contextwall 0.1.4__tar.gz → 0.2.0__tar.gz

contextwall-0.2.0/CHANGELOG.md

@@ -0,0 +1,126 @@
+# Changelog
+
+All notable changes to ContextWall are recorded here. Format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project
+adheres to [SemVer](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.0] — 2026-09
+
+The **consolidation** release. The SDK now ships inside the main `contextwall`
+package as `context_firewall.sdk`. The separate `contextwall-sdk` package becomes
+a thin deprecation shim that installs `contextwall>=0.2.0` and re-exports
+from the new location.
+
+### Added
+
+- **`context_firewall.sdk` submodule** — hosts `SafeAnthropic`, `AsyncSafeAnthropic`,
+  `SafeOpenAI`, `AsyncSafeOpenAI`, `ContextWallClient`, `AsyncContextWallClient`,
+  and all response models. Same class contracts and method signatures as the
+  old `contextwall_sdk` package.
+- **Optional extras** on the main package for provider SDKs:
+  - `pip install "contextwall[anthropic]"` — anthropic>=0.25
+  - `pip install "contextwall[openai]"` — openai>=1.0
+  - `pip install "contextwall[all]"` — both
+
+### Changed
+
+- **`contextwall-sdk` bumped to 0.2.0 as a deprecation shim.** Depends on
+  `contextwall>=0.2.0` plus both provider SDKs (matches the old
+  `contextwall-sdk[all]` behavior so pinned installs keep working). Emits a
+  `DeprecationWarning` on import. Will be removed in v0.4.
+
+### Migration
+
+```diff
+- pip install contextwall-sdk[all]
++ pip install "contextwall[all]"
+
+- from contextwall_sdk import SafeAnthropic
++ from context_firewall.sdk import SafeAnthropic
+```
+
+Nothing about class contracts changed — only the import path and the extras
+name.
+
+### Why
+
+The split between `contextwall` and `contextwall-sdk` caused version drift
+(main went to 0.1.5, SDK stayed at 0.1.4 in the previous release) and
+doubled the release surface. Single-package is the pattern most successful
+OSS security tools follow (openai, anthropic, snyk agent-scan, semgrep,
+trivy). See [contextwall.io/vs](https://contextwall.io/vs) for context.
+
+## [0.1.5] — 2026-08
+
+The **Preflight** release. Introduces the `ctxfw check` subcommand — a safety
+preflight for AI agents that returns a scorecard and a release decision in
+about 60 seconds. Reduces the daemon's surface, cleans up the `CRE→ContextWall`
+naming, and ships fallback aliases so existing deployments keep working.
+
+### Added
+
+- **`ctxfw check` — Preflight subcommand.** Runs a pinned adversarial suite
+  against an agent target and emits a scorecard + release gate.
+  - Four adapters: `--openai` (OpenAI-compatible), `--anthropic`, `--replay`
+    (JSONL trace-boundary), `--mcp` (component-exposure static scan; never
+    invokes tools).
+  - 35 fixtures across three dimensions in `standard@2026.09`: Injection
+    Resistance (10), Grounding Under Attack (5), Data Exfiltration (20).
+    Every fixture cites its source — CVE, paper, or public disclosure.
+  - Independent letter grade (per dimension) and release gate (for CI).
