shadowshield 0.6.1__tar.gz → 0.6.3__tar.gz

{shadowshield-0.6.1 → shadowshield-0.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: shadowshield
-Version: 0.6.1
+Version: 0.6.3
 Summary: Unified open-source security shield for agentic AI systems — inspired by Sentinel & ShadowClaw.
 Project-URL: Homepage, https://shadowshield.xyz
 Project-URL: Documentation, https://github.com/0xsl1m/shadowshield#readme
@@ -28,7 +28,6 @@ Requires-Dist: httpx>=0.27
 Requires-Dist: pydantic>=2.5
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: structlog>=24.1
-Requires-Dist: tiktoken>=0.6
 Provides-Extra: all
 Requires-Dist: datasets>=2.18; extra == 'all'
 Requires-Dist: fastapi>=0.110; extra == 'all'
@@ -149,8 +148,9 @@ print(result.safe_text)            # safe fallback message
 > in-distribution **regression baseline, not a SOTA claim**. We publish the humbling
 > external numbers on purpose — a credible security tool shows its homework.
 > The frozen blind semantic snapshots are harder still: v1 reaches 26.7% recall /
-> 13.3% FPR and v2 reaches 0% / 10%. Run
-> `shadowshield benchmark --generalization v2`; these gaps are public by design.
+> 13.3% FPR, v2 reaches 0% / 10%, and v3 reaches 30% / 30%; the 90-row aggregate
+> is 22.2% / 20%. Run `shadowshield benchmark --generalization all`; these gaps
+> are public by design.
 
 ---
 
@@ -206,8 +206,8 @@ pip install "shadowshield[dashboard]"      # + FastAPI HTTP server & dashboard
 pip install "shadowshield[all]"            # everything
 ```
 
-Core deps are intentionally small: `pydantic`, `structlog`, `pyyaml`, `httpx`,
-`tiktoken`. The ML classifier, Presidio PII, dataset loaders, and dashboard live
+Core deps are intentionally small: `pydantic`, `structlog`, `pyyaml`, and
+`httpx`. The ML classifier, Presidio PII, dataset loaders, and dashboard live
 behind extras — the default install pulls **no** heavy ML stack.
 
 ---
@@ -295,7 +295,7 @@ shadowshield detectors          # list registered detectors
 shadowshield init > shield.yaml # write an annotated default config
 shadowshield benchmark          # run the bundled offline benchmark
 shadowshield benchmark --adversarial
-shadowshield benchmark --generalization v2  # frozen blind semantic snapshot
+shadowshield benchmark --generalization all # all frozen blind semantic snapshots
 shadowshield serve              # HTTP server + live dashboard (needs [dashboard])
 ```
 
@@ -329,15 +329,18 @@ export SHADOWSHIELD_ADMIN_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_POLICY_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_POLICY_STATE_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_IMAGE_DIGEST="$(curl -fsSL \
-  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.1/container-digest.txt)"
+  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.3/container-digest.txt)"
 docker compose pull
 docker compose up -d
 ```
 
-The release workflow scans that exact image, publishes it to GHCR, and attaches
-its digest plus CycloneDX SBOM to the matching GitHub Release. All four secrets
-must be independent. Terminate TLS at a trusted ingress before exposing it beyond
-localhost. See the
+The release workflow scans that exact image, publishes it to GHCR, signs SLSA
+provenance plus the CycloneDX SBOM with ephemeral GitHub OIDC/Sigstore identity,
+verifies the registry-attached source/workflow claims and an anonymous digest
+pull, and attaches the digest plus SBOM to the matching GitHub Release. Stable
+release tags are accepted only from an exact green `main` commit. All four
+secrets must be independent. Terminate TLS at a trusted ingress before exposing
+it beyond localhost. See the
 [production-readiness roadmap](docs/PRODUCTION_READINESS.md) for launch gates,
 known scale limits, and the operator checklist.
 
@@ -347,14 +350,14 @@ Upgrading a control-plane volume from 0.6.0 requires an offline re-key because
 ```bash
 # Load the existing scan/admin keys first so the new Compose file can resolve.
 export SHADOWSHIELD_IMAGE_DIGEST="$(curl -fsSL \
-  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.1/container-digest.txt)"
+  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.3/container-digest.txt)"
 export SHADOWSHIELD_POLICY_KEY="<existing-0.6.0-policy-key>"
 export SHADOWSHIELD_POLICY_STATE_KEY="$(openssl rand -hex 32)"
 # Stop every writer and snapshot the volume before running the migration.
 docker compose stop shadowshield
 docker compose run --rm --no-deps shadowshield \
   shadowshield migrate-policy-state --path /var/lib/shadowshield/policy-state.json
-# Preserve the reported .pre-0.6.1.bak file, then start 0.6.1.
+# Preserve the reported .pre-0.6.1.bak file, then start 0.6.3.
 docker compose up -d
 ```
 
@@ -606,7 +609,7 @@ shadowshield serve --control --api-key SECRET      # require X-API-Key / Bearer
 shadowshield schema      # config JSON Schema (editor/CI validation)
 shadowshield owasp       # OWASP LLM Top 10 (2025) coverage map
 shadowshield benchmark --adversarial       # curated regression set
-shadowshield benchmark --generalization v2 # frozen blind semantic snapshot
+shadowshield benchmark --generalization all # all frozen blind semantic snapshots
 ```
 
