agent-firewall-security 2.2.0__tar.gz → 2.3.0__tar.gz

{agent_firewall_security-2.2.0 → agent_firewall_security-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-firewall-security
-Version: 2.2.0
+Version: 2.3.0
 Summary: Security and canonical authorization infrastructure for AI agents and automated tool use.
 Project-URL: Homepage, https://github.com/Shubhbhangoo/agent-firewall
 Project-URL: Repository, https://github.com/Shubhbhangoo/agent-firewall
@@ -28,6 +28,8 @@ Requires-Dist: hypothesis>=6.0; extra == "dev"
 
 Agent Firewall is built around one security boundary: **authorization remains deterministic, explicit, and fail-closed**. Identity, provenance, monitoring, behavioral analysis, simulation, evidence, and response provide security context around that boundary, but they do not become an alternative path to authorization.
 
+> **v2.3** is a correctness release. It adds no subsystem and no authorization path: the work was to attack v2.2's shipped behaviour, fix the three fail-open paths that broke, stop analytical output from reading as verified when it was not, and make the strict invariant gate something CI can actually fail on.
+>
 > **v2.2** makes the control plane adaptive: authority is re-evaluated when the state it rested on changes, contradictions between independent claim sources are reported rather than resolved, and the architectural properties the design rests on are checked by code instead of asserted in prose.
 
 ---
@@ -90,6 +92,76 @@ When required evidence is unavailable, verification fails, identity is unknown,
 
 ---
 
+## What v2.3 changes
+
+v2.3 adds no subsystem. Three requests that v2.2 allowed are now denied,
+each found by attacking the shipped implementation rather than by reviewing
+the design.
+
+### Three fail-open paths closed
+
+- **A non-finite request value satisfied every numeric bound.** Numeric
+  constraints are enforced by negation — admit unless `actual > expected` —
+  and `NaN` compares `False` against everything, so `{"amount": NaN}` passed
+  an `amount_max` of 100 and an `amount_min` of 10 at the same time.
+  `json.loads` accepts the bare tokens `NaN`, `Infinity` and `-Infinity`, so
+  the value arrived through ordinary request bodies and tool output. Now
+  `constraint_denied`.
+- **The first decision taken while a configured dependency was blind
+  reported as `authorized`.** v2.2 gated all three revalidation paths but
+  not the initial decision, so a capability was allowed once and denied by
+  every revalidation of the same request. Now
+  `security_dependency_unavailable: <names>`, applied at the boundary — the
+  engine still returns a `(bool, reason)` pair and mints no verdict.
+- **Reconfiguring a delegation budget reset the consumed total.** An
+  exhausted lineage's whole allowance was restored by an administrative call
+  that revoked, re-issued and signed nothing — and the idempotent case was
+  the dangerous one, since a startup path re-applying the same limit cleared
+  the ledger on every restart. `configure` now adjusts the ceiling and
+  leaves the ledger alone.
+
+All three share one shape: **an admission must be positively established,
+not inferred from the absence of a violation.** See
+[`docs/v2.3-security-corrections.md`](docs/v2.3-security-corrections.md).
+
+### The self-attack suite
+
+`tests/test_v2_3_self_attack.py` is 116 tests, one section per question in
+the mission's final self-attack list, each attempting the attack through the
+real public API. Two rules govern the file: attack through the front door,
+and where the system makes no guarantee, pin the non-guarantee instead of
+faking one. A completeness test maps each of the thirteen questions to its
+section, so deleting one fails rather than quietly shrinking the suite. See
+[`docs/v2.3-self-attack.md`](docs/v2.3-self-attack.md).
+
+### A strict invariant gate that can pass
+
+`python -m firewall.invariants --strict` exited 2 on every invocation,
+because five of the eleven invariants are claims about live state that a
+source-only run never reaches. A gate that always fails is a gate that gets
+removed, so those five were effectively ungated in CI.
+`firewall/invariants/exercise.py` builds the canonical estate through the
+SDK's public API only, and CI now runs the source-only and exercised gates
+as separate steps. What a green exercised run establishes is bounded to that
+estate, and the printed output says so. See
+[`docs/v2.3-invariant-gate.md`](docs/v2.3-invariant-gate.md).
+
+### One name, one guarantee
+
+Three renames separate a cryptographic result from an analytical one that
+shared its name — `deception.ClaimIntegrityReport`,
+`security_memory.EvidenceCheckpoint`, and
+`AgentSecurityProfile.finding_score`. The third mattered most:
+`MeshState.trust_score` is 0.0 when identity could not be verified, while
+the profile's was 1.0 until something was found, so wiring the profile into
+the mesh's `trust_provider` would have delivered an unchecked agent as fully
+trusted. `firewall.correlation` is deleted; coordination detection moved to
+`firewall.intel`, where every finding carries supporting facts, a rationale
+and `basis="inferred"`. See
+[`docs/v2.3-migration.md`](docs/v2.3-migration.md).
+
+---
+
 ## What v2.2 adds
 
