secgraphai 1.0.0rc1__tar.gz

secgraphai-1.0.0rc1/.github/workflows/ci.yml

@@ -0,0 +1,51 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.11', '3.12', '3.13', '3.14']
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - run: python -m pip install --upgrade pip 'setuptools>=83'
+      - run: python -m pip install -e '.[test,api,security]'
+      - run: python -m ruff check src tests demo
+      - run: python -m mypy src
+      - run: python -m bandit -q -r src
+      - run: python -m coverage run --branch -m pytest -q
+      - run: python -m coverage report --include='src/secgraphai/*' --fail-under=90
+      - run: python -m pip_audit
+      - run: python -m build
+      - run: python -m pip install --force-reinstall --no-deps dist/*.whl
+      - run: secgraph --help
+
+  secrets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.13'
+      - run: python -m pip install detect-secrets
+      - run: detect-secrets scan --all-files --exclude-files '(^|/)(tests|\.git)/|SecGraphAI_PRD' > secrets-report.json
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: secrets-report
+          path: secrets-report.json

secgraphai-1.0.0rc1/.github/workflows/deep-security.yml

@@ -0,0 +1,44 @@
+name: Deep security
+
+on:
+  schedule:
+    - cron: '29 4 * * 6'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  mutation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.13'
+      - run: python -m pip install -e '.[test,api,security]' 'mutmut>=3,<4'
+      - run: mutmut run
+      - if: always()
+        run: mutmut results
+
+  fuzz-and-dynamic:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.13'
+      - run: python -m pip install -e '.[test,api,fuzz]'
+      - run: python -m pytest -q tests/test_prd_properties.py tests/test_prd_scanner_dashboard.py tests/test_prd_benchmark.py
+      - run: python fuzz/fuzz_parsers.py -runs=10000 -max_len=65536
+
+  self-dogfood:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.13'
+      - run: python -m pip install -e '.[test,api,security]'
+      - run: python -m secgraphai.cli self-audit --deep
+      - run: pytest -q tests/test_prd_scanner_dashboard.py tests/test_prd_security_branches.py

secgraphai-1.0.0rc1/.github/workflows/release.yml

@@ -0,0 +1,35 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write
+  attestations: write
+
+jobs:
+  publish:
+    environment: pypi
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.13'
+      - run: python -m pip install --upgrade pip 'setuptools>=83'
+      - run: python -m pip install -e '.[test,api,security]'
+      - run: python -m coverage run --branch -m pytest -q
+      - run: python -m coverage report --include='src/secgraphai/*' --fail-under=90
+      - run: python -m pip_audit
+      - run: python -m secgraphai.cli sbom generate --output secgraphai.cdx.json
+      - run: python -m build
+      - uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: 'dist/*'
+      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: actions/upload-artifact@v7
+        with:
+          name: release-sbom
+          path: secgraphai.cdx.json

secgraphai-1.0.0rc1/.github/workflows/security.yml

@@ -0,0 +1,40 @@
+name: Security
+
+on:
+  pull_request:
+  schedule:
+    - cron: '17 3 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  codeql:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: python
+      - uses: github/codeql-action/analyze@v4
+
+  semgrep:
+    runs-on: ubuntu-latest
+    container: semgrep/semgrep
+    steps:
+      - uses: actions/checkout@v7
+      - run: semgrep scan --config p/python --config p/security-audit --error src
+
+  adversarial:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.13'
+      - run: python -m pip install --upgrade pip 'setuptools>=83'
+      - run: python -m pip install -e '.[test,api,security]'
+      - run: pytest -q tests/test_prd_properties.py tests/test_prd_benchmark.py tests/test_prd_security_branches.py
+      - run: python -m secgraphai.cli self-audit --deep

secgraphai-1.0.0rc1/.gitignore

@@ -0,0 +1,12 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+.coverage
+build/
+dist/
+mutants/
+.venv/
+secgraph.db*
+

secgraphai-1.0.0rc1/.hypothesis/.gitignore

@@ -0,0 +1,9 @@
+# This .gitignore file was automatically created by Hypothesis. Hypothesis gitignores
+# .hypothesis by default, because we generally recommend that .hypothesis not be checked
+# into version control.
+#
+# If you *would* like to check .hypothesis into version control, you should delete this
+# file. Hypothesis will not re-create this .gitignore unless .hypothesis is deleted (and
+# if it does, that's a bug - please report it!)
+
+*

secgraphai-1.0.0rc1/.hypothesis/constants/00c79b23b3a4731d

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/storage.py
+# hypothesis_version: 6.167.1
+
+[100, 200, 448, 1000, ' WHERE scan_id = ?', 'attack_paths', 'baselines', 'bundles', 'document', 'documents', 'edges', 'enc:v1:', 'events', 'findings', 'graph_edges', 'graph_nodes', 'invalid pagination', 'jobs', 'json', 'links', 'nodes', 'plugin_registry', 'policies', 'reports', 'risk_paths', 'scans', 'secgraph.db', 'secgraphai', 'targets']

secgraphai-1.0.0rc1/.hypothesis/constants/03903408e6ec0fcd

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/demo/app.py
+# hypothesis_version: 6.167.1
+
+[100, 403, 404, 500, 10000, 100000, '/agent', '/email', '/rag', '/records/{record_id}', '/refund', '@example.test', 'A', 'B', 'a-1', 'a-safe', 'alice@example.test', 'amount', 'answer', 'api_key', 'approval required', 'b-1', 'b-poison', 'bob@example.test', 'email', 'false', 'forbidden', 'id', 'ignore previous', 'loop', 'not found', 'processed', 'refund', 'refunded', 'request rejected', 'secret', 'sent', 'ssn', 'status', 'tenant', 'text', 'tool_calls', 'tools', 'true']

