ai-agent-risk 0.1.0__tar.gz

ai_agent_risk-0.1.0/CHANGELOG.md

@@ -0,0 +1,7 @@
+# Changelog
+
+## 0.1.0 (2026-10-11)
+
+First public release accompanying the preprint "agent-risk: Risk Assessment for Changes to AI Agents".
+Provides episode data representations, counterfactual replay of stopping and retry gates,
+exact Clopper-Pearson harm certification, and paired equivalence testing for AI agents.

ai_agent_risk-0.1.0/LICENSE

@@ -0,0 +1,24 @@
+BSD 2-Clause License
+
+Copyright (c) 2026, Yue Zhao, Zixiang Xu, Angela Huyue Zhang, S. Alex Yang, Xiyang Hu
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

ai_agent_risk-0.1.0/MANIFEST.in

@@ -0,0 +1,9 @@
+include CHANGELOG.md
+recursive-include tests *.py
+prune checks
+prune experiments
+prune registrations
+prune data
+prune survey
+prune supplement
+exclude ARTIFACT.md

ai_agent_risk-0.1.0/PKG-INFO

@@ -0,0 +1,206 @@
+Metadata-Version: 2.4
+Name: ai-agent-risk
+Version: 0.1.0
+Summary: Risk modeling for AI agents from logs: replay a proposed change over logged episodes and separate what the log settles, what a declared stop valuation fixes, and what needs bounds.
+Author: Zixiang Xu, Angela Huyue Zhang, S. Alex Yang, Xiyang Hu
+Author-email: Yue Zhao <yzhao062@gmail.com>
+License-Expression: BSD-2-Clause
+Project-URL: Homepage, https://github.com/yzhao062/agent-risk
+Project-URL: Repository, https://github.com/yzhao062/agent-risk
+Project-URL: Issues, https://github.com/yzhao062/agent-risk/issues
+Project-URL: Dataset, https://huggingface.co/datasets/yzhao062/agent-risk-logs
+Keywords: ai agents,risk,monitoring,counterfactual replay,clopper-pearson,paired proportions
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Science/Research
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: Scientific/Engineering :: Mathematics
+Classifier: Typing :: Typed
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: numpy>=1.20
+Requires-Dist: scipy>=1.7
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Dynamic: license-file
+
+<a name="readme-top"></a>
+
+<div align="center">
+
+# agent-risk
+
+**Risk assessment for changes to AI agents, starting from the logs you already have**
+
+[![PyPI](https://img.shields.io/pypi/v/ai-agent-risk.svg?color=blue)](https://pypi.org/project/ai-agent-risk/)
+[![Python](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/)
+[![CI](https://github.com/yzhao062/agent-risk/actions/workflows/ci.yml/badge.svg)](https://github.com/yzhao062/agent-risk/actions/workflows/ci.yml)
+[![License](https://img.shields.io/badge/License-BSD_2--Clause-blue.svg)](https://github.com/yzhao062/agent-risk/blob/main/LICENSE)
+[![Dataset](https://img.shields.io/badge/Hugging%20Face-agent--risk--logs-yellow.svg)](https://huggingface.co/datasets/yzhao062/agent-risk-logs)
+
+[What It Answers](#what-it-answers) · [Key Results](#key-results) · [Install](#install) · [Quickstart](#quickstart) · [Reproduce the Paper](#reproduce-the-paper) · [Citation](#citation)
+
+<img src="https://raw.githubusercontent.com/yzhao062/agent-risk/main/docs/figure1.png" alt="Replaying a logged episode under a proposed change: the log settles agreeing episodes, a declared stop value settles stopped ones, and continuing ones need logged support, a snapshot run, or a bound" width="100%">
+
+</div>
+
