feat(policy): support persistent baseline network policy exclusions

docs/reference/network-policies.mdx

@@ -136,6 +136,7 @@ Apply maintained presets such as `github`, `pypi`, or `tavily` only when the san
 
 During onboarding, the wizard prompts for a policy tier that determines the default set of presets applied on top of the baseline policy.
 The baseline policy is always applied regardless of the selected tier.
+An operator can persistently exclude a specific baseline entry with [`policy exclude`](#excluding-a-baseline-entry) when they accept reduced, unsupported functionality; excluded entries are the only baseline changes that survive rebuild.
 
 | Tier | Presets included | Description |
 |------|------------------|-------------|
@@ -290,3 +291,27 @@ Edit or review `current-policy.yaml`, then apply it:
 ```bash
 openshell policy set --policy current-policy.yaml --wait <sandbox-name>
 ```
+
+### Excluding a baseline entry
+
+The baseline policy applies to every sandbox, but an operator can persistently exclude a specific baseline entry when they accept reduced, unsupported functionality in exchange for tighter egress.
+
+Preview the exact scope, then exclude an exact baseline key:
+
+```bash
+$$nemoclaw <sandbox-name> policy exclude <key> --dry-run
+$$nemoclaw <sandbox-name> policy exclude <key> --force
+```
+
+The command prints every endpoint, method/path rule, and binary the exclusion removes, and requires explicit acknowledgement (`--force` in non-interactive use).
+The exclusion is bound to the reviewed entry content, recorded in the sandbox registry, and replayed on rebuild.
+If a later release changes or removes that entry, create and rebuild fail closed and require re-review.
+
+List active exclusions with `policy list`.
+Restore an entry against the current baseline and clear its exclusion:
+
+```bash
+$$nemoclaw <sandbox-name> policy restore <key>
+```
+
+Excluding a baseline entry leaves agent features that depend on it unsupported for that sandbox.

scripts/checks/openshell-policy-mutation-read.mts

@@ -44,7 +44,7 @@ export const MUTATION_READS: readonly AuditedMutationRead[] = [
   },
   {
     relativePath: "src/lib/policy/index.ts",
-    expectedReadCalls: 6,
+    expectedReadCalls: 7,
     baseCommand: "runCapture(buildPolicyGetCommand(sandboxName))",
     unsafeBaseCommand: "runCapture(buildPolicyGetCommand(sandboxName), { ignoreError: true })",
     fullCommand: "runCapture(buildPolicyGetFullCommand(sandboxName), { ignoreError: true })",

src/commands/sandbox/policy/exclude.ts

@@ -0,0 +1,34 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { excludeSandboxBaseline } from "../../../lib/actions/sandbox/policy-channel";
+import { NemoClawCommand } from "../../../lib/cli/nemoclaw-oclif-command";
+
+import {
+  commonPolicyOptions,
+  policyBaselineArgs,
+  policyMutationFlags,
+} from "../../../lib/sandbox/policy-command-support";
+
+export default class PolicyExcludeCommand extends NemoClawCommand {
+  static id = "sandbox:policy:exclude";
+  static strict = true;
+  static summary = "Exclude an entry from the agent baseline policy";
+  static description =
+    "Persistently exclude an exact baseline network policy entry from a sandbox. The removed egress and its support impact are previewed before mutation, and the exclusion is replayed across rebuild.";
+  static usage = ["<name> <key> [--force|-f] [--yes|-y] [--dry-run]"];
+  static examples = [
+    "<%= config.bin %> sandbox policy exclude alpha nous_research --force",
+    "<%= config.bin %> sandbox policy exclude alpha nous_research --dry-run",
+  ];
+  static args = policyBaselineArgs;
+  static flags = policyMutationFlags;
+
+  public async run(): Promise<void> {
+    const { args, flags } = await this.parse(PolicyExcludeCommand);
+    await excludeSandboxBaseline(args.sandboxName, {
+      key: args.key,
+      ...commonPolicyOptions(flags),
+    });
+  }
+}

src/commands/sandbox/policy/mutate.test.ts

@@ -6,12 +6,16 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 const mocks = vi.hoisted(() => ({
   addSandboxPolicy: vi.fn().mockResolvedValue(undefined),
   removeSandboxPolicy: vi.fn().mockResolvedValue(undefined),
+  excludeSandboxBaseline: vi.fn().mockResolvedValue(undefined),
+  restoreSandboxBaseline: vi.fn().mockResolvedValue(undefined),
 }));
 
 vi.mock("../../../lib/actions/sandbox/policy-channel", () => mocks);
 
 import PolicyAddCommand from "./add";
+import PolicyExcludeCommand from "./exclude";
 import PolicyRemoveCommand from "./remove";
+import PolicyRestoreCommand from "./restore";
 
 const rootDir = process.cwd();
 
