spillway-guard 0.1.0__tar.gz

spillway_guard-0.1.0/.gitignore

@@ -0,0 +1,58 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+*.egg
+*.egg-info/
+.eggs/
+
+# Build artifacts
+build/
+dist/
+wheels/
+sdist/
+pip-wheel-metadata/
+*.whl
+
+# Virtual environments
+.venv/
+.venv-test/
+venv/
+env/
+ENV/
+.python-version
+
+# Tooling caches
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.hypothesis/
+.coverage
+.coverage.*
+htmlcov/
+.tox/
+.nox/
+
+# Logs and run output
+*.log
+logs/
+spillway_runs/
+
+# Local scratch (never committed)
+_work/
+
+# Secrets and local config
+.env
+.env.*
+*.pem
+
+# Editors and OS
+.DS_Store
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# local preview builds
+docs/_preview.html

spillway_guard-0.1.0/CHANGELOG.md

@@ -0,0 +1,114 @@
+# Changelog
+
+All notable changes to SPILLWAY are recorded here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project uses
+[semantic versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.1.0]
+
+Initial release. `reference/spillway_gate.py` is the final build of the
+gate the paper evaluated, and every number in the paper comes from it or from
+an earlier build. The `spillway_guard` package ports it, and differential tests
+compare their decisions on synthetic inputs. The library checks and their regression coverage are recorded below.
+`reference/BUILD_PROVENANCE.md` pins the evaluation artifacts used for the reported tables.
+
+### Added
+
+- `spillway_guard` package: the typed-identity egress floor (identity index read
+  from typed tool returns, taint-novel check, grant and destruction checks,
+  fixed delegation rules), the rule-based ingress sanitizer that removes
+  instruction-like regions and retains the removed spans as evidence, and the
+  optional two-view judge with the span veto (disabled by default, enabled in the paper's
+  results), which may restore a refused call but never one whose target
+  lies in the removed text. `Policy(delegation_span_veto=True)`, off by default
+  (the paper's setting), extends the span and co-residence veto to the
+  delegation rules and to grants to a named principal.
+- `spillway-agentdojo` (the `[agentdojo]` extra): runs the gate as a drop-in
+  AgentDojo pipeline element with the switches used in every run of the paper
+  (`--auto --access-grant --chatml-guard --exfil-provenance` and the `SPW_*`
+  environment switches).
+- `benchmarks/results/`: the per-cell numbers behind most of the paper's
+  tables (its README says which), and
+  `benchmarks/scripts/appendix_asr_levels.py` (`make asr-levels`), which
+  prints the raw and in-scope attack-success levels of the paper's Table 5
+  without its ROPE column.
+- Packaging and community files: `pyproject.toml`, `CITATION.cff`,
+  `CONTRIBUTING.md`, `SECURITY.md`, a bypass-report issue template, and CI
+  (lint, unit tests on Python 3.10 to 3.13, differential tests against the
+  reference gate, a build check).
+
+### Library checks and regression coverage
+
+`spillway-agentdojo` runs the archived evaluation gate in
+`reference/spillway_gate.py`. The reusable library API maintains the checks
+below. Each path has a test in `tests/test_hardening.py`, and `SECURITY.md`
+lists the integration conditions and remaining admission paths.
+Replaying recorded tool calls through the package before and after these
+changes, without a model, changed none of 7,831 AgentDojo decisions. On 4,259
+AgentDyn calls from an earlier run it refused 2 more with the judge fixed at yes
+and 284 more with no judge. This replay checks fixed-call decisions. Task-level utility and attack success
+are the paper's evaluation results, whose build lineage is recorded in
+`reference/BUILD_PROVENANCE.md`.
+
+- Delegation rules: every target of a call, a number included, must be bound to
+  the task, a value that holds an address or a URL no longer passes on its first
+  word, and a digit run no longer makes a value an identity attribute.
+- Task-named fetches: a task word must name the URL's host, a parent domain counts
+  only when written in full, and only URL arguments count. `fetch_*` and
+  `browse_*` tools get the content check.
+- Grants: a principal must be named in the task as a whole word, numeric member
+  ids count as principals, and a `transfer` tool counts as a grant only when it
+  moves an owner or a repository.
+- Free text: an IBAN or another opaque identifier repeated inside a sentence
+  counts as repeated in free text.
+- Decoy spans: a harmless removed span no longer opens the injection-span rule.
+  `Policy(injspan_clean_rule=True)` restores the evaluated rule.
+- Span veto: forged chat turns join the removed spans, a sign-off removes the
+  sender's name only at the claim, and the grant rule honors removed text.
+- Taint: returns are also compared as raw strings, so a target with a character
+  the renderer escapes still matches.
+- Arguments and fields: target values are read at any depth, camelCase names
+  split into words, and free-text names such as `email_body` are never targets
+  or identity roles. `attendees`, `invitees`, `guests` and `shared_with` are
+  target arguments.
+- Deletions: an intent word must be a whole word that no negation covers, so
+  "clearly", "cancellation policy" and "do not delete" no longer authorize a
+  deletion.
+- Judge: only a true verdict restores a call, an exception counts as a no,
+  `Judge(threshold=...)` takes effect, a panel counts every model, and a long
+  argument no longer pushes a target out of the prompt.
+
+### Results in the paper (AgentDojo suite v1.2.2 and AgentDyn)
+
+- Standard attack, three backbones x four suites: in-scope attack success
+  `.000` on all twelve cells, at the highest twelve-cell under-attack utility of
+  the defenses run (`.484`) and 96% of the undefended agent's benign utility.
+- ChatInject (forged chat template, qwen3:8b, 665 pairs): raw zero.
+- AutoDojo (optimizer-generated injections): in-scope attack success `.000` on
+  the 389 released pairs (descriptive). On two held-out Banking sets, `.000` and
+  `.007` by AgentDojo's check, `.014` counting a second transfer that check
+  misses.
+- PISmith (released RL attacker): mean in-scope attack success `.007`.
+- Delegated routing against ROPE, seven suites on gpt-4o-mini: in-scope attack
+  success zero on all seven.
+
+Some of these results, among them SPILLWAY's cells in Table 1, ran on an earlier
+build without the address and payee-change rules. Appendix B of the paper
+reports that these rules change no sanitizer output on the 27,392 tool messages
+behind Tables 1 and 3, the ChatInject panel and Figures 3 and 4, and that
+rerunning Table 1's 949 qwen3:8b pairs with the address rules reproduces each
+suite's utility and attack success to the third decimal.
+
+### Scope
+
+- The stated property is scoped to identity targets: a recipient, account, participant,
+  channel or URL that the user never named and that no read-only tool returned
+  in a typed field. A spoofed typed field and content-only effects are out of
+  scope. See `SECURITY.md`.
+- Target roles come from one lexicon per tool set. A new tool set needs its roles
+  declared before the floor covers it. See `CONTRIBUTING.md`.
+
+[Unreleased]: https://github.com/saintmachines/spillway/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/saintmachines/spillway/releases/tag/v0.1.0