+Before changing a deployed AI agent (a stricter safety gate, a new model), organizations must approve the change, starting from existing logs. `agent-risk` extends classical risk analysis to partial records and partial changes to running systems: it replays logged episodes under the proposed change, assuming nothing else changes and the agent does not anticipate the change. The log settles episodes that act as before, a declared stop value settles stopped ones, and the rest need logged support, a saved-state rerun, or a bound.
+
+> [!NOTE]
+> This repository accompanies the paper *agent-risk: Risk Assessment for Changes to AI Agents* by Yue Zhao, Zixiang Xu, Angela Huyue Zhang, S. Alex Yang, and Xiyang Hu (arXiv preprint, 2026). It holds the Python package, the 15 finite checks, the experiment code, the registrations, and the survey; the 3.5 GB of run logs are on [Hugging Face](https://huggingface.co/datasets/yzhao062/agent-risk-logs).
+
+## What It Answers
+
+Replay a proposed change over each logged episode and sort the episode by what happens at its first deviation from the log:
+
+| Case | Under the change, the episode... | What settles it | In this repository |
+|---|---|---|---|
+| **Agree** | acts exactly as logged | The log itself | `replay_stop` |
+| **Stop** | is stopped at its first deviation | A declared stop value (needs per-step harm in the log) | `replay_stop`, `certify_replay` |
+| **Continue** | continues past its first deviation | Logged support, a rerun from a saved state, or a bound | `retry_harm_bounds`; saved-state reruns in [`experiments/`](https://github.com/yzhao062/agent-risk/tree/main/experiments) |
+
+## Key Results
+
+**One log, two gates, half the agent calls.** In a bash sandbox, a 7,200-episode log alone decided neither of two retry gates, which let the agent act after refusals the log never shows. Rerunning only each gate's blocked episodes from saved states reached both live decisions at half the agent calls of a live test sized post hoc for them, given the log.
+
+**Per-step harm decides whether a stop can be replayed.** Without per-step harm, a stopping gate's certified harm ceiling rose up to 2.5-fold, since the log hides whether harm preceded the stop.
+
+**A new model needs new evidence.** The new model reproduced none of 99 logged episodes, so replay settled none; the same model reproduced every one at logged inputs and seeds. A model release needs support, bounds, or new runs from step 0.
+
+## Install
+
+```bash
+pip install ai-agent-risk
+```
+
+Or install from GitHub with `pip install git+https://github.com/yzhao062/agent-risk`, or clone the repository and run `pip install .` at its root. The distribution name is `ai-agent-risk`; the import name is `agent_risk`. Requires Python 3.9 or later, NumPy (>= 1.20), and SciPy (>= 1.7).
+
+## Quickstart
+
+The snippet below replays three episodes under a stopping gate (theta = 0.94), computes replayed harm, failure, and cost, certifies an exact Clopper-Pearson upper bound on harm, and bounds harm under a retry gate:
+
+```python
+from agent_risk import Episode, certify_replay, replay_stop, retry_harm_bounds
+
+scores, cost = [0.10, 0.20, 0.97, 0.30], [10, 20, 30, 40]
+episodes = [
+    Episode(scores, [False, True, False, False], cost, failed=False),  # harm at step 1
+    Episode(scores, [False, False, False, True], cost, failed=False),  # harm at step 3
