GuardTrellis 0.1.7

GuardTrellis 0.1.7

• Preserve the Gemini example's one-request contract with newer Google Gen AI SDKs by
  disabling automatic continuation. Incomplete responses with continuation tokens become
  ERROR without another HTTP request or deliverable text. Retain compatibility with older
  supported SDKs that do not expose the continuation option, with mocked regressions at the
  actual HTTP boundary.
• Refresh the locked optional integrations and development tooling: FastAPI, LangGraph,
  LangGraph Checkpoint, LangSmith, OpenAI, Google Gen AI, and Ruff. Declared dependency
  ranges remain unchanged.
• Add a separate bounded concurrency evaluation for existing async APIs, with exact
  checked callback delivery, rejection isolation, resource observations and a reduced
  cross-platform CI protocol. Retain historical evidence and incomplete measurements;
  no detector, scheduler or SDK deadline change is included.
• Add a control-coverage guide linking configured behavior to source, regression tests,
  retained evidence and application responsibilities. Refresh current roadmap and recipe
  status while preserving historical reports and decisions.

Upgrade note: applications that copied examples/gemini_app.py should adopt its explicit
continuation configuration when updating the Gemini SDK. No core SDK API, default-policy,
or detector behavior changes from 0.1.6.

Install with python -m pip install guardtrellis==0.1.7.

Verification

• Released from commit 9ee817b857f72ffbbc5fcc8cc7c1927dc9f8ff44. PR #66 supplies bounded contributions to #45 and #46; their wider criteria remain open. The Gemini example/dependency changes were merged in PR #64.
• All 16 PR validation checks and exact-main CI passed, including native Windows, macOS and Linux/Python 3.11–3.14. Windows logs confirm 948 tests, the new concurrency smoke and fresh wheel/source installation checks. CodeQL passed.
• The retained macOS/Python 3.12 concurrency baseline records 720/720 exact checked outcomes across 12 fixed cells and 36 completed/reaped children. These authored synthetic development measurements do not establish general detector accuracy or production capacity; historical misses, false positives and timeout limitations remain documented.
• TestPyPI rehearsal and PyPI promotion and verification passed. Promotion reused the exact verified files without rebuilding, checked public file hashes/descriptions, and tested fresh wheel/source installations with core-only and optional extras. Provider examples used HTTP mocks; no new live-provider claim is made.
• A fresh unpinned pip install guardtrellis outside the checkout selected 0.1.7 and passed checked PII redaction, secret blocking without callback delivery and async allowed delivery.
• Published package: PyPI 0.1.7.

SHA-256

• guardtrellis-0.1.7-py3-none-any.whl: ba8b6fb0056a561b9cd4e1c9f1dedf4cd2461910170f497065f2c50ad66263c4
• guardtrellis-0.1.7.tar.gz: c64b1b85cf84a76eb1b7637cf041363eacf56de82d49aa7381bb271f3a3c464f

The attached release.json and SHA256SUMS retain the exact source commit, original TestPyPI workflow run and artifact hashes.

GuardTrellis 0.1.6

GuardTrellis 0.1.6

• Add optional PIIScanner(phone_mode="formatted") for a bounded ASCII international
  phone grammar: an explicit plus, 8–15 digits, single spaces/hyphens between groups,
  and at most one balanced parenthesized digit group. Match and redact complete original
  spans, including +12025550123-4567; invalid/overlong candidates do not fall back to
  a contiguous-prefix match. Such candidates remain undetected, rather than being blocked.
• Add regression coverage and a versioned default-versus-formatted evaluation with exact
  action, span and checked-delivery comparisons, retained limitations, and bounded resource
  observations. Preserve all historical corpora, profiles and baseline reports.
• Simplify the distribution smoke stages while preserving core-only, OpenAI-only and
  all-extras installations, assertions and example executions for both distributions.