 ### Continuous authorization
@@ -358,7 +430,9 @@ The architecture is designed around explicit security invariants.
 - **A check that could not run is not a check that passed.**
 - **Security failures default toward refusal rather than implicit trust.**
 
-These are implementation properties of the system, not a claim that any deployment is universally secure. Eleven such properties are additionally stated once in `firewall.invariants` and checked by code rather than asserted in prose alone; see [`docs/v2.2-invariants.md`](docs/v2.2-invariants.md).
+These are implementation properties of the system, not a claim that any deployment is universally secure. Eleven such properties are additionally stated once in `firewall.invariants` and checked by code rather than asserted in prose alone; see [`docs/v2.2-invariants.md`](docs/v2.2-invariants.md) for the invariants themselves and [`docs/v2.3-invariant-gate.md`](docs/v2.3-invariant-gate.md) for what a green gate run does and does not establish.
+
+Where a property does **not** hold, it is stated rather than left to be inferred. A posture change is detected but does not by itself flip a verdict; `retire_key` is not containment for a stolen key, since a retired key's signatures keep verifying so that rotation does not invalidate capabilities in flight; an `amount_max` ceiling is per request, so two siblings each holding one can spend it twice unless a lineage budget is configured; and possession of a trusted signing key is authority, which no cryptography can undo. [`docs/v2.3-self-attack.md`](docs/v2.3-self-attack.md) records each of these against the test that pins it.
 
 ---
 
@@ -394,7 +468,7 @@ Verification distinguishes states including `verified`, `failed`, `unverifiable`
 Python 3.10+ is required.
 
 ```bash
-pip install agent-firewall-security==2.2.0
+pip install agent-firewall-security==2.3.0
 ```
 
 Development installation:
@@ -442,6 +516,11 @@ The authorization path evaluates the security conditions required by the capabil
 
 ## Command surface
 
+v2.3 adds no new CLI subcommands. It adds one flag to the invariant
+checker: `python -m firewall.invariants --exercise --strict` builds the
+canonical estate so that all eleven invariants can be reached, which makes
+`--strict` a gate that can pass and is therefore worth failing.
+
 v2.2 adds no new CLI subcommands. Its one new entry point is the invariant
 checker, `python -m firewall.invariants`, shown above.
 
@@ -492,6 +571,21 @@ python -m firewall.benchmarks
 
 The repository contains unit, integration, adversarial, hardening, evidence, UI/API, benchmark, and research tests.
 
+The v2.3 test surface adds the thirteen-question self-attack suite, which
+covers, among other properties:
+
+- a non-finite request value satisfying no numeric ceiling or floor
+- the first decision under a blind dependency being withheld, and agreeing
+  with its own revalidations
+- a delegation budget's consumed total surviving reconfiguration
+- erasing or re-pointing the delegation registry failing closed against the
+  child's own signature
+- naming an issuer as trusted not importing its keys
+- `revoke_issuer` containing a compromised signer where `retire_key` does not
+- no gate in the firewall reading the untrusted-data taint marker, because a
+  type and a signature are the barrier rather than a filter
+- the degradation subtraction being unable to turn a denial into an allow
+
 The v2.2 test surface covers, among other properties:
 
 - capability attenuation
@@ -603,6 +697,10 @@ See [`SECURITY.md`](SECURITY.md) for the project's security reporting policy.
 
 Detailed specifications are maintained in the repository:
 
+- `docs/v2.3-security-corrections.md`
+- `docs/v2.3-self-attack.md`
+- `docs/v2.3-invariant-gate.md`
+- `docs/v2.3-migration.md`
 - `docs/v2.2-architecture.md`
 - `docs/v2.2-security-model.md`
 - `docs/v2.2-threat-model.md`

{agent_firewall_security-2.2.0 → agent_firewall_security-2.3.0}/README.md

@@ -4,6 +4,8 @@
 
 Agent Firewall is built around one security boundary: **authorization remains deterministic, explicit, and fail-closed**. Identity, provenance, monitoring, behavioral analysis, simulation, evidence, and response provide security context around that boundary, but they do not become an alternative path to authorization.
 
