ct-toolkit 0.2.6__tar.gz → 0.2.9__tar.gz

{ct_toolkit-0.2.6 → ct_toolkit-0.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ct-toolkit
-Version: 0.2.6
+Version: 0.2.9
 Summary: Computational Theseus Toolkit — Identity Continuity Guardrails for Agentic Systems
 Author: Hakan Damar
 License: Apache-2.0

{ct_toolkit-0.2.6 → ct_toolkit-0.2.9}/ct_toolkit/core/exceptions.py

@@ -103,3 +103,18 @@ class ChainIntegrityError(ProvenanceError):
 
 class VaultError(ProvenanceError):
     """Vault connection or authorization error."""
+
+
+# ── File Integrity Errors ────────────────────────────────────────────────────
+
+class ConfigurationTamperingError(CTToolkitError):
+    """
+    Raised when a configuration file has been modified after initialization.
+    Indicates a potential security breach or unintended change.
+    """
+    def __init__(self, file_path: str):
+        self.file_path = file_path
+        super().__init__(
+            f"SECURITY ALERT: Tampering detected in configuration file: {file_path}. "
+            "Execution halted to prevent security bypass."
+        )

ct_toolkit-0.2.9/ct_toolkit/core/integrity.py

@@ -0,0 +1,56 @@
+"""
+ct_toolkit.core.integrity
+-------------------------
+Cryptographic integrity monitoring for configuration files.
+"""
+import hashlib
+from pathlib import Path
+from ct_toolkit.utils.logger import get_logger
+from ct_toolkit.core.exceptions import ConfigurationTamperingError
+
+logger = get_logger(__name__)
+
+class IntegrityMonitor:
+    """
+    Monitors the cryptographic integrity of CT configuration files.
+    Prevents runtime tampering by agents or malicious actors.
+    """
+    def __init__(self):
+        self._file_hashes: dict[str, str] = {}
+
+    def _calculate_hash(self, file_path: Path) -> str:
+        """Calculates the SHA-256 hash of a given file."""
+        hasher = hashlib.sha256()
+        try:
+            with open(file_path, 'rb') as f:
+                buf = f.read()
+                hasher.update(buf)
+            return hasher.hexdigest()
+        except FileNotFoundError:
+            logger.error(f"Integrity check failed: File not found at {file_path}")
+            raise
+
+    def register_file(self, file_path: Path) -> None:
+        """Registers a file and stores its initial hash."""
+        if not file_path.is_file():
+            logger.warning(f"Integrity check: Cannot register non-file path: {file_path}")
+            return
+        
+        file_hash = self._calculate_hash(file_path)
+        self._file_hashes[str(file_path)] = file_hash
+        logger.debug(f"Registered integrity hash for {file_path.name}")
+
+    def verify_integrity(self) -> None:
+        """
+        Verifies that none of the registered files have been modified.
+        Raises ConfigurationTamperingError if a mismatch is found.
+        """
+        if not self._file_hashes:
+            return  # Nothing to verify
+
+        for path_str, original_hash in self._file_hashes.items():
+            current_hash = self._calculate_hash(Path(path_str))
+            if current_hash != original_hash:
+                raise ConfigurationTamperingError(path_str)
+        logger.debug("Integrity verification passed for all registered files.")
+

{ct_toolkit-0.2.6 → ct_toolkit-0.2.9}/ct_toolkit/core/wrapper.py

@@ -21,15 +21,18 @@ from __future__ import annotations
 
 import time
 import hashlib
+import os
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Iterator
 import any_llm
 from any_llm import AnyLLM
+import glob
 
 from ct_toolkit.core.kernel import ConstitutionalKernel
 from ct_toolkit.core.compatibility import CompatibilityLayer, CompatibilityResult
 from ct_toolkit.core.exceptions import CTToolkitError, MissingClientError
+from ct_toolkit.core.integrity import IntegrityMonitor
 from ct_toolkit.divergence.scheduler import RiskProfile
 from ct_toolkit.utils.logger import get_logger
 
