swt3-ai 0.4.1 → 0.5.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +46 -41
  3. data/lib/swt3_ai/types.rb +18 -2
  4. data/lib/swt3_ai.rb +1 -1
  5. metadata +3 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 3c33738eca6af0da5f3b341aca0c44f10d97f646a0aed85bd57901081c2bc6f9
4
- data.tar.gz: 26e63c59eb176fc1d7cdfda26eed9841c1fa8e242a97915885a3396f26c43099
3
+ metadata.gz: fb901b26be47c81210c83fbf53748471246c6d515c1f4d7c62ccf7fedd2106ed
4
+ data.tar.gz: 5864cc0d9485c41cb07b3dec9311fc598087dbf51a29a4e9bc93cdbebe0c4e5e
5
5
  SHA512:
6
- metadata.gz: c8472c6b851815fd18a8a0f8f1b896b4fd8e727b4a9d4fcc12629beca30294aba4f5b7c95b912d6c5274da0123777bab811fa6723b066b041d228caeae7b292c
7
- data.tar.gz: f7eda3a4fbeea3e9c58f36cb298f65da87c37bc4798add45af5ac28a81f68776383ee97597a0efb2ed3880aa379976184c0e857dbdb30ccc468cff5897dd6b97
6
+ metadata.gz: ac1d6cb94dc33a7be3471433a17d09315e8c778347c2ebba17f78408898260ff11e65119a449f124e12fe6d837706681575992d7fa37151f822a027ce3738a35
7
+ data.tar.gz: 3243b1e0bbc3a8815fa1bd30461af74ffd002dc28c2759ccd0a37c364be1f622468f27038409d130bc27ce6b08fff07104baca81918ad54637d4e04c74c565be
data/README.md CHANGED
@@ -5,49 +5,40 @@ Witness your AI. Prove it followed the rules. Cryptographic accountability for e
5
5
 
6
6
  # swt3-ai
7
7
 
8
- **SWT3 AI Witness SDK for Ruby** (coming soon): tamper-proof evidence that your AI is doing what you say it does. Every inference hashed. Every tool call recorded. Every resource access checked against scope. No prompts or responses ever leave your infrastructure.
8
+ **SWT3 AI Witness SDK for Ruby**: mint, verify, and sign SWT3 witness anchors with cross-language parity. Zero external dependencies -- uses only `openssl` from the standard library.
9
9
 
10
- The EU AI Act takes effect **August 2, 2026**. When regulators ask "prove your AI followed the rules," you need more than logs. You need cryptographic proof.
10
+ GPAI transparency obligations are enforceable now. EU AI Act high-risk enforcement begins **December 2, 2027**. This SDK gives you the cryptographic primitives.
11
11
 
12
- ## Status
12
+ ## What You Get
13
13
 
14
- This package reserves the `swt3-ai` namespace on RubyGems. The full Ruby SDK is under development.
14
+ - **`Swt3Ai::Fingerprint.mint_fingerprint`** -- canonical SWT3 fingerprint from tenant, procedure, factors, and timestamp
15
+ - **`Swt3Ai::Signing.sign_payload`** -- HMAC-SHA256 signing with optional agent identity binding
16
+ - **`Swt3Ai::Fingerprint.sha256_truncated`** -- truncated SHA-256 hashing for prompts, responses, and model weights
17
+ - **Types** -- `WitnessPayload`, `WitnessReceipt`, `WitnessConfig` structs and `REVOCATION_REASONS` constants
15
18
 
16
- Production SDKs are available today for Python and TypeScript:
19
+ All output is byte-identical to the Python, TypeScript, Rust, and C# SDKs. Verified by shared test vectors.
17
20
 
18
- ```bash
19
- # Python
20
- pip install swt3-ai
21
- python -m swt3_ai.demo
21
+ ## Quick Start
22
22
 
23
- # TypeScript
24
- npm install @tenova/swt3-ai
25
- npx swt3-demo
23
+ ```bash
24
+ gem install swt3-ai
26
25
  ```
27
26
 
28
- Both run the full pipeline locally with no API keys: hash, extract, clear, anchor, verify.
29
-
30
- ## What SWT3 Does
31
-
32
- When your AI makes a call, the SDK:
27
+ Mint a fingerprint:
33
28
 
34
- 1. **Hashes** the prompt and response locally using SHA-256 (raw text never leaves your machine)
35
- 2. **Extracts** numeric factors: model version, latency, token count, guardrail status
36
- 3. **Clears** sensitive metadata based on your clearing level (you control what goes on the wire)
37
- 4. **Anchors** the factors into a cryptographic fingerprint anyone can independently verify
38
- 5. **Returns** your original response completely untouched
29
+ ```ruby
30
+ require "swt3_ai"
39
31
 