+    Episode([0.10, 0.20], [False, False], [10, 20], failed=False),     # never above 0.94
+]
+
+replay = replay_stop(episodes, theta=0.94)
+print(replay.branches, replay.stop_steps)  # ('stop', 'stop', 'agree') (2, 2, None)
+print(round(replay.p_harm, 3))             # 0.333: only the step-1 harm survives
+print(round(replay.p_failure, 3))          # 0.667: a stop counts as a failure by default
+print(replay.mean_cost)                    # 50.0 = (60 + 60 + 30) / 3
+print(round(replay.stop_mass, 3), round(replay.stop_clean_share, 3))  # 0.667 0.333
+
+cert = certify_replay(replay, alpha=0.05)
+print(cert.n_harmed, cert.n, round(cert.upper, 3))  # 1 3 0.865
+
+bounds = retry_harm_bounds(episodes, theta=0.94, cap=2)
+print([round(v, 3) for v in bounds.interval])       # [0.333, 0.667]
+```
+
+<details>
+<summary><b>Loading logs and comparing two policies</b></summary>
+
+Logs load from JSON Lines, with `null` marking unobserved harm:
+
+```python
+from agent_risk import load_jsonl
+
+lines = ['{"scores": [0.1, 0.97], "harm": [false, null], "cost": [5, 6], "failed": false}']
+episodes = load_jsonl(lines)  # or load_jsonl("log.jsonl")
+```
+
+Paired comparisons and equivalence tests:
+
+```python
+from agent_risk import is_equivalent, newcombe_paired_interval
+
+ci = newcombe_paired_interval(both=40, first_only=1, second_only=2, neither=57, level=0.90)
+print(round(ci.estimate, 3), round(ci.lower, 3), round(ci.upper, 3))  # -0.01 -0.043 0.023
+print(is_equivalent(ci, margin=0.10))  # True: equivalent at alpha = 0.05
+```
+
+</details>
+
+## Reproduce the Paper
+
+1. **Get the logs.** Download the dataset into `data/` from the repository root; [`data/README.md`](https://github.com/yzhao062/agent-risk/blob/main/data/README.md) explains the layout, checksums, and redactions.
+
+   ```bash
+   hf download yzhao062/agent-risk-logs --repo-type dataset --local-dir data \
+     --include "logs/*" "arm-e/*" MANIFEST.tsv REDACTIONS.tsv
+   ```
+
+2. **Regenerate the numbers.** [`ARTIFACT.md`](https://github.com/yzhao062/agent-risk/blob/main/ARTIFACT.md) maps every table and figure of the paper to its logs, its registration, and its command (A1 to A39). The commands write to `outputs/` and leave `data/` untouched.
+3. **Check the theory.** `python checks/run_all.py` runs the 15 finite checks of the formal results ([`checks/README.md`](https://github.com/yzhao062/agent-risk/blob/main/checks/README.md)).
+
+> [!TIP]
+> On the released logs, the documented commands reproduce every number of the registered analyses, and the figure script regenerates the paper's Figures D.1 to D.3. To rerun experiments live (served models, ControlArena, tau2-bench), see [`experiments/RUNNING.md`](https://github.com/yzhao062/agent-risk/blob/main/experiments/RUNNING.md).
+
+<details>
+<summary><b>Repository map</b></summary>
+
+| Directory / File | Description |
+|---|---|
+| [`src/agent_risk/`](https://github.com/yzhao062/agent-risk/tree/main/src/agent_risk) | Core Python package: episode representation, stopping replay, retry bounds, exact Clopper-Pearson certification, and paired Newcombe confidence intervals. |
+| [`tests/`](https://github.com/yzhao062/agent-risk/tree/main/tests) | Unit and regression tests (149) covering replay algorithms, stop valuations, bounds, and paper test vectors. |
