shadowshield 0.6.1__tar.gz → 0.6.2__tar.gz

{shadowshield-0.6.1 → shadowshield-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: shadowshield
-Version: 0.6.1
+Version: 0.6.2
 Summary: Unified open-source security shield for agentic AI systems — inspired by Sentinel & ShadowClaw.
 Project-URL: Homepage, https://shadowshield.xyz
 Project-URL: Documentation, https://github.com/0xsl1m/shadowshield#readme
@@ -149,8 +149,9 @@ print(result.safe_text)            # safe fallback message
 > in-distribution **regression baseline, not a SOTA claim**. We publish the humbling
 > external numbers on purpose — a credible security tool shows its homework.
 > The frozen blind semantic snapshots are harder still: v1 reaches 26.7% recall /
-> 13.3% FPR and v2 reaches 0% / 10%. Run
-> `shadowshield benchmark --generalization v2`; these gaps are public by design.
+> 13.3% FPR, v2 reaches 0% / 10%, and v3 reaches 30% / 30%; the 90-row aggregate
+> is 22.2% / 20%. Run `shadowshield benchmark --generalization all`; these gaps
+> are public by design.
 
 ---
 
@@ -295,7 +296,7 @@ shadowshield detectors          # list registered detectors
 shadowshield init > shield.yaml # write an annotated default config
 shadowshield benchmark          # run the bundled offline benchmark
 shadowshield benchmark --adversarial
-shadowshield benchmark --generalization v2  # frozen blind semantic snapshot
+shadowshield benchmark --generalization all # all frozen blind semantic snapshots
 shadowshield serve              # HTTP server + live dashboard (needs [dashboard])
 ```
 
@@ -329,15 +330,18 @@ export SHADOWSHIELD_ADMIN_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_POLICY_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_POLICY_STATE_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_IMAGE_DIGEST="$(curl -fsSL \
-  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.1/container-digest.txt)"
+  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.2/container-digest.txt)"
 docker compose pull
 docker compose up -d
 ```
 
-The release workflow scans that exact image, publishes it to GHCR, and attaches
-its digest plus CycloneDX SBOM to the matching GitHub Release. All four secrets
-must be independent. Terminate TLS at a trusted ingress before exposing it beyond
-localhost. See the
+The release workflow scans that exact image, publishes it to GHCR, signs SLSA
+provenance plus the CycloneDX SBOM with ephemeral GitHub OIDC/Sigstore identity,
+verifies the registry-attached source/workflow claims and an anonymous digest
+pull, and attaches the digest plus SBOM to the matching GitHub Release. Stable
+release tags are accepted only from an exact green `main` commit. All four
+secrets must be independent. Terminate TLS at a trusted ingress before exposing
+it beyond localhost. See the
 [production-readiness roadmap](docs/PRODUCTION_READINESS.md) for launch gates,
 known scale limits, and the operator checklist.
 
@@ -347,14 +351,14 @@ Upgrading a control-plane volume from 0.6.0 requires an offline re-key because
 ```bash
 # Load the existing scan/admin keys first so the new Compose file can resolve.
 export SHADOWSHIELD_IMAGE_DIGEST="$(curl -fsSL \
-  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.1/container-digest.txt)"
+  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.2/container-digest.txt)"
 export SHADOWSHIELD_POLICY_KEY="<existing-0.6.0-policy-key>"
 export SHADOWSHIELD_POLICY_STATE_KEY="$(openssl rand -hex 32)"
 # Stop every writer and snapshot the volume before running the migration.
 docker compose stop shadowshield
 docker compose run --rm --no-deps shadowshield \
   shadowshield migrate-policy-state --path /var/lib/shadowshield/policy-state.json
-# Preserve the reported .pre-0.6.1.bak file, then start 0.6.1.
+# Preserve the reported .pre-0.6.1.bak file, then start 0.6.2.
 docker compose up -d
 ```
 
