Skip to content

v2.11.0 — MACI fail-closed by default, legitimacy kernel stable, PyPI metadata repair

Latest
Latest

Choose a tag to compare

View all tags
@dislovelhl dislovelhl released this 29 Jul 02:47
v2.11.0
40fbd3a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Constitutional governance for AI agents — deterministic enforcement before execution, MACI role separation, and tamper-evident audit trails.

pip install acgs-lite==2.11.0
# or with all LLM integrations:
pip install "acgs-lite[all]==2.11.0"

⚠️ Breaking change — MACI is now fail-closed by default

GovernedAgent now defaults to enforce_maci=True. Callers must pass a maci_role at construction and a governance_action for governed runs. A misconfigured or missing role/action now fails closed instead of silently treating MACI as advisory.

# 2.10.x — MACI advisory by default
agent = GovernedAgent(client, constitution="rules.yaml")

# 2.11.0 — role and action are required for governed runs
agent = GovernedAgent(client, constitution="rules.yaml", maci_role="proposer")
agent.run(prompt, governance_action="send_email")

If you deliberately need the old behavior for a non-side-effecting evaluation flow, pass enforce_maci=False explicitly — it now warns when a maci_role is set alongside it.

Security

  • Bundled a fail-closed Claude Code governance hook route, so local hook enforcement no longer depends on an unbundled /x402/check sidecar.
  • Closed adversarially proven fail-open paths in framework integrations: delegated __getattr__ calls, bytes-like and non-first positional code/task carriers, dict-keyed smolagents step_callbacks, unknown hook decision classes, and multi-governor wrapping gaps.
  • Hardened failure behavior — validator crashes fail closed, blocked CRITICAL decisions are retained in full-audit mode, and builtin-laundering / __builtins__ escape vectors are blocked.
  • Added a responsible-disclosure policy in SECURITY.md with scope and response-window targets. It does not claim certification, production readiness, or third-party validation.

Added

  • Graduated the Runtime Legitimacy Kernel to a stable public surface, with receipt-bound legitimacy contracts as the committed membrane story.
  • A five-trigger adversarial fail-closed suite with committed evidence artifacts covering authorization, constitution version, policy staleness, receipt integrity, and audit-evidence verifiability.
  • A CI governance-regression gate with invariant pinning, so previously closed bypass vectors, the canonical constitutional hash, and receipt-binding assumptions are checked continuously.
  • Japan AI Guidelines for Business compliance mapping, a Swarms governance adapter, xAI/Grok and smolagents adapter coverage, SMT boundary verification for governed callables, and a recruiting-domain constitution template.
  • An experimental gove extra bridging the gove-zone kernel through a ConstitutionPolicy adapter (Python ≥ 3.11).
  • examples/release_proof.py — a deterministic, API-key-free proof artifact for fresh-venv verification.

Fixed

  • Capped the mcp extra at mcp>=1.0,<2.0. MCP SDK 2.0.0 removed Server.list_tools, which broke integrations.mcp_server against the previously unbounded requirement.
  • Repaired 49 stale repository URLs left over from the org transfer, and absolutized 28 relative README links so they resolve on the PyPI project page instead of 404ing.
  • Populated the previously blank Security and Changelog documentation pages, with mkdocs build --strict now gating recurrences.
  • Repaired constitution templates that failed to load, and added a guard that every shipped template loads and enforces.
  • Corrected the advertised compliance-framework count to the 20 the registry actually holds.

Known limitations

  • Simulations and seeded harness runs are not empirical benchmarks. The real-LLM experiment harness ships, but real artifacts require provider API keys and committed results.
  • There are no independently confirmed production users in this release.
  • Certification, third-party validation, and independent adoption are external outcomes and are not claimed here.

Verification

Built artifacts pass twine check; a fresh-venv install imports 2.11.0 and reproduces the release proof (ALLOW/TRANSFORM/DENY, denied and receiptless execution blocked, audit chain valid). Constitutional hash 608508a9bd224290 is unchanged.

Full changelog: v2.10.1...v2.11.0

Assets 2
Loading