v0.10.0-beta.17: clearer schema review

Clearer schema review

Beta.17 improves scanner guidance without changing runtime protection.

• Report untyped composite argument schemas (anyOf, oneOf, allOf) as unresolved json rather than incorrectly displaying string. Explicit types, enums and existing schema review remain respected; this is not union validation.
• When an explicit constrained or free argument declaration disagrees with fixed inference, require review and withhold standard remediation guidance. Keep the protected argument policy and effective risk unchanged. Without a conflicting argument declaration, this correction does not change authority recommendations.
• Preserve enum-selector review obligations and strengthen current-report acceptance tests. Frozen historical evidence remains unchanged.

Upgrading

Reports can gain review requirements, withhold remediation guidance and change derived control fingerprints. Cross-version comparisons can report type_changed when a previous string display becomes json. Automation using --fail-on-review may now require attention. Review baseline changes against the intended tool policy; these report changes do not establish new handler permissions or vulnerabilities.

Scanner report v6, controls v1, the Authority Diff format, public runtime API and dependency pins remain unchanged. This release does not add a new runtime defense.

Publication status

Published and verified on PyPI. This is a prerelease; install the exact version:

python -m pip install "verb-authority==0.10.0b17"

The wheel and source distribution have identical verified hashes on GitHub, TestPyPI and PyPI. A fresh installation of the wheel downloaded directly from PyPI passed the installed scanner checks and offline quickstart.

Verification: release assets and TestPyPI → PyPI publication and installation checks.

v0.10.0-beta.16 — deferred approval replay fix

Beta 16: deferred approval replay repair and executable protection evidence

Upgrade note

This release fixes a concurrent-resume defect in the optional Pydantic AI
adapter. Users of deferred approvals should upgrade. The affected adapter
source is also present in Beta 15; the dependency-free core argument-binding
decision is unchanged by this repair.

Two concurrent resumes of one pending approval could recreate consumed pending
state. A later replay of the original approval/history could then invoke the
same action again. The worker now checks the pending commitment under the
existing lock and rejects an already-consumed or discarded approval without
rearming it. The regression verifies actual handler-entry counts, including
failure after entry and cancellation.

Protection demo

authority_assurance_demo.py (repository/source distribution) exercises email,
service-ticket and deployment arguments with inert in-memory handlers. It
compares a deliberately unguarded implementation, a separate server-injection
alternative, and the actual integrated gate. --json includes submitted calls,
independent host bindings, decisions, handler counts and observed arguments.

All 96 arm records are asserted: the VA arm blocks 17 cases before handler
entry and permits 15 legitimate controls. Nine preceding-call controls test
the stale-target cases. Server injection uses a payload-only interface and
has its own valid-call controls; it does not depend on VA.

Verification and compatibility

• 1,573 full-source tests passed with the pinned optional adapter installed.
• Separate internal Daybreak review and 20 repeated adapter regression runs
  passed. These are model-assisted internal tests, not independent adoption.
• Includes the previously merged result-recording diagnostic and read-only
  declaration clarifications. Neither is an implementation-effect sandbox.
• Public Python API, zero-dependency core, scanner report v6 and optional
  dependency pins are unchanged. No TypeScript/npm release.

These deterministic replays do not measure live-model attack rates or promise
universal protection. Host bindings and policies must be independently trusted,
and relevant calls must pass through the integrated gate. The adapter repair
does not provide distributed exactly-once execution.

Published package

Available on PyPI as 0.10.0b16.
The same wheel and sdist passed TestPyPI verification before protected PyPI
publication; final PyPI download, hash and installed quickstart checks passed.
See the release build
and package publication.

Install the core with python -m pip install "verb-authority==0.10.0b16",
or the optional adapter with
python -m pip install "verb-authority[pydantic]==0.10.0b16".

Beta 15: clearer authority review and safer integration examples

Beta 15: clearer authority review and safer integration examples

This release preserves the Python runtime API and dependency-free core while
improving scanner review coverage, remediation guidance and the installed-package
checks. It remains an early beta, not a claim of production readiness.

