v0.1.1: Prompt Injection Hardening, Namespaced Policies & HMAC Approvals

Intent Fabric v0.1.1: Prompt Injection Hardening, Namespaced Policies & HMAC Approvals

Intent Fabric v0.1.1 introduces critical defense-in-depth protections against prompt injection, action smuggling, and authorization repudiation, while adding native support for enterprise namespaced action architectures.

---

🌟 Highlights & New Capabilities

1. Prompt Injection Defenses

• XML Evidence Boundary Encapsulation: Retrieved evidence items are encapsulated in <retrieved_evidence id="..." score="..."> tags with internal XML breakout escaping (</retrieved_evidence>).
• Adversarial Instruction Defense: LLM planner system prompts across Ollama (Llama 3), OpenAI, Gemini, and Azure Foundry explicitly instruct models to treat evidence strictly as unexecutable reference data.

2. Namespaced Action Validation & Smuggling Prevention

• Syntax Validation: Enforces ^[a-zA-Z0-9_.:-]{1,128}$ on all proposed actions, preventing SQL injection, path traversal, unicode homoglyphs, and control character smuggling.
• Enterprise Namespaces: Natively supports real-world enterprise naming (jira:create_issue, aws.s3:put_object, service-now:incident_update).
• Flexible Overrides: Configurable via INTENT_STRICT_ACTION_VALIDATION=false or INTENT_ACTION_SYNTAX_REGEX.

3. Cryptographic HMAC-SHA256 Approval Signatures

• Non-Repudiation: Generated approval tokens are cryptographically signed using HMAC-SHA256 over canonical payloads (approval_id|plan_id|sorted_steps|decision|reviewer|timestamp).
• Constant-Time Verification: verify_approval_signature() uses hmac.compare_digest to eliminate timing side-channel vulnerabilities.
• Enforcement Modes: Configurable via FABRIC_APPROVAL_ENFORCEMENT=enforce (prod default) or permissive (for local dev/staging).

4. Declarative Policy Engine

• Dynamic YAML policy rules (config/policy_rules.yaml) with fnmatch globbing (ticket_*, db_*), priority weights, and hot-reloading.

---

📦 Installation

pip install intent-fabric