> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qwedai.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# QWED Infra: verification for Terraform, IAM, and Kubernetes

> QWED Infra applies formal verification to infrastructure as code — Terraform, AWS IAM, Kubernetes, costs, and release boundaries — before agents deploy.

**Deterministic verification for infrastructure as code (IaC).**

![Verified by QWED](https://img.shields.io/badge/Verified_by-QWED-00C853?style=flat\&logo=checkmarx)
![PyPI](https://img.shields.io/pypi/v/qwed-infra?color=blue)

`qwed-infra` is a Python library (v0.3.0) that mathematically proves the security and compliance of infrastructure definitions (Terraform, AWS IAM, Kubernetes). It uses **formal methods (Z3 solver)**, **graph theory**, and **deterministic arithmetic** to do so without ML, heuristics, or confidence scores.

It prevents AI agents (like Devin or Copilot Workspace) from deploying insecure, non-compliant, or expensive infrastructure by verifying configuration *before* deployment.

## Architecture

```mermaid theme={null}
graph TD
    subgraph "IaC Parsing"
        A[Terraform Code] -->|TerraformParser| B[Normalized Resources]
    end
    subgraph "Verification Engines"
        B -->|IAM Policies| C["IamGuard (Z3 Solver)"]
        B -->|Network Topology| D["NetworkGuard (NetworkX)"]
        B -->|Instance Types| E["CostGuard (Decimal Arithmetic)"]
    end
    subgraph "Release Gate"
        F[Source Package] --> G["ArtifactBoundaryGuard<br/>(Secret Scan + Build Config)"]
    end
    C --> H[InfraDiagnosticResult]
    D --> H
    E --> H
    G --> H
    H --> I{"proof_ref present?"}
    I -->|Yes| J[Authoritative - admit for deploy]
    I -->|No| K[Non-authoritative - block]
```

## Key features

### IamGuard

Verifies AWS IAM policies using the **Z3 theorem prover**. Converts policies into first-order logic formulas to prove or disprove access, wildcard expansion, condition evaluation, and deny precedence.

### NetworkGuard

Verifies network reachability using **graph theory** (NetworkX). Validates paths like `Internet -> Internet Gateway (IGW) -> Route -> Security Group -> Instance`. Fail-closed on NAT gateways, VPC peering, NACLs, and Transit Gateway.

### CostGuard

Deterministic cloud cost estimation using **Decimal arithmetic** (no floating-point rounding errors). Enforce budgets and detect expensive instance types before deployment.

### ArtifactBoundaryGuard

Release-gate verification for Python packages. Scans for secret leaks, debug artifact inclusion, and validates hatch build configuration. Blocks publishing when the package surface is unknown or unsafe.

## Audit & Diagnostics

Every guard produces an `InfraDiagnosticResult` — a 3-layer diagnostic with:

* **Layer 1 (`agent_message`):** Human-readable status, safe for downstream tools
* **Layer 2 (`developer_fields`):** Structured evidence — constraint IDs, audit traces, findings
* **Layer 3 (`proof_ref`):** SHA-256 hash of verification evidence; present only when the result is `VERIFIED` and authoritative

Each result also carries a canonical **`RuleRef`** audit trace (`build_trace()`) referencing the specific statute or policy rule that drove the verdict.

## Verification Context v1.0

Every guard exposes a `to_verification_context()` method that runs the verification from raw inputs and emits a **Verification Context (VC) document**: a portable, schema-validated, JSON-serializable trust artifact carrying the claim, verifier identity, hash-bound evidence, and an `ADMIT`/`DENY` admission decision.

The document is fail-closed by construction. `ADMIT` requires a `VERIFIED` result plus a cryptographically valid ES256 attestation bound to the exact claim and evidence. Everything else is `DENY`. See [Verification Context documents](/infra/guards#verification-context-documents).

## Installation

Install with a minimum version:

```bash theme={null}
pip install "qwed-infra>=0.3.0"
```

v0.3.0 adds runtime dependencies `pyjwt` and `cryptography` for attestation signing and validation.


## Related topics

- [QWED Infra troubleshooting](/infra/troubleshooting.md)
- [Usage examples](/infra/examples.md)
- [QWED Infra guards for infrastructure verification](/infra/guards.md)
- [QWED deployment guide](/advanced/deployment.md)
- [QWED architecture: translation, verification, guards](/architecture.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.