{"resourceId":"creativeainews-openshell-prover-20260928","versions":[{"version":"external-a64b9a51c62c4e825e31f4fdf80e8fc8fd81688fe4d3191322dd0b7554d409e6","resource":{"id":"creativeainews-openshell-prover-20260928","title":"Creative AI News: OpenShell policy prover tested—9 caught, 9 unsupported, CI exit-3 risk","organization":"Creative AI News","sector":"Independent AI engineering journalism","geography":"Global","publishedAt":"2026-09-28T18:31:00Z","publicationDate":"2026-09-28","eventDate":"2026-09-28","sourceName":"Creative AI News","sourceLabel":"Independent hands-on evaluation / policy-prover measurement","sourceUrl":"https://www.creativeainews.com/articles/nvidia-openshell-policy-prover-tested-2026/","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["developers-agents","data-security","governance-procurement","infrastructure"],"finding":"Why now (Oct 2): Anomity’s same-day production-defaults guide elevates CI gating of OpenShell policies; this Sep 28 Creative AI News hands-on test remains unarchived and is the only measured prover coverage complementary to that advice. Authors ran openshell-prover 0.1.2 (SHA-256 verified) against 19 permission-widening edits on a coding-agent boundary: 9 exceeded with concrete counterexamples, 9 returned unsupported (exit 3)—including every filesystem widening, enforce→audit switches, and GraphQL endpoints—and 1 within_boundary because the runtime always blocks cloud-metadata. Checks finished under 200 ms. Verdict: prover is honest about limits; risk is CI that treats “not rejected” as safe—gate on exit 0 only.","sledRelevance":"Gives SLED platform teams a concrete CI acceptance rule (fail on exit ≠ 0) and documents which loosenings the prover will not catch—directly actionable beside Oct 2 defaults guidance.","evidence":"Opened Creative AI News article with datePublished 2026-09-28T18:31:00Z (modified 2026-09-29). Body includes tabulated 19 widening edits, exit codes, and explicit CI guidance.","architectureImplications":"Wire openshell-prover into policy CI with pass-only-on-exit-0; review filesystem and audit-mode changes manually.","governanceImplications":"Document prover coverage limits in security control descriptions so auditors do not equate exit 3 with safe.","securityPrivacyImplications":"Enforce→audit and GraphQL additions can bypass a naive fail-on-exit-1 gate; metadata host rules may look allowed while runtime blocks them.","caveats":"Single-lab hands-on on v0.1.2; not a formal red-team of OpenShell runtime escapes; Sentry not tested; publication is two research nights before Oct 2 but newly paired with Oct 2 defaults guidance and still absent from archive.","streamIds":["nvidia"],"roles":{"sales":"Use as the measured peer to Oct 2 defaults advice: Creative AI News ran OpenShell’s policy prover on 19 widenings—9 caught, 9 unsupported, 1 runtime-blocked—and warns CI that treats “not rejected” as safe will miss audit-mode and GraphQL loosenings. Discovery for platform/CISO: will you fail builds on exit 3? Unsupported: Sentry latency claims, full runtime escape proof, or SLED production deny rates from this test alone.","engineering":"Fit for OpenShell policy-as-code pipelines on campus agent platforms. Integrate openshell-prover check candidate.yaml --boundary boundary.yaml and fail the build on any exit other than 0. Prerequisites: pinned OpenShell 0.1.2 or newer, boundary policy in git, and a Linux CI runner. Constraints: filesystem widenings return unsupported; GraphQL/MCP stay unmodeled; the prover models the runtime, not intent. Proof: reproduce the article’s audit-mode and GraphQL cases returning exit 3 under your gate.","delivery":"Work: add prover CI job, train reviewers on exit-3 meaning, and keep manual review for filesystem/Landlock. Dependencies: DevSecOps, AI platform, InfoSec. Ownership: platform engineering with security sign-off. Skills: YAML policies, SMT prover CLI. Governance: change tickets when overriding exit-3. Acceptance: CI blocks audit-mode and GraphQL widenings. Risks: copying install.sh from main instead of pinned releases."},"roleDetails":{"sales":{"customerProblem":"Buyers need evidence that OpenShell’s formal prover catches real policy loosenings—and where it does not.","stakeholders":["AI platform lead","DevSecOps","CISO"],"discoveryQuestions":["Do you gate policy PRs with openshell-prover?","Fail on exit 3 or only exit 1?","Who reviews filesystem policy changes?"],"valueHypothesis":"Hands-on 9/9/1 results bound a CI control story without claiming Sentry or full escape resistance.","potentialEngagement":"Short prover CI design review using the published harness pattern.","unsupportedClaims":["Guarantee all risky edits are caught","Sentry millisecond quarantine proof","SLED measured outcomes"]},"engineering":{"fit":"CI integration of openshell-prover with exit-0-only gate.","architectureIntegration":"Keep boundary and candidate YAML in git; run prover offline without gateway.","prerequisites":["OpenShell 0.1.2+ pinned","x86_64/arm64 Linux runner","Boundary policy reviewed by security"],"constraints":["Filesystem changes return unsupported","GraphQL/MCP uncheckable","Exit 3 ≠ safe"],"security":"Treat enforce→audit as high-risk loosening requiring human review even when prover is inconclusive.","proofOfValue":["Reproduce audit-mode exit 3","Reproduce GraphQL exit 3","Confirm metadata runtime always-block behavior"]},"delivery":{"work":"Implement prover CI, document exit codes, train reviewers.","dependencies":["DevSecOps pipeline owners","AI platform","InfoSec policy authors"],"ownership":"Platform eng owns CI job; InfoSec owns boundary policy.","skillsAdoption":"Adopt NVIDIA OpenShell skills optionally; pin install versions.","governanceCheckpoints":["CI policy merged","Exit-code runbook published","Sample failing PR demonstrated"],"acceptanceCriteria":["PR blocked on exit ≠ 0","Manual filesystem review checklist live"],"risks":["Naive fail-on-exit-1 gate","Unpinned install from main","Assuming prover proves least privilege"]}},"retrievedAt":"2026-10-03T03:05:00Z","enrichedAt":"2026-10-03T03:05:19Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Prover CI is specialist DevSecOps work; plan shared templates so smaller SLED teams can reuse gates.","procurementImplications":"Ask vendors/integrators for prover CI evidence and exit-code policy, not only OpenShell install demos.","operatingModelImplications":"Policy changes become code-reviewed artifacts with automated gates plus manual filesystem review.","sourceVerification":{"openedUrl":"https://www.creativeainews.com/articles/nvidia-openshell-policy-prover-tested-2026/","referenceExcerpt":"It caught 9 with a concrete counterexample, answered \"unsupported\" on 9","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}