Kirit93
48e12bdbf1
feat(prover): support REST query parameter containment
...
Model exact and wildcard query constraints, preserve repeated-value semantics, and expose query-aware counterexamples. Bound query-aware probes before the solver and add runtime parity and regression coverage.
Signed-off-by: Kirit93 <kthadaka@nvidia.com >
2026-09-21 15:28:55 -07:00
Johnny Greco and Kirit93
5bce19ab47
feat(prover): check process, Landlock, and destination IP containment ( #3394 )
...
* feat(prover): check process, landlock, and destination IP containment
Signed-off-by: Kirit93 <kthadaka@nvidia.com >
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(prover): reject ambiguous implicit IP modes
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(prover): validate implicit IP modes policy-wide
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(prover): tighten containment edge handling
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* test(prover): cover boundary v2 evidence shapes
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* docs(prover): document boundary v2 evidence limits
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* refactor(prover): simplify result version contract
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* refactor(prover): clarify coverage terminology
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
---------
Signed-off-by: Kirit93 <kthadaka@nvidia.com >
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
Co-authored-by: Kirit93 <kthadaka@nvidia.com >
2026-09-18 21:38:08 +00:00
Johnny Greco
58b5f8f976
feat(prover): add standalone policy boundary checker ( #3289 )
...
* feat(prover): add standalone policy maximum checker
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* refactor(prover): simplify check scope schema
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(prover): align containment and cancellation with runtime
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(prover): stabilize containment checks in CI
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* test(prover): avoid solver in fast-path guard test
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(prover): align string containment with runtime
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(prover): reject ambiguous z3 string escapes
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(prover): align containment with runtime boundaries
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(prover-cli): harden cancellation and invalid input
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* feat(packaging): install policy prover with OpenShell
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* docs(prover): clarify installation and check results
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* docs(build): describe prover distribution directly
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* refactor(prover): rename maximum policy to boundary
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* refactor(prover): localize fail-closed validation
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* test(prover): cover fail-closed CLI surfaces
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* test(prover): allow CI load for REST solver proof
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(prover): use canonical policy schema for containment
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(prover): preserve uncertainty for runtime binary globs
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(prover): bound policy validation work
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* docs(prover): document validation resource limits
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(prover): make containment API extensible
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* docs(prover): define containment API contract
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(ci): integrate prover with consolidated builds
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
* fix(ci): declare release packaging dependency
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
---------
Signed-off-by: Johnny Greco <jogreco@nvidia.com >
2026-09-17 17:30:03 +00:00
Kirit93