40
- The result: an immutable record that your AI ran the right model, with the right guardrails, within the right boundaries. Without the auditor ever seeing the data.
32
+ # Hash prompt and response locally (raw text never leaves your machine)
33
+ prompt_hash = Swt3Ai::Fingerprint.sha256_truncated("Summarize this contract...", 16)
34
+ response_hash = Swt3Ai::Fingerprint.sha256_truncated("The contract states...", 16)
41
35
 
42
- ## Regulatory Coverage
43
-
44
- The SWT3 AI Witnessing Profile maps to:
36
+ # Mint a fingerprint from the canonical formula
37
+ fp = Swt3Ai::Fingerprint.mint_fingerprint("MY_TENANT", "AI-INF.1", 1.0, 1.0, 0.0, 1774800000000)
45
38
 
46
- - **EU AI Act**: Articles 9, 10, 12, 13, 14, 53, 72
47
- - **NIST AI RMF**: GOVERN, MAP, MEASURE, MANAGE functions
48
- - **ISO 42001**: Annex A AI management controls
49
- - **NIST 800-53**: SI-7 (integrity), AU-2/AU-3 (audit), AC controls
50
- - **SR 11-7**: Model risk management (financial services)
39
+ # Sign for non-repudiation (optional)
40
+ sig = Swt3Ai::Signing.sign_payload("swt3_sk_my_key", fp, "fraud-detector-prod")
41
+ ```
51
42
 
52
43
  ## Verify Any Anchor From Your Terminal
53
44
 
@@ -62,23 +53,37 @@ No SDK needed. Works on any machine, any language.
62
53
 
63
54
  All SWT3 SDKs produce identical fingerprints from the same inputs. A unified audit trail across your entire stack, verified by shared test vectors at build time.
64
55
 
65
- | Layer | Language | Package |
66
- |-------|----------|---------|
67
- | Backend services | Python | [swt3-ai](https://pypi.org/project/swt3-ai/) |
68
- | API routes / Edge | TypeScript | [@tenova/swt3-ai](https://www.npmjs.com/package/@tenova/swt3-ai) |
69
- | Protocol reference | TypeScript | [@tenova/libswt3](https://www.npmjs.com/package/@tenova/libswt3) |
70
- | Web apps (Rails) | Ruby | swt3-ai (this package, coming soon) |
56
+ | Language | Package | Registry |
57
+ |----------|---------|----------|
58
+ | Python | [swt3-ai](https://pypi.org/project/swt3-ai/) | PyPI |
59
+ | TypeScript | [@tenova/swt3-ai](https://www.npmjs.com/package/@tenova/swt3-ai) | npm |
60
+ | Rust | [swt3-ai](https://crates.io/crates/swt3-ai) | crates.io |
61
+ | C# / .NET | [swt3-ai](https://www.nuget.org/packages/swt3-ai) | NuGet |
62
+ | Ruby | swt3-ai (this package) | RubyGems |
63
+ | MCP Server | [@tenova/swt3-mcp](https://www.npmjs.com/package/@tenova/swt3-mcp) | npm + MCP Registry |
71
64
 
72
- ## Links
65
+ The Python and TypeScript SDKs include the full witness pipeline: transparent client wrapping, buffer management, clearing engine, adapter support (OpenAI, Anthropic, Bedrock, vLLM, Ollama, LangChain), trust mesh, policy-as-code, and Merkle accumulator. Use them for production AI witnessing. Use this Ruby gem for embedding fingerprint verification into Rails apps, Sidekiq workers, or Ruby-based tooling.
73
66
 
74
- - **Website**: [tenova.io](https://tenova.io)
75
- - **Protocol Spec**: [SWT3-SPEC-v1.0](https://github.com/tenova-labs/swt3-ai)
76
- - **Live Demo**: [sovereign.tenova.io/audit/axm_audit_demo_eu_ai_act_public](https://sovereign.tenova.io/audit/axm_audit_demo_eu_ai_act_public)
67
+ ## Regulatory Coverage
68
+
69
+ The SWT3 AI Witnessing Profile maps to:
70
+
71
+ - **EU AI Act**: Articles 9, 10, 12, 13, 14, 53, 72
72
+ - **NIST AI RMF**: GOVERN, MAP, MEASURE, MANAGE functions