@@ -39,6 +42,7 @@ logger = get_logger(__name__)
 @dataclass
 class WrapperConfig:
     """TheseusWrapper configuration."""
+    project_root: str | Path | None = None
     kernel_path: str | Path | None = None
     template: str = "general"
     kernel_name: str = "default"
@@ -108,6 +112,7 @@ class TheseusWrapper:
         kernel_path: str | Path | None = None,
         template: str = "general",
         kernel_name: str = "default",
+        project_root: str | Path | None = None,
     ) -> None:
         """
         Initializes TheseusWrapper.
@@ -118,11 +123,14 @@ class TheseusWrapper:
             config:  Optional WrapperConfig instance.
             provider: Provider name (e.g. "openai", "anthropic", "ollama", "google", "cohere").
                       If provided, 'any-llm' will be used to initialize the client internally.
+            project_root: Path to the user's project root directory. Used to find a custom 'config/' folder.
+                          Defaults to the current working directory.
         """
         self._config = config or WrapperConfig(
             kernel_path=kernel_path,
             template=template,
             kernel_name=kernel_name,
+            project_root=project_root,
         )
         
         if client is None and provider is None:
@@ -131,6 +139,11 @@ class TheseusWrapper:
             
         self._client = client
         self._provider = provider or self._detect_provider(client)
+        self._project_root = (
+            Path(self._config.project_root)
+            if self._config.project_root
+            else Path(os.getcwd())
+        )
         self._kernel = self._load_kernel()
 
         # If a parent kernel exists, merge it into our own kernel as axiomatic constraints
@@ -146,8 +159,57 @@ class TheseusWrapper:
         self._divergence_engine = self._init_divergence_engine()
         self._last_model: str = "unknown"
 
+        # ── Integrity Monitoring ──
+        self._integrity_monitor = IntegrityMonitor()
+        self._register_monitored_files()
+
         self._log_init()
 
+    def _register_monitored_files(self):
+        """
+        Finds and registers all critical configuration files for integrity monitoring,
+        including both built-in package files and user-provided custom configs.
+        """
+        logger.debug("Registering configuration files for integrity monitoring.")
+        
+        # 1. Scan built-in package files
+        try:
+            from importlib.resources import files
+            package_root = files("ct_toolkit")
+            
+            internal_patterns = [
+                "kernels/**/*.yaml",
+                "identity/templates/**/*.yaml",
+                "endorsement/probes/**/*.json",
+            ]
+
+            for pattern in internal_patterns:
+                for file_path in package_root.rglob(pattern):
+                    if file_path.is_file():
+                        self._integrity_monitor.register_file(file_path)
+
+        except (ImportError, ModuleNotFoundError):
+            # Fallback for older Python or different environments
+            package_root = Path(__file__).parent.parent
+            # This is less ideal as it might find non-package files, but it's a
+            # reasonable fallback for development environments.
+            for pattern in internal_patterns:
+                for file_path in package_root.rglob(pattern):
+                    if file_path.is_file():
+                        self._integrity_monitor.register_file(file_path)
+
+        # 2. Scan user's custom config directory
+        if self._project_root:
+            user_config_dir = self._project_root / "config"
+            if user_config_dir.is_dir():
+                logger.debug(f"Scanning user config directory for integrity monitoring: {user_config_dir}")
+                user_patterns = ["*_kernel.yaml", "*_identity.yaml", "*_probes.json", "*.yaml", "*.json"]
+                for pattern in user_patterns:
+                    for file_path in user_config_dir.rglob(pattern):
+                        if file_path.is_file():
+                            self._integrity_monitor.register_file(file_path)
+
+
     # ── Factory / Init ─────────────────────────────────────────────────────────
 
     def _detect_provider(self, client: Any) -> str:
@@ -180,30 +242,40 @@ class TheseusWrapper:
         return "unknown"
 
     def _load_kernel(self) -> ConstitutionalKernel:
+        # 1. Check for explicit path
         if self._config.kernel_path:
+            logger.debug(f"Loading kernel from explicit path: {self._config.kernel_path}")
             return ConstitutionalKernel.from_yaml(self._config.kernel_path)
-        
-        import os
+
         safe_name = os.path.basename(self._config.kernel_name)
         