secgraphai-1.0.0rc1/.hypothesis/constants/03c7900637dec143

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/intelligence.py
+# hypothesis_version: 6.167.1
+
+[0.25, 0.7, 1.0, 10.0, 30.0, 100, 304, 429, 512, 2000, 2048, 8192, 10000, 20000000, '*', ',', '-', '.cve-', '.json', '1.6', '2.3', ':', '<', '<=', '>', '>=', 'AFFECTED', 'CC0-1.0', 'CVE-\\d{4}-\\d{4,}', 'CWE-', 'CycloneDX', 'DISCOVERED', 'GET', 'If-Modified-Since', 'If-None-Match', 'MITIGATED', 'NOASSERTION', 'NOT_AFFECTED', 'NOT_APPLICABLE', 'NVD', 'NVD_API_KEY', 'Name', 'PACKAGE-MANAGER', 'PARTIAL', 'PRESENT', 'REACHABLE', 'SECURITY', 'SPDX-2.3', 'SPDXID', 'SPDXRef-DOCUMENT', 'SecGraphAI', 'SecGraphAI SBOM', 'TESTED', 'TEST_ERROR', 'Tool: SecGraphAI', 'VERIFIED_CONTROL', 'VERIFIED_FINDING', 'VERIFIED_IN_LAB', '\\', 'a', 'affected_ranges', 'affected_versions', 'agentic-2026', 'aliases', 'api-2023', 'apiKey', 'baseScore', 'bomFormat', 'complete', 'component', 'components', 'conditional', 'configurations', 'covered', 'cpe', 'cpe23Type', 'cpeMatch', 'created', 'creationInfo', 'creators', 'criteria', 'cve', 'cveID', 'cve_ids', 'cvss', 'cvssData', 'cwe_ids', 'dataLicense', 'delta', 'description', 'descriptions', 'documentNamespace', 'downloadLocation', 'en', 'environmentalScore', 'etag', 'externalRefs', 'filesAnalyzed', 'full', 'http', 'https', 'id', 'keywordSearch', 'known_exploited', 'lang', 'last-modified', 'lastModEndDate', 'lastModStartDate', 'lastModified', 'last_modified', 'library', 'llm-2026', 'metadata', 'metrics', 'missing', 'mode', 'name', 'next_start_index', 'nodes', 'not_modified', 'packages', 'percent', 'profile', 'properties', 'published', 'purl', 'pypi', 'query', 'reachable', 'records', 'referenceCategory', 'referenceLocator', 'referenceType', 'references', 'resultsPerPage', 'results_per_page', 'retry-after', 'retry_after', 'schema_version', 'secgraphai', 'severity', 'source', 'sourceIdentifier', 'spdxVersion', 'specVersion', 'ssvc', 'startIndex', 'start_index', 'states', 'status', 'synchronized_at', 'test_errors', 'threatScore', 'timestamp', 'tools', 'totalResults', 'total_results', 'type', 'unknown', 'url', 'utf-8', 'value', 'vectorString', 'vendor', 'version', 'versionEndExcluding', 'versionEndIncluding', 'versionInfo', 'vulnerabilities', 'vulnerable', 'w', 'weaknesses', 'web-2025']

secgraphai-1.0.0rc1/.hypothesis/constants/0550354c9828334d

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/core.py
+# hypothesis_version: 6.167.1
+
+['1.0', '1.0.0rc1', 'BLOCKED_BY_CONTROL', 'CRITICAL', 'DERIVED', 'DETERMINISTIC', 'HIGH', 'INCONCLUSIVE', 'INFO', 'LIKELY_VIOLATION', 'LOW', 'MEDIUM', 'OUT_OF_SCOPE', 'PASS', 'PROBABILISTIC', 'TEST_ERROR', 'VERIFIED_VIOLATION', 'cost_usd', 'external_calls', 'forbid', 'input_tokens', 'model_calls', 'output_tokens', 'retries', 'retrieval_calls', 'tool_calls', 'wall_time_ms']

secgraphai-1.0.0rc1/.hypothesis/constants/0ad7a417881b5e2f

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/evaluation.py
+# hypothesis_version: 6.167.1
+
+[1.0, 'cost_usd', 'external_calls', 'inf', 'input_tokens', 'model_calls', 'output_tokens', 'retries', 'retrieval_calls', 'tool_calls', 'wall_time_seconds']

