agentprov 0.1.1__tar.gz

agentprov-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nicholas Jones
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

agentprov-0.1.1/PKG-INFO

@@ -0,0 +1,99 @@
+Metadata-Version: 2.4
+Name: agentprov
+Version: 0.1.1
+Summary: AgentPROV: an execution-provenance framework for LLM-agent security research — source-preserving, evidence-qualified execution records and defensible W3C PROV, with benchmark/framework adapters
+Keywords: provenance,W3C PROV,LLM agents,prompt injection,agent security,reproducibility
+Author: Nicholas Jones
+License-Expression: MIT
+License-File: LICENSE
+License-File: THIRD_PARTY_NOTICES.md
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Science/Research
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Requires-Dist: prov>=3.2.2
+Requires-Dist: rdflib>=7.6.0
+Requires-Dist: rfc8785>=0.1.4
+Requires-Dist: pyyaml>=6.0.3
+Requires-Dist: agentprov-capture
+Requires-Dist: keyring>=25.6,<26
+Requires-Dist: psutil>=7.2,<9
+Requires-Dist: python-dotenv>=1.2.2 ; extra == 'live'
+Requires-Dist: pydot>=4.0.1 ; extra == 'render'
+Requires-Dist: pyshacl>=0.40.1 ; extra == 'shacl'
+Requires-Dist: agentprov-zenodo ; extra == 'zenodo'
+Requires-Python: >=3.14
+Project-URL: Homepage, https://w3id.org/agentprov/
+Project-URL: Documentation, https://w3id.org/agentprov/docs/
+Project-URL: Source, https://github.com/nickjones39/AgentPROV
+Provides-Extra: live
+Provides-Extra: render
+Provides-Extra: shacl
+Provides-Extra: zenodo
+Description-Content-Type: text/markdown
+
+# agentprov
+
+AgentPROV turns agent executions into a source-preserving, evidence-qualified canonical record, and derives W3C PROV
+from that record. The executions can be captured live or released by other research projects. Every derived PROV
+statement names its evidence class, the rule that produced it, and the field of the record that justifies it. Corpora
+are hash-chained from the original raw bytes to the final graph. You can verify and recompute them without
+re-running any model.
+
+This package is the `agentprov` command-line program and library. It installs the capture library
+([`agentprov-capture`](https://pypi.org/project/agentprov-capture/)) with it; the draft-only Zenodo uploader
+([`agentprov-zenodo`](https://pypi.org/project/agentprov-zenodo/)) comes with the `zenodo` extra.
+
+- Website: <https://w3id.org/agentprov/>
+- User guide: <https://w3id.org/agentprov/docs/>
+- Source code: <https://github.com/nickjones39/AgentPROV>
+- Software on Zenodo: <https://doi.org/10.5281/zenodo.23848609>
+- Corpora on Zenodo (one collection): <https://doi.org/10.5281/zenodo.23814758>
+
+## Install
+
+Python 3.14.8 or later:
+
+```bash
+pip install agentprov              # or: uv tool install agentprov
+pip install "agentprov[zenodo]"    # with the draft-only Zenodo uploader
+agentprov info                     # versions, the source registry, extras, host isolation grade
+agentprov --help
+```
+
+The desktop app is a separate download for macOS, Windows and Linux, on the
+[releases page](https://github.com/nickjones39/AgentPROV/releases/latest). Live runs need the repository checkout: the
+benchmark backends are separate projects that this package does not contain.
+
+## What it does
+
+- **Import** released agent logs (48 sources in 13 formats, single-agent tool-calling traces) and live captures into
+  one canonical execution record (`aer/0.2`), through isolated, resource-limited workers.
+- **Derive** semantic annotations (`sem/0.1`) and W3C PROV-JSON in three bundles: core (observed and derived
+  statements), inference and assessment (`agentprov-prov/0.1`).
+- **Validate** each stage, **verify** a corpus's hash chain against its root digest, and **recompute** the derivation
+  byte for byte without calling a model.
