Cloud instances need the operator's consent

block-cloud-instances refuses a shell command that runs a cloud provider's command line until the operator has directly consented to operations on cloud instances. It runs before every shell call; reads of files, edits and other tools are never touched.

#Why it exists

Cloud instances cost money and hold the fleet's work. The operator's rule is that no operation on a cloud instance — creating, starting, stopping, resizing, deleting, listing or running on one — happens unless he said so himself, and that his consent is kept in a record rather than inferred from the task.

#What is refused

Every command segment is read, one shell level down as well (bash -c '…'), and the program it runs is compared with the provider command lines the gate declares in rust/crates/tama-hook-tools/src/ports/block_cloud_instances/programs.json: gcloud, aws, az, vastai, runpodctl, doctl, hcloud, oci, ibmcloud and linode-cli. Every call of such a program waits for consent, listing included: which call of a provider's command line touches an instance is not decided by reading its words.

The refusal names the program, its provider and the capability to record:

block-cloud-instances: BLOCKED: `gcloud` operates on Google Cloud cloud instances, and no operation on a cloud instance runs without the operator's direct consent. He gives it in the conversation; record it as the Tama session capability {"tool":"cloud"} with the lifetime he names, which he confirms, then run the command.

#What passes

• A command with --help or -h, which runs nothing.
• A command that only names a provider as an argument, such as echo gcloud or grep -rn vastai docs.
• Stado's own commands: placement through the fleet is Stado's work, not an agent's call of a provider.
• Any provider command in a session whose recorded capability grants {"tool": "cloud"}.

#Giving consent

The operator says in the conversation that the agent may operate on cloud instances, and for how long. The agent records it by writing {"grants":[{"tool":"cloud"}],"lifetime":"single-use"} (or expires-at or current-session, as he named it) to xd://tama_request_session_capability. A capability an agent asks for is granted only when the operator confirms it, and the session's capability file in Tama's session-control directory keeps that confirmation for the lifetime he named. tama sessions capability revoke --session <ID> --agent <harness> withdraws it at once.

#Source and test

The policy: rust/crates/tama-hook-tools/src/ports/block_cloud_instances/mod.rs; the program: rust/crates/tama-hook-tools/src/programs/block/consent/block_cloud_instances.rs; the declaration: hook-declarations/operator-consent/block-cloud-instances.json; the real test: tests/cloud-instances/consent.rs, which runs the built hook on shell payloads. Declared with tama hooks declare --file <declaration> and installed with tama hooks release, both under the operator's consent; which hooks this machine runs is decided by tama enforcement only <hook-id>….