agentmandate 0.3.1__tar.gz → 0.3.2__tar.gz

{agentmandate-0.3.1 → agentmandate-0.3.2}/CHANGELOG.md

@@ -6,6 +6,17 @@ All notable changes to this project are documented here. The format follows
 
 ## Unreleased
 
+## 0.3.2 - 2026-07-28
+
+### Changed
+
+- The README scopes every finding to permitted reachability under the reviewed
+  manifest and bounded abstraction, rather than observed model behaviour or
+  undeclared downstream enforcement.
+- The roadmap makes external tool-graph validation a prerequisite for model
+  growth, then ranks bounded cardinality, reviewed resource relationships, and
+  non-monetary effect budgets as evidence-dependent candidates.
+
 ## 0.3.1 - 2026-07-28
 
 ### Changed

{agentmandate-0.3.1 → agentmandate-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentmandate
-Version: 0.3.1
+Version: 0.3.2
 Summary: Compound-path and cross-release analysis of what an AI agent is permitted to do
 Project-URL: Homepage, https://github.com/mrwersa/agentmandate
 Project-URL: Repository, https://github.com/mrwersa/agentmandate
@@ -64,7 +64,7 @@ whole run is capped at 500 GBP. Release 2 adds one read-only tool:
 
 That tool spends nothing. It does, however, let the agent get hold of more
 cases, and the 500 GBP cap is measured *per case*. Two separately valid refunds
-become possible, so reachable extraction doubles to 1,000 GBP
+become reachable under the manifest, so reachable extraction doubles to 1,000 GBP
 while every individual call still looks permitted.
 
 ![A read-only case search makes two approved refunds reachable and breaches the run limit](https://raw.githubusercontent.com/mrwersa/agentmandate/main/docs/assets/authority-path.svg)
@@ -269,6 +269,10 @@ The `lint` command deliberately overlaps the scanners above. A tool that reporte
 
 ## Scope
 
+Read every finding as **permitted by the reviewed manifest within this bounded
+abstraction**. It is not proof that the model will choose the path or that an
+undeclared downstream invariant will accept it.
+
 What this does not do, on purpose:
 
 - **No enforcement.** No proxy, no runtime interception, no blocking.
@@ -300,7 +304,7 @@ ruff check .
 
 ## Status
 
-Alpha, version 0.3.0. The authority model is the part most likely to change,
+Alpha, version 0.3.2. The authority model is the part most likely to change,
 because it has not yet been pointed at enough real tool graphs to know where it
 is too coarse. Issues describing a graph it models badly are the most useful
 thing you can file.

{agentmandate-0.3.1 → agentmandate-0.3.2}/README.md

@@ -30,7 +30,7 @@ whole run is capped at 500 GBP. Release 2 adds one read-only tool:
 
 That tool spends nothing. It does, however, let the agent get hold of more
 cases, and the 500 GBP cap is measured *per case*. Two separately valid refunds
-become possible, so reachable extraction doubles to 1,000 GBP
+become reachable under the manifest, so reachable extraction doubles to 1,000 GBP
 while every individual call still looks permitted.
 
 ![A read-only case search makes two approved refunds reachable and breaches the run limit](https://raw.githubusercontent.com/mrwersa/agentmandate/main/docs/assets/authority-path.svg)
@@ -235,6 +235,10 @@ The `lint` command deliberately overlaps the scanners above. A tool that reporte
 
 ## Scope
 
+Read every finding as **permitted by the reviewed manifest within this bounded
+abstraction**. It is not proof that the model will choose the path or that an
+undeclared downstream invariant will accept it.
+
 What this does not do, on purpose:
 
 - **No enforcement.** No proxy, no runtime interception, no blocking.
@@ -266,7 +270,7 @@ ruff check .
 
 ## Status
 
-Alpha, version 0.3.0. The authority model is the part most likely to change,
+Alpha, version 0.3.2. The authority model is the part most likely to change,
 because it has not yet been pointed at enough real tool graphs to know where it
 is too coarse. Issues describing a graph it models badly are the most useful
 thing you can file.

{agentmandate-0.3.1 → agentmandate-0.3.2}/ROADMAP.md

@@ -7,15 +7,16 @@ runtime proxy or general agent-security scanner.
 
 This is direction, not a release promise.
 
-## Now: trustworthy authority analysis
+## Current foundation: trustworthy authority analysis
 
-Version 0.2 makes the existing gate dependable:
+Version 0.3.2 makes the existing gate dependable:
 
 - fail-closed replay when control evidence is missing
 - tool-contract and run-limit comparison across releases
 - one search depth on both sides of a diff
 - safe ingestion of untrusted MCP catalogues
 - explicit handling of incomparable currencies and different agents
+- reviewed test obligations reconciled against current reachable authority
 
 ## Next: easier adoption
 
@@ -35,6 +36,39 @@ new value remains the authority graph and its counterexamples.
 
 ## Then: widen the model where evidence demands it
 
+Do not implement every candidate below in parallel. First collect tool graphs
+from independent users and identify which abstraction forces them to distort a
+real control. Expressiveness increases the search state and the annotation
+burden, so a feature needs a concrete graph and counterexample before it earns
+that cost.
+
+### Bounded scope cardinality
+
+The current `unbounded` flag distinguishes one binding from an unlimited
+source. Real tools often expose a finite collection, such as at most ten cases
+or one refund per transaction. A reviewed `max_bindings` bound is the first
+candidate extension because it sharpens the existing scope model without
+turning the manifest into a full application specification.
+
+Per-customer or relational limits come later. They require resource identity
+and relationships, not another integer placed beside the current type count.
+
+### Resource relationships
+
+Scope counts deliberately forget which customer owns a case or whether two
+bindings refer to the same object. If real graphs show that this creates false
+or missed paths, add a small reviewed relation vocabulary and preserve binding
+provenance through tool transitions. Do not jump directly to arbitrary
+preconditions and postconditions.
+
+### Non-monetary effect budgets
+
+Some authority limits count irreversible actions rather than currency, such as
+accounts closed, credentials rotated, or external messages sent. Generalise
+the current cumulative-value mechanism only when those limits share a clear,
+reviewable accumulation rule. Confidentiality and data flow remain a separate
+model rather than being disguised as a numeric budget.
+
 ### Data-flow reachability
 
 Add reviewed source, transform, and sink labels so the analyser can detect a

{agentmandate-0.3.1 → agentmandate-0.3.2}/agentmandate/__init__.py

@@ -13,7 +13,7 @@ against the declaration, so it is usable without another tool alongside it.
 
 from __future__ import annotations
 
-__version__ = "0.3.1"
+__version__ = "0.3.2"
 
 from .diff import Change, Delta, compare
 from .lint import Finding, check

{agentmandate-0.3.1 → agentmandate-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentmandate"
-version = "0.3.1"
+version = "0.3.2"
 description = "Compound-path and cross-release analysis of what an AI agent is permitted to do"
 readme = "README.md"
 license = "Apache-2.0"