v0.1.1 — the first release on PyPI

The first release on PyPI.

$ pip install rag-security-protocol
$ python -c "import rsp.runtime"

SPEC.md is the deliverable. The code is evidence that its clauses are implementable.

RSP puts a scanner at the ingest hook, before text is embedded or stored, so that blocked means it was never there. Everything shipping today intercepts after storage, where content stays recoverable through embedding inversion.

A plugin is a command. It reads one JSON object on stdin, writes one on stdout, and exits:

$ echo '{"rsp_version":"0.1","hook":"on_chunk","content":"key: AKIA47CQZHT2MVPF3JXB"}' | my-scanner
{"verdict":"REDACT","spans":[{"start":5,"end":25,"type":"aws"}],"replacement":"[REDACTED]"}

What has evidence, and what kind

Twenty-eight normative clauses:

24	a conformance case, which binds every implementation (R1 by the reference plugin existing)
4	the reference host's own tests, which bind one — K1, K2, M1, S4

§10 names each and says why a case cannot reach it. Read it before relying on K1: its evidence covers the pipeline the guard sits in, and a LlamaIndex docstore with store_doc_text at its default keeps the whole document — the document cache K1 names. A host that adds one satisfies the guard and breaks the clause. That is #120, open.

What is installed, and what is not

pip install gives you rsp/ alone: the host, five layers, one-way imports, no runtime dependencies. llama-index-core is an optional extra.

conformance/ and plugins/ are not in the package, on purpose. The kit is meant to be copied next to the plugin under test — python conformance/run.py -- my-scanner — so that what it checks is the protocol rather than a version of it that travelled with one host. Clone or vendor it.

Also in the repository

• Seven plugin adapters over the unmodified gitleaks binary, in TypeScript, Go, Rust, Python, C, Java and Swift. Each carries a strict gate of its own, because every JSON parser is lenient somewhere and no two in the same place.
• examples/host/ — a whole host in one file, judged by a Python plugin and a Go one at the same time. The host code cannot tell them apart.
• WRITING-A-PLUGIN.md — the four messages, and the three things that bite.

The name

The distribution is rag-security-protocol; the package is import rsp. rsp on PyPI belongs to an unrelated SSH proxy, so the two differ, the way beautifulsoup4 gives you bs4.

Known

• #120 — a docstore defeats the ingest guard, silently. The one hole that makes a correctly-wired host non-compliant.
• #106, #108, #111 and the unused-exports pass — what is left of the redundancy scan in #79, none of it a defect.
• A high-severity advisory against nltk, with no patched version upstream. It arrives only through the optional llamaindex extra; the core declares no runtime dependencies at all.

Apache-2.0.