VAIS Boundary v0.12.0rc10

VAIS Boundary v0.12.0rc10 release review

Date: 2026-09-20

Scope and decision rule

RC10 is a hardening and evidence release. It carries exactly one change to library behaviour, a
fail-closed fix in security-value canonicalization, plus positioning documentation and an
unpackaged experiment tree. The frozen RC7 benchmark evidence is unchanged and RC10 makes no new
model claims from it.

The tagged tree also contains website/, a static Astro landing page and its GitHub Pages
workflow. It is not part of the library, is absent from the wheel and the sdist, and is excluded
from every gate check below. Its build inputs (node_modules, .astro) are excluded from the
source ZIP so that the archive stays reproducible whether or not the site has been built. Nothing
else in this review covers it.

The review does not certify production readiness, does not extend any benchmark claim, and does
not turn the new lab experiment into a general claim about prompt-injection defences.

Material findings

FIND-041: unbounded recursion bypassed the fail-closed guard

deep_freeze recursed without a depth bound. Argument nesting past the interpreter's frame limit
raised RecursionError inside action_fingerprint. RecursionError is not a ValueError, so it
bypassed the except ValueError guards at monitor.py that exist to return
DENY action_not_fingerprintable. The monitor produced no decision and no audit record, failing
closed only by crashing the caller.

RC10 bounds recursion at MAX_SECURITY_DEPTH and raises ValueError, routing the failure into
the existing fail-closed path. No broad exception handler was added, because converting unknown
faults into silent denials would weaken the same property (DEC-033). Regression coverage is in
tests/test_fingerprint_recursion.py, which fails with RecursionError before the fix.

Residual, recorded as LIM-033. The DENY-plus-audit outcome holds only when the nesting trips
inside action_fingerprint. Deeper nesting fails while the adapter constructs the Value, before
any PlannedAction or monitor decision exists, so it is fail-closed by exception with no VAIS
decision and no audit entry. Adapters that build Values from model-controlled data must catch
ValueError and record a denial themselves. This obligation is now stated in ATTACK-SURFACE.md.

Attack-surface coverage gap: the decision-reason output channel

docs/ATTACK-SURFACE.md maps the twelve input surfaces that cross a trust boundary into the
monitor, and adds a thirteenth that they did not cover: the verdict and reason strings returned to
the caller. A reason such as bound_argument_changed:ticket_id names the argument the contract
binds. The denial-feedback channel is named in the literature (arXiv 2604.04035) and VAIS exposes
enforcement outcomes by construction. No mitigation ships in RC10. It is recorded as an open
surface with a proposed direction, reason redaction toward the model with full detail retained in
the audit trail.

Security-boundary review

Review item	Bounded result
Canonicalization	Recursion is bounded and raises ValueError; NFC normalization, non-finite rejection and duplicate-key rejection are unchanged from RC9. Collision families closed by RC8/RC9 are regression-locked in tests/test_fingerprint_collisions.py.
Fingerprint identity	plain_arguments() excludes nothing, so the fingerprint covers the full argument set. Reference-versus-referent remains an accepted, documented application-level risk: the fingerprint binds the reference value, never the referent's contents.
Fail-closed paths	Unchanged from RC9 and re-reviewed. The one new path, an over-deep security value, denies.
Audit	Unchanged. Hash chained, not externally anchored. LIM-033 records the one case that produces no entry.
Approvals, policy, invariants, MCP	Unchanged from RC9.

Research and claim review

• Two findings and two limitations added (FIND-041, FIND-042, LIM-033, LIM-034); two decisions
  recorded (DEC-033, DEC-034).
• Related work now cites Proof of Execution, ARM, SPA, APPA and AgentProof, each checked against
  its primary paper. ARM in particular already implements proxy mediation, immutable capability
  tokens, a hash-chained audit log and integrity-lattice provenance, so RC10 narrows VAIS's stated
  distinction against it to independent post-execution effect verification.
• docs/incident-mapping.md states which disclosed 2026 incidents match an enforced mechanism and
  which conventional MCP flaws VAIS does not address. No incident is described as prevented.
• The README utility figure keeps its value and gains the paired-control argument beside it. The
  RC7 aggregate is not an enforcement-cost figure.

Experiment tree and dual-use review

experiments/tier_a is committed as reproducible evidence and excluded from the sdist and wheel
(DEC-034). It contains two pre-registrations, frozen generated inputs with hashes verifiable from
git, and 6,351 raw episode records.

