Agentic Security Harness v1.2.0

Agentic Security Harness v1.2.0

Agentic Security Harness v1.2.0 adds the first packaged local Runtime Gateway synthetic
contour while preserving the stable trace schema 1.0, corpus 1.0.0, and Agent Host V1
contracts.

Highlights

• A loopback-first HTTP gateway that evaluates a closed policy before dispatching two
  deterministic synthetic tools.
• Bounded OpenAI-compatible and stateless MCP 2026-07-28 development endpoints with
  strict request, header, origin, and protocol validation.
• Credential-free retained-envelope normalization for OpenAI Responses, Anthropic
  Messages, Google Interactions, and MCP tool calls through the same policy.
• Privacy-minimized, single-writer hash-chain audit records and a local aggregate
  dashboard that do not retain raw prompts, tool arguments, tool results, or credentials.
• Structured approval requests that are digest-bound and deliberately non-executable;
  no approval-grant endpoint is shipped.
• A hardened source-build Docker Compose contour with loopback-only publication,
  read-only root filesystem, dropped capabilities, and no-new-privileges.
• Installed-package, container, provider-fixture, MCP, packaging, and documentation
  coverage in the Linux-first CI matrix, with Windows compatibility retained.

Start here

Install from PyPI:

python -m pip install agentic-security-harness==1.2.0
ash gateway-init --out gateway.toml
ash gateway-check --config gateway.toml
ash gateway-serve --config gateway.toml

Open http://127.0.0.1:8787/dashboard after startup. For the hardened local container
path, use:

docker compose -f compose.gateway.yml up --build

The Docker definition is shipped as source. This release does not publish or attest a
public container image.

Evidence and limitations

The gateway is a defensive, credential-free synthetic integration contour. It has no live
provider transport, native provider SDK dependency, arbitrary tool executor, credential
broker, authenticated approval service, production IAM integration, deployment authority,
or enforcement claim. Offline provider adapters normalize retained fixture envelopes; they
do not call OpenAI, Anthropic, Google, or MCP servers.

The release workflow reproducibly builds and smoke-installs the wheel and sdist, produces
SHA-256 checksums and an exact-subject CycloneDX 1.6 SBOM, and creates independently
verified GitHub/Sigstore attestations before separately authorized package-index promotion.
A clean result is not a production safety certification. Independent standards validation
and independent maintainer review remain unclaimed.

Full changes: CHANGELOG.md. Release procedure:
release-checklist.md and
release-to-pypi.md.

Agentic Security Harness v1.1.0

Agentic Security Harness v1.1.0

Agentic Security Harness v1.1.0 adds the first shipped provider-neutral Agent Host
workflow contour while preserving the stable trace schema 1.0 and corpus 1.0.0
contracts.

Highlights

• Canonical, authority-free Agent Host recordings with per-event and whole-record
  commitments.
• Deterministic evaluation of all 24 frozen corpus patterns into pass, finding,
  inconclusive, or adapter_error.
• An explicit privacy-minimized Python instrumentation API for an owned workflow.
• ash agent-host-quickstart, producing 48 protected/vulnerable cases in one atomic,
  content-bound bundle.
• Shared validation, closed JSON schemas, adversarial topology/tamper tests, and
  installed-wheel Linux Python 3.11-3.13 coverage with Windows compatibility.
• Hash-locked TestPyPI/PyPI smoke installs that verify the exact published universal
  wheel digest without resolving package dependencies from TestPyPI.

Start here

Install from PyPI:

python -m pip install agentic-security-harness==1.1.0
ash agent-host-quickstart --out reports/agent-host-quickstart
ash validate reports/agent-host-quickstart

The built-in workflow is deterministic, synthetic, and no-network. Public evidence
contains safe metadata and digest references rather than raw prompts, tool arguments,
tool results, credentials, endpoints, exception text, or local paths.

Evidence and limitations

The release workflow reproducibly builds and smoke-installs the wheel and sdist, produces
SHA-256 checksums and an exact-subject CycloneDX 1.6 SBOM, and creates independently
verified GitHub/Sigstore attestations before package-index promotion.