What changed

• Scanner report v6 includes per-argument remediation guidance: prefer keeping
  protected arguments out of the model-visible schema and injecting them from
  trusted application state; use exact trusted_args binding for compatibility.
  Uncertain protected arguments remain explicitly review-required, without an
  automatically selected remediation.
• A Markdown first-look section separates strong lock candidates, provisional
  review locks and data-fillable arguments. It does not change runtime policy.
• Nested argument property maps retain schema-review debt. Both scanner and
  Authority Diff review thresholds now expose these previously clean-looking
  cases; outer-argument policy and runtime behavior are unchanged.
• Integration demos use exact JSON type/value and explicit trusted-key checks,
  and restrict the model-selected read example to a trusted public catalog.
  These corrections align examples with checks already present in the runtime.
• Development installs include the build backend needed by archive tests.
• Larry Peseckis's frozen synthetic tuple-boundary evidence is preserved with
  explicit historical limitations and 16 separate maintainer regressions. It
  establishes no payment execution, business authorization or adoption claim.

Compatibility

Beta 14 emitted report v5; Beta 15 emits v6. Consumers requiring exactly v5 must
update. Authority Diff continues to accept complete v4/v5 reports for
observational comparisons. Enforcement thresholds should rescan raw schemas,
not trust imported reports as runtime policy. --fail-on-review can now exit 2
for nested schemas that previously appeared clean.

No TypeScript/npm runtime, automatic schema-projection API, deployment system,
or expanded runtime security guarantee is included.

Installation and artifact checks

Published on PyPI on
September 7, 2026. Install the exact beta:

python -m pip install "verb-authority==0.10.0b15"
python -I -m verb_authority quickstart

The quickstart uses a local mock tool, not an email service: altered recipient
and oversized body remain at 0 invocations; the independent trusted-value
control reaches 1. It does not exercise a real human-approval workflow.

Use the wheel, source archive and SHA256SUMS from this one release. Verify
the hashes before installing; do not mix files from different builds. The
TestPyPI-to-PyPI publication path reuses the same verified wheel and source
archive rather than rebuilding them between indexes.

Publication verification completed successfully:

• Exact tagged source: 431769ec6238d29743a99c1f93b09ebbd4a34b73.
• Release build and fresh-runner artifact verification.
• TestPyPI and PyPI downloaded-file hash and installed-quickstart checks.

These are release-engineering checks, not independent adoption or production
validation.

As always, the application must supply the trusted values independently of the
model and route relevant calls through the gate. Per-argument authority is not
a substitute for application identity, business rules or complete agent security.

Verb Authority v0.10.0-beta.14

Verb Authority v0.10.0-beta.14

Beta 14 is the onboarding and distribution release. It makes the existing per-argument authority scanner and pre-execution gate easier to install, evaluate, and integrate without changing the security promise or policy-inference behavior.

What changed

• A focused two-minute README path: install, offline quickstart, real-schema scan, runtime example, boundaries, and Issue #7 feedback.
• The first official PyPI distribution, installable as verb-authority==0.10.0b14, with the dependency-free core supporting Python 3.10–3.14.
• The technical contracts remain available in focused documentation, including dedicated JavaScript/TypeScript evaluation guidance.
• README, documentation, case studies, and the social-preview asset are included in both the wheel and source distribution.
• The release verifier exact-allowlists wheel documentation and binds its bytes to the tested source-distribution contract.
• The TestPyPI-first OIDC publication workflow publishes the existing GitHub Release artifacts, verifies their hashes and installed quickstart behavior, and requires protected production approval before PyPI.

Security boundary

There is no change to policy inference or runtime enforcement. The enforced claim remains per-argument provenance before execution. Verb Authority is not business authorization or complete prompt-injection protection.

Install and run the local quickstart

Install the published prerelease from PyPI:

python -m pip install "verb-authority==0.10.0b14"
python -I -m verb_authority quickstart

The immutable GitHub release tag remains available as a secondary installation path:

python -I -m pip install "verb-authority @ git+https://github.com/yairsabag/verb-authority.git@v0.10.0-beta.14"

Published package: PyPI

Feedback and real/redacted schema tests: Issue #7

Verb Authority v0.10.0-beta.13

Beta 13 turns argument-level authority into a runnable, one-command proof.

60-second quickstart

env -u PYTHONPATH -u PYTHONHOME python -I -m verb_authority quickstart

The offline demo scans an exported MCP send_email schema and then runs the gate immediately before a safe local tool implementation.

What it proves

• an untrusted recipient is blocked and the local tool invocation count stays at 0
• a 2,001-character body is blocked by the registered maxLength=2000 boundary and the count stays at 0
• the application-approved recipient is allowed and the tool executes exactly once
• no network, model, or email service is used

External adversarial testing

A frozen MCP fixture exposed an ambiguous-argument edge case. The policy was corrected and the behavior is permanently covered by regression tests. Technical contributor credit is preserved in the repository evidence.