 ## Documentation

{shadowshield-0.6.1 → shadowshield-0.6.3}/README.md

@@ -76,8 +76,9 @@ print(result.safe_text)            # safe fallback message
 > in-distribution **regression baseline, not a SOTA claim**. We publish the humbling
 > external numbers on purpose — a credible security tool shows its homework.
 > The frozen blind semantic snapshots are harder still: v1 reaches 26.7% recall /
-> 13.3% FPR and v2 reaches 0% / 10%. Run
-> `shadowshield benchmark --generalization v2`; these gaps are public by design.
+> 13.3% FPR, v2 reaches 0% / 10%, and v3 reaches 30% / 30%; the 90-row aggregate
+> is 22.2% / 20%. Run `shadowshield benchmark --generalization all`; these gaps
+> are public by design.
 
 ---
 
@@ -133,8 +134,8 @@ pip install "shadowshield[dashboard]"      # + FastAPI HTTP server & dashboard
 pip install "shadowshield[all]"            # everything
 ```
 
-Core deps are intentionally small: `pydantic`, `structlog`, `pyyaml`, `httpx`,
-`tiktoken`. The ML classifier, Presidio PII, dataset loaders, and dashboard live
+Core deps are intentionally small: `pydantic`, `structlog`, `pyyaml`, and
+`httpx`. The ML classifier, Presidio PII, dataset loaders, and dashboard live
 behind extras — the default install pulls **no** heavy ML stack.
 
 ---
@@ -222,7 +223,7 @@ shadowshield detectors          # list registered detectors
 shadowshield init > shield.yaml # write an annotated default config
 shadowshield benchmark          # run the bundled offline benchmark
 shadowshield benchmark --adversarial
-shadowshield benchmark --generalization v2  # frozen blind semantic snapshot
+shadowshield benchmark --generalization all # all frozen blind semantic snapshots
 shadowshield serve              # HTTP server + live dashboard (needs [dashboard])
 ```
 
@@ -256,15 +257,18 @@ export SHADOWSHIELD_ADMIN_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_POLICY_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_POLICY_STATE_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_IMAGE_DIGEST="$(curl -fsSL \
-  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.1/container-digest.txt)"
+  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.3/container-digest.txt)"
 docker compose pull
 docker compose up -d
 ```
 
-The release workflow scans that exact image, publishes it to GHCR, and attaches
-its digest plus CycloneDX SBOM to the matching GitHub Release. All four secrets
-must be independent. Terminate TLS at a trusted ingress before exposing it beyond
-localhost. See the
+The release workflow scans that exact image, publishes it to GHCR, signs SLSA
+provenance plus the CycloneDX SBOM with ephemeral GitHub OIDC/Sigstore identity,
+verifies the registry-attached source/workflow claims and an anonymous digest
+pull, and attaches the digest plus SBOM to the matching GitHub Release. Stable
+release tags are accepted only from an exact green `main` commit. All four
+secrets must be independent. Terminate TLS at a trusted ingress before exposing
+it beyond localhost. See the
 [production-readiness roadmap](docs/PRODUCTION_READINESS.md) for launch gates,
 known scale limits, and the operator checklist.
 
@@ -274,14 +278,14 @@ Upgrading a control-plane volume from 0.6.0 requires an offline re-key because
 ```bash
 # Load the existing scan/admin keys first so the new Compose file can resolve.
 export SHADOWSHIELD_IMAGE_DIGEST="$(curl -fsSL \
-  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.1/container-digest.txt)"
+  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.3/container-digest.txt)"
 export SHADOWSHIELD_POLICY_KEY="<existing-0.6.0-policy-key>"
 export SHADOWSHIELD_POLICY_STATE_KEY="$(openssl rand -hex 32)"
 # Stop every writer and snapshot the volume before running the migration.
 docker compose stop shadowshield
 docker compose run --rm --no-deps shadowshield \
   shadowshield migrate-policy-state --path /var/lib/shadowshield/policy-state.json
-# Preserve the reported .pre-0.6.1.bak file, then start 0.6.1.
+# Preserve the reported .pre-0.6.1.bak file, then start 0.6.3.
 docker compose up -d
 ```
 
@@ -533,7 +537,7 @@ shadowshield serve --control --api-key SECRET      # require X-API-Key / Bearer
 shadowshield schema      # config JSON Schema (editor/CI validation)
 shadowshield owasp       # OWASP LLM Top 10 (2025) coverage map
 shadowshield benchmark --adversarial       # curated regression set
-shadowshield benchmark --generalization v2 # frozen blind semantic snapshot
+shadowshield benchmark --generalization all # all frozen blind semantic snapshots
 ```
 