+- **Package** a corpus with its datasheet and checksums for an offline deposit; `package` never uploads. The separate
+  uploader creates unpublished Zenodo drafts only, and publishing is always done by hand on Zenodo.
+
+The [user guide](https://w3id.org/agentprov/docs/) walks through each step on a small demo corpus, and its command
+reference lists every command's `--help`.
+
+## Citation
+
+```bibtex
+@software{jones_agentprov_2026,
+  author  = {Jones, Nicholas},
+  title   = {AgentPROV: execution provenance for LLM-agent security research},
+  version = {0.1.1},
+  year    = {2026},
+  license = {MIT},
+  url     = {https://github.com/nickjones39/AgentPROV}
+}
+```
+
+## Licence
+
+MIT, © 2026 Nicholas Jones. Third-party code and data licences are listed in
+[`THIRD_PARTY_NOTICES.md`](https://github.com/nickjones39/AgentPROV/blob/main/THIRD_PARTY_NOTICES.md).

agentprov-0.1.1/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,81 @@
+# Third-party notices
+
+AgentPROV's own code is MIT-licensed (see `LICENSE`). This file records third-party material that is
+incorporated into, adapted by, or used under licence by this repository. It also records the licence
+bases of the external execution data AgentPROV can import. **AgentPROV does not redistribute any
+external corpus in Git.** Imported raw artefacts are handled per source under the raw policy
+(`include` / `reference` / `withhold`) recorded in each corpus manifest.
+
+## Code adapted or mirrored
+
+| Component | Origin | Licence | Where |
+|---|---|---|---|
+| AgentDojo-PROV (baseline framework) | `nickjones39/agentdojo-prov` @ `579a908` | MIT, © 2026 Nicholas Jones | verbatim compat port under `src/agentprov/prov/compat/adprov_v2_3/`; capture logic in `backends/shared/` |
+| AgentDojo `ToolsExecutor.query` mirror and the June-2024 security checkers (compat/replay only) | `ethz-spylab/agentdojo` (v0.1.35; June-2024 blobs) | MIT, © 2024 Edoardo Debenedetti, Jie Zhang, Mislav Balunovic, Luca Beurer-Kellner, Marc Fischer, Florian Tramèr | `backends/shared/` (executor mirror) |
+
+The live backends (`backends/agentdojo`, `backends/autodojo`, `backends/agentdyn`, `backends/inspect`) *install*
+third-party benchmark code into isolated environments. They do not vendor it:
+- `agentdojo==0.1.35` (PyPI; MIT)
+- the AutoDojo fork `xhOwenMa/AutoDojo` @ `aa458794b7eb7f082e94daeac4c0f55bfc0c90cc` (MIT, © 2026 Ma,
+  Li, Xiao, Yu, Zhang, Vorobeychik; contains AgentDojo MIT code and vendored defences under their own
+  licences)
+- AgentDyn `SaFo-Lab/AgentDyn` @ `5353cf76` (repository MIT, whose text is AgentDojo's)
+- for the Inspect harness: `inspect-ai` 0.3.263 and `inspect-evals` 0.20.0 (PyPI; MIT), and the AgentHarm dataset
+  at revision `e23b3fe6` (MIT with an additional clause: use only to improve AI safety and security)
+
+The desktop app's bundles redistribute Qt and PySide6 (LGPL-3.0) and further Python packages; their notices are in
+[`gui/THIRD_PARTY_NOTICES.md`](gui/THIRD_PARTY_NOTICES.md).
+
+## Execution data AgentPROV can import (not redistributed here)
+
+Licence bases are as recorded by the investigation of 2026-10-07; the table lists the sources known then. Every
+registered source and part, with its SPDX licence id, is in the README's generated sources table, and every declared
+corpus with its licence in the user guide's [Corpora and where they come from](docs/user-guide/14-corpora.md). Corpus
+manifests record the licences verbatim.