secgraphai-1.0.0rc1/.hypothesis/constants/0e1404082b00bf3e

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/security_modules.py
+# hypothesis_version: 6.167.1
+
+[0.8, 429, 500, '*', '127.0.0.1', 'A02', 'A04', 'A10', 'AGENT-APPROVAL', 'AGENT-AUTHZ', 'AGENT-COST', 'AGENT-DELEGATION', 'AGENT-GOAL', 'AGENT-INTENT', 'AGENT-MEMORY', 'AGENT-MESSAGE', 'AGENT-PRIVILEGE', 'AGENT-RECURSION', 'AGENT-SCHEMA', 'AGENT-STATE', 'API-AI-COST', 'API-AUTHN', 'API-AUTHZ', 'API-DEBUG', 'API-ERROR', 'API-EXPECTATION', 'API-PAGINATION', 'API-PAYLOAD', 'API-PROPERTY-AUTHZ', 'API-RATE', 'API-SCHEMA', 'API-SSRF', 'API1', 'API2', 'API3', 'API4', 'API5', 'API7', 'API8', 'ASI01', 'ASI02', 'ASI03', 'ASI04', 'ASI06', 'ASI07', 'ASI08', 'ASI09', 'ASI10', 'BEHAVIOR_CHANGED', 'GET', 'INVARIANT_VIOLATED', 'LLM01', 'LLM02', 'LLM05', 'LLM06', 'LLM07', 'LLM08', 'LLM09', 'MCP-APPROVAL', 'MCP-AUTHZ', 'MCP-CHAIN', 'MCP-CREDENTIAL', 'MCP-DESTINATION', 'MCP-DRIFT', 'MCP-EXPOSURE', 'MCP-INJECTION', 'MCP-METADATA', 'MCP-ORIGIN', 'MCP-OUTPUT-INJECTION', 'MCP-TOKEN-SCOPE', 'MCP-TRANSPORT', 'OWASP', 'POLICY_DEVIATION', 'RAG-AUTHZ', 'RAG-CANARY', 'RAG-CITATION', 'RAG-CLEANUP', 'RAG-CONFIG', 'RAG-CROSS-TENANT', 'RAG-FLOOD', 'RAG-INJECTION', 'RAG-METADATA', 'RAG-POISON', 'RAG-PROVENANCE', 'RAG-SENSITIVE', 'REACHED_MODEL', 'TOOL_EXECUTED', 'TOOL_REQUESTED', '[::1]', 'access_token', 'actual_state', 'admin', 'agent', 'agent_message', 'all', 'allowed', 'allowedOrigins', 'allowed_origins', 'annotations', 'api_key', 'approved', 'authorization', 'authorized', 'baseline', 'bearer ', 'callback', 'callsTools', 'calls_tools', 'chain', 'citation', 'confidential', 'content', 'credit_card', 'cross-agent', 'delegation', 'delete', 'description', 'destinations', 'direct', 'document', 'downstream', 'error', 'events', 'exception', 'expected', 'expected_state', 'external', 'external-action', 'externalDestinations', 'function', 'get', 'goal', 'goal_change', 'hierarchy', 'high', 'http://', 'identity', 'ignore previous', 'in_intent', 'indirect', 'instruction', 'inventory', 'keys', 'kind', 'limit', 'localhost', 'maxProperties', 'max_results', 'maximum', 'mcp', 'mcp-resource', 'memory', 'memory_write', 'metadata', 'metadata_filtering', 'method', 'multi-agent', 'multi-turn', 'multimodal', 'name', 'namespace_isolation', 'obfuscated', 'object', 'observed', 'operation', 'origins', 'outputSchema', 'override', 'override policy', 'owner', 'page_size', 'pagesize', 'parameters', 'password', 'patch', 'path', 'paths', 'permissions', 'pii', 'post', 'privilege_change', 'privileged', 'problem', 'provenance', 'put', 'rag', 'rag-injection', 'requestBody', 'requesting', 'requests', 'requiresApproval', 'responses', 'reveal secret', 'risk', 'root', 'schema', 'scopes', 'secgraphai', 'secret', 'security', 'send secret', 'sensitivity', 'sequence', 'server', 'setting', 'source', 'sqlalchemy', 'ssn', 'stack trace', 'state', 'state_transition', 'status', 'statuses', 'synthetic', 'system override', 'system-extraction', 'system_prompt', 'tenant', 'token', 'tokenScopes', 'token_scopes', 'tool', 'tool-calls', 'tool-output', 'tool-schema', 'tool_schema_change', 'tools', 'traceback', 'trusted-test', 'trusted_as_control', 'type', 'unknown', 'untrusted', 'upload', 'uploaded-document', 'uri', 'url', 'user', 'web', 'web-content', 'webhook', 'x-ai-endpoint', 'x-cost-limit', 'x-debug', 'x-rate-limit']

secgraphai-1.0.0rc1/.hypothesis/constants/0e730d4a35917c80

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/cli.py
+# hypothesis_version: 6.167.1
+
+[100, 120, 443, 1000, 8000, 8777, '--against', '--allow-private', '--allow-unverified', '--api-key-env', '--baseline', '--budget-usd', '--cache', '--config', '--dashboard', '--database', '--deep', '--encryption-key-env', '--event', '--fail-on-regression', '--fail-on-violation', '--force', '--format', '--host', '--mask-pii', '--max-duration', '--max-requests', '--minimum-percent', '--mode', '--model', '--output', '--port', '--profile', '--public-key', '--query', '--retention-days', '--root', '--target', '--token-env', '-c', '-o', '.', '.secgraph/baselines', '127.0.0.1', ':', '::1', 'Component', 'Count', 'NO_SECRET_EXFIL', 'Python', 'SAFE', '__main__', 'adaptive', 'affected', 'age_seconds', 'agent', 'allowed_hosts', 'allowed_ports', 'api', 'api_key_env', 'attacks', 'audit', 'base_url', 'baseline', 'blocked_networks', 'bom.json', 'bundle', 'cached', 'cloud_upload', 'compare', 'components', 'counts', 'coverage', 'create', 'cve', 'cve-cache.json', 'cyclonedx', 'deny', 'description', 'destination', 'dev', 'diff', 'draft-pack.json', 'engines', 'etag', 'expected', 'external', 'fetched', 'gate', 'generate', 'generate-test', 'graph', 'http://', 'https', 'https://', 'id', 'identity', 'import', 'init', 'inputs', 'inspect', 'invariants', 'json', 'last-(\\d+)-days', 'last_modified', 'llm', 'llm-2026', 'localhost', 'mask_pii', 'max_duration_seconds', 'max_total_requests', 'mcp', 'media', 'metadata', 'mode', 'model', 'new', 'next_start_index', 'official', 'openapi', 'owasp', 'owasp-agentic-2026', 'owasp-api-2023', 'owasp-full', 'owasp-llm-2026', 'owasp-web-2025', 'packs', 'passed', 'plugins', 'policy', 'privacy', 'prompt-injection', 'pytest', 'query', 'rag', 'reachable', 'reasons', 'regressions', 'render', 'replay', 'report', 'require_stable_dns', 'research', 'resumed_from', 'review', 'safe', 'sbom', 'scan', 'scan_id', 'schemas', 'scope', 'search', 'secgraph.db', 'secgraph.yaml', 'secret', 'self-audit', 'sensitivity', 'serve', 'show', 'simulate', 'source', 'spdx', 'spdxVersion', 'status', 'summary', 'sync', 'synchronized_at', 'target', 'telemetry', 'terminal', 'test', 'trust', 'utf-8', 'verify', 'version', '{}']