 ## Documentation

{shadowshield-0.6.1 → shadowshield-0.6.3}/docs/BENCHMARKS.md

@@ -15,6 +15,8 @@ shadowshield benchmark --adversarial
 # Independently authored blind semantic snapshots
 shadowshield benchmark --generalization v1
 shadowshield benchmark --generalization v2
+shadowshield benchmark --generalization v3
+shadowshield benchmark --generalization all
 
 # External public dataset (needs the datasets extra)
 pip install "shadowshield[datasets]"
@@ -24,14 +26,40 @@ pip install "shadowshield[transformers]"
 shadowshield benchmark --hf deepset/prompt-injections --split test --transformer
 ```
 
+The CLI warms every configured detector before starting the latency clock. Its
+JSON and text reports include a runtime-integrity section covering warmup,
+readiness, and bounded per-detector failure counts. A benchmark with a warmup
+failure, a detector that remains unready, or any detector error exits non-zero
+and is marked **unreliable**; its confusion counts remain available for
+diagnosis but must not be published as quality evidence. CLI benchmark shields
+disable normal audit emission so logging I/O does not distort latency or corrupt
+the command's machine-readable JSON stdout.
+
+Programmatic callers can request the same behavior with
+`evaluate_shield(shield, examples, warmup=True)`. The default remains
+`warmup=False` for API compatibility. In both modes, readiness is checked after
+the scans and per-scan detector error counters are aggregated.
+
+Per-category output retains the original `total`, `flagged`, and flag-rate
+fields, and additionally reports class-conditional TP/FP/TN/FN, recall, FPR,
+and balanced accuracy. Recall is `null`/`n/a` for categories with no attack
+rows; FPR is `null`/`n/a` for categories with no benign rows; balanced accuracy
+is defined only when both classes are present.
+
+Aggregate and per-category recall/FPR also include two-sided 95% Wilson score
+intervals. Wilson intervals remain informative at small sample sizes and at
+observed rates of 0% or 100%; an interval is `null`/`n/a` when that category has
+no rows for the corresponding class. Existing scalar metric fields are
+unchanged, and the interval fields are additive.
+
 ## 1. Bundled benchmark (in-distribution — a regression baseline)
 
 75 curated examples (40 attack / 35 benign, incl. 16 NotInject-style hard
 negatives). `balanced` mode:
 
-| recall | FPR | precision | F1 | p50 |
+| recall (95% CI) | FPR (95% CI) | precision | F1 | p50 |
 |---:|---:|---:|---:|---:|
-| 100% | 0% | 100% | 100% | 0.16 ms |
+| 100% [91.2%, 100%] | 0% [0%, 9.9%] | 100% | 100% | 0.16 ms |
 
 **This is a regression baseline and a smoke test — NOT a claim of real-world
 accuracy.** 100% on our own set just means we don't regress on the attack
@@ -43,34 +71,44 @@ The 36-row adversarial catalogue includes obfuscation, multilingual and indirect
 attacks, plus benign trigger-heavy counterexamples. It improved from
 15/2/16/3 to 18/0/18/0 (TP/FP/TN/FN):
 
-| recall | FPR | precision | F1 |
+| recall (95% CI) | FPR (95% CI) | precision | F1 |
 |---:|---:|---:|---:|
-| 100% | 0% | 100% | 100% |
+| 100% [82.4%, 100%] | 0% [0%, 17.6%] | 100% | 100% |
 
 This is still a curated regression set. The signatures were developed with these
 cases visible, so its perfect score is not a generalization claim.
 
 ## 3. Blind semantic snapshots (the anti-gaming result)
 
-Two balanced snapshots were authored independently without detector or regex
+Three balanced snapshots were authored independently without detector or regex
 context, then frozen. They deliberately pair attacks with benign text containing
 similar roleplay, authority, debug, and policy vocabulary.
 
-Isolation protocol: the authoring task received only the five semantic category
-names, required row/balance counts, and a request for attack/benign contrast
-pairs. It did not receive detector source, signatures, or current predictions.
-The files were frozen before detector tuning and are integrity-pinned in tests:
+Isolation protocol: the v1/v2 authoring tasks received only the five semantic
+category names, required row/balance counts, and a request for attack/benign
+contrast pairs. The v3 task received modality coverage requirements but no