+
+| Source | Licence basis of released logs |
+|---|---|
+| AgentDojo upstream runs | repository MIT (no separate data licence) |
+| ROPE (incl. AutoDojo-attack runs) | repository MIT |
+| AgentDyn | repository MIT, whose text is AgentDojo's; the data licence is not explicit |
+| DRIFT | MIT (added 2026-07-16) |
+| Mandate-AgentDojo-Eval | MIT |
+| Agent Security Tools Survey (Zenodo) | CC-BY-4.0. Embedded third-party data keeps its own licence; AgentHarm data carries a use clause. |
+| MultiTurnAgentAttack (STAC) | CC BY-NC 4.0 (non-commercial) |
+| CIAware-Bench | no licence. Reference-only; never redistributed. |
+| DTap-Bench (AI-Secure, Hugging Face run logs and task definitions) | Apache-2.0 (dataset cards; upstream AI-secure/DecodingTrust-Agent LICENSE) |
+| Interbolt on AgentDojo (deconvolute-labs) | Apache-2.0 |
+| MELON (xwsdid/MELON) | MIT (upstream AgentDojo text) |
+| Glitch (zanethomas1430-code) | MIT |
+| UBAG gateway (mohameduk/agentdojo) | MIT (upstream AgentDojo text) |
+| TACIT (CSSLab/Tacit) | Apache-2.0 |
+| Geryon (luiacuaniello) | Apache-2.0 |
+| In-context trajectory poisoning (HilaryTorn) | MIT |
+| Prompt injection harness (yockcheng) | Apache-2.0 |
+| llm_safety (ShreeyaVarma) | MIT (upstream AgentDojo text) |
+| jspace-agentdojo-950 (kongminOS) | MIT |
+| ceferisbarov/agentdojo reruns | MIT (upstream AgentDojo text) |
+| Linyxus/agentdojo lacuna-exp | MIT (upstream AgentDojo text) |
+| CrAIBench (AthaSSiN) | MIT |
+| IPI multidomain agent study (Menelaus29) | MIT |
+| gate (dafarusd) | **AGPL-3.0-only** (copyleft; its own corpus, D-25/D-94) |
+| SENTRY (vinhqdang) | **AGPL-3.0-only** (copyleft; its own corpus) |
+| aiAuthZ (Sports-Vision-Inc) | **AGPL-3.0-only** (copyleft; its own corpus) |
+| Munim / bookkeeper (sricursion) | **GPL-3.0-or-later** (copyleft; its own corpus) |
+| LLMLock (Wakeful-Cloud/llm-lock) | **GPL-3.0** (copyleft; its own corpus; the LICENSE states no version choice) |
+
+Small test fixtures are derived from these sources. Each carries its own `SOURCE.json`, which records origin, commit,
+licence and licence class. Fixtures of licence class `permissive` are part of the repository; the others (for example
+the restricted-use AgentHarm excerpts) stay in the private development repository, and the tests that need them skip.
+The copyleft sources' tests use synthetic fixtures (see below).
+
+**Copyleft sources: synthetic fixtures only (D-945).** The repository holds no logs, excerpts or licence texts of the
+AGPL-3.0 and GPL-3.0 sources (gate, SENTRY, aiAuthZ, bookkeeper, llm-lock). Their tests run on synthetic fixtures under
+`tests/fixtures/{gate,sentry,aiauthz,bookkeeper,llm-lock}/`: self-authored AgentDojo TraceLogger logs, written by
+`tests/adapters/agentdojo/phase10d_synthetic.py`, that follow each source's directory layout and dialect. Their
+`SOURCE.json` entries record `synthetic: true`, `licence_class: permissive` and the repository's MIT licence. Two values
+are filled in only when the tests run, and no fixture file stores them: the synthetic injection sentence, which is
+assembled from fragments, and AgentDojo's default system prompt (MIT, © 2024 Debenedetti et al.), which is read from the
+permissive `tests/fixtures/agentdojo/head/` fixtures. The real excerpts that these fixtures replace had licence class
+`restricted` and were approved for the private repository only (user decision, 2026-10-12). They stay in the private
+development history and are not part of the release commit or any package.