Upgrade note: existing calls retain the default phone_mode="contiguous", including its
known partial-prefix matches. Enable formatted mode explicitly in each desired stage;
formats still controls whether phones are checked. This additive optional API retains
the 0.1.x compatibility contract. Malformed candidates can lose legacy prefix findings
when opting in. Phone-like signed numbers remain ambiguous; national numbers, extensions,
Unicode separators/digits, dotted formats and verbal obfuscation remain unsupported.
There is no implicit JSON decoding, dependency change, or change to the fixed contact recipe.

Install with python -m pip install guardtrellis==0.1.6.

Verification

• Released from commit 311fd7dbd700e817f60901d71395229bd76a335b, merged in PR #65 and completing #60.
• All 16 PR checks and post-merge CI passed, including native Windows and Python 3.11–3.14. Windows logs confirm 909 passing tests, the new comparison/resource probes, and both distribution installation smokes. CodeQL and dependency checks passed.
• The authored 93-case development comparison improves exact outcomes from 50/93 under the unchanged default to 81/93 with formatted mode. Twelve retained mismatches remain; there were zero unexpected errors or privacy failures. This is not a production accuracy estimate.
• TestPyPI rehearsal passed. PyPI promotion and verification reused the exact verified files without rebuilding, checked public file hashes/descriptions, and smoke-tested fresh wheel/source installations with core-only and optional extras. Provider examples used HTTP mocks; no new live-provider claim is made.
• A fresh unpinned pip install guardtrellis outside the checkout selected 0.1.6 and verified default compatibility, complete formatted-phone spans, malformed-candidate behavior and input blocking without callback delivery.
• Published package: PyPI 0.1.6.

SHA-256

• guardtrellis-0.1.6-py3-none-any.whl: 498b882e7a62cb3bb687a7bc1ac016eea335142d8d76a69303468f1780737794
• guardtrellis-0.1.6.tar.gz: 0545f712c2903758bd81289a4939e4cda08323a31274fb77070d6464ef6d19b3

The attached release.json and SHA256SUMS retain the exact source commit, original TestPyPI workflow run, and artifact hashes.

GuardTrellis 0.1.5

• Add an application-owned decoded contact recipe for a fixed two-field schema using
  existing public APIs. Check both decoded fields for secrets before PII redaction,
  enforce whole-call limits, retain separate decoded provenance, and authorize only the
  final schema-validated checked arguments. Include regression and fresh-install smokes.
• Add a separate authored contact comparison and the retained 63-case escaped-JSON/phone
  development baseline. Keep raw-text misses, formatted-phone limitations and exact-delivery
  mismatches visible; these evaluations do not establish general detection accuracy.
• Fix Windows temporary-directory cleanup in the resource evaluation worker and simplify
  distribution smoke setup. Add a PyPI download badge outside the generated release block.

No core runtime API, dependency-requirement, default-policy, or detection-rule changes from
0.1.4. Applications must explicitly adopt the contact recipe; upgrading alone does not
enable decoded-value inspection. Formatted-phone coverage remains a separate follow-up.

Verification

• Source commit: d0f5970f601e5504c32e57778fbff9a2f917d924, merged in PR #63. Design #50; implementation #62.
• 758 tests passed locally; all 16 PR checks and exact-main CI passed, including native Windows. The initial Windows metadata-path failure was corrected before merge.
• Historical evaluation outcomes and reports are preserved. The new 24-case authored contact comparison retains two formatted-phone mismatches in each decoded workflow; it is not general accuracy evidence.
• TestPyPI rehearsal and PyPI promotion passed. Production used the unchanged rehearsal artifacts; both index verification jobs downloaded the actual files and verified metadata, hashes and fresh wheel/source installations with all eleven mocked examples.
• A fresh unpinned PyPI install selected 0.1.5 and passed the copied contact example.

Applications must explicitly adopt the recipe. Existing scanners and serialized ToolGuard behavior remain unchanged; #60 formatted-phone coverage and a future shared structured SDK API remain separately scoped.

