consequence-gate 0.1.1__tar.gz → 0.2.0__tar.gz

consequence_gate-0.2.0/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

{consequence_gate-0.1.1 → consequence_gate-0.2.0}/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.4
 Name: consequence-gate
-Version: 0.1.1
+Version: 0.2.0
 Summary: Speculative outcome-simulation layer for AI agent tool calls — predicts consequence (blast radius, irreversibility, velocity) before execution and steers agents toward safer alternatives.
-Author-email: Anandkrishnan Shnn <anandkrshnn@gmail.com>
+Author-email: Anandkrishnan Shnn <anandkrshnn@outlook.com>
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/anandkrshnn-ai/consequence-gate
 Project-URL: Documentation, https://github.com/anandkrshnn-ai/consequence-gate#readme
@@ -21,11 +21,15 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.5.0
+Requires-Dist: cryptography>=42.0.0
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"
 Requires-Dist: pytest-cov>=4.0; extra == "dev"
 Requires-Dist: black>=23.0; extra == "dev"
 Requires-Dist: ruff>=0.1.0; extra == "dev"
+Requires-Dist: psycopg[binary]>=3.1; extra == "dev"
 Provides-Extra: mcp
 Provides-Extra: langgraph
 Requires-Dist: langgraph>=0.2.0; extra == "langgraph"
@@ -33,22 +37,31 @@ Requires-Dist: langchain-core>=0.3.0; extra == "langgraph"
 Provides-Extra: langchain
 Requires-Dist: langchain>=0.3.0; extra == "langchain"
 Requires-Dist: langchain-core>=0.3.0; extra == "langchain"
+Dynamic: license-file
 
 # consequence-gate
 
+[![CI](https://github.com/anandkrshnn-ai/consequence-gate/actions/workflows/ci.yml/badge.svg)](https://github.com/anandkrshnn-ai/consequence-gate/actions/workflows/ci.yml)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-blue.svg)](https://pypi.org/project/consequence-gate/)
+[![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](LICENSE)
+[![Tests](https://img.shields.io/badge/tests-30%20passed-success.svg)](tests/)
+[![Coverage](https://img.shields.io/badge/coverage-core%2090%25%2B-brightgreen.svg)](tests/)
+
+**[Try the interactive demo ⚡](https://consequence-gate-demo-mu.vercel.app/)**
+
 A speculative outcome-simulation layer for AI agent tool calls. It sits
 **upstream** of static runtime access gates (AgentWall, AWS Strands
 `BeforeToolCallEvent`, MCP proxies, Prisma AIRS) and asks a different
 question than they do.
 
-Static gates ask: *does this call match an allowed pattern?*
+Static gates ask: *does this call match an allowed pattern or schema?*  
 `consequence-gate` asks: *what will this call actually do, and is that
 outcome safe?*
 
 ## Why this exists
 
 Static runtime gates are fast (sub-millisecond) and effective at schema
-validation, RBAC, and pattern matching -- but a schema-valid,
+validation, RBAC, and pattern matching — but a schema-valid,
 policy-compliant call can still be consequence-catastrophic. A
 `process_claim(amount=50000)` call can pass every static check while
 pushing an account over its daily velocity limit via an irreversible
@@ -59,8 +72,8 @@ either passes it through, asks a human, denies it outright, or steers
 the agent toward a pre-vetted safer alternative.
 
 This is explicitly **not** a replacement for AgentWall / Strands / MCP
-proxies -- it's a prediction layer that runs before them, in the same
-pipeline.
+proxies — it is an outcome prediction layer that runs upstream of them in the same pipeline.
+
 
 ## Core contracts
 
@@ -221,34 +234,63 @@ agent = Agent(hooks=[hook])
 ## Decision Matrix
 
 | Decision | Strands | MCP | LangGraph |
-|----------|---------|-----|-----------|
+|---|---|---|---|
 | `ALLOW` | Executes normally | Forwarded to downstream MCP server | Tool executes via handler(request) |
 | `DENY` | `BLOCKED: <reason>` | JSON-RPC error (code=-32603) | Raises `ValueError("BLOCKED: ...")` |
 | `ASK` | `ESCALATION_REQUIRED: <reason>` | `isError=true` tool result | Raises `ValueError("ESCALATION_REQUIRED: ...")` |
 | `STEER` | `STEER_GUIDANCE: <guidance>\nSuggested alternative...` | `isError=true` + guidance | `ToolMessage(content="STEER_GUIDANCE: ...", status="error")` |
 