+    Configurable via `contextwall.yaml`; supports `dimension_overrides`.
+  - Stable exit codes: `0` pass · `2` usage · `10` safety failure ·
+    `11` insufficient evidence · `12` adapter error.
+  - Outputs: terminal (Rich when TTY), JSON, SARIF 2.1.0, self-hosted HTML.
+    Evidence redacted by default; opt out with `--no-redact`.
+- **Grader regression harness** (`tests/preflight/`) with 40+ labeled
+  `(fixture, response, verdict)` triples plus post-mortem-derived traces from
+  EchoLeak, AWS Q v1.84.0, GitHub MCP exfil, and PoisonedRAG.
+- **Methodology doc** at `docs/METHODOLOGY.md` — versioned per suite.
+- **Full spec** at `docs/PREFLIGHT_SPEC.md`.
+- **CI dep on nothing else** — Preflight runs standalone from `uvx contextwall check`.
+
+### Changed
+
+- **CLI naming: `CRE_*` → `CONTEXTWALL_*`.** All env vars renamed with
+  `CRE_*` fallback aliases and a `DeprecationWarning`. Legacy names slated
+  for removal in v0.3.
+  - `CRE_API_TOKEN` → `CONTEXTWALL_API_TOKEN`
+  - `CRE_COMPLIANCE_HMAC_KEY` → `CONTEXTWALL_COMPLIANCE_HMAC_KEY`
+  - `CRE_CONTROL_PLANE_TOKEN` → `CONTEXTWALL_CONTROL_PLANE_TOKEN`
+  - `CRE_URL`, `CRE_API_KEY`, `CRE_KEY` → `CONTEXTWALL_*` (SDK)
+- **Prometheus metric prefix: `cre_*` → `contextwall_*`.** All 12 metrics
+  renamed. **Breaking for Grafana dashboards referencing the old names.**
+- **Error type in proxy responses: `cre_policy_violation` → `contextwall_policy_violation`.**
+  SDK accepts both so mixed old-daemon / new-SDK deployments keep working.
+- **Default DB path: `.ctxfw/cre.db` → `.ctxfw/contextwall.db`.** Daemon
+  auto-migrates the legacy file at startup if it exists.
+- **`ctxfw.oss.yaml` sample updated** with the new env-var and path defaults.
+
+### Removed
+
+- **Speculative in-daemon engines pruned** (~800 LOC removed, no external
+  API impact): `graph/`, `entropy/`, `runtime/`, `analytics/`, `lint/`. Their
+  routes now consistently return 503 for the affected `/analytics/*` and
+  `/v1/lint/*` endpoints. These were daemon-only research code; nothing in
+  the SDK or proxy path referenced them.
+- **Dependencies dropped:** `kuzu`, `context-compiler-mcp`,
+  `opentelemetry-sdk`, `opentelemetry-exporter-otlp-proto-grpc`, `grpcio`.
+- **`contextwall-sdk.ContextWallClient.lint`** accessor removed — the lint
+  engine is gone.
+
+### Migration notes
+
+- **Env vars:** if you set `CRE_*` env vars, keep working — you'll see a
+  `DeprecationWarning`. To silence it, rename to `CONTEXTWALL_*`.
+- **DB path:** first daemon start on 0.1.5 auto-renames `.ctxfw/cre.db`
+  to `.ctxfw/contextwall.db`. If your config pins `storage.db_path`, update it.
+- **Grafana:** update panels referencing `cre_proxy_requests_total`,
+  `cre_proxy_violations_total`, etc. to the `contextwall_*` prefix.
+- **`ContextWallClient.lint`:** the lint API is gone — remove call sites.
+
+## [0.1.4] — earlier 2026
+
+Baseline release before Preflight. Runtime firewall (proxy + policy engine +
+compliance export) with `CRE_*` env vars and `cre_*` metrics. Superseded by
+0.1.5 with backward-compatible aliases.

