Skip to content

GraphSmith v0.3.0 — GraphSmith Attestation (GSA)

Choose a tag to compare

View all tags
@pjpoulose pjpoulose released this 24 Jul 22:27
v0.3.0
a5f4d03

GraphSmith v0.3.0 — the GraphSmith Attestation (GSA) standard

MCP connects your agents; GSA proves what they did. v0.3.0 turns each AI-workflow run into a signed, replayable, tamper-evident attestation bundle any CI can verify and any regulator can read — evidence, never a certification — and delivers the regulated register and air-gapped verification deferred from v0.2.0.

What's new

  • GSA attestation standard — a portable bundle format + a normative verification algorithm. gsa-verify (verifier), gsa-produce (honest-by-construction sealing), gsa-plan (drift/destructive-change detection + deterministic replay). Ed25519 / ECDSA-P256 / RSA-PSS signing, local keypair by default (no PKI). A contradictory or tampered bundle does not verify.
  • The regulated register (four lanes, each adversarially tested) — approver identity (N-of-M by distinct signer keys), obligations→controls (coverage recomputed from evidence; manual-only can never be marked covered), evidence retention (append-only, hash-chained), and air-gapped verification (out-of-band maintainer signature; verify offline with no trust in the registry). A fail-closed regulated-mode activation guard activates only on a complete, valid register.
  • MCP attestation shim — a boundary attestation for any MCP-speaking agent, with no agent changes. Verified against agents GraphSmith didn't build: Claude Code, Cursor, LangGraph, Devin, Windsurf. It attests what crosses the MCP boundary and never claims what it didn't observe.
  • Conformance kit + evidence badge, KNOWN-LIMITATIONS.md, a worked offline-verify transcript, and a NIST prior-art submission draft.

Adversarial hardening (the discipline)

Every security-tier component was built by one model family and adversarially tested by ≥2 different, non-Anthropic families (Codex/GPT, DeepSeek, Mistral, Qwen); the orchestrator re-ran every suite. 16 real defects were found and fixed — 1 critical (an N-of-M Sybil bypass), 4 high, 11 medium — every one re-verified. Zero were found by model review: two families returned "clean" on the module whose executed suite then found nine bugs. Consolidated record: docs/reviews/2026-07-24-v0.3.0-hardening.md.

Closed by a 282-scenario gauntlet — all HOLD, 0 BREAK — independently reproduced by a non-Anthropic harness (Codex: 282 / all HOLD / 0 BREAK). Reproduce it yourself: node tests/gauntlet/v0.3.0-battery.js.

Honest scope (binding)

GSA is an evidence layer, not a certification. A valid bundle attests what ran and that the record is unaltered — never that a workflow is safe, correct, or compliant. External single-delivery is run-once, replay-verified of recorded effects, not exactly-once (true single-delivery needs the external system's idempotency key). Per-skill filesystem/model/subprocess grant enforcement is targeted for v0.4.0 (v0.3.0 attests network egress + external-call presence). Trust of a signer's key is the verifier's policy. Full boundaries: KNOWN-LIMITATIONS.md.

Install / verify

npx skills add SathiaAI/graphsmith
node scripts/gsa-conformance.js       # portable conformance battery + evidence badge
node scripts/gsa-offline-demo.js      # offline verification (network denied)

Pending CI (updated when the release workflow runs)

  • 3-OS verify matrix (Ubuntu/Windows/macOS × Node 18/22) and the per-platform capability badge — unavailable profiles render unavailable, never green.
  • Full agent×OS conformance matrix — see docs/GSA-CONFORMANCE.md.

What's next — v0.4.0

Per-skill capability grant enforcement (filesystem/model/subprocess); keyless / transparency-log signing (opt-in); deeper evidence-retention automation; and broader independent GSA implementations toward a ratified (non-draft) protocol.

Reviewed, not certified — this attests tested behaviour, not fitness for any purpose. Release-owner attestation: the notes reflect tested behaviour, all adversarial findings (including dissent) are preserved, and the honest-language + publication-hygiene gates passed. — Paul Poulose

Assets 2
Loading