-## Backtest Workflow
+## Trust Model & Failure Modes
+
+`consequence-gate` evaluates consequence by combining tool invocation parameters with runtime state returned from your `context_provider` callback (e.g. `account_rolling_24h_spend`, `kyc_verified`, `table_metadata`).
+
+### Critical Failure Modes & Mitigations
+
+| Failure Mode | Risk | Mitigation in Consequence-Gate |
+|---|---|---|
+| **Stale Context / Cache Lag** | Context provider returns yesterday's spend balance, potentially missing velocity breaches. | If context is unverified or confidence drops below `0.8`, the gate **always defaults to `ASK` (human escalation)**. It never grants a speculative `ALLOW`. |
+| **Missing Context Provider** | Tool is invoked without any environment or database connection. | The simulator scores confidence as `0.0` or `0.5` and raises an escalation requirement (`ASK`). |
+| **Agent Steering Thrashing** | The agent repeatedly submits non-compliant alternative calls in response to guidance. | The `SteerCircuitBreaker` enforces a hard retry cap (default: 2 retries) before terminating the loop and escalating to human review. |
+| **Replay / Network Retries** | Network timeout causes agent runtime to resubmit the identical tool call. | Idempotency tokens are deterministically keyed to the entity's natural business key, guaranteeing identical evaluation without incrementing velocity counters twice. |
+
+See [SECURITY.md](SECURITY.md) for full trust boundary documentation.
+
+## Offline Backtest Benchmark
+ 
+Before deploying to production, run an offline backtest against historical execution traces to measure the four-quadrant FP/FN/TN breakdown:
 
-Before deploying to production, run an offline backtest against historical
-execution traces:
+```bash
+# Run backtest on the bundled 500-trace synthetic benchmark dataset
+consequence-gate backtest examples/benchmark_traces.jsonl
+```
+
+### Empirical Benchmark Summary (500 Synthetic Traces)
+
+*(Note: Evaluated on a synthetically generated trace corpus `examples/benchmark_traces.jsonl` to validate harness mechanics end-to-end; see [BACKTEST_RESULTS.md](BACKTEST_RESULTS.md) for disclosure)*
 
-1. Export 1,000-5,000 tool-call traces as JSONL (see `examples/backtest_sample_traces.jsonl`)
-2. Run `python examples/run_backtest_demo.py` against your traces
-3. Review the four-quadrant breakdown:
-   - True Negative: correctly allowed benign operations
-   - False Negative Caught: schema-valid calls that would have breached limits
-   - False Positive Relieved: over-blocking that the simulator would have avoided
-   - Steer Recovery Rate: percentage of blocked turns that could have completed via guidance
+- **Benign Pass-Through (True Negatives):** 252 (50.4%) — Benign operations passed through.
+- **Downstream Hazards Intercepted:** 129 (25.8%) — Schema-valid hazards caught before execution.
+- **Over-Blocked Operations Relieved:** 35 (7.0%) — Benign calls over-blocked by naive regex gates safely enabled.
+- **Ambiguous Escalations:** 84 (16.8%) — Low-confidence/unrecognized calls routed to `ASK`.
 
-## Status
+Detailed breakdown and reproduction steps: [BACKTEST_RESULTS.md](BACKTEST_RESULTS.md) | [BACKTEST_METHODOLOGY.md](BACKTEST_METHODOLOGY.md)
 
-- **Financial simulator**: functional with unit tests
-- **Database simulator**: functional with unit tests (EXPLAIN-based row estimation, recursive FK cascade walk)
-- **Communications simulator**: functional with unit tests (blast radius, unsubscribe compliance, canary cohorts, reputation impact)
-- **Strands integration**: functional with unit tests (full `ALLOW`/`DENY`/`ASK`/`STEER` lifecycle)
-- **MCP integration**: functional with unit tests (stdio transport, JSON-RPC error handling)
-- **LangGraph integration**: functional with unit tests (`@wrap_tool_call` middleware pattern)
+## Status & Test Coverage
+
+- **Financial simulator**: functional with unit tests (`tests/test_financial_sim.py`, 96% coverage)
+- **Database simulator**: functional with unit tests (`tests/test_database_sim.py`), plus real-PostgreSQL EXPLAIN fixture validation (`tests/test_database_explain_fixture.py`, runs in CI via a `postgres:16` service container; skips locally when no database is reachable)
+- **Communications simulator**: functional with unit tests (`tests/test_communications_sim.py`, 90% coverage)
+- **Circuit breaker & natural-key idempotency**: functional with unit tests (`tests/test_circuit_breaker.py`, 95% coverage)
+- **Strands integration**: functional with unit tests (`tests/test_strands_hook.py`, 91% coverage)
+- **MCP integration**: functional with unit tests (`tests/test_mcp_proxy.py`)
+- **LangGraph integration**: functional with unit tests (`tests/test_langgraph_hook.py`)
+- **CLI & Backtesting**: functional with unit tests (`tests/test_cli.py`)
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for architecture guidelines, coding conventions, and instructions on creating new consequence simulators.
 