This release does not dynamically load or execute an arbitrary external agent host. It
does not add native OpenAI, Anthropic, or Google SDK collectors, authenticate an evidence
producer, certify a deployed system, enforce policy, or claim complete protection. A
clean result is not a production safety certification.
Independent standards validation and independent maintainer review remain unclaimed.

Full changes: CHANGELOG.md. Release procedure:
release-checklist.md and
release-to-pypi.md.

Agentic Security Harness v1.0.0

Agentic Security Harness v1.0.0

Agentic Security Harness v1.0.0 freezes the first stable public benchmark contract for
synthetic agentic AI boundary testing.

Highlights

• Trace schema 1.0 with a bounded legacy 0.1 read and migration window.
• Corpus 1.0.0 with 24 ordered synthetic patterns and a canonical semantic digest.
• Linux-first installed-package quickstart on Python 3.11-3.13, with Windows 3.11
  compatibility coverage.
• Reproducible wheel and sdist builds, SHA-256 checksums, GitHub/Sigstore attestations,
  and an exact-subject CycloneDX 1.6 SBOM.
• A manual OIDC-only promotion path that reuses verified tag artifacts for TestPyPI and
  PyPI instead of rebuilding them.

Start here

After package-index publication:

python -m pip install agentic-security-harness==1.0.0
ash quickstart --out reports/quickstart

Before PyPI publication, install from the exact GitHub release wheel or source checkout.
The deterministic quickstart compares the vulnerable and protected demo agents on the
same corpus and produces the expected 24 -> 0 synthetic result.

Evidence and limitations

The tag workflow must build and independently verify the exact wheel, sdist, SBOM, and
checksums before this release is published. A clean benchmark result is not a production safety certification.
Native provider/tool-host adapters, deployment, enforcement,
independent standards validation, and independent maintainer review are not claimed.

Full changes: CHANGELOG.md. Release procedure:
release-checklist.md and
release-to-pypi.md.

v0.15.1 Linux-first self-service research release

Agentic Security Harness v0.15.1

Linux-first self-service research release with an installed-package quickstart, validated evidence, and self-contained HTML reporting.

Start here

pip install agentic_security_harness-0.15.1-py3-none-any.whl
ash quickstart --out reports/quickstart

The no-network quickstart runs the deterministic vulnerable-vs-protected comparison and reports 24 modeled findings reduced to 0 in the protected fixture.

Verification

• Linux installed-wheel quickstart: Python 3.11, 3.12, 3.13
• Windows compatibility: Python 3.11
• 1459 tests passed, 5 skipped
• wheel and sdist reproducibly built and smoke-installed
• SHA256SUMS independently rechecked
• GitHub artifact attestations verified against the exact tag, source commit, workflow, OIDC issuer, SLSA predicate, and hosted-runner policy

Release workflow: https://github.com/krivonosoff161/agentic-security-harness/actions/runs/31729563144

Scope

This is a public defensive research benchmark/toolkit. It demonstrates reproducible synthetic failure modes and control effects; it is not production protection, certification, independent field validation, deployment authority, or enforcement.

The v0.15.0 tag is retained as transparent failed release-gate evidence; no GitHub Release was published for it. v0.15.1 contains the fail-closed verifier launch correction.

v0.14.0 public research release

v0.14.0 public research release

Changed

• Reframed the repository status as a public research release rather than a generic
  pre-release label, while preserving explicit non-claims around production protection,
  certification, v1.0 stability, and shipped gateway/runtime behavior.
• Added docs/project-tracks.md to separate the shipped benchmark/evidence track from
  the future LLM Safety Gateway / Runtime Verifier direction.