spillway_guard-0.1.0/CITATION.cff

@@ -0,0 +1,35 @@
+cff-version: 1.2.0
+message: "If you use SPILLWAY in your work, please cite the paper listed under preferred-citation."
+type: software
+title: "SPILLWAY"
+abstract: "Prompt-injection defense for tool-using LLM agents: a typed-identity egress floor, a rule-based ingress sanitizer, and an optional judge that reviews refused calls."
+authors:
+  - family-names: Lim
+    given-names: Woosang
+  - family-names: Chang
+    given-names: Yeseul
+  - family-names: Lee
+    given-names: Jaewoo
+version: 0.1.0
+license: Apache-2.0
+repository-code: "https://github.com/saintmachines/spillway"
+url: "https://saintmachines.github.io/spillway/"
+keywords:
+  - prompt injection
+  - LLM agents
+  - tool use
+  - agent security
+  - AgentDojo
+preferred-citation:
+  type: unpublished
+  title: "SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection"
+  authors:
+    - family-names: Lim
+      given-names: Woosang
+    - family-names: Chang
+      given-names: Yeseul
+    - family-names: Lee
+      given-names: Jaewoo
+  year: 2026
+  url: "https://github.com/saintmachines/spillway/blob/main/docs/SPILLWAY_preprint.pdf"
+  notes: "Preprint."