@@ -606,7 +610,7 @@ shadowshield serve --control --api-key SECRET      # require X-API-Key / Bearer
 shadowshield schema      # config JSON Schema (editor/CI validation)
 shadowshield owasp       # OWASP LLM Top 10 (2025) coverage map
 shadowshield benchmark --adversarial       # curated regression set
-shadowshield benchmark --generalization v2 # frozen blind semantic snapshot
+shadowshield benchmark --generalization all # all frozen blind semantic snapshots
 ```
 
 ## Documentation

{shadowshield-0.6.1 → shadowshield-0.6.2}/README.md

@@ -76,8 +76,9 @@ print(result.safe_text)            # safe fallback message
 > in-distribution **regression baseline, not a SOTA claim**. We publish the humbling
 > external numbers on purpose — a credible security tool shows its homework.
 > The frozen blind semantic snapshots are harder still: v1 reaches 26.7% recall /
-> 13.3% FPR and v2 reaches 0% / 10%. Run
-> `shadowshield benchmark --generalization v2`; these gaps are public by design.
+> 13.3% FPR, v2 reaches 0% / 10%, and v3 reaches 30% / 30%; the 90-row aggregate
+> is 22.2% / 20%. Run `shadowshield benchmark --generalization all`; these gaps
+> are public by design.
 
 ---
 
@@ -222,7 +223,7 @@ shadowshield detectors          # list registered detectors
 shadowshield init > shield.yaml # write an annotated default config
 shadowshield benchmark          # run the bundled offline benchmark
 shadowshield benchmark --adversarial
-shadowshield benchmark --generalization v2  # frozen blind semantic snapshot
+shadowshield benchmark --generalization all # all frozen blind semantic snapshots
 shadowshield serve              # HTTP server + live dashboard (needs [dashboard])
 ```
 
@@ -256,15 +257,18 @@ export SHADOWSHIELD_ADMIN_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_POLICY_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_POLICY_STATE_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_IMAGE_DIGEST="$(curl -fsSL \
-  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.1/container-digest.txt)"
+  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.2/container-digest.txt)"
 docker compose pull
 docker compose up -d
 ```
 
-The release workflow scans that exact image, publishes it to GHCR, and attaches
-its digest plus CycloneDX SBOM to the matching GitHub Release. All four secrets
-must be independent. Terminate TLS at a trusted ingress before exposing it beyond
-localhost. See the
+The release workflow scans that exact image, publishes it to GHCR, signs SLSA
+provenance plus the CycloneDX SBOM with ephemeral GitHub OIDC/Sigstore identity,
+verifies the registry-attached source/workflow claims and an anonymous digest
+pull, and attaches the digest plus SBOM to the matching GitHub Release. Stable
+release tags are accepted only from an exact green `main` commit. All four
+secrets must be independent. Terminate TLS at a trusted ingress before exposing
+it beyond localhost. See the
 [production-readiness roadmap](docs/PRODUCTION_READINESS.md) for launch gates,
 known scale limits, and the operator checklist.
 
@@ -274,14 +278,14 @@ Upgrading a control-plane volume from 0.6.0 requires an offline re-key because
 ```bash
 # Load the existing scan/admin keys first so the new Compose file can resolve.
 export SHADOWSHIELD_IMAGE_DIGEST="$(curl -fsSL \
-  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.1/container-digest.txt)"
+  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.2/container-digest.txt)"
 export SHADOWSHIELD_POLICY_KEY="<existing-0.6.0-policy-key>"
 export SHADOWSHIELD_POLICY_STATE_KEY="$(openssl rand -hex 32)"
 # Stop every writer and snapshot the volume before running the migration.
 docker compose stop shadowshield
 docker compose run --rm --no-deps shadowshield \
   shadowshield migrate-policy-state --path /var/lib/shadowshield/policy-state.json
-# Preserve the reported .pre-0.6.1.bak file, then start 0.6.1.
+# Preserve the reported .pre-0.6.1.bak file, then start 0.6.2.
 docker compose up -d
 ```
 
@@ -533,7 +537,7 @@ shadowshield serve --control --api-key SECRET      # require X-API-Key / Bearer
 shadowshield schema      # config JSON Schema (editor/CI validation)
 shadowshield owasp       # OWASP LLM Top 10 (2025) coverage map
 shadowshield benchmark --adversarial       # curated regression set
-shadowshield benchmark --generalization v2 # frozen blind semantic snapshot
+shadowshield benchmark --generalization all # all frozen blind semantic snapshots
 ```
 
