v2.1.0: Enterprise Security & High-Concurrency Engine

AW-1 Circuit Breaker v2.1.0: Enterprise Security & High-Concurrency Engine

AW-1 Circuit Breaker v2.1.0 transitions the engine from a prototype security interceptor into a production-grade, Tier-1 execution gate for autonomous AI agents, MCP toolchains, and LLM orchestration frameworks. This release introduces universal framework decorators, declarative Policy-as-Code with dynamic hot-reloading, zero-day reflection exploit defenses, structured audit telemetry, and multi-version enterprise CI validation.

---

What’s New in v2.1.0

1. Universal @guard Framework Adapter

A zero-friction, drop-in execution guard designed to wrap arbitrary synchronous functions, asynchronous coroutines (async def), and structured agent tool payloads (OpenAI/Anthropic tool schemas, LangChain BaseTool, CrewAI, and AutoGen dispatches).

• Fail-Closed Execution Gate: Inspects abstract syntax trees (AST) prior to runtime dispatch. If code or argument payloads violate security bounds, dispatch is aborted instantly with a PermissionError.
• Zero Supply-Chain Dependencies: Operates entirely within the Python standard library, maintaining zero runtime overhead and zero third-party vulnerability attack surface.
• Backward Compatibility: Fully preserves the legacy protect_tool interface while exposing @guard at the package root (from aw1 import guard).

2. Declarative Policy-as-Code Engine (SecurityPolicy)

Security teams can now declare and manage security boundaries as version-controlled code rather than modifying application logic:

• Configurable Enforcement Rules: Configures granular blacklists for prohibited modules (subprocess, shutil, socket, ctypes, multiprocessing), prohibited syscalls (system, popen, execv, fork, kill, rmdir), and restricted built-ins (eval, exec, compile, __import__).
• Strict Allowlist Mode: Supports zero-trust isolation where only explicitly approved modules (e.g., math, json, datetime) are permitted to execute.
• AST Complexity & DoS Caps: Configurable caps for maximum node counts (default 1,500) and AST nesting depth (default 25 levels) prevent syntax-bomb denial-of-service exploits.
• Dynamic Hot-Reloading: Automatically detects disk changes to aw1.policy.json via file mtime tracking and reloads active enforcement rules without restarting long-running worker processes.

3. Reflection & Sandbox Breakout Defense

Prevents advanced runtime escape vectors targeting Python object introspection. The policy engine intercepts and blocks access to critical dunder attributes:

• Prohibits __subclasses__, __globals__, __code__, __builtins__, __bases__, and __mro__.
• Neutralizes classic sandbox escape payloads (().__class__.__subclasses__()) in under 0.13 ms.

4. Microsecond Structured Audit Telemetry

Every arbitration decision emits a machine-parseable JSON log record designed for direct ingestion into Datadog, AWS CloudWatch, Splunk, or OpenTelemetry (OTel) collectors:

{
  "event": "aw1_arbitration",
  "timestamp_epoch": 1792537282.9182,
  "target": "agent_tools.dispatch_code",
  "verdict": "FAIL_CLOSED",
  "latency_ms": 0.1043,
  "reason": "Strict allowlist violation: module 'requests' not permitted",
  "payload_sample": "import requests; requests.get('[https://example.com](https://example.com)')"
}

---

High-Concurrency Benchmark Results

Evaluated across a stress test of 10,000 asynchronous agent dispatches in concurrent batches of 500 simultaneous tasks:

Metric	Result	Industry Standard (LLM-as-a-Judge)
Throughput	8,485.0 dispatches/sec	~5 – 20 req/sec
Median Latency (P50)	0.0776 ms (77.6 µs)	500 – 1,500 ms
90th Percentile (P90)	0.0941 ms (94.1 µs)	1,200 – 2,000 ms
95th Percentile (P95)	0.1066 ms (106.6 µs)	1,500 – 2,500 ms
99th Percentile (P99)	0.2263 ms (226.3 µs)	2,000 – 4,000 ms
Attack Blocking Latency	< 0.13 ms (Fail-Closed)	N/A (Probabilistic)
Deterministic Guarantee	100% Mathematical AST Match	Probabilistic (~85–95%)

---

Verified Compatibility Matrix

Automated CI regression testing validates full compatibility across all active enterprise Python versions:

• Python 3.10: Supported (CI Verified)
• Python 3.11: Supported (CI Verified)
• Python 3.12: Supported (CI Verified)
• Python 3.13: Supported (CI Verified)

---

Installation & Upgrade

Via PyPI

pip install --upgrade aw1-circuit-breaker

Via UV / UVX

uv add aw1-circuit-breaker

MCP Client Integration (Claude Desktop / Cursor)

{
  "mcpServers": {
    "aw1-circuit-breaker": {
      "command": "uvx",
      "args": ["aw1-circuit-breaker"]
    }
  }
}

---

Quickstart

1. Synchronous & Asynchronous Agent Tool Gating

import asyncio
from aw1 import guard

# Standard Python tool
@guard
def execute_code(code: str) -> str:
    return "Executed cleanly"

# Async agent dispatch (CrewAI, LangGraph, AutoGen)
@guard
async def dispatch_tool_call(tool_call: dict) -> dict:
    return {"status": "success", "result": "computed"}

# Benign call passes
execute_code("total = sum([i for i in range(100)])")

# Malicious payload raises PermissionError and logs FAIL_CLOSED telemetry
try:
    execute_code("import subprocess; subprocess.run(['rm', '-rf', '/'])")
except PermissionError as e:
    print(f"Intercepted: {e}")

2. Runtime Policy Configuration

from aw1.policy import configure_policy

# Load custom enterprise policy or lock down to strict allowlist
configure_policy(policy_data={
    "version": "1.1",
    "policy_name": "fintech-zero-trust",
    "strict_allowlist_mode": True,
    "allowed_modules": ["math", "json", "decimal"],
    "prohibited_modules": ["subprocess", "shutil", "socket"]
})

---

Registry & Source Metadata

• PyPI Distribution: https://pypi.org/project/aw1-circuit-breaker/2.1.0/
• MCP Registry Entry: io.github.MvikManners/aw1-circuit-breaker
• Schema Specification: Model Context Protocol 2025-12-11
• Repository: https://github.com/MvikManners/aw1-circuit-breaker

v2.0.1

v2.0.1 release: Deterministic AST security circuit breaker and runtime validation for autonomous AI agents and MCP servers.