secgraphai-1.0.0rc1/.hypothesis/constants/1256bf512abf999b

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/scanner.py
+# hypothesis_version: 6.167.1
+
+[0.2, 0.35, 0.4, 0.6, 0.65, 0.75, 0.8, 1.0, 100, 120, 401, 403, 443, 1000, 8000, 'BEHAVIOR_CHANGED', 'CALLBACK_OBSERVED', 'INVARIANT_VIOLATED', 'LLM02', 'NO_SECRET_EXFIL', 'OWASP_LLM_2026', 'POLICY_DEVIATION', 'REACHED_MODEL', 'TOOL_EXECUTED', 'TOOL_REQUESTED', 'VERIFIED_EFFECT', 'adaptive', 'allowed_hosts', 'allowed_ports', 'api_key_env', 'attacker', 'base_url', 'blocked_networks', 'boundary_progress', 'callbacks', 'canary', 'content', 'context', 'controls', 'destination', 'error', 'features', 'flow', 'genetic', 'graph', 'http', 'https', 'invariants', 'json', 'max_duration_seconds', 'max_total_requests', 'metadata', 'model', 'model_parameters', 'output', 'principal', 'prompt', 'prompt_hash', 'remediation', 'reproduction', 'require_stable_dns', 'resisted', 'retrieval_settings', 'role', 'roles', 'scope', 'source', 'stages', 'static', 'status_code', 'strategy', 'target', 'tenant', 'test_id', 'tool', 'tool_schemas', 'tools', 'user', 'verified']

secgraphai-1.0.0rc1/.hypothesis/constants/13ddb56c93054742

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/policy.py
+# hypothesis_version: 6.167.1
+
+['.', '__', 'allow', 'contains', 'default', 'deny', 'effect', 'enforce', 'eq', 'gt', 'gte', 'id', 'in', 'log', 'lt', 'lte', 'match', 'matched policy rule', 'mode', 'ne', 'options', 'priority', 'rate_limit', 'reason', 'redact', 'require_approval', 'rules', 'sandbox', 'shadow', 'transform', 'utf-8']

secgraphai-1.0.0rc1/.hypothesis/constants/17bb152ddb6eda64

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/security.py
+# hypothesis_version: 6.167.1
+
+[120, 443, 1000, '*', '-', '.', '0', '0.0.0.0/8', '10.0.0.0/8', '100.64.0.0/10', '127.0.0.0/8', '127.0.0.1', '169.254.0.0/16', '172.16.0.0/12', '192.168.0.0/16', '198.18.0.0/15', '224.0.0.0/4', ':', '::1/128', '[PII]', '[REDACTED]', '_', 'account_deletion', 'allowed_hosts', 'api_key', 'apikey', 'auth', 'authorization', 'blocked_networks', 'cloud_upload', 'cookie', 'cors', 'dashboard', 'debug', 'destructive_write', 'evidence', 'fc00::/7', 'fe80::/10', 'host', 'http', 'https', 'in_process', 'localhost', 'max_total_requests', 'mode', 'password', 'plugins', 'privacy', 'proxy_authorization', 'redact', 'scope', 'secret', 'session', 'session_id', 'set_cookie', 'telemetry', 'token', 'trusted', 'x_api_key']

secgraphai-1.0.0rc1/.hypothesis/constants/1863497317d95972

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/config.py
+# hypothesis_version: 6.167.1
+
+[100, 120, 8000, 10000, 86400, 1000000, '0.0.0.0/8', '10.0.0.0/8', '100.64.0.0/10', '127.0.0.0/8', '169.254.0.0/16', '172.16.0.0/12', '192.168.0.0/16', '198.18.0.0/15', '224.0.0.0/4', '::1/128', 'CUSTOM', 'LAB', 'PASSIVE', 'SAFE', '_', 'account_deletion', 'destructive_write', 'encryption_key_env', 'fc00::/7', 'fe80::/10', 'forbid', 'localhost', 'token_env', 'utf-8']

secgraphai-1.0.0rc1/.hypothesis/constants/2ae4e5ca09dd1472

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/graph.py
+# hypothesis_version: 6.167.1
+
+['AFFECTED_BY', 'APIEndpoint', 'AUTHENTICATES_AS', 'Agent', 'BELONGS_TO_TENANT', 'Browser', 'CAN_CALL', 'CAN_INFLUENCE', 'CAN_READ', 'CAN_WRITE', 'CONTAINS', 'CROSSES_BOUNDARY', 'CROSS_TENANT', 'Component', 'DataAsset', 'Database', 'Document', 'EXECUTES', 'EXECUTION_CYCLE', 'Embedding', 'ExternalService', 'File', 'GUARDED_BY', 'Identity', 'MCPResource', 'MCPServer', 'Memory', 'Model', 'NetworkBoundary', 'Policy', 'Principal', 'Prompt', 'RECEIVES_FROM', 'REQUIRES_PERMISSION', 'RETRIEVES_FROM', 'Retriever', 'SENDS_TO', 'Secret', 'Session', 'Tool', 'User', 'VectorStore', 'Vulnerability', 'anonymous', 'authentication', 'category', 'confidential', 'control_plane', 'destination_tenant', 'edges', 'external', 'high', 'kind', 'length', 'low', 'multiple-tenants', 'path', 'pii', 'privilege', 'privileged', 'produces_output', 'protected', 'risk-path', 'score', 'secret', 'sensitivity', 'source_tenant', 'tenant', 'trust', 'untrusted']

secgraphai-1.0.0rc1/.hypothesis/constants/35b8474cfb611e04

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/demo/assessment.py
+# hypothesis_version: 6.167.1
+
+[403, 1000, '/email', '/records/b-1', '/refund', '127.0.0.1', 'A', 'GET', 'POST', 'X-Tenant', 'a-1', 'allowed', 'amount', 'approval', 'content', 'customer_id', 'demo', 'destination', 'external', 'external_data_flow', 'external_side_effect', 'function', 'high', 'http://127.0.0.1', 'id', 'ignore previous', 'in_intent', 'kind', 'loop', 'low', 'object_authorization', 'prompt_injection', 'recursion_budget', 'risk', 'source', 'tenant', 'text', 'tool', 'tool_calls', 'tools']