+> **v2.3** is a correctness release. It adds no subsystem and no authorization path: the work was to attack v2.2's shipped behaviour, fix the three fail-open paths that broke, stop analytical output from reading as verified when it was not, and make the strict invariant gate something CI can actually fail on.
+>
 > **v2.2** makes the control plane adaptive: authority is re-evaluated when the state it rested on changes, contradictions between independent claim sources are reported rather than resolved, and the architectural properties the design rests on are checked by code instead of asserted in prose.
 
 ---
@@ -66,6 +68,76 @@ When required evidence is unavailable, verification fails, identity is unknown,
 
 ---
 
+## What v2.3 changes
+
+v2.3 adds no subsystem. Three requests that v2.2 allowed are now denied,
+each found by attacking the shipped implementation rather than by reviewing
+the design.
+
+### Three fail-open paths closed
+
+- **A non-finite request value satisfied every numeric bound.** Numeric
+  constraints are enforced by negation — admit unless `actual > expected` —
+  and `NaN` compares `False` against everything, so `{"amount": NaN}` passed
+  an `amount_max` of 100 and an `amount_min` of 10 at the same time.
+  `json.loads` accepts the bare tokens `NaN`, `Infinity` and `-Infinity`, so
+  the value arrived through ordinary request bodies and tool output. Now
+  `constraint_denied`.
+- **The first decision taken while a configured dependency was blind
+  reported as `authorized`.** v2.2 gated all three revalidation paths but
+  not the initial decision, so a capability was allowed once and denied by
+  every revalidation of the same request. Now
+  `security_dependency_unavailable: <names>`, applied at the boundary — the
+  engine still returns a `(bool, reason)` pair and mints no verdict.
+- **Reconfiguring a delegation budget reset the consumed total.** An
+  exhausted lineage's whole allowance was restored by an administrative call
+  that revoked, re-issued and signed nothing — and the idempotent case was
+  the dangerous one, since a startup path re-applying the same limit cleared
+  the ledger on every restart. `configure` now adjusts the ceiling and
+  leaves the ledger alone.
+
+All three share one shape: **an admission must be positively established,
+not inferred from the absence of a violation.** See
+[`docs/v2.3-security-corrections.md`](docs/v2.3-security-corrections.md).
+
+### The self-attack suite
+
+`tests/test_v2_3_self_attack.py` is 116 tests, one section per question in
+the mission's final self-attack list, each attempting the attack through the
+real public API. Two rules govern the file: attack through the front door,
+and where the system makes no guarantee, pin the non-guarantee instead of
+faking one. A completeness test maps each of the thirteen questions to its
+section, so deleting one fails rather than quietly shrinking the suite. See
+[`docs/v2.3-self-attack.md`](docs/v2.3-self-attack.md).
+
+### A strict invariant gate that can pass
+
+`python -m firewall.invariants --strict` exited 2 on every invocation,
+because five of the eleven invariants are claims about live state that a
+source-only run never reaches. A gate that always fails is a gate that gets
+removed, so those five were effectively ungated in CI.
+`firewall/invariants/exercise.py` builds the canonical estate through the
+SDK's public API only, and CI now runs the source-only and exercised gates
+as separate steps. What a green exercised run establishes is bounded to that
+estate, and the printed output says so. See
+[`docs/v2.3-invariant-gate.md`](docs/v2.3-invariant-gate.md).
+
+### One name, one guarantee
+
+Three renames separate a cryptographic result from an analytical one that
+shared its name — `deception.ClaimIntegrityReport`,
+`security_memory.EvidenceCheckpoint`, and
+`AgentSecurityProfile.finding_score`. The third mattered most:
+`MeshState.trust_score` is 0.0 when identity could not be verified, while
+the profile's was 1.0 until something was found, so wiring the profile into
+the mesh's `trust_provider` would have delivered an unchecked agent as fully
+trusted. `firewall.correlation` is deleted; coordination detection moved to
+`firewall.intel`, where every finding carries supporting facts, a rationale
+and `basis="inferred"`. See
+[`docs/v2.3-migration.md`](docs/v2.3-migration.md).
+
+---
+
 ## What v2.2 adds
 
