# Script Policy

Scripts should be deterministic, non-destructive by default, and reviewable.

Minimum expectations:

- expose a command-line entrypoint or clear function boundary
- prefer `argparse` and `--help` for operator-facing scripts
- keep `python3 scripts/name.py --help` safe, non-mutating, and fast enough for trust smoke checks
- avoid hidden interactive prompts unless the command is explicitly interactive
- state network or filesystem side effects in nearby docs or trust metadata
- declare allowed network hosts in `security/network_policy.json` before team distribution
- emit structured JSON when used by `scripts/yao.py`