+| [`checks/`](https://github.com/yzhao062/agent-risk/tree/main/checks) | 15 finite-instance check scripts verifying the theorems, combinatorial bounds, and design invariants. |
+| [`experiments/`](https://github.com/yzhao062/agent-risk/tree/main/experiments) | Experiment harness, run scripts, analysis and post hoc scripts, and the figure script. |
+| [`registrations/`](https://github.com/yzhao062/agent-risk/tree/main/registrations) | Registration documents for the paper's runs (sample sizes, analysis rules, margins, prediction hashes), each with its registration time, and the run records. |
+| [`data/`](https://github.com/yzhao062/agent-risk/tree/main/data) | Log manifest, SHA-256 checksums, redaction records, run manifests, and download instructions. |
+| [`survey/`](https://github.com/yzhao062/agent-risk/tree/main/survey) | The characteristic survey: 23 coded sources with their recorded versions, 30 AI Incident Database incidents, the 20-code codebook, both coders' matrices, and the agreement script. |
+| [`supplement/`](https://github.com/yzhao062/agent-risk/tree/main/supplement) | Companion files for the paper's appendices. |
+| [`ARTIFACT.md`](https://github.com/yzhao062/agent-risk/blob/main/ARTIFACT.md) | The artifact guide: paper names and run codes, verbatim prompts and policies, and every reproduction command. |
+
+</details>
+
+<details>
+<summary><b>Running the tests</b></summary>
+
+```bash
+pip install ".[test]"
+pytest
+```
+
+This runs the 149 tests in [`tests/`](https://github.com/yzhao062/agent-risk/tree/main/tests). Without the optional `statsmodels`, two comparison tests are skipped (147 passed, 2 skipped).
+
+</details>
+
+## Citation
+
+```bibtex
+@article{zhao2026agentrisk,
+  title   = {agent-risk: Risk Assessment for Changes to AI Agents},
+  author  = {Zhao, Yue and Xu, Zixiang and Zhang, Angela Huyue and Yang, S. Alex and Hu, Xiyang},
+  journal = {arXiv preprint},
+  year    = {2026}
+}
+```
+
+## License
+
+The code is under the [BSD 2-Clause License](https://github.com/yzhao062/agent-risk/blob/main/LICENSE). The logs on [Hugging Face](https://huggingface.co/datasets/yzhao062/agent-risk-logs) are under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) ([`LICENSE-DATA.md`](https://github.com/yzhao062/agent-risk/blob/main/LICENSE-DATA.md)).
+
+<details>
+<summary><b>Third-party components</b></summary>
+
+- **ControlArena**: task definitions, environments, and bash tool harnesses (used in all bash-environment runs) derive from [ControlArena](https://github.com/UKGovernmentBEIS/control-arena), under the [MIT License](https://opensource.org/licenses/MIT).
+- **tau2-bench**: airline customer-support tasks, dialogue environments, and the customer simulator (used in the airline runs, E3 and E5) derive from [tau2-bench](https://github.com/sierra-research/tau2-bench), under the [MIT License](https://opensource.org/licenses/MIT).
+- **Qwen models**: the agent and monitor models (Qwen3-14B-FP8, Qwen3-14B, Qwen3-4B-Instruct-2507, Qwen3.5-27B-FP8, Qwen2.5-14B-Instruct) are released by their developers under the [Apache-2.0 License](https://www.apache.org/licenses/LICENSE-2.0). Neither this repository nor the dataset contains model weights.
+
+</details>
+
+<p align="right"><a href="#readme-top">↑ back to top</a></p>

