agentic-security-harness 1.0.0__tar.gz

agentic_security_harness-1.0.0/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

agentic_security_harness-1.0.0/NOTICE

@@ -0,0 +1,10 @@
+Agentic Security Harness
+Copyright 2026 krivonosoff161
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this project except in compliance with the License.
+A copy of the License is provided in the LICENSE file, or at
+http://www.apache.org/licenses/LICENSE-2.0
+
+The project name, logos, and branding are not granted as trademarks.
+Please preserve attribution when referencing the project or its corpus.

agentic_security_harness-1.0.0/PKG-INFO

@@ -0,0 +1,286 @@
+Metadata-Version: 2.4
+Name: agentic-security-harness
+Version: 1.0.0
+Summary: Open-source defensive harness and learning lab for reproducing and measuring agentic AI failure modes with portable traces, attack graphs, scorecards, and data-boundary tests.
+Author: Dmitry Krivonosov
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/krivonosoff161/agentic-security-harness
+Project-URL: Repository, https://github.com/krivonosoff161/agentic-security-harness
+Project-URL: Issues, https://github.com/krivonosoff161/agentic-security-harness/issues
+Project-URL: Changelog, https://github.com/krivonosoff161/agentic-security-harness/blob/main/CHANGELOG.md
+Keywords: ai-security,agentic-ai,benchmark,llm-security,prompt-injection,red-team
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Requires-Dist: pydantic<3,>=2
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: ruff>=0.5; extra == "dev"
+Requires-Dist: mypy>=1.8; extra == "dev"
+Dynamic: license-file
+
+# Agentic Security Harness
+
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13320/badge)](https://www.bestpractices.dev/projects/13320)
+[![CI](https://github.com/krivonosoff161/agentic-security-harness/actions/workflows/ci.yml/badge.svg)](https://github.com/krivonosoff161/agentic-security-harness/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/krivonosoff161/agentic-security-harness/actions/workflows/codeql.yml/badge.svg)](https://github.com/krivonosoff161/agentic-security-harness/actions/workflows/codeql.yml)
+![Python](https://img.shields.io/badge/python-3.11%2B-blue)
+![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![Status](https://img.shields.io/badge/status-v1.0--ready-blue)
+
+**Your AI coding agent reads untrusted repository text. Can it keep data separate from
+instructions and authority?**
+
+Agentic Security Harness is a local, trace-first benchmark for defensive testing of
+agentic AI boundary failures. It runs reproducible synthetic scenarios, records portable
+traces and scorecards, and compares a deliberately vulnerable local agent with a protected
+one.
+
+In plain English: it turns “the agent behaved unsafely” into evidence you can replay,
+validate, compare, and review.
+
+## Quickstart
+
+Install the current source checkout:
+
+```bash
+git clone https://github.com/krivonosoff161/agentic-security-harness.git
+cd agentic-security-harness
+python -m pip install .
+ash quickstart --out reports/quickstart
+```
+
+After the separately gated PyPI publication, the primary install command becomes:
+
+```bash
+python -m pip install agentic-security-harness
+```
+
+`ash quickstart` is local and no-network. It runs the same stable 24-pattern corpus against
+both demo targets, validates the generated artifacts, and renders a self-contained HTML
+report.
+
+| Target | Modeled findings | Patterns passed |
+|---|---:|---:|
+| `demo-agent` | 24 | 0 |
+| `protected-demo-agent` | 0 | 24 |
+
+The deterministic result is **24 modeled findings** for the vulnerable fixture and
+**0 modeled findings** for the protected fixture. This is synthetic conformance evidence,
+not a production safety claim.
+
+![Terminal comparison showing 24 findings reduced to 0](docs/images/terminal-compare.png)
+
+![Rendered comparison report table](docs/images/comparison-table.png)
+
+Inspect the committed before/after example in
+[`examples/comparison-report/`](examples/comparison-report/) or validate every public
+example locally:
+
+```bash
+ash validate examples/
+ash validate docs/evidence-status-registry.json
+```
+
+## What this is / is not
+
+| This project is | This project is not |
+|---|---|
+| A reproducible benchmark for agent operating-environment boundaries. | A production safety certification. |
+| A synthetic and authorized defensive testing lab. | A live exploitation or persistence toolkit. |