contextwall-0.2.0/PKG-INFO

@@ -0,0 +1,206 @@
+Metadata-Version: 2.5
+Name: contextwall
+Version: 0.2.0
+Summary: Safety preflight and runtime firewall for AI agents — point at your agent, get a scorecard and release decision.
+Author-email: ContextWall <info@bytewise.ca>
+License: Apache-2.0
+License-File: LICENSE
+Keywords: agent-security,ai-agents,ai-security,context-firewall,guardrails,llm-security,llmops,mcp,preflight,prompt-injection,rag
+Requires-Python: >=3.11
+Requires-Dist: aiobotocore>=2.0
+Requires-Dist: aiosqlite>=0.19
+Requires-Dist: apscheduler>=3.10
+Requires-Dist: click>=8.0
+Requires-Dist: cryptography>=42.0
+Requires-Dist: duckdb>=0.10
+Requires-Dist: fastapi>=0.110
+Requires-Dist: fastmcp>=2.0
+Requires-Dist: httpx>=0.27
+Requires-Dist: prometheus-client>=0.20
+Requires-Dist: pydantic-settings>=2.0
+Requires-Dist: pydantic>=2.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rapidfuzz>=3.0
+Requires-Dist: rich>=13.0
+Requires-Dist: uvicorn[standard]>=0.27
+Requires-Dist: watchdog>=3.0
+Provides-Extra: all
+Requires-Dist: anthropic>=0.25; extra == 'all'
+Requires-Dist: openai>=1.0; extra == 'all'
+Provides-Extra: anthropic
+Requires-Dist: anthropic>=0.25; extra == 'anthropic'
+Provides-Extra: dev
+Requires-Dist: anthropic>=0.25; extra == 'dev'
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: openai>=1.0; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.4; extra == 'dev'
+Provides-Extra: openai
+Requires-Dist: openai>=1.0; extra == 'openai'
+Description-Content-Type: text/markdown
+
+# ContextWall
+
+**Safety preflight and runtime firewall for AI agents.**
+
+Point Preflight at your agent, get a safety scorecard and a release decision
+in about 60 seconds. Then, if you want it, run the same detection at runtime
+between your agent and its context sources.
+
+```bash
+uvx contextwall check --openai http://localhost:11434/v1
+```
+
+```
+ContextWall Preflight — my-agent-v3.2
+Suite: standard@2026.09    Adapter: openai-compatible
+Assessment mode: MODEL-BOUNDARY
+Assessment scope: SAFETY ONLY
+
+  Injection Resistance       B+   7/10 cases passed
+  Grounding Under Attack     C    2/5 cases passed
+  Data Exfiltration          A    0/20 detected emissions
+
+Release gate: BLOCKED
+  ✗ Grounding score below minimum grade
+  ✗ Critical test inj-05 (semantic override) failed
+
+Fix first:
+  1. Semantic override bypass       → contextwall.io/fix/inj-05
+  2. Poisoned document treated fact → contextwall.io/fix/gnd-02
+```
+
+[Full quickstart](https://contextwall.io/quickstart)
+&nbsp;·&nbsp;
+[Methodology](https://contextwall.io/methodology)
+&nbsp;·&nbsp;
+[vs LlamaFirewall / NeMo / Snyk agent-scan / PromptFoo](https://contextwall.io/vs)
+
+---
+
+## Get started
+
+**Zero install, one command:**
+
+```bash
+uvx contextwall check --help
+```
+
+**Install into your env:**
+
+```bash
+pip install contextwall                    # CLI + Preflight + detectors + daemon
+pip install "contextwall[anthropic]"       # + SafeAnthropic wrapper
+pip install "contextwall[openai]"          # + SafeOpenAI wrapper (works with vLLM, Ollama, Mistral, ...)
+pip install "contextwall[all]"             # everything
+```
+
+The client SDK ships as a submodule:
+
+```python
+from context_firewall.sdk import SafeAnthropic, ContextWallBlockedError
+```
+
+Users of the old `contextwall-sdk` package: keep working via a deprecation
+shim (import from `context_firewall.sdk` when convenient).
+
+**Point at your agent — four adapters:**
+
+| Flag | For | Assessment mode |
+|---|---|---|
+| `--openai <url>` | OpenAI-compatible endpoints (OpenAI, vLLM, Ollama, LiteLLM, …) | model-boundary |
+| `--anthropic <url>` | Anthropic Messages endpoints (direct, Bedrock proxies) | model-boundary |
+| `--replay <file.jsonl>` | Prerecorded responses — grade offline, reproducible in CI | trace-boundary |
+| `--mcp <config.json>` | MCP config — enumerates tools + scans descriptions (never invokes) | component-exposure |
+
+**Gate CI on it:**
+
+```bash