-        # Load built-in kernel using importlib.resources
+        # 2. Check for user-defined config directory
+        if self._project_root:
+            user_config_path = self._project_root / "config" / f"{safe_name}.yaml"
+            if user_config_path.exists():
+                logger.debug(f"Loading kernel from user config: {user_config_path}")
+                return ConstitutionalKernel.from_yaml(user_config_path)
+
+        # 3. Load built-in kernel using importlib.resources
         try:
             from importlib.resources import files
             kernel_resource = files("ct_toolkit.kernels").joinpath(f"{safe_name}.yaml")
             if kernel_resource.is_file():
+                logger.debug(f"Loading built-in kernel: {safe_name}.yaml")
                 return ConstitutionalKernel.from_yaml(kernel_resource)
         except (ImportError, FileNotFoundError):
-            # Fallback
+            # Fallback for older python versions
             kernel_path = (
                 Path(__file__).parent.parent
                 / "kernels"
                 / f"{safe_name}.yaml"
             )
             if kernel_path.exists():
+                logger.debug(f"Loading built-in kernel (fallback): {kernel_path}")
                 return ConstitutionalKernel.from_yaml(kernel_path)
 
         logger.warning(
-            f"Kernel '{self._config.kernel_name}' not found, using default."
+            f"Kernel '{self._config.kernel_name}' not found in user config or built-ins. Using default."
         )
         return ConstitutionalKernel.default()
 
@@ -232,6 +304,7 @@ class TheseusWrapper:
             template=self._config.template,
             embedding_client=emb_client,
             embedding_model=self._config.embedding_model,
+            project_root=self._project_root,
         )
 
     def _init_divergence_engine(self) -> Any:
@@ -263,6 +336,7 @@ class TheseusWrapper:
             l3_threshold=self._config.divergence_l3_threshold,
             enterprise_mode=self._config.enterprise_mode,
             scheduler=scheduler,
+            project_root=self._project_root,
             provenance_log=self._provenance_log,
         )
 
@@ -299,6 +373,9 @@ class TheseusWrapper:
             system:   Additional system prompt (appended to kernel)
             history:  Conversation history [{"role": ..., "content": ...}]
         """
+        # --- Pre-flight Checks ---
+        self._integrity_monitor.verify_integrity()
+
         composed_system = self._compose_system_prompt(system)
         messages = self._build_messages(message, history, composed_system)
 
@@ -416,6 +493,10 @@ class TheseusWrapper:
         if hasattr(self._client, "api_key") and self._client.api_key:
             any_llm_kwargs["api_key"] = self._client.api_key
 
+        # Transfer common client configurations if available
+        if hasattr(self._client, "timeout") and "timeout" not in any_llm_kwargs:
+            any_llm_kwargs["timeout"] = self._client.timeout
+
         try:
             return any_llm.completion(**any_llm_kwargs)
         except Exception as e:
@@ -473,6 +554,16 @@ class TheseusWrapper:
         return messages
 
     def _extract_content(self, raw: Any) -> str:
+        # Handle dict responses (e.g. from some mockers or raw APIs)
+        if isinstance(raw, dict):
+            if "choices" in raw and isinstance(raw["choices"], list) and raw["choices"]:
+                # OpenAI dict format
+                return raw["choices"][0].get("message", {}).get("content", "") or ""
+            if "message" in raw:
+                # Ollama dict format
+                return raw["message"].get("content", "") or ""
+            return str(raw)
+
         # OpenAI
         if hasattr(raw, "choices"):
             return raw.choices[0].message.content or ""
@@ -485,6 +576,8 @@ class TheseusWrapper:
         return str(raw)
 
     def _extract_model(self, raw: Any, fallback: str | None) -> str:
+        if isinstance(raw, dict) and "model" in raw:
+            return raw["model"]
         if hasattr(raw, "model"):
             return raw.model
         return fallback or "unknown"

{ct_toolkit-0.2.6 → ct_toolkit-0.2.9}/ct_toolkit/divergence/engine.py

@@ -17,6 +17,7 @@ from __future__ import annotations
 import time
 from dataclasses import dataclass
 from enum import Enum
+from pathlib import Path
 from typing import Any
 
 from ct_toolkit.identity.embedding import IdentityEmbeddingLayer
@@ -116,6 +117,7 @@ class DivergenceEngine:
         enterprise_mode: bool = False,   # Run all tiers all the time
         scheduler: Any | None = None,    # ElasticityScheduler instance
         provenance_log: Any | None = None, 
+        project_root: Path | None = None,
     ) -> None:
         self._identity = identity_layer
         self._kernel = kernel
@@ -123,6 +125,7 @@ class DivergenceEngine:
         self._provider = provider
         self._judge_client = judge_client
         self._log = provenance_log
+        self._project_root = project_root
         
