L4-only endpoints are not implicitly read-only. A policy with
access: full and no protocol is an explicit grant of full access,
not a violated intent. Write bypass now only fires when the policy
expresses read-only intent via access: read-only or GET-only L7 rules.
Signed-off-by: Alexander Watson <zredlined@gmail.com>
Only report exfiltration paths where enforcement diverges from intent:
- L4-only endpoints (no HTTP inspection)
- Wire protocol bypasses (L7 exists but binary circumvents it)
L7-enforced endpoints where POST is explicitly allowed are the policy
working as designed, not findings.
Remove binary inheritance from the Z3 model — transitive spawn chain
access produced noise (git inheriting access to api.telegram.org via
node). Direct policy grants only. Inheritance can return later as an
opt-in extended analysis mode.
NemoClaw default policy: 38 findings -> 9 actionable gaps.
Signed-off-by: Alexander Watson <zredlined@gmail.com>
Narrow OPP to two yes/no security questions:
1. Can data leave this sandbox? (exfiltration)
2. Can the agent write despite read-only intent? (write bypass)
Removes 4 advisory/lint queries (overpermissive methods, L4 gaps,
binary inheritance, inference relay), 3 output modes (Mermaid,
topology, HTML), and fixes 3 bugs (include_workdir not used in
exfil analysis, __all__ broken when protos missing, CLI PYTHONPATH).
~40% line reduction (2900 -> 1769 lines).
Signed-off-by: Alexander Watson <zredlined@gmail.com>
Alexander Watson