 ## License
 
 Apache-2.0
+

{consequence_gate-0.1.1 → consequence_gate-0.2.0}/README.md

@@ -1,18 +1,26 @@
 # consequence-gate
 
+[![CI](https://github.com/anandkrshnn-ai/consequence-gate/actions/workflows/ci.yml/badge.svg)](https://github.com/anandkrshnn-ai/consequence-gate/actions/workflows/ci.yml)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-blue.svg)](https://pypi.org/project/consequence-gate/)
+[![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](LICENSE)
+[![Tests](https://img.shields.io/badge/tests-30%20passed-success.svg)](tests/)
+[![Coverage](https://img.shields.io/badge/coverage-core%2090%25%2B-brightgreen.svg)](tests/)
+
+**[Try the interactive demo ⚡](https://consequence-gate-demo-mu.vercel.app/)**
+
 A speculative outcome-simulation layer for AI agent tool calls. It sits
 **upstream** of static runtime access gates (AgentWall, AWS Strands
 `BeforeToolCallEvent`, MCP proxies, Prisma AIRS) and asks a different
 question than they do.
 
-Static gates ask: *does this call match an allowed pattern?*
+Static gates ask: *does this call match an allowed pattern or schema?*  
 `consequence-gate` asks: *what will this call actually do, and is that
 outcome safe?*
 
 ## Why this exists
 
 Static runtime gates are fast (sub-millisecond) and effective at schema
-validation, RBAC, and pattern matching -- but a schema-valid,
+validation, RBAC, and pattern matching — but a schema-valid,
 policy-compliant call can still be consequence-catastrophic. A
 `process_claim(amount=50000)` call can pass every static check while
 pushing an account over its daily velocity limit via an irreversible
@@ -23,8 +31,8 @@ either passes it through, asks a human, denies it outright, or steers
 the agent toward a pre-vetted safer alternative.
 
 This is explicitly **not** a replacement for AgentWall / Strands / MCP
-proxies -- it's a prediction layer that runs before them, in the same
-pipeline.
+proxies — it is an outcome prediction layer that runs upstream of them in the same pipeline.
+
 
 ## Core contracts
 
@@ -185,34 +193,63 @@ agent = Agent(hooks=[hook])
 ## Decision Matrix
 
 | Decision | Strands | MCP | LangGraph |
-|----------|---------|-----|-----------|
+|---|---|---|---|
 | `ALLOW` | Executes normally | Forwarded to downstream MCP server | Tool executes via handler(request) |
 | `DENY` | `BLOCKED: <reason>` | JSON-RPC error (code=-32603) | Raises `ValueError("BLOCKED: ...")` |
 | `ASK` | `ESCALATION_REQUIRED: <reason>` | `isError=true` tool result | Raises `ValueError("ESCALATION_REQUIRED: ...")` |
 | `STEER` | `STEER_GUIDANCE: <guidance>\nSuggested alternative...` | `isError=true` + guidance | `ToolMessage(content="STEER_GUIDANCE: ...", status="error")` |
 
