[robertjamesprior]

Summary

Readers copy the destination table and the CSP snippets on /info/network-access straight into firewalls and Content Security Policies. Two things were missing: the page never said Kernel would keep those destinations stable, and nothing checked that the table, its own CSP snippet and the platform agreed. The table and the snippet have already drifted apart once.

• What we commit to section: the destinations and ports on the page do not change without a changelog entry and advance notice, plus the three things inside the page's scope that are deliberately not covered (the hostname inside a wildcard, which metro serves a session, egress IPs).
• compat/network_surface.json is vendored byte-identical from kernel/kernel contracts/network-surface.json, which validates its own shape in that repo and is what the Ansible inventory validator checks host domains against, so the promise, the page and the assertion are one object.
• The surface lists ports ascending, so the table check compares the port cell to the list and a CSP source with no port counts as 443. The page already published both ports; this brings the surface up to it.
• scripts/check_network_surface.py asserts the destination table, the Live View CSP block and the stated exclusions all match the surface. Wired to a new workflow on every pull request.

The commitment is scoped to this page's subject on purpose. It says nothing about API response shapes, error codes or SDK signatures, which have no equivalent published page yet, so it cannot accidentally disclaim them.

Testing

python3 scripts/check_network_surface.py passes against the page as it stands, which confirms the vendored surface matches what is already published rather than restating it. Verified the negative cases by removing a host from the table (ports ['8443'] != ['443', '8443']) and by dropping the portless origins from the CSP block, which fails naming the missing *.onkernel.com:443 and *.kernel.sh:443. Confirmed all three vendored copies are byte-identical. Workflow YAML parses.

🤖 Generated with Claude Code

---

Note

Low Risk
Docs and CI validation only; no runtime services, auth, or customer data paths change.

Overview
Formalizes the firewall allowlist promise on info/network-access.mdx with a new What we commit to section: listed destinations and ports won’t change without a changelog and notice, plus three explicit out-of-scope items (per-session wildcard hostnames, metro placement, egress IPs).

Adds a single source of truth by vendoring compat/network_surface.json (with compat/network_surface.sha256 as a tamper pin) from the kernel network-surface.json contract, including ordered ports (443, 8443) and session_facing metadata for wildcard CDP/Live View traffic.

Prevents doc drift with scripts/check_network_surface.py, which fails CI if the destinations table, Live View CSP ```text block, exclusion bullets, or vendored hash don’t match the JSON. A new .github/workflows/network-surface.yml runs that check on every pull request and on pushes to main.

^{Reviewed by Cursor Bugbot for commit 7ae010b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Nov 8, 2026, 8:51 PM

💡 Tip: Enable Automations to automatically generate PRs for you.