ai_agent_risk-0.1.0/README.md

@@ -0,0 +1,172 @@
+<a name="readme-top"></a>
+
+<div align="center">
+
+# agent-risk
+
+**Risk assessment for changes to AI agents, starting from the logs you already have**
+
+[![PyPI](https://img.shields.io/pypi/v/ai-agent-risk.svg?color=blue)](https://pypi.org/project/ai-agent-risk/)
+[![Python](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/)
+[![CI](https://github.com/yzhao062/agent-risk/actions/workflows/ci.yml/badge.svg)](https://github.com/yzhao062/agent-risk/actions/workflows/ci.yml)
+[![License](https://img.shields.io/badge/License-BSD_2--Clause-blue.svg)](https://github.com/yzhao062/agent-risk/blob/main/LICENSE)
+[![Dataset](https://img.shields.io/badge/Hugging%20Face-agent--risk--logs-yellow.svg)](https://huggingface.co/datasets/yzhao062/agent-risk-logs)
+
+[What It Answers](#what-it-answers) · [Key Results](#key-results) · [Install](#install) · [Quickstart](#quickstart) · [Reproduce the Paper](#reproduce-the-paper) · [Citation](#citation)
+
+<img src="https://raw.githubusercontent.com/yzhao062/agent-risk/main/docs/figure1.png" alt="Replaying a logged episode under a proposed change: the log settles agreeing episodes, a declared stop value settles stopped ones, and continuing ones need logged support, a snapshot run, or a bound" width="100%">
+
+</div>
+
+Before changing a deployed AI agent (a stricter safety gate, a new model), organizations must approve the change, starting from existing logs. `agent-risk` extends classical risk analysis to partial records and partial changes to running systems: it replays logged episodes under the proposed change, assuming nothing else changes and the agent does not anticipate the change. The log settles episodes that act as before, a declared stop value settles stopped ones, and the rest need logged support, a saved-state rerun, or a bound.
+
+> [!NOTE]
+> This repository accompanies the paper *agent-risk: Risk Assessment for Changes to AI Agents* by Yue Zhao, Zixiang Xu, Angela Huyue Zhang, S. Alex Yang, and Xiyang Hu (arXiv preprint, 2026). It holds the Python package, the 15 finite checks, the experiment code, the registrations, and the survey; the 3.5 GB of run logs are on [Hugging Face](https://huggingface.co/datasets/yzhao062/agent-risk-logs).
+
+## What It Answers
+
+Replay a proposed change over each logged episode and sort the episode by what happens at its first deviation from the log:
+
+| Case | Under the change, the episode... | What settles it | In this repository |
+|---|---|---|---|
+| **Agree** | acts exactly as logged | The log itself | `replay_stop` |
+| **Stop** | is stopped at its first deviation | A declared stop value (needs per-step harm in the log) | `replay_stop`, `certify_replay` |
+| **Continue** | continues past its first deviation | Logged support, a rerun from a saved state, or a bound | `retry_harm_bounds`; saved-state reruns in [`experiments/`](https://github.com/yzhao062/agent-risk/tree/main/experiments) |
+
+## Key Results
+
+**One log, two gates, half the agent calls.** In a bash sandbox, a 7,200-episode log alone decided neither of two retry gates, which let the agent act after refusals the log never shows. Rerunning only each gate's blocked episodes from saved states reached both live decisions at half the agent calls of a live test sized post hoc for them, given the log.
+
+**Per-step harm decides whether a stop can be replayed.** Without per-step harm, a stopping gate's certified harm ceiling rose up to 2.5-fold, since the log hides whether harm preceded the stop.
+
+**A new model needs new evidence.** The new model reproduced none of 99 logged episodes, so replay settled none; the same model reproduced every one at logged inputs and seeds. A model release needs support, bounds, or new runs from step 0.