 ## Documentation

{shadowshield-0.6.1 → shadowshield-0.6.2}/docs/BENCHMARKS.md

@@ -15,6 +15,8 @@ shadowshield benchmark --adversarial
 # Independently authored blind semantic snapshots
 shadowshield benchmark --generalization v1
 shadowshield benchmark --generalization v2
+shadowshield benchmark --generalization v3
+shadowshield benchmark --generalization all
 
 # External public dataset (needs the datasets extra)
 pip install "shadowshield[datasets]"
@@ -52,25 +54,35 @@ cases visible, so its perfect score is not a generalization claim.
 
 ## 3. Blind semantic snapshots (the anti-gaming result)
 
-Two balanced snapshots were authored independently without detector or regex
+Three balanced snapshots were authored independently without detector or regex
 context, then frozen. They deliberately pair attacks with benign text containing
 similar roleplay, authority, debug, and policy vocabulary.
 
-Isolation protocol: the authoring task received only the five semantic category
-names, required row/balance counts, and a request for attack/benign contrast
-pairs. It did not receive detector source, signatures, or current predictions.
-The files were frozen before detector tuning and are integrity-pinned in tests:
+Isolation protocol: the v1/v2 authoring tasks received only the five semantic
+category names, required row/balance counts, and a request for attack/benign
+contrast pairs. The v3 task received modality coverage requirements but no
+detector source, signatures, or current predictions. The files were frozen before
+detector tuning and are integrity-pinned in tests:
 v1 SHA-256 `b3281ba1a42d266bb930bbb41943016d47b38dbc822ff7cff5131f3448a0248f`;
-v2 SHA-256 `aa8b8c81c00a55bb65180e15ff743b6241d24845b3886e8e60b52b9b23db47fa`.
+v2 SHA-256 `aa8b8c81c00a55bb65180e15ff743b6241d24845b3886e8e60b52b9b23db47fa`;
+v3 SHA-256 `2285031e8143572311a522a4b6ec1a39c96a34ac2b42785f17818e8a145342bf`.
 
 | snapshot | rows | TP/FP/TN/FN | recall | FPR | balanced accuracy |
 |---|---:|---:|---:|---:|---:|
 | v1 | 30 | 4/2/13/11 | 26.7% | 13.3% | 56.7% |
 | v2 | 20 | 0/1/9/10 | 0% | 10% | 45% |
-
-The narrow 0.6.1 fixes intentionally leave these results unchanged. They expose
-the core deterministic tier's semantic-generalization ceiling and are development
-evidence for the next classifier/conjunction tranche, not a number to hide.
+| v3 | 40 | 6/6/14/14 | 30% | 30% | 50% |
+| **aggregate** | **90** | **10/9/36/35** | **22.2%** | **20%** | **51.1%** |
+
+The v3 snapshot was opened only after a detector candidate and acceptance bar
+were frozen. That candidate raised aggregate recall to 55.6% but failed the
+predeclared false-positive and balanced-accuracy gates (24.4% FPR; 65.6%
+balanced accuracy), so it was discarded in full. No v3-driven detector tuning
+ships in 0.6.2; the table records the unchanged released core.
+
+These snapshots expose the core deterministic tier's semantic-generalization
+ceiling and are development evidence for a fresh-corpus classifier/conjunction
+tranche, not numbers to hide or a set to tune against.
 
 ## 4. External: `deepset/prompt-injections` (out-of-distribution)
 

{shadowshield-0.6.1 → shadowshield-0.6.2}/docs/PRODUCTION_READINESS.md

@@ -1,6 +1,6 @@
 # Production readiness roadmap
 
-**Baseline:** ShadowShield 0.6.1 · **Audit date:** 2026-07-25
+**Baseline:** ShadowShield 0.6.2 · **Audit date:** 2026-07-25
 
 This roadmap is the release gate for the Python library and the optional HTTP
 control plane. A checked item is implemented and locally verified; unchecked
@@ -10,12 +10,12 @@ items require an explicit operator or maintainer decision before public launch.
 
