v0.1.1 — the first release on PyPI

The first release on PyPI.

$ pip install rag-security-protocol
$ python -c "import rsp.runtime"

SPEC.md is the deliverable. The code is evidence that its clauses are implementable.

RSP puts a scanner at the ingest hook, before text is embedded or stored, so that blocked means it was never there. Everything shipping today intercepts after storage, where content stays recoverable through embedding inversion.

A plugin is a command. It reads one JSON object on stdin, writes one on stdout, and exits:

$ echo '{"rsp_version":"0.1","hook":"on_chunk","content":"key: AKIA47CQZHT2MVPF3JXB"}' | my-scanner
{"verdict":"REDACT","spans":[{"start":5,"end":25,"type":"aws"}],"replacement":"[REDACTED]"}

What has evidence, and what kind

Twenty-eight normative clauses:

24	a conformance case, which binds every implementation (R1 by the reference plugin existing)
4	the reference host's own tests, which bind one — K1, K2, M1, S4

§10 names each and says why a case cannot reach it. Read it before relying on K1: its evidence covers the pipeline the guard sits in, and a LlamaIndex docstore with store_doc_text at its default keeps the whole document — the document cache K1 names. A host that adds one satisfies the guard and breaks the clause. That is #120, open.

What is installed, and what is not

pip install gives you rsp/ alone: the host, five layers, one-way imports, no runtime dependencies. llama-index-core is an optional extra.

conformance/ and plugins/ are not in the package, on purpose. The kit is meant to be copied next to the plugin under test — python conformance/run.py -- my-scanner — so that what it checks is the protocol rather than a version of it that travelled with one host. Clone or vendor it.

Also in the repository

• Seven plugin adapters over the unmodified gitleaks binary, in TypeScript, Go, Rust, Python, C, Java and Swift. Each carries a strict gate of its own, because every JSON parser is lenient somewhere and no two in the same place.
• examples/host/ — a whole host in one file, judged by a Python plugin and a Go one at the same time. The host code cannot tell them apart.
• WRITING-A-PLUGIN.md — the four messages, and the three things that bite.

The name

The distribution is rag-security-protocol; the package is import rsp. rsp on PyPI belongs to an unrelated SSH proxy, so the two differ, the way beautifulsoup4 gives you bs4.

Known

• #120 — a docstore defeats the ingest guard, silently. The one hole that makes a correctly-wired host non-compliant.
• #106, #108, #111 and the unused-exports pass — what is left of the redundancy scan in #79, none of it a defect.
• A high-severity advisory against nltk, with no patched version upstream. It arrives only through the optional llamaindex extra; the core declares no runtime dependencies at all.

Apache-2.0.

v0.1.1rc1 — a candidate on PyPI

A candidate, published to prove the pipeline. Same tree as v0.1.0 but for the packaging.

$ pip install --pre rag-security-protocol
$ python -c "import rsp.runtime"

The distribution is rag-security-protocol — rsp on PyPI belongs to an unrelated SSH proxy — and the package is still import rsp, the way beautifulsoup4 gives you bs4.

What this release is for

The name had never been used, the publish workflow had never run, and the trusted-publishing configuration had never been exercised. PyPI refuses a filename a second time even after a delete, so the first upload is the one that cannot be taken back. This is that upload, deliberately spent on a candidate.

It bought what it was meant to: the first attempt failed in the test step, before uv build, and uploaded nothing. nltk refuses to open a file with more than one link, and uv hardlinks from its cache by default — a hazard ci.yml had documented and the new workflow had not carried over. Measured: st_nlink is 2 under hardlink and 1 under copy.

Note on pip install

With no stable release yet published, a plain pip install rag-security-protocol resolves to this candidate — pip skips pre-releases only when a stable version can satisfy the requirement, and here none exists. Pin a version if that matters to you. It stops being true the moment 0.1.1 is out.

What is in it

Unchanged from v0.1.0: twenty-eight normative clauses, twenty-four with a conformance case and four with the reference host's tests; one host with no runtime dependencies; seven plugin adapters over the unmodified gitleaks binary; a conformance kit that imports none of it.

The installed package is rsp/ alone. conformance/ and plugins/ are deliberately not shipped — the kit is meant to be copied next to the plugin under test, so that what it checks is the protocol rather than a version of it that travelled with one host.

Read §10 before relying on K1. A LlamaIndex docstore left at its default keeps the whole document, including one the guard blocked. That is #120, open.

v0.1.0 — the first freeze

SPEC.md is the deliverable. The code is evidence that its clauses are implementable.

RSP puts a scanner at the ingest hook, before text is embedded or stored, so that blocked means it was never there. Everything shipping today intercepts after storage, where content stays recoverable through embedding inversion.

A plugin is a command. It reads one JSON object on stdin, writes one on stdout, and exits:

$ echo '{"rsp_version":"0.1","hook":"on_chunk","content":"key: AKIA47CQZHT2MVPF3JXB"}' | my-scanner
{"verdict":"REDACT","spans":[{"start":5,"end":25,"type":"aws"}],"replacement":"[REDACTED]"}

What has evidence, and what kind

Twenty-eight normative clauses:

24	a conformance case, which binds every implementation (R1 by the reference plugin existing)
4	the reference host's own tests, which bind one — K1, K2, M1, S4

§10 names each and says why a case cannot reach it: K1 and K2 are about storage, which a host case cannot see unless the host offers somewhere to look; S4 is a requirement on a host's internal shape; M1's failure cannot be written into a case file, because a case file is JSON.

Read §10 before relying on K1. Its evidence covers the pipeline the guard sits in. A LlamaIndex docstore with store_doc_text at its default keeps the whole document — the document cache K1 names — and a transformation cannot reach it. The reference host configures none for that reason. A host that adds one satisfies the guard and breaks the clause. That is #120, open.

What is in it

• rsp/ — one host: five layers, one-way imports, zero runtime dependencies. llama-index-core is an optional extra.
• conformance/ — cases, a runner, and a plugin that misbehaves on request. Standard library only, and nothing in it imports this host: python conformance/run.py -- my-scanner checks against the protocol, not against our reading of it.
• Seven plugin adapters over the unmodified gitleaks binary, in TypeScript, Go, Rust, Python, C, Java and Swift. Each carries a strict gate of its own, because every JSON parser is lenient somewhere and no two in the same place.
• examples/host/ — a whole host in one file, judged by a Python plugin and a Go one at the same time. The host code cannot tell them apart.
• WRITING-A-PLUGIN.md — the four messages, and the three things that bite.

Not published to PyPI

The unit a protocol distributes is the specification and the cases, and the conformance kit is meant to be copied next to your plugin rather than installed. Publishing the reference host as a package would invite dependence on evidence. Clone it, or vendor what you need.

Known

• #120 — a docstore defeats the ingest guard, silently. The one hole that makes a correctly-wired host non-compliant.
• #106, #108, #111 and the unused-exports pass — what is left of the redundancy scan in #79, none of it a defect.
• A high-severity advisory against nltk, with no patched version upstream. It arrives only through the optional llamaindex extra; nothing in the core imports it, and pyproject.toml declares no runtime dependencies at all.

Apache-2.0.