+
+## Install
+
+```bash
+pip install ai-agent-risk
+```
+
+Or install from GitHub with `pip install git+https://github.com/yzhao062/agent-risk`, or clone the repository and run `pip install .` at its root. The distribution name is `ai-agent-risk`; the import name is `agent_risk`. Requires Python 3.9 or later, NumPy (>= 1.20), and SciPy (>= 1.7).
+
+## Quickstart
+
+The snippet below replays three episodes under a stopping gate (theta = 0.94), computes replayed harm, failure, and cost, certifies an exact Clopper-Pearson upper bound on harm, and bounds harm under a retry gate:
+
+```python
+from agent_risk import Episode, certify_replay, replay_stop, retry_harm_bounds
+
+scores, cost = [0.10, 0.20, 0.97, 0.30], [10, 20, 30, 40]
+episodes = [
+    Episode(scores, [False, True, False, False], cost, failed=False),  # harm at step 1
+    Episode(scores, [False, False, False, True], cost, failed=False),  # harm at step 3
+    Episode([0.10, 0.20], [False, False], [10, 20], failed=False),     # never above 0.94
+]
+
+replay = replay_stop(episodes, theta=0.94)
+print(replay.branches, replay.stop_steps)  # ('stop', 'stop', 'agree') (2, 2, None)
+print(round(replay.p_harm, 3))             # 0.333: only the step-1 harm survives
+print(round(replay.p_failure, 3))          # 0.667: a stop counts as a failure by default
+print(replay.mean_cost)                    # 50.0 = (60 + 60 + 30) / 3
+print(round(replay.stop_mass, 3), round(replay.stop_clean_share, 3))  # 0.667 0.333
+
+cert = certify_replay(replay, alpha=0.05)
+print(cert.n_harmed, cert.n, round(cert.upper, 3))  # 1 3 0.865
+
+bounds = retry_harm_bounds(episodes, theta=0.94, cap=2)
+print([round(v, 3) for v in bounds.interval])       # [0.333, 0.667]
+```
+
+<details>
+<summary><b>Loading logs and comparing two policies</b></summary>
+
+Logs load from JSON Lines, with `null` marking unobserved harm:
+
+```python
+from agent_risk import load_jsonl
+
+lines = ['{"scores": [0.1, 0.97], "harm": [false, null], "cost": [5, 6], "failed": false}']
+episodes = load_jsonl(lines)  # or load_jsonl("log.jsonl")
+```
+
+Paired comparisons and equivalence tests:
+
+```python
+from agent_risk import is_equivalent, newcombe_paired_interval
+
+ci = newcombe_paired_interval(both=40, first_only=1, second_only=2, neither=57, level=0.90)
+print(round(ci.estimate, 3), round(ci.lower, 3), round(ci.upper, 3))  # -0.01 -0.043 0.023
+print(is_equivalent(ci, margin=0.10))  # True: equivalent at alpha = 0.05
+```
+
+</details>
+
+## Reproduce the Paper
+
+1. **Get the logs.** Download the dataset into `data/` from the repository root; [`data/README.md`](https://github.com/yzhao062/agent-risk/blob/main/data/README.md) explains the layout, checksums, and redactions.
+
+   ```bash
+   hf download yzhao062/agent-risk-logs --repo-type dataset --local-dir data \
+     --include "logs/*" "arm-e/*" MANIFEST.tsv REDACTIONS.tsv
+   ```
+
+2. **Regenerate the numbers.** [`ARTIFACT.md`](https://github.com/yzhao062/agent-risk/blob/main/ARTIFACT.md) maps every table and figure of the paper to its logs, its registration, and its command (A1 to A39). The commands write to `outputs/` and leave `data/` untouched.
+3. **Check the theory.** `python checks/run_all.py` runs the 15 finite checks of the formal results ([`checks/README.md`](https://github.com/yzhao062/agent-risk/blob/main/checks/README.md)).
+
+> [!TIP]
+> On the released logs, the documented commands reproduce every number of the registered analyses, and the figure script regenerates the paper's Figures D.1 to D.3. To rerun experiments live (served models, ControlArena, tau2-bench), see [`experiments/RUNNING.md`](https://github.com/yzhao062/agent-risk/blob/main/experiments/RUNNING.md).
+
+<details>
+<summary><b>Repository map</b></summary>