+detector source, signatures, or current predictions. The files were frozen before
+detector tuning and are integrity-pinned in tests:
 v1 SHA-256 `b3281ba1a42d266bb930bbb41943016d47b38dbc822ff7cff5131f3448a0248f`;
-v2 SHA-256 `aa8b8c81c00a55bb65180e15ff743b6241d24845b3886e8e60b52b9b23db47fa`.
+v2 SHA-256 `aa8b8c81c00a55bb65180e15ff743b6241d24845b3886e8e60b52b9b23db47fa`;
+v3 SHA-256 `2285031e8143572311a522a4b6ec1a39c96a34ac2b42785f17818e8a145342bf`.
 
-| snapshot | rows | TP/FP/TN/FN | recall | FPR | balanced accuracy |
+| snapshot | rows | TP/FP/TN/FN | recall (95% CI) | FPR (95% CI) | balanced accuracy |
 |---|---:|---:|---:|---:|---:|
-| v1 | 30 | 4/2/13/11 | 26.7% | 13.3% | 56.7% |
-| v2 | 20 | 0/1/9/10 | 0% | 10% | 45% |
-
-The narrow 0.6.1 fixes intentionally leave these results unchanged. They expose
-the core deterministic tier's semantic-generalization ceiling and are development
-evidence for the next classifier/conjunction tranche, not a number to hide.
+| v1 | 30 | 4/2/13/11 | 26.7% [10.9%, 52.0%] | 13.3% [3.7%, 37.9%] | 56.7% |
+| v2 | 20 | 0/1/9/10 | 0% [0%, 27.8%] | 10% [1.8%, 40.4%] | 45% |
+| v3 | 40 | 6/6/14/14 | 30% [14.5%, 51.9%] | 30% [14.5%, 51.9%] | 50% |
+| **aggregate** | **90** | **10/9/36/35** | **22.2% [12.5%, 36.3%]** | **20% [10.9%, 33.8%]** | **51.1%** |
+
+The v3 snapshot was opened only after a detector candidate and acceptance bar
+were frozen. That candidate raised aggregate recall to 55.6% but failed the
+predeclared false-positive and balanced-accuracy gates (24.4% FPR; 65.6%
+balanced accuracy), so it was discarded in full. No v3-driven detector tuning
+ships in 0.6.2; the table records the unchanged released core.
+
+These snapshots expose the core deterministic tier's semantic-generalization
+ceiling and are development evidence for a fresh-corpus classifier/conjunction
+tranche, not numbers to hide or a set to tune against.
 
 ## 4. External: `deepset/prompt-injections` (out-of-distribution)
 

{shadowshield-0.6.1 → shadowshield-0.6.3}/docs/PRODUCTION_READINESS.md

@@ -1,21 +1,22 @@
 # Production readiness roadmap
 
-**Baseline:** ShadowShield 0.6.1 · **Audit date:** 2026-07-25
+**Baseline:** ShadowShield 0.6.3 · **Audit date:** 2026-07-25
 
 This roadmap is the release gate for the Python library and the optional HTTP
-control plane. A checked item is implemented and locally verified; unchecked
-items require an explicit operator or maintainer decision before public launch.
+control plane. A checked item is implemented and locally verified. The
+operator-owned unchecked items do not block the library or static site, but they
+must be resolved before exposing the optional HTTP control plane publicly.
 
 ## Current readiness
 
 | Area | State | Evidence / remaining action |
 |---|---|---|
-| Correctness | Ready | Full unit/integration suite; strict mypy; Ruff lint and format |
-| Packaging | Ready | Isolated sdist/wheel build, Twine metadata check, installed-wheel CI smoke test |
-| Runtime security | Ready with configuration | Early API-key/Bearer auth, body limits, restricted CORS, immutable protection floor, non-root read-only container |
-| Supply chain | Ready | Digest-pinned base, SHA-pinned Actions, PyPI OIDC, pre-push image vulnerability gate, anonymously verified GHCR digest, release-attached CycloneDX SBOM |
-| Observability | Ready for single process | Content-free telemetry, Prometheus endpoint, bounded in-memory event feed |
-| Detection quality | Beta | Curated adversarial: 100%/0% FPR; blind v1: 26.7%/13.3%; blind v2: 0%/10%; deepset core: 23.3%/0% |
+| Correctness | Ready | 320 unit/integration cases; strict mypy; Ruff lint/format; CodeQL extended scanning |
+| Packaging | Ready | Hash-locked build environment, byte-for-byte repeat build gate, Twine validation, installed-wheel smoke test |
+| Runtime security | Ready with configuration | Early API-key/Bearer auth, bounded/deadlined body intake, detector-failure policy, restricted CORS, immutable protection floor, non-root read-only container |
+| Supply chain | Ready | Digest/SHA-pinned build inputs, PyPI OIDC, exact-green-main release gates, immutable image/evidence handling, pre-push vulnerability gate, anonymous GHCR digest pull, registry-verified SLSA and CycloneDX attestations |