-## Backtest Workflow
+## Trust Model & Failure Modes
+
+`consequence-gate` evaluates consequence by combining tool invocation parameters with runtime state returned from your `context_provider` callback (e.g. `account_rolling_24h_spend`, `kyc_verified`, `table_metadata`).
+
+### Critical Failure Modes & Mitigations
+
+| Failure Mode | Risk | Mitigation in Consequence-Gate |
+|---|---|---|
+| **Stale Context / Cache Lag** | Context provider returns yesterday's spend balance, potentially missing velocity breaches. | If context is unverified or confidence drops below `0.8`, the gate **always defaults to `ASK` (human escalation)**. It never grants a speculative `ALLOW`. |
+| **Missing Context Provider** | Tool is invoked without any environment or database connection. | The simulator scores confidence as `0.0` or `0.5` and raises an escalation requirement (`ASK`). |
+| **Agent Steering Thrashing** | The agent repeatedly submits non-compliant alternative calls in response to guidance. | The `SteerCircuitBreaker` enforces a hard retry cap (default: 2 retries) before terminating the loop and escalating to human review. |
+| **Replay / Network Retries** | Network timeout causes agent runtime to resubmit the identical tool call. | Idempotency tokens are deterministically keyed to the entity's natural business key, guaranteeing identical evaluation without incrementing velocity counters twice. |
+
+See [SECURITY.md](SECURITY.md) for full trust boundary documentation.
+
+## Offline Backtest Benchmark
+ 
+Before deploying to production, run an offline backtest against historical execution traces to measure the four-quadrant FP/FN/TN breakdown:
 
-Before deploying to production, run an offline backtest against historical
-execution traces:
+```bash
+# Run backtest on the bundled 500-trace synthetic benchmark dataset
+consequence-gate backtest examples/benchmark_traces.jsonl
+```
+
+### Empirical Benchmark Summary (500 Synthetic Traces)
+
+*(Note: Evaluated on a synthetically generated trace corpus `examples/benchmark_traces.jsonl` to validate harness mechanics end-to-end; see [BACKTEST_RESULTS.md](BACKTEST_RESULTS.md) for disclosure)*
 
-1. Export 1,000-5,000 tool-call traces as JSONL (see `examples/backtest_sample_traces.jsonl`)
-2. Run `python examples/run_backtest_demo.py` against your traces
-3. Review the four-quadrant breakdown:
-   - True Negative: correctly allowed benign operations
-   - False Negative Caught: schema-valid calls that would have breached limits
-   - False Positive Relieved: over-blocking that the simulator would have avoided
-   - Steer Recovery Rate: percentage of blocked turns that could have completed via guidance
+- **Benign Pass-Through (True Negatives):** 252 (50.4%) — Benign operations passed through.
+- **Downstream Hazards Intercepted:** 129 (25.8%) — Schema-valid hazards caught before execution.
+- **Over-Blocked Operations Relieved:** 35 (7.0%) — Benign calls over-blocked by naive regex gates safely enabled.
+- **Ambiguous Escalations:** 84 (16.8%) — Low-confidence/unrecognized calls routed to `ASK`.
 
-## Status
+Detailed breakdown and reproduction steps: [BACKTEST_RESULTS.md](BACKTEST_RESULTS.md) | [BACKTEST_METHODOLOGY.md](BACKTEST_METHODOLOGY.md)
 
-- **Financial simulator**: functional with unit tests
-- **Database simulator**: functional with unit tests (EXPLAIN-based row estimation, recursive FK cascade walk)
-- **Communications simulator**: functional with unit tests (blast radius, unsubscribe compliance, canary cohorts, reputation impact)
-- **Strands integration**: functional with unit tests (full `ALLOW`/`DENY`/`ASK`/`STEER` lifecycle)
-- **MCP integration**: functional with unit tests (stdio transport, JSON-RPC error handling)
-- **LangGraph integration**: functional with unit tests (`@wrap_tool_call` middleware pattern)
+## Status & Test Coverage
+
+- **Financial simulator**: functional with unit tests (`tests/test_financial_sim.py`, 96% coverage)
+- **Database simulator**: functional with unit tests (`tests/test_database_sim.py`), plus real-PostgreSQL EXPLAIN fixture validation (`tests/test_database_explain_fixture.py`, runs in CI via a `postgres:16` service container; skips locally when no database is reachable)
+- **Communications simulator**: functional with unit tests (`tests/test_communications_sim.py`, 90% coverage)
+- **Circuit breaker & natural-key idempotency**: functional with unit tests (`tests/test_circuit_breaker.py`, 95% coverage)
+- **Strands integration**: functional with unit tests (`tests/test_strands_hook.py`, 91% coverage)
+- **MCP integration**: functional with unit tests (`tests/test_mcp_proxy.py`)
+- **LangGraph integration**: functional with unit tests (`tests/test_langgraph_hook.py`)
+- **CLI & Backtesting**: functional with unit tests (`tests/test_cli.py`)
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for architecture guidelines, coding conventions, and instructions on creating new consequence simulators.
 