@@ -65,4 +69,32 @@ describe("policy mutation oclif commands", () => {
 
     expect(mocks.addSandboxPolicy).not.toHaveBeenCalled();
   });
+
+  it("maps policy-exclude args to typed baseline options", async () => {
+    await PolicyExcludeCommand.run(["alpha", "nous_research", "--force"], rootDir);
+
+    expect(mocks.excludeSandboxBaseline).toHaveBeenCalledWith("alpha", {
+      key: "nous_research",
+      yes: false,
+      force: true,
+      dryRun: false,
+    });
+  });
+
+  it("maps policy-restore args to typed baseline options", async () => {
+    await PolicyRestoreCommand.run(["alpha", "nous_research", "--dry-run"], rootDir);
+
+    expect(mocks.restoreSandboxBaseline).toHaveBeenCalledWith("alpha", {
+      key: "nous_research",
+      yes: false,
+      force: false,
+      dryRun: true,
+    });
+  });
+
+  it("requires an explicit baseline key before dispatch", async () => {
+    await expect(PolicyExcludeCommand.run(["alpha"], rootDir)).rejects.toThrow();
+
+    expect(mocks.excludeSandboxBaseline).not.toHaveBeenCalled();
+  });
 });

src/commands/sandbox/policy/restore.ts

@@ -0,0 +1,34 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { restoreSandboxBaseline } from "../../../lib/actions/sandbox/policy-channel";
+import { NemoClawCommand } from "../../../lib/cli/nemoclaw-oclif-command";
+
+import {
+  commonPolicyOptions,
+  policyBaselineArgs,
+  policyMutationFlags,
+} from "../../../lib/sandbox/policy-command-support";
+
+export default class PolicyRestoreCommand extends NemoClawCommand {
+  static id = "sandbox:policy:restore";
+  static strict = true;
+  static summary = "Restore a previously excluded baseline entry";
+  static description =
+    "Restore an excluded baseline network policy entry against the current release baseline and drop its recorded exclusion.";
+  static usage = ["<name> <key> [--dry-run]"];
+  static examples = [
+    "<%= config.bin %> sandbox policy restore alpha nous_research",
+    "<%= config.bin %> sandbox policy restore alpha nous_research --dry-run",
+  ];
+  static args = policyBaselineArgs;
+  static flags = policyMutationFlags;
+
+  public async run(): Promise<void> {
+    const { args, flags } = await this.parse(PolicyRestoreCommand);
+    await restoreSandboxBaseline(args.sandboxName, {
+      key: args.key,
+      ...commonPolicyOptions(flags),
+    });
+  }
+}

src/lib/actions/root-help.ts

@@ -92,7 +92,7 @@ export function help(): void {
     `    ${D}• Check inference route:   ${CLI_NAME} inference get${R}`,
     `    ${D}• Change inference model:  ${CLI_NAME} inference set --model <model> --provider <provider>${R}`,
   );
-  lines.push(`    ${D}• Add network presets:     use the policy-add command on your sandbox${R}`);
+  lines.push(`    ${D}• Add network presets:     use the policy add command on your sandbox${R}`);
   lines.push(
     `    ${D}• Change credentials:      credentials reset <PROVIDER>, then re-run onboard${R}`,
   );

src/lib/actions/sandbox/channel-status.ts

@@ -538,7 +538,7 @@ function buildBasicChannelReport(
       : `${policyLabel} preset not applied`,
     hint: presetInRegistry
       ? undefined
-      : `run \`${CLI_NAME} ${sandboxName} policy-add ${policyPresets[0]}\``,
+      : `run \`${CLI_NAME} ${sandboxName} policy add ${policyPresets[0]}\``,
   });
   if (enabled) {
     signals.push(...buildConfigStatusSignals(sandboxName, channelName, entry, agent, deps));