 | Area | State | Evidence / remaining action |
 |---|---|---|
-| Correctness | Ready | Full unit/integration suite; strict mypy; Ruff lint and format |
+| Correctness | Ready | 290+ unit/integration cases; strict mypy; Ruff lint/format; CodeQL extended scanning |
 | Packaging | Ready | Isolated sdist/wheel build, Twine metadata check, installed-wheel CI smoke test |
 | Runtime security | Ready with configuration | Early API-key/Bearer auth, body limits, restricted CORS, immutable protection floor, non-root read-only container |
-| Supply chain | Ready | Digest-pinned base, SHA-pinned Actions, PyPI OIDC, pre-push image vulnerability gate, anonymously verified GHCR digest, release-attached CycloneDX SBOM |
+| Supply chain | Ready | Repository-enforced Action SHA pins, PyPI OIDC, exact-green-main release gates, pre-push image vulnerability gate, anonymous GHCR digest pull, registry-verified SLSA and CycloneDX attestations |
 | Observability | Ready for single process | Content-free telemetry, Prometheus endpoint, bounded in-memory event feed |
-| Detection quality | Beta | Curated adversarial: 100%/0% FPR; blind v1: 26.7%/13.3%; blind v2: 0%/10%; deepset core: 23.3%/0% |
+| Detection quality | Beta | Curated adversarial: 100%/0% FPR; blind v1–v3 aggregate: 22.2%/20%; v3: 30%/30%; deepset core: 23.3%/0% |
 | Scale / HA | Not yet | Counters, events, configuration, and rate limits are process-local |
 | Streaming | Not yet | Outputs must be buffered before scanning |
 
@@ -48,6 +48,19 @@ items require an explicit operator or maintainer decision before public launch.
 - [x] Pin the base image by digest, gate the exact release image on Trivy, publish
   it to GHCR, verify an anonymous digest pull, and attach its immutable digest
   plus CycloneDX SBOM to the release.
+- [x] Sign release-image SLSA provenance and the CycloneDX SBOM with ephemeral
+  GitHub OIDC/Sigstore identity, then verify repository, workflow, runner, and
+  source-commit claims from the OCI registry before completing the release.
+- [x] Reject release publication unless a stable, non-prerelease tag matches the
+  package version, resolves to `main`, and has a successful exact-SHA `main` CI run.
+- [x] Reject symlink/non-regular durable policy-state files, use unpredictable
+  exclusive temporary files, and revision-check reads, migrations, and replaces.
+- [x] Coalesce concurrent failed Transformer/Vector load generations while giving
+  every waiter a fresh bounded exception traceback and allowing a later retry.
+- [x] Enable Dependabot security updates, extended CodeQL scanning, secret
+  push-protection, and repository-level enforcement of full-SHA Action pins.
+- [x] Publish a third independently authored blind snapshot and reject—not
+  tune—the first frozen candidate when it missed the predeclared FPR/accuracy bar.
 
 ## P1 — launch procedure (operator-owned)
 
@@ -70,11 +83,13 @@ items require an explicit operator or maintainer decision before public launch.
 
 1. Add a rolling-window streaming scanner that blocks before unsafe output is emitted.
 2. Move rate limits, event history, and metrics aggregation to shared external stores for multi-worker HA.
-3. Publish signed container images and provenance attestations from the release workflow.
-4. Calibrate detector scores on a larger independently sourced corpus and publish confidence intervals.
-5. Add multi-hour soak and network fault-injection tests for reporters, judges, and hot policy updates.
-6. Split the current administrator credential into narrower observe and mutation scopes.
-7. Design cross-process model/index coordination and durable Reporter spooling.
+3. Build a fresh independently sourced development corpus, then evaluate the
+   next detector candidate once on a new sealed snapshot and publish confidence intervals.
+4. Add multi-hour soak and network fault-injection tests for reporters, judges, and hot policy updates.
+5. Split the current administrator credential into narrower observe and mutation scopes.
+6. Design cross-process model/index coordination and durable Reporter spooling.
+7. Split unprivileged container build/scan from the write/OIDC publication job.
+8. Refactor release evidence into a draft-first pipeline, then enable immutable releases.
 
