swt3-ai 0.6.5 → 0.6.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +33 -1
- metadata +4 -4
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 719cc19c6202c043713079ad509eb09a4c729393ecf7488e35c6b122660e241c
|
|
4
|
+
data.tar.gz: 388ee4b8e7ca9810490d186066840808a088d2766546f57c2651a3d40f4fc61f
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 94f83a0f5ce92842abfd3bb615a412527828bff511e8179ee5bb6416cd8b6758470aae7820e9ec6274d97ed5803cbf2b599680f9ad301e0549e4f966b55093c4
|
|
7
|
+
data.tar.gz: 1475c12c91eb99198fef45ce8da074349d55a8d1f426a3b43c58b06da6ce7f4a8d10e200702f6555eb7285f5c40736c8988c2879e5f0f840f2c8e8d8db8c2438
|
data/README.md
CHANGED
|
@@ -11,6 +11,38 @@ Built for platform engineers who need to bolt compliance witnessing onto product
|
|
|
11
11
|
|
|
12
12
|
EU AI Act GPAI transparency obligations enforced since **August 2, 2026**. High-risk enforcement follows **December 2, 2027**. This SDK gives you the cryptographic primitives for both.
|
|
13
13
|
|
|
14
|
+
## What's New in v0.6.6
|
|
15
|
+
|
|
16
|
+
Supply chain accountability. Four new procedures, a CI/CD gate action, and OTel GenAI conventions across the ecosystem. Every improvement flows through to Ruby because fingerprints are identical across all 10 languages.
|
|
17
|
+
|
|
18
|
+
### 4 New Procedures
|
|
19
|
+
|
|
20
|
+
**AI-PROV.1 (Model Provenance Chain):** Records model lineage -- base model, training pipeline, fine-tuning ancestry. The G7 Hiroshima AI SBOM framework requires provenance documentation. A `parent_model_fingerprint` parameter on model weight/adapter/quantization methods links derivative models to their ancestors. Provenance anchors verify with `mint_fingerprint` like any other anchor.
|
|
21
|
+
|
|
22
|
+
**AI-DEL.2 (Delegation Boundary):** Records what an agent is NOT permitted to do -- blocked tools, restricted scopes, escalation triggers. EU AI Act Art. 14 requires documented AI system limitations. Where AI-DEL.1 tracks permissions, AI-DEL.2 tracks constraints.
|
|
23
|
+
|
|
24
|
+
**AI-DENSITY.1 (Anchor Density):** Records the ratio of witnessed events to total events over a time window. Catches the slow coverage drift from 100% to 2% that nobody notices until the audit. A DensityEnforcer class in Python and TypeScript auto-fires density anchors when coverage drops.
|
|
25
|
+
|
|
26
|
+
**AI-MCP.1 (MCP Security Posture):** Evaluates 8 security properties of an MCP server connection. Records checks passed vs. total -- never which specific checks failed. NSA and CISA flagged 200,000+ vulnerable MCP deployments in 2026. This creates evidence that security was evaluated at connection time without becoming an attack map.
|
|
27
|
+
|
|
28
|
+
**Why it matters for Ruby:** All four procedures produce anchors with the same fingerprint formula. Your Ruby code can verify any of these new anchor types with the existing `Swt3Ai::Fingerprint.mint_fingerprint` method -- no gem update required for verification. Your Rails dashboards and Sidekiq workers can process provenance and density anchors from the Python pipeline without any changes. When your Ruby monitoring layer ingests anchor data, the new procedure types are just more rows with the same verifiable fingerprint structure.
|
|
29
|
+
|
|
30
|
+
### GitHub Action
|
|
31
|
+
|
|
32
|
+
`tenova-labs/swt3-gate-action@v1` evaluates `.swt3-gate.yml` in CI/CD. Fails the build when coverage drops. Works with any language -- the gate checks anchors on the server, not the SDK in your repo. Your Gemfile-driven CI pipeline can enforce compliance gates without installing any additional gems.