src/lib/actions/sandbox/exec-policy-hint-rendering.test.ts

@@ -11,8 +11,8 @@ describe("buildPolicyDenialExecHint (#5978)", () => {
     ["the denied endpoint", "example.com:443"],
     ["the sandbox name", "oc-fresh"],
     ["the logs breadcrumb", "nemoclaw oc-fresh logs --tail 50"],
-    ["the policy-list review breadcrumb", "nemoclaw oc-fresh policy-list"],
-    ["the policy-add allow-path breadcrumb", "nemoclaw oc-fresh policy-add <preset>"],
+    ["the policy-list review breadcrumb", "nemoclaw oc-fresh policy list"],
+    ["the policy-add allow-path breadcrumb", "nemoclaw oc-fresh policy add <preset>"],
     ["the opt-out env", POLICY_HINT_SUPPRESS_ENV],
   ])("names %s", (_label, expected) => {
     expect(hint).toContain(expected);
@@ -52,7 +52,7 @@ describe("buildPolicyDenialExecHint (#5978)", () => {
   ])("renders the <name> placeholder for an unsafe sandbox name: %s", (_label, unsafe) => {
     const hint = buildPolicyDenialExecHint("nemoclaw", unsafe, "example.com:443");
     expect(hint).toContain("nemoclaw <name> logs --tail 50");
-    expect(hint).toContain("nemoclaw <name> policy-add <preset>");
+    expect(hint).toContain("nemoclaw <name> policy add <preset>");
     expect(hint).not.toContain(unsafe);
     expect(hint).not.toContain("");
   });

src/lib/actions/sandbox/exec-policy-hint-rendering.ts

@@ -23,8 +23,8 @@ export function buildPolicyDenialExecHint(
     `${cliName}: recent network policy denial detected${target} inside sandbox '${sandboxName}'.`,
     "  The sandbox's egress policy blocked this request; the tool above only saw the proxy's 403.",
     `  See the denied flow:    ${cliName} ${sandboxName} logs --tail 50`,
-    `  Review applied presets: ${cliName} ${sandboxName} policy-list`,
-    `  Allow the host:         ${cliName} ${sandboxName} policy-add <preset>`,
+    `  Review applied presets: ${cliName} ${sandboxName} policy list`,
+    `  Allow the host:         ${cliName} ${sandboxName} policy add <preset>`,
     `  Silence this hint:      export ${POLICY_HINT_SUPPRESS_ENV}=1`,
   ].join("\n");
 }