It also contains 120 generated prompt-injection payloads. This is the first release to ship
attack text. The bounded assessment: the payloads are lab-scoped natural-language attempts to make
a local training application close the wrong support ticket. They carry no exploit, no capability
uplift and no technique that is not already described in the public literature, and without them
the reported results are not reproducible. They are retained on that basis. Both pre-registered
primary outcomes failed to validate, and LIM-034 records that the remaining numbers describe one
application, one tool and two agent models only.

Validation and release gate

RC10 is releasable only after all of the following succeed on the final commit:

1. full source regression suite;
2. default policy and invariant validation;
3. deterministic protected benchmark smoke test;
4. wheel and sdist build plus isolated wheel installation, with experiments absent from both;
5. deterministic source ZIP reproduction and SHA-256 manifest verification;
6. tracked-tree, archive and reachable-history privacy/secret scans;
7. clean GitHub CI across Python 3.11-3.14 on Windows and Linux;
8. annotated v0.12.0rc10 tag and release assets built from the verified commit.

Passing these checks supports only the recorded implementation and packaging result. It does not
establish universal prompt-injection resistance, production authorization-service readiness,
external audit anchoring, or any general claim about content-filtering defences.

VAIS Boundary v0.12.0rc9

Benchmark clarification: DeepSeek completed

DeepSeek-R1-Distill-Llama-8B completed the RC7 full stage after RC7 corrected the experimental reasoning-profile assumption. The tested model/runtime did not expose a valid reasoning-off configuration, so DeepSeek was moved to a separately labelled native_reasoning cohort with observed reasoning required rather than suppressed or ignored.

• Status: completed
• Evaluable episodes: 240/240
• Protected invariant violations: 0/240
• Protected workflow utility: 167/240 (69.6%)
• Attack-added diagnostic events: 159/240 (66.2%)

The single gate-failed model in the fifteen-model panel was SmolLM3-3B, with two target-failure episodes left unevaluated. DeepSeek is included among the fourteen completed models. Native-reasoning and reasoning-off utility or attack-added rates are not treated as directly comparable.

---

VAIS Boundary v0.12.0rc9 release review

Date: 2026-08-24

Scope and decision rule

This review covers the first shareable release under the VAIS Boundary — Verifiable Authority & Invariant Security identity. It reviews the trusted authorization and independent effect-verification paths, MCP mediation, research attribution, licensing/package identity, retained benchmark claims and repository privacy.

The review does not certify production readiness, provide formal trademark clearance or turn the bounded RC7 benchmark into RC9 model evidence. RC9 carries the frozen RC7 report unchanged and makes new claims only for the reviewed code, metadata and regression tests.

Material findings

FIND-039: verifier evidence and numeric/type ambiguity

Observable Effect attributes were held in mutable dictionaries after construction, contract-binding invariants used normal Python equality, and the invariant loader accepted Boolean-equivalent schema versions and non-finite approval thresholds. These paths could undermine independent effect verification through post-observation mutation, True == 1 type confusion or non-finite comparisons.

RC9 recursively freezes and Unicode-normalizes effect evidence, validates provenance records, uses canonical type-sensitive equality for contract bindings, rejects Boolean/non-finite effect values for numeric approval checks, rejects non-finite thresholds and type-confused versions, and requires at least one declared invariant.

FIND-040: exception text in assessment artifacts

The protected MCP path retained only an exception class, but the deliberately unprotected assessment client retained the complete exception message. Because baseline records can enter benchmark artifacts, that difference could preserve credentials or provider payload data.

RC9 elides exception messages in both paths while retaining exception class, deterministic request identity, indeterminate state and retry_safe=false.

Security-boundary review

Review item	Bounded result
Consequential demonstrations	Protected paths use ProtectedExecutor, MCPProtectedClient or an explicit ReferenceMonitor decision. Direct execution is confined to clearly labelled unprotected comparison paths using sandbox or deliberately vulnerable demo services.
Untrusted data labels	Retrieved/MCP/model-derived data is labelled by application code. MCP profiles cannot promote remote results to trusted authority.
Policy parsing	Unknown fields and invalid types fail closed. Policy v4 now requires default_action: deny and undeclared-argument rejection; v1-v3 remain available only with their documented historical semantics.
Invariant parsing	Unknown fields, unsupported types, Boolean/type-confused versions, empty sets and non-finite thresholds fail closed. Effect evidence is immutable and canonical before evaluation.
Approvals	Persistent approvals bind exact action, principal, session, tenant and capability; consumption is atomic and single-use within the documented single-process boundary.
Audit	Events are hash chained and secret-bearing detail keys are rejected. The chain is not externally anchored or append-only storage.
MCP dispatch	Only ALLOW reaches a protected MCP session. Post-dispatch exceptions are indeterminate and unsafe to retry automatically.
Secrets in retained records	Protected and unprotected MCP exception messages are omitted. Public reports structurally omit prompts, arguments, raw effects and detailed secret-bearing values; raw trajectories remain controlled artifacts.

