@atlasauth/pca-control-evals 0.1.0 → 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,45 +1,51 @@
 # @atlasauth/pca-control-evals
 
-An **empirical adversarial safety bound** for Proof-Carrying Authority, complementing PCA's analytic one.
+An empirical adversarial safety bound for Proof-Carrying Authority (PCA), complementing PCA's analytic one.
 
-PCA already proves an analytic bound: between two human co-signs, the total risk of machine-only actions
-is at most `bMax/κ` — no matter what the agent does, even if fully compromised (see `@atlasauth/pca`
-`safetyBound()` / `risk.ts`). That is a theorem about the *budget*. It does not tell you whether the
-controls actually catch a given adversarial strategy, or how much legitimate work they allow.
+PCA proves an analytic bound: between two human co-signs, the total risk of machine-only actions is at most `bMax/kappa`, whatever the agent does (see `safetyBound()` in `@atlasauth/pca`). That is a statement about the budget. It does not tell you whether the controls actually catch a given adversarial strategy, or how much legitimate work they allow. This package adds the empirical side as a red-team and blue-team control evaluation, following the AI Control methodology of Greenblatt, Shlegeris, Sachan and Roger ([arXiv:2312.06942](https://arxiv.org/abs/2312.06942)) and Korbak et al. ([arXiv:2501.17315](https://arxiv.org/abs/2501.17315)).
 
-This package adds the empirical side, as a **red-team / blue-team control evaluation**, following
-Redwood Research's *AI Control* methodology:
+A possibly-misaligned red agent emits a sequence of intended actions (slow-burn under the budget, an over-cap action, an off-policy verb, a high-taint exfiltration flow, a replay). The blue control protocol is PCA's real control surface: `reviewAction` (predicates, caveats, step-up tiers), the metered trust budget, DLP, and the behavioral immune system. It decides allow, step-up or deny for each action.
 
-- Greenblatt, Shlegeris, Sachan, Roger — **"AI Control: Improving Safety Despite Intentional Subversion"**, arXiv:2312.06942.
-- Korbak et al. — **"A sketch of an AI control safety case"**, arXiv:2501.17315.
+- safety: the fraction of episodes in which red could not cause an unacceptable outcome (a catastrophic action blue let through);
+- usefulness: the fraction of legitimate actions blue allowed.
 
-A possibly-misaligned **red** agent emits a sequence of intended actions (slow-burn under the budget, an
-over-cap action, an off-policy verb, a high-taint exfiltration flow, a replay). A **blue** control
-protocol — which here *is* PCA's real control surface: `reviewAction`/`dryRun` (predicates + caveats +
-step-up tiers), the metered trust budget (`admit`/`cost`/`leak`), DLP (`evaluateDlp`), and the
-behavioral immune system (`observe`/`assess`/`adapt`) — decides allow / step-up / deny per action.
+## Install
 
-- **safety** = fraction of episodes in which red could NOT cause an unacceptable outcome (a catastrophic
-  action blue let through);
-- **usefulness** = fraction of legitimate actions blue allowed.
+```sh
+npm i @atlasauth/pca-control-evals
+```
+
+Depends on `@atlasauth/pca` (installed automatically).
+
+## Usage
 
 ```ts
 import { exampleControlEval } from '@atlasauth/pca-control-evals';
 
 const report = exampleControlEval(); // deterministic
-// { safety: 1, usefulness: 1, analyticBound: 1,
-//   catches: { predicate, caveat, dlp, budget, immune, replay },
+// { safety, usefulness, analyticBound, episodes,
+//   catches: { replay, predicate, caveat, dlp, budget, immune },
 //   byStrategy: { 'over-cap', 'off-verb', 'slow-burn', 'taint-exfil', 'replay', 'immune-probe', 'benign' } }
 ```
 
-Plug in your own `RedPolicy[]`, `BluePolicy`, and `Env`, then call `controlEval(reds, blue, env, { episodes, seed })`.
+Plug in your own suite with `controlEval(reds, blue, env, { episodes, seed })`:
+
+```ts
+import { controlEval, exampleBlue, exampleEnv, EXAMPLE_RED_POLICIES } from '@atlasauth/pca-control-evals';
+
+const report = controlEval(EXAMPLE_RED_POLICIES, exampleBlue(), exampleEnv, { episodes: 20, seed: 7 });
+```
+
+A `RedPolicy` is `{ name, strategy, gen({ env, rng, now }) => RedAction[] }`, a `BluePolicy` bundles the agent with optional DLP, immune and budget settings, and an `Env` decides which allowed actions count as unacceptable. Everything is deterministic given a seed.
 
 ## This is a harness, not a proof
 
-The number is an **empirical bound over a MODELED adversary and a MODELED environment**, and it is only
-ever as strong as the red policies and the environment you encode. A control protocol catches only the
-hazards its predicates / DLP classes / budget / immune signals actually represent — `gapAwareEnv` +
-`gapExploitRed` deliberately construct an in-policy, zero-taint, in-cap hazard no control encodes, and
-`safety` drops to 0 against it. Publishing a real guarantee needs a realistic environment and a
-realistic red suite. This **complements**, and does not replace, the analytic `Σrisk ≤ bMax/κ` bound:
-the two answer different questions. Everything is deterministic given a seed.
+The number is an empirical bound over a modeled adversary in a modeled environment, and it is only as strong as the red policies and environment you encode. A control protocol catches only the hazards its predicates, DLP classes, budget and immune signals actually represent. `gapAwareEnv` with `gapExploitRed` deliberately builds an in-policy, zero-taint, in-cap hazard that no control encodes, and `safety` drops to 0 against it. A real guarantee needs a realistic environment and a realistic red suite. This complements, and does not replace, the analytic `bMax/kappa` bound; the two answer different questions.
+
+Cryptography in PCA is unaudited.
+
+Source and issues: https://github.com/Atlas-Authorization/pca
+
+## License
+
+MIT - see LICENSE

package/package.json

@@ -1,7 +1,27 @@
 {
   "name": "@atlasauth/pca-control-evals",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Empirical adversarial control-evaluation harness for PCA: a seeded red-team/blue-team game (Redwood-style AI Control) that scores safety = P(a possibly-misaligned agent cannot cause an unacceptable outcome) + usefulness against PCA's verifier/budget/step-up/DLP/immune controls. Complements the analytic Σrisk ≤ bMax/κ bound.",
+  "keywords": [
+    "ai control",
+    "red team",
+    "evaluation",
+    "safety",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-control-evals"
+  },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -12,7 +32,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/pca": "0.1.0"
+    "@atlasauth/pca": "0.3.0"
   },
   "devDependencies": {
     "typescript": "^5.6.3",
@@ -20,8 +40,12 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
+  "engines": {
+    "node": ">=20"
+  },
   "publishConfig": {
     "access": "public"
   },