src/lib/actions/sandbox/policy-channel-baseline.test.ts

@@ -0,0 +1,151 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { afterEach, beforeEach, describe, expect, it, type MockInstance, vi } from "vitest";
+
+import * as store from "../../credentials/store";
+import * as policies from "../../policy";
+import type { PolicyObject } from "../../policy/preset-parsing";
+import * as registry from "../../state/registry";
+
+vi.mock("../../state/mcp-lifecycle-lock", () => ({
+  withSandboxMutationLock: <T>(_name: string, action: () => Promise<T>) => action(),
+}));
+vi.mock("./policy-context-refresh", () => ({
+  refreshSandboxPolicyContextFile: vi.fn(),
+}));
+
+import { excludeSandboxBaseline, restoreSandboxBaseline } from "./policy-channel";
+
+class ExitError extends Error {
+  constructor(public readonly code: number | undefined) {
+    super(`process.exit(${code})`);
+  }
+}
+
+const BASE_CONTENT = `version: 1
+network_policies:
+  nous_research:
+    name: nous_research
+    endpoints:
+      - host: nousresearch.com
+        port: 443
+        rules:
+          - allow: { method: GET, path: "/**" }
+  managed_inference:
+    name: managed_inference
+    endpoints:
+      - host: inference.local
+`;
+
+const NOUS_ENTRY: PolicyObject = {
+  name: "nous_research",
+  endpoints: [{ host: "nousresearch.com", port: 443 }],
+};
+
+let exitSpy: MockInstance;
+let promptMock: MockInstance;
+let excludeBaselineEntryMock: MockInstance;
+let restoreBaselineEntryMock: MockInstance;
+let getBaselineExclusionsMock: MockInstance;
+
+async function captureExit(action: () => Promise<void>): Promise<number | undefined> {
+  try {
+    await action();
+  } catch (error) {
+    if (error instanceof ExitError) return error.code;
+    throw error;
+  }
+  throw new Error("Expected process.exit to be called");
+}
+
+beforeEach(() => {
+  delete process.env.NEMOCLAW_NON_INTERACTIVE;
+  vi.spyOn(console, "log").mockImplementation(() => undefined);
+  vi.spyOn(console, "error").mockImplementation(() => undefined);
+  exitSpy = vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
+    throw new ExitError(code);
+  }) as never);
+  promptMock = vi.spyOn(store, "prompt").mockResolvedValue("y");
+
+  vi.spyOn(registry, "getSandbox").mockReturnValue({ name: "alpha", agent: "hermes" });
+  getBaselineExclusionsMock = vi.spyOn(registry, "getBaselineExclusions").mockReturnValue([]);
+
+  vi.spyOn(policies, "resolveSandboxBaselinePolicy").mockReturnValue({
+    policyPath: "/repo/policy-additions.yaml",
+    content: BASE_CONTENT,
+  });
+  vi.spyOn(policies, "getSandboxBaselineEntry").mockImplementation((_sandbox, key) =>
+    key === "nous_research" ? NOUS_ENTRY : null,
+  );
+  vi.spyOn(policies, "getSandboxBaselineEntryDigest").mockReturnValue("digest-1");
+  excludeBaselineEntryMock = vi.spyOn(policies, "excludeBaselineEntry").mockReturnValue(true);
+  restoreBaselineEntryMock = vi.spyOn(policies, "restoreBaselineEntry").mockReturnValue(true);
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  delete process.env.NEMOCLAW_NON_INTERACTIVE;
+});
+
+describe("excludeSandboxBaseline (#7178)", () => {
+  it("exits on an unknown baseline key without mutating", async () => {
+    const code = await captureExit(() =>
+      excludeSandboxBaseline("alpha", { key: "absent", force: true }),
+    );
+    expect(code).toBe(1);
+    expect(excludeBaselineEntryMock).not.toHaveBeenCalled();
+  });
+
+  it("refuses to exclude a protected baseline entry", async () => {
+    vi.spyOn(policies, "getSandboxBaselineEntry").mockReturnValue({ name: "managed_inference" });
+    const code = await captureExit(() =>
+      excludeSandboxBaseline("alpha", { key: "managed_inference", force: true }),
+    );
+    expect(code).toBe(1);
+    expect(excludeBaselineEntryMock).not.toHaveBeenCalled();
+  });
+
+  it("requires explicit acknowledgement in non-interactive mode", async () => {
+    process.env.NEMOCLAW_NON_INTERACTIVE = "1";
+    const code = await captureExit(() => excludeSandboxBaseline("alpha", { key: "nous_research" }));
+    expect(code).toBe(1);
+    expect(excludeBaselineEntryMock).not.toHaveBeenCalled();
+  });
+
+  it("excludes with a bound digest when acknowledged via --force", async () => {
+    await excludeSandboxBaseline("alpha", { key: "nous_research", force: true });
+    expect(promptMock).not.toHaveBeenCalled();
+    expect(excludeBaselineEntryMock).toHaveBeenCalledWith(
+      "alpha",
+      "nous_research",
+      expect.any(String),
+    );
+  });
+
+  it("does not mutate on --dry-run", async () => {
+    await excludeSandboxBaseline("alpha", { key: "nous_research", dryRun: true });
+    expect(excludeBaselineEntryMock).not.toHaveBeenCalled();
+  });
+
+  it("aborts when the interactive confirmation is declined", async () => {
+    promptMock.mockResolvedValue("n");
+    await excludeSandboxBaseline("alpha", { key: "nous_research" });
+    expect(excludeBaselineEntryMock).not.toHaveBeenCalled();
+  });
+});
+
+describe("restoreSandboxBaseline (#7178)", () => {
+  it("exits when the key is not excluded", async () => {
+    getBaselineExclusionsMock.mockReturnValue([]);
+    const code = await captureExit(() => restoreSandboxBaseline("alpha", { key: "nous_research" }));
+    expect(code).toBe(1);
+    expect(restoreBaselineEntryMock).not.toHaveBeenCalled();
+  });
+
+  it("restores a recorded exclusion", async () => {
+    getBaselineExclusionsMock.mockReturnValue([{ key: "nous_research", digest: "digest-1" }]);
+    await restoreSandboxBaseline("alpha", { key: "nous_research" });
+    expect(restoreBaselineEntryMock).toHaveBeenCalledWith("alpha", "nous_research");
+  });
+});