+
+| Directory / File | Description |
+|---|---|
+| [`src/agent_risk/`](https://github.com/yzhao062/agent-risk/tree/main/src/agent_risk) | Core Python package: episode representation, stopping replay, retry bounds, exact Clopper-Pearson certification, and paired Newcombe confidence intervals. |
+| [`tests/`](https://github.com/yzhao062/agent-risk/tree/main/tests) | Unit and regression tests (149) covering replay algorithms, stop valuations, bounds, and paper test vectors. |
+| [`checks/`](https://github.com/yzhao062/agent-risk/tree/main/checks) | 15 finite-instance check scripts verifying the theorems, combinatorial bounds, and design invariants. |
+| [`experiments/`](https://github.com/yzhao062/agent-risk/tree/main/experiments) | Experiment harness, run scripts, analysis and post hoc scripts, and the figure script. |
+| [`registrations/`](https://github.com/yzhao062/agent-risk/tree/main/registrations) | Registration documents for the paper's runs (sample sizes, analysis rules, margins, prediction hashes), each with its registration time, and the run records. |
+| [`data/`](https://github.com/yzhao062/agent-risk/tree/main/data) | Log manifest, SHA-256 checksums, redaction records, run manifests, and download instructions. |
+| [`survey/`](https://github.com/yzhao062/agent-risk/tree/main/survey) | The characteristic survey: 23 coded sources with their recorded versions, 30 AI Incident Database incidents, the 20-code codebook, both coders' matrices, and the agreement script. |
+| [`supplement/`](https://github.com/yzhao062/agent-risk/tree/main/supplement) | Companion files for the paper's appendices. |
+| [`ARTIFACT.md`](https://github.com/yzhao062/agent-risk/blob/main/ARTIFACT.md) | The artifact guide: paper names and run codes, verbatim prompts and policies, and every reproduction command. |
+
+</details>
+
+<details>
+<summary><b>Running the tests</b></summary>
+
+```bash
+pip install ".[test]"
+pytest
+```
+
+This runs the 149 tests in [`tests/`](https://github.com/yzhao062/agent-risk/tree/main/tests). Without the optional `statsmodels`, two comparison tests are skipped (147 passed, 2 skipped).
+
+</details>
+
+## Citation
+
+```bibtex
+@article{zhao2026agentrisk,
+  title   = {agent-risk: Risk Assessment for Changes to AI Agents},
+  author  = {Zhao, Yue and Xu, Zixiang and Zhang, Angela Huyue and Yang, S. Alex and Hu, Xiyang},
+  journal = {arXiv preprint},
+  year    = {2026}
+}
+```
+
+## License
+
+The code is under the [BSD 2-Clause License](https://github.com/yzhao062/agent-risk/blob/main/LICENSE). The logs on [Hugging Face](https://huggingface.co/datasets/yzhao062/agent-risk-logs) are under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) ([`LICENSE-DATA.md`](https://github.com/yzhao062/agent-risk/blob/main/LICENSE-DATA.md)).
+
+<details>
+<summary><b>Third-party components</b></summary>
+
+- **ControlArena**: task definitions, environments, and bash tool harnesses (used in all bash-environment runs) derive from [ControlArena](https://github.com/UKGovernmentBEIS/control-arena), under the [MIT License](https://opensource.org/licenses/MIT).
+- **tau2-bench**: airline customer-support tasks, dialogue environments, and the customer simulator (used in the airline runs, E3 and E5) derive from [tau2-bench](https://github.com/sierra-research/tau2-bench), under the [MIT License](https://opensource.org/licenses/MIT).
+- **Qwen models**: the agent and monitor models (Qwen3-14B-FP8, Qwen3-14B, Qwen3-4B-Instruct-2507, Qwen3.5-27B-FP8, Qwen2.5-14B-Instruct) are released by their developers under the [Apache-2.0 License](https://www.apache.org/licenses/LICENSE-2.0). Neither this repository nor the dataset contains model weights.
+
+</details>
+
+<p align="right"><a href="#readme-top">↑ back to top</a></p>