73
+ - **ISO 42001**: Annex A AI management controls
74
+ - **NIST 800-53**: SI-7 (integrity), AU-2/AU-3 (audit), AC controls
75
+ - **SR 11-7**: Model risk management (financial services)
77
76
 
78
77
  ## Privacy
79
78
 
80
79
  Your prompts and responses **never leave your infrastructure**. The SDK computes SHA-256 hashes locally and transmits only irreversible hashes and numeric factors. At Clearing Level 3, even the model name is hashed. The witness endpoint is a blind registrar: it stores cryptographic proofs, not your data.
81
80
 
81
+ ## Links
82
+
83
+ - **Website**: [tenova.io](https://tenova.io)
84
+ - **Protocol Spec**: [SWT3-SPEC-v1.0](https://github.com/tenova-labs/swt3-ai)
85
+ - **Live Demo**: [sovereign.tenova.io/audit/axm_audit_demo_eu_ai_act_public](https://sovereign.tenova.io/audit/axm_audit_demo_eu_ai_act_public)
86
+
82
87
  ---
83
88
 
84
89
  *SWT3: Sovereign Witness Traceability. We don't run your models. We witness them.*
data/lib/swt3_ai/types.rb CHANGED
@@ -6,7 +6,10 @@ module Swt3Ai
6
6
  :fingerprint_timestamp_ms, :ai_model_id, :ai_prompt_hash,
7
7
  :ai_response_hash, :ai_latency_ms, :ai_input_tokens,
8
8
  :ai_output_tokens, :agent_id, :cycle_id,
9
- :payload_signature, :policy_version_hash,
9
+ :payload_signature, :signing_key_id, :signing_key_version,
10
+ :policy_version_hash, :jurisdiction, :legal_basis,
11
+ :purpose_class, :authorization_id,
12
+ :revocation_target, :revocation_reason,
10
13
  keyword_init: true
11
14
  )
12
15
 
@@ -21,7 +24,20 @@ module Swt3Ai
21
24
  WitnessConfig = Struct.new(
22
25
  :endpoint, :api_key, :tenant_id, :clearing_level,
23
26
  :buffer_size, :flush_interval, :timeout, :max_retries,
24
- :agent_id, :signing_key, :cycle_id, :policy_version,
27
+ :agent_id, :signing_key, :signing_key_id, :signing_key_version,
28
+ :cycle_id, :policy_version,
29
+ :jurisdiction, :legal_basis, :purpose_class,
25
30
  keyword_init: true
26
31
  )
32
+
33
+ # Revocation reason codes for AI-REV.1 anchors.
34
+ REVOCATION_REASONS = {
35
+ "unspecified" => 0,
36
+ "model_recall" => 1,
37
+ "policy_violation" => 2,
38
+ "data_contamination" => 3,
39
+ "consent_withdrawal" => 4,
40
+ "regulatory_order" => 5,
41
+ "error_correction" => 6,
42
+ }.freeze
27
43
  end
data/lib/swt3_ai.rb CHANGED
@@ -7,5 +7,5 @@ require_relative "swt3_ai/signing"
7
7
  require_relative "swt3_ai/types"
8
8
 
9
9
  module Swt3Ai
10
- VERSION = "0.3.6"
10
+ VERSION = "0.5.2"
11
11
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: swt3-ai
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.4.1
4
+ version: 0.5.2
5
5
  platform: ruby
6
6
  authors:
7
7
  - TeNova Labs
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2026-04-28 00:00:00.000000000 Z
11
+ date: 2026-05-19 00:00:00.000000000 Z
12
12
  dependencies: []
13
13
  description: Mint, verify, and sign SWT3 witness anchors for AI compliance. Cross-language
14
14
  parity with Python and TypeScript SDKs. Zero external dependencies.
@@ -29,6 +29,7 @@ licenses:
29
29
  metadata:
30
30
  source_code_uri: https://github.com/tenova-labs/swt3-ai
31
31
  homepage_uri: https://tenova.io
32
+ keywords: ai,compliance,witness,swt3,eu-ai-act,nist-ai-rmf,ai-governance,ai-audit,ai-safety,agentic-ai,guardrails,model-governance,cryptographic-attestation
32
33
  post_install_message:
33
34
  rdoc_options: []
34
35
  require_paths: