swiftapi-python 1.2.2__tar.gz → 1.3.0__tar.gz

swiftapi_python-1.3.0/CHANGELOG.md

@@ -0,0 +1,21 @@
+# Changelog
+
+## 1.3.0 — 2026-09-22
+
+Add local prerequisite evaluation, canonical action envelopes, Ed25519 decisions
+and execution receipts, durable replay protection, an exact sandbox marker broker,
+Codex/Claude MCP installation with dry-run/backups/uninstall, and local qualification.
+Add an optional pinned-key remote decision client with sync and async authorization.
+Add pinned defensive-framework fetches and denominator-preserving evaluation import.
+
+Harden inherited authority and provider paths: verify signed exact-action approval,
+consume attestations before consequences, refuse redirects, fail closed on unknown
+revocation, and preserve provider termination metadata without synthetic Void labels.
+
+Research artifacts, native-EOS model claims, and unpublished local 2.0 work are
+preserved separately. This release does not claim to reproduce or ship those models.
+
+## 1.2.2 — 2026-02-25
+
+Historical PyPI ancestor. Its wheel and sdist are immutable; the release audit
+records their published and independently recomputed hashes and exact public API.

swiftapi_python-1.3.0/MANIFEST.in

@@ -0,0 +1,6 @@
+include LICENSE README.md MIGRATION_1_2_2.md CHANGELOG.md PRODUCT_TRUTH_MAP.md
+recursive-include docs *.md
+recursive-include tests *.py
+recursive-include scripts *.py
+recursive-include benchmarks *.json
+recursive-include swiftapi py.typed

swiftapi_python-1.3.0/MIGRATION_1_2_2.md

@@ -0,0 +1,37 @@
+# Migration from 1.2.2 to 1.3.0
+
+1.2.2 remains immutable provenance. This is an additive minor release with
+explicit security corrections. The public imports, constructor call forms,
+remote endpoints, and callback/decorator/context-manager usage are preserved.
+No unpublished 2.0.0 native-runtime code or research model is shipped here.
+
+| Historical 1.2.2 | 1.3.0 |
+| --- | --- |
+| `SwiftAPI`, `Enforcement`, `enforce`, provider wrappers and verifier exports | Preserved; new local API and CLI added |
+| `check_revocation` returned false after authority/network failure | Failure raises; paranoid execution stops |
+| Guard checked a signature without comparing the exact requested action | Signed approval, action type and fingerprint must match |
+| No local one-use attestation ledger | SQLite issuer/JTI claim before guarded callbacks or attested provider calls |
+| Provider wrappers accepted unsigned approval and bound incomplete kwargs | Verify signatures and bind the complete outbound payload |
+| Wrapper-generated empty denial called `void` | Empty denial retained for compatibility; `classification=GATE_BLOCK`, stop metadata absent |
+| Synthetic `stop`/`end_turn` generated by response constructors | Provider stop metadata is retained only when supplied by the provider |
+| Authority redirects could forward headers | Redirects refused; HTTPS authority URLs required |
+| No CLI/local authority | `swiftapi doctor`, `brake`, MCP installation, qualification and receipt verification |
+
+If you tested `finish_reason == "void"` or `stop_reason == "void"`, switch to
+`response.classification == "GATE_BLOCK"`. A locally blocked call never reached
+the provider. Do not interpret it as model-native noncontinuation.
+
+Replay state defaults to `~/.local/share/swiftapi/replay.sqlite3`; set
+`SWIFTAPI_HOME` to a private dedicated directory for each trusted deployment.
+Keep this state durable and shared across workers that share an authority.
+Deleting/resetting it resets replay protection. Do not share an unsafe directory.
+
+Callbacks and decorators retain the historical descriptive-action API. They do
+not inspect arbitrary Python code or dynamically bind decorator arguments.
+Use broker operations for exact parameter construction and execution. Legacy
+`paranoid=False` still skips online revocation; choose `paranoid=True` for live
+revocation checks. Provider compatibility wrappers authenticate authorization
+but do not claim online revocation checks or the full upstream SDK surface.
+
+The new remote decision protocol is separate from the legacy `/verify` protocol.
+There is no assertion that swiftapi.ai already implements it.