+| Observability | Ready for single process | Content-free telemetry, detector-error counters, Prometheus endpoint, bounded in-memory event feed |
+| Detection quality | Beta | Curated adversarial: 100%/0% FPR; blind v1–v3 aggregate: 22.2%/20%; v3: 30%/30%; deepset core: 23.3%/0% |
 | Scale / HA | Not yet | Counters, events, configuration, and rate limits are process-local |
 | Streaming | Not yet | Outputs must be buffered before scanning |
 
@@ -23,7 +24,7 @@ items require an explicit operator or maintainer decision before public launch.
 
 - [x] Repair control-plane syntax and restore test collection.
 - [x] Make optional-dependency tests and typing deterministic with or without MCP installed.
-- [x] Enforce an 80% branch-aware coverage floor (current local result: 85%).
+- [x] Enforce an 80% branch-aware coverage floor (current local result: 86%).
 - [x] Test every declared Python runtime, 3.10 through 3.14, in CI.
 - [x] Build and validate both distribution formats and smoke-test the installed wheel.
 - [x] Audit declared dependencies in CI (local audit: no known vulnerabilities).
@@ -48,6 +49,36 @@ items require an explicit operator or maintainer decision before public launch.
 - [x] Pin the base image by digest, gate the exact release image on Trivy, publish
   it to GHCR, verify an anonymous digest pull, and attach its immutable digest
   plus CycloneDX SBOM to the release.
+- [x] Sign release-image SLSA provenance and the CycloneDX SBOM with ephemeral
+  GitHub OIDC/Sigstore identity, then verify repository, workflow, runner, and
+  source-commit claims from the OCI registry before completing the release.
+- [x] Reject release publication unless a stable, non-prerelease tag matches the
+  package version, resolves to `main`, and has a successful exact-SHA `main` CI run.
+- [x] Reject symlink/non-regular durable policy-state files, use unpredictable
+  exclusive temporary files, and revision-check reads, migrations, and replaces.
+- [x] Coalesce concurrent failed Transformer/Vector load generations while giving
+  every waiter a fresh bounded exception traceback and allowing a later retry.
+- [x] Enable Dependabot security updates, extended CodeQL scanning, secret
+  push-protection, and repository-level enforcement of full-SHA Action pins.
+- [x] Publish a third independently authored blind snapshot and reject—not
+  tune—the first frozen candidate when it missed the predeclared FPR/accuracy bar.
+- [x] Make documented session guard calls record clean and blocked turns exactly
+  once so multi-turn and alignment checks receive the advertised trace.
+- [x] Surface bounded, content-free detector failures in every result, audit,
+  benchmark, control event, and Prometheus metric; make strict mode fail closed.
+- [x] Coalesce HTTP request frames, cap fragmentation, and apply one total body
+  deadline so authenticated slow/chunked bodies cannot pin all scan slots;
+  authenticate protected non-preflight methods before body/admission work.
+- [x] Hash-lock release build and container dependencies, pin the Dockerfile
+  frontend, remove the unused mandatory tokenizer dependency, and require two
+  byte-identical distribution builds.
+- [x] Upgrade maintained Actions to their Node 24 generations, bound every CI
+  job with a timeout, and refuse conflicting image tags or release assets while
+  allowing only attested exact-source digest recovery of an interrupted
+  container publication.
+- [x] Make benchmark evidence fail visibly on warmup, readiness, or detector
+  errors and report class-conditional per-slice confusion metrics with 95%
+  Wilson confidence intervals.
 
 ## P1 — launch procedure (operator-owned)
 
@@ -60,7 +91,8 @@ items require an explicit operator or maintainer decision before public launch.
 - [ ] Set an explicit CORS allowlist or leave CORS disabled.
 - [ ] Run the adversarial and application-specific eval sets in permissive/shadow mode.
 - [ ] Choose thresholds from measured false-positive cost; record the accepted baseline.
-- [ ] Connect Prometheus and content-free telemetry; alert on error, block-rate, and latency shifts.
+- [ ] Connect Prometheus and content-free telemetry; alert on detector errors,
+  readiness, block-rate, and latency shifts.
