103 lines
1.8 KiB
Markdown
103 lines
1.8 KiB
Markdown
# Monty External Functions (Allowlist Example)
|
|
|
|
Monty supports host interaction only through **explicit external functions**
|
|
provided by the embedding application.
|
|
|
|
In ThreeGate, adding external functions is a **security boundary change**.
|
|
|
|
This document provides a *minimal, safe* example set suitable for review.
|
|
|
|
---
|
|
|
|
## Design Rules (Non-Negotiable)
|
|
|
|
External functions must be:
|
|
|
|
- Pure (no side effects)
|
|
- Deterministic
|
|
- Resource bounded
|
|
- Non-reflective (no introspection)
|
|
- Non-I/O (no files, no network, no env)
|
|
|
|
If a function violates any of these, it does **not belong in Monty**.
|
|
|
|
---
|
|
|
|
## Recommended Initial Allowlist
|
|
|
|
### Cryptographic Hashing
|
|
|
|
```python
|
|
def sha256_hex(s: str) -> str:
|
|
import hashlib
|
|
return hashlib.sha256(s.encode("utf-8")).hexdigest()
|
|
````
|
|
|
|
Use cases:
|
|
|
|
* Deduplication
|
|
* Content fingerprinting
|
|
* Integrity checks
|
|
|
|
---
|
|
|
|
### Regex Utilities
|
|
|
|
```python
|
|
def regex_findall(pattern: str, text: str) -> list[str]:
|
|
import re
|
|
return re.findall(pattern, text)
|
|
```
|
|
|
|
Use cases:
|
|
|
|
* Structured extraction
|
|
* Validation
|
|
* Parsing bounded text
|
|
|
|
---
|
|
|
|
### JSON Utilities
|
|
|
|
```python
|
|
def json_loads(s: str):
|
|
import json
|
|
return json.loads(s)
|
|
|
|
def json_dumps(obj) -> str:
|
|
import json
|
|
return json.dumps(obj, sort_keys=True)
|
|
```
|
|
|
|
Use cases:
|
|
|
|
* Deterministic serialization
|
|
* Schema normalization
|
|
|
|
---
|
|
|
|
## Explicitly Forbidden Examples
|
|
|
|
🚫 File access (`open`, `pathlib`)
|
|
🚫 Time access (`time.time`, `datetime.now`)
|
|
🚫 Randomness
|
|
🚫 Network
|
|
🚫 Subprocess
|
|
🚫 Environment access
|
|
|
|
---
|
|
|
|
## Policy Statement
|
|
|
|
> Any addition, removal, or modification of Monty external functions must be
|
|
> reviewed as a **capability escalation** and documented in `policy/tool-exec.policy.md`.
|
|
|
|
---
|
|
|
|
## Summary
|
|
|
|
Monty is safest when it behaves like a **pure function evaluator**.
|
|
|
|
If you need I/O, persistence, or non-determinism:
|
|
→ escalate to ERA instead.
|