swiftapi_python-1.3.0/PKG-INFO

@@ -0,0 +1,147 @@
+Metadata-Version: 2.4
+Name: swiftapi-python
+Version: 1.3.0
+Summary: SwiftAPI Python SDK - AI Action Verification Gateway
+Author-email: Rayan Pal <rayan@swiftapi.ai>
+License-Expression: MIT
+Project-URL: Homepage, https://swiftapi.ai
+Project-URL: Documentation, https://getswiftapi.com/docs
+Keywords: swiftapi,ai,verification,attestation,security,governance,enforcement
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests<3,>=2.32.3
+Requires-Dist: pynacl<2,>=1.5.0
+Requires-Dist: colorama<1,>=0.4.6
+Requires-Dist: tomli<3,>=2; python_version < "3.11"
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0.0; extra == "dev"
+Requires-Dist: hypothesis<7,>=6; extra == "dev"
+Requires-Dist: pytest-cov>=4.0.0; extra == "dev"
+Requires-Dist: black>=23.0.0; extra == "dev"
+Requires-Dist: mypy>=1.0.0; extra == "dev"
+Requires-Dist: types-requests<3,>=2.32.3; extra == "dev"
+Dynamic: license-file
+
+# SwiftAPI Python SDK
+
+A prerequisite before a protected action. Local Swift Brake verifies explicit
+permission, executes its registered capability once, and creates signed receipts.
+Codex or Claude Code remains the coding agent. No second model is involved.
+
+```bash
+pip install swiftapi-python
+swiftapi doctor
+swiftapi brake test
+swiftapi brake install --dry-run
+swiftapi brake install
+```
+
+Python 3.9+, macOS and Linux. The local test needs no account, API key, model,
+or cloud service. Restart the coding agent after installing the MCP integration.
+
+## Try the brake
+
+```bash
+swiftapi brake propose hello.txt "Hello from Swift Brake"
+# Copy the returned request_id into the following commands.
+swiftapi brake execute REQUEST_ID
+# GATE_BLOCK: no marker is written.
+swiftapi brake authorize REQUEST_ID
+swiftapi brake execute REQUEST_ID
+# AUTHORIZED_EXECUTION: exact marker bytes are written once.
+swiftapi brake execute REQUEST_ID
+# GATE_BLOCK: the authorization cannot execute again.
+swiftapi status
+swiftapi receipts
+swiftapi verify RECEIPT_PATH --public-key PUBLIC_KEY_PATH
+```
+
+`status` prints the sandbox and public-key path. `execute` returns the receipt
+path. The operator authorizes in a separate terminal; authorization is deliberately
+absent from the MCP tool surface. A signature requires an independently trusted
+verification key, never a key blindly accepted from the receipt itself.
+
+`swiftapi brake` presents `swiftapi>` and delegates ordinary input to the existing
+Codex CLI. `swiftapi brake --agent claude` uses Claude Code. These host calls use
+your existing account; the local test itself makes no model calls.
+
+## Python
+
+The old imports remain available: `from swiftapi import SwiftAPI, Enforcement`.
+The new local API does not require a remote account:
+
+```python
+from pathlib import Path
+from tempfile import mkdtemp
+from swiftapi import ActionEnvelope, BindingCondition, LocalAuthority, LocalGuard
+
+action = ActionEnvelope("example.append", {"value": "verified"}, "Append one value")
