aiap-client 1.0.1__tar.gz

aiap_client-1.0.1/LICENSE.md

@@ -0,0 +1,65 @@
+# aiap-client License
+
+Version 1.0, August 2026
+
+**Copyright © 2026 Kanjani AI Research & Causum. All rights reserved.**
+
+This package implements the AI Agency Protocol (AIAP), a proprietary
+specification. It is **not** open source and **not** source available.
+Publication to a public package index is a distribution convenience and does
+not constitute an open-source grant. Commercial licensing is administered
+exclusively by Causum.
+
+## Free use — Evaluation
+
+You may, at no fee and without time limit:
+
+- Read, study, and reference this package and the Protocol specification
+- Install and run this package in non-production environments
+- Prototype, experiment with, and test conformance of implementations
+- Publish independent research concerning the Protocol, with attribution
+
+"Evaluation Use" means use outside of production operation and not in support
+of any revenue-generating product, service, or business process.
+
+## Paid use — Operating License required
+
+You require an Operating License to derive Commercial Value from this package.
+Commercial Value means economic benefit derived from the Protocol, **whether or
+not the Protocol or any implementation of it is itself sold, licensed, or
+otherwise transferred to any third party.** Operating this package in
+production in support of any product, service, or internal business process
+that generates revenue requires an Operating License.
+
+Commercial resale of this package, agency-brokerage services whose primary
+value proposition is the Protocol itself, or Protocol-as-a-Service offerings is
+prohibited without a separate commercial license agreement.
+
+## Restrictions
+
+You shall not fork, rebrand, or republish this package under a different name
+or identity; remove or alter copyright notices, license headers, or attribution
+statements; or use the names "AIAP" or "AI Agency Protocol" in a product name,
+service name, or marketing material without prior written consent.
+
+## Reservation of rights
+
+All patent rights are expressly reserved. No patent license is granted, whether
+expressly, by implication, by estoppel, by publication, by package-index
+distribution, or otherwise. All rights not expressly granted are reserved.
+
+## No warranty
+
+THIS PACKAGE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+OWNER BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM USE OF
+THIS PACKAGE.
+
+---
+
+The full agreement, including the DFARS 252.227-7013 federal-grant carve-out,
+governs this package and is available in the protocol repository:
+https://gitlab.com/causum/aiap/-/blob/main/LICENSE.md
+
+Licensing inquiries: owner@ai-governance-protocol.org or licensing@causum.com