SHA-256

• guardtrellis-0.1.5-py3-none-any.whl: 020631fe07bf22207a9030701bb493f79f2f05bfbd3c287216f8f5ceaca46023
• guardtrellis-0.1.5.tar.gz: 5999468fa96e11fd93815b17888bb26bce6bf31be9df0a9bc53088971dbb20d1

The attached release.json retains the original successful rehearsal run ID and source commit.

GuardTrellis 0.1.4

• Add a core-only tool-result handoff recipe using the existing public API. Validate and
  authorize the tool call, then check returned text before the next model or agent-state
  consumer receives it. Include redaction, rejection, callback/scanner failure, privacy,
  original-return reuse, and fresh distribution installation coverage.

No core runtime API, dependency-requirement, or detection-rule changes from 0.1.3.

Published from commit e398f927f7f1976b42425ec30e164de541174175 after PR #56.

Verification: main CI, TestPyPI rehearsal, and unchanged-artifact PyPI promotion. The initial Windows measurement-directory cleanup failure is retained in main CI; its failed-job rerun passed.

Both index verification jobs check actual downloaded files, descriptions, hashes, and fresh wheel/source installs with offline examples. OpenAI and Azure remain mock-verified; detector and host-control limitations remain explicit in the limitations.

SHA-256:

• guardtrellis-0.1.4-py3-none-any.whl: a03bf203aaa3ca2a0f75e3fb845e606a6769cbac277f6da990379264ac95e1d1
• guardtrellis-0.1.4.tar.gz: 706c0bdb7168848244937f95bda6f1ea151305dafc9a37f3412b428a4134755a

GuardTrellis 0.1.3

• Add a core-only decoded search.query recipe that checks equivalent plain/escaped
  supported values using current public APIs, revalidates edited JSON, and dispatches
  only final checked arguments after application authorization. Include bounded-input,
  Unicode, scanner-failure, privacy, and no-dispatch tests and fresh distribution smokes.
• Record the accepted recipe-first decoded-JSON decision. A shared nested/multi-field
  checker remains deferred until a concrete caller need justifies a separate core API.

No core runtime API, dependency, or detection-rule changes from 0.1.2.

Verification

Source commit: 7865047487c59ad7c749ec4c4582cb3d5c61540f (PR #42).

• Merged-main CI: all six platform/Python jobs passed; CodeQL also passed.
• TestPyPI rehearsal: published description and hashes matched, and both downloaded distributions passed fresh installation/example checks.
• PyPI promotion and verification: promotes the identical verified rehearsal files without rebuilding and verifies public hashes, description, and fresh installations.
• 551 local tests passed, including 72 decoded-query boundary cases; Ruff, strict mypy, packaging checks, and retained evaluations passed their applicable checks. Known evaluation misses, false positives, and scenario mismatches remain documented.

Artifact	SHA-256
guardtrellis-0.1.3-py3-none-any.whl	6a267fea11b9fd5020023871b1d336f73ddd41dc8dd5409d3abc5d0070dfa982
guardtrellis-0.1.3.tar.gz	03befea98e285de0a4796a39c69095b0dd3de971607d936f2708a4991732916d

The recipe checks one fixed decoded field. Detector coverage, serialized-text API behavior, synchronous deadlines, provider mock/live evidence, and host-owned authorization/output/resource controls retain their documented limits. See the recipe and limitations.

GuardTrellis 0.1.2

GuardTrellis 0.1.2 adds async tool-handoff regression evidence, practical policy/operations guidance, a versioned synthetic policy evaluation, and a decoded-JSON design proposal.

