GraphSmith v0.4.0 — Extended-Control Hardening

Extended-control hardening. v0.4.0 turns the deferred review gaps into enforced, recomputed controls, and teaches the GSA verifier to check them: every run-time claim a bundle makes is recomputed from its own evidence and fails closed on any lie (D5). Evidence, not certification.

What's new

• Capability conformance (R1) — per-skill fs / model / subprocess / network grants; requested ⊆ granted; attested only when enforced (D1).
• Side-effect receipts (R2) — external effects reconcile against adapter receipts; an evidence-less "success" is never vouched for.
• Signer lifecycle + recall (R3) — revoked signers and recalled bundles fail closed; a rotated key resolves only to a live successor.
• Secret / PII redaction (R4) — an exported trace carrying an unredacted secret or PII fails closed, against a 17-format recall gate.
• SBOM + build provenance (R5) — SBOM digest + provenance recomputed against actual artifact hashes; this release publishes to npm with build provenance.
• Policy-as-code (R8) — versioned enterprise-safe profiles; a required control counts only when enforced.
• GSA §9.11 — the verifier recomputes all five run-time controls from a bundle's own evidence; a v0.3.0 bundle verifies unchanged.
• graphsmith verify CLI — a fail-closed verifier bin from the graphsmith-skill package for CI / enterprise.
• Independent Assurance program — docs/ASSURANCE.md.

Assurance

Every control built by one model family and adversarially reviewed by ≥2 non-Anthropic families (Mistral, DeepSeek, Qwen); the orchestrator re-ran every suite and audited zero-finding results for rubber-stamping. Real defects found + fixed include a leaky R4 redaction battery (missed AWS/JWT/Google/Stripe keys, tokens, phone PII) and two regex-brittleness bugs; a tester's inverted harness that scored missed leaks as passes was caught and rejected. Closed by the v0.4.0 gauntlet: 395 scenarios, all HOLD, 0 BREAK (v0.3.0 gauntlet still green at 286); GSA conformance 14/14.

Full notes: docs/releases/v0.4.0.md. Reviewed, not certified — this attests tested behavior, not fitness for any purpose.

GraphSmith Verify v0.3.1 — GSA attestation checks for agent PRs

GraphSmith Verify runs GraphSmith Attestation (GSA) checks on agent-authored
pull requests: a run passes graphsmith verify or it doesn't — a signed,
replayable, tamper-evident record of exactly what your agents did.

This release

• First publish of the Verify action to the GitHub Marketplace
• Static GSA hero added to the README

What it does

• Enforces deterministic merge boundaries for agent PRs
• Fail-closed integrity + profile verification in CI
• Emits a JSON result for downstream badge/status steps
• unavailable-is-not-failure mode by default (failed profiles still fail the build)

Security
Pin this action by full commit SHA, never a tag:

uses: SathiaAI/graphsmith@5496866128c68ac6ae424578b56ff8aff3ccf8ac

Docs: https://graphsmith.ai · License: MIT · local-first

GraphSmith v0.3.0 — GraphSmith Attestation (GSA)

GraphSmith v0.3.0 — the GraphSmith Attestation (GSA) standard

MCP connects your agents; GSA proves what they did. v0.3.0 turns each AI-workflow run into a signed, replayable, tamper-evident attestation bundle any CI can verify and any regulator can read — evidence, never a certification — and delivers the regulated register and air-gapped verification deferred from v0.2.0.

What's new

• GSA attestation standard — a portable bundle format + a normative verification algorithm. gsa-verify (verifier), gsa-produce (honest-by-construction sealing), gsa-plan (drift/destructive-change detection + deterministic replay). Ed25519 / ECDSA-P256 / RSA-PSS signing, local keypair by default (no PKI). A contradictory or tampered bundle does not verify.
• The regulated register (four lanes, each adversarially tested) — approver identity (N-of-M by distinct signer keys), obligations→controls (coverage recomputed from evidence; manual-only can never be marked covered), evidence retention (append-only, hash-chained), and air-gapped verification (out-of-band maintainer signature; verify offline with no trust in the registry). A fail-closed regulated-mode activation guard activates only on a complete, valid register.
• MCP attestation shim — a boundary attestation for any MCP-speaking agent, with no agent changes. Verified against agents GraphSmith didn't build: Claude Code, Cursor, LangGraph, Devin, Windsurf. It attests what crosses the MCP boundary and never claims what it didn't observe.
• Conformance kit + evidence badge, KNOWN-LIMITATIONS.md, a worked offline-verify transcript, and a NIST prior-art submission draft.

Adversarial hardening (the discipline)

Every security-tier component was built by one model family and adversarially tested by ≥2 different, non-Anthropic families (Codex/GPT, DeepSeek, Mistral, Qwen); the orchestrator re-ran every suite. 16 real defects were found and fixed — 1 critical (an N-of-M Sybil bypass), 4 high, 11 medium — every one re-verified. Zero were found by model review: two families returned "clean" on the module whose executed suite then found nine bugs. Consolidated record: docs/reviews/2026-07-24-v0.3.0-hardening.md.

Closed by a 282-scenario gauntlet — all HOLD, 0 BREAK — independently reproduced by a non-Anthropic harness (Codex: 282 / all HOLD / 0 BREAK). Reproduce it yourself: node tests/gauntlet/v0.3.0-battery.js.