Full details: CHANGELOG.md

Verb Authority v0.10.0-beta.12

Verb Authority v0.10.0-beta.12

This research prerelease makes static review debt explicit at the tool level. It follows the external beta.11 Playwright rerun, which correctly observed that two arguments required review while no single report field summarized that fact for the tool.

What is new

• Scanner report v5 adds a derived review_required boolean and structured review_sources index to every tool.
• review_sources identifies flagged arguments plus schema, risk, risk-conflict, MCP annotation-conflict, and selector-branch review obligations already present in the report.
• summary.review_required remains the number of flagged arguments; summary.review_required_tools counts tools with any static review debt.
• Static review remains separate from runtime needs_confirmation. A well-classified consequential call may require approval without carrying unresolved review debt.
• Authority Diff validates every v5 aggregate against its underlying evidence and still accepts complete v4 reports for observational comparison without mutating or rewriting them. Diff output remains format v2.
• The public Atlas report, installed-wheel smoke contract, README, and changelog are updated for report v5.

Scope

This release improves report clarity and machine validation; it does not broaden Verb Authority's security claim. The project still covers per-argument provenance, local constraints, and exact one-selector branch risk, not general prompt-injection prevention, selection intent, arbitrary cross-argument authorization, sequence policy, business authorization, or action-instance authorization.

Verification

The exact release tree passed all eight GitHub CI jobs across Python 3.10 through 3.14, the pinned Pydantic AI adapter, package construction, installed-wheel smoke tests, and composite-action isolation. Three independent Daybreak reviews found no blocker; one review ran 42 focused adversarial probes. The full suite passed 1,449 tests. The beta.12 source archive and wheel were verified against the exact commit, and clean installed-package smoke tests passed on Python 3.11 and 3.12.

Thanks to Sankalp Gilda for the careful external rerun and the report-level observation that motivated this change.

Focused feedback remains welcome: a missed lock, unnecessary lock, incorrect review source, wrong branch risk, confirmation mismatch, adapter bypass, or a real tool shape the current model cannot express.

Post-publication documentation note

The tagged beta.12 code and verified distribution artifacts remain unchanged. After publication, PR #24 corrected the default-branch README and changelog to identify beta.12 as the latest prerelease and move its notes out of Unreleased. This documentation-only follow-up does not change the release code, wheel, source archive, or recorded hashes.

Verb Authority v0.10.0-beta.11

Verb Authority v0.10.0-beta.11

This research prerelease adds the first framework runtime adapter and closes the Playwright polymorphic-tool finding with exact selector branch risk.

What is new

• Exact one-selector branch risk and active-argument enforcement. A read branch such as browser_tabs list can remain read-only while close is destructive and requires confirmation.
• Safer defaults: primitive type membership alone, including enum and number, no longer proves that untrusted data may author a consequential argument.
• Scanner report v4 with structured MCP annotation evidence and explicit unresolved, consistent, conflicting, and inapplicable states.
• Authority Diff now treats unequal active-argument replacements as authority increases, fails on existing candidate review debt when requested, and explains that debt without corrupting JSON output.
• An optional pinned Pydantic AI 2.35 adapter. It wraps local direct tools, resolves trusted choices from application-owned state, binds deferred approval to the exact call and branch, rejects unwrapped paths, and seals authoritative selector registration outside mutable public inspection state.

Scope

Verb Authority establishes per-argument provenance, local constraints, and exact one-selector branch risk. It does not establish selection intent, general cross-argument composition, sequence policy, business authorization, or action-instance authorization. The first Pydantic adapter intentionally supports one audited pinned framework version and rejects unsupported runtime paths.

Verification

The release commit passed all eight GitHub CI checks across Python 3.10 through 3.14, the pinned Pydantic AI integration, package construction, installed-wheel smoke tests, and composite-action isolation. Local verification passed 1,417 tests in the pinned Pydantic environment and 1,267 base tests. The offline runtime evaluation passed 6/6, the corpus retained zero policy and call false allows, the public Atlas reproduced byte-for-byte, and a focused Daybreak re-audit returned READY with no P1 or P2 findings.

The release workflow builds, independently re-verifies, and uploads exactly the wheel, source archive, and SHA256SUMS. Please recompute the checksums locally before installation.

Focused feedback is welcome: a missed lock, unnecessary lock, wrong branch risk, confirmation mismatch, adapter bypass, or a real tool shape that the current model cannot express.

Verb Authority v0.10.0-beta.10

Verb Authority v0.10.0-beta.10

This research prerelease advances the runtime-integration beta and restores the full verified release path. The beta.8 and beta.9 tags remain immutable historical candidates; both GitHub releases are draft and assetless, and neither version is reused.

