I built OpenShell's Z3 policy prover and ran 29 checks. It caught everything except the metadata address.

Description and use

OpenShell’s policy prover correctly flags most violations but misses metadata‑address reachability due to excluded IP ranges in its containment model.

Problem

Verify that a candidate policy stays within a boundary policy using OpenShell’s SMT‑based prover, and identify gaps in its coverage.

Outcome

The prover caught all but metadata‑address reachability; the gap is due to excluded IP ranges in the containment model.

Workflow

• Clone the OpenShell repo (commit 9a85667).
• Build the prover with Rust, linking against the Python z3‑solver wheel (libz3.so 5.3.1).
• Run the CLI on 29 candidate/boundary policy pairs.
• Collect verdicts and counterexamples.
• Analyze the prover’s IP containment model for exclusions.
• Compare results with the runtime’s hard‑blocked IP list.
• Document the discrepancy between the prover’s coverage and the actual enforcement.

Evidence

The prover ships as a standalone CLI, openshell-prover, whose job is a boundary check: given a candidate policy and a boundary policy (the most access an environment allows), decide whether the candidate stays inside the boundary — and if not, produce a counterexample.

Source

Three things deserve credit before the failure. First, the counterexamples are concrete: ... Second, you cannot lauran a read-only REST rule through a raw L4 endpoint to the same host — it models the difference. Third, when a comparison depends on facts it doesn't have — is /etc/passwd contained by /etc given symlinks in an image it can't see? — it returns unsupported and exits 3 rather than guessing.

Source

A policy whose only network rule is "curl may reach 169.254.169.254" — the cloud metadata address, the SSRF greatest hit, the thing the Hugging Face agent incident ran on — passes the boundary check.

Source

Loopback, link-local, and unspecified addresses are excluded from the destination-IP containment model.

Source

The runtime hard‑blocks the same ranges regardless of policy — is_always_blocked_ip in the supervisor's network code, with a test literally named test_declared_endpoint_loopback_stays_blocked.

Source