# Nexus Policy Engine Foundation v1 — Evidence Summary

Shell-side policy evaluation foundation — **read/evaluate only**. No lockdown, registry, GPO, or Windows enforcement.

## Scope delivered

| Area | Status |
|------|--------|
| `NexusPolicy` + role/rule models | Done |
| `NexusPolicyStore` (local JSON, `%LocalAppData%/NinjaNexus/policies/`) | Done |
| `NexusPolicyEvaluator` + `NexusPolicyService` | Done |
| Role defaults (`User` … `MasterDeveloper`) | Done |
| Launcher hides denied apps | Done |
| Store filters packages by policy | Done |
| Console command policy evaluation | Done |
| Settings hides denied sections | Done |
| Agent `GET /agent/policies` (read-only snapshot) | Done |
| `dotnet build NexusShell -c Release` | **PASS** (0 errors) |

## Policy model

**Location:** `source/nexus-shell/NexusShell/Services/Policy/`

| Type | Purpose |
|------|---------|
| `NexusRole` | `User`, `PowerUser`, `Administrator`, `Developer`, `MasterDeveloper` |
| `NexusPolicyType` | App, Feature, Device, Console, Developer, Store, Remote access categories |
| `NexusPolicyRuleType` | `AllowApp`, `DenyApp`, `AllowFeature`, `DenyFeature`, `RequireRole`, `RequireTrust` |
| `NexusPolicy` | JSON document: allow/deny lists + rules |
| `NexusRolePolicy` | Role-bound policy with source path |
| `NexusPolicySnapshot` | Agent/API read-only export |

**Evaluation semantics (POC):**

1. Explicit **deny** wins over allow.
2. If `allowApps` / `allowCommands` / `allowFeatures` is non-empty, target must be listed.
3. Empty allow list = no extra restriction (deny-only mode).
4. `RequireRole` rules gate features (e.g. console requires `Developer`).

**Sample JSON** (`Assets/Policies/default-user.json`):

```json
{
  "role": "User",
  "allowApps": ["files", "browser", "photos", "media", "calculator", "settings", "launcher"],
  "denyApps": ["console", "device-manager", "store", "terminal", "hub"]
}
```

## Role defaults

| File | Role | Notable restrictions |
|------|------|----------------------|
| `default-user.json` | User | No store, console, terminal, device-manager; limited console commands |
| `default-poweruser.json` | PowerUser | Store + device-manager; no console |
| `default-administrator.json` | Administrator | Full settings; console still requires Developer |
| `default-developer.json` | Developer | Full console + all apps |
| `default-masterdeveloper.json` | MasterDeveloper | Unrestricted (empty deny lists) |

Seeded on first run from `Assets/Policies/` → `%LocalAppData%/NinjaNexus/policies/`.

## Integration points

| Surface | Integration |
|---------|-------------|
| **Launcher** | `LauncherViewModel` filters `PinnedApps` via `NexusPolicyService.FilterApps`; launch blocked if denied |
| **Dock** | `DesktopViewModel.RefreshDockItems()` hides Terminal etc. per policy |
| **Store** | `NexusStoreService.GetAllItems()` filters packages; `MainWindow.OpenStore()` checks `CanAccessStore()` |
| **Console** | `NexusConsoleService` checks `IsCommandAllowed()` before registry whitelist |
| **Settings** | `NexusSettingsViewModel.VisibleNavItems` hides `ControlCenter`, `Identity` for User |
| **Agent** | `GET http://127.0.0.1:{port}/agent/policies` returns `NexusAgentPoliciesResponse` |

## Agent endpoint

```
GET /agent/policies
```

Returns current role, policy id/name/version, allow/deny lists, `consoleAccess`, `storeAccess`, `evaluationMode: "read-only"`.

## Future enforcement plan

1. **Sync** — pull org policies from Identity API `PolicyService` post-enrollment; merge with local role defaults.
2. **Enforcement** — agent applies device trust + remote policy snapshot on heartbeat ack.
3. **Lockdown bridge** — replace hardcoded `LockdownService` lists with evaluated policy bundles.
4. **GPO layer** — separate sprint; map Nexus policies to Windows settings (out of v1 scope).
5. **Audit** — log policy denials to console audit + Control Center.

## Backend note

Platform sprint `NexusIdentity.Api/Services/PolicyService.cs` is **unchanged**. Shell uses its own `NexusPolicyStore` for POC. Remote policies can be consumed later without modifying this sprint's shell evaluator.

## Changed / added files

### New — Policy engine
- `Services/Policy/NexusRole.cs`
- `Services/Policy/NexusPolicyType.cs`
- `Services/Policy/NexusPolicyRuleType.cs`
- `Services/Policy/NexusPolicyRule.cs`
- `Services/Policy/NexusPolicy.cs`
- `Services/Policy/NexusRolePolicy.cs`
- `Services/Policy/NexusPolicyAppKeys.cs`
- `Services/Policy/NexusPolicySnapshot.cs`
- `Services/Policy/NexusPolicyStore.cs`
- `Services/Policy/NexusPolicyEvaluator.cs`
- `Services/Policy/NexusPolicyService.cs`
- `Assets/Policies/default-*.json` (5 role files)

### Modified — Shell integration
- `App.xaml.cs` — DI wiring
- `ViewModels/LauncherViewModel.cs`
- `ViewModels/DesktopViewModel.cs`
- `ViewModels/NexusSettingsViewModel.cs`
- `Views/NexusSettingsView.xaml`
- `Services/NexusConsoleService.cs`
- `Services/NexusStoreService.cs`
- `MainWindow.xaml.cs`
- `Agent/NexusAgentService.cs`
- `Agent/NexusAgentRuntimeState.cs`
- `Agent/Models/NexusAgentApiModels.cs`
- `NexusShell.csproj` — copy policy JSON assets

### Evidence
- `docs/evidence/nexus-policy-engine-v1/SUMMARY.md` (this file)
- `docs/evidence/nexus-policy-engine-v1/SCREENSHOT-NOTES.md`

## Build

```
dotnet build source/nexus-shell/NexusShell/NexusShell.csproj -c Release
```

Result: **0 errors** (pre-existing warnings only).

## Git status (snapshot)

Policy engine files are **uncommitted** local changes under `Ninja Nexus/source/nexus-shell/` and `docs/evidence/nexus-policy-engine-v1/`. No commit was made per mission scope.
