swt3-ai 0.7.1 → 0.7.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +45 -10
- metadata +3 -3
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: e2a85025105308c834b25f3a858488398fe9c720f07bf32f6718d88323155d35
|
|
4
|
+
data.tar.gz: bff95d20511fcf0bac273a9c17dbb600888b8cdbc6ac2481e87bb8bea4f79bdb
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: f5959aaf4ff1f77673529384866a768301bbc7c309b054e44865cedc61360b393cdf68e63a366770626b38e716bdbacf94866c08f71fb0fb84185021183d7c9a
|
|
7
|
+
data.tar.gz: 36a7a31449f5b4a09373a3d95fd540ae8aba7abcc12832b80a15a7d0f189b1e5721dc462c0b968215c9d1123a3df40e88362986eff7335d36d27c9377e7055ac
|
data/README.md
CHANGED
|
@@ -11,11 +11,54 @@ Built for platform engineers who need to bolt compliance witnessing onto product
|
|
|
11
11
|
|
|
12
12
|
EU AI Act GPAI transparency obligations enforced since **August 2, 2026**. High-risk enforcement follows **December 2, 2027**. This SDK gives you the cryptographic primitives for both.
|
|
13
13
|
|
|
14
|
+
## What's New in v0.7.3
|
|
15
|
+
|
|
16
|
+
A2A (Google's Agent-to-Agent protocol) has 150+ supporting organizations, all three hyperscalers, and a v1.0 stable specification under Linux Foundation governance. It has zero built-in audit trail. MCP OAuth adoption sits at 8.5% with 30+ CVEs filed in 60 days. v0.7.3 makes SWT3 the evidence layer for both agent communication protocols with dedicated procedures, lifecycle-aware adapters, and a new crosswalk CLI command.
|
|
17
|
+
|
|
18
|
+
**Why this matters for Ruby:** Ruby API backends and Rails agent orchestrators gain A2A lifecycle attestation with the same factor semantics and fingerprint parity as every other SDK language.
|
|
19
|
+
|
|
20
|
+
### 4 New Procedures
|
|
21
|
+
|
|
22
|
+
- **AI-A2A.1** (Task Delegation Lifecycle): Records task state transitions (submitted/working/input_required/completed/failed/canceled/rejected) with delegation depth and latency.
|
|
23
|
+
- **AI-A2A.2** (Agent Card Discovery): Records agent discovery via well-known URLs, registries, or referrals, with verified credential count.
|
|
24
|
+
- **AI-A2A.3** (Context Chain Linking): Records contextId linkage across multi-agent delegation chains for forensic reconstruction.
|
|
25
|
+
- **AI-MCP.5** (OAuth Token Binding): Records 8 OAuth lifecycle events (discovery through revocation) with binding strength and scope governance.
|
|
26
|
+
|
|
27
|
+
### Updated Coverage
|
|
28
|
+
|
|
29
|
+
- 284 procedures across 10 namespaces (was 280/9)
|
|
30
|
+
- 72 MCP tools (was 68)
|
|
31
|
+
- A2A namespace added (10th namespace)
|
|
32
|
+
- `swt3 crosswalk <procedure>` CLI command for offline framework mapping lookup
|
|
33
|
+
- 269 compliance guides
|
|
34
|
+
|
|
35
|
+
## What's New in v0.7.2
|
|
36
|
+
|
|
37
|
+
Two gaps closed in one release: harness-layer governance and zero-code MCP compliance. v0.7.2 adds five new procedures for orchestration, context management, sandboxing, and eval gating -- the decisions AI harnesses make before inference that have no audit trail today. It also ships a Witness Middleware (`withSWT3(transport)`) in the companion MCP package that auto-mints AI-TOOL.1 anchors for every tool call flowing through any MCP server, with zero code changes to tool handlers.
|
|
38
|
+
|
|
39
|
+
**Why this matters for Ruby:** Rails dashboards and Sidekiq workers are where AI compliance data surfaces for human review. The five harness governance anchors (AI-ORCH.1/2, AI-CTX.1, AI-SAND.1, AI-GATE.1) are structurally identical to inference anchors -- same `mint_fingerprint` verification, same `WitnessPayload` structure. When your Python or TypeScript harness records which agents it delegated to, how much context was truncated, and whether the eval gate passed, your Ruby reporting layer processes those anchors without any gem changes. The Witness Middleware means every MCP server in your stack gains cryptographic attestation by wrapping its transport -- your Ruby dashboard displays the evidence automatically.
|
|
40
|
+
|
|
41
|
+
### 5 New Procedures
|
|
42
|
+
|
|
43
|
+
- **AI-ORCH.1** (Orchestration Topology): Records routing pattern (parallel/sequential/hierarchical), agent count, dependency depth.
|
|
44
|
+
- **AI-ORCH.2** (Agent Handoff): Records delegator-to-delegate identity link with permission delta direction.
|
|
45
|
+
- **AI-CTX.1** (Context Window Management): Records token count before/after eviction and the method used.
|
|
46
|
+
- **AI-SAND.1** (Sandbox Enforcement): Records tools declared vs. invoked and violation count.