ai_agent_risk-0.1.0/pyproject.toml

@@ -0,0 +1,67 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "ai-agent-risk"
+dynamic = ["version"]
+description = "Risk modeling for AI agents from logs: replay a proposed change over logged episodes and separate what the log settles, what a declared stop valuation fixes, and what needs bounds."
+readme = "README.md"
+requires-python = ">=3.9"
+license = "BSD-2-Clause"
+license-files = ["LICENSE"]
+authors = [
+    { name = "Yue Zhao", email = "yzhao062@gmail.com" },
+    { name = "Zixiang Xu" },
+    { name = "Angela Huyue Zhang" },
+    { name = "S. Alex Yang" },
+    { name = "Xiyang Hu" },
+]
+
+keywords = [
+    "ai agents",
+    "risk",
+    "monitoring",
+    "counterfactual replay",
+    "clopper-pearson",
+    "paired proportions",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Science/Research",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Scientific/Engineering :: Artificial Intelligence",
+    "Topic :: Scientific/Engineering :: Mathematics",
+    "Typing :: Typed",
+]
+dependencies = ["numpy>=1.20", "scipy>=1.7"]
+
+[project.urls]
+Homepage = "https://github.com/yzhao062/agent-risk"
+Repository = "https://github.com/yzhao062/agent-risk"
+Issues = "https://github.com/yzhao062/agent-risk/issues"
+Dataset = "https://huggingface.co/datasets/yzhao062/agent-risk-logs"
+
+[project.optional-dependencies]
+test = ["pytest>=7"]
+
+[tool.setuptools.dynamic]
+version = { attr = "agent_risk.__version__" }
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+agent_risk = ["py.typed"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+filterwarnings = ["error"]

ai_agent_risk-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

ai_agent_risk-0.1.0/src/agent_risk/__init__.py

@@ -0,0 +1,53 @@
+"""Risk modeling for AI agents from logs.
+
+Replay a proposed change over logged episodes and separate what the log
+settles, what a declared stop valuation fixes, and what needs bounds.
+
+Main entry points:
+
+* :class:`Episode`, :func:`load_episodes`, :func:`load_jsonl`: logged data.
+* :func:`replay_stop`, :class:`StopValuation`: replay of a stopping gate.
+* :func:`retry_harm_bounds`: outer interval for a retry gate.
+* :func:`clopper_pearson_upper`, :func:`certify`, :func:`certify_replay`,
+  :func:`compare_logging_schemes`: certified harm bounds.
+* :func:`newcombe_paired_interval`, :func:`is_equivalent`: paired comparison.
+"""
+
+from .certify import (
+    Certificate,
+    LoggingComparison,
+    certify,
+    certify_replay,
+    clopper_pearson_upper,
+    compare_logging_schemes,
+)
+from .episode import Episode, any_harm, load_episodes, load_jsonl
+from .paired import PairedInterval, is_equivalent, newcombe_paired_interval, wilson_interval
+from .retry import RetryBounds, retry_harm_bounds
+from .stopping import EpisodeReplay, StopReplay, StopValuation, replay_stop
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "__version__",
+    "Certificate",
+    "Episode",
+    "EpisodeReplay",
+    "LoggingComparison",
+    "PairedInterval",
+    "RetryBounds",
+    "StopReplay",
+    "StopValuation",
+    "any_harm",
+    "certify",
+    "certify_replay",
+    "clopper_pearson_upper",
+    "compare_logging_schemes",
+    "is_equivalent",
+    "load_episodes",
+    "load_jsonl",
+    "newcombe_paired_interval",
+    "replay_stop",
+    "retry_harm_bounds",
+    "wilson_interval",
+]

ai_agent_risk-0.1.0/src/agent_risk/_checks.py

@@ -0,0 +1,25 @@
+"""Shared input checks."""
+
+from __future__ import annotations
+
+import numbers
+
+
+def check_count(value: object, name: str) -> int:
+    """Return ``value`` as a non-negative ``int`` or raise."""
+    if isinstance(value, bool) or not isinstance(value, numbers.Integral):
+        raise TypeError(f"{name} must be an integer, got {value!r}")
+    value = int(value)
+    if value < 0:
+        raise ValueError(f"{name} must be non-negative, got {value}")
+    return value
+
+
+def check_open_unit(value: object, name: str) -> float:
+    """Return ``value`` as a ``float`` in the open interval (0, 1) or raise."""
+    if isinstance(value, bool) or not isinstance(value, numbers.Real):
+        raise TypeError(f"{name} must be a real number, got {value!r}")
+    value = float(value)
+    if not 0.0 < value < 1.0:
+        raise ValueError(f"{name} must lie in (0, 1), got {value}")
+    return value