 ## Go / no-go gates
 

{shadowshield-0.6.1 → shadowshield-0.6.2}/docs/RELEASING.md

@@ -8,9 +8,10 @@ this specific GitHub workflow directly. The pipeline is
 The same GitHub Release also triggers
 [`container-release.yml`](../.github/workflows/container-release.yml). It builds
 one image from the release tag, generates a CycloneDX SBOM, rejects fixable
-high/critical findings, pushes that exact scanned image to GHCR, verifies an
-anonymous pull by digest, and attaches `container-digest.txt` plus the SBOM to
-the GitHub Release.
+high/critical findings, pushes that exact scanned image to GHCR, signs SLSA
+provenance and CycloneDX attestations through GitHub's Sigstore-backed OIDC
+service, verifies the signed provenance and an anonymous pull by digest, and
+attaches `container-digest.txt` plus the SBOM to the GitHub Release.
 
 ## One-time setup (PyPI account owner only)
 
@@ -62,13 +63,10 @@ Do not create the release while required checks are pending. A partial release
 is recoverable by fixing the failed workflow and re-running it, but the PyPI
 version itself cannot be replaced.
 
-To publish the **current** Python version without a new release (for example, the
-first publish of an already-tagged version), trigger only the PyPI workflow:
-
-```bash
-gh workflow run publish.yml --ref main
-gh run watch        # follow it
-```
+Both publication workflows independently reject non-stable tags, tag/source
+version mismatches, commits outside `main`, and commits without a successful
+exact-SHA `main` CI run. There is no manual-dispatch publication path; use
+GitHub's **Re-run failed jobs** control to recover a failed release workflow.
 
 ## Verify
 
@@ -79,7 +77,22 @@ python -c "import shadowshield as ss; print(ss.__version__)"
 
 gh release download vX.Y.Z \
   --pattern container-digest.txt --pattern shadowshield-sbom.cdx.json
-docker pull "ghcr.io/0xsl1m/shadowshield@$(cat container-digest.txt)"
+digest="$(cat container-digest.txt)"
+image="ghcr.io/0xsl1m/shadowshield@$digest"
+docker pull "$image"
+gh attestation verify "oci://$image" \
+  --repo 0xsl1m/shadowshield \
+  --bundle-from-oci \
+  --signer-workflow 0xsl1m/shadowshield/.github/workflows/container-release.yml \
+  --source-digest "$(git rev-list -n 1 vX.Y.Z)" \
+  --deny-self-hosted-runners
+gh attestation verify "oci://$image" \
+  --repo 0xsl1m/shadowshield \
+  --bundle-from-oci \
+  --predicate-type https://cyclonedx.org/bom \
+  --signer-workflow 0xsl1m/shadowshield/.github/workflows/container-release.yml \
+  --source-digest "$(git rev-list -n 1 vX.Y.Z)" \
+  --deny-self-hosted-runners
 ```
 
 ## Notes

{shadowshield-0.6.1 → shadowshield-0.6.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "shadowshield"
-version = "0.6.1"
+version = "0.6.2"
 description = "Unified open-source security shield for agentic AI systems — inspired by Sentinel & ShadowClaw."
 readme = "README.md"
 requires-python = ">=3.10"

{shadowshield-0.6.1 → shadowshield-0.6.2}/src/shadowshield/__init__.py

@@ -71,7 +71,7 @@ from .plugins import PluginManager, ShadowShieldPlugin
 from .reporter import Reporter, attach_reporter
 from .responders import Responder, spotlight
 
-__version__ = "0.6.1"
+__version__ = "0.6.2"
 
 __all__ = [
     "__version__",

{shadowshield-0.6.1 → shadowshield-0.6.2}/src/shadowshield/cli.py

@@ -242,7 +242,7 @@ def build_parser() -> argparse.ArgumentParser:
     )
     dataset_source.add_argument(
         "--generalization",
-        choices=["v1", "v2", "all"],
+        choices=["v1", "v2", "v3", "all"],
         default=None,
         help="use an independently authored blind semantic snapshot",
     )