aiap_client-1.0.1/PKG-INFO

@@ -0,0 +1,163 @@
+Metadata-Version: 2.5
+Name: aiap-client
+Version: 1.0.1
+Summary: AI Agency Protocol (AIAP) client — identity, scope, and ephemeral authority for AI agents
+Author-email: Kanjani AI Research & Causum <owner@ai-governance-protocol.org>
+License: # aiap-client License
+        
+        Version 1.0, August 2026
+        
+        **Copyright © 2026 Kanjani AI Research & Causum. All rights reserved.**
+        
+        This package implements the AI Agency Protocol (AIAP), a proprietary
+        specification. It is **not** open source and **not** source available.
+        Publication to a public package index is a distribution convenience and does
+        not constitute an open-source grant. Commercial licensing is administered
+        exclusively by Causum.
+        
+        ## Free use — Evaluation
+        
+        You may, at no fee and without time limit:
+        
+        - Read, study, and reference this package and the Protocol specification
+        - Install and run this package in non-production environments
+        - Prototype, experiment with, and test conformance of implementations
+        - Publish independent research concerning the Protocol, with attribution
+        
+        "Evaluation Use" means use outside of production operation and not in support
+        of any revenue-generating product, service, or business process.
+        
+        ## Paid use — Operating License required
+        
+        You require an Operating License to derive Commercial Value from this package.
+        Commercial Value means economic benefit derived from the Protocol, **whether or
+        not the Protocol or any implementation of it is itself sold, licensed, or
+        otherwise transferred to any third party.** Operating this package in
+        production in support of any product, service, or internal business process
+        that generates revenue requires an Operating License.
+        
+        Commercial resale of this package, agency-brokerage services whose primary
+        value proposition is the Protocol itself, or Protocol-as-a-Service offerings is
+        prohibited without a separate commercial license agreement.
+        
+        ## Restrictions
+        
+        You shall not fork, rebrand, or republish this package under a different name
+        or identity; remove or alter copyright notices, license headers, or attribution
+        statements; or use the names "AIAP" or "AI Agency Protocol" in a product name,
+        service name, or marketing material without prior written consent.
+        
+        ## Reservation of rights
+        
+        All patent rights are expressly reserved. No patent license is granted, whether
+        expressly, by implication, by estoppel, by publication, by package-index
+        distribution, or otherwise. All rights not expressly granted are reserved.
+        
+        ## No warranty
+        
+        THIS PACKAGE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        OWNER BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM USE OF
+        THIS PACKAGE.
+        
+        ---
+        
+        The full agreement, including the DFARS 252.227-7013 federal-grant carve-out,
+        governs this package and is available in the protocol repository:
+        https://gitlab.com/causum/aiap/-/blob/main/LICENSE.md
+        
+        Licensing inquiries: owner@ai-governance-protocol.org or licensing@causum.com
+License-File: LICENSE.md
+Keywords: agency,agents,ai,aiap,credentials,identity,jit,protocol
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Requires-Python: >=3.11
+Requires-Dist: httpx>=0.25.0
+Requires-Dist: pydantic>=2.0
+Provides-Extra: aws
+Requires-Dist: boto3>=1.26.0; extra == 'aws'
+Provides-Extra: cert
+Requires-Dist: cryptography>=41.0; extra == 'cert'
+Provides-Extra: dev
+Requires-Dist: pytest; extra == 'dev'
+Requires-Dist: pytest-asyncio; extra == 'dev'
+Requires-Dist: respx; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# aiap-client — AI Agency Protocol SDK
+
+**Identity is persistent. Agency is ephemeral.**
+
+Python SDK for the AI Agency Protocol (AIAP). Enables agents to request scoped, time-limited authority from a central broker.
+
+## Install
+
+```bash
+pip install aiap-client
+pip install aiap-client[aws]   # + boto3 for credential sessions
+pip install aiap-client[cert]  # + cryptography for certificate auth
+```
+
+## Quick Start
+
+```python
+from aiap_client import AgencyClient, AgencyLevel
+
+client = AgencyClient(
+    broker_url="https://www.cyber-ai-scim.com",
+    agent_id="YXFQTW0VCL",
+    mac_secret="your-hmac-secret",
+)
+
+# Request JIT credentials
+grant = await client.request_agency(
+    intent="Invoke underwriting model",
+    use_case="underwriting",
+    resources=["bedrock:InvokeModel"],
+    duration_seconds=900,
+)
+
+if grant.granted:
+    session = grant.to_boto3_session(region="us-east-1")
+    bedrock = session.client("bedrock-runtime")
+    # Invoke with scoped creds — expires in 15 min
+else:
+    print(f"Denied: {grant.reason}")
+```
+
+## Mediated Execution (Level 2)
+
+Agent never sees credentials:
+
+```python
+result = await client.execute(
+    intent="Invoke model for risk assessment",
+    use_case="underwriting",
+    action="bedrock:InvokeModel",
+    parameters={"modelId": "anthropic.claude-sonnet-4-6", "body": {...}},
+)
+print(result.output)  # Only the result
+```
+
+## Certificate Authentication
+
+```python
+from aiap_client import AgencyClient, CertificateSigner
+
+client = AgencyClient(
+    broker_url="https://www.cyber-ai-scim.com",
+    agent_id="YXFQTW0VCL",
+    signer=CertificateSigner(cert_path="agent.pem", key_path="agent-key.pem"),
+)
+```
+
+## Protocol
+
+See [RFC-001: AI Agency Protocol](../../../specification/RFC-001-AI-Agency-Protocol.md)