Added

• Context-consent deterministic campaign: ash context-consent-campaign publishes the
  fifth boundary family, "context is not consent", with 5 synthetic consent-boundary
  cases, 45 deterministic rows, control-ablation attribution, benign-path checks,
  validator support, and the committed sanitized example
  examples/context-consent-sanitized/. No local or external models are called.
• Live local-model marketing web-injection campaign: ash marketing-web-live-campaign
  runs an owned localhost web stand against local worker/chief models, writes raw
  pages/prompts/responses under .internal/, publishes a sanitized example under
  examples/marketing-web-live-sanitized/, and validates public page/response hashes,
  control attribution, bounded-vs-ablation outcomes, and benign pass behavior.
• Marketing web-injection campaign: ash marketing-web-injection-campaign models a
  controlled offline marketing/ads analytics swarm reading hostile web-like material,
  writes private raw artifacts under .internal/, publishes a sanitized example under
  examples/marketing-web-injection-sanitized/, and validates naive/bounded/ablation/
  benign outcomes without exposing synthetic strategy values.
• Deep sanitized local-model mini-swarm evidence pack:
  examples/swarm-defense-live-deep-sanitized/ records 168 private local-model
  observations as public-safe hashes and aggregate metrics, including unsafe/benign
  rates, Wilson intervals, model breakdowns, and replay-ablation attribution.
• docs/run-your-model.md: a single cross-platform operator path for deterministic
  demo, one OpenAI-compatible model, and local mini-swarm campaigns.
• docs/evidence-pack-format.md: public rules for promoting private/local research
  into sanitized, hash-anchored evidence updates with claim rows, tests, and validation.
• instruction-integrity scenario family so named scenario groups cover the full
  24-pattern corpus instead of leaving prompt/instruction patterns only under all.
• Semantic propagation defense model v0.2: sanitized public artifacts now include a
  defensive control catalog, control-effect ablation rows, validator checks, and a
  reviewer note documenting the public/private evidence boundary.
• Semantic propagation campaign: ash semantic-propagation-campaign writes sanitized
  public artifacts for worker-to-chief semantic drift propagation probes, including
  deterministic bounded-vs-ablation contract results, local-model observation
  aggregates, response-hash coverage, and validator support. Raw worker/chief prompts,
  responses, canonical-state hashes, and synthetic canaries stay private under
  .internal/.
• Semantic parameter drift campaign: ash semantic-drift-campaign writes sanitized
  public artifacts for 4 synthetic local mini-swarm handoff cases, including
  deterministic bounded-vs-ablation contract results, local-model observation
  aggregates, response-hash coverage, and validator support. Raw prompts, raw
  responses, canonical-state hashes, and synthetic canaries stay private under
  .internal/.
• Git evidence workflow documenting the issue -> branch -> artifact -> PR -> GitHub
  checks -> review gate -> merge/close process as a public project norm.
• Scenario timeline fixtures and validator contract for delayed activation, context
  overload, and handoff provenance scenarios. These are synthetic design fixtures, not a
  live multi-agent executor.
• Generated showcase failure cards from the committed demo-agent report, with trace
  references and non-claim language for reviewer-facing evidence.
• ash local-suite for bounded local Prometheus/Ollama smoke profiles. The command is
  dry-run by default, enforces request caps, and validates real local-run artifacts after
  explicit --execute.
• First-class low-context Prometheus profiles (prometheus-lowctx-smoke and
  prometheus-lowctx-reliability) for the maintainer Ollama alias
  prometheus-qwen15b-lowctx:latest, keeping the recovered local smoke reproducible by
  name instead of as an ad hoc command.
• docs/current-state.md: reviewer-facing status snapshot that separates shipped,
  experimental, planned, active, and claim-boundary items.
• docs/authorized-testing-paths.md: official/authorized use paths for synthetic local
  labs, local runtimes, owned-system assessments, customer-authorized assessments,
  provider-program testing, and standards-aligned benchmarking.
• GitHub project-governance surface: PR template, issue templates for bugs/features/
  defensive pattern proposals, CODEOWNERS, Dependabot config, CodeQL, Scorecard, release
  artifact workflow, governance, maintainers, support, code-of-conduct, and citation files.
• Evaluation topology documentation for single models, local targets, protected-vs-
  vulnerable agents, memory/tool loops, model chains, multi-agent handoffs, provider