+ctxfw check --replay ./tests/preflight/responses.jsonl \
+            --gate --fail-below B- --sarif > preflight.sarif
+# Exit codes: 0 pass · 10 safety failure · 11 insufficient evidence · 12 adapter error
+```
+
+## What Preflight measures
+
+35 fixtures across three safety dimensions, pinned per suite version so
+scorecards remain reproducible:
+
+| Dimension | Fixtures | What it tests |
+|---|---:|---|
+| **Injection Resistance** | 10 | EchoLeak-shape, tool poisoning, zero-width, spaced-letters, semantic override, indirect-via-retrieval, +3 CVE-derived |
+| **Grounding Under Attack** | 5 | False attribution, fabricated event, nonexistent API, conflicting sources, poisoned action recommendation |
+| **Data Exfiltration** | 20 | AWS/OpenAI/Anthropic/GitHub keys, SSH keys, JWTs, bearer tokens, DB URLs, SSN, credit card, composite PII, tool-arg exfiltration |
+
+Every fixture cites its source — CVE-2025-32711 (EchoLeak), GHSA-7g7f-ff96-5gcw
+(AWS Q v1.84.0), Invariant Labs' 2025 disclosures, USENIX 2025 PoisonedRAG,
+and more.
+
+Grades and release gates are **independent outputs**. Letter grade is for
+humans and README badges; the gate is machine truth for CI. They can disagree
+by design — see [docs/METHODOLOGY.md](./docs/METHODOLOGY.md).
+
+## What Preflight does NOT measure
+
+Every scorecard states this explicitly:
+
+- Correctness of the agent's answers
+- Cost, latency, throughput, availability
+- Tool authorization semantics (who is allowed to call which tool)
+- Tenant isolation and multi-user access control
+- Data retention and provider configuration
+- Human-in-loop policy correctness
+
+A passing Preflight means the agent resisted the pinned safety corpus —
+not that it's production-ready overall. Honest scope beats false assurances.
+
+## Runtime firewall (optional follow-up)
+
+Preflight is the wedge; the runtime firewall is the product. Once you know
+which classes your agent falls for, enforce the same detection at runtime
+by pointing your SDK at the local daemon:
+
+```bash
+ctxfw start                                          # runs the daemon on :8080
+export ANTHROPIC_BASE_URL=http://localhost:8080/proxy/anthropic
+export ANTHROPIC_API_KEY=sk-ant-your-real-key        # unchanged
+```
+
+Prompts and documents never leave your host. The daemon inspects both
+inbound context and outbound tool arguments using the same detectors as
+Preflight. Source-tier trust model, per-source policy, tamper-evident
+provenance chain. See [`ctxfw.oss.yaml`](./ctxfw.oss.yaml) for a config
+example.
+
+## Compliance
+
+Compliance packs (HIPAA, SOC 2, FedRAMP) map violations to specific control
+IDs, run in `baa_mode` for PHI-adjacent deployments, and export tamper-evident
+audit bundles. See [contextwall.io/compliance](https://contextwall.io/compliance)
+for enterprise scope, data residency, and policy-as-code details.
+
+## Architecture
+
+One paragraph: the CLI (`ctxfw`) hosts both the Preflight subcommand
+(`ctxfw check`) and the daemon (`ctxfw start`). Preflight adapters
+(OpenAI-compatible, Anthropic, replay, MCP-static) each declare a capability
+manifest with observed/unobserved channels. The suite runner iterates
+versioned fixtures, the grader combines pattern-based checks with
+outcome-based checks, and the scorecard reports dimension grades + release
+gate independently. The runtime daemon shares the same three-layer detector
+(structural, regex, heuristic scoring) and pattern libraries; it proxies
+LLM API calls through `/proxy/anthropic` and `/proxy/openai`, applying
+source-tier-aware policy before content reaches the model.
+
+## Contributing
+
+Grader-drift reports are the highest-signal contribution. If you find an
+`(input, response)` pair where the grader gives the wrong verdict, please
+[open an issue](https://github.com/bytewise-ca/context-wall/issues).
+Fixture proposals and independent-reviewer volunteers are also very welcome —
+see [docs/METHODOLOGY.md](./docs/METHODOLOGY.md) for conventions.
+
+## License
+
+Apache 2.0. See [LICENSE](./LICENSE).