+state = {"operator_approved": True}  # Supplied by trusted application code.
+condition = BindingCondition(action.action_hash, state)
+guard = LocalGuard(LocalAuthority(), Path(mkdtemp()) / "ledger")
+values = []
+guard.run(
+    lambda: values.append("verified"),
+    action=action.capability, params=action.params, intent=action.intent,
+    condition=condition, state=state,
+)
+assert values == ["verified"]
+```
+
+A callback's code must actually implement its supplied action description.
+For an untrusted agent, use a registered broker operation that constructs and
+executes the same canonical parameters. The bundled MCP operation creates a new
+small UTF-8 marker in its own sandbox; it cannot run a shell or overwrite files.
+
+## What is enforced
+
+An authorization binds an action hash, capability, condition hash, state hash,
+nonce, issue time, and expiry. Ed25519 verification and a durable SQLite replay
+claim happen before execution. Execution is never retried. Missing, malformed,
+forged, expired, replayed, or mismatched authorization fails closed.
+
+This guarantee applies to mediated capabilities. Arbitrary host tools are outside
+the broker. Local same-user key storage supports development and CI; a malicious
+process able to read the signer, change the gate, or mutate the ledger can bypass
+that trust boundary. Production credentials and signing authority require process
+or account isolation from untrusted agent code. Instructions and hooks are not a
+universal security boundary.
+
+## Research is measured separately
+
+`GATE_BLOCK` is deterministic enforcement, not native EOS. Successful empty
+provider output is classified as a black-box `PROVIDER_VOID` with V0/V1/V2/VU
+subtypes. Only exposed native token evidence can qualify as `NATIVE_VOID`.
+The package does not download or retrain research models. The frozen
+[PCCG-2 release](https://getswiftapi.com/pccg-2) and
+[research library](https://getswiftapi.com/research) preserve the empirical,
+causal, theoretical, and protocol boundaries.
+
+## Documentation
+
+Start with [Quickstart](docs/QUICKSTART.md). See [concepts](docs/CONCEPTS.md),
+[local brake](docs/LOCAL_BRAKE.md), [Codex](docs/CODEX.md),
+[Claude Code](docs/CLAUDE_CODE.md), [Python SDK](docs/PYTHON_SDK.md),
+[conditions](docs/CONDITIONS.md), [action envelopes](docs/ACTION_ENVELOPES.md),
+[receipts](docs/RECEIPTS.md), [verification](docs/VERIFICATION.md),
+[remote authority](docs/REMOTE_SWIFTAPI.md), [BYOK](docs/BYOK.md),
+[security](docs/SECURITY_MODEL.md), [threat model](docs/THREAT_MODEL.md),
+[native noncontinuation](docs/NATIVE_NONCONTINUATION.md),
+[benchmarking](docs/BENCHMARKING.md), and [provenance](docs/RESEARCH_PROVENANCE.md).
+
+[Migration from 1.2.2](MIGRATION_1_2_2.md) documents security corrections and
+termination-metadata changes. Historical 1.2.2 bytes remain immutable on PyPI.
+
+MIT license. Research and software by Rayan Pal / SwiftAPI Labs.

