rag-security-protocol 0.1.1__py3-none-any.whl

rag_security_protocol-0.1.1.dist-info/METADATA

@@ -0,0 +1,132 @@
+Metadata-Version: 2.5
+Name: rag-security-protocol
+Version: 0.1.1
+Summary: RAG Security Protocol — where security tools hook into a RAG pipeline, and what they return
+Project-URL: Homepage, https://github.com/PCBZ/rsp
+Project-URL: Specification, https://github.com/PCBZ/rsp/blob/main/SPEC.md
+Project-URL: Issues, https://github.com/PCBZ/rsp/issues
+Project-URL: Changelog, https://github.com/PCBZ/rsp/releases
+Author: PCBZ
+License-Expression: Apache-2.0
+License-File: LICENSE
+Keywords: conformance,llm,protocol,rag,redaction,security
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Provides-Extra: llamaindex
+Requires-Dist: llama-index-core<0.15,>=0.14; extra == 'llamaindex'
+Description-Content-Type: text/markdown
+
+# RSP
+
+A protocol for scanning content **before** it reaches a vector store.
+
+Everything that ships today scans after storage, where an embedding already
+exists and the text is recoverable from it. RSP puts the scanner at the
+ingest hook instead, so that blocked means it was never there.
+
+```console
+$ rsp ingest demo/sample-docs --config demo/rsp.toml
+scanned 11 chunks
+  REDACT aws-access-token   demo/sample-docs/deploy-notes.md:1-14
+  REDACT private-key        demo/sample-docs/runbook-backups.md:1-18
+11 chunks indexed, 0 blocked, 2 redacted
+```
+
+Nothing in that run is ours except the wiring: the detector is
+[gitleaks](https://github.com/gitleaks/gitleaks), unmodified, and the pipeline
+is LlamaIndex.
+
+## What it is
+
+`SPEC.md` is the deliverable — twenty-eight clauses, each with the reasoning
+that produced it, twenty-three of them settled by a conformance case rather
+than by assertion. The code in `rsp/` is one host implementation, and exists
+to prove the clauses are implementable.
+
+A plugin is a command. It reads one JSON object on stdin, writes one on
+stdout, and exits:
+
+```console
+$ echo '{"rsp_version":"0.1","hook":"on_chunk","content":"key: AKIA47CQZHT2MVPF3JXB"}' | my-scanner
+{"verdict":"REDACT","spans":[{"start":5,"end":25,"type":"aws"}],"replacement":"[REDACTED]"}
+```
+
+Offsets are bytes into UTF-8, half-open. The host applies them; a plugin never
+sees the content again. [Writing a plugin](https://github.com/PCBZ/rsp/blob/main/WRITING-A-PLUGIN.md) is the page to
+start from — the four messages, and the three things that bite.
+
+## Try it
+
+```bash
+uv sync --extra llamaindex
+uv run rsp ingest demo/sample-docs --config demo/rsp.toml   # needs gitleaks and node
+```
+
+## Use it
+
+```python
+from rsp.config import load
+from rsp.guards import RSPIngestGuard, RSPRetrieveGuard
+from rsp.runtime import Runtime
+
+runtime = Runtime(load("rsp.toml"))  # every plugin handshakes here, or this raises
+
+indexed = IngestionPipeline(
+    transformations=[SentenceSplitter(), RSPIngestGuard(runtime=runtime), embedding]
+).run(documents=documents)
+
+kept = RSPRetrieveGuard(runtime=runtime).postprocess_nodes(retrieved, query_str=query)
+```
+
+The ingest guard goes after the splitter and before the embedding, which is
+the whole point: a blocked chunk is never embedded and never stored. The
+retrieve guard catches what an index already held.
+
+[`examples/host`](https://github.com/PCBZ/rsp/tree/main/examples/host) is that, whole and runnable: four documents
+through one pipeline, judged by a Python plugin and a Go one at the same time.
+The host code does not know which is which.
+
+## Check your own plugin
+
+```console
+$ python conformance/run.py -- my-scanner
+```
+
+Copy `conformance/` and `plugins/` next to your plugin — they are not in the
+installed package, on purpose: you are checking against the protocol, not
+against a version of it that shipped with a host. Standard library only, and
+nothing in it imports this host. `conformance/README.md` explains roles
+and the host cases.
+
+## Where things are
+
+| | |
+|---|---|
+| `SPEC.md` | the protocol |
+| `WRITING-A-PLUGIN.md` | the on-ramp, quoting a plugin under test |
+| `conformance/` | cases, a runner, and a plugin that misbehaves on request |
+| `rsp/` | the reference host — five layers, one-way imports, zero dependencies |
+| `plugins/rsp-echo` | the reference plugin, whose verdicts are chosen by markers |
+| `examples/host` | a whole host in one file, judged by a Python plugin and a Go one |
+| `examples/gitleaks-{ts,go,rs,py,c,java,swift}` | the same real scanner wrapped seven times, in seven languages |
+| `demo/` | eight documents, two of them with fabricated credentials |
+
+Decisions (D1–D9) and open questions live in the
+[wiki](https://github.com/PCBZ/rsp/wiki). Clause IDs — `S1`, `E4` — resolve
+inside a clone; issue numbers do not, so the spec never cites one.
+
+## Status
+
+v0.1 is the first freeze. Four clauses have no conformance case and
+`SPEC.md` §10 says which and why. Two of them — blocked content never reaching
+storage, and a dropped retrieval hit — are the ones a host case cannot observe
+without the host offering somewhere to look, and they are the two the protocol
+is most about. That is the honest state of it.