contextwall-0.2.0/README.md

@@ -0,0 +1,164 @@
+# ContextWall
+
+**Safety preflight and runtime firewall for AI agents.**
+
+Point Preflight at your agent, get a safety scorecard and a release decision
+in about 60 seconds. Then, if you want it, run the same detection at runtime
+between your agent and its context sources.
+
+```bash
+uvx contextwall check --openai http://localhost:11434/v1
+```
+
+```
+ContextWall Preflight — my-agent-v3.2
+Suite: standard@2026.09    Adapter: openai-compatible
+Assessment mode: MODEL-BOUNDARY
+Assessment scope: SAFETY ONLY
+
+  Injection Resistance       B+   7/10 cases passed
+  Grounding Under Attack     C    2/5 cases passed
+  Data Exfiltration          A    0/20 detected emissions
+
+Release gate: BLOCKED
+  ✗ Grounding score below minimum grade
+  ✗ Critical test inj-05 (semantic override) failed
+
+Fix first:
+  1. Semantic override bypass       → contextwall.io/fix/inj-05
+  2. Poisoned document treated fact → contextwall.io/fix/gnd-02
+```
+
+[Full quickstart](https://contextwall.io/quickstart)
+ · 
+[Methodology](https://contextwall.io/methodology)
+ · 
+[vs LlamaFirewall / NeMo / Snyk agent-scan / PromptFoo](https://contextwall.io/vs)
+
+---
+
+## Get started
+
+**Zero install, one command:**
+
+```bash
+uvx contextwall check --help
+```
+
+**Install into your env:**
+
+```bash
+pip install contextwall                    # CLI + Preflight + detectors + daemon
+pip install "contextwall[anthropic]"       # + SafeAnthropic wrapper
+pip install "contextwall[openai]"          # + SafeOpenAI wrapper (works with vLLM, Ollama, Mistral, ...)
+pip install "contextwall[all]"             # everything
+```
+
+The client SDK ships as a submodule:
+
+```python
+from context_firewall.sdk import SafeAnthropic, ContextWallBlockedError
+```
+
+Users of the old `contextwall-sdk` package: keep working via a deprecation
+shim (import from `context_firewall.sdk` when convenient).
+
+**Point at your agent — four adapters:**
+
+| Flag | For | Assessment mode |
+|---|---|---|
+| `--openai <url>` | OpenAI-compatible endpoints (OpenAI, vLLM, Ollama, LiteLLM, …) | model-boundary |
+| `--anthropic <url>` | Anthropic Messages endpoints (direct, Bedrock proxies) | model-boundary |
+| `--replay <file.jsonl>` | Prerecorded responses — grade offline, reproducible in CI | trace-boundary |
+| `--mcp <config.json>` | MCP config — enumerates tools + scans descriptions (never invokes) | component-exposure |
+
+**Gate CI on it:**
+
+```bash
+ctxfw check --replay ./tests/preflight/responses.jsonl \
+            --gate --fail-below B- --sarif > preflight.sarif
+# Exit codes: 0 pass · 10 safety failure · 11 insufficient evidence · 12 adapter error
+```
+
+## What Preflight measures
+
+35 fixtures across three safety dimensions, pinned per suite version so
+scorecards remain reproducible:
+
+| Dimension | Fixtures | What it tests |
+|---|---:|---|
+| **Injection Resistance** | 10 | EchoLeak-shape, tool poisoning, zero-width, spaced-letters, semantic override, indirect-via-retrieval, +3 CVE-derived |
+| **Grounding Under Attack** | 5 | False attribution, fabricated event, nonexistent API, conflicting sources, poisoned action recommendation |