 ### Continuous authorization
@@ -334,7 +406,9 @@ The architecture is designed around explicit security invariants.
 - **A check that could not run is not a check that passed.**
 - **Security failures default toward refusal rather than implicit trust.**
 
-These are implementation properties of the system, not a claim that any deployment is universally secure. Eleven such properties are additionally stated once in `firewall.invariants` and checked by code rather than asserted in prose alone; see [`docs/v2.2-invariants.md`](docs/v2.2-invariants.md).
+These are implementation properties of the system, not a claim that any deployment is universally secure. Eleven such properties are additionally stated once in `firewall.invariants` and checked by code rather than asserted in prose alone; see [`docs/v2.2-invariants.md`](docs/v2.2-invariants.md) for the invariants themselves and [`docs/v2.3-invariant-gate.md`](docs/v2.3-invariant-gate.md) for what a green gate run does and does not establish.
+
+Where a property does **not** hold, it is stated rather than left to be inferred. A posture change is detected but does not by itself flip a verdict; `retire_key` is not containment for a stolen key, since a retired key's signatures keep verifying so that rotation does not invalidate capabilities in flight; an `amount_max` ceiling is per request, so two siblings each holding one can spend it twice unless a lineage budget is configured; and possession of a trusted signing key is authority, which no cryptography can undo. [`docs/v2.3-self-attack.md`](docs/v2.3-self-attack.md) records each of these against the test that pins it.
 
 ---
 
@@ -370,7 +444,7 @@ Verification distinguishes states including `verified`, `failed`, `unverifiable`
 Python 3.10+ is required.
 
 ```bash
-pip install agent-firewall-security==2.2.0
+pip install agent-firewall-security==2.3.0
 ```
 
 Development installation:
@@ -418,6 +492,11 @@ The authorization path evaluates the security conditions required by the capabil
 
 ## Command surface
 
+v2.3 adds no new CLI subcommands. It adds one flag to the invariant
+checker: `python -m firewall.invariants --exercise --strict` builds the
+canonical estate so that all eleven invariants can be reached, which makes
+`--strict` a gate that can pass and is therefore worth failing.
+
 v2.2 adds no new CLI subcommands. Its one new entry point is the invariant
 checker, `python -m firewall.invariants`, shown above.
 
@@ -468,6 +547,21 @@ python -m firewall.benchmarks
 
 The repository contains unit, integration, adversarial, hardening, evidence, UI/API, benchmark, and research tests.
 
+The v2.3 test surface adds the thirteen-question self-attack suite, which
+covers, among other properties:
+
+- a non-finite request value satisfying no numeric ceiling or floor
+- the first decision under a blind dependency being withheld, and agreeing
+  with its own revalidations
+- a delegation budget's consumed total surviving reconfiguration
+- erasing or re-pointing the delegation registry failing closed against the
+  child's own signature
+- naming an issuer as trusted not importing its keys
+- `revoke_issuer` containing a compromised signer where `retire_key` does not
+- no gate in the firewall reading the untrusted-data taint marker, because a
+  type and a signature are the barrier rather than a filter
+- the degradation subtraction being unable to turn a denial into an allow
+
 The v2.2 test surface covers, among other properties:
 
 - capability attenuation
@@ -579,6 +673,10 @@ See [`SECURITY.md`](SECURITY.md) for the project's security reporting policy.
 
 Detailed specifications are maintained in the repository:
 
+- `docs/v2.3-security-corrections.md`
+- `docs/v2.3-self-attack.md`
+- `docs/v2.3-invariant-gate.md`
+- `docs/v2.3-migration.md`
 - `docs/v2.2-architecture.md`
 - `docs/v2.2-security-model.md`
 - `docs/v2.2-threat-model.md`

{agent_firewall_security-2.2.0 → agent_firewall_security-2.3.0}/agent_firewall_security.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-firewall-security
-Version: 2.2.0
+Version: 2.3.0
 Summary: Security and canonical authorization infrastructure for AI agents and automated tool use.
 Project-URL: Homepage, https://github.com/Shubhbhangoo/agent-firewall
 Project-URL: Repository, https://github.com/Shubhbhangoo/agent-firewall
@@ -28,6 +28,8 @@ Requires-Dist: hypothesis>=6.0; extra == "dev"
 
 Agent Firewall is built around one security boundary: **authorization remains deterministic, explicit, and fail-closed**. Identity, provenance, monitoring, behavioral analysis, simulation, evidence, and response provide security context around that boundary, but they do not become an alternative path to authorization.
 