rag_security_protocol-0.1.1.dist-info/RECORD

@@ -0,0 +1,16 @@
+rsp/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+rsp/cli.py,sha256=GHv1oAEItdQUiHzPrvr02IN3lSMvcttjRdWmgd8h_R4,2683
+rsp/codec.py,sha256=o-SGeLqUc5OOkc3Axr2t9f4BNWuDZ1B4g6Z2heJoD34,6256
+rsp/config.py,sha256=qzs0W_40ooQH_mXrmVsiivSeymW10l5X10tLomrgJkg,5954
+rsp/guards.py,sha256=33jdo6rzu4YawTeaFncaPQAnx7uA52Ayv4aMx3VMVZs,3304
+rsp/handshake.py,sha256=2WJ-rvDA494ixmNOO2_yZQcfFsScLaWQutbImLS_NyU,2388
+rsp/ingest.py,sha256=xddiatHxxnhzoouh_-N110nkPc-QimvD2yAoYMmmh5Q,5546
+rsp/process.py,sha256=AChPxbTySX7nXqh8-UCg_klQyLNPFHER04d3_0caGBo,5488
+rsp/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+rsp/runtime.py,sha256=LXv_oVGGHpoIuTUajGSHX7_Qe-WoaS6Z2ZmExZNW3A0,9907
+rsp/spans.py,sha256=mIw9TmYahPX3K91SsSlLITlQBHo8T4ep0HX2Bp5tjMw,3709
+rag_security_protocol-0.1.1.dist-info/METADATA,sha256=qyAl--XPu-z2J5oKPFdDlfH-_hYmEhWbMeyrEC7pMHk,5338
+rag_security_protocol-0.1.1.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+rag_security_protocol-0.1.1.dist-info/entry_points.txt,sha256=MpeFCB8yav-W9hF5Bd2yfQ-8G0_kfg9K9GPPgU5uY1w,37
+rag_security_protocol-0.1.1.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+rag_security_protocol-0.1.1.dist-info/RECORD,,

rag_security_protocol-0.1.1.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

rag_security_protocol-0.1.1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+rsp = rsp.cli:main

rag_security_protocol-0.1.1.dist-info/licenses/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