+| **Data Exfiltration** | 20 | AWS/OpenAI/Anthropic/GitHub keys, SSH keys, JWTs, bearer tokens, DB URLs, SSN, credit card, composite PII, tool-arg exfiltration |
+
+Every fixture cites its source — CVE-2025-32711 (EchoLeak), GHSA-7g7f-ff96-5gcw
+(AWS Q v1.84.0), Invariant Labs' 2025 disclosures, USENIX 2025 PoisonedRAG,
+and more.
+
+Grades and release gates are **independent outputs**. Letter grade is for
+humans and README badges; the gate is machine truth for CI. They can disagree
+by design — see [docs/METHODOLOGY.md](./docs/METHODOLOGY.md).
+
+## What Preflight does NOT measure
+
+Every scorecard states this explicitly:
+
+- Correctness of the agent's answers
+- Cost, latency, throughput, availability
+- Tool authorization semantics (who is allowed to call which tool)
+- Tenant isolation and multi-user access control
+- Data retention and provider configuration
+- Human-in-loop policy correctness
+
+A passing Preflight means the agent resisted the pinned safety corpus —
+not that it's production-ready overall. Honest scope beats false assurances.
+
+## Runtime firewall (optional follow-up)
+
+Preflight is the wedge; the runtime firewall is the product. Once you know
+which classes your agent falls for, enforce the same detection at runtime
+by pointing your SDK at the local daemon:
+
+```bash
+ctxfw start                                          # runs the daemon on :8080
+export ANTHROPIC_BASE_URL=http://localhost:8080/proxy/anthropic
+export ANTHROPIC_API_KEY=sk-ant-your-real-key        # unchanged
+```
+
+Prompts and documents never leave your host. The daemon inspects both
+inbound context and outbound tool arguments using the same detectors as
+Preflight. Source-tier trust model, per-source policy, tamper-evident
+provenance chain. See [`ctxfw.oss.yaml`](./ctxfw.oss.yaml) for a config
+example.
+
+## Compliance
+
+Compliance packs (HIPAA, SOC 2, FedRAMP) map violations to specific control
+IDs, run in `baa_mode` for PHI-adjacent deployments, and export tamper-evident
+audit bundles. See [contextwall.io/compliance](https://contextwall.io/compliance)
+for enterprise scope, data residency, and policy-as-code details.
+
+## Architecture
+
+One paragraph: the CLI (`ctxfw`) hosts both the Preflight subcommand
+(`ctxfw check`) and the daemon (`ctxfw start`). Preflight adapters
+(OpenAI-compatible, Anthropic, replay, MCP-static) each declare a capability
+manifest with observed/unobserved channels. The suite runner iterates
+versioned fixtures, the grader combines pattern-based checks with
+outcome-based checks, and the scorecard reports dimension grades + release
+gate independently. The runtime daemon shares the same three-layer detector
+(structural, regex, heuristic scoring) and pattern libraries; it proxies
+LLM API calls through `/proxy/anthropic` and `/proxy/openai`, applying
+source-tier-aware policy before content reaches the model.
+
+## Contributing
+
+Grader-drift reports are the highest-signal contribution. If you find an
+`(input, response)` pair where the grader gives the wrong verdict, please
+[open an issue](https://github.com/bytewise-ca/context-wall/issues).
+Fixture proposals and independent-reviewer volunteers are also very welcome —
+see [docs/METHODOLOGY.md](./docs/METHODOLOGY.md) for conventions.
+
+## License
+
+Apache 2.0. See [LICENSE](./LICENSE).

