 Simon Scatton
|
e21b7fd8cf
|
chore(build): remove bundled Z3 support (#3275)
* chore(build): remove bundled Z3 support
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* fix(build): preserve vendored Z3 for local gateway artifacts
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
---------
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
|
2026-10-01 12:08:33 +00:00 |
|
|
Drew Newberry
|
9244868056
|
docs: refresh architecture and agent guides (#3705)
* docs: refresh architecture and agent guides
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs: describe updated security architecture neutrally
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs: highlight new isolation primitives
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs(sandboxes): clarify how to disconnect
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs: align architecture and guides with current navigation
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs(extensibility): streamline extension authentication guidance
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
---------
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-25 02:38:00 -07:00 |
|
|
Johnny GrecoandKirit93
|
5bce19ab47
|
feat(prover): check process, Landlock, and destination IP containment (#3394)
* feat(prover): check process, landlock, and destination IP containment
Signed-off-by: Kirit93 <kthadaka@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): reject ambiguous implicit IP modes
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): validate implicit IP modes policy-wide
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): tighten containment edge handling
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* test(prover): cover boundary v2 evidence shapes
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(prover): document boundary v2 evidence limits
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): simplify result version contract
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): clarify coverage terminology
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
---------
Signed-off-by: Kirit93 <kthadaka@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Co-authored-by: Kirit93 <kthadaka@nvidia.com>
|
2026-09-18 21:38:08 +00:00 |
|
|
Johnny Greco
|
58b5f8f976
|
feat(prover): add standalone policy boundary checker (#3289)
* feat(prover): add standalone policy maximum checker
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): simplify check scope schema
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): align containment and cancellation with runtime
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): stabilize containment checks in CI
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* test(prover): avoid solver in fast-path guard test
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): align string containment with runtime
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): reject ambiguous z3 string escapes
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): align containment with runtime boundaries
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover-cli): harden cancellation and invalid input
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* feat(packaging): install policy prover with OpenShell
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(prover): clarify installation and check results
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(build): describe prover distribution directly
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): rename maximum policy to boundary
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): localize fail-closed validation
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* test(prover): cover fail-closed CLI surfaces
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* test(prover): allow CI load for REST solver proof
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): use canonical policy schema for containment
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): preserve uncertainty for runtime binary globs
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): bound policy validation work
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(prover): document validation resource limits
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): make containment API extensible
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(prover): define containment API contract
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(ci): integrate prover with consolidated builds
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(ci): declare release packaging dependency
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
---------
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
2026-09-17 17:30:03 +00:00 |
|