Only report exfiltration paths where enforcement diverges from intent:
- L4-only endpoints (no HTTP inspection)
- Wire protocol bypasses (L7 exists but binary circumvents it)
L7-enforced endpoints where POST is explicitly allowed are the policy
working as designed, not findings.
Remove binary inheritance from the Z3 model — transitive spawn chain
access produced noise (git inheriting access to api.telegram.org via
node). Direct policy grants only. Inheritance can return later as an
opt-in extended analysis mode.
NemoClaw default policy: 38 findings -> 9 actionable gaps.
Signed-off-by: Alexander Watson <zredlined@gmail.com>
Narrow OPP to two yes/no security questions:
1. Can data leave this sandbox? (exfiltration)
2. Can the agent write despite read-only intent? (write bypass)
Removes 4 advisory/lint queries (overpermissive methods, L4 gaps,
binary inheritance, inference relay), 3 output modes (Mermaid,
topology, HTML), and fixes 3 bugs (include_workdir not used in
exfil analysis, __all__ broken when protos missing, CLI PYTHONPATH).
~40% line reduction (2900 -> 1769 lines).
Signed-off-by: Alexander Watson <zredlined@gmail.com>
Wrap the sandbox import in try/except so subpackages like
openshell.prover can be imported without a full Rust build.
Removes the conftest.py namespace hack that was working around this.
Signed-off-by: Alexander Watson <zredlined@gmail.com>
Closes#273
Verify inference endpoints synchronously on the server during set/update, expose a --no-verify escape hatch in the CLI and Python helper, and return actionable failures when validation does not pass.
Alexander Watson