|
|
33
|
+
|
|
34
|
+
### OTel GenAI Conventions (Python + TypeScript)
|
|
35
|
+
|
|
36
|
+
The OpenTelemetry exporters now emit `gen_ai.system`, `gen_ai.request.model`, and token usage attributes following the OTel GenAI semantic conventions. If your Ruby service consumes OTel spans from the Python or TypeScript witness pipeline, these new attributes appear automatically.
|
|
37
|
+
|
|
38
|
+
### Updated Coverage
|
|
39
|
+
|
|
40
|
+
- 118 procedures across 64 namespaces (+AI-PROV.1, AI-DEL.2, AI-DENSITY.1, AI-MCP.1)
|
|
41
|
+
- 37 MCP tools (+witness_delegation_boundary, witness_anchor_density, witness_mcp_security, witness_model_provenance)
|
|
42
|
+
- 10 SDK languages with byte-identical output
|
|
43
|
+
- 36 framework crosswalks, 222 compliance guides
|
|
44
|
+
- 2,825 tests passing across 5 languages
|
|
45
|
+
|
|
14
46
|
## What's New in v0.6.5
|
|
15
47
|
|
|
16
48
|
Scale governance. The protocol grew features that matter at GPAI scale, and every improvement flows through to Ruby because fingerprints are identical across all 10 languages.
|
|
@@ -224,7 +256,7 @@ All SWT3 SDKs produce identical fingerprints from the same inputs. A unified aud
|
|
|
224
256
|
| Python ML pipeline | [swt3-ai (PyPI)](https://pypi.org/project/swt3-ai/) | Full witness pipeline: `wrap(client)`, buffer management, clearing engine, 21 adapters (OpenAI, Anthropic, Bedrock, vLLM, Ollama, LiteLLM, LangChain, CrewAI, etc.) |
|
|
225
257
|
| TypeScript/Node API | [@tenova/swt3-ai (npm)](https://www.npmjs.com/package/@tenova/swt3-ai) | ES6 Proxy wrapping, streaming support, Vercel AI SDK adapter, OTel export |
|
|
226
258
|
| Rails, Sidekiq, Grape, Hanami | **swt3-ai (this gem)** | Fingerprint, signing, and verification primitives. Embed witnessing into controllers, workers, middleware, or rake tasks |
|
|
227
|
-
| MCP-enabled agents | [@tenova/swt3-mcp](https://www.npmjs.com/package/@tenova/swt3-mcp) |
|
|
259
|
+
| MCP-enabled agents | [@tenova/swt3-mcp](https://www.npmjs.com/package/@tenova/swt3-mcp) | 37 MCP tools, transport middleware for zero-code witnessing |
|
|
228
260
|
|
|
229
261
|
Your Python team trains the model and wraps inference with the full pipeline. Your Ruby infrastructure witnesses every downstream decision, API call, and background job that touches the model's output. Same fingerprints, same anchors, same audit trail.
|
|
230
262
|
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: swt3-ai
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.6.
|
|
4
|
+
version: 0.6.6
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- TeNova Labs
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2026-08-
|
|
11
|
+
date: 2026-08-25 00:00:00.000000000 Z
|
|
12
12
|
dependencies: []
|
|
13
13
|
description: Mint, verify, and sign SWT3 witness anchors for AI compliance. EU AI
|
|
14
14
|
Act, NIST AI RMF, CMMC, SR 11-7. Cross-language parity with Python and TypeScript
|
|
@@ -52,6 +52,6 @@ requirements: []
|
|
|
52
52
|
rubygems_version: 3.4.20
|
|
53
53
|
signing_key:
|
|
54
54
|
specification_version: 4
|
|
55
|
-
summary: 'SWT3 AI Witness SDK: cryptographic attestation for AI inference.
|
|
56
|
-
|
|
55
|
+
summary: 'SWT3 AI Witness SDK: cryptographic attestation for AI inference. 118 procedures,
|
|
56
|
+
64 namespaces, 10 languages, 18 profiles, 21 integrations.'
|
|
57
57
|
test_files: []
|