swt3-ai 0.6.6 → 0.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 719cc19c6202c043713079ad509eb09a4c729393ecf7488e35c6b122660e241c
-  data.tar.gz: 388ee4b8e7ca9810490d186066840808a088d2766546f57c2651a3d40f4fc61f
+  metadata.gz: f796446c334f2e8d057bd6f0233a8c06e7e69fb4c1dfddc4fcc113922b1fecea
+  data.tar.gz: 6d4e9d4dddc88968b5eccc5727a9ea23e3229558737b1fa5aa24669294cb6166
 SHA512:
-  metadata.gz: 94f83a0f5ce92842abfd3bb615a412527828bff511e8179ee5bb6416cd8b6758470aae7820e9ec6274d97ed5803cbf2b599680f9ad301e0549e4f966b55093c4
-  data.tar.gz: 1475c12c91eb99198fef45ce8da074349d55a8d1f426a3b43c58b06da6ce7f4a8d10e200702f6555eb7285f5c40736c8988c2879e5f0f840f2c8e8d8db8c2438
+  metadata.gz: 915aa33a2e78e682c0a671f3740368b708e3c35a8f9793f9ce5c491d8e92f5117849b7e9edc27df6e979e9d449630519629594b920daf8e65c43981c2e0454a8
+  data.tar.gz: ac360e61a803cc6f32d539d6ede8de83a89be6180a720face17a04490a1df2f506764d5b53b4bb4dd95a497357592879d2a8d1cbbcb26ee384182fa530f6ed4f

data/README.md

@@ -11,37 +11,45 @@ Built for platform engineers who need to bolt compliance witnessing onto product
 
 EU AI Act GPAI transparency obligations enforced since **August 2, 2026**. High-risk enforcement follows **December 2, 2027**. This SDK gives you the cryptographic primitives for both.
 
-## What's New in v0.6.6
-
-Supply chain accountability. Four new procedures, a CI/CD gate action, and OTel GenAI conventions across the ecosystem. Every improvement flows through to Ruby because fingerprints are identical across all 10 languages.
+## What's New in v0.7.1
 
-### 4 New Procedures
+MCP security is under fire. OWASP published the MCP Top 10 in 2026 -- 30-82% of MCP servers are vulnerable to tool poisoning, insufficient authentication, and shadow server proliferation. v0.7.1 adds three new procedures (AI-MCP.2, AI-MCP.3, AI-MCP.4) that close the remaining OWASP gaps. SWT3 is now the first protocol to cover all 10 OWASP MCP risks with cryptographic evidence. Every new anchor type verifies with the existing `Swt3Ai::Fingerprint.mint_fingerprint` method -- no gem update required.
 
-**AI-PROV.1 (Model Provenance Chain):** Records model lineage -- base model, training pipeline, fine-tuning ancestry. The G7 Hiroshima AI SBOM framework requires provenance documentation. A `parent_model_fingerprint` parameter on model weight/adapter/quantization methods links derivative models to their ancestors. Provenance anchors verify with `mint_fingerprint` like any other anchor.
+**Why this matters for Ruby:** Rails dashboards displaying compliance posture and Sidekiq workers processing witness data will encounter the new MCP security anchors (tool integrity, server auth, server discovery) as your Python and TypeScript pipelines adopt them. The anchors are structurally identical to inference anchors -- same `mint_fingerprint` verification, same `WitnessPayload` structure. Your Ruby reporting layer can surface MCP security findings (schema drift detected, unauthenticated server, shadow server) without any gem changes.
 
-**AI-DEL.2 (Delegation Boundary):** Records what an agent is NOT permitted to do -- blocked tools, restricted scopes, escalation triggers. EU AI Act Art. 14 requires documented AI system limitations. Where AI-DEL.1 tracks permissions, AI-DEL.2 tracks constraints.
+### 3 New Procedures
 
-**AI-DENSITY.1 (Anchor Density):** Records the ratio of witnessed events to total events over a time window. Catches the slow coverage drift from 100% to 2% that nobody notices until the audit. A DensityEnforcer class in Python and TypeScript auto-fires density anchors when coverage drops.
+- **AI-MCP.2** (Tool Integrity Attestation): Detects tool schema drift between connect and invoke. OWASP MCP-03.
+- **AI-MCP.3** (Server Auth Attestation): Records auth method and verification. No auth = FAIL = IA-9 finding. OWASP MCP-07.
+- **AI-MCP.4** (Server Discovery Attestation): Shadow server detection via allowlist check. OWASP MCP-09.
 