agentprov-0.1.1/docs/pypi/agentprov.md

@@ -0,0 +1,64 @@
+# agentprov
+
+AgentPROV turns agent executions into a source-preserving, evidence-qualified canonical record, and derives W3C PROV
+from that record. The executions can be captured live or released by other research projects. Every derived PROV
+statement names its evidence class, the rule that produced it, and the field of the record that justifies it. Corpora
+are hash-chained from the original raw bytes to the final graph. You can verify and recompute them without
+re-running any model.
+
+This package is the `agentprov` command-line program and library. It installs the capture library
+([`agentprov-capture`](https://pypi.org/project/agentprov-capture/)) with it; the draft-only Zenodo uploader
+([`agentprov-zenodo`](https://pypi.org/project/agentprov-zenodo/)) comes with the `zenodo` extra.
+
+- Website: <https://w3id.org/agentprov/>
+- User guide: <https://w3id.org/agentprov/docs/>
+- Source code: <https://github.com/nickjones39/AgentPROV>
+- Software on Zenodo: <https://doi.org/10.5281/zenodo.23848609>
+- Corpora on Zenodo (one collection): <https://doi.org/10.5281/zenodo.23814758>
+
+## Install
+
+Python 3.14.8 or later:
+
+```bash
+pip install agentprov              # or: uv tool install agentprov
+pip install "agentprov[zenodo]"    # with the draft-only Zenodo uploader
+agentprov info                     # versions, the source registry, extras, host isolation grade
+agentprov --help
+```
+
+The desktop app is a separate download for macOS, Windows and Linux, on the
+[releases page](https://github.com/nickjones39/AgentPROV/releases/latest). Live runs need the repository checkout: the
+benchmark backends are separate projects that this package does not contain.
+
+## What it does
+
+- **Import** released agent logs (48 sources in 13 formats, single-agent tool-calling traces) and live captures into
+  one canonical execution record (`aer/0.2`), through isolated, resource-limited workers.
+- **Derive** semantic annotations (`sem/0.1`) and W3C PROV-JSON in three bundles: core (observed and derived
+  statements), inference and assessment (`agentprov-prov/0.1`).
+- **Validate** each stage, **verify** a corpus's hash chain against its root digest, and **recompute** the derivation
+  byte for byte without calling a model.
+- **Package** a corpus with its datasheet and checksums for an offline deposit; `package` never uploads. The separate
+  uploader creates unpublished Zenodo drafts only, and publishing is always done by hand on Zenodo.
+
+The [user guide](https://w3id.org/agentprov/docs/) walks through each step on a small demo corpus, and its command
+reference lists every command's `--help`.
+
+## Citation
+
+```bibtex
+@software{jones_agentprov_2026,
+  author  = {Jones, Nicholas},
+  title   = {AgentPROV: execution provenance for LLM-agent security research},
+  version = {0.1.1},
+  year    = {2026},
+  license = {MIT},
+  url     = {https://github.com/nickjones39/AgentPROV}
+}
+```
+
+## Licence
+
+MIT, © 2026 Nicholas Jones. Third-party code and data licences are listed in
+[`THIRD_PARTY_NOTICES.md`](https://github.com/nickjones39/AgentPROV/blob/main/THIRD_PARTY_NOTICES.md).