What testers can exercise

• Local MCP, OpenAI, and Anthropic tool-schema scanning without uploading or invoking tools.
• Per-argument authority classification, control evidence, and risk evidence.
• Authority Diff thresholds that rescan raw schemas rather than trusting imported reports.
• A synchronous guarded runner with exact trusted-value matching, confirmation binding, a minimal trusted-choice resolver, and fail-closed runtime checks.
• Explicit product boundaries: per-argument provenance is not compositional action-instance authorization, and approved destinations can still be selected through control flow influenced by untrusted content.

Release integrity

• The source distribution is verified before extraction, then the extracted source is tested and used to build the wheel.
• The candidate is handed to a separate read-only runner by immutable artifact ID and digest.
• Download, verification, and staging happen outside the trusted Git checkout.
• Only the minimal publisher job has contents: write, and it uploads only the independently verified three-file set.

Release-candidate evidence for commit 7b2730bfd4cb4ecf7e88478fc6e6730c51570066: 1,073 tests passed on Python 3.11 and 1,073 on Python 3.12, the extracted source distribution passed both suites, installed-wheel smoke tests passed on both versions, and independent plus Daybreak audits returned READY with no P2 or P3 findings.

Please verify SHA256SUMS after downloading the wheel and source archive. For focused feedback, report one missed lock, unnecessary lock, risk/evidence mismatch, runtime bypass, or model boundary exposed by a real or redacted tool schema.

v0.10.0-beta.6

Beta.6 closes the two remaining report-clarity notes from the external beta.5 rerun in issue #7.

Risk conflict clarity

• eval is now recognized only as a complete-token advisory code_exec signal. evaluate, evaluation, and revaluate remain unmatched, so substring false positives do not return.
• An undeclared eval tool still has effective risk unknown, requires review, and keeps confirmation enabled. A caller-controlled name remains evidence, not a behavioral verdict.
• When a risk declaration conflicts with a matched name heuristic, the effective tier is now unknown with risk_source: conflict_safe_default until review.
• The conflicting declaration and its author-supplied evidence remain visible separately under declared_risk; they are not presented as evidence for the effective safe-default tier.
• Conflict cases keep confirmation enabled and no longer auto-relax uncertain arguments as if the declared read_only tier had already been accepted.

The attributed avp9-nexus positive-control fixture remains financial, requires confirmation, and has no conflict.

Verification

• 95 tests pass locally.
• Pull request CI passed on Python 3.10, 3.11, 3.12, 3.13, and 3.14 plus the distribution build/smoke test.
• A separately built universal wheel passed a clean isolated install, the avp9 positive-control oracle, the new eval and conflict assertions, an Authority Diff identity run, and pip check.

The release workflow rebuilds from this tag, reruns the suite, installs the resulting wheel, verifies the fixture and both CLIs, and then attaches the wheel, source archive, and SHA256SUMS.

Verb Authority v0.10.0-beta.5 — Explicit Risk Evidence

This beta responds to the comparison run reported in issue #7. The finding was not a missing-keyword edge case: an author-controlled tool name was acting as the behavioral verdict and could put confirmation on the wrong call.

What changed:

• Undeclared tool risk is now unknown, requires review, and keeps runtime confirmation enabled.
• Tool-name matching is complete-token only and is reported as a caller-mutable heuristic, never as proof.
• Runtime Tool objects can declare risk=Risk.*.
• Control sidecars can declare a risk tier, evidence status, and concrete effects.
• Reports separate effective, inferred, and declared risk and expose conflicts, review status, and confirmation behavior.
• A declaration that lowers a matched high-risk heuristic retains confirmation until the conflict is reviewed.
• Authority Diff and --fail-on-review include risk evidence and conflicts.

Regression coverage includes all reported bid mutations (place_bid, purchase_bid, buy_bid, submit_bid, transfer_funds, bid), all reported evaluation mutations (evaluate, eval, evaluation, revaluate), description and parameter-name counterexamples, explicit read-only declarations, and confirmation fail-safes.

Migration note: code constructing Tool(...) should now pass an explicit risk=Risk.READ_ONLY|WRITE|FINANCIAL|DESTRUCTIVE|CODE_EXEC. Omitting it is intentionally fail-safe and produces unknown plus confirmation. Scanner users can add the equivalent risk object to the existing version-1 controls sidecar.

The release workflow reruns the full Python 3.10-3.14 test/build matrix, builds a wheel and source archive, verifies SHA-256 checksums, installs the wheel without dependencies, exercises all installed commands, and then attaches the verified assets and SHA256SUMS.