 - [ ] Load-test representative payload sizes and concurrency on the target instance class.
 - [ ] Record the deployed image digest and CI SBOM, then rehearse backup/restore
   and rollback against the target environment.
@@ -70,11 +102,17 @@ items require an explicit operator or maintainer decision before public launch.
 
 1. Add a rolling-window streaming scanner that blocks before unsafe output is emitted.
 2. Move rate limits, event history, and metrics aggregation to shared external stores for multi-worker HA.
-3. Publish signed container images and provenance attestations from the release workflow.
-4. Calibrate detector scores on a larger independently sourced corpus and publish confidence intervals.
-5. Add multi-hour soak and network fault-injection tests for reporters, judges, and hot policy updates.
-6. Split the current administrator credential into narrower observe and mutation scopes.
-7. Design cross-process model/index coordination and durable Reporter spooling.
+3. Build a fresh independently sourced development corpus, then evaluate the
+   next detector candidate once on a new sealed snapshot and publish confidence intervals.
+4. Add multi-hour soak and network fault-injection tests for reporters, judges, and hot policy updates.
+5. Split the current administrator credential into narrower observe and mutation scopes.
+6. Design cross-process model/index coordination and durable Reporter spooling.
+7. Split unprivileged container build/scan from the write/OIDC publication job.
+8. Refactor release evidence into a draft-first pipeline with independently
+   promoted, already-scanned OCI artifacts.
+9. Pin optional model revisions, pre-cache them for offline production startup,
+   and bound model-loading time.
+10. Add vulnerability-audit matrices for every supported optional dependency stack.
 
 ## Go / no-go gates
 

{shadowshield-0.6.1 → shadowshield-0.6.3}/docs/RELEASING.md

@@ -8,9 +8,14 @@ this specific GitHub workflow directly. The pipeline is
 The same GitHub Release also triggers
 [`container-release.yml`](../.github/workflows/container-release.yml). It builds
 one image from the release tag, generates a CycloneDX SBOM, rejects fixable
-high/critical findings, pushes that exact scanned image to GHCR, verifies an
-anonymous pull by digest, and attaches `container-digest.txt` plus the SBOM to
-the GitHub Release.
+high/critical findings, pushes that exact scanned image to GHCR, signs SLSA
+provenance and CycloneDX attestations through GitHub's Sigstore-backed OIDC
+service, verifies the signed provenance and an anonymous pull by digest, and
+attaches `container-digest.txt` plus the SBOM to the GitHub Release.
+
+Build tooling and the production container dependency graph are version- and
+hash-locked in `requirements/build.lock` and `requirements/container.lock`.
+Release jobs build the sdist and wheel twice and require byte-identical outputs.
 
 ## One-time setup (PyPI account owner only)
 
@@ -41,8 +46,15 @@ workflow deliberately fails its anonymous-pull gate if that happens.
 1. Let the first `Publish release container` run push the package.
 2. If the anonymous-pull step fails, open the `shadowshield` package settings
    under the `0xsl1m` account and change visibility to **Public**.
-3. Re-run the failed workflow job. Do not publish the release digest to operators
-   until the anonymous pull and evidence-attachment steps are green.
+3. Re-run the failed workflow job. It will reuse an existing image only when the
+   version and exact-commit tags resolve to the same digest and its revision and
+   version labels match the release **and** that digest already has trusted source
+   provenance from this workflow for the exact commit. It never overwrites a
+   conflicting or unattested tag. If an interruption happens after an image push
+   but before provenance is attached, delete the incomplete version/commit tags
+   from GHCR and re-run; the workflow deliberately refuses to bless them.
+   Do not publish the digest to operators until the anonymous-pull and
+   evidence-attachment steps are green.
 
 ## Cutting a release
 
@@ -58,17 +70,18 @@ gh release create vX.Y.Z --target "$merge_sha" \
 # -> PyPI publishing and exact-image scan/publish run independently
 ```
 