         # Base thresholds
         self._base_l1_threshold = l1_threshold
@@ -331,5 +334,6 @@ class DivergenceEngine:
             kernel=self._kernel,
             template=self._template,
             max_probes=max_probes,
+            project_root=self._project_root,
         )
         return runner.run()

{ct_toolkit-0.2.6 → ct_toolkit-0.2.9}/ct_toolkit/divergence/l2_judge.py

@@ -139,15 +139,26 @@ class LLMJudge:
 
         try:
             # Call using instructor for structured data
-            data: JudgeResponse = self._instructor_client.chat.completions.create(
-                model=self._model,
-                response_model=JudgeResponse,
-                messages=[
-                    {"role": "system", "content": system_prompt},
-                    {"role": "user", "content": user_prompt},
-                ],
-                max_retries=2
-            )
+            if self._provider == "anthropic":
+                data: JudgeResponse = self._instructor_client.messages.create(
+                    model=self._model,
+                    response_model=JudgeResponse,
+                    system=system_prompt,
+                    messages=[
+                        {"role": "user", "content": user_prompt},
+                    ],
+                    max_retries=2
+                )
+            else:
+                data: JudgeResponse = self._instructor_client.chat.completions.create(
+                    model=self._model,
+                    response_model=JudgeResponse,
+                    messages=[
+                        {"role": "system", "content": system_prompt},
+                        {"role": "user", "content": user_prompt},
+                    ],
+                    max_retries=2
+                )
             
             result = JudgeResult(
                 verdict=data.verdict,

{ct_toolkit-0.2.6 → ct_toolkit-0.2.9}/ct_toolkit/divergence/l3_icm.py

@@ -209,6 +209,7 @@ class ICMRunner:
         model: str | None = None,
         include_domain_probes: bool = True,
         max_probes: int | None = None,
+        project_root: Path | None = None,
     ) -> None:
         self._client = client
         self._provider = provider
@@ -216,6 +217,7 @@ class ICMRunner:
         self._template = template
         self._model = model or self._default_model(provider)
         self._include_domain = include_domain_probes
+        self._project_root = project_root
         self._max_probes = max_probes
 
     @staticmethod
@@ -332,13 +334,22 @@ class ICMRunner:
 
         # Domain probes — based on template
         if self._include_domain:
-            domain_path = (
-                self.PROBES_DIR / "domain_probes" / f"{self._template}_probes.json"
-            )
-            if domain_path.exists():
-                with open(domain_path, encoding="utf-8") as f:
-                    probes.extend(json.load(f))
-                logger.info(f"Domain probes loaded: {self._template}")
+            # Check user config first
+            domain_loaded = False
+            if self._project_root:
+                user_probe_path = self._project_root / "config" / f"{self._template}_probes.json"
+                if user_probe_path.exists():
+                    with open(user_probe_path, encoding="utf-8") as f:
+                        probes.extend(json.load(f))
+                    logger.info(f"Custom domain probes loaded: {user_probe_path}")
+                    domain_loaded = True
+
+            if not domain_loaded:
+                domain_path = self.PROBES_DIR / "domain_probes" / f"{self._template}_probes.json"
+                if domain_path.exists():
+                    with open(domain_path, encoding="utf-8") as f:
+                        probes.extend(json.load(f))
+                    logger.info(f"Domain probes loaded: {self._template}")
 
         if not probes:
             logger.warning("Probe file not found. Empty battery.")

{ct_toolkit-0.2.6 → ct_toolkit-0.2.9}/ct_toolkit/identity/embedding.py

@@ -43,6 +43,7 @@ class IdentityEmbeddingLayer:
         template: str = "general",
         embedding_client: Any = None,  # Provider client for real embeddings
         embedding_model: str = "text-embedding-3-small",
+        project_root: Path | None = None,
     ) -> None:
         self._template = template
         self._embedding_client = embedding_client
@@ -50,6 +51,7 @@ class IdentityEmbeddingLayer:
         self._reference_vector: np.ndarray | None = None
         self._template_keywords: list[str] = []
         self._reference_text: str = ""          # stored for lazy computation
+        self._project_root = project_root
         self._embedding_method: str = "uninitialized"
         self._load_template()
 