secgraphai-1.0.0rc1/.hypothesis/constants/373954cfba184222

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/invariants.py
+# hypothesis_version: 6.167.1
+
+['$resource.', '_eq', '_gt', '_gte', '_lt', '_lte', 'context', 'controls', 'deny', 'destination', 'equal', 'flow', 'invariants', 'missing_controls', 'principal', 'source', 'tool', 'unequal', 'utf-8']

secgraphai-1.0.0rc1/.hypothesis/constants/457ccc1355f72abe

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/schemas.py
+# hypothesis_version: 6.167.1
+
+['$id', '$schema', '1.0', 'LOCAL', 'TRUSTED_OFFICIAL', 'TRUSTED_ORGANIZATION', 'UNVERIFIED_COMMUNITY', 'additionalProperties', 'allow', 'array', 'attack-pack-1.0.json', 'attacks', 'category', 'conversation_depth', 'cost', 'default', 'deny', 'effect', 'enforce', 'enum', 'family', 'framework', 'id', 'integer', 'items', 'log', 'mappings', 'match', 'minLength', 'minimum', 'minimum_engine', 'mode', 'moderate', 'null', 'object', 'options', 'policy-1.0.json', 'priority', 'prompt', 'properties', 'publisher', 'rate_limit', 'rationale', 'reason', 'redact', 'report-1.0.json', 'require_approval', 'required', 'rules', 'sandbox', 'shadow', 'signature', 'source', 'strength', 'string', 'strong', 'tags', 'target_invariant', 'transform', 'trust', 'type', 'utf-8', 'version', 'weak']

secgraphai-1.0.0rc1/.hypothesis/constants/4e0113644b40370f

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/validators.py
+# hypothesis_version: 6.167.1
+
+[1.0, '$.', ',', '.', 'Marker search', 'Observed tenant', 'Policy effect', 'Response is not JSON', 'Secret pattern scan', 'authorization', 'callbacks', 'database-state', 'description', 'effect', 'file-state', 'http-callback', 'json-schema', 'kind', 'marker', 'metadata', 'observed', 'policy', 'required', 'secret', 'state', 'tenant', 'tool', 'tools']

secgraphai-1.0.0rc1/.hypothesis/constants/4f65fc5ceb965987

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/plugins.py
+# hypothesis_version: 6.167.1
+
+[1024, 2000000, ',', '--cap-drop', '--cpus', '--env', '--interactive', '--memory', '--network', '--pids-limit', '--read-only', '--rm', '--security-opt', '--tmpfs', '/', '0', '1', '256m', '64', ':', 'ALL', 'PATH', 'PYTHONIOENCODING', 'SECGRAPH_PLUGIN', 'artifact_sha256', 'command', 'community', 'container', 'credentials.raw', 'docker', 'in_process', 'local', 'max_output_bytes', 'mode', 'name', 'no-new-privileges', 'none', 'organization', 'output_schema', 'permissions', 'podman', 'rb', 'required', 'run', 'secgraph-plugin-', 'subprocess', 'trust', 'trusted', 'utf-8', 'version']

secgraphai-1.0.0rc1/.hypothesis/constants/53594f3abb8d0bb1

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/adapters.py
+# hypothesis_version: 6.167.1
+
+[0.5, 0.8, 1.0, 200, 4000, '1', '2', '3', 'CRITICAL', 'CWE', 'HIGH', 'INFO', 'LIKELY_VIOLATION', 'LOW', 'MEDIUM', 'Nuclei finding', 'OSV vulnerability', 'PASS', 'Potential secret', 'SARIF finding', 'Semgrep finding', 'ZAP finding', 'alert', 'alerts', 'aliases', 'api-property-testing', 'check_id', 'codeql', 'confidence', 'content-filtering', 'critical', 'cwe', 'deepteam', 'dependencies', 'description', 'details', 'detect-secrets', 'dynamic-api-testing', 'engine', 'error', 'extra', 'failures', 'findings', 'garak', 'high', 'id', 'info', 'is_valid', 'issues', 'level', 'llmguard', 'low', 'mappings', 'medium', 'message', 'metadata', 'model-probes', 'model-supply-chain', 'modelscan', 'name', 'note', 'nuclei', 'osv', 'packages', 'pass', 'passed', 'pii-detection', 'pip-audit', 'pluginid', 'presidio', 'probes', 'prompt-evaluation', 'prompt-injection', 'promptfoo', 'pyrit', 'raw_id', 'reason', 'red-team', 'results', 'risk', 'risk_score', 'riskcode', 'ruleId', 'runs', 'safe', 'scanner', 'schemathesis', 'score', 'secret-detection', 'semgrep', 'severity', 'site', 'static-analysis', 'status', 'summary', 'target', 'template-id', 'template-scanning', 'templates', 'test', 'test_id', 'tests', 'text', 'title', 'type', 'verdict', 'vulnerabilities', 'vulns', 'warning', 'zap']

secgraphai-1.0.0rc1/.hypothesis/constants/594d49c6a361d903

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/supply_chain.py
+# hypothesis_version: 6.167.1
+
+[1024, 2000000, 10000000000, '*', '.', '.bin', '.dill', '.gguf', '.joblib', '.json', '.onnx', '.pickle', '.pkl', '.pt', '.pth', '.safetensors', 'rb', 'unknown', 'utf-8']

