Split from #47 (finding K2) - feature-sized, tracked on its own.
Evaluation currently runs with the process's full ambient authority: an
evaluated expression can read any file (readFile, import), reach the
environment (getEnv), write to the store (toFile, source copies), and
reach the network through the fetchers. Evaluating an expression from an
outside source therefore means trusting it with everything the process
can do.
Upstream separates these concerns with restricted-eval and pure-eval
modes that gate filesystem reads to declared roots, hide the ambient
environment, and disable or pin network fetches. nova-nix wants the same
shape: an eval mode that gates each ambient capability behind policy
carried in the eval state, with the CLI choosing the mode.
The MonadEval effect class is the natural seam: every ambient capability
is already a method, so a restricted instance (or a policy check inside
EvalIO) covers them all without touching the evaluator core.
Split from #47 (finding K2) - feature-sized, tracked on its own.
Evaluation currently runs with the process's full ambient authority: an
evaluated expression can read any file (readFile, import), reach the
environment (getEnv), write to the store (toFile, source copies), and
reach the network through the fetchers. Evaluating an expression from an
outside source therefore means trusting it with everything the process
can do.
Upstream separates these concerns with restricted-eval and pure-eval
modes that gate filesystem reads to declared roots, hide the ambient
environment, and disable or pin network fetches. nova-nix wants the same
shape: an eval mode that gates each ambient capability behind policy
carried in the eval state, with the CLI choosing the mode.
The MonadEval effect class is the natural seam: every ambient capability
is already a method, so a restricted instance (or a policy check inside
EvalIO) covers them all without touching the evaluator core.