Release-v1

Prove your firewall change is safe — before it merges. Paste your Cisco / Juniper / Palo Alto / iptables configs into a PR and RuleHawk audits them offline, in about a second, and blocks the merge if a change opens a hole, breaks a rule, or breaks a required flow.

RuleHawk 0.3.1

First tagged release of the 0.3.x line — a zero-install, offline, multi-vendor firewall/ACL auditor and CI gate, now with connectivity prechecks and a hardened soundness core.

Highlights

Segmentation proofs — declare zones + must_not_reach and RuleHawk proves isolation or reports a concrete witness packet on the exact line. Exhaustive space-subtraction search; never a false "isolated" on in-scope configs.

Connectivity prechecks (must_reach) — prove a deployment flow actually works before it ships (e.g. "users must reach the Zscaler ZEN ranges on 80/443", GRE/IPsec tunnels). A flow no ruleset permits fails the gate (connectivity-broken) with the concrete dropped packet. First-in-category for offline Zscaler-style egress readiness.

Hygiene — dead / shadowed / redundant / union-shadowed rules, overly-permissive any/any, and dangerous service exposure, each with exact proofs and a cleanup plan.

Six vendors, auto-detected — Cisco IOS/ASA, Cisco NX-OS, Arista EOS, Juniper Junos, Palo Alto PAN-OS, Linux iptables/ip6tables.

CI gate — GitHub Action with SARIF inline annotations, a sticky PR comment, and a job summary. Pure Python, zero dependencies, a full repo audits in ~1 second. Your config never leaves the runner.

Since the last engine snapshot

• must_reach is an exhaustive proof (a partial-coverage permit no longer certifies full connectivity).
• Numeric IP protocols (permit 47=GRE) and ICMP type name/number spellings normalized across all frontends.
• Explicit ACL sequence numbers honored as device match order; iptables -I/-R modeled at their real position; PAN-OS pre/post-rulebase order + per-vsys contexts + multi-line service merge.
• Non-UTF-8 input, malformed policies, and adversarial nesting all fail closed (never crash, never a false pass).
• 664 automated tests, including a property-based soundness oracle.

Use it

- uses: optimesh-ai/RuleHawk@v1
  with:
    configs: firewall/**/*.conf
    policy: .rulehawk/policy.json
    fail-on: high

See the worked demo repo — 10 live PRs across every finding class and vendor.

Full scope note: RuleHawk proves the filter layer — it does not model routing, NAT, or the proxy itself. connectivity-ok means your firewalls don't block the flow, not end-to-end delivery.