+| A way to compare vulnerable and protected targets using portable artifacts. | Proof that a provider, model, or deployed agent is secure. |
+| A stable trace/corpus contract with machine-readable validation. | A model leaderboard or CVE database. |
+
+The benchmark focuses on agent operating-environment boundaries, not just standalone model answers.
+Built-in targets are deterministic and offline. The experimental external adapter
+is explicit opt-in, prompt-only, and does not execute tools. See
+[`docs/benchmark-semantics.md`](docs/benchmark-semantics.md) and
+[`docs/authorized-testing-paths.md`](docs/authorized-testing-paths.md).
+
+## Visual evidence snapshot
+
+![Evidence flow from scenario to validated report](docs/assets/evidence-flow.svg)
+
+The public evidence map separates deterministic executable specifications, sanitized local
+observations, historical material, and independently reviewed evidence:
+
+- [Evidence map](docs/showcase/evidence-map.md)
+- [Evidence classes](docs/evidence-classes.md)
+- [Machine-readable evidence registry](docs/evidence-status-registry.json)
+- [Evidence pack format](docs/evidence-pack-format.md)
+- [Private/public evidence boundary](docs/private-public-evidence-boundary.md)
+
+Public artifacts may include scenario identifiers, aggregate counts, response hashes, and
+validator results. They do not include raw private prompts, raw responses, synthetic
+canaries, or local paths. Keep external raw material under
+`.internal/external-demo/latest`. **Do not** commit `raw_responses/` or other private
+runtime evidence.
+
+## Current stable surface
+
+- Trace schema `1.0`, with a bounded legacy `0.1` read/migration window.
+- Corpus `1.0.0`, freezing 24 ordered synthetic pattern identifiers.
+- Local targets for vulnerable/protected agent, RAG, tool, function, and multi-agent
+  handoff comparisons, including `toy-multi-agent` and `protected-toy-multi-agent`.
+- JSON traces, scorecards, run manifests, remediation, Markdown reports, and
+  self-contained HTML reports.
+- Deterministic validators for artifact integrity and declared benchmark semantics.
+- Linux/Python 3.11-3.13 as the primary installed-package contour, with Windows 3.11
+  compatibility coverage.
+- Reproducible wheel/sdist builds, checksums, GitHub attestations, and an exact-subject
+  CycloneDX SBOM in the next authorized tag workflow.
+
+The exact shipped, experimental, planned, and historical surfaces live in
+[`docs/current-state.md`](docs/current-state.md) and
+[`docs/capability-matrix.md`](docs/capability-matrix.md). Technical v1 gates and honest
+non-claims are in [`docs/v1-readiness.md`](docs/v1-readiness.md).
+
+## If you only have one minute
+
+- Run the no-network demo above.
+- Read the [committed comparison](examples/comparison-report/README.md).
+- Browse the [showcase](docs/showcase/index.md) and
+  [scenario matrix](docs/showcase/scenario-matrix.md).
+- See [weak spots and findings](docs/showcase/weak-spots-and-findings.md).
+- Check [current state](docs/current-state.md) and the
+  [project tracker](docs/project-tracker.md).
+- Bring your own local or OpenAI-compatible model through
+  [Run your model](docs/run-your-model.md).
+
+## Use your own model or runtime
+
+The shortest cross-platform operator path is
+[`docs/run-your-model.md`](docs/run-your-model.md). It covers:
+
+1. a no-model deterministic demo;
+2. one explicitly authorized OpenAI-compatible model;
+3. a deterministic local swarm comparison;
+4. a bounded local-model mini-swarm campaign.
+
+Connection details and scenario selection are documented in
+[`docs/connect-models.md`](docs/connect-models.md) and
+[`docs/test-your-model.md`](docs/test-your-model.md). External runs are prompt-only
+self-report checks unless a separately reviewed host/tool adapter exists. A coherent answer
+is not evidence of safe tool execution.
+
+## Benchmark and evidence documentation
+
+The README is the front door; deeper contracts live in `docs/`:
+
+| Question | Source of truth |
+|---|---|
+| What is shipped now? | [Current state](docs/current-state.md) |
+| What work is open? | [Project tracker](docs/project-tracker.md) and [roadmap](docs/roadmap.md) |
+| Which testing paths are authorized? | [Authorized testing paths](docs/authorized-testing-paths.md) |
+| Which system shapes are evaluated? | [Evaluation topologies](docs/evaluation-topologies.md) |
+| What boundary model is used? | [Agentic boundary model](docs/agentic-boundary-model.md) |
+| How is the corpus expanded? | [Corpus expansion plan](docs/corpus-expansion-plan.md) |