contextwall-0.2.0/RELEASE_NOTES_v0.1.5.md

@@ -0,0 +1,97 @@
+# ContextWall v0.1.5 — Preflight
+
+Release notes for the "Preflight" release. See [CHANGELOG.md](./CHANGELOG.md)
+for the full change list.
+
+## What's new
+
+**`ctxfw check`** — point Preflight at your agent, get a safety scorecard and
+a release decision in about 60 seconds.
+
+```bash
+uvx contextwall check --openai http://localhost:11434/v1
+```
+
+```
+ContextWall Preflight — my-agent-v3.2
+Suite: standard@2026.09    Adapter: openai-compatible
+Assessment mode: MODEL-BOUNDARY
+Assessment scope: SAFETY ONLY
+
+  Injection Resistance       B+   7/10 cases passed
+  Grounding Under Attack     C    2/5 cases passed
+  Data Exfiltration          A    0/20 detected emissions
+
+Release gate: BLOCKED
+  ✗ Grounding score below minimum grade
+  ✗ Critical test inj-05 (semantic override) failed
+
+Fix first:
+  1. Semantic override bypass       → contextwall.io/fix/inj-05
+  2. Poisoned document treated fact → contextwall.io/fix/gnd-02
+```
+
+**35 pinned fixtures** across three safety dimensions, each with a citation
+to a CVE, paper, or public disclosure. **Four adapters:** OpenAI-compatible,
+Anthropic, JSONL replay (trace-boundary — grade offline in CI), and MCP
+static (component-exposure — never invokes tools). **Stable exit codes**
+(0 / 10 / 11 / 12) route different failure classes correctly in CI.
+
+## Get it
+
+```bash
+# One-shot, no install
+uvx contextwall check --help
+
+# Install into your env
+pip install --upgrade contextwall
+```
+
+## Breaking changes
+
+None for users of the runtime firewall. The migration is transparent via
+deprecation aliases:
+
+- **Env vars:** `CRE_*` → `CONTEXTWALL_*` (aliases in place; `DeprecationWarning`
+  on the old names)
+- **DB path:** `.ctxfw/cre.db` → `.ctxfw/contextwall.db` (auto-migrated at
+  daemon start)
+- **Error type:** `cre_policy_violation` → `contextwall_policy_violation`
+  (SDK accepts both; mixed deployments work either way)
+
+**One thing that IS breaking**: Prometheus metrics renamed `cre_*` →
+`contextwall_*`. If you have Grafana dashboards or Prometheus alerts on the
+old names, update them.
+
+## Under the hood
+
+- Removed ~800 LOC of speculative in-daemon research code
+  (`graph`, `entropy`, `runtime`, `analytics`, `lint` engines) that no
+  production path referenced.
+- Dropped 5 large deps (`kuzu`, `context-compiler-mcp`, `opentelemetry-*`,
+  `grpcio`) — faster install, smaller image, cleaner surface.
+- Test suite grew to 74 tests, all under a second wall-clock.
+
+## Manual steps for maintainers
+
+These are `gh`/PyPI/GitHub settings, not code:
+
+1. **PyPI publish**: `python -m build && python -m twine upload dist/*` from
+   `context-wall/`; same from `context-wall/sdk/python/` for the SDK.
+2. **GitHub release**: `gh release create v0.1.5 --title "v0.1.5 — Preflight"
+   --notes-file RELEASE_NOTES_v0.1.5.md`.
+3. **Repo metadata** (via Settings or `gh repo edit`):
+   - Description: `Safety preflight and runtime firewall for AI agents — point at your agent, get a scorecard and release decision.`
+   - Website: `https://contextwall.io`
+   - Topics: `llm-security`, `prompt-injection`, `ai-agents`, `ai-security`, `agent-security`, `rag`, `guardrails`, `llmops`, `mcp`, `preflight`
+4. **README badges** (once PyPI reflects 0.1.5): PyPI version, download count,
+   Python versions, license.
+
+## Deferred
+
+- **Preamble patent freedom-to-operate review** (US20250028969A1) — needs
+  counsel signoff before broad public distribution.
+- **Grader validation stats** (independent-reviewer agreement rate, etc.) —
+  target lands in v0.2 once the labeled corpus grows past 50.
+- **Hosted scorecard** (uploaded scorecards with shareable URLs) — v1.5 per
+  the spec, weeks 10–14.

