Hashimori 0.3.0

0.3.0 — Runtime enforcement for AI agent tool calls

Added

• hashimori.runtime: decide on every tool call an agent makes — allow, ask,
  deny, or rewrite — with the same engine and rule language used for design-time
  review. Default policy in hashimori/runtime/packs/agent-runtime.yaml.
  • Effect lifting for shell, file tools, web fetch/search, sub-agents and MCP
    tools. MCP tools are mapped by an operator-owned registry (--tools /
    HASHIMORI_TOOLS); server self-declared annotations are not trusted.
  • Shell adapter: variables and loops, find -exec/-delete, xargs/parallel,
    wrappers, process substitution, system-change commands, downloads. Unresolved
    targets on writes and deletes are unknown, never guessed; unknowns ask.
  • Script inspection: local scripts run by python/bash/sh, and their local
    imports, are lifted into effects before they run. Installed packages are not
    inspected (pinned as a known-gap test).
  • Red zones, per-call pricing, a session risk budget, raise-only taint shared
    with sub-agents, and rewrite-before-refuse (workspace deletes → a recoverable
    quarantine the agent can't empty; hashimori restore).
• Adapters: Claude Code PreToolUse/PostToolUse (fails closed; tells the
  agent when a call was rewritten), Cursor hooks, and hashimori serve for
  low-latency hooks. Ready-made configs in adapters/.
• Design time → runtime: hashimori envelope compiles a review decision into
  runtime limits; hashimori learn proposes an envelope from shadow-mode logs.
• Operations: hashimori fleet (cross-session and cross-host campaign
  detection, "allowed elsewhere"), hashimori report (self-contained HTML),
  OCSF Detection Finding export, minimal agent messages with incident ids,
  check, ledger, bench.
• Optional model judge, escalate-only, behind a small adapter interface:
  http (any model behind a service you run) and jev (TypeSafe), or your own
  object via judge.use(). Malformed answers are discarded; hard spend cap.
• Benchmark on NL2Bash, RedCode-Exec (Python and Bash) and MBPP, with
  held-out splits and pinned dataset sources (benchmarks/runtime/).
• Docs and examples: docs/runtime.md, examples/runtime/tour.sh (a
  self-checking tour, also run in CI), examples/runtime/tools.yaml,
  examples/intake/coding-agent.json.

Changed

• Engine: evaluate_rules() and select_tier() are exposed; pack hashes are
  cached at load (a full evaluation was spending ~99% of its time re-hashing
  packs); the libyaml safe loader is used when available. evaluate() behaves
  the same.

Hashimori 0.2.0

Hashimori 0.2.0

The first tagged release since 0.1.0's initial commit — twelve PRs, two rule packs, one silent-bypass bug fixed, and the CI/publishing groundwork to make future releases routine.

New rule packs

• Healthcare (#3) — FDA SaMD clearance for clinical decision support, HIPAA BAAs before PHI reaches a model vendor, 42 CFR Part 2 consent, clinician attestation on AI-drafted documentation.
• Finance (#7, thanks @tkbad) — credit/underwriting explainability, AML/sanctions alert disposition, algorithmic trading kill switches, robo-advice suitability disclosure, cardholder data agreements, model-risk validation. Mapped to DORA, APRA CPS230/234, PCI DSS, ECOA/Reg B, FCRA, SR-11-7, SEC, and FINRA.

Fixed

• Silent rule-bypass in in/not_in (#5) — a bare string instead of a list (in: credit instead of in: [credit]) used to be silently checked character-by-character, turning a rule meant to fire into one that never did, with no error anywhere. Now raises a clear error instead of misevaluating.
• CLI crashes on malformed input (#6) — a broken or wrong-shaped rule pack used to crash evaluate/test with a raw Python traceback. Now a clean one-line error, same exit code.

Hardened

• StepSecurity Harden Runner added to CI for supply-chain monitoring (#4).
• CODEOWNERS added so review auto-assignment matches what the README already claimed (#8).
• PyPI publishing via Trusted Publishing (OIDC) — no stored token, ever (#11).

Test coverage: 56% → 96%

hashimori/cli.py — the actual user-facing entrypoint — had 0% coverage before this release. Now 94%, alongside new edge-case coverage for previously-untested condition/loader branches (#6).

Docs / discoverability

• A comparison table against OPA/Rego and generic GRC platforms, so evaluators can tell in 30 seconds whether this is the right tool for them (#9).
• A true zero-install quickstart — uvx/pipx run straight from the repo, no clone, no venv (#10).

Contributors

@bansalfx, @tkbad

Full list of merged PRs: #1–#12