+| What do metrics mean? | [Metric contract](docs/metric-contract.md) |
+| How are scenarios sequenced? | [Scenario timeline](docs/scenario-timeline.md) |
+| How should reports be showcased? | [Showcase checklist](docs/showcase-report-checklist.md) |
+| How is evidence promoted? | [Evidence pack format](docs/evidence-pack-format.md) |
+| How are changes reviewed? | [Git evidence workflow](docs/git-evidence-workflow.md) |
+
+Specialized reviewer paths:
+
+- [Local Prometheus workflow](docs/local-prometheus-workflow.md)
+- [Local model profiles](docs/local-model-profiles.md)
+- [Multi-agent handoff toy topology](docs/handoff-toy-topology.md)
+- [Security audit causal map](docs/security-audit-causal-map-2026-07-15.md)
+- [R5 sanitized research status](docs/r5-research-status.md)
+- [Project governance](GOVERNANCE.md)
+
+## Standards and portfolio boundaries
+
+The project publishes conservative mappings to OWASP LLM, NIST, and a direct-fit MITRE
+ATLAS subset in [`docs/standards-mapping.md`](docs/standards-mapping.md). These are
+maintainer-reviewed mappings, not certification or independent standards validation.
+Independent review remains public follow-up work.
+
+The related public contract includes:
+
+- [Threat ontology](docs/threat-ontology.md): 26 provider-neutral failure families.
+- [Scenario adjudication ledger](docs/scenario-adjudication-ledger.md): 127 bounded source
+  units from 13 enumerated builders.
+- [Unified event envelope](docs/unified-event-envelope.md): separation of observations,
+  data, authority, advisories, decisions, and effects.
+
+The 127 units are **not 127 canonical attacks** and **not a repository-wide total**. The
+contract grants no executor, provider, deployment, enforcement, or production authority.
+
+## Public security stack
+
+Agentic Security Harness is the benchmark/evidence layer in a small public defensive
+stack:
+
+```text
+llm-safety-playbooks -> ai-agent-handoff -> agentic-transfer-verifier -> agentic-security-harness
+```
+
+- [`llm-safety-playbooks`](https://github.com/krivonosoff161/llm-safety-playbooks)
+  documents practical boundary rules.
+- [`ai-agent-handoff`](https://github.com/krivonosoff161/ai-agent-handoff)
+  represents task briefs and handoff state as reviewable files.
+- [`agentic-transfer-verifier`](https://github.com/krivonosoff161/agentic-transfer-verifier)
+  checks provenance, authority, approval, and audit evidence around transfers.
+- This repository measures modeled failures and produces validated benchmark artifacts.
+
+The repositories are related but not interchangeable. A playbook is not a runtime control,
+a handoff file is not a sandbox, and a passing benchmark is not a production certificate.
+
+## Release and package status
+
+The source tree is prepared for the stable v1 contract. Tagging, GitHub Release creation,
+TestPyPI upload, and PyPI publication remain separate, auditable owner gates. Until the
+package-index promotion succeeds, source and GitHub Release installation are the supported
+paths.
+
+- [Release checklist](docs/release-checklist.md)
+- [PyPI release process](docs/release-to-pypi.md)
+- [Changelog](CHANGELOG.md)
+- [Security policy](SECURITY.md)
+
+Independent standards review and a durable second GitHub reviewer are transparent
+post-v1 credibility tasks. Their absence does not change deterministic test results, but
+independent review is not claimed.
+
+## Development
+
+```bash
+python -m pip install -e ".[dev]"
+python -m pytest
+python -m ruff check .
+python -m mypy src tests tools
+ash validate examples/
+```
+
+Development follows
+`idea -> issue -> branch -> implementation -> tests/artifacts -> PR -> GitHub checks -> review gate`.
+See [`docs/git-evidence-workflow.md`](docs/git-evidence-workflow.md),
+[`CONTRIBUTING.md`](CONTRIBUTING.md), and [`docs/agent-operating-guide.md`](docs/agent-operating-guide.md).
+
+## Responsible use
+
+Use only synthetic, local, owned, or explicitly authorized targets. Do not use this project
+for credential theft, persistence, evasion, destructive payloads, or unauthorized systems.
+See [`SECURITY.md`](SECURITY.md) and
+[`docs/authorized-testing-paths.md`](docs/authorized-testing-paths.md).
+
+## Citation, contributing, and license
+
+- Citation metadata: [`CITATION.cff`](CITATION.cff)
+- Governance: [`GOVERNANCE.md`](GOVERNANCE.md)
+- Contributing: [`CONTRIBUTING.md`](CONTRIBUTING.md)
+- Support: [`SUPPORT.md`](SUPPORT.md)
+- License: Apache-2.0, see [`LICENSE`](LICENSE) and [`NOTICE`](NOTICE)