Stop eyeballing your agent's permissions. Prove them.

说明与用途

OpenShell 的证明器能自动发现政策违规的具体实例，揭示手工审查容易忽视的隐藏泄漏。

问题

Reading permission files by eye misses subtle policy combinations that allow unintended access.

结果

The prover quickly identifies exact requests or filesystem writes that violate a boundary, revealing leaks that manual review would miss.

工作流

• Write a boundary policy for the parent agent.
• Generate a candidate policy for a child agent.
• Run openshell-prover with the boundary and candidate files.
• Interpret the prover’s output: if exit code 0, policy is within boundary; otherwise, examine the counterexample or unsupported message.
• Adjust the candidate policy accordingly and re‑run.

证据

The sandbox blocked the agent's write to a GitHub repo it was not allowed to touch.

来源

The prover says within_boundary and exits 0.

来源

result: exceeds_boundary counterexample: network binary=- ancestor_binary=- binary_identity_required=false host=api.github.com:443 protocol=rest method=POST path=/repos/acme/app/issues

来源

When the prover cannot answer, it says so and exits 3, instead of passing.

来源