agentprov-0.1.1/pyproject.toml

@@ -0,0 +1,213 @@
+[project]
+name = "agentprov"
+version = "0.1.1"
+description = "AgentPROV: an execution-provenance framework for LLM-agent security research — source-preserving, evidence-qualified execution records and defensible W3C PROV, with benchmark/framework adapters"
+readme = "docs/pypi/agentprov.md"
+requires-python = ">=3.14"
+license = "MIT"
+license-files = [
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md",
+]
+keywords = [
+    "provenance",
+    "W3C PROV",
+    "LLM agents",
+    "prompt injection",
+    "agent security",
+    "reproducibility",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Science/Research",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Security",
+    "Topic :: Scientific/Engineering :: Artificial Intelligence",
+]
+dependencies = [
+    "prov>=3.2.2",
+    "rdflib>=7.6.0",
+    "rfc8785>=0.1.4",
+    "pyyaml>=6.0.3",
+    "agentprov-capture",
+    "keyring>=25.6,<26",
+    "psutil>=7.2,<9",
+]
+
+[[project.authors]]
+name = "Nicholas Jones"
+
+[project.urls]
+Homepage = "https://w3id.org/agentprov/"
+Documentation = "https://w3id.org/agentprov/docs/"
+Source = "https://github.com/nickjones39/AgentPROV"
+
+[project.optional-dependencies]
+live = ["python-dotenv>=1.2.2"]
+shacl = ["pyshacl>=0.40.1"]
+render = ["pydot>=4.0.1"]
+zenodo = ["agentprov-zenodo"]
+
+[project.scripts]
+agentprov = "agentprov.cli.main:main"
+
+[dependency-groups]
+dev = [
+    "pytest>=9.1.1",
+    "hypothesis>=6.168.5",
+    "ruff>=0.16.10",
+    "mypy>=2.4.0",
+    "jsonschema>=4.26.0",
+    "types-pyyaml>=6.0.12",
+    "pytest-xdist>=3.8",
+    "pytest-testmon>=2.1",
+    "agentprov-zenodo",
+]
+docs = [
+    "mkdocs==1.6.1",
+    "mkdocs-material==9.7.7",
+]
+
+[build-system]
+requires = ["uv_build>=0.12.18,<0.13"]
+build-backend = "uv_build"
+
+[tool.uv]
+required-version = ">=0.12.22"
+exclude-newer = "2026-10-07T00:00:00Z"
+default-groups = ["dev"]
+
+[tool.uv.exclude-newer-package]
+certifi = "2026-11-01T00:00:00Z"
+
+[tool.uv.workspace]
+members = [
+    "capture",
+    "zenodo",
+]
+
+[tool.uv.sources.agentprov-capture]
+workspace = true
+
+[tool.uv.sources.agentprov-zenodo]
+workspace = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-ra --strict-markers --import-mode=importlib"
+markers = [
+    "slow: slower tests (run in CI, skipped with -m 'not slow')",
+    "network: needs network access (never in default CI)",
+    "backend_agentdojo: needs the backends/agentdojo environment",
+    "backend_autodojo: needs the backends/autodojo environment",
+    "backend_agentdyn: needs the backends/agentdyn environment",
+    "backend_inspect: needs a backends/inspect environment (inspect_ai, inspect_evals and the pinned dataset)",
+    "full_corpus: needs the local baseline corpora (AGENTPROV_BASELINE_CORPUS)",
+    "old_package: needs agentdojo-prov 1.0.0 @ 579a908 in a separate interpreter and the C6 producer's work dir (AGENTPROV_C6_WORK)",
+    "render: needs the render extra (pydot) and, for images, the graphviz dot binary; skipped with the reason when absent",
+    "live_artefacts: consumes capture/0.1 sessions produced by a backend job (AGENTPROV_LIVE_ARTEFACTS; K.8.5)",
+]
+filterwarnings = [