• Document and regression-test async tool handoff after redaction, rejection, scanner
  failure, timeout, and caller cancellation, including late scanner completion.
  Clarify per-scanner deadlines and caller-owned authorization/execution limits.
• Add a core-only policy/operations recipe showing separate input, retrieval, tool, and
  output policies, checked-data handoff, metadata-only logging, and application resource
  controls. Include rejection/failure tests and distribution smoke coverage.
• Add a separate versioned synthetic evaluation for scanner combinations, secret signatures,
  JSON/tool validation, and checked callback/tool delivery. Report detection and delivery
  mismatches separately while retaining known misses, false positives, and historical corpora.
• Expand the roadmap and propose a decoded-JSON values contract for maintainer review.
  The proposal does not implement or change structured-value scanning.

No core runtime API, dependency, or detection-rule changes from 0.1.1.

Limitations: the decoded-JSON document is a proposal, not implemented semantic scanning. Evaluations are synthetic development evidence and retain their misses/false positives; they do not establish prompt-injection resistance or production safety. OpenAI/Azure integrations remain mock-verified. Tool authorization, execution, isolation, and concurrency remain application-owned. Cancellation cannot forcibly stop scanner threads or cancellation-resistant coroutines.

Verification evidence:

• Source: dba51eea2b2252fb4b05b1472ea16a6e42efd661.
• PR #37: all 16 checks passed; merged-source CI passed on Linux Python 3.11–3.14, macOS ARM64, and Windows x64. Local suite: 478 tests with warnings treated as errors.
• TestPyPI rehearsal: public files, exact hashes, package description, and fresh wheel/source installations verified.
• PyPI promotion: promoted the unchanged rehearsal artifacts without rebuilding; public hashes, description, and fresh wheel/source installation checks passed.

Artifact SHA-256 hashes:

282a2b501ddd7eb859de4047b7c3bcd865ff13b2e35a1ec351727c203cf2c3e9  guardtrellis-0.1.2-py3-none-any.whl
f14996a38b445e5e7e90041f81f44cbe13f86dabcbfaf0fff055674bf0c1151e  guardtrellis-0.1.2.tar.gz

A fresh unpinned pip install guardtrellis equivalent using uv selected 0.1.2 outside the source checkout and passed an offline async checked-redaction smoke.

GuardTrellis 0.1.1

• Add the GuardTrellis logo to the repository README and packaged PyPI description.
  Include the original image in the source archive.
• Make callback-timeout regression tests deterministic across platforms, covering both
  callbacks that start before cancellation and coroutine cleanup when startup is delayed.

No runtime API, dependency, or detection-rule changes from 0.1.0.

Verification

• Merged source e339b4e from PR #28.
• Main CI covers Linux Python 3.11–3.14, macOS and Windows; CodeQL passed. Local validation passed 404 tests with warnings treated as errors, lint, formatting, type checks, both evaluation corpora, strict metadata checks and fresh distribution installations.
• TestPyPI rehearsal and PyPI promotion verify public file hashes, the packaged README description, and fresh wheel/source installations with core and optional examples. PyPI receives the same verified files without rebuilding.
• The original transparent logo is included in the source archive and displayed in the repository README, TestPyPI description and PyPI description.

A fresh unpinned python -m pip install guardtrellis selected 0.1.1 from PyPI and passed a core redaction smoke outside the source checkout.

The tag CI run passed on its second attempt. The first Windows run encountered WinError 32 while removing an evaluation-worker temporary directory; only the failed Windows job was rerun. The original log is retained in the run history. This intermittent evaluation-tooling cleanup issue remains a follow-up; no source or published artifacts changed for the retry.

Compatibility and limits

The 0.1.x compatibility policy and documented limitations continue to apply. Detection remains limited to configured checks; complete-output scanning, async cancellation limits and application-owned authorization are unchanged. Synthetic results are not a general accuracy or production-safety guarantee. Provider examples use mocks in release verification; this release adds no live-provider verification.