rsp/cli.py

@@ -0,0 +1,80 @@
+"""`rsp validate` checks a config; `rsp ingest` runs a directory through it.
+
+`load` stops at the first problem, because a host with half its guards is worse
+than one that does not start; `validate` turns that into a message and an exit
+code for someone editing the file.
+"""
+
+from __future__ import annotations
+
+import argparse
+import pathlib
+import sys
+from collections.abc import Sequence
+
+from rsp.config import load
+from rsp.runtime import ConfigError, Plugin
+
+
+def _validate(plugins: list[Plugin]) -> int:
+    for plugin in plugins:
+        print(
+            f"{plugin.name}: {' '.join(plugin.command)} "
+            f"[on_error={plugin.on_error.value} timeout={plugin.timeout:g}s]"
+        )
+    # No handshake: a binary installed elsewhere does not make the config invalid.
+    print(f"{len(plugins)} plugin(s), not started", file=sys.stderr)
+    return 0
+
+
+def _ingest(directory: pathlib.Path, plugins: list[Plugin]) -> int:
+    try:
+        # rsp.ingest imports llama_index lazily, so a missing extra surfaces at the call.
+        from rsp.ingest import ingest
+
+        report = ingest(directory, plugins)
+    except ImportError:
+        print(
+            "rsp ingest needs the llamaindex extra: pip install 'rsp[llamaindex]'", file=sys.stderr
+        )
+        return 1
+    except (ConfigError, FileNotFoundError) as exc:
+        print(exc, file=sys.stderr)
+        return 1
+
+    print(f"scanned {report.scanned} chunks")
+    for item in report.findings:
+        # A chunk's lines, not a position: the host never sees a span (S4).
+        print(f"  {item.verdict:7}{item.types:18} {item.source}:{item.lines}")
+    print(
+        f"{report.indexed} chunks indexed, "
+        f"{len(report.blocked)} blocked, {len(report.redacted)} redacted"
+    )
+    return 0
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="rsp")
+    commands = parser.add_subparsers(dest="command", required=True)
+
+    check = commands.add_parser("validate", help="check a config file")
+    check.add_argument("config", help="path to a TOML config")
+
+    run = commands.add_parser("ingest", help="run a directory through the plugins")
+    run.add_argument("directory", help="directory of documents")
+    run.add_argument("--config", default="rsp.toml", help="path to a TOML config")
+
+    arguments = parser.parse_args(argv)
+    try:
+        plugins = load(arguments.config)
+    except ConfigError as exc:
+        print(exc, file=sys.stderr)
+        return 1
+
+    if arguments.command == "validate":
+        return _validate(plugins)
+    return _ingest(pathlib.Path(arguments.directory), plugins)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