secgraphai-1.0.0rc1/.hypothesis/constants/5bd1ff3f86003943

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/self_security.py
+# hypothesis_version: 6.167.1
+
+[180, 1024, ', ', '--format', '-m', '127.0.0.1', '::1', '; ', '=', 'Config permissions', 'Configuration safety', 'Dashboard bind', 'Database permissions', 'FAIL', 'N/A', 'PASS', 'Package integrity', 'Plugin signatures', 'RECORD', 'SG-SECRET', 'Secret exposure', 'TLS configuration', 'Unexpected plugins', 'Version freshness', 'WARN', '[REDACTED]', '_KEY', '_SECRET', '_TOKEN', 'api_key', 'audit_sha256', 'checks', 'dashboard', 'host', 'json', 'localhost', 'metadata', 'nt', 'organization', 'passed', 'pip_audit', 'rb', 'secgraphai', 'sha256=', 'tls', 'trusted']

secgraphai-1.0.0rc1/.hypothesis/constants/63365995458d761c

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/provenance.py
+# hypothesis_version: 6.167.1
+
+['CONFIDENTIAL', 'EXTERNAL', 'MEMORY', 'MODEL_GENERATED', 'PII', 'RAG', 'SECRET', 'SYSTEM', 'T', 'TOOL_DATA', 'UNTRUSTED', 'USER', 'derived', 'exact', 'mixed', 'probabilistic', 'trusted', 'unknown', 'untrusted']

secgraphai-1.0.0rc1/.hypothesis/constants/68cdaef8b5af732e

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/attacks.py
+# hypothesis_version: 6.167.1
+
+[2000000, ',', '-', '0', '1.0.0rc1', '2026', ':', 'ASI02', 'Encode the answer:', 'In a simulation,', 'LLM01', 'LLM08', 'LLM09', 'LOCAL', 'OWASP Agentic', 'OWASP LLM', 'Step by step,', 'TENANT_ISOLATION', 'TOOL_AUTHORIZATION', 'TRUSTED_OFFICIAL', 'TRUSTED_ORGANIZATION', 'UNVERIFIED_COMMUNITY', '_', 'agent', 'ascii', 'attacks', 'category', 'conversation_depth', 'cost', 'family', 'framework', 'id', 'identity', 'indirect-injection', 'llm', 'mappings', 'mcp', 'minimum_engine', 'moderate', 'official_ed25519.pub', 'pi-direct', 'pi-indirect', 'prompt', 'prompt-injection', 'publisher', 'rag', 'rag-exfil', 'rag-exfiltration', 'rationale', 'secgraphai', 'secgraphai.packs', 'signature', 'source', 'strength', 'strong', 'system-leak', 'tags', 'target_invariant', 'tool', 'tool-abuse', 'tool-escalate', 'trust', 'user', 'utf-8', 'version', 'weak']

secgraphai-1.0.0rc1/.hypothesis/constants/6b42f66b3560a7e2

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/research.py
+# hypothesis_version: 6.167.1
+
+[1000, 20000000, '(?<=[.!?])\\s+', '.pdf', '0.0.0-draft', '1.0.0rc1', 'activated', 'attack', 'bypass', 'exploit', 'inject', 'limitations', 'local-import', 'replace', 'research-draft', 'source_sha256', 'utf-8']

secgraphai-1.0.0rc1/.hypothesis/constants/6c8d8b43a35f89cb

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/runtime.py
+# hypothesis_version: 6.167.1
+
+['F', 'after_sync', 'agent', 'allowed', 'approval', 'before_sync', 'drop_fields', 'effect', 'enforced', 'explanation', 'fields', 'function', 'kind', 'labels', 'maximum', 'normal', 'permission', 'permissions', 'policy', 'reason', 'redact', 'retriever', 'risk', 'rule_id', 'sandboxed', 'sensitive', 'tenant', 'tool', 'transform', 'user', 'when', 'window_seconds']

secgraphai-1.0.0rc1/.hypothesis/constants/7a1631ce034da8b3

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/model.py
+# hypothesis_version: 6.167.1
+
+[200, 2000000, '/', 'Accept', 'Authorization', 'POST', 'application/json', 'choices', 'content', 'message', 'messages', 'model', 'revalidate']

secgraphai-1.0.0rc1/.hypothesis/constants/8d1347f4554e562f

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/demo/__init__.py
+# hypothesis_version: 6.167.1
+
+[]

secgraphai-1.0.0rc1/.hypothesis/constants/96dd42550b2ebc7e

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/reporting.py
+# hypothesis_version: 6.167.1
+
+['## Audit manifest', '## Limitations', '## Resource usage', '%s', '.', '</tr>', '<tr>', '\\|', '```', '```json', 'csv', 'fingerprint', 'html', 'id', 'json', 'jsonl', 'junit', 'markdown', 'md', 'pdf', 'sarif', 'severity', 'title', 'utf-8', 'verdict', 'xml', '|', '|---|---|---|---|']

