v0.1.0 — the first freeze

SPEC.md is the deliverable. The code is evidence that its clauses are implementable.

RSP puts a scanner at the ingest hook, before text is embedded or stored, so that blocked means it was never there. Everything shipping today intercepts after storage, where content stays recoverable through embedding inversion.

A plugin is a command. It reads one JSON object on stdin, writes one on stdout, and exits:

$ echo '{"rsp_version":"0.1","hook":"on_chunk","content":"key: AKIA47CQZHT2MVPF3JXB"}' | my-scanner
{"verdict":"REDACT","spans":[{"start":5,"end":25,"type":"aws"}],"replacement":"[REDACTED]"}

What has evidence, and what kind

Twenty-eight normative clauses:

24	a conformance case, which binds every implementation (R1 by the reference plugin existing)
4	the reference host's own tests, which bind one — K1, K2, M1, S4

§10 names each and says why a case cannot reach it: K1 and K2 are about storage, which a host case cannot see unless the host offers somewhere to look; S4 is a requirement on a host's internal shape; M1's failure cannot be written into a case file, because a case file is JSON.

Read §10 before relying on K1. Its evidence covers the pipeline the guard sits in. A LlamaIndex docstore with store_doc_text at its default keeps the whole document — the document cache K1 names — and a transformation cannot reach it. The reference host configures none for that reason. A host that adds one satisfies the guard and breaks the clause. That is #120, open.

What is in it

• rsp/ — one host: five layers, one-way imports, zero runtime dependencies. llama-index-core is an optional extra.
• conformance/ — cases, a runner, and a plugin that misbehaves on request. Standard library only, and nothing in it imports this host: python conformance/run.py -- my-scanner checks against the protocol, not against our reading of it.
• Seven plugin adapters over the unmodified gitleaks binary, in TypeScript, Go, Rust, Python, C, Java and Swift. Each carries a strict gate of its own, because every JSON parser is lenient somewhere and no two in the same place.
• examples/host/ — a whole host in one file, judged by a Python plugin and a Go one at the same time. The host code cannot tell them apart.
• WRITING-A-PLUGIN.md — the four messages, and the three things that bite.

Not published to PyPI

The unit a protocol distributes is the specification and the cases, and the conformance kit is meant to be copied next to your plugin rather than installed. Publishing the reference host as a package would invite dependence on evidence. Clone it, or vendor what you need.

Known

• #120 — a docstore defeats the ingest guard, silently. The one hole that makes a correctly-wired host non-compliant.
• #106, #108, #111 and the unused-exports pass — what is left of the redundancy scan in #79, none of it a defect.
• A high-severity advisory against nltk, with no patched version upstream. It arrives only through the optional llamaindex extra; nothing in the core imports it, and pyproject.toml declares no runtime dependencies at all.

Apache-2.0.