BREAKING: drops `auto_verify_and_confirm` and `AutoVerifyResult`.
src/pisama_agent_sdk/auto_verify.py contained SDK-side reimplementations of
three private backend verification primitives, and said so in its own docstring:
"""Vendored bounded-delta verification.
Lifted from backend/app/healing/innovations/prompt_delta.py -- same
50-token cap, same residual-signal check on the agent's response with
the delta appended."""
This package is MIT and published to PyPI, so that shipped publicly in both the
wheel and the sdist of 0.2.1. What it disclosed:
- working implementations of PromptDelta, ShadowReplay and ConsensusCheck
- the private backend module path, confirming internal structure
- tuned constants (the 50-token delta cap, _SAFE_TURN_BUDGET = 3)
- three guardrail delta templates in _build_prompt_delta
- a comment mapping which primitives run server-side and why, i.e. the
free/paid boundary
Healing and fix generation are paid features. Removing the module rather than
sanding off the identifying comments, because renaming things while keeping the
algorithm would be theatre: the IP is the algorithm and its constants.
Not replaced with a server-delegating call: no endpoint exists for running the
primitives on demand (healing.py exposes only /confirm-applied and
/verification-metrics). Building one is a backend feature, not a packaging fix.
Callers who need verification should use the hosted service.
Minor bump rather than patch because a public symbol is gone. 122 tests pass.
Audit note: the fix-efficacy harness, the guardrail strategy library, the trained
guardrail_policy.json, and all fix-generation prompts were verified absent from
every published artifact. This module was the only exposure.
Co-Authored-By: Claude <noreply@anthropic.com>