MCP integration review

The core wrapper depends on a minimal behavioral call_tool protocol rather than SDK types. Remote result trust is fixed to untrusted; confidentiality may be configured. Canonical tool names and server/tool endpoint pairs are unique and Unicode-normalized. Catalog filtering is documented only as attack-surface reduction, never authorization.

The optional dependency remains mcp>=2,<3. The official MCP Python SDK repository identified v2 as its stable line when reviewed on 2026-08-24. This major-version bound avoids silently admitting a future incompatible v3 while allowing stable v2 maintenance releases.

Research and claim review

• Software citation and capstone citation are separate; the repository does not reuse the software citation as a paper citation.
• Related work explicitly credits CaMeL capability/control-data separation, FIDES information-flow enforcement, AgentDojo and OWASP guidance.
• VAIS does not claim novelty for capabilities, taint/information-flow labels, reference monitors or deterministic pre-tool enforcement.
• The v0.5.1 measurement correction and v0.6 125-case static corpus precede v0.10 adaptive verification and remain versioned historical controls.
• RC9 does not rerun or relabel the RC7 model campaign. Published model results retain their original evidence version, denominators, configuration gates and limitations.

Identity, license and privacy

• Public identity: VAIS Boundary — Verifiable Authority & Invariant Security.
• Canonical repository: stratomarco/vais-boundary.
• Stable command/import: vais.
• Compatible distribution name: verifiable-ai-security.
• License: Apache-2.0, including commercial use under its terms.
• Author and maintainer: Marco Constantino, stratomarco@proton.me.
• The prior corporate email is removed from tracked content and rewritten from every reachable branch/tag commit before sharing. Copies already fetched elsewhere and provider caches remain outside the repository's deletion guarantee.
• The project name is treated as an unregistered identifier; no trademark registration or formal clearance is claimed.

Validation and release gate

RC9 is releasable only after all of the following succeed on the final commit:

1. full source regression suite;
2. default policy and invariant validation;
3. deterministic protected benchmark smoke test;
4. wheel and sdist build plus isolated wheel installation;
5. deterministic source ZIP reproduction and SHA-256 manifest verification;
6. tracked-tree, archive and reachable-history privacy/secret scans;
7. clean GitHub CI across Python 3.11–3.14 on Windows and Linux;
8. annotated v0.12.0rc9 tag and release assets built from the verified commit.

Passing these checks supports only the recorded implementation and packaging result. It does not establish universal prompt-injection resistance, production authorization-service readiness, distributed exactly-once execution, external audit anchoring, cryptographic identity of model weights or statistical representativeness of the model panel.

VAIS v0.12.0rc8 — verified RC7 evidence freeze

VAIS v0.12.0rc8 is the verified evidence-freeze release for the completed v0.12.0rc7 cross-model campaign. RC8 packages and explains the evidence; it does not relabel the original executions or change the protected security semantics.

Bounded result

• 15 models planned; 14 completed the common 240-episode full stage.
• 3,360/3,360 full-stage episodes were evaluable across completed rows.
• 4,603/4,605 distinct staged episodes were evaluable overall.
• 0 protected invariant violations were observed.
• SmolLM3-3B remains gate-failed after two truncated/non-JSON target generations; those episodes remain unevaluated.
• DeepSeek-R1-Distill-Llama-8B completed 240/240 episodes in the separately labeled native-reasoning cohort.

A separate 24-episode SmolLM diagnostic used a larger 7,168-token retry. One different generation still exhausted the retry, so RC8 retains the uniform 4,096-token panel budget and does not manufacture a 15/15 result.

Validation

• 180/180 checkpoint artifacts matched their recorded sizes and SHA-256 values.
• 222 tests passed from the source tree and 222 passed from a fresh extraction of the final source ZIP.
• GitHub Actions passed on Ubuntu and Windows with Python 3.11, 3.12, 3.13 and 3.14, plus the wheel smoke test.
• Source ZIP and wheel were reproduced byte-for-byte across two builds.
• The public HTML/SVG reports were visually checked at 1280px with no horizontal overflow.
• Generated local research indexes and machine-specific paths are excluded from source distributions; canonical YAML/Markdown research records remain included.

Zero observed violations in this finite, recorded campaign is bounded negative evidence, not proof of universal security. Utility and attack-added-event percentages are diagnostics, not security scores. See the release summary, freeze audit, evidence manifest and SHA256SUMS attached below.