swt3-ai 0.6.5 → 0.6.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +33 -1
  3. metadata +4 -4
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 4e1defaa0689d6035a9d6a27cc2b286838d45ff2caeb1574e04647c9d1aecd2d
4
- data.tar.gz: f33f1e1ed8ec0428ef8074762135d014201d4941c8f3fb5f3547f115085a9a67
3
+ metadata.gz: 719cc19c6202c043713079ad509eb09a4c729393ecf7488e35c6b122660e241c
4
+ data.tar.gz: 388ee4b8e7ca9810490d186066840808a088d2766546f57c2651a3d40f4fc61f
5
5
  SHA512:
6
- metadata.gz: 0ce3f5e29bfd56858dcd84eedfcda6b3b31940f6277132a4f7c105d509cf12ccce34328d889f713f20c94046842b6fe68638304d22d9fccef89956a805e5c2ba
7
- data.tar.gz: 2fda1b6a1e9eda682e740fe10a87ed1b4fbf1f9ef5df3c6d2926bd05d10d97dc24cf0c1a2c4cd1d8d5903949f73a235359379750b531702fbaad6ceedb257d29
6
+ metadata.gz: 94f83a0f5ce92842abfd3bb615a412527828bff511e8179ee5bb6416cd8b6758470aae7820e9ec6274d97ed5803cbf2b599680f9ad301e0549e4f966b55093c4
7
+ data.tar.gz: 1475c12c91eb99198fef45ce8da074349d55a8d1f426a3b43c58b06da6ce7f4a8d10e200702f6555eb7285f5c40736c8988c2879e5f0f840f2c8e8d8db8c2438
data/README.md CHANGED
@@ -11,6 +11,38 @@ Built for platform engineers who need to bolt compliance witnessing onto product
11
11
 
12
12
  EU AI Act GPAI transparency obligations enforced since **August 2, 2026**. High-risk enforcement follows **December 2, 2027**. This SDK gives you the cryptographic primitives for both.
13
13
 
14
+ ## What's New in v0.6.6
15
+
16
+ Supply chain accountability. Four new procedures, a CI/CD gate action, and OTel GenAI conventions across the ecosystem. Every improvement flows through to Ruby because fingerprints are identical across all 10 languages.
17
+
18
+ ### 4 New Procedures
19
+
20
+ **AI-PROV.1 (Model Provenance Chain):** Records model lineage -- base model, training pipeline, fine-tuning ancestry. The G7 Hiroshima AI SBOM framework requires provenance documentation. A `parent_model_fingerprint` parameter on model weight/adapter/quantization methods links derivative models to their ancestors. Provenance anchors verify with `mint_fingerprint` like any other anchor.
21
+
22
+ **AI-DEL.2 (Delegation Boundary):** Records what an agent is NOT permitted to do -- blocked tools, restricted scopes, escalation triggers. EU AI Act Art. 14 requires documented AI system limitations. Where AI-DEL.1 tracks permissions, AI-DEL.2 tracks constraints.
23
+
24
+ **AI-DENSITY.1 (Anchor Density):** Records the ratio of witnessed events to total events over a time window. Catches the slow coverage drift from 100% to 2% that nobody notices until the audit. A DensityEnforcer class in Python and TypeScript auto-fires density anchors when coverage drops.
25
+
26
+ **AI-MCP.1 (MCP Security Posture):** Evaluates 8 security properties of an MCP server connection. Records checks passed vs. total -- never which specific checks failed. NSA and CISA flagged 200,000+ vulnerable MCP deployments in 2026. This creates evidence that security was evaluated at connection time without becoming an attack map.
27
+
28
+ **Why it matters for Ruby:** All four procedures produce anchors with the same fingerprint formula. Your Ruby code can verify any of these new anchor types with the existing `Swt3Ai::Fingerprint.mint_fingerprint` method -- no gem update required for verification. Your Rails dashboards and Sidekiq workers can process provenance and density anchors from the Python pipeline without any changes. When your Ruby monitoring layer ingests anchor data, the new procedure types are just more rows with the same verifiable fingerprint structure.
29
+
30
+ ### GitHub Action
31
+
32
+ `tenova-labs/swt3-gate-action@v1` evaluates `.swt3-gate.yml` in CI/CD. Fails the build when coverage drops. Works with any language -- the gate checks anchors on the server, not the SDK in your repo. Your Gemfile-driven CI pipeline can enforce compliance gates without installing any additional gems.
33
+
34
+ ### OTel GenAI Conventions (Python + TypeScript)
35
+
36
+ The OpenTelemetry exporters now emit `gen_ai.system`, `gen_ai.request.model`, and token usage attributes following the OTel GenAI semantic conventions. If your Ruby service consumes OTel spans from the Python or TypeScript witness pipeline, these new attributes appear automatically.
37
+
38
+ ### Updated Coverage
39
+
40
+ - 118 procedures across 64 namespaces (+AI-PROV.1, AI-DEL.2, AI-DENSITY.1, AI-MCP.1)
41
+ - 37 MCP tools (+witness_delegation_boundary, witness_anchor_density, witness_mcp_security, witness_model_provenance)
42
+ - 10 SDK languages with byte-identical output
43
+ - 36 framework crosswalks, 222 compliance guides
44
+ - 2,825 tests passing across 5 languages
45
+
14
46
  ## What's New in v0.6.5
15
47
 