SHA-256

• guardtrellis-0.1.1-py3-none-any.whl: 4be8fde0cc61f21e657e3223998eb635827f6f6685ff0156167374e026d9ea21
• guardtrellis-0.1.1.tar.gz: 2d1e3251a64dc85c3de682121c4e4093276b01280ef98888e968d433dc607e55

The attached release.json and SHA256SUMS retain the source commit, rehearsal run and artifact hashes.

GuardTrellis 0.1.0

GuardTrellis 0.1.0 is the first final release. It commits to documented public API compatibility throughout the 0.1.x series, within the compatibility and support policy.

python -m pip install 'guardtrellis==0.1.0'

Changes and migration

• Adopt a compatibility and support policy for the 0.1.x
  final-release series: preserve documented public imports, call signatures, result fields,
  action/stage meanings, and existing diagnostics; define detection-fix exceptions,
  deprecation notices, supported Python versions, and dependency/maintenance expectations.
• Prepare non-alpha package metadata and matching installation instructions. Update current
  documentation to describe the compatibility promise while retaining historical alpha notes,
  evaluation reports, and provider verification limits.
• Define changelog maintenance rules for user-visible changes, compatibility/dependency
  changes, detection fixes, and migration guidance. Distinguish normal GitHub releases from
  prereleases in the publishing checklist.

No core runtime or scanner-rule changes from 0.1.0a4. Applications using its documented
API need only update their version pin and run their application checks. Copied OpenAI/Azure
SDK 2 adapters from earlier alphas still need the
SDK 3 migration already included in 0.1.0a4.
Detection coverage, serialized-JSON scanning, async cancellation, and host-owned authorization
retain their documented limitations.

Scope and validation

The stable designation is an API and support commitment. Documented detection limits remain; it does not certify application safety. OpenAI and Azure examples remain mock-verified. The recorded Gemini live smoke and synthetic evaluations retain their original scope.

• Source: 9a7d3e2cd41fd07a294d3e55f185a5651a489c99, merged in PR #26.
• Post-merge CI: Linux Python 3.11–3.14, macOS Python 3.12, and Windows Python 3.12.
• CodeQL.
• Candidate preparation passed 403 tests with warnings treated as errors, lint/format/type checks, both retained evaluation corpora, strict package metadata checks, and fresh wheel/source installs.
• Windows passed after one unchanged job retry; the initial resource-reporting subprocess test failure remains in the CI history. Its underlying cause was not established; no test was skipped or weakened.

Publication evidence

• TestPyPI 0.1.0 — verified rehearsal.
• PyPI 0.1.0 — verified promotion.
• PyPI received the unchanged TestPyPI wheel and source archive. Both indexes' hashes and complete package descriptions matched the candidate; fresh installations of both downloaded distributions passed core and optional-example checks.
• An additional clean, unpinned pip install guardtrellis from PyPI selected 0.1.0 and passed core allow/block/redaction checks.

The attached release.json records the source commit and original TestPyPI workflow run. SHA256SUMS records the package hashes:

File	SHA-256
guardtrellis-0.1.0-py3-none-any.whl	554da9339e5468257b53b700043aabf69a40f2f2c867bbd99bfd65a6e648090f
guardtrellis-0.1.0.tar.gz	2321e0ecc673d6d0796ec33829d1e5d32d4008bbc658cf347433f1aeb604d97e

GuardTrellis 0.1.0a4

GuardTrellis 0.1.0a4 adds a runnable retrieval/tool-call recipe, a separate Unicode/PII development challenge set, and OpenAI SDK 3 compatibility. The package description and every installation pin now describe this release.

python -m pip install 'guardtrellis==0.1.0a4'

• Retrieval/tool-call recipe: check retrieved text before prompt assembly, validate proposed tool arguments, and execute the checked call behind application-owned authorization. The recipe uses only core dependencies and is covered by rejection tests and distribution smokes.
• Unicode/PII challenges: 40 synthetic development cases with provenance, multilingual context, benign cases, escaped JSON pairs, per-family/language results, action counts, and retained failures. The original 72-case corpus and historical reports remain unchanged.
• OpenAI SDK 3 migration: the optional openai extra now requires openai>=3,<4 and httpx2>=2.12,<3. Custom clients, transports, and exception handling must use HTTPX2, whose default certificate trust comes from the operating system. OpenAI and Azure remain mock-verified only.
• Updated package summary, README feature description, PyPI-compatible guide links, release notes, and roadmap completion evidence.

