riskgate 1.0.0rc8: homepage

Metadata-only release (no code changes since 1.0.0rc6).

• Homepage: https://riskgate-phi.vercel.app/
• Documentation: https://reallysaurabh.github.io/riskgate/

Install: pip install --pre riskgate

riskgate 1.0.0rc7: documentation site

Documentation-only release (no code changes since 1.0.0rc6).

• Docs: https://reallysaurabh.github.io/riskgate/, rebuilt from docs/ on every push to main.
• PyPI's Documentation link points there.
• Fixed 17 lists that rendered as run-on text.

Install: pip install --pre riskgate

riskgate 1.0.0rc6: four fixes before the API freeze

Four fixes before the 1.0.0 API freeze. No calibration maths and no artefact schema (riskgate.calibration/v1)
change, and the text of Decision.reason is unchanged.

Security

• Agent-facing feedback no longer contains robust margins or the calibrated threshold.
  • New Decision.agent_reason, a numbers-free text the agent may see; adapters send agent_reason or reason.
  • Decision.reason is unchanged and stays in audit records, on_ask and approver payloads.
  • Fail-closed decisions get a generic agent text, so exception details (paths, connection strings) stay internal.
  • The ADK confirmation hint uses the agent text too.
• MCP proxy _meta["riskgate/decision"] no longer carries scores, the threshold or the full reason unless
  expose_scores=True (riskgate serve-mcp --expose-scores) is set for a trusted client.

Fixed

• A stale calibration no longer acts. With require_calibration=False, a stale artefact (status VOID) no
  longer produces CERTIFY or PROBE:
  • such decisions are returned as ASK;
  • the would-be verdict goes in Decision.would_verdict and the audit record;
  • REJECT is unchanged.
  • The docs no longer call this setting "shadow mode".

Changed

• Human declines are reported as declined. When a human or on_ask says no, the agent gets
  {"status": "declined", ...}. This applies in guard, the ADK adapter (previously "rejected"), the LangGraph
  adapters, the MCP proxy and the Claude Agent SDK can_use_tool callback. needs_approval now only means that no
  approver was reachable, or that an ADK confirmation is still pending.
• Every blocked-call feedback carries "executed": false.
• New guard(..., raise_on_ask=True). With False, an ASK without on_ask returns needs_approval feedback
  instead of raising. guarded_function_tool now uses this instead of a stand-in on_ask=lambda d: False, which
  would have reported every ASK as declined.

Documentation

• New "Safe database dry-runs" section (docs/operations.md): a savepoint on the live database is not a sandbox
  (MySQL, MariaDB and Oracle commit DDL implicitly; PostgreSQL rollbacks still lock and write WAL; EXPLAIN ANALYZE
  executes).
• Savepoint wording corrected in the README, byo_domain, operations, calibration, faq, quickstart and SPEC. The
  refunds example explains why its per-ticket in-memory SQLite savepoint is safe.

Tests

• tests/test_adapter_semantics.py: the outcome-semantics table.
• New VOID tests (certify and probe), agent-reason tests, and decline contract tests for MCP and ADK.

Install: pip install --pre riskgate · Claude Code: /plugin marketplace update riskgate

riskgate 1.0.0rc5: agent skills

Added

• Agent skills (skills/, Agent Skills standard):
  • riskgate: gate a risky tool, with a runnable quickstart;
  • riskgate-from-traces: traces + outcomes → a calibrated gate and a replay report, with inspect_traces.py.
• Packaging for the skills:
  • a Claude Code plugin and marketplace (.claude-plugin/; /plugin install riskgate@riskgate);
  • a Gemini CLI extension (gemini-extension.json);
  • claude.ai zips attached to every GitHub release.
• riskgate.adapters.claude_agent_sdk: pretooluse_hook and can_use_tool for the Claude Agent SDK, with
  contract tests against claude-agent-sdk 0.2.168. Extra: riskgate[claude-agent-sdk].
• Docs: docs/agent_skills.md.

Install the skills

• Claude Code: /plugin marketplace add reallysaurabh/riskgate, then /plugin install riskgate@riskgate
• Claude apps: upload riskgate.zip / riskgate-from-traces.zip (attached below) under Customize → Skills
• Gemini CLI: gemini extensions install https://github.com/reallysaurabh/riskgate
• Codex / others: copy skills/* into .agents/skills/

Library: pip install --pre riskgate · Guide: docs/agent_skills.md

riskgate 1.0.0rc4

Added

• riskgate.traces: onboarding from agent traces plus an outcome signal, without a simulator.
  • load_traces (JSONL runs with tool calls and read outputs) and load_outcomes (CSV / JSONL joined by trace id).
    Label sources that name an LLM judge or an approval are refused.
  • infer_tool_kinds: read vs write; unknown tools count as writes.
  • decision_points: one labelled write each, with a no-look-ahead TraceContext; unlabelled and conflicting writes
    are counted, not guessed.
  • seal_split: group-disjoint fit / cal / eval with a content digest.
• DiscreteWorlds.fit: learn the prior and evidence tables from labelled examples (use the fit split).
• Docs: docs/from_traces.md, including the three rules that keep the guarantee. Example
  examples/use_cases/from_traces.py.

Install: pip install --pre riskgate

Guide: Start from your traces

riskgate 1.0.0rc3

Building blocks for the use cases on the RiskGate site (map of all sixteen: docs/use_cases.md).

Added

• riskgate.worlds for decisions that hinge on one hidden fact with a few values:
  • DiscreteWorlds: naive-Bayes hypothesis provider. Scores are −log posterior; unobserved fields are skipped, so
    one provider serves both probe stages; the tables are fingerprinted.
  • OutcomeTable: which action is safe in which world (or a callable) and what each read-only lookup reveals;
    unnamed actions are unsafe (fail closed). table.probes(), table.noop, table.spec.
  • Score functions nearest_violation and unsafe_mass (exported).
• riskgate.provenance: prompt-injection gate. AgentContext, ToolOutput, ProvenanceWorlds (one
  hypothesis per untrusted output, scored by an LLM-free instruction_score), ProvenanceModel, entities.
• riskgate.replay: replay(gate, episodes) → ReplayReport (follows probes through after_probe);
  resplit(...) validity study over random (grouped) splits; sweep(...), the error budget as a dial.
• riskgate.rules: needs_person, never, amount_above (fails closed on non-numbers), irreversible, with
  versions pinned to their parameters.
• examples/use_cases/: payments (UPI), missing-item refund, card dispute, idle-VM cleanup, prompt injection.
  All simulated; run in the test suite.

Changed

• Probe selection when nothing is certifiable before the probe (λ₁ = +∞). The gate used to find no
  "disagreement" between hypotheses, so it never probed. It now judges disagreement by the spec itself (margin ≥ 0),
  the same rule in calibration and deployment. The two-stage bound is unchanged; gates whose λ₁ is finite behave as
  before.

Install: pip install --pre riskgate

Full map of use cases: docs/use_cases.md