Developer tests OpenShell's Z3 policy prover with 29 checks; it misses the cloud metadata address

·2 views

NVIDIA's OpenShell, a runtime for autonomous AI agent fleets, reached the Hacker News front page and includes a formal verification tool, the openshell-prover CLI, that uses an SMT solver to check whether a candidate policy stays within a boundary policy. A developer built the Rust tool from source, linking it against Z3 via the Python z3-solver wheel because the prebuilt feature failed. Across 29 candidate and boundary pairs, the prover caught nearly every attempted escape, producing concrete counterexamples and refusing to guess when facts were unavailable. However, it failed to flag the cloud instance metadata address 169.254.169.254, the most commonly warned-about target in agent-safety discussions, and similar metadata endpoints were classified as within boundary.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Claude Code MCP Setup: Where Server Configuration Lives and How Scopes Conflict

Claude Code must know about an MCP server through configuration before it can connect to it. Definitions can be stored at project, user, or local scope, or be provided centrally by an organization, depending on who should use them. A project's shared .mcp.json file can declare a team's server without exposing personal credentials, while local scope keeps individual secrets private to one project. When the same server name appears in several scopes, Claude Code uses the complete entry from the highest-precedence source rather than merging fields. Organization-managed definitions override the other sources when duplicated.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Track Your Net Worth Monthly in Google Sheets With Assets, Debts, and a Growth Chart

Net worth, the gap between what you own and what you owe, is presented as a clearer indicator of financial direction than bank balance alone. The guide walks readers through building a monthly tracker in Google Sheets, with an accounts list tagged as assets or debts and a column for each month. Formulas total assets and debts, calculate net worth and its monthly change, and compute a debt ratio that the author suggests keeping below 50%. A line chart of net worth over time and a category breakdown with a pie chart are also described. The article closes with a promotion for the author's own paid and free budget templates.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why specific names beat generic ones, from a murder statue to IKEA

An essay argues that naming something gives people a handle on it, even when the thing is dangerous. It contrasts the nickname 'Peanut' for a deadly statue in a horror story with the template-generated names common among software companies. The author contends that generic, consultant-style names fit everyone and so tell no one anything. The piece cites IKEA's place-based and occupation-based naming as an example of specificity that scales, and suggests specific names are easier to remember and repeat.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

BlockVectra Data API TypeScript client v0.1.3 rejects missing API keys at startup

The BlockVectra Data API TypeScript client now throws an error when it is created with a missing, empty or whitespace-only key, catching configuration mistakes before the first request. Non-empty keys are passed through unchanged, with validity still checked by the API itself. Version 0.1.3 is distributed as a prebuilt GitHub package, not yet through npm's public registry, and includes JavaScript and TypeScript declarations. The release also adds an isDataApiError guard that identifies structured JSON error responses while preserving the original HTTP status. The developers note that the release passed unit tests and example checks, but the credentialed live API test was skipped.

0 comments Read more at DEV Community