-Do not create the release while required checks are pending. A partial release
-is recoverable by fixing the failed workflow and re-running it, but the PyPI
-version itself cannot be replaced.
-
-To publish the **current** Python version without a new release (for example, the
-first publish of an already-tagged version), trigger only the PyPI workflow:
+Do not create the release while required checks are pending. Once trusted source
+provenance exists, a partial container release is recoverable by fixing the
+failed workflow and re-running it: exact matching registry content is pulled,
+rescanned, re-attested, and reused. An interruption between the first image push
+and provenance attachment intentionally needs the incomplete GHCR tags removed
+before retry. Conflicting tags and existing evidence assets are never
+overwritten. The PyPI version itself cannot be replaced.
 
-```bash
-gh workflow run publish.yml --ref main
-gh run watch        # follow it
-```
+Both publication workflows independently reject non-stable tags, tag/source
+version mismatches, commits outside `main`, and commits without a successful
+exact-SHA `main` CI run. There is no manual-dispatch publication path; use
+GitHub's **Re-run failed jobs** control to recover a failed release workflow.
 
 ## Verify
 
@@ -79,13 +92,30 @@ python -c "import shadowshield as ss; print(ss.__version__)"
 
 gh release download vX.Y.Z \
   --pattern container-digest.txt --pattern shadowshield-sbom.cdx.json
-docker pull "ghcr.io/0xsl1m/shadowshield@$(cat container-digest.txt)"
+digest="$(cat container-digest.txt)"
+image="ghcr.io/0xsl1m/shadowshield@$digest"
+docker pull "$image"
+gh attestation verify "oci://$image" \
+  --repo 0xsl1m/shadowshield \
+  --bundle-from-oci \
+  --signer-workflow 0xsl1m/shadowshield/.github/workflows/container-release.yml \
+  --source-digest "$(git rev-list -n 1 vX.Y.Z)" \
+  --deny-self-hosted-runners
+gh attestation verify "oci://$image" \
+  --repo 0xsl1m/shadowshield \
+  --bundle-from-oci \
+  --predicate-type https://cyclonedx.org/bom \
+  --signer-workflow 0xsl1m/shadowshield/.github/workflows/container-release.yml \
+  --source-digest "$(git rev-list -n 1 vX.Y.Z)" \
+  --deny-self-hosted-runners
 ```
 
 ## Notes
 
 - **Versions are immutable.** A published version can never be re-uploaded, only
   *yanked*. Always confirm `twine check` is green (CI does this) before releasing.
+- Regenerate dependency locks only in a dedicated reviewed PR, using the exact
+  commands recorded at the top of each lock file; CI audits both locked graphs.
 - Deploy the container by the exact `image@sha256` value in
   `container-digest.txt`, never by a mutable version tag or a local Compose
   rebuild. The release SBOM describes that exact pre-push-scanned image.

{shadowshield-0.6.1 → shadowshield-0.6.3}/docs/configuration.md

@@ -19,11 +19,11 @@ Generate an annotated starter file with `shadowshield init > shield.yaml`.
 
 ## Modes
 
-| Mode | block_threshold | medium→ | LLM check | rate limit |
-|---|---|---|---|---|
-| `strict` | 0.45 | block | on | on (30/60s) |
-| `balanced` | 0.65 | sanitize | off | off |
-| `permissive` | 0.85 | flag | off | off |
+| Mode | block_threshold | medium→ | detector failure | LLM check | rate limit |
+|---|---|---|---|---|---|
+| `strict` | 0.45 | block | block | on | on (30/60s) |
+| `balanced` | 0.65 | sanitize | report | off | off |
+| `permissive` | 0.85 | flag | report | off | off |
 