+> **v2.3** is a correctness release. It adds no subsystem and no authorization path: the work was to attack v2.2's shipped behaviour, fix the three fail-open paths that broke, stop analytical output from reading as verified when it was not, and make the strict invariant gate something CI can actually fail on.
+>
 > **v2.2** makes the control plane adaptive: authority is re-evaluated when the state it rested on changes, contradictions between independent claim sources are reported rather than resolved, and the architectural properties the design rests on are checked by code instead of asserted in prose.
 
 ---
@@ -90,6 +92,76 @@ When required evidence is unavailable, verification fails, identity is unknown,
 
 ---
 
+## What v2.3 changes
+
+v2.3 adds no subsystem. Three requests that v2.2 allowed are now denied,
+each found by attacking the shipped implementation rather than by reviewing
+the design.
+
+### Three fail-open paths closed
+
+- **A non-finite request value satisfied every numeric bound.** Numeric
+  constraints are enforced by negation — admit unless `actual > expected` —
+  and `NaN` compares `False` against everything, so `{"amount": NaN}` passed
+  an `amount_max` of 100 and an `amount_min` of 10 at the same time.
+  `json.loads` accepts the bare tokens `NaN`, `Infinity` and `-Infinity`, so
+  the value arrived through ordinary request bodies and tool output. Now
+  `constraint_denied`.
+- **The first decision taken while a configured dependency was blind
+  reported as `authorized`.** v2.2 gated all three revalidation paths but
+  not the initial decision, so a capability was allowed once and denied by
+  every revalidation of the same request. Now
+  `security_dependency_unavailable: <names>`, applied at the boundary — the
+  engine still returns a `(bool, reason)` pair and mints no verdict.
+- **Reconfiguring a delegation budget reset the consumed total.** An
+  exhausted lineage's whole allowance was restored by an administrative call
+  that revoked, re-issued and signed nothing — and the idempotent case was
+  the dangerous one, since a startup path re-applying the same limit cleared
+  the ledger on every restart. `configure` now adjusts the ceiling and
+  leaves the ledger alone.
+
+All three share one shape: **an admission must be positively established,
+not inferred from the absence of a violation.** See
+[`docs/v2.3-security-corrections.md`](docs/v2.3-security-corrections.md).
+
+### The self-attack suite
+
+`tests/test_v2_3_self_attack.py` is 116 tests, one section per question in
+the mission's final self-attack list, each attempting the attack through the
+real public API. Two rules govern the file: attack through the front door,
+and where the system makes no guarantee, pin the non-guarantee instead of
+faking one. A completeness test maps each of the thirteen questions to its
+section, so deleting one fails rather than quietly shrinking the suite. See
+[`docs/v2.3-self-attack.md`](docs/v2.3-self-attack.md).
+
+### A strict invariant gate that can pass
+
+`python -m firewall.invariants --strict` exited 2 on every invocation,
+because five of the eleven invariants are claims about live state that a
+source-only run never reaches. A gate that always fails is a gate that gets
+removed, so those five were effectively ungated in CI.
+`firewall/invariants/exercise.py` builds the canonical estate through the
+SDK's public API only, and CI now runs the source-only and exercised gates
+as separate steps. What a green exercised run establishes is bounded to that
+estate, and the printed output says so. See
+[`docs/v2.3-invariant-gate.md`](docs/v2.3-invariant-gate.md).
+
+### One name, one guarantee
+
+Three renames separate a cryptographic result from an analytical one that
+shared its name — `deception.ClaimIntegrityReport`,
+`security_memory.EvidenceCheckpoint`, and
+`AgentSecurityProfile.finding_score`. The third mattered most:
+`MeshState.trust_score` is 0.0 when identity could not be verified, while
+the profile's was 1.0 until something was found, so wiring the profile into
+the mesh's `trust_provider` would have delivered an unchecked agent as fully
+trusted. `firewall.correlation` is deleted; coordination detection moved to
+`firewall.intel`, where every finding carries supporting facts, a rationale
+and `basis="inferred"`. See
+[`docs/v2.3-migration.md`](docs/v2.3-migration.md).
+
+---
+
 ## What v2.2 adds
 