+    "error::UserWarning:agentprov.*",
+    "ignore:Dataset.default_context is deprecated:DeprecationWarning:rdflib.graph",
+]
+
+[tool.ruff]
+line-length = 110
+target-version = "py314"
+extend-exclude = [
+    "backends/*/.venv",
+    "docs/architecture/examples",
+    "docs/reports/systematic-search/data",
+    "docs/reports/systematic-search/scripts",
+    "docs/reports/precheck/data",
+]
+
+[tool.ruff.lint]
+select = [
+    "E4",
+    "E7",
+    "E9",
+    "F",
+    "B",
+    "UP",
+    "T20",
+    "PLE2502",
+    "S102",
+    "S301",
+    "S307",
+    "S506",
+]
+
+[tool.ruff.lint.per-file-ignores]
+"src/agentprov/cli/**" = ["T20"]
+"tests/**" = ["T20"]
+"tools/**" = ["T20"]
+"src/agentprov/io/worker_testjobs.py" = ["T20"]
+"src/agentprov/prov/compat/adprov_v2_3/build_prov.py" = [
+    "B",
+    "BLE",
+    "UP",
+    "S",
+    "E7",
+]
+"src/agentprov/prov/compat/adprov_v2_3/prov_emit.py" = [
+    "B",
+    "BLE",
+    "UP",
+    "S",
+    "E7",
+]
+"src/agentprov/prov/compat/adprov_v2_3/labeling.py" = [
+    "B",
+    "BLE",
+    "UP",
+    "S",
+    "E7",
+]
+"src/agentprov/prov/compat/adprov_v2_3/validate.py" = [
+    "B",
+    "BLE",
+    "UP",
+    "S",
+    "E7",
+]
+"src/agentprov/prov/compat/adprov_v2_3/conformance.py" = [
+    "B",
+    "BLE",
+    "UP",
+    "S",
+    "E7",
+]
+"tests/prov/compat/adprov_v2_3/test_*.py" = ["B905"]
+
+[tool.mypy]
+python_version = "3.14"
+strict = false
+warn_unused_ignores = true
+packages = ["agentprov"]
+mypy_path = "src"
+
+[[tool.mypy.overrides]]
+module = [
+    "agentprov.prov.compat.adprov_v2_3.build_prov",
+    "agentprov.prov.compat.adprov_v2_3.prov_emit",
+    "agentprov.prov.compat.adprov_v2_3.labeling",
+    "agentprov.prov.compat.adprov_v2_3.validate",
+    "agentprov.prov.compat.adprov_v2_3.conformance",
+]
+ignore_errors = true
+
+[[tool.mypy.overrides]]
+module = [
+    "pydot",
+    "pydot.*",
+]
+ignore_missing_imports = true
+
+[[tool.mypy.overrides]]
+module = [
+    "psutil",
+    "psutil.*",
+]
+ignore_missing_imports = true

agentprov-0.1.1/pyproject.toml.orig

@@ -0,0 +1,156 @@
+[project]
+name = "agentprov"
+version = "0.1.1"
+description = "AgentPROV: an execution-provenance framework for LLM-agent security research — source-preserving, evidence-qualified execution records and defensible W3C PROV, with benchmark/framework adapters"
+readme = "docs/pypi/agentprov.md"  # the PyPI page: absolute links; README.md is the repository's
+requires-python = ">=3.14"          # stdlib zstd (PEP 784), tar 'data' filter default, 2025-26 archive CVE fixes; see docs/architecture
+license = "MIT"
+license-files = ["LICENSE", "THIRD_PARTY_NOTICES.md"]
+authors = [{ name = "Nicholas Jones" }]
+keywords = ["provenance", "W3C PROV", "LLM agents", "prompt injection", "agent security", "reproducibility"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Science/Research",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Security",
+    "Topic :: Scientific/Engineering :: Artificial Intelligence",
+]
+# Core runtime dependencies are deliberately few. Untrusted bytes are parsed with the stdlib only
+# (src/agentprov/ingest/); no benchmark package (agentdojo, inspect_ai, ...) is ever imported by the core.