Honest scope (binding)

GSA is an evidence layer, not a certification. A valid bundle attests what ran and that the record is unaltered — never that a workflow is safe, correct, or compliant. External single-delivery is run-once, replay-verified of recorded effects, not exactly-once (true single-delivery needs the external system's idempotency key). Per-skill filesystem/model/subprocess grant enforcement is targeted for v0.4.0 (v0.3.0 attests network egress + external-call presence). Trust of a signer's key is the verifier's policy. Full boundaries: KNOWN-LIMITATIONS.md.

Install / verify

npx skills add SathiaAI/graphsmith
node scripts/gsa-conformance.js       # portable conformance battery + evidence badge
node scripts/gsa-offline-demo.js      # offline verification (network denied)

Pending CI (updated when the release workflow runs)

• 3-OS verify matrix (Ubuntu/Windows/macOS × Node 18/22) and the per-platform capability badge — unavailable profiles render unavailable, never green.
• Full agent×OS conformance matrix — see docs/GSA-CONFORMANCE.md.

What's next — v0.4.0

Per-skill capability grant enforcement (filesystem/model/subprocess); keyless / transparency-log signing (opt-in); deeper evidence-retention automation; and broader independent GSA implementations toward a ratified (non-draft) protocol.

---

Reviewed, not certified — this attests tested behaviour, not fitness for any purpose. Release-owner attestation: the notes reflect tested behaviour, all adversarial findings (including dissent) are preserved, and the honest-language + publication-hygiene gates passed. — Paul Poulose

GraphSmith v0.2.0 — the GraphSmith Protocol

GraphSmith v0.2.0 — the GraphSmith Protocol

v0.2.0 turned GraphSmith from a skill into a skill that publishes a protocol — extracting its integrity and evolution behaviour into a versioned, schema-backed, conformance-testable specification: the GraphSmith Protocol (v0.1-draft). Five invariants (I1–I5), evidence-carrying capability profiles (R/E/B/T/G/Q/X), and a four-gate promotion pipeline, backed by JSON schemas, a conformance lab, a GitHub Action, and an evidence-carrying badge. Self-healing, gated learning (staged-only), and an assurance/red-team harness ship alongside.

Reviewed across multiple non-Anthropic model families and closed by a multi-model gauntlet (153 orchestrator tests, all HOLD / 0 BREAK; an independent 172/172 execution pass; 2 real gaps found and fixed). Dissents preserved in docs/reviews/.

Reviewed, not certified — this attests tested behaviour, not fitness for any purpose.

v0.1.1 — held twice, fixed everything, receipts included

Every finding from two external adversarial reviews — a three-pass cross-model council on v0.1.0 and a pre-release red team on the v0.1.1 candidate (GPT-5.1, Gemini 2.5 Pro, DeepSeek R1, attacking the live scripts by executing them) — fixed and regression-proofed. The red team held the release unanimously; we adopted the stricter verdict, answered all fifteen findings with fixes rather than wording, and shipped only after the HOLD authors' own conditions were met.

Reliability

• fsync'd write-ahead intent/effect logs: the power-loss double-send becomes a designed, loud halt — and the chaos harness now stages the lost-flush state to prove it
• Safety verdicts earned by on-disk state, never by a string: forged halts fail the harness
• Lease + heartbeat run lock (claim-with-a-lease, applied to the manager itself): same-run concurrency refuses, crashed runs self-recover in ~30s, recycled pids can't wedge a run, no manual lock deletion ever
• Wired idempotencyKey (runId:step) in every worker stub; step-name validation; capped corruption backups

Tooling

• Linter immune to comments, strings, and multi-line template literals, with setInterval and hoisted clock/random detection; 12-case line-pinned regression corpus with mutation-tested teeth; single-file mode
• Content-integrity-pinned KnoSky grounding (baked sha512, refuse-on-mismatch); strict GRAPHSMITH_OFFLINE parsing
• CI on Linux + Windows × Node 18/22 runs the full proof battery on every push; npm publish is gated behind it — this release is the gate's first green

Receipts
All three review reports — council, red team, and verification pass, dissents preserved — are published in docs/reviews/. Three deliberate boundaries (log rotation, cross-file data-flow lint, air-gapped supply-chain verification) are disclosed in the README with their revisit triggers.

Same medicine the skill prescribes.

GraphSmith v0.1.0

First public release.

What's in the box

• SKILL.md — the skill itself: seven rules, builder/engineer audience modes, four phases (ground → blueprint → build → verify)
• scripts/scaffold.js — generates a zero-dependency durable workflow project
• scripts/chaos.js — kill-and-resume test harness (crash mid-step, verify no duplicate side effects)
• scripts/graphlint.js — flags fragile agent-loop patterns in existing code
• scripts/knosky-sync.js — grounds the skill in your real repo via KnoSky
• scripts/install.js — installs into Claude Code, Codex, Gemini CLI, Cursor, Windsurf/Devin, Hermes, and Copilot skill directories
• references/ — graduation ladder, multi-agent coordination rules, full build system

Install

npx graphsmith-skill

Or download graphsmith.skill (zip format, sha256 starts 5480b6d1) and drop the extracted graphsmith/ folder into your agent's skills directory.

MIT licensed.