swt3-ai 0.7.1 → 0.7.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +23 -9
- metadata +3 -3
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 6506648a320ce0a78e9c082473e48d3eb14141b89a1c95c98d5d55bd3ef390b2
|
|
4
|
+
data.tar.gz: e216c1e6abab7f953bbcebc8fa598aeab055afdaeca2d7167c6a2e824ca44182
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: aa46a981fd01f006a3f7c2dc37ea8dcbf10b5851ad8892b3d60e0c205eb064d1df52aaa2aadc361e1ac43de4ca7d806573eb182d922d59025418d564881b90e0
|
|
7
|
+
data.tar.gz: 38c3365a3698394ee5df7ed0100ae678cfb45bf04674eff7f18be914c0feb7596587fa44b340b81259316a20073aca20265751e04e56e7d55ff4c843838ad390
|
data/README.md
CHANGED
|
@@ -11,11 +11,33 @@ Built for platform engineers who need to bolt compliance witnessing onto product
|
|
|
11
11
|
|
|
12
12
|
EU AI Act GPAI transparency obligations enforced since **August 2, 2026**. High-risk enforcement follows **December 2, 2027**. This SDK gives you the cryptographic primitives for both.
|
|
13
13
|
|
|
14
|
+
## What's New in v0.7.2
|
|
15
|
+
|
|
16
|
+
Two gaps closed in one release: harness-layer governance and zero-code MCP compliance. v0.7.2 adds five new procedures for orchestration, context management, sandboxing, and eval gating -- the decisions AI harnesses make before inference that have no audit trail today. It also ships a Witness Middleware (`withSWT3(transport)`) in the companion MCP package that auto-mints AI-TOOL.1 anchors for every tool call flowing through any MCP server, with zero code changes to tool handlers.
|
|
17
|
+
|
|
18
|
+
**Why this matters for Ruby:** Rails dashboards and Sidekiq workers are where AI compliance data surfaces for human review. The five harness governance anchors (AI-ORCH.1/2, AI-CTX.1, AI-SAND.1, AI-GATE.1) are structurally identical to inference anchors -- same `mint_fingerprint` verification, same `WitnessPayload` structure. When your Python or TypeScript harness records which agents it delegated to, how much context was truncated, and whether the eval gate passed, your Ruby reporting layer processes those anchors without any gem changes. The Witness Middleware means every MCP server in your stack gains cryptographic attestation by wrapping its transport -- your Ruby dashboard displays the evidence automatically.
|
|
19
|
+
|
|
20
|
+
### 5 New Procedures
|
|
21
|
+
|
|
22
|
+
- **AI-ORCH.1** (Orchestration Topology): Records routing pattern (parallel/sequential/hierarchical), agent count, dependency depth.
|
|
23
|
+
- **AI-ORCH.2** (Agent Handoff): Records delegator-to-delegate identity link with permission delta direction.
|
|
24
|
+
- **AI-CTX.1** (Context Window Management): Records token count before/after eviction and the method used.
|
|
25
|
+
- **AI-SAND.1** (Sandbox Enforcement): Records tools declared vs. invoked and violation count.
|
|
26
|
+
- **AI-GATE.1** (Eval Gate Decision): Records eval pass/fail counts with auto-computed gate score.
|
|
27
|
+
|
|
28
|
+
### Updated Coverage
|
|
29
|
+
|
|
30
|
+
- 280 procedures across 77 namespaces (was 275/77)
|
|
31
|
+
- 68 MCP tools (was 63)
|
|
32
|
+
- 10 SDK languages with byte-identical output
|
|
33
|
+
- 77 framework crosswalks, 265 compliance guides
|
|
34
|
+
- ~3,000 tests passing across 10 languages
|
|
35
|
+
|
|
14
36
|
## What's New in v0.7.1
|
|
15
37
|
|
|
16
38
|
MCP security is under fire. OWASP published the MCP Top 10 in 2026 -- 30-82% of MCP servers are vulnerable to tool poisoning, insufficient authentication, and shadow server proliferation. v0.7.1 adds three new procedures (AI-MCP.2, AI-MCP.3, AI-MCP.4) that close the remaining OWASP gaps. SWT3 is now the first protocol to cover all 10 OWASP MCP risks with cryptographic evidence. Every new anchor type verifies with the existing `Swt3Ai::Fingerprint.mint_fingerprint` method -- no gem update required.
|
|
17
39
|
|
|
18
|
-
**Why this matters for Ruby:** Rails dashboards displaying compliance posture and Sidekiq workers processing witness data will encounter the new MCP security anchors (tool integrity, server auth, server discovery) as your Python and TypeScript pipelines adopt them.
|
|
40
|
+
**Why this matters for Ruby:** Rails dashboards displaying compliance posture and Sidekiq workers processing witness data will encounter the new MCP security anchors (tool integrity, server auth, server discovery) as your Python and TypeScript pipelines adopt them. Same `mint_fingerprint` verification, same `WitnessPayload` structure -- no gem changes.
|
|
19
41
|
|
|
20
42
|
### 3 New Procedures
|
|
21
43
|
|
|
@@ -23,14 +45,6 @@ MCP security is under fire. OWASP published the MCP Top 10 in 2026 -- 30-82% of
|
|
|
23
45
|
- **AI-MCP.3** (Server Auth Attestation): Records auth method and verification. No auth = FAIL = IA-9 finding. OWASP MCP-07.
|
|
24
46
|
- **AI-MCP.4** (Server Discovery Attestation): Shadow server detection via allowlist check. OWASP MCP-09.
|
|
25
47
|
|
|
26
|
-
### Updated Coverage
|
|
27
|
-
|
|
28
|
-
- 275 procedures across 77 namespaces (was 266/75)
|
|
29
|
-
- 63 MCP tools (was 59)
|
|
30
|
-
- 10 SDK languages with byte-identical output
|
|
31
|
-
- 77 framework crosswalks, 250 compliance guides
|
|
32
|
-
- ~2,950 tests passing across 5 languages
|
|
33
|
-
|
|
34
48
|
## What's New in v0.7.0
|
|
35
49
|
|
|
36
50
|
AI does not run in a vacuum. It authenticates with service accounts, runs on hardware with supply chains, and consumes enough electricity to reshape power grids. v0.7.0 extends SWT3 down the full AI infrastructure stack with 22 new procedures across three families: credential governance (NHI), hardware supply chains (HBOM/DPP), and energy management (ADR). Every new anchor type verifies with the existing `Swt3Ai::Fingerprint.mint_fingerprint` method -- no gem update required.
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: swt3-ai
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.7.
|
|
4
|
+
version: 0.7.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- TeNova Labs
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2026-09-
|
|
11
|
+
date: 2026-09-15 00:00:00.000000000 Z
|
|
12
12
|
dependencies: []
|
|
13
13
|
description: Mint, verify, and sign SWT3 witness anchors for AI compliance. EU AI
|
|
14
14
|
Act, NIST AI RMF, CMMC, SR 11-7. Cross-language parity with Python and TypeScript
|
|
@@ -53,5 +53,5 @@ rubygems_version: 3.4.20
|
|
|
53
53
|
signing_key:
|
|
54
54
|
specification_version: 4
|
|
55
55
|
summary: 'SWT3 AI Witness SDK: cryptographic attestation for AI inference and infrastructure
|
|
56
|
-
governance.
|
|
56
|
+
governance. 280 procedures, 9 namespaces, 10 languages, 77 frameworks.'
|
|
57
57
|
test_files: []
|