secgraphai-1.0.0rc1/.hypothesis/constants/9ffc2aa542b5d099

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/dashboard.py
+# hypothesis_version: 6.167.1
+
+[100, 120, 202, 401, 404, 413, 422, 429, 1000, 4401, 2000000, ',', '/', '/api/v1/attack-paths', '/api/v1/events', '/api/v1/findings', '/api/v1/graph', '/api/v1/health', '/api/v1/policies', '/api/v1/reports', '/api/v1/scan-jobs', '/api/v1/scans', '/api/v1/self-audit', '/api/v1/targets', '/api/v1/views/{view}', '/health', '/static', '127.0.0.1', ':', '::1', 'AGENT-', 'API-', 'API-AUTHZ-', 'Bearer ', 'COMPLETED', 'Cache-Control', 'DENY', 'FAILED', 'IDENTITY-', 'MCP-', 'Model', 'PI-', 'QUEUED', 'RAG-', 'RUNNING', 'Referrer-Policy', 'SG-AGENT-', 'SG-API-', 'SG-API-AUTHZ-', 'SG-IDENTITY-', 'SG-MCP-', 'SG-PI-', 'SG-PROMPT-', 'SG-RAG-', 'SecGraphAI', 'X-Frame-Options', 'adaptive', 'agent', 'agents', 'allowed', 'api-security', 'architecture', 'artifacts', 'attack-graph', 'attack-paths', 'attack_budget', 'audit', 'authentication', 'authorization', 'bearer', 'bind_host', 'by_severity', 'by_verdict', 'configuration', 'content-length', 'coverage', 'decisions', 'detail', 'edges', 'effect', 'error', 'events', 'finding_id', 'finding_ids', 'findings', 'graph', 'heartbeat', 'http', 'id', 'identities', 'index.html', 'items', 'job_id', 'jobs', 'json', 'kind', 'known_exploited', 'llm-2026', 'local', 'localhost', 'match', 'max_body_bytes', 'mcp', 'mode', 'models', 'modules', 'no-referrer', 'no-store', 'nodes', 'nosniff', 'not found', 'ok', 'options', 'overview', 'owasp', 'owasp-coverage', 'policies', 'priority', 'prompt-injection', 'rag', 'rate limit exceeded', 'reason', 'regression-tests', 'reports', 'request too large', 'resources', 'risk_paths', 'rules', 'runtime', 'scan.completed', 'scan.failed', 'scan.queued', 'scan.running', 'scan_id', 'scans', 'secgraphai', 'self-audit', 'self-security', 'settings', 'state', 'static', 'status', 'summary', 'target not found', 'target_id', 'targets', 'telemetry', 'test_errors', 'time', 'total', 'type', 'unauthorized', 'verified', 'view', 'vulnerabilities', 'would_block']

secgraphai-1.0.0rc1/.hypothesis/constants/a2eabf9a65f9e727

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/multimodal.py
+# hypothesis_version: 6.167.1
+
+[50000000, '.json', '.md', '.xml', 'application/pdf', 'replace', 'text/', 'utf-8']

secgraphai-1.0.0rc1/.hypothesis/constants/aa2d985d0efcca81

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/discovery.py
+# hypothesis_version: 6.167.1
+
+[200, 443, 2000000, '*', '.json', '.py', '.yaml', '.yml', '/openapi.json', ':', 'GET', 'agent', 'agents', 'annotated', 'api', 'attributes', 'calls', 'chroma', 'configuration', 'delete', 'dynamic', 'environment', 'external', 'external_service', 'external_services', 'faiss', 'fastapi', 'field', 'function', 'gen_ai.model', 'gen_ai.request.model', 'gen_ai.tool.name', 'get', 'graphql', 'head', 'host', 'http', 'http.method', 'http.request.method', 'http.route', 'http_traces', 'https', 'id', 'identities', 'identity', 'kind', 'mcp', 'mcp_resource', 'mcp_server', 'mcp_server_id', 'mcp_servers', 'mcpclient', 'metadata_discovery', 'method', 'methods', 'model', 'models', 'mutation', 'name', 'operation', 'operation_id', 'options', 'otel', 'otel_spans', 'parameter', 'patch', 'path', 'paths', 'permissions', 'post', 'principal', 'prompt', 'protected', 'protocol', 'put', 'ragtarget', 'reads', 'requires_approval', 'retriever', 'retrievers', 'retrieves_from', 'risk', 'routes', 'schema', 'security', 'sends_to', 'server', 'serverInfo', 'source', 'span', 'subscription', 'tool', 'tool.name', 'tools', 'trust', 'trust_boundaries', 'trust_boundary', 'uri', 'url', 'utf-8', 'value', 'value_redacted', 'vector_store', 'vector_stores', 'writes']

secgraphai-1.0.0rc1/.hypothesis/constants/b5befa58771c59d5

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/canary.py
+# hypothesis_version: 6.167.1
+
+['document', 'id', 'memory', 'record', 'replace', 'secret', 'tool', 'utf-8']

secgraphai-1.0.0rc1/.hypothesis/constants/b62ab6adfcfd8e16

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/roles.py
+# hypothesis_version: 6.167.1
+
+[4000, 'asset', 'attack', 'base_url', 'confidence', 'content', 'evidence', 'invariant', 'json', 'judge', 'judges', 'mappings', 'model', 'output', 'prompt', 'remediation', 'role', 'system', 'target', 'title', 'user', 'violation']

secgraphai-1.0.0rc1/.hypothesis/constants/bad1bf67bf75338c

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/__init__.py
+# hypothesis_version: 6.167.1
+
+['Attack', 'AttackMapping', 'AttackMemory', 'AttackPack', 'AttackPlanner', 'Confidence', 'Config', 'DifferentialResult', 'DiscoveredComponent', 'DiscoveryInventory', 'EdgeType', 'Evidence', 'Finding', 'Interaction', 'Invariant', 'InvariantEngine', 'Label', 'Mode', 'Model', 'ModelRole', 'ModelRoles', 'NodeType', 'PackTrust', 'PolicyEngine', 'Provenance', 'Report', 'ResourceUsage', 'Rule', 'ScanManifest', 'SecGraph', 'SecurityGraph', 'Sensitive', 'Severity', 'Tainted', 'UtilityResult', 'Verdict', 'Verification', 'canary', 'compare_utility', 'detect_amplification', 'discover_fastapi', 'discover_mcp', 'discover_path', 'discover_url', 'invariant', 'load_official_pack', 'measure', 'secgraph']