+dependencies = [
+    "prov>=3.2.2",            # PROV model, PROV-JSON <-> PROV-O serialisation
+    "rdflib>=7.6.0",          # PROV-O round-trip / RDF checks
+    "rfc8785>=0.1.4",         # RFC 8785 JSON Canonicalisation Scheme (AER lines, digests)
+    "pyyaml>=6.0.3",          # only via agentprov.ingest.yamlsafe (injection-marker normaliser, compat port)
+    "agentprov-capture",      # capture/0.1 event model + hash-chain verifier (shared with live backends)
+    "keyring>=25.6,<26",      # D-702: `agentprov keys` and `run --keychain`; imported only by agentprov.keys.helper
+    "psutil>=7.2,<9",         # D-704: job identity (pid + create time) and process trees; agentprov.jobs only
+]
+
+[project.urls]
+Homepage = "https://w3id.org/agentprov/"
+Documentation = "https://w3id.org/agentprov/docs/"
+Source = "https://github.com/nickjones39/AgentPROV"
+
+[project.optional-dependencies]
+live = ["python-dotenv>=1.2.2"]   # read .env at the live CLI entry only
+shacl = ["pyshacl>=0.40.1"]       # optional SHACL profile shapes
+render = ["pydot>=4.0.1"]         # agentprov render (also needs the graphviz `dot` binary)
+zenodo = ["agentprov-zenodo"]     # D-880: the draft-only Zenodo uploader (zenodo/); agentprov never imports it
+
+[project.scripts]
+agentprov = "agentprov.cli.main:main"
+
+[dependency-groups]
+dev = [
+    "pytest>=9.1.1",
+    "hypothesis>=6.168.5",
+    "ruff>=0.16.10",
+    "mypy>=2.4.0",
+    "jsonschema>=4.26.0",
+    "types-pyyaml>=6.0.12",
+    "pytest-xdist>=3.8",
+    "pytest-testmon>=2.1",
+    "agentprov-zenodo",   # D-880: the uploader in every checkout environment (the GUI runs it from there)
+]
+# The user guide's website (mkdocs.yml; D-760). Not a default group: a plain `uv sync` never installs it.
+# Exact pins: Material for MkDocs is in maintenance mode (Zensical is its named successor) and MkDocs 1.x has no
+# further releases, so nothing moves under the lock by accident.
+docs = [
+    "mkdocs==1.6.1",
+    "mkdocs-material==9.7.7",
+]
+
+[build-system]
+requires = ["uv_build>=0.12.18,<0.13"]
+build-backend = "uv_build"
+
+[tool.uv]
+required-version = ">=0.12.22"     # can install CPython 3.14.8 (release-mode floor); raised 2026-10-08 per G.7.1(1)
+exclude-newer = "2026-10-07T00:00:00Z"
+# D-1011: the security releases osv-scanner asked for (the first public CI run, 2026-11-01); only these
+# packages may be newer than the cutoff above, every other one stays where it was
+exclude-newer-package = { certifi = "2026-11-01T00:00:00Z" }
+default-groups = ["dev"]
+
+[tool.uv.workspace]
+members = ["capture", "zenodo"]     # backends/* are separate uv projects with their own locks (never members)
+
+[tool.uv.sources]
+agentprov-capture = { workspace = true }
+agentprov-zenodo = { workspace = true }
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-ra --strict-markers --import-mode=importlib"
+markers = [
+    "slow: slower tests (run in CI, skipped with -m 'not slow')",
+    "network: needs network access (never in default CI)",
+    "backend_agentdojo: needs the backends/agentdojo environment",
+    "backend_autodojo: needs the backends/autodojo environment",
+    "backend_agentdyn: needs the backends/agentdyn environment",
+    "backend_inspect: needs a backends/inspect environment (inspect_ai, inspect_evals and the pinned dataset)",
+    "full_corpus: needs the local baseline corpora (AGENTPROV_BASELINE_CORPUS)",
+    "old_package: needs agentdojo-prov 1.0.0 @ 579a908 in a separate interpreter and the C6 producer's work dir (AGENTPROV_C6_WORK)",
+    "render: needs the render extra (pydot) and, for images, the graphviz dot binary; skipped with the reason when absent",
+    "live_artefacts: consumes capture/0.1 sessions produced by a backend job (AGENTPROV_LIVE_ARTEFACTS; K.8.5)",
+]
+filterwarnings = [
+    "error::UserWarning:agentprov.*",
+    # prov 3.2.2 calls rdflib's deprecated Dataset.default_context; third-party, harmless for the compat oracle
+    "ignore:Dataset.default_context is deprecated:DeprecationWarning:rdflib.graph",
+]
+
+[tool.ruff]
+line-length = 110
+target-version = "py314"
+# docs/architecture/examples/: frozen prototype scripts that generated the specification's example vectors;
+# they are spec artefacts, not product code (the implementation re-implements them under src/).
