 alangou
|
c608c13fbd
|
fix(prover): distinguish sibling endpoints and fail closed on solver errors (#4326)
Signed-off-by: Adrien Langou <alangou@nvidia.com>
|
2026-10-13 13:21:38 +00:00 |
|
|
Johnny GrecoandKirit93
|
5bce19ab47
|
feat(prover): check process, Landlock, and destination IP containment (#3394)
* feat(prover): check process, landlock, and destination IP containment
Signed-off-by: Kirit93 <kthadaka@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): reject ambiguous implicit IP modes
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): validate implicit IP modes policy-wide
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): tighten containment edge handling
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* test(prover): cover boundary v2 evidence shapes
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(prover): document boundary v2 evidence limits
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): simplify result version contract
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): clarify coverage terminology
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
---------
Signed-off-by: Kirit93 <kthadaka@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Co-authored-by: Kirit93 <kthadaka@nvidia.com>
|
2026-09-18 21:38:08 +00:00 |
|
|
Johnny Greco
|
58b5f8f976
|
feat(prover): add standalone policy boundary checker (#3289)
* feat(prover): add standalone policy maximum checker
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): simplify check scope schema
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): align containment and cancellation with runtime
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): stabilize containment checks in CI
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* test(prover): avoid solver in fast-path guard test
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): align string containment with runtime
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): reject ambiguous z3 string escapes
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): align containment with runtime boundaries
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover-cli): harden cancellation and invalid input
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* feat(packaging): install policy prover with OpenShell
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(prover): clarify installation and check results
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(build): describe prover distribution directly
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): rename maximum policy to boundary
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): localize fail-closed validation
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* test(prover): cover fail-closed CLI surfaces
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* test(prover): allow CI load for REST solver proof
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): use canonical policy schema for containment
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): preserve uncertainty for runtime binary globs
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): bound policy validation work
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(prover): document validation resource limits
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): make containment API extensible
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(prover): define containment API contract
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(ci): integrate prover with consolidated builds
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(ci): declare release packaging dependency
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
---------
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
2026-09-17 17:30:03 +00:00 |
|
|
Johnny Greco
|
2ccef97769
|
feat(policy): establish one canonical authored policy representation (#3334)
* chore(policy): restart schema implementation
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* feat(policy-schema): add canonical authored policy model
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(policy): use canonical authored schema
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): project canonical policy documents
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(policy): describe shared schema boundary
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(policy): close reviewed parser gaps
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(policy-schema): fail closed on unsupported fields
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(policy): preserve partial process identities
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(policy-schema): harden authored policy inspection
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(policy): rename policy schema crate
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* revert(policy): restore policy schema crate
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* test(e2e): serialize OIDC PKCE scenarios
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
---------
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
2026-09-16 17:36:31 +00:00 |
|
|
Alexander Watson
|
e98ea3ee93
|
feat(policy): add agentic approval loop (#1528)
|
2026-05-29 21:11:31 -07:00 |
|