First public release — a formally verified, quantitative reconstruction of the March-2026 Trivy / TeamPCP GitHub Actions supply-chain compromise (CVE-2026-33634).
Three-layer validation
- Layer 1 — a static analyzer over a 189-workflow corpus grounds the model's assumptions.
- Layer 2 — a TLA+/TLC incident-reconstruction model proves which mitigations close the attack: per-pipeline isolation, a refinement relation, and the residual attack surface.
- Layer 3 — a PRISM probabilistic model computes compromise probabilities, expected times, a two-stage npm cascade, and closed-form parametric results, calibrated against public malicious-package data.
Automated mitigation search — an LLM proposes defender policies, each verified by the PRISM oracle; it independently converges on the paper's central finding (rotate the residual credential).
All three layers reproduce and are gated in CI (SHA-pinned actions). Software licensed Apache-2.0; the paper text CC-BY-4.0.