+# docs/reports/systematic-search/{data,scripts}/: the systematic search's scripts (archived verbatim, and the screening
+# generator that reproduces the appendix tables), a record of the manuscript appendix, not product code.
+extend-exclude = ["backends/*/.venv", "docs/architecture/examples", "docs/reports/systematic-search/data", "docs/reports/systematic-search/scripts", "docs/reports/precheck/data"]
+
+[tool.ruff.lint]
+select = ["E4", "E7", "E9", "F", "B", "UP", "T20", "PLE2502", "S102", "S301", "S307", "S506"]
+
+[tool.ruff.lint.per-file-ignores]
+# `print` is banned outside the CLI (N.1.12(1)); tests and maintenance scripts may print.
+"src/agentprov/cli/**" = ["T20"]
+"tests/**" = ["T20"]
+"tools/**" = ["T20"]
+"src/agentprov/io/worker_testjobs.py" = ["T20"]  # test-only job kinds that print on purpose (stdout/stderr isolation tests)
+# The five oracle files are a verbatim port of the baseline (R-31): ruff may not push them away from 579a908.
+"src/agentprov/prov/compat/adprov_v2_3/build_prov.py" = ["B", "BLE", "UP", "S", "E7"]
+"src/agentprov/prov/compat/adprov_v2_3/prov_emit.py" = ["B", "BLE", "UP", "S", "E7"]
+"src/agentprov/prov/compat/adprov_v2_3/labeling.py" = ["B", "BLE", "UP", "S", "E7"]
+"src/agentprov/prov/compat/adprov_v2_3/validate.py" = ["B", "BLE", "UP", "S", "E7"]
+"src/agentprov/prov/compat/adprov_v2_3/conformance.py" = ["B", "BLE", "UP", "S", "E7"]
+"tests/prov/compat/adprov_v2_3/test_*.py" = ["B905"]  # ported baseline tests, kept diff-able against 579a908
+
+[tool.mypy]
+python_version = "3.14"
+strict = false
+warn_unused_ignores = true
+packages = ["agentprov"]
+mypy_path = "src"
+
+# The five oracle files are a verbatim baseline port (R-31): never edited to satisfy a type checker.
+[[tool.mypy.overrides]]
+module = [
+    "agentprov.prov.compat.adprov_v2_3.build_prov",
+    "agentprov.prov.compat.adprov_v2_3.prov_emit",
+    "agentprov.prov.compat.adprov_v2_3.labeling",
+    "agentprov.prov.compat.adprov_v2_3.validate",
+    "agentprov.prov.compat.adprov_v2_3.conformance",
+]
+ignore_errors = true
+
+# pydot comes with the optional `render` extra; the default environment type-checks without it.
+[[tool.mypy.overrides]]
+module = ["pydot", "pydot.*"]
+ignore_missing_imports = true
+
+# psutil (D-704) ships no stubs in the lock (types-psutil would be another download), as for the GUI.
+[[tool.mypy.overrides]]
+module = ["psutil", "psutil.*"]
+ignore_missing_imports = true

agentprov-0.1.1/src/agentprov/__init__.py

@@ -0,0 +1,14 @@
+"""AgentPROV: an execution-provenance framework for LLM-agent security research.
+
+Pipeline (each stage after the raw store is a pure, versioned function)::
+
+    raw evidence (imported logs | live capture/0.1)  ->  AER (aer/0.2; aer/0.1 read)  ->  SEM (sem/0.1)
+        ->  W3C PROV (agentprov-prov/0.1: core / inference / assessment bundles)
+        ->  validation  ->  corpus (hash-chained manifest)
+
+See ``docs/architecture/`` for the normative specification and ``AGENTS.md`` for project memory.
+"""
+
+from agentprov.versions import VERSIONS, __version__
+
+__all__ = ["VERSIONS", "__version__"]

agentprov-0.1.1/src/agentprov/__main__.py

@@ -0,0 +1,8 @@
+"""``python -m agentprov``: the same entry point as the ``agentprov`` console script (MN M.1.2)."""
+
+from __future__ import annotations
+
+from agentprov.cli.main import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())