16
48
  Scale governance. The protocol grew features that matter at GPAI scale, and every improvement flows through to Ruby because fingerprints are identical across all 10 languages.
@@ -224,7 +256,7 @@ All SWT3 SDKs produce identical fingerprints from the same inputs. A unified aud
224
256
  | Python ML pipeline | [swt3-ai (PyPI)](https://pypi.org/project/swt3-ai/) | Full witness pipeline: `wrap(client)`, buffer management, clearing engine, 21 adapters (OpenAI, Anthropic, Bedrock, vLLM, Ollama, LiteLLM, LangChain, CrewAI, etc.) |
225
257
  | TypeScript/Node API | [@tenova/swt3-ai (npm)](https://www.npmjs.com/package/@tenova/swt3-ai) | ES6 Proxy wrapping, streaming support, Vercel AI SDK adapter, OTel export |
226
258
  | Rails, Sidekiq, Grape, Hanami | **swt3-ai (this gem)** | Fingerprint, signing, and verification primitives. Embed witnessing into controllers, workers, middleware, or rake tasks |
227
- | MCP-enabled agents | [@tenova/swt3-mcp](https://www.npmjs.com/package/@tenova/swt3-mcp) | 33 MCP tools, transport middleware for zero-code witnessing |
259
+ | MCP-enabled agents | [@tenova/swt3-mcp](https://www.npmjs.com/package/@tenova/swt3-mcp) | 37 MCP tools, transport middleware for zero-code witnessing |
228
260
 
229
261
  Your Python team trains the model and wraps inference with the full pipeline. Your Ruby infrastructure witnesses every downstream decision, API call, and background job that touches the model's output. Same fingerprints, same anchors, same audit trail.
230
262
 
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: swt3-ai
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.6.5
4
+ version: 0.6.6
5
5
  platform: ruby
6
6
  authors:
7
7
  - TeNova Labs
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2026-08-18 00:00:00.000000000 Z
11
+ date: 2026-08-25 00:00:00.000000000 Z
12
12
  dependencies: []
13
13
  description: Mint, verify, and sign SWT3 witness anchors for AI compliance. EU AI
14
14
  Act, NIST AI RMF, CMMC, SR 11-7. Cross-language parity with Python and TypeScript
@@ -52,6 +52,6 @@ requirements: []
52
52
  rubygems_version: 3.4.20
53
53
  signing_key:
54
54
  specification_version: 4
55
- summary: 'SWT3 AI Witness SDK: cryptographic attestation for AI inference. 114 procedures,
56
- 62 namespaces, 10 languages, 18 profiles, 21 integrations.'
55
+ summary: 'SWT3 AI Witness SDK: cryptographic attestation for AI inference. 118 procedures,
56
+ 64 namespaces, 10 languages, 18 profiles, 21 integrations.'
57
57
  test_files: []