rsp/codec.py

@@ -0,0 +1,167 @@
+"""Wire codec: a request mapping in, a parsed response out, or why not.
+
+Sits between rsp.process and plugin identity, so both directions can be tested on
+raw bytes without spawning anything.
+"""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass
+from typing import Any
+
+from rsp.process import DEFAULT_MAX_OUTPUT, DEFAULT_TIMEOUT, Invocation, Outcome, invoke
+
+RSP_VERSION = "0.1"
+# Past this, parsers lose precision and two hosts disagree about a span (RFC 8259 §6).
+_SAFE_INTEGER = 2**53 - 1
+# RFC 8259 §2 whitespace. str.strip() also removes characters a strict parser refuses.
+_WHITESPACE = " \t\n\r"
+
+
+def _sendable(value: Any, seen: frozenset[int] = frozenset()) -> None:
+    """Raise ValueError if any part of a request would break T4 on the wire.
+
+    `seen` holds the containers above this one, so a request nested inside
+    itself is named rather than reaching the stack limit. Depth that is merely
+    great still raises RecursionError, which `call` catches alongside the rest
+    (E2).
+    """
+    if isinstance(value, (Mapping, list, tuple)):
+        if id(value) in seen:
+            raise ValueError("a request cannot contain itself")
+        seen = seen | {id(value)}
+    if isinstance(value, Mapping):
+        # json.dumps writes the key 1 as "1", so {1: "a", "1": "b"} repeats a key.
+        written = [str(key) if isinstance(key, (int, float, bool)) else key for key in value]
+        if len(set(written)) != len(written):
+            raise ValueError("a key would be repeated once written")
+        for nested in value.values():
+            _sendable(nested, seen)
+    elif isinstance(value, (list, tuple)):
+        for nested in value:
+            _sendable(nested, seen)
+    elif isinstance(value, int) and not isinstance(value, bool) and abs(value) > _SAFE_INTEGER:
+        raise ValueError(f"{value} is outside the interoperable range")
+
+
+def encode(request: Mapping[str, Any]) -> bytes:
+    """One request as compact UTF-8 JSON. Raises ValueError if it cannot be.
+
+    `ensure_ascii=False` keeps the bytes a plugin counts the bytes we sent (S1);
+    `allow_nan=False` stops Python writing NaN, which no other parser accepts.
+    """
+    _sendable(request)  # a host does not send what it would refuse (T4)
+    return json.dumps(request, ensure_ascii=False, allow_nan=False, separators=(",", ":")).encode(
+        "utf-8"
+    )
+
+
+def _reject_constant(token: str) -> Any:
+    """NaN and Infinity are not JSON (RFC 8259); Python's parser takes them."""
+    raise ValueError(f"{token} is not JSON")
+
+
+def _reject_duplicate_keys(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    """Refuse a repeated key: parsers disagree about which one wins (RFC 8259 §4)."""
+    seen: set[str] = set()
+    for key, _ in pairs:
+        if key in seen:
+            raise ValueError(f"duplicate key {key!r}")
+        seen.add(key)
+    return dict(pairs)
+
+
+def _checked_number(token: str) -> int:
+    """Integers a JavaScript host could not read back unchanged."""
+    value = int(token)
+    if abs(value) > _SAFE_INTEGER:
+        raise ValueError(f"{token} is outside the interoperable range")
+    return value
+
+
+_DECODER = json.JSONDecoder(
+    parse_constant=_reject_constant,
+    object_pairs_hook=_reject_duplicate_keys,
+    parse_int=_checked_number,
+)
+
+
+def decode(raw: bytes) -> tuple[Outcome, dict[str, Any] | None]:
+    """Exactly one JSON object and nothing else, or why not (T2).
+
+    Not the first object that parses: anything else on stdout makes the protocol
+    channel a log, where a stray line looks like a response.
+    """
+    try:
+        text = raw.decode("utf-8")
+    except UnicodeDecodeError:
+        return Outcome.MALFORMED, None
+
+    # Stripped with JSON's four, not Python's: a plugin whose whole output is
+    # some other space character said something, and EMPTY means it did not.
+    body = text.lstrip(_WHITESPACE)
+    if not body:
+        return Outcome.EMPTY, None
+
+    try:
+        payload, end = _DECODER.raw_decode(body)
+    except (ValueError, RecursionError):
+        # ValueError: JSONDecodeError, or a value the hooks above refuse.
+        # RecursionError: nesting deep enough to exhaust the stack, which the
+        # output cap does not bound — 200KB of brackets is well under it. A
+        # plugin does not get to choose when the host falls over (D2).
+        return Outcome.MALFORMED, None
+
+    if body[end:].strip(_WHITESPACE):
+        return Outcome.MALFORMED, None  # a second object, or trailing noise
+    if not isinstance(payload, dict):
+        return Outcome.MALFORMED, None  # a list or a bare string is not a response
+    try:
+        # `\ud800` parses and cannot be written back as UTF-8 (M1). Through
+        # `encode`, whose walk also bounds the nesting: the C scanner reads two
+        # thousand brackets without complaint, and a plugin does not get to
+        # choose when the host falls over (D2).
+        encode(payload)
+    except (ValueError, RecursionError):
+        return Outcome.MALFORMED, None
+
+    return Outcome.OK, payload
+
+
+@dataclass(frozen=True)
+class Reply:
+    outcome: Outcome
+    payload: dict[str, Any] | None
+    invocation: Invocation | None  # None when no process was ever started
+
+    @property
+    def ok(self) -> bool:
+        return self.outcome is Outcome.OK
+
+
+def call(
+    command: Sequence[str],
+    request: Mapping[str, Any],
+    *,
+    timeout: float = DEFAULT_TIMEOUT,
+    max_output: int = DEFAULT_MAX_OUTPUT,
+) -> Reply:
+    """One plugin call, from a request mapping to a parsed response. Never raises (E2).
+
+    Only a clean exit has its output parsed: from a killed or truncated call it is
+    a fragment, whether or not it happens to parse.
+    """
+    try:
+        payload_bytes = encode(request)
+    except (ValueError, TypeError, RecursionError):
+        # No plugin is at fault and none ran, but there is no verdict either (E3).
+        return Reply(Outcome.UNENCODABLE, None, None)
+
+    invocation = invoke(command, payload_bytes, timeout=timeout, max_output=max_output)
+    if not invocation.ok:
+        return Reply(invocation.outcome, None, invocation)
+
+    outcome, payload = decode(invocation.stdout)
+    return Reply(outcome, payload, invocation)