 ### Continuous authorization
@@ -358,7 +430,9 @@ The architecture is designed around explicit security invariants.
 - **A check that could not run is not a check that passed.**
 - **Security failures default toward refusal rather than implicit trust.**
 
-These are implementation properties of the system, not a claim that any deployment is universally secure. Eleven such properties are additionally stated once in `firewall.invariants` and checked by code rather than asserted in prose alone; see [`docs/v2.2-invariants.md`](docs/v2.2-invariants.md).
+These are implementation properties of the system, not a claim that any deployment is universally secure. Eleven such properties are additionally stated once in `firewall.invariants` and checked by code rather than asserted in prose alone; see [`docs/v2.2-invariants.md`](docs/v2.2-invariants.md) for the invariants themselves and [`docs/v2.3-invariant-gate.md`](docs/v2.3-invariant-gate.md) for what a green gate run does and does not establish.
+
+Where a property does **not** hold, it is stated rather than left to be inferred. A posture change is detected but does not by itself flip a verdict; `retire_key` is not containment for a stolen key, since a retired key's signatures keep verifying so that rotation does not invalidate capabilities in flight; an `amount_max` ceiling is per request, so two siblings each holding one can spend it twice unless a lineage budget is configured; and possession of a trusted signing key is authority, which no cryptography can undo. [`docs/v2.3-self-attack.md`](docs/v2.3-self-attack.md) records each of these against the test that pins it.
 
 ---
 
@@ -394,7 +468,7 @@ Verification distinguishes states including `verified`, `failed`, `unverifiable`
 Python 3.10+ is required.
 
 ```bash
-pip install agent-firewall-security==2.2.0
+pip install agent-firewall-security==2.3.0
 ```
 
 Development installation:
@@ -442,6 +516,11 @@ The authorization path evaluates the security conditions required by the capabil
 
 ## Command surface
 
+v2.3 adds no new CLI subcommands. It adds one flag to the invariant
+checker: `python -m firewall.invariants --exercise --strict` builds the
+canonical estate so that all eleven invariants can be reached, which makes
+`--strict` a gate that can pass and is therefore worth failing.
+
 v2.2 adds no new CLI subcommands. Its one new entry point is the invariant
 checker, `python -m firewall.invariants`, shown above.
 
@@ -492,6 +571,21 @@ python -m firewall.benchmarks
 
 The repository contains unit, integration, adversarial, hardening, evidence, UI/API, benchmark, and research tests.
 
+The v2.3 test surface adds the thirteen-question self-attack suite, which
+covers, among other properties:
+
+- a non-finite request value satisfying no numeric ceiling or floor
+- the first decision under a blind dependency being withheld, and agreeing
+  with its own revalidations
+- a delegation budget's consumed total surviving reconfiguration
+- erasing or re-pointing the delegation registry failing closed against the
+  child's own signature
+- naming an issuer as trusted not importing its keys
+- `revoke_issuer` containing a compromised signer where `retire_key` does not
+- no gate in the firewall reading the untrusted-data taint marker, because a
+  type and a signature are the barrier rather than a filter
+- the degradation subtraction being unable to turn a denial into an allow
+
 The v2.2 test surface covers, among other properties:
 
 - capability attenuation
@@ -603,6 +697,10 @@ See [`SECURITY.md`](SECURITY.md) for the project's security reporting policy.
 
 Detailed specifications are maintained in the repository:
 
+- `docs/v2.3-security-corrections.md`
+- `docs/v2.3-self-attack.md`
+- `docs/v2.3-invariant-gate.md`
+- `docs/v2.3-migration.md`
 - `docs/v2.2-architecture.md`
 - `docs/v2.2-security-model.md`
 - `docs/v2.2-threat-model.md`

{agent_firewall_security-2.2.0 → agent_firewall_security-2.3.0}/agent_firewall_security.egg-info/SOURCES.txt