spillway_guard-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,87 @@
+# Contributing to SPILLWAY
+
+Thanks for helping. Three kinds of contribution are most useful: a bypass report
+(an injection that gets an effect to an attacker's target through the floor), a
+tool-role lexicon for a tool set the floor does not cover yet, and fixes with a
+test. Keep the floor deterministic: no model call decides admission.
+
+## Setup and tests
+
+```bash
+git clone https://github.com/saintmachines/spillway
+cd spillway
+python -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+ruff check .
+pytest -q -m "not differential"
+```
+
+The differential tests run synthetic tool messages and typed models through the
+packaged floor and through `reference/spillway_gate.py` (the final build the paper
+evaluated) and require identical decisions on those inputs. The library checks
+and their regression cases are recorded in `CHANGELOG.md` and
+`tests/test_hardening.py`. A deliberate behavioral difference from the archived
+gate belongs in both records. The differential tests
+need the AgentDojo extra. Set `SPW_REQUIRE_DIFFERENTIAL=1` so that a missing
+dependency fails the run instead of skipping it:
+
+```bash
+pip install -e ".[dev,agentdojo]"
+SPW_REQUIRE_DIFFERENTIAL=1 pytest -q -m differential
+```
+
+Add such a test to `tests/test_differential.py`, whose tests carry the
+`differential` mark. CI runs both groups on pushes to `main` and on pull
+requests.
+
+## Adding a tool-role lexicon for a new tool set
+
+The floor reads where a call goes from the tools' declared types, never from
+text. What it needs per tool set is a role lexicon, written once:
+
+1. **Verb prefixes** that mark a tool as read-only, writing, destructive, or
+   granting (the AgentDojo lexicon has 11, 22, 10, and 11 of them).
+2. **Target-argument names**: the arguments that name where an effect goes
+   (recipient, account, participant, channel, URL, with 26 names for AgentDojo and
+   6 more for AgentDyn).
+3. **Principal-argument names**: the arguments that name who receives a grant.
+4. **Self-owned tools**: the short list of tools that write only to the user's
+   own calendar or drive.
+5. **Identity field types and routing roles** on the tools' return models: a
+   field is indexed when its declared type is an identity format (email, URI,
+   UUID, hostname, IP) or its field has a routing role (recipient, sender,
+   participant, channel).
+
+Then:
+
+- Add a classmethod to `Lexicon` in `src/spillway_guard/lexicon.py`, like
+  `for_agentdyn`, and pass the result to `Guard` through `lexicon`. Keep an existing
+  lexicon as it is when you cover a new tool set.
+- Add a test that runs the new tool set's benign tasks with the gate on and off
+  and shows which calls the floor refuses and why. A refusal on benign traffic
+  indicates a lexicon gap. Correct the role declarations and rerun the check.
+- Confirm the change is a no-op on the AgentDojo suites: the differential tests
+  must still pass unchanged.
+- Say in the pull request which tool set, how many tools in each role, and which
+  identity fields the index picks up.
+
+## Reporting an attack that bypasses the floor
+
+An injection that routes an effect to an identity target the user never named is
+a security report. Follow [SECURITY.md](SECURITY.md) and send it through the
+private channel described there. The fields a report needs are listed in the
+[bypass report template](.github/ISSUE_TEMPLATE/bypass_report.md). A utility
+regression, a sanitizer rule that removes benign text, or a content-only effect
+is a normal issue.
+
+## Conventions
+
+- Python 3.10 or newer, standard library first. `pydantic` and `PyYAML` are the only
+  hard runtime dependencies. `agentdojo` stays optional.
+- Environment switches use the `SPW_` prefix.
+- Every result in the documentation traces to `benchmarks/results/*.json` or to
+  the paper. Do not add a result that neither source carries. Operational figures
+  from the paper's runs, such as GPU memory and API cost, are labelled as such.
+- Claims stay within the threat model: zero in-scope attack success on the
+  AgentDojo benchmarks the paper runs, nothing wider than that.
+- `ruff check .` and `ruff format .` before you push (line length 120).

spillway_guard-0.1.0/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 SPILLWAY authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