aiap_client-1.0.1/README.md

@@ -0,0 +1,70 @@
+# aiap-client — AI Agency Protocol SDK
+
+**Identity is persistent. Agency is ephemeral.**
+
+Python SDK for the AI Agency Protocol (AIAP). Enables agents to request scoped, time-limited authority from a central broker.
+
+## Install
+
+```bash
+pip install aiap-client
+pip install aiap-client[aws]   # + boto3 for credential sessions
+pip install aiap-client[cert]  # + cryptography for certificate auth
+```
+
+## Quick Start
+
+```python
+from aiap_client import AgencyClient, AgencyLevel
+
+client = AgencyClient(
+    broker_url="https://www.cyber-ai-scim.com",
+    agent_id="YXFQTW0VCL",
+    mac_secret="your-hmac-secret",
+)
+
+# Request JIT credentials
+grant = await client.request_agency(
+    intent="Invoke underwriting model",
+    use_case="underwriting",
+    resources=["bedrock:InvokeModel"],
+    duration_seconds=900,
+)
+
+if grant.granted:
+    session = grant.to_boto3_session(region="us-east-1")
+    bedrock = session.client("bedrock-runtime")
+    # Invoke with scoped creds — expires in 15 min
+else:
+    print(f"Denied: {grant.reason}")
+```
+
+## Mediated Execution (Level 2)
+
+Agent never sees credentials:
+
+```python
+result = await client.execute(
+    intent="Invoke model for risk assessment",
+    use_case="underwriting",
+    action="bedrock:InvokeModel",
+    parameters={"modelId": "anthropic.claude-sonnet-4-6", "body": {...}},
+)
+print(result.output)  # Only the result
+```
+
+## Certificate Authentication
+
+```python
+from aiap_client import AgencyClient, CertificateSigner
+
+client = AgencyClient(
+    broker_url="https://www.cyber-ai-scim.com",
+    agent_id="YXFQTW0VCL",
+    signer=CertificateSigner(cert_path="agent.pem", key_path="agent-key.pem"),
+)
+```
+
+## Protocol
+
+See [RFC-001: AI Agency Protocol](../../../specification/RFC-001-AI-Agency-Protocol.md)