@@ -71,7 +71,6 @@ firewall/continuous_auth/__init__.py
 firewall/continuous_auth/engine.py
 firewall/continuous_auth/monitor.py
 firewall/continuous_auth/predicates.py
-firewall/correlation/__init__.py
 firewall/deception/__init__.py
 firewall/defense/__init__.py
 firewall/defense/mesh.py
@@ -88,6 +87,7 @@ firewall/intel/__init__.py
 firewall/intel/engine.py
 firewall/invariants/__init__.py
 firewall/invariants/__main__.py
+firewall/invariants/exercise.py
 firewall/invariants/model.py
 firewall/invariants/registry.py
 firewall/invariants/runtime.py
@@ -181,4 +181,9 @@ tests/test_v2_2_deception_integrity.py
 tests/test_v2_2_evidence_integrity.py
 tests/test_v2_2_invariants.py
 tests/test_v2_2_platform_provenance.py
-tests/test_v2_2_security_memory.py
+tests/test_v2_2_security_memory.py
+tests/test_v2_3_duplicate_concepts.py
+tests/test_v2_3_intel_coordination.py
+tests/test_v2_3_invariant_gate.py
+tests/test_v2_3_policy_analysis.py
+tests/test_v2_3_self_attack.py

{agent_firewall_security-2.2.0 → agent_firewall_security-2.3.0}/firewall/adversarial/__init__.py

@@ -43,12 +43,12 @@ Every check that raises produces a ``DiscrepancyType.UNKNOWN`` signal at
 ``unknown`` provenance plus a gap naming the check. The previous version
 wrapped six of these in ``except Exception: pass``, so a registry that
 threw produced a profile that looked exactly like a clean one: no
-signals, an empty capability list, ``trust_score`` 1.0 and
+signals, an empty capability list, ``finding_score`` 1.0 and
 ``risk_level`` ``"low"``.
 
 Risk is triage, not authority
 -----------------------------
-:attr:`AgentSecurityProfile.trust_score` and
+:attr:`AgentSecurityProfile.finding_score` and
 :attr:`AgentSecurityProfile.risk_level` order findings for a human or a
 containment operator. They are **not** an authorization input.
 ``FirewallSDK.authorize`` does not read them, and nothing in this module
@@ -164,10 +164,10 @@ class DiscrepancyType(str, Enum):
 #: PROVENANCE_INTEGRITY in :mod:`firewall.invariants` reports any such
 #: duplicate.
 #:
-#: It is an alias rather than a deletion because ``firewall.correlation``
-#: and ``firewall.deception`` import ``ProvenanceLevel`` from here, and
-#: the point of the change is to collapse the two definitions onto one
-#: object, not to rename anything. ``ProvenanceLevel is Provenance`` now
+#: It is an alias rather than a deletion because ``firewall.deception``
+#: imports ``ProvenanceLevel`` from here, and the point of the change is
+#: to collapse the two definitions onto one object, not to rename
+#: anything. ``ProvenanceLevel is Provenance`` now
 #: holds, so the algebra in :mod:`firewall.platform` -- ``combine``,
 #: ``coerce``, ``is_factual`` -- applies to these members directly.
 ProvenanceLevel = Provenance
@@ -280,8 +280,20 @@ class AgentSecurityProfile:
     ``gaps`` names every check that could not be performed, in words. A
     profile with gaps is never ``risk_level="low"``.
 
-    ``trust_score`` and ``risk_level`` are triage. Nothing authorizes on
+    ``finding_score`` and ``risk_level`` are triage. Nothing authorizes on
     them; ``FirewallSDK.authorize`` does not read this type.
+
+    ``finding_score`` was called ``trust_score`` until v2.3. It never
+    measured trust: it starts at 1.0 and is multiplied down once per
+    finding, so an agent nothing could be checked about keeps a score near
+    1.0 while ``risk_level`` reports ``"unknown"`` and ``gaps`` names what
+    was skipped. The old name collided with
+    :attr:`firewall.defense.mesh.MeshState.trust_score`, which is the
+    opposite convention -- a real trust score that is forced to 0.0 when
+    identity cannot be verified, and that the mesh compares against its
+    quarantine threshold. Feeding this field into that one would have
+    delivered an unchecked agent as fully trusted, which is why the two no
+    longer share a name.
     """
 
     agent_id: str
@@ -292,7 +304,7 @@ class AgentSecurityProfile:
     live_capabilities: tuple[str, ...] = ()
     delegation_depth: int = 0
     posture: str = "unknown"
-    trust_score: float = 1.0
+    finding_score: float = 1.0
     risk_level: str = "unknown"
     gaps: tuple[str, ...] = ()
     last_evaluated: float = 0.0
@@ -300,8 +312,8 @@ class AgentSecurityProfile:
     def __post_init__(self) -> None:
         if self.risk_level not in RISK_LEVELS:
             raise ValueError(f"unknown risk level: {self.risk_level!r}")
-        if not 0.0 <= float(self.trust_score) <= 1.0:
-            raise ValueError("trust_score must be within [0.0, 1.0]")
+        if not 0.0 <= float(self.finding_score) <= 1.0:
+            raise ValueError("finding_score must be within [0.0, 1.0]")
 
