atbash-hermes-plugin 0.4.10.dev1__py3-none-any.whl → 0.4.10.dev2__py3-none-any.whl

atbash_hermes_plugin/__init__.py

@@ -676,6 +676,22 @@ def _extract_allow(raw: Any) -> Optional[bool]:
     return None
 
 
+def _extract_status(raw: Any) -> str:
+    """Read the judge's server-reported `status`, lower-cased ("" when absent).
+
+    `"logged"` is the ONLY signal that a missing verdict is the AUDIT tier
+    choosing not to enforce, rather than a degraded or hostile response.
+    """
+    status_attr = getattr(raw, "status", None)
+    if isinstance(status_attr, str):
+        return status_attr.strip().lower()
+    if isinstance(raw, dict):
+        v = raw.get("status")
+        if isinstance(v, str):
+            return v.strip().lower()
+    return ""
+
+
 def _extract_reason(raw: Any) -> str:
     reason_attr = getattr(raw, "reason", None)
     if reason_attr is None:
@@ -1055,10 +1071,32 @@ class AtbashHermesGuard:
                 }
 
             if verdict == "NO VERDICT":
-                # AUDIT-tier organisations receive "No verdict" (log-only mode).
-                # Treat as ALLOW — do not block, update baseline.
-                self._snapshots[path] = new_content
-                self._hash_store.set(path, _sha256_hex(new_content))
+                # AUDIT-tier organisations receive "No verdict" (log-only mode)
+                # and the server says so explicitly with status "logged". Every
+                # other way a verdict goes missing — empty body, truncated
+                # payload, a proxy error page served as 200, a buggy or
+                # compromised judge — normalises to "No verdict" too. Allowing
+                # those would let a poisoning payload through exactly when the
+                # judge is least trustworthy AND make it the new tamper
+                # baseline. Same rule as the SDK's audit_tool_call.
+                status = _extract_status(verdict_raw)
+                if status == "logged":
+                    self._snapshots[path] = new_content
+                    self._hash_store.set(path, _sha256_hex(new_content))
+                    return None
+                logger.warning(
+                    "Atbash memory write no verdict without audit marker path=%s status=%s reason=%s",
+                    path, status or "absent", reason,
+                )
+                if self.fail_closed:
+                    return {
+                        "action": "block",
+                        "message": (
+                            "Memory write blocked (judge returned no verdict without an "
+                            f"audit-tier marker; status: {status or 'absent'}): {reason}"
+                        ),
+                    }
+                # fail-open: allow but do NOT advance baseline — content was not judged.
                 return None
 
             if verdict == "ERROR":
@@ -1088,9 +1126,8 @@ class AtbashHermesGuard:
                         f"Memory write blocked (unrecognized verdict {verdict!r}): {reason}"
                     ),
                 }
-            # fail-open: accept the write, update baseline
-            self._snapshots[path] = new_content
-            self._hash_store.set(path, _sha256_hex(new_content))
+            # fail-open: allow but do NOT advance baseline — an unrecognised
+            # verdict did not judge the content, same as ERROR / unmarked NO VERDICT.
             return None
 
         except Exception as e:

{atbash_hermes_plugin-0.4.10.dev1.dist-info → atbash_hermes_plugin-0.4.10.dev2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: atbash-hermes-plugin
-Version: 0.4.10.dev1
+Version: 0.4.10.dev2
 Summary: Atbash safety plugin for Hermes Agent
 Author: atbash
 License-Expression: LicenseRef-Atbash-Proprietary
@@ -242,6 +242,12 @@ Hermes sessions.
 - Atbash API error:
   - `ATBASH_ENFORCE_DECISION=true`: fail closed and block.
   - `ATBASH_ENFORCE_DECISION=false`: fail open and allow.
+- Memory writes (`MEMORY.md`, `CLAUDE.md`, `memory/` paths) with `No verdict`: allowed
+  and recorded as the new tamper baseline only when the judge marks the response as the
+  AUDIT tier (`status: "logged"`). Any other missing verdict — empty body, truncated
+  payload, a proxy error served as 200, a compromised judge — is blocked under
+  `ATBASH_ENFORCE_DECISION=true`; under `false` the write proceeds but is never
+  recorded as the baseline, because it was not judged.
 
 Atbash ships fail-closed on every tier. Setting `ATBASH_ENFORCE_DECISION=false`
 inverts that for this agent: a judge outage becomes a silent allow, and the

atbash_hermes_plugin-0.4.10.dev2.dist-info/RECORD

@@ -0,0 +1,7 @@
+atbash_hermes_plugin/__init__.py,sha256=M8cKJulLKG1q0bN15eTKH-27oH6y9JJIe9Ue5rUl7HM,55112
+atbash_hermes_plugin-0.4.10.dev2.dist-info/licenses/LICENSE,sha256=1vOJDJvAuOLDHJ8-Q0qDdOXZJJVli6Lr9mKKaFsOa5w,1600
+atbash_hermes_plugin-0.4.10.dev2.dist-info/METADATA,sha256=-Z4S-cH45jATOquRsGhxQAHWSVdbQcGMpCY_CBcVHsg,8547
+atbash_hermes_plugin-0.4.10.dev2.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+atbash_hermes_plugin-0.4.10.dev2.dist-info/entry_points.txt,sha256=YezkmasjRBXrSlXpqhSJdFhDCdBbENp-_THYtkcRTBo,67
+atbash_hermes_plugin-0.4.10.dev2.dist-info/top_level.txt,sha256=0nT35m8jNxzbQB3CerGf5kgH7hm_pc6GLadlf69w_JM,21
+atbash_hermes_plugin-0.4.10.dev2.dist-info/RECORD,,

atbash_hermes_plugin-0.4.10.dev1.dist-info/RECORD

@@ -1,7 +0,0 @@
-atbash_hermes_plugin/__init__.py,sha256=vd7kxSnqMGrU3oYttRM6bLw5WwU4Rg5UsDXFXtO0pt8,53307
-atbash_hermes_plugin-0.4.10.dev1.dist-info/licenses/LICENSE,sha256=1vOJDJvAuOLDHJ8-Q0qDdOXZJJVli6Lr9mKKaFsOa5w,1600
-atbash_hermes_plugin-0.4.10.dev1.dist-info/METADATA,sha256=Hc4ffzsDOASmiNASYWQ38KvfB4wt6Q4zENxAOqO3qbY,8069
-atbash_hermes_plugin-0.4.10.dev1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-atbash_hermes_plugin-0.4.10.dev1.dist-info/entry_points.txt,sha256=YezkmasjRBXrSlXpqhSJdFhDCdBbENp-_THYtkcRTBo,67
-atbash_hermes_plugin-0.4.10.dev1.dist-info/top_level.txt,sha256=0nT35m8jNxzbQB3CerGf5kgH7hm_pc6GLadlf69w_JM,21
-atbash_hermes_plugin-0.4.10.dev1.dist-info/RECORD,,