contextwall-0.2.0/RELEASE_NOTES_v0.2.0.md

@@ -0,0 +1,70 @@
+# ContextWall v0.2.0 — SDK consolidation
+
+Small but structurally important release. **The SDK now lives inside the
+main `contextwall` package** as `context_firewall.sdk`. The old `contextwall-sdk`
+package continues to work as a deprecation shim.
+
+## What changed
+
+- **One package, one release story.** `context_firewall.sdk` is the new home
+  for `SafeAnthropic`, `SafeOpenAI`, `ContextWallClient`, and all response
+  models. Same class contracts as before.
+- **Note on naming:** the PyPI package is named `contextwall` (no separator);
+  the Python module has always been `context_firewall` (with underscore).
+  So: `pip install contextwall` and `import context_firewall`. The old
+  `contextwall-sdk` package continues to install as `contextwall_sdk` (the
+  shim).
+- **Optional extras** for the provider SDKs:
+  - `pip install "contextwall[anthropic]"`
+  - `pip install "contextwall[openai]"`
+  - `pip install "contextwall[all]"`
+- **`contextwall-sdk` 0.2.0** is now a thin shim that installs the main
+  package and re-exports from `context_firewall.sdk` with a `DeprecationWarning`.
+  It will be removed in v0.4.
+
+## Migration
+
+```diff
+- pip install contextwall-sdk[all]
++ pip install "contextwall[all]"
+
+- from contextwall_sdk import SafeAnthropic
++ from context_firewall.sdk import SafeAnthropic
+```
+
+Nothing about behavior changed — only the import path and the extras name.
+If you don't migrate, the shim keeps working; you'll see a one-time
+`DeprecationWarning` and can silence it after the migration.
+
+## Why
+
+The old `contextwall` / `contextwall-sdk` split caused two real problems:
+
+1. **Version drift.** v0.1.5 shipped only for the main package; the SDK
+   stayed at 0.1.4. Users didn't know which pair to install.
+2. **Doubled release surface.** Every release meant two publishes, two
+   changelogs, two READMEs to keep in sync.
+
+Single-package is the pattern most successful OSS security tools follow
+(openai, anthropic, snyk agent-scan, semgrep, trivy). The provider-SDK
+weight concern that motivated the split originally is now handled cleanly
+by optional extras.
+
+## Publish sequence
+
+```bash
+# Main package
+cd /Users/punakkals/work/context-wall
+uv build && uv publish
+
+# Shim package
+cd sdk/python
+uv build && uv publish
+```
+
+## Deferred
+
+- **Removal of `contextwall-sdk`** — v0.4, per the deprecation notice.
+- **`contextwall_sdk._anthropic` / `contextwall_sdk._openai` etc.** — those
+  private submodules are gone from the shim. If anyone was importing from
+  them directly (undocumented), they'll need to update to `context_firewall.sdk`.

{contextwall-0.1.4 → contextwall-0.2.0}/ctxfw.oss.yaml

@@ -39,7 +39,7 @@ compliance:
 # Get a registration token from https://app.contextwall.io → Settings.
 control_plane:
   url: ""
-  registration_token: "${CRE_CONTROL_PLANE_TOKEN:-}"
+  registration_token: "${CONTEXTWALL_CONTROL_PLANE_TOKEN:-}"
   daemon_name: "oss-daemon"
   push_interval_seconds: 60
   heartbeat_interval_seconds: 30
@@ -58,11 +58,11 @@ graph:
   trust_cutoff: 0.30
 
 storage:
-  db_path: /app/.ctxfw/cre.db
+  db_path: /app/.ctxfw/contextwall.db
 
 policy:
   policy_dir: /app/.ctxfw/policies
 
 daemon:
-  pid_file: /app/.ctxfw/cre.pid
+  pid_file: /app/.ctxfw/daemon.pid
   jobs: {}