     @property
     def factual_signals(self) -> tuple[SecuritySignal, ...]:
@@ -319,7 +331,7 @@ class AgentSecurityProfile:
             "live_capabilities": list(self.live_capabilities),
             "delegation_depth": self.delegation_depth,
             "posture": self.posture,
-            "trust_score": self.trust_score,
+            "finding_score": self.finding_score,
             "risk_level": self.risk_level,
             "gaps": list(self.gaps),
             "last_evaluated": self.last_evaluated,
@@ -331,7 +343,7 @@ def assess_risk(
     *,
     gaps: tuple[str, ...] | list[str] = (),
 ) -> tuple[float, str]:
-    """Derive ``(trust_score, risk_level)`` from signals and gaps.
+    """Derive ``(finding_score, risk_level)`` from signals and gaps.
 
     A pure function so the derivation can be tested without building a
     control plane, and so there is one place where the ordering rules
@@ -342,8 +354,8 @@ def assess_risk(
     *Unknown is not trusted.* It weighted three discrepancy types and
     ignored the other fifteen, so an unknown identity, an untrusted
     issuer, an expired capability, a revoked delegation ancestor and a
-    task belonging to somebody else all left ``trust_score`` at 1.0 and
-    ``risk_level`` at ``"low"``. ``DELEGATION_WIDENING`` was one of the
+    task belonging to somebody else all left ``finding_score`` at 1.0
+    and ``risk_level`` at ``"low"``. ``DELEGATION_WIDENING`` was one of the
     three it did weight, and nothing emitted it.
 
     *A gap is not a pass.* ``risk_level`` is never ``"low"`` while any
@@ -406,7 +418,7 @@ def assess_risk(
     return score, level
 
 
-#: How far one factual finding moves ``trust_score``. Multiplicative, so
+#: How far one factual finding moves ``finding_score``. Multiplicative, so
 #: independent findings compound rather than saturating at the worst one.
 _SIGNAL_WEIGHTS: dict[DiscrepancyType, float] = {
     DiscrepancyType.IDENTITY_MISMATCH: 0.2,
@@ -551,7 +563,9 @@ class AdversarialAgentDefense:
         )
         gaps.extend(fact_gaps)
 
-        trust_score, risk_level = assess_risk(tuple(signals), gaps=tuple(gaps))
+        finding_score, risk_level = assess_risk(
+            tuple(signals), gaps=tuple(gaps)
+        )
 
         profile = AgentSecurityProfile(
             agent_id=agent_id,
@@ -562,7 +576,7 @@ class AdversarialAgentDefense:
             live_capabilities=facts["live_capabilities"],
             delegation_depth=facts["delegation_depth"],
             posture=facts["posture"],
-            trust_score=trust_score,
+            finding_score=finding_score,
             risk_level=risk_level,
             gaps=tuple(gaps),
             last_evaluated=timestamp,

{agent_firewall_security-2.2.0 → agent_firewall_security-2.3.0}/firewall/authorization.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import math
 from typing import Optional
 
 from firewall.capability import (
@@ -251,6 +252,21 @@ def _check_constraints(
             ):
                 return False
 
+            # A ceiling here is enforced by its negation: the request is
+            # admitted unless ``actual > expected``. NaN compares False
+            # against every bound, so ``nan > 100`` is False and a NaN
+            # request value would satisfy every ``_max`` ceiling -- and
+            # ``nan < 10`` is False too, so it would satisfy every
+            # ``_min`` floor. A value that cannot be ordered cannot be
+            # shown to be within the bound, and unknown is not trusted.
+            #
+            # ``json.loads`` accepts the bare tokens ``NaN``,
+            # ``Infinity`` and ``-Infinity`` by default, so this reaches
+            # the gate from any JSON request body or tool output without
+            # the caller doing anything unusual.
+            if not math.isfinite(actual):
+                return False
+
             if key.endswith(
                 "_max"
             ):