# HMP project profile — TEMPLATE ONLY (not a built-in Pico policy or enforced schema)
# Copy for each project, fill values, have a human owner approve it, and version-control it.
# DO NOT interpret this file as an authorization token.
profile_schema: "0.1.0-proposal"
status: "template_only"            # change only after owner approval + actual enforcement
core_document: "hmp.md"             # pin/record the exact content version for runs

mandate:
  id: "REPLACE_WITH_STABLE_MANDATE_ID"
  version: "0.1.0"
  owner_role: "REPLACE_WITH_HUMAN_ROLE"
  purpose: "REPLACE_WITH_APPROVED_OBJECTIVE"
  permitted_resource_scopes: []      # explicit repo/dataset/service IDs
  out_of_scope: []                  # explicit exclusions
  expires_at: null                 # use an actual timestamp before consequential execution
  limits:
    cost_eur: null                  # replace with project-specific bound if applicable
    max_affected_repositories: 1

# These are decision CLASSES, not a complete permission schema.
# They complement but cannot expand existing repo/tool execution permissions.
action_classes:
  - id: "local_isolated_code_changes"
    decision: "allow"
    examples: ["modify code in authorized worktree", "run local tests"]
    conditions:
      - "target is explicitly in mandate scope"
      - "no higher-priority policy prohibits the action"
  - id: "expand_permissions_or_scope"
    decision: "hmp_required"
    trigger: "HMP-AUTHORITY"
    human_role: "REPLACE_WITH_HUMAN_ROLE"
  - id: "change_scientific_acceptance_criteria"
    decision: "hmp_required"
    trigger: "HMP-VALUES"
    human_role: "REPLACE_WITH_SCIENTIFIC_OWNER_ROLE"
  - id: "change_enforcement_policy"
    decision: "hmp_required"
    trigger: "HMP-GOVERNANCE"
    human_role: "REPLACE_WITH_GOVERNANCE_OWNER_ROLE"
  - id: "exfiltrate_restricted_data"
    decision: "deny"

review:
  per_case_human_reserved: []        # add case-specific obligations (if any)
  preapprovable_classes: []          # each requires scope, constraints, expiry and a human-issued mandate
  acceptable_evidence: ["action_diff", "test_results", "provenance", "risk_assessment"]
  approvals_source: "not_configured"  # MUST be independent of agent-editable content
  default_on_missing_authority: "unresolved"

enforcement:
  mode: "documentation_only"      # not a security boundary; change only when implemented
  required_paths: []               # list actual tool/action interception points
  on_timeout: "deny_affected_action"
  forbid_approval_from_agent_text: true
  require_action_binding: true
  require_policy_version_binding: true
  audit_automatically_allowed_actions: true