aiap_client-1.0.1/SPEC.md

@@ -0,0 +1,212 @@
+# AIAP Python SDK — Specification
+
+**Package:** `aiap-client`  
+**Version:** 1.0.0  
+**Python:** >=3.11  
+**Dependencies:** `httpx>=0.25.0`, `pydantic>=2.0`
+
+---
+
+## Purpose
+
+The `aiap-client` SDK enables agents, applications, and helpers to:
+1. Request agency (JIT credentials or mediated execution)
+2. Authenticate with MAC or certificate
+3. Manage credential lifecycle (refresh, revoke)
+4. Record agency decisions for audit
+
+---
+
+## Public API
+
+```python
+from aiap_client import (
+    # Core
+    AgencyClient,
+    
+    # Models
+    AgencyRequest,
+    AgencyGrant,
+    AgencyDeny,
+    AgencyRevoke,
+    AgencyLevel,
+    SafetyTier,
+    
+    # Credentials
+    AgencyCredentials,
+    CredentialSession,
+    
+    # Authentication
+    MacSigner,
+    CertificateSigner,
+)
+```
+
+---
+
+## Usage
+
+### Basic: Request JIT Credentials
+
+```python
+from aiap_client import AgencyClient, AgencyRequest, AgencyLevel
+
+client = AgencyClient(
+    broker_url="https://www.cyber-ai-scim.com",
+    agent_id="YXFQTW0VCL",
+    mac_secret="d918eb5081ca19eaf6081882df70e3cd...",
+)
+
+# Request agency
+grant = await client.request_agency(
+    intent="Invoke underwriting model for applicant risk assessment",
+    use_case="underwriting",
+    resources=["bedrock:InvokeModel"],
+    resource_arns=["arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-sonnet-4-6"],
+    duration_seconds=900,
+)
+
+if grant.granted:
+    # Use the scoped credentials
+    session = grant.to_boto3_session()
+    bedrock = session.client("bedrock-runtime", region_name="us-east-1")
+    # ... invoke model with JIT creds
+else:
+    print(f"Denied: {grant.reason}")
+```
+
+### Level 2: Mediated Execution
+
+```python
+result = await client.execute(
+    intent="Invoke underwriting model",
+    use_case="underwriting",
+    action="bedrock:InvokeModel",
+    parameters={
+        "modelId": "anthropic.claude-sonnet-4-6",
+        "body": {"messages": [...]},
+    },
+)
+# Agent never sees credentials — only the result
+print(result.output)
+```
+
+### Revoke
+
+```python
+await client.revoke(decision_id="dec-a1b2c3d4e5f6")
+```
+
+### Certificate Authentication
+
+```python
+from aiap_client import AgencyClient, CertificateSigner
+
+signer = CertificateSigner(
+    cert_path="/path/to/agent-cert.pem",
+    key_path="/path/to/agent-key.pem",
+)
+
+client = AgencyClient(
+    broker_url="https://www.cyber-ai-scim.com",
+    agent_id="YXFQTW0VCL",
+    signer=signer,
+)
+```
+
+---
+
+## Module Design
+
+### `models.py`
+
+```python
+class AgencyLevel(str, Enum):
+    JIT_CREDENTIALS = "JIT_CREDENTIALS"
+    MEDIATED = "MEDIATED"
+    DELEGATED = "DELEGATED"
+
+class SafetyTier(str, Enum):
+    LOW = "LOW"
+    MEDIUM = "MEDIUM"
+    HIGH = "HIGH"
+    CRITICAL = "CRITICAL"
+
+class AgencyRequest(BaseModel):
+    agent_id: str
+    credential: str  # MAC hex or "cert:<base64>"
+    intent: str
+    use_case: str
+    resources: list[str]
+    resource_arns: list[str] = []
+    context: dict = {}
+    level: AgencyLevel = AgencyLevel.JIT_CREDENTIALS
+    duration_seconds: int = 900
+
+class AgencyCredentials(BaseModel):
+    access_key_id: str
+    secret_access_key: str
+    session_token: str
+    expiration: str
+
+class AgencyGrant(BaseModel):
+    granted: bool = True
+    decision_id: str
+    credentials: AgencyCredentials | None = None
+    source_identity: str = ""
+    session_name: str = ""
+    tags: dict = {}
+    scope: dict = {}
+    governance_checks: list[str] = []
+    expires_at: str = ""
+
+class AgencyDeny(BaseModel):
+    granted: bool = False
+    decision_id: str
+    reason: str
+    governance_checks: list[str] = []
+```
+
+### `client.py`
+
+```python
+class AgencyClient:
+    def __init__(self, broker_url, agent_id, mac_secret="", signer=None): ...
+    async def request_agency(self, intent, use_case, resources, **kwargs) -> AgencyGrant | AgencyDeny: ...
+    async def execute(self, intent, use_case, action, parameters, **kwargs) -> ExecutionResult: ...
+    async def revoke(self, decision_id) -> bool: ...
+    async def heartbeat(self, decision_id) -> bool: ...
+    async def list_sessions(self) -> list[dict]: ...
+    async def list_decisions(self, limit=20) -> list[dict]: ...
+```
+
+### `credentials.py`
+
+```python
+class CredentialSession:
+    """Wraps AgencyCredentials with auto-refresh."""
+    def __init__(self, client, grant): ...
+    def to_boto3_session(self, region="us-east-1") -> boto3.Session: ...
+    async def refresh(self) -> None: ...
+    @property
+    def is_expired(self) -> bool: ...
+    @property
+    def expires_in_seconds(self) -> int: ...
+```
+
+### `signer.py`
+
+```python
+class Signer(Protocol):
+    def sign(self, agent_id: str) -> str: ...
+
+class MacSigner:
+    """HMAC-SHA256 signing (bootstrap/legacy)."""
+    def __init__(self, secret: str): ...
+    def sign(self, agent_id: str) -> str: ...
+
+class CertificateSigner:
+    """X.509 certificate signing (production)."""
+    def __init__(self, cert_path: str, key_path: str): ...
+    def sign(self, agent_id: str) -> str: ...
+```

aiap_client-1.0.1/aiap_client/__init__.py

@@ -0,0 +1,45 @@
+"""AIAP Client v1.0.0 — AI Agency Protocol client.
+
+Provides:
+- Agency request/grant/deny lifecycle
+- JIT credential management (auto-refresh, boto3 session)
+- Mediated execution (Level 2 — agent never sees credentials)
+- MAC and certificate authentication
+- Session revocation
+"""
+
+__version__ = "1.0.1"
+
+from .client import AgencyClient
+from .models import (
+    AgencyCredentials,
+    AgencyDeny,
+    AgencyGrant,
+    AgencyLevel,
+    AgencyRequest,
+    AgencyRevoke,
+    ExecutionResult,
+    MediatedRequest,
+    SafetyTier,
+    AgencyDecisionResult,
+)
+from .credentials import CredentialSession
+from .signer import MacSigner, CertificateSigner, Signer
+
+__all__ = [
+    "AgencyClient",
+    "AgencyCredentials",
+    "AgencyDeny",
+    "AgencyGrant",
+    "AgencyLevel",
+    "AgencyRequest",
+    "AgencyRevoke",
+    "ExecutionResult",
+    "MediatedRequest",
+    "SafetyTier",
+    "AgencyDecisionResult",
+    "CredentialSession",
+    "MacSigner",
+    "CertificateSigner",
+    "Signer",
+]