secgraphai-1.0.0rc1/.hypothesis/constants/cf7dc441e460f488

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/lifecycle.py
+# hypothesis_version: 6.167.1
+
+[100, 10000000, '\x00', '$schema', ',', '..', '1', '2.1.0', ':', 'CRITICAL', 'HIGH', 'LIKELY_VIOLATION', 'PASS', 'SecGraphAI', 'TEST_ERROR', 'VERIFIED_VIOLATION', '[^A-Za-z0-9_]', '_', 'artifact_hashes', 'cases', 'ci', 'confidence', 'config_hash', 'configuration', 'configuration.json', 'driver', 'environment', 'error', 'evidence', 'executable', 'expected', 'fail_on_new', 'fail_on_test_error', 'failure', 'finding_id', 'findings', 'fingerprint', 'forbid', 'forbidden marker', 'forbidden_markers', 'forbidden_verdicts', 'graph', 'hashes', 'id', 'implementation', 'inputs.json', 'interactions', 'invalid replay case', 'invariant', 'json', 'junit', 'level', 'limitations', 'manifest', 'manifest.json', 'mappings', 'message', 'name', 'new', 'note', 'partialFingerprints', 'platform', 'policies', 'policies.json', 'policy', 'policy_hash', 'prompt', 'properties', 'pytest', 'python', 'regression_tests', 'replayable', 'report.json', 'reports', 'resolved', 'results', 'ruleId', 'runs', 'schema', 'secgraph-regression', 'secgraphFingerprint', 'secgraphai', 'secgraphai.generated', 'sha256', 'test_id', 'testcase', 'tests', 'tests.json', 'testsuite', 'text', 'tool', 'unchanged', 'unicode', 'utf-8', 'verdict', 'version', 'w', 'warning', 'yaml']

secgraphai-1.0.0rc1/.hypothesis/constants/d19dd4c0425a4b1b

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/instrumentation.py
+# hypothesis_version: 6.167.1
+
+[500, 1000, 'F', 'X-SecGraph-Trace', '__name__', 'callable', 'chat', 'completions', 'fastapi', 'http', 'httpx', 'langchain', 'langgraph', 'mcp', 'method', 'openai', 'request', 'response', 'secgraph.duration_ms', 'secgraph.name', 'secgraph.success', 'secgraph_started', 'status', 'x-request-id']

secgraphai-1.0.0rc1/.hypothesis/constants/e79554e1cb15be15

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/packs/__init__.py
+# hypothesis_version: 6.167.1
+
+[]

secgraphai-1.0.0rc1/.hypothesis/constants/f15e97de0390a51d

@@ -0,0 +1,4 @@
+# file: /home/runner/work/SecGraphAI/SecGraphAI/src/secgraphai/targets.py
+# hypothesis_version: 6.167.1
+
+[200, 201, 204, 401, 403, 1000, 1000000, 2000000, ',', '/', ':', 'Authorization', 'DELETE', 'GET', 'HEAD', 'OPTIONS', 'account_deletion', 'active_write', 'additionalProperties', 'delete', 'description', 'destructive_write', 'external_side_effect', 'get', 'head', 'initialize', 'inputSchema', 'metadata_discovery', 'method', 'name', 'operationId', 'options', 'patch', 'path', 'paths', 'post', 'prompts', 'prompts/list', 'put', 'read', 'replace', 'resources', 'resources/list', 'revalidate', 'security', 'server', 'tools', 'tools/list', 'utf-8']

secgraphai-1.0.0rc1/.hypothesis/constants/f6018d68f0966e42

@@ -0,0 +1,4 @@
+# file: /tmp/pytest-of-runner/pytest-0/test_replay_cli_reruns_and_fai0/replay_callback.py
+# hypothesis_version: 6.167.1
+
+['LEAK-MARKER']

secgraphai-1.0.0rc1/CHANGELOG.md

@@ -0,0 +1,47 @@
+# Changelog
+
+All notable changes to SecGraphAI are documented here. The project follows Semantic
+Versioning and the format is based on Keep a Changelog.
+
+## [Unreleased]
+
+- Enforced PASSIVE, SAFE, LAB, and CUSTOM request modes and recorded finding reproduction inputs.
+- Added executable replay verification, persisted dashboard scan jobs, and authenticated live events.
+- Added four independent model roles, boundary-progress adaptive search, and a package-driven
+  six-behavior vulnerable/hardened benchmark.
+- Added incremental CVE cache metadata/freshness and digest-pinned container plugin isolation.
+- Added resumable, rate-aware NVD paging and all PRD-documented installation extras.
+- Added MCP and OpenTelemetry architecture discovery with graph relationships and public APIs.
+- Added a detailed user guide with callback, model, API, RAG, MCP, agent, CI, and dashboard scenarios.
+- Expanded security and integration coverage to more than 450 tests.
+- Completed principal/tool/condition/control invariant evaluation and full resource accounting.
+- Expanded RAG, MCP, API, and agent checks and normalized every declared external-engine format.
+- Added live FastAPI route discovery, declared graph relationships, and environment-name-only metadata.
+- Added conditional/delta NVD synchronization, encrypted/retained storage, optional PII masking,
+  broader credential redaction, DNS rebinding detection, and replay compression-ratio limits.
+- Added baseline-aware `secgraph test`, historical policy simulation, and dedicated dashboard views.
+
+## [1.0.0rc1] - 2026-09-07
+
+- Connected attack planning, validators, target execution, policy enforcement, and evidence.
+- Added complete CLI workflow groups, dashboard API/frontend, CVE/CycloneDX/SPDX intelligence,
+  instrumentation, security modules, adapters, signed packs, and benchmark applications.
+- Added release-candidate security, property, integration, and packaging verification.
+
+## [0.9.0] - 2026-09-07
+
+- Added validators, judge ensembles, API/identity, RAG, MCP, provenance, and policy primitives.
+- Added adaptive planning, memory, novelty/evolution, and signed attack packs.
+- Added baselines, replay bundles, pytest generation, SARIF, and JUnit.
+- Added OWASP coverage, SBOM/CVE intelligence, security gates, plugin isolation, and dashboard API.
+- Expanded the suite with over 300 parameterized unit and security cases.
+
+## [0.1.0] - 2026-09-07
+
+### Added
+
+- Initial package, CLI, OpenAI-compatible model adapter, and callback scanner.
+- Typed security graph, invariants, findings, evidence, and verdicts.
+- Runtime authorization and approval interception.
+- Deterministic canaries, scope controls, secret redaction, configuration doctor,
+  secure HTML/JSON reporting, and SQLite report storage.

secgraphai-1.0.0rc1/LICENSE

@@ -0,0 +1,18 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+Copyright 2026 SecGraphAI contributors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+