-**AI-MCP.1 (MCP Security Posture):** Evaluates 8 security properties of an MCP server connection. Records checks passed vs. total -- never which specific checks failed. NSA and CISA flagged 200,000+ vulnerable MCP deployments in 2026. This creates evidence that security was evaluated at connection time without becoming an attack map.
+### Updated Coverage
 
-**Why it matters for Ruby:** All four procedures produce anchors with the same fingerprint formula. Your Ruby code can verify any of these new anchor types with the existing `Swt3Ai::Fingerprint.mint_fingerprint` method -- no gem update required for verification. Your Rails dashboards and Sidekiq workers can process provenance and density anchors from the Python pipeline without any changes. When your Ruby monitoring layer ingests anchor data, the new procedure types are just more rows with the same verifiable fingerprint structure.
+- 275 procedures across 77 namespaces (was 266/75)
+- 63 MCP tools (was 59)
+- 10 SDK languages with byte-identical output
+- 77 framework crosswalks, 250 compliance guides
+- ~2,950 tests passing across 5 languages
 
-### GitHub Action
+## What's New in v0.7.0
 
-`tenova-labs/swt3-gate-action@v1` evaluates `.swt3-gate.yml` in CI/CD. Fails the build when coverage drops. Works with any language -- the gate checks anchors on the server, not the SDK in your repo. Your Gemfile-driven CI pipeline can enforce compliance gates without installing any additional gems.
+AI does not run in a vacuum. It authenticates with service accounts, runs on hardware with supply chains, and consumes enough electricity to reshape power grids. v0.7.0 extends SWT3 down the full AI infrastructure stack with 22 new procedures across three families: credential governance (NHI), hardware supply chains (HBOM/DPP), and energy management (ADR). Every new anchor type verifies with the existing `Swt3Ai::Fingerprint.mint_fingerprint` method -- no gem update required.
 
-### OTel GenAI Conventions (Python + TypeScript)
+**Why this matters for Ruby:** Rails dashboards and Sidekiq workers are where AI data flows through enterprise systems. These new procedure families mean your Ruby monitoring layer can process credential rotation anchors, hardware inventory attestations, and demand response settlements alongside inference anchors -- same verifiable fingerprint structure, same verification call, new evidence categories. When your Python team witnesses service account rotation and your Ruby dashboard displays it, the fingerprint math is identical.
 
-The OpenTelemetry exporters now emit `gen_ai.system`, `gen_ai.request.model`, and token usage attributes following the OTel GenAI semantic conventions. If your Ruby service consumes OTel spans from the Python or TypeScript witness pipeline, these new attributes appear automatically.
+### 22 New Procedures
 
-### Updated Coverage
+**NHI (6):** Credential scope, lifecycle, privilege changes, rotation, delegation, revocation. **HBOM/DPP (10):** Hardware inventory, component lifecycle, thermal monitoring, water, PUE, supply chain provenance, battery health, charge cycles, degradation, end-of-life. **ADR (6):** Demand response events, baseline, curtailment, settlement, carbon credits, grid signals.
 
-- 118 procedures across 64 namespaces (+AI-PROV.1, AI-DEL.2, AI-DENSITY.1, AI-MCP.1)
-- 37 MCP tools (+witness_delegation_boundary, witness_anchor_density, witness_mcp_security, witness_model_provenance)
+- 266 procedures across 75 namespaces (was 118/64)
+- 59 MCP tools (was 37)
 - 10 SDK languages with byte-identical output
-- 36 framework crosswalks, 222 compliance guides
-- 2,825 tests passing across 5 languages
+- 36 framework crosswalks, 237 compliance guides
+- ~2,950 tests passing across 5 languages
+
+## What's New in v0.6.6
+
+Supply chain accountability. Four new procedures, a CI/CD gate action, and OTel GenAI conventions across the ecosystem. Every improvement flows through to Ruby because fingerprints are identical across all 10 languages.
 
 ## What's New in v0.6.5
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: swt3-ai
 version: !ruby/object:Gem::Version
-  version: 0.6.6
+  version: 0.7.1
 platform: ruby
 authors:
 - TeNova Labs
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-25 00:00:00.000000000 Z
+date: 2026-09-08 00:00:00.000000000 Z
 dependencies: []
 description: Mint, verify, and sign SWT3 witness anchors for AI compliance. EU AI
   Act, NIST AI RMF, CMMC, SR 11-7. Cross-language parity with Python and TypeScript
@@ -52,6 +52,6 @@ requirements: []
 rubygems_version: 3.4.20
 signing_key:
 specification_version: 4
-summary: 'SWT3 AI Witness SDK: cryptographic attestation for AI inference. 118 procedures,
-  64 namespaces, 10 languages, 18 profiles, 21 integrations.'
+summary: 'SWT3 AI Witness SDK: cryptographic attestation for AI inference and infrastructure
+  governance. 275 procedures, 9 namespaces, 10 languages, 77 frameworks.'
 test_files: []