SDK 0.3: agent hardening, ML span model, audit CLI

[chiruu12]

Summary

• Wire OpenClaw-style agent hardening: auto boundary wrap on untrusted sources, session taint + tool profiles, crescendo trajectory gate, intent verification on side-effect tools
• Add Hermes/persona jailbreak regex patterns and spoof-resistant <<<UNTRUSTED>>> boundary markers
• Add local ML span model path (injection_ml), encoding classifier, safe-prefix scan cache, and unplug-audit CLI
• Expand test coverage (508 tests): agent hardening, boundaries, session taint, encoding probes, redaction

Test plan

• cd sdk && uv run pytest -q (508 passed)
• uv run ruff check src/unplug
• unplug-audit --require-ml --probes with v11 checkpoint when available
• MCP boundary tools smoke test against updated Guard API

Notes

• Boundaries auto-wrap defaults on for RETRIEVED / TOOL_OUTPUT — configure via [boundaries] in TOML
• Container sandbox / channel pairing remain host responsibilities (documented in decisions.md)

[Copilot]

Pull request overview

This PR ships SDK 0.3, a large security and agent-hardening release. It wires OpenClaw-style boundaries, CaMeL-lite session taint with tool profiles, crescendo trajectory and intent gates, a local ML span model (injection_ml) with composite encoding classifier, a new unplug-audit CLI, and a renamed PyPI package (unplug-ai). It also reworks redaction (new RedactionMode with [BLOCKED:*] tags) and expands evasion patterns and test coverage to 508 tests.

Changes:

• Agent hardening: spoof-resistant <<<UNTRUSTED>>> boundaries, session taint + tool profiles, crescendo trajectory slope detection, intent/side-effect mismatch findings, Hermes/persona/red-team injection patterns.
• ML pipeline: optional Transformers BIOES span model behind ModelProvider, composite encoding classifier, safe-prefix cache versioning, base64 size limits, secret-prefix blob skipping.
• Tooling/packaging: unplug-audit CLI with FP/encoding/boundary probe suites; PyPI rename to unplug-ai; new publish workflow; Guard singleton becomes thread-safe.

Reviewed changes

Copilot reviewed 83 out of 85 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
sdk/src/unplug/guard.py	Adds ML wiring, approval flow, session taint hooks, threadsafe init, profile enforcement
sdk/src/unplug/pipelines/{input,output,toolcall,base}.py	Boundary wrap, ML-after-regex order, redaction via apply_span_redactions, trajectory findings, taint/intent in toolcall
sdk/src/unplug/core/{boundaries,approval,intent,trajectory,redaction,model_runtime}.py	New modules implementing each subsystem
sdk/src/unplug/core/{encodings,normalize,secrets,policy,stats,context,cache}.py	Composite classifier, evasion-only stages, ReDoS-guarded registry, RedactionMode plumbing, taint state on context
sdk/src/unplug/scanners/{injection,destructive,harmful,leakage,financial,secrets}.py	Normalization in scanners, span mapping fixes, reversed text, SSN/email evasions, replacement deferred to pipeline
sdk/src/unplug/safeguards/injection/patterns.py, injection_ml.py, registry.py	New Hermes/persona/fake-chat patterns + ML span scanner registration
sdk/src/unplug/ml/*	New optional ML package: BIOES decoder, span model, providers, registry, device selection
sdk/src/unplug/config/{agent_policy,tools,policy,guard,loader}.py	New TOML sections (boundaries, trajectory, intent, tools, models)
sdk/src/unplug/audit/*, sdk/src/unplug/cli/audit.py	New audit runner + probe suites + CLI entrypoint
sdk/src/unplug/api/types.py, models.py	ApprovalRequest, span validators, RedactionMode on ScanRequest
sdk/tests/*	15 new test modules covering agent hardening, boundaries, taint, encoding probes, redaction, FPs, adversarial, stress
sdk/pyproject.toml, README.md, PUBLISH.md, .github/workflows/*.yml	Rename to unplug-ai, add unplug-audit script, publish workflow, security regression CI step
sdk/unplug.example.toml, benchmarks/builtin_samples.py, Makefile, context/product/decisions.md	Config example, benchmark samples, security make target, decision log

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.