# Nexus Policy Enforcement 1.0 — Evidence Summary

Complete, consistent shell-side policy enforcement. Denied apps and features are **removed from UI** (invisible), not grayed out or disabled. No registry, GPO, or Windows changes. Agent `GET /agent/policies` remains read-only.

## Build

```
dotnet build source/nexus-shell/NexusShell/NexusShell.csproj -c Release
```

**Result:** PASS (0 errors)

## Central gate: `NexusPolicyService`

All enforcement flows through one service:

| Method | Purpose |
|--------|---------|
| `CanLaunchApp(appKey \| AppEntry)` | Single launch gate (apps + rules + role + trust) |
| `FilterVisibleApps(apps)` | Launcher/catalog filtering (alias: `FilterApps`) |
| `CanOpenBrowser()` / `CanOpenFiles()` / `CanOpenDeviceManager()` | Feature + app combined gates |
| `CanOpenPhotos()` / `CanOpenMedia()` / `CanOpenCalculator()` / `CanOpenSettings()` | Per-surface gates |
| `CanAccessConsole()` / `CanAccessStore()` | Console and store access |
| `IsDockItemAllowed(label)` | Dock visibility |
| `IsCommandAllowed(command)` | Console commands (before whitelist) |
| `IsSettingsSectionAllowed(section)` | Settings nav filtering |
| `IsPackageAllowed(packageId)` | Store package filtering |

`NexusPolicyEvaluator` now evaluates **RequireRole** and **RequireTrust** rules (with device trust from `NexusIdentityService`) in addition to allow/deny lists.

## Enforcement matrix

| Surface | Hide (UI) | Block launch / deep link |
|---------|-----------|---------------------------|
| **Launcher grid** | `FilterVisibleApps` on search + pinned lists | `CanLaunchApp` in `Launch()` — silent deny |
| **Launcher "Se flere i Files"** | `CanOpenFiles` → `Visibility` collapsed | `OpenFiles()` silent deny |
| **Dock** | `RefreshDockItems` filters items | `HandleDockItem` policy check per action |
| **Store catalog** | `NexusStoreService.GetAllItems` filters packages | `OpenStore()` silent deny |
| **Console commands** | N/A (console hidden for User) | `IsCommandAllowed` before whitelist |
| **Console apps-list** | Lists only `FilterVisibleApps` | — |
| **Settings nav** | `VisibleNavItems` hides denied sections | `OpenSettings()` gated |
| **Settings console button** | `CanOpenNexusConsole` visibility | — |
| **Device Manager** | Hidden from launcher (deny app) | `OpenDeviceManager()` silent deny |
| **Browser** | Hidden when denied | `OpenBrowser()` silent deny |
| **Files** | Hidden when denied | `OpenFiles()` silent deny |
| **External apps** | Hidden from launcher | `AppLaunchService` → `CanLaunchApp` |
| **Keyboard Ctrl+Shift+Alt+N** | — | Opens console only if `CanAccessConsole()` |
| **Store → nexus:console/files/browser** | Packages filtered | `MainWindow` open methods gated |
| **Agent** | — | Read-only snapshot only (no OS enforcement) |

## Example User policy (`default-user.json`)

**Visible apps:** desktop, files, browser, photos, settings, launcher  
**Invisible (denied):** console, device-manager, store, terminal, hub, media, calculator  
**Developer role:** `default-developer.json` — all apps/features allowed

## Integration points (changed)

### Policy core
- `Services/Policy/NexusPolicyEvaluator.cs` — rules engine with role + trust
- `Services/Policy/NexusPolicyService.cs` — centralized gates, identity trust

### Surfaces
- `ViewModels/LauncherViewModel.cs` — pinned filter fix, `CanOpenFiles`, silent launch deny
- `ViewModels/DesktopViewModel.cs` — dock actions gated
- `MainWindow.xaml.cs` — all window open paths gated; silent deny (no message boxes)
- `Services/AppLaunchService.cs` — policy before lockdown
- `Services/NexusConsoleService.cs` — filtered `apps-list`
- `Views/LauncherOverlay.xaml` — Files shortcut hidden when denied
- `App.xaml.cs` — policy service wired with `NexusIdentityService`

### Policy seed
- `Assets/Policies/default-user.json` — mission example (deny console, device-manager)

## Gaps remaining (out of scope)

| Gap | Notes |
|-----|-------|
| **Cached policy on disk** | `%LocalAppData%/NinjaNexus/policies/` is seeded once; delete stale copies to pick up new seed defaults |
| **Remote policy sync** | Identity API `PolicyService` not consumed; local JSON only |
| **DashboardViewModel** | Legacy surface; not wired to policy (unused in MainWindow flow) |
| **Developer Console window** | Separate from Nexus Console; still lockdown-gated only |
| **RequireTrust in seed JSON** | Evaluator supports it; no default policies use RequireTrust yet |
| **OS-level enforcement** | By design — agent read-only per mission constraints |
| **Audit log of denials** | Silent deny by design; no user-visible or audit trail in v1 |

## Changed files

```
source/nexus-shell/NexusShell/Services/Policy/NexusPolicyEvaluator.cs
source/nexus-shell/NexusShell/Services/Policy/NexusPolicyService.cs
source/nexus-shell/NexusShell/Services/AppLaunchService.cs
source/nexus-shell/NexusShell/Services/NexusConsoleService.cs
source/nexus-shell/NexusShell/ViewModels/LauncherViewModel.cs
source/nexus-shell/NexusShell/ViewModels/DesktopViewModel.cs
source/nexus-shell/NexusShell/MainWindow.xaml.cs
source/nexus-shell/NexusShell/Views/LauncherOverlay.xaml
source/nexus-shell/NexusShell/App.xaml.cs
source/nexus-shell/NexusShell/Assets/Policies/default-user.json
source/nexus-shell/NexusShell/Services/Deployment/*.cs (missing System.IO — build fix)
docs/evidence/nexus-policy-enforcement-v1/SUMMARY.md
```