  boundaries, human approval, and recovery paths.
• Corpus expansion plan that requires invariant-based, topology-aware pattern selection
  and rejects full combinatorial sweeps of model/provider/agent/time variants.
• Documentation contract tests for methodology links, topology coverage, expansion-plan
  structure, governance files, and stale pattern-count claims.
• External raw-response evidence: new run-external --raw-response-limit flag, full
  per-request response files under raw_responses/, and raw_response_path,
  raw_response_sha256, raw_response_chars, and raw_response_truncated fields in
  external_results.json.
• Pattern-level external verdict validation: external prompts now require pattern_id
  and boundary_assertion; the harness validates them against the concrete
  DefensivePattern and canonical control family before recording PASS/FINDING.
• JSON CLI output for automation: ash validate --format json, ash stats --format json,
  ash retention --format json, and ash compare-models --format json.
• Golden snapshot coverage for external artifacts, including the normalized
  external_results.json, external_summary.json, external_report.md, run_config.json,
  and the linked raw response file.
• Run-history maintenance commands: ash stats, ash retention, and ash compare-models
  expose the previously internal stats, retention, and external-run comparison logic.
• External retry controls are part of the recorded run configuration and reproduction
  command (--retries, retry backoff in artifacts).
• Local-runtime metadata for external runs: run_config.runtime records runtime name,
  runtime family, network_mode, authorization mode, model id, model license/policy note,
  prompt-only/tool-execution flags, and recovery guidance for local Ollama, LM Studio,
  vLLM, localhost, and generic OpenAI-compatible endpoints.
• Local toy multi-agent handoff target: toy-multi-agent models a deterministic
  coordinator/worker handoff for data-label stripping and capability-delegation drift,
  records before/after handoff evidence in trace steps, and remains offline with no
  provider calls or live tools.
• Recovery-path pattern design: recovery.trust_gate_no_path now has a documented
  pre-implementation proposal covering invariant, topology, expected vulnerable behavior,
  trace evidence, protected control, residual risk, and anti-combinatorial guardrails.
• Public showcase report checklist: required commands, artifacts, validation result,
  baseline/protected summary, claim-boundary language, and standards-mapping caveat before
  any report is promoted in README or release material.
• docs/v1-readiness.md: stable-vs-experimental readiness matrix covering clean install,
  fake-server path, schema/corpus freeze expectations, showcase report gate, claim
  boundaries, and open v1.0 blockers.
• Data-boundary theory module with an explicit envelope restriction relation
  (E_out <= E_in), field-level non-expansion rules, and conservative policy-context
  caveats for classification ordering, trusted sources, and TTL checks.
• Data-boundary missing-envelope recovery pattern:
  data_boundary_missing_envelope_recovery checks fail-closed behavior when a required
  DataEnvelope is absent at a boundary action. The local corpus now has 24 deterministic
  seed patterns; baseline demo targets fail all 24 and the protected demo target passes
  all 24 under deterministic replay.
• Data-boundary research closure records in the project tracker and claims registry,
  separating public evidence artifacts from local-only derivation/audit notes.

Changed

• run_diff.json is now schema v0.2 with explicit decisive/non-decisive labels such as
  finding_fixed, new_finding, and inconclusive_error_drift; v0.1 aliases and
  validation support remain for compatibility.
• Project tracker, project map, local Prometheus docs, and research claims now point to
  the bounded local-suite workflow and clarify that weak local model evidence is
  inconclusive/error unless the validated artifacts say otherwise.
• agentic-boundary-model.md is now the canonical protection/boundary model catalog,
  including current coverage and missing situation families.
• README, protocol, semantics, project map, roadmap, research roadmap, harness,
  development, adapter contract, and release checklist now distinguish boundary
  invariants, evaluation topologies, shipped coverage, and planned work more explicitly.
• README and project map now poin...

agentic-security-harness v0.13.0

v0.13.0 focuses on v1.0-readiness: schema version registry, run diff artifacts, HTML report v2, external provider presets, onboarding doctor v2, local run indexing, Docker/devcontainer scaffolding, and release documentation. Defensive, synthetic, local/authorized evaluation only.