spillway_guard-0.1.0/Makefile

@@ -0,0 +1,50 @@
+# SPILLWAY release: developer targets. `make help` lists them.
+PY ?= python3
+TABLES := benchmarks/scripts/make_tables.py
+ASR_LEVELS := benchmarks/scripts/appendix_asr_levels.py
+
+.PHONY: help install install-agentdojo test tables asr-levels lint selftest cell
+
+help:
+	@echo "make install           editable install with the dev extra (pytest, ruff, email-validator)"
+	@echo "make install-agentdojo editable install with the dev and agentdojo extras (runs the gate on AgentDojo)"
+	@echo "make test              check benchmarks/results against the paper's numbers, then the unit tests"
+	@echo "make tables            write benchmarks/TABLES.md from benchmarks/results/*.json"
+	@echo "make asr-levels        print Appendix Table 5 (raw / in-scope ASR per cell) from the breadth-grid files, without its ROPE column"
+	@echo "make lint              ruff check . (the configuration in ruff.toml, the same as CI)"
+	@echo "make selftest          the reference gate's own self-tests (needs the agentdojo extra, no server)"
+	@echo "make cell SUITE=banking BACKBONE=qwen3:8b   run one AgentDojo cell with the paper's settings"
+
+# A venv made by `uv venv` ships no pip: run `$(PY) -m ensurepip --upgrade` first, or use `uv pip install -e ".[dev]"`.
+install:
+	$(PY) -m pip install -e ".[dev]"
+
+install-agentdojo:
+	$(PY) -m pip install -e ".[dev,agentdojo]"
+
+# make_tables.py exits non-zero when a printed value differs from the paper, so it is a test.
+test:
+	$(PY) $(TABLES) --no-write
+	@$(PY) -m pytest -q -m "not differential" tests
+
+tables:
+	$(PY) $(TABLES) --out benchmarks/TABLES.md
+
+# appendix_asr_levels.py is pinned byte for byte in reference/BUILD_PROVENANCE.md and opens its two input files under
+# fixed names in the current directory. This target runs it unchanged in a temporary directory that links the shipped files under
+# those names. It reads the per-cell aggregates in those two files, not per-pair records.
+asr-levels:
+	@tmp=$$(mktemp -d) && trap 'rm -rf "$$tmp"' EXIT && \
+	ln -s "$(CURDIR)/benchmarks/results/breadth_grid_summary.json" "$$tmp/final_v122.json" && \
+	ln -s "$(CURDIR)/benchmarks/results/breadth_grid_cells.json" "$$tmp/tables_v122.json" && \
+	$(PY) -c 'import os, runpy, sys; os.chdir(sys.argv[1]); runpy.run_path(sys.argv[2], run_name="__main__")' "$$tmp" "$(CURDIR)/$(ASR_LEVELS)"
+
+lint:
+	ruff check .
+
+selftest:
+	$(PY) -m spillway_guard.agentdojo.runner --self-test
+
+cell:
+	@test -n "$(SUITE)" -a -n "$(BACKBONE)" || { echo "usage: make cell SUITE=<suite> BACKBONE=<model>"; exit 2; }
+	bash reproduce/run_cell.sh "$(SUITE)" "$(BACKBONE)"

spillway_guard-0.1.0/NOTICE

@@ -0,0 +1,81 @@
+SPILLWAY (spillway-guard)
+Copyright 2026 SPILLWAY authors
+
+This product is licensed under the Apache License, Version 2.0. See LICENSE.
+
+This product includes material from AgentDojo
+(https://github.com/ethz-spylab/agentdojo), which is licensed under the MIT
+License. The AgentDojo copyright notice and license text are reproduced at the
+end of this file, copied from licenses/LICENSE in the agentdojo 0.1.35
+distribution.
+
+Files that derive from AgentDojo:
+
+  src/spillway_guard/agentdojo/agentdojo_default_prompt.txt
+    AgentDojo's default system prompt, the "default" entry of
+    agentdojo/data/system_messages.yaml, byte for byte.
+    Ships in the wheel and in the source distribution.
+
+  reference/harness/21_agentdojo_full_benchmark.py
+    Contains code copied and adapted from
+    agentdojo/agent_pipeline/tool_execution.py and
+    agentdojo/agent_pipeline/llms/google_llm.py.
+    Ships in the source distribution.
+
+  reference/harness/24_agentdojo_gemini_backbone.py
+    Contains code copied and adapted from
+    agentdojo/agent_pipeline/llms/google_llm.py.
+    Ships in the source distribution.
+
+Test inputs in tests/, the self-test in reference/spillway_gate.py and the
+template patterns in src/spillway_guard/sanitizer.py reuse AgentDojo's
+important_instructions injection template, addresses and tool names. The typed
+fixtures in tests/test_floor.py are shaped like AgentDojo's return models, and
+the prompt listed above is also copied into
+reference/harness/21_agentdojo_full_benchmark.py.
+
+The project page under docs/ shows one recorded AgentDojo episode. Its task,
+tool returns and injection text come from AgentDojo's task suites.
+
+The lexicon in src/spillway_guard/lexicon.py and the harness under
+reference/harness/ use tool-argument names and one sentence of the default
+prompt of AgentDyn (https://github.com/SaFo-Lab/AgentDyn), which is under the
+MIT License with the same copyright line as AgentDojo.
+
+Other licenses. The Apache License does not cover these files:
+
+  docs/assets/fonts/
+    Fraunces and IBM Plex, under the SIL Open Font License 1.1. The license
+    texts sit beside the fonts.
+
+  docs/assets/saintmachines_lockup.svg, docs/assets/saintmachines_lockup_white.svg
+    Logos. No license to these or to the SPILLWAY and SAINT Machines names is
+    granted, as section 6 of the Apache License says of trademarks.
+
+  docs/SPILLWAY_preprint.pdf
+    The paper, under the license it carries on arXiv.
+
+
+AgentDojo license (agentdojo 0.1.35, licenses/LICENSE):
+
+MIT License
+
+Copyright (c) 2024 Edoardo Debenedetti, Jie Zhang, Mislav Balunovic, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.