 ## License
 
 Apache-2.0
+

{consequence_gate-0.1.1 → consequence_gate-0.2.0}/consequence_gate/__init__.py

@@ -1,3 +1,3 @@
 """consequence-gate: speculative outcome-simulation layer for AI agent tool calls."""
 
-__version__ = "0.1.1"
+__version__ = "0.2.0"

consequence_gate-0.2.0/consequence_gate/backtest/harness.py

@@ -0,0 +1,62 @@
+"""
+Offline backtest harness: replays historical JSONL tool-call traces
+through a simulator + evaluator, WITHOUT re-executing anything, to
+measure the four-quadrant FP/FN/TN/steer-recovery breakdown against
+the trace's recorded existing_gate_decision and actual_execution_status.
+"""
+
+import json
+from collections.abc import Callable, Iterable
+
+
+def load_traces(path: str) -> list[dict]:
+    traces = []
+    with open(path) as f:
+        for line in f:
+            line = line.strip()
+            if line:
+                traces.append(json.loads(line))
+    return traces
+
+
+def run_backtest(
+    traces: Iterable[dict], simulate_and_evaluate: Callable[[dict], str]
+) -> list[dict]:
+    """
+    simulate_and_evaluate: function(trace) -> decision string ("ALLOW"/"DENY"/"ASK"/"STEER")
+    Returns per-trace records annotated with quadrant classification.
+    """
+    results = []
+    for trace in traces:
+        new_decision = simulate_and_evaluate(trace)
+        gt = trace.get("ground_truth_consequence")
+
+        if gt == "UNSAFE":
+            if new_decision in ("DENY", "STEER", "ASK"):
+                quadrant = "FALSE_NEGATIVE_CAUGHT"  # TP: Hazard Intercepted
+            else:
+                quadrant = "OTHER"  # FN: Missed Hazard
+        elif gt == "SAFE":
+            if new_decision == "ALLOW":
+                quadrant = "TRUE_NEGATIVE"  # TN: Benign Pass-Through
+            else:
+                quadrant = "FALSE_POSITIVE"  # FP: Over-blocked
+        else:
+            # Fallback for traces lacking ground_truth_consequence
+            old_decision = trace.get("existing_gate_decision", "ALLOW")
+            outcome = trace.get("actual_execution_status", "UNKNOWN")
+            if (
+                old_decision == "ALLOW"
+                and new_decision in ("DENY", "STEER", "ASK")
+                and outcome != "SUCCESS"
+            ):
+                quadrant = "FALSE_NEGATIVE_CAUGHT"
+            elif old_decision in ("DENY", "ASK") and new_decision == "ALLOW":
+                quadrant = "FALSE_POSITIVE_RELIEVED"
+            elif old_decision == "ALLOW" and new_decision == "ALLOW":
+                quadrant = "TRUE_NEGATIVE"
+            else:
+                quadrant = "OTHER"
+
+        results.append({**trace, "simulated_decision": new_decision, "quadrant": quadrant})
+    return results

consequence_gate-0.2.0/consequence_gate/backtest/reporter.py

@@ -0,0 +1,29 @@
+"""
+Generates the four-quadrant FP/FN breakdown report from backtest results.
+"""
+
+from collections import Counter
+
+
+def generate_report(results: list[dict]) -> dict:
+    counts = Counter(r["quadrant"] for r in results)
+    total = len(results)
+    fn_caught = counts.get("FALSE_NEGATIVE_CAUGHT", 0)
+    fp_relieved = counts.get("FALSE_POSITIVE_RELIEVED", 0)
+    fp_caused = counts.get("FALSE_POSITIVE", 0)
+    return {
+        "total_traces": total,
+        "true_negative": counts.get("TRUE_NEGATIVE", 0),
+        "hazards_intercepted": fn_caught,
+        "overblocked_relieved": fp_relieved,
+        "false_positives_caused": fp_caused,
+        "other": counts.get("OTHER", 0),
+        "hazard_interception_rate": fn_caught / total if total else 0.0,
+        "overblock_relief_rate": fp_relieved / total if total else 0.0,
+        "false_positive_rate": fp_caused / total if total else 0.0,
+        # Backward-compatibility aliases
+        "false_negative_caught": fn_caught,
+        "false_positive_relieved": fp_relieved,
+        "false_negative_rate": fn_caught / total if total else 0.0,
+        "false_positive_relief_rate": fp_relieved / total if total else 0.0,
+    }