swt3-ai 0.7.0 → 0.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +20 -0
- metadata +3 -3
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: f796446c334f2e8d057bd6f0233a8c06e7e69fb4c1dfddc4fcc113922b1fecea
|
|
4
|
+
data.tar.gz: 6d4e9d4dddc88968b5eccc5727a9ea23e3229558737b1fa5aa24669294cb6166
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 915aa33a2e78e682c0a671f3740368b708e3c35a8f9793f9ce5c491d8e92f5117849b7e9edc27df6e979e9d449630519629594b920daf8e65c43981c2e0454a8
|
|
7
|
+
data.tar.gz: ac360e61a803cc6f32d539d6ede8de83a89be6180a720face17a04490a1df2f506764d5b53b4bb4dd95a497357592879d2a8d1cbbcb26ee384182fa530f6ed4f
|
data/README.md
CHANGED
|
@@ -11,6 +11,26 @@ Built for platform engineers who need to bolt compliance witnessing onto product
|
|
|
11
11
|
|
|
12
12
|
EU AI Act GPAI transparency obligations enforced since **August 2, 2026**. High-risk enforcement follows **December 2, 2027**. This SDK gives you the cryptographic primitives for both.
|
|
13
13
|
|
|
14
|
+
## What's New in v0.7.1
|
|
15
|
+
|
|
16
|
+
MCP security is under fire. OWASP published the MCP Top 10 in 2026 -- 30-82% of MCP servers are vulnerable to tool poisoning, insufficient authentication, and shadow server proliferation. v0.7.1 adds three new procedures (AI-MCP.2, AI-MCP.3, AI-MCP.4) that close the remaining OWASP gaps. SWT3 is now the first protocol to cover all 10 OWASP MCP risks with cryptographic evidence. Every new anchor type verifies with the existing `Swt3Ai::Fingerprint.mint_fingerprint` method -- no gem update required.
|
|
17
|
+
|
|
18
|
+
**Why this matters for Ruby:** Rails dashboards displaying compliance posture and Sidekiq workers processing witness data will encounter the new MCP security anchors (tool integrity, server auth, server discovery) as your Python and TypeScript pipelines adopt them. The anchors are structurally identical to inference anchors -- same `mint_fingerprint` verification, same `WitnessPayload` structure. Your Ruby reporting layer can surface MCP security findings (schema drift detected, unauthenticated server, shadow server) without any gem changes.
|
|
19
|
+
|
|
20
|
+
### 3 New Procedures
|
|
21
|
+
|
|
22
|
+
- **AI-MCP.2** (Tool Integrity Attestation): Detects tool schema drift between connect and invoke. OWASP MCP-03.
|
|
23
|
+
- **AI-MCP.3** (Server Auth Attestation): Records auth method and verification. No auth = FAIL = IA-9 finding. OWASP MCP-07.
|
|
24
|
+
- **AI-MCP.4** (Server Discovery Attestation): Shadow server detection via allowlist check. OWASP MCP-09.
|
|
25
|
+
|
|
26
|
+
### Updated Coverage
|
|
27
|
+
|
|
28
|
+
- 275 procedures across 77 namespaces (was 266/75)
|
|
29
|
+
- 63 MCP tools (was 59)
|
|
30
|
+
- 10 SDK languages with byte-identical output
|
|
31
|
+
- 77 framework crosswalks, 250 compliance guides
|
|
32
|
+
- ~2,950 tests passing across 5 languages
|
|
33
|
+
|
|
14
34
|
## What's New in v0.7.0
|
|
15
35
|
|
|
16
36
|
AI does not run in a vacuum. It authenticates with service accounts, runs on hardware with supply chains, and consumes enough electricity to reshape power grids. v0.7.0 extends SWT3 down the full AI infrastructure stack with 22 new procedures across three families: credential governance (NHI), hardware supply chains (HBOM/DPP), and energy management (ADR). Every new anchor type verifies with the existing `Swt3Ai::Fingerprint.mint_fingerprint` method -- no gem update required.
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: swt3-ai
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.7.
|
|
4
|
+
version: 0.7.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- TeNova Labs
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2026-09-
|
|
11
|
+
date: 2026-09-08 00:00:00.000000000 Z
|
|
12
12
|
dependencies: []
|
|
13
13
|
description: Mint, verify, and sign SWT3 witness anchors for AI compliance. EU AI
|
|
14
14
|
Act, NIST AI RMF, CMMC, SR 11-7. Cross-language parity with Python and TypeScript
|
|
@@ -53,5 +53,5 @@ rubygems_version: 3.4.20
|
|
|
53
53
|
signing_key:
|
|
54
54
|
specification_version: 4
|
|
55
55
|
summary: 'SWT3 AI Witness SDK: cryptographic attestation for AI inference and infrastructure
|
|
56
|
-
governance.
|
|
56
|
+
governance. 275 procedures, 9 namespaces, 10 languages, 77 frameworks.'
|
|
57
57
|
test_files: []
|