|
|
47
|
+
- **AI-GATE.1** (Eval Gate Decision): Records eval pass/fail counts with auto-computed gate score.
|
|
48
|
+
|
|
49
|
+
### Updated Coverage
|
|
50
|
+
|
|
51
|
+
- 280 procedures across 77 namespaces (was 275/77)
|
|
52
|
+
- 68 MCP tools (was 63)
|
|
53
|
+
- 10 SDK languages with byte-identical output
|
|
54
|
+
- 77 framework crosswalks, 265 compliance guides
|
|
55
|
+
- ~3,000 tests passing across 10 languages
|
|
56
|
+
|
|
14
57
|
## What's New in v0.7.1
|
|
15
58
|
|
|
16
59
|
MCP security is under fire. OWASP published the MCP Top 10 in 2026 -- 30-82% of MCP servers are vulnerable to tool poisoning, insufficient authentication, and shadow server proliferation. v0.7.1 adds three new procedures (AI-MCP.2, AI-MCP.3, AI-MCP.4) that close the remaining OWASP gaps. SWT3 is now the first protocol to cover all 10 OWASP MCP risks with cryptographic evidence. Every new anchor type verifies with the existing `Swt3Ai::Fingerprint.mint_fingerprint` method -- no gem update required.
|
|
17
60
|
|
|
18
|
-
**Why this matters for Ruby:** Rails dashboards displaying compliance posture and Sidekiq workers processing witness data will encounter the new MCP security anchors (tool integrity, server auth, server discovery) as your Python and TypeScript pipelines adopt them.
|
|
61
|
+
**Why this matters for Ruby:** Rails dashboards displaying compliance posture and Sidekiq workers processing witness data will encounter the new MCP security anchors (tool integrity, server auth, server discovery) as your Python and TypeScript pipelines adopt them. Same `mint_fingerprint` verification, same `WitnessPayload` structure -- no gem changes.
|
|
19
62
|
|
|
20
63
|
### 3 New Procedures
|
|
21
64
|
|
|
@@ -23,14 +66,6 @@ MCP security is under fire. OWASP published the MCP Top 10 in 2026 -- 30-82% of
|
|
|
23
66
|
- **AI-MCP.3** (Server Auth Attestation): Records auth method and verification. No auth = FAIL = IA-9 finding. OWASP MCP-07.
|
|
24
67
|
- **AI-MCP.4** (Server Discovery Attestation): Shadow server detection via allowlist check. OWASP MCP-09.
|
|
25
68
|
|
|
26
|
-
### Updated Coverage
|
|
27
|
-
|
|
28
|
-
- 275 procedures across 77 namespaces (was 266/75)
|
|
29
|
-
- 63 MCP tools (was 59)
|
|
30
|
-
- 10 SDK languages with byte-identical output
|
|
31
|
-
- 77 framework crosswalks, 250 compliance guides
|
|
32
|
-
- ~2,950 tests passing across 5 languages
|
|
33
|
-
|
|
34
69
|
## What's New in v0.7.0
|
|
35
70
|
|
|
36
71
|
AI does not run in a vacuum. It authenticates with service accounts, runs on hardware with supply chains, and consumes enough electricity to reshape power grids. v0.7.0 extends SWT3 down the full AI infrastructure stack with 22 new procedures across three families: credential governance (NHI), hardware supply chains (HBOM/DPP), and energy management (ADR). Every new anchor type verifies with the existing `Swt3Ai::Fingerprint.mint_fingerprint` method -- no gem update required.
|
|
@@ -285,7 +320,7 @@ Your prompts and responses **never leave your infrastructure**. The SDK computes
|
|
|
285
320
|
## Links
|
|
286
321
|
|
|
287
322
|
- **Website**: [tenova.io](https://tenova.io)
|
|
288
|
-
- **Protocol Spec**: [SWT3
|
|
323
|
+
- **Protocol Spec**: [SWT3 Protocol Specification](https://swt3.ai/spec)
|
|
289
324
|
- **Live Demo**: [sovereign.tenova.io/audit/axm_audit_demo_eu_ai_act_public](https://sovereign.tenova.io/audit/axm_audit_demo_eu_ai_act_public)
|
|
290
325
|
|
|
291
326
|
---
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: swt3-ai
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.7.
|
|
4
|
+
version: 0.7.3
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- TeNova Labs
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2026-09-
|
|
11
|
+
date: 2026-09-22 00:00:00.000000000 Z
|
|
12
12
|
dependencies: []
|
|
13
13
|
description: Mint, verify, and sign SWT3 witness anchors for AI compliance. EU AI
|
|
14
14
|
Act, NIST AI RMF, CMMC, SR 11-7. Cross-language parity with Python and TypeScript
|
|
@@ -53,5 +53,5 @@ rubygems_version: 3.4.20
|
|
|
53
53
|
signing_key:
|
|
54
54
|
specification_version: 4
|
|
55
55
|
summary: 'SWT3 AI Witness SDK: cryptographic attestation for AI inference and infrastructure
|
|
56
|
-
governance.
|
|
56
|
+
governance. 280 procedures, 9 namespaces, 10 languages, 77 frameworks.'
|
|
57
57
|
test_files: []
|