 A mode seeds every default; any field you set in YAML or `for_mode(..., **kw)`
 layers on top.
@@ -34,6 +34,7 @@ layers on top.
 |---|---|
 | `mode` | preset posture (strict/balanced/permissive) |
 | `raise_on_block` | make `Shield.scan()` raise on a block (default false) |
+| `fail_closed_on_detector_error` | block if any detector raises; failures are always reported as content-free metadata (strict defaults true) |
 | `block_threshold` | aggregate score that forces a block regardless of policy |
 | `policy.{none..critical}` | severity → decision mapping |
 | `detectors.<name>.enabled` | per-detector toggle |

{shadowshield-0.6.1 → shadowshield-0.6.3}/docs/plugins.md

@@ -56,7 +56,9 @@ shield = Shield.for_mode(
 
 A plugin that fails to import is **skipped**, not fatal — one broken third-party
 plugin can never disable the shield. A plugin detector that *raises during a scan*
-is caught by the engine's fail-safe wrapper and drops only its own contribution.
+is caught by the engine's fail-safe wrapper, reported through bounded content-free
+error metadata and metrics, and forces a block when
+`fail_closed_on_detector_error` is enabled.
 
 ## Security note
 

{shadowshield-0.6.1 → shadowshield-0.6.3}/docs/security-model.md

@@ -67,8 +67,10 @@ identity to block on its own.
 
 ## Fail-safe defaults
 
-- **Detector errors fail safe.** A detector that raises drops only its own
-  contribution; the scan continues with the other layers.
+- **Detector errors are visible.** The other independent layers continue, while
+  bounded content-free metadata and metrics identify the failed detector. Strict
+  mode forces a block; balanced/permissive report the failure unless configured
+  to fail closed.
 - **`guard()` fails closed** (raises), **`filter()` fails soft** (returns the safe
   fallback). You choose per call site.
 - **Secrets are never echoed.** Secret matches are redacted from `Threat` records

{shadowshield-0.6.1 → shadowshield-0.6.3}/pyproject.toml

@@ -1,10 +1,10 @@
 [build-system]
-requires = ["hatchling>=1.21"]
+requires = ["hatchling==1.31.0"]
 build-backend = "hatchling.build"
 
 [project]
 name = "shadowshield"
-version = "0.6.1"
+version = "0.6.3"
 description = "Unified open-source security shield for agentic AI systems — inspired by Sentinel & ShadowClaw."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -43,7 +43,6 @@ dependencies = [
     "structlog>=24.1",
     "pyyaml>=6.0",
     "httpx>=0.27",
-    "tiktoken>=0.6",
 ]
 
 [project.optional-dependencies]
@@ -142,8 +141,17 @@ python_version = "3.10"
 strict = true
 warn_unused_ignores = true
 ignore_missing_imports = true
+# Allow targeted external-stub exclusions to respect ``follow_imports = skip``.
+follow_imports_for_stubs = true
 files = ["src/shadowshield"]
 
+[[tool.mypy.overrides]]
+# NumPy 2.5 publishes PEP 695 aliases that cannot be parsed while mypy checks
+# our Python 3.10 syntax target. The optional dependency boundary stays Any;
+# every ShadowShield source module is still checked explicitly and strictly.
+module = ["numpy", "numpy.*"]
+follow_imports = "skip"
+
 [tool.coverage.run]
 source = ["shadowshield"]
 branch = true

{shadowshield-0.6.1 → shadowshield-0.6.3}/src/shadowshield/__init__.py

@@ -71,7 +71,7 @@ from .plugins import PluginManager, ShadowShieldPlugin
 from .reporter import Reporter, attach_reporter
 from .responders import Responder, spotlight
 
-__version__ = "0.6.1"
+__version__ = "0.6.3"
 
 __all__ = [
     "__version__",