@@ -58,34 +60,48 @@ class IdentityEmbeddingLayer:
     def _load_template(self) -> None:
         import os
         import yaml
-        from importlib.resources import files
+        
+        data = None
         
         # Sanitize template name to prevent path traversal
         safe_template = os.path.basename(self._template)
         
+        # 1. Check user config first if project_root is provided
+        if self._project_root:
+            # Check for both "name.yaml" and "name_identity.yaml"
+            for fname in [f"{safe_template}.yaml", f"{safe_template}_identity.yaml"]:
+                user_path = self._project_root / "config" / fname
+                if user_path.exists():
+                    logger.debug(f"Loading identity template from user config: {user_path}")
+                    with open(user_path, "r", encoding="utf-8") as f:
+                        data = yaml.safe_load(f)
+                    break
+        
         # Load built-in template using importlib.resources
-        try:
-            template_resource = files("ct_toolkit.identity.templates").joinpath(f"{safe_template}.yaml")
-            if template_resource.is_file():
-                with template_resource.open("r", encoding="utf-8") as f:
-                    data = yaml.safe_load(f)
-            else:
-                raise FileNotFoundError(f"Template resource not found: {template_resource}")
-        except (ImportError, FileNotFoundError):
-            # Fallback for development or older environments
-            template_path = (
-                Path(__file__).parent
-                / "templates"
-                / f"{safe_template}.yaml"
-            )
-            if not template_path.exists():
-                logger.warning(
-                    f"Template '{self._template}' not found, using 'general'."
+        if data is None:
+            try:
+                from importlib.resources import files
+                template_resource = files("ct_toolkit.identity.templates").joinpath(f"{safe_template}.yaml")
+                if template_resource.is_file():
+                    with template_resource.open("r", encoding="utf-8") as f:
+                        data = yaml.safe_load(f)
+                else:
+                    raise FileNotFoundError(f"Template resource not found: {template_resource}")
+            except (ImportError, FileNotFoundError):
+                # Fallback for development or older environments
+                template_path = (
+                    Path(__file__).parent
+                    / "templates"
+                    / f"{safe_template}.yaml"
                 )
-                template_path = Path(__file__).parent / "templates" / "general.yaml"
-            
-            with open(template_path, "r", encoding="utf-8") as f:
-                data = yaml.safe_load(f)
+                if not template_path.exists():
+                    logger.warning(
+                        f"Template '{self._template}' not found, using 'general'."
+                    )
+                    template_path = Path(__file__).parent / "templates" / "general.yaml"
+                
+                with open(template_path, "r", encoding="utf-8") as f:
+                    data = yaml.safe_load(f)
 
         self._template_keywords = data.get("identity_keywords", [])
         self._reference_text = data.get("reference_text", " ".join(self._template_keywords))

{ct_toolkit-0.2.6 → ct_toolkit-0.2.9}/ct_toolkit.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ct-toolkit
-Version: 0.2.6
+Version: 0.2.9
 Summary: Computational Theseus Toolkit — Identity Continuity Guardrails for Agentic Systems
 Author: Hakan Damar
 License: Apache-2.0

{ct_toolkit-0.2.6 → ct_toolkit-0.2.9}/ct_toolkit.egg-info/SOURCES.txt

@@ -10,6 +10,7 @@ ct_toolkit.egg-info/top_level.txt
 ct_toolkit/core/__init__.py
 ct_toolkit/core/compatibility.py
 ct_toolkit/core/exceptions.py
+ct_toolkit/core/integrity.py
 ct_toolkit/core/kernel.py
 ct_toolkit/core/wrapper.py
 ct_toolkit/divergence/__init__.py

{ct_toolkit-0.2.6 → ct_toolkit-0.2.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ct-toolkit"
-version = "0.2.6"
+version = "0.2.9"
 description = "Computational Theseus Toolkit — Identity Continuity Guardrails for Agentic Systems"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -71,3 +71,9 @@ dev = [
     "pytest-cov>=7.0.0",
     "twine>=6.2.0",
 ]
+
+[tool.semantic_release]
+version_toml = ["pyproject.toml:project.version"]
+branch = "main"
+changelog_file = "CHANGELOG.md"
+build_command = "pip install build && python -m build"