Skip to content

v0.3.6 — Runtime cycle governance, PII sanitization, capability broker, and egress schema enforcement

Latest
Latest

Choose a tag to compare

View all tags
@rosspeili rosspeili released this 16 Oct 07:27
· 1 commit to main since this release
v0.3.6
dd0ff64

AURA Harness — a runtime coat for agent loops: audit, policy, and compliance export.

v0.3.6 packages everything merged since v0.3.5. The headline is enterprise governance, privacy, and secret brokering on the causal spine: sliding-window trajectory cycle detection and loop governance (preset: break), a two-tier zero-dependency PII sanitization engine (middleware.pii_mask) with deterministic pseudonym tokens, capability broker with multi-secret and HTTP header injection, egress JSON schema constitution checks, escalation playbooks on observer/SLO triggers, runtime spectrum service activation, and verified operator identity gates.

Experimental (alpha). API may change before 1.0.

Install

pip install aura-harness==0.3.6 # or simply pip install aura-harness

Optional Skillware integration:

pip install "aura-harness[skillware]==0.3.6"

From source:

git clone https://github.com/ARPAHLS/aura.git
cd aura
git checkout v0.3.6
pip install -e ".[dev]"

Cycle Governance & Loop Detection

  • Break observer cycle detection & loop governance (#93) — enhanced BreakObserver (preset: break) with sliding-window trajectory locality ($K=8$):
    • 1-cycle action fixation: $A \to A \to A$ consecutive tool + normalized argument fixation.
    • 2-cycle state oscillation: $A \leftrightarrow B \leftrightarrow A \leftrightarrow B$ alternating state toggles across turns.
    • 3-cycle execution choreography: $A \to B \to C \to A \to B \to C$ repetitive multi-step loops.
    • Error status fingerprint churn: Identical SHA-256 error fingerprints across consecutive tool results.
    • Reasoning inertia: $\ge 85%$ SequenceMatcher text similarity across consecutive turn thoughts.
    • FinOps burn-velocity guard: Loop token tracking with burn_rate_spike alerts.
    • Cryptographic non-repudiation proofs: Immutable SHA-256 spine hashes (cycle_entry_hash, cycle_recurrence_hash) conforming to EU AI Act Article 14 human oversight standards.
    • Actionable directives: Structured remedial_directive steering strings in observer.alert.
    • Enforcement actions: alert_only, pause (appends break_pause rule and trips session state), and circuit_break.
    • Audit report synthesis: Scorecard scorecard.observers = {alerts, loop_cycles} and finding COGNITIVE_CYCLE_DETECTED (severity: warn).

Privacy & Sequencer Middleware

  • Sequencer middleware & PII masking (#58) — two-tier PII sanitization engine:
    • Tier 1 (Built-in): Zero-dependency regex patterns with algorithmic Luhn validation for credit cards, RFC emails, E.164/NANP phones, SSNs, IPv4/IPv6, API keys/JWTs/UUIDs, and IBANs.
    • Tier 2 (Pluggable): PiiMaskerProvider protocol for contextual NER models (Presidio, Skillware, ARPA micro-f1-mask 270M).
    • Masking strategies: redact, mask, and pseudonymize / tokenize with deterministic session-scoped pseudonym tokens preserving entity equivalence across multi-turn agent reasoning.
    • Sequencer integration: MiddlewarePolicy / MiddlewareStack at step boundaries (scope: per_step, inbound/outbound) and explicit pipeline step op (type: op, ref: middleware.pii_mask).
    • Audit report synthesis: Scorecard scorecard.middleware = {applied, pii_redactions} and finding PII_MASKED (severity: info).

Security, Capabilities & Egress Policies

  • Capability broker & multi-target secret injection (#48, #86) — profile capabilities[] declares named intents and secret refs only; SecretBroker (EnvSecretBroker, MapSecretBroker, CallableSecretBroker, ChainSecretBroker) injects live tokens after constraint checks. Supports multi-target injection via inject: [{ref, as, prefix}] into args (e.g. aws_access_key_id) and headers (e.g. headers.Authorization). Automatic egress scrubbing redacts secret values and secret-like keys from spine, summary, and OTel exports.
  • Egress schema and constitution checks (#78) — profile variables.schema_refs (named JSON Schema specs per tool) and explicit schema_check constraint rules validate tool.call args and/or tool.result payloads at egress; auto-wired at spectrum high / full. Audit finding SCHEMA_VIOLATION.
  • Escalation playbooks (#47) — profile escalations[] maps trigger events (slo.missed, conformance.drift, observer.alert, constraint.violated) to actions (log, alert, nudge, pause, email, wake, custom); spine events escalation.fired, membrane.nudge, escalation.email.
  • Verified identity via spectrum (#73) — spectrum.identity_required defaults to requiring a verified operator at session open for high / full levels; session open raises IdentityRequiredError when unverified. Audit finding VERIFIED_IDENTITY_REQUIRED.
  • Spectrum services runtime activation & Limit preset (#77) — spectrum.services[] auto-wires packaged observer presets (monitor, break, limit, goal_drift, schedule_slo) at session open based on spectrum posture.

Fixes & Hardening

  • Stale agent name aliases (#81) — renaming or archiving an agent now removes previous name aliases from the registry.
  • Spine payload redaction — session.emit always scrubs secret-like keys (token, api_key, password, authorization, *_secret) and injected secret values on JSONL, summary, and OTel artifacts, even without active capabilities.
  • In-memory callable serialization — profile persistence safely handles runtime callables (e.g., watchdog functions) without JSON serialization errors.

Tests & Stress Simulations

  • 300 automated tests across core, membrane, egress, spectrum, observers, identity, capabilities, and exporters (all passing).
  • Dedicated high-throughput stress simulations:
    • scripts/aura_break_loop_stress_sim.py — 5,000 events, 0 memory leaks, 1,936 eps, cycle topology detection, and cryptographic hash verification.
    • scripts/aura_pii_stress_sim.py — high-throughput PII detection and pseudonymization stress suite.
    • scripts/aura_capability_stress_sim.py — 18 scenarios covering multi-secret, header injection, and leak scrubbing.
    • scripts/aura_host_stress_sim.py — 26 scenarios covering coats, spectrum levels, and verified-ID gates.

Links

Full diff: v0.3.5...v0.3.6

Contributors

@rosspeili @evgenyponomarev

Contributors

evgenyponomarev and rosspeili
Assets 2
Loading