swt3-ai 0.7.0 → 0.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c4177e65ff1e28a22579c6a925b75594280ea28efbd71be729c39b070bf23a9c
-  data.tar.gz: db3b75d6f1c21ba9420b9186852739f64d6abd76173a805f04dae3ebebf702b9
+  metadata.gz: 6506648a320ce0a78e9c082473e48d3eb14141b89a1c95c98d5d55bd3ef390b2
+  data.tar.gz: e216c1e6abab7f953bbcebc8fa598aeab055afdaeca2d7167c6a2e824ca44182
 SHA512:
-  metadata.gz: 596e0444f61aa0fe6ac81efa3f2ab1db537f00cee25d711163ea80d5f3a50279d257ad9bde3a2d784a26d21b7c5470570eabf7cc2ac2fedbca3c2de0a895eece
-  data.tar.gz: 6147f6be2921faaf28fea1d131b058dd38a25e81de098f58b2727838a2e1c1238ead20e84c6e452fc818fda6b93c5b99ad16dd72c56b28403d6be62b45315dc3
+  metadata.gz: aa46a981fd01f006a3f7c2dc37ea8dcbf10b5851ad8892b3d60e0c205eb064d1df52aaa2aadc361e1ac43de4ca7d806573eb182d922d59025418d564881b90e0
+  data.tar.gz: 38c3365a3698394ee5df7ed0100ae678cfb45bf04674eff7f18be914c0feb7596587fa44b340b81259316a20073aca20265751e04e56e7d55ff4c843838ad390

data/README.md

@@ -11,6 +11,40 @@ Built for platform engineers who need to bolt compliance witnessing onto product
 
 EU AI Act GPAI transparency obligations enforced since **August 2, 2026**. High-risk enforcement follows **December 2, 2027**. This SDK gives you the cryptographic primitives for both.
 
+## What's New in v0.7.2
+
+Two gaps closed in one release: harness-layer governance and zero-code MCP compliance. v0.7.2 adds five new procedures for orchestration, context management, sandboxing, and eval gating -- the decisions AI harnesses make before inference that have no audit trail today. It also ships a Witness Middleware (`withSWT3(transport)`) in the companion MCP package that auto-mints AI-TOOL.1 anchors for every tool call flowing through any MCP server, with zero code changes to tool handlers.
+
+**Why this matters for Ruby:** Rails dashboards and Sidekiq workers are where AI compliance data surfaces for human review. The five harness governance anchors (AI-ORCH.1/2, AI-CTX.1, AI-SAND.1, AI-GATE.1) are structurally identical to inference anchors -- same `mint_fingerprint` verification, same `WitnessPayload` structure. When your Python or TypeScript harness records which agents it delegated to, how much context was truncated, and whether the eval gate passed, your Ruby reporting layer processes those anchors without any gem changes. The Witness Middleware means every MCP server in your stack gains cryptographic attestation by wrapping its transport -- your Ruby dashboard displays the evidence automatically.
+
+### 5 New Procedures
+
+- **AI-ORCH.1** (Orchestration Topology): Records routing pattern (parallel/sequential/hierarchical), agent count, dependency depth.
+- **AI-ORCH.2** (Agent Handoff): Records delegator-to-delegate identity link with permission delta direction.
+- **AI-CTX.1** (Context Window Management): Records token count before/after eviction and the method used.
+- **AI-SAND.1** (Sandbox Enforcement): Records tools declared vs. invoked and violation count.
+- **AI-GATE.1** (Eval Gate Decision): Records eval pass/fail counts with auto-computed gate score.
+
+### Updated Coverage
+
+- 280 procedures across 77 namespaces (was 275/77)
+- 68 MCP tools (was 63)
+- 10 SDK languages with byte-identical output
+- 77 framework crosswalks, 265 compliance guides
+- ~3,000 tests passing across 10 languages
+
+## What's New in v0.7.1
+
+MCP security is under fire. OWASP published the MCP Top 10 in 2026 -- 30-82% of MCP servers are vulnerable to tool poisoning, insufficient authentication, and shadow server proliferation. v0.7.1 adds three new procedures (AI-MCP.2, AI-MCP.3, AI-MCP.4) that close the remaining OWASP gaps. SWT3 is now the first protocol to cover all 10 OWASP MCP risks with cryptographic evidence. Every new anchor type verifies with the existing `Swt3Ai::Fingerprint.mint_fingerprint` method -- no gem update required.
+
+**Why this matters for Ruby:** Rails dashboards displaying compliance posture and Sidekiq workers processing witness data will encounter the new MCP security anchors (tool integrity, server auth, server discovery) as your Python and TypeScript pipelines adopt them. Same `mint_fingerprint` verification, same `WitnessPayload` structure -- no gem changes.
+
+### 3 New Procedures
+
+- **AI-MCP.2** (Tool Integrity Attestation): Detects tool schema drift between connect and invoke. OWASP MCP-03.
+- **AI-MCP.3** (Server Auth Attestation): Records auth method and verification. No auth = FAIL = IA-9 finding. OWASP MCP-07.
+- **AI-MCP.4** (Server Discovery Attestation): Shadow server detection via allowlist check. OWASP MCP-09.
+
 ## What's New in v0.7.0
 
 AI does not run in a vacuum. It authenticates with service accounts, runs on hardware with supply chains, and consumes enough electricity to reshape power grids. v0.7.0 extends SWT3 down the full AI infrastructure stack with 22 new procedures across three families: credential governance (NHI), hardware supply chains (HBOM/DPP), and energy management (ADR). Every new anchor type verifies with the existing `Swt3Ai::Fingerprint.mint_fingerprint` method -- no gem update required.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: swt3-ai
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.7.2
 platform: ruby
 authors:
 - TeNova Labs
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-01 00:00:00.000000000 Z
+date: 2026-09-15 00:00:00.000000000 Z
 dependencies: []
 description: Mint, verify, and sign SWT3 witness anchors for AI compliance. EU AI
   Act, NIST AI RMF, CMMC, SR 11-7. Cross-language parity with Python and TypeScript
@@ -53,5 +53,5 @@ rubygems_version: 3.4.20
 signing_key:
 specification_version: 4
 summary: 'SWT3 AI Witness SDK: cryptographic attestation for AI inference and infrastructure
-  governance. 266 procedures, 9 namespaces, 10 languages, 36 frameworks.'
+  governance. 280 procedures, 9 namespaces, 10 languages, 77 frameworks.'
 test_files: []