This remains an experimental alpha. No core Guard/scanner API or detection-rule changes are included. Application authorization, execution limits, and output handling remain the host's responsibility. Known detection and cancellation limitations remain; synthetic results do not establish production safety. See the changelog and limitations.

Validation: 403 local tests passed with warnings treated as errors, plus lint, formatting, core/example type checks, strict Twine 7 metadata checks, and fresh wheel/source installations with all seven examples. The 72-case evaluation retained 35 TP, 2 FP, 31 TN and 4 FN; the 40-case challenge set retained 14 TP, 6 FP, 11 TN and 9 FN, with zero errors in either set. CI passed on Linux Python 3.11–3.14, macOS 15 and Windows Server 2025 at the release commit. CodeQL also passed.

Published from 4523ad93ac3b8c0161582a469c92a336dc7fc0e9. The TestPyPI rehearsal and PyPI promotion passed, including exact description checks, public file hashes and fresh installation checks. Both indexes received the same files without a rebuild. TestPyPI package · PyPI package.

SHA-256 checksums:

• guardtrellis-0.1.0a4-py3-none-any.whl: 99c00164fa1e5045cadc5c2d84939073f033b710bd3cd7534a40e168b1d74c8b
• guardtrellis-0.1.0a4.tar.gz: 33175984a1e86470055e5c91eb496892f3923236697c176e39f8a31d635cb00d

The attached wheel, source archive, manifest and checksum list are unchanged from the verified rehearsal. To use SHA256SUMS, place the wheel and source archive in a dist/ directory beside it.

GuardTrellis 0.1.0a3

GuardTrellis 0.1.0a3 corrects the stale installation instructions shipped in the 0.1.0a2 package description and includes the resource measurements merged in PR #20.

python -m pip install 'guardtrellis==0.1.0a3'

• Generate module and README versions from pyproject.toml with python scripts/release_artifacts.py sync; CI rejects source, lockfile, changelog, or installation-pin drift.
• Verify the README embedded in both distributions and the description published by TestPyPI/PyPI, alongside package versions and file hashes.
• Add a bounded, offline resource-measurement harness, a recorded local baseline, and host-control guidance for expensive schemas and cancellation.

This remains an alpha release. No core API, scanner rules, or runtime limits change. Historical evaluation and provider-smoke results retain their original provenance. Known detection and cancellation limitations remain; synthetic results do not establish production safety. See the changelog and limitations.

Validation: 364 local tests passed with warnings treated as errors, plus lint, formatting, types, the 72-case evaluation (retaining its documented misses and false positives), strict package checks, and fresh wheel/source-archive installations. CI passed on Linux Python 3.11–3.14, macOS 15, and Windows Server 2025.

Published from 3b3850bc512115905d5842dd6f9da9754be513b5. The TestPyPI rehearsal and PyPI promotion passed, including description, downloaded-file integrity, and fresh installation checks. Both indexes received the same files without a rebuild. PyPI package.

SHA-256 checksums:

• guardtrellis-0.1.0a3-py3-none-any.whl: 86764460690305bff0cf31d15879a15e0fd62d3565d6a2037454ec7c4ff087e9
• guardtrellis-0.1.0a3.tar.gz: 7c30048329d1b2071ec915a3e97c43fb06638c330ded52a88675be077ff8dcd7

The attached manifest and checksum list are unchanged from the rehearsal. To use SHA256SUMS, place the wheel and source archive in a dist/ directory beside it.