swiftapi_python-1.3.0/PRODUCT_TRUTH_MAP.md

@@ -0,0 +1,50 @@
+# Product truth map — 2026-09-22
+
+Source record: live getswiftapi.com pages fetched before code mutation, linked
+DOIs/repositories followed, exact PyPI 1.2.2 wheel/sdist verified. Audit snapshots
+and source reconciliation are retained in the enclosing consolidation/audit tree.
+Status distinguishes implementation from research and protocol claims; a source
+inspection is not a fresh replay of frozen research or a production service audit.
+
+| Claim / category | Website location | Implementation | Test / evidence / immutable identity | Current status |
+| --- | --- | --- | --- | --- |
+| Native EOS-only content/permission separation, 101 parameters | /, /pccg-2, /research | Frozen research model, not this SDK | HF PCCG-2 revision a3b952458a46b5547ba3cec7d03a37b395bed03a; DOI 22730710; 2048 FINAL, 40+40 causal, frozen non-EOS hash 5f42fcb08c73af4914a711b524ae7130d671ec9504ecdfa699e8f478094713ec | RESEARCH_ONLY |
+| Full accepted six-digit domain certificate | /pccg-2 | Published finite-precision proof/checker, not 810 billion new trials | DOI 22730710 manuscript supplement; specific recorded-content and arithmetic assumptions | RESEARCH_ONLY |
+| PCCG-1 reasoning-prefix-preserving GO/EOS intervention | /pccg, /research | Separate trained Qwen3-4B release | GitHub d08b157ac9273974b75d7ada2a894a1afe86e3f2; HF 5f3b70d51f068a7a8a108b99f66b2fdfd15e25ce; DOI 22681787 | RESEARCH_ONLY |
+| 31,430-trial matrix, 11,658 Void outcomes, 0/4290 matched control Voids | /, /research | Frozen provider records, not a universal security guarantee | DOI 21696066; void-matrix-complete-analysis v1.0.0-evidence-analysis; published definition retained | RESEARCH_ONLY |
+| 12,160 cross-script trials, 7253 exact artifacts | /, /research | Frozen GPT-5.4 records | DOI 21799525; gpt-5.4-shrt-cross-script-evidence | RESEARCH_ONLY |
+| Earlier 180/180 null trials with non-null controls | /research | Frozen two-model protocol | DOI 18976656; void-convergence repository | RESEARCH_ONLY |
+| Kimi native/provider receipt terminology | /kimi-receipts | Public case evidence and receipt verifier | Linked captured provider records; no inference of internal EOS from stop | RESEARCH_ONLY |
+| Binding condition / proposed AGI criterion | /research, /public-agi-criterion | Conceptual criterion, not a software security proof | DOI 19211116 | DOCUMENTED_ONLY |
+| Textual emergence, earlier frameworks and chronology | /research | Published research history | DOIs 17856031, 18395519, 18750330, 18796600; links preserved | RESEARCH_ONLY |
+| Attestation protocol, offline Ed25519 verification | /docs, /verify, /research | legacy verifier.py; brake/core.py | test_verifier.py; test_brake.py; DOI 18012025; pinned historical key | IMPLEMENTED |
+| Revocation and replay defense advertised for SDK | /, /docs | client.check_revocation; Enforcement; verifier.claim_attestation | test_legacy_security.py; test_release_contract.py; historical revocation failed open and lacked local replay, corrected here | IMPLEMENTED |
+| No action executes without verification | historical PyPI README; /docs | Enforcement callbacks and registered broker only | Forged/mismatched/replay tests; wording narrowed to mediated capabilities, no arbitrary-root guarantee | PARTIAL |
+| Scoped keys, policies, grants, audit endpoints | /, /docs | existing backend main.py routes and legacy SDK client | Backend source inspected; no authenticated production write was performed | PARTIAL |
+| API/proxy/admission/runtime integrations | /docs | existing backend, CLI/MCP and admission-controller trees | Existing code present; not all runtime deployments qualified in this release | PARTIAL |
+| Public self-service cloud key issuance unavailable | /docs | Existing scoped authority provisioning flow | Live documentation explicitly states scoped evaluation/partnership access; local package requires no account | DOCUMENTED_ONLY |
+| BYOK/provider credentials remain with provider | /docs | existing compatibility wrappers; new MCP path has no provider request | test_openai.py, test_anthropic.py, HTTPS/no-redirect regressions; no live provider call required | IMPLEMENTED |
+| Optional attested-provider service mode | new BYOK documentation | Existing legacy attestation wrappers; no forced provider proxy | Service-specific new mode not deployed by this release | DOCUMENTED_ONLY |
+| Local prerequisite-conditioned brake | new /brake, README | brake/core.py, broker.py, cli.py | 11-case local qualification plus adversarial/property tests | IMPLEMENTED |
+| Canonical action/state/condition binding | new product docs | ActionEnvelope, BindingCondition, verify_decision | Hash substitution, type sensitivity, mutation and serialization property tests | IMPLEMENTED |
+| Signed short-lived one-use authorization | new product docs | LocalAuthority, ReplayLedger | Forgery, wrong trust key, expiry, concurrency and fresh-process replay tests | IMPLEMENTED |
+| Durable receipts independently verified | new /brake | decision/execution schemas and CLI verify | Signed-envelope verification in isolated process; no assertion that signature proves real-world effect | IMPLEMENTED |
+| Codex/Claude normal prompts with local tools | new /brake | stdio MCP, managed config and instruction installers | Installer preservation/reversal tests; live host qualification reported separately in release manifest | IMPLEMENTED |
+| Hooks form universal security boundary | not a valid supported claim | No mandatory-hook claim in this release | Official host docs identify coverage/trust limits; arbitrary tools remain outside broker | STALE |
+| Native model runtime as installable 2.0.0 product | local unpublished /void draft; live /void returns 404 | Unpublished home SDK work preserved separately | Missing public release manifest; isolated website safely returns 404 until a qualified release exists | MISSING |
+| Defensive benchmark adapter | new benchmark docs | brake/benchmarks.py and pinned upstream fetch script | Case-denominator and failure-retention tests; frameworks fetched at exact locked commits; model evaluations not run | IMPLEMENTED |
+| Zero unauthorized escape in production | requested invariant, no universal public result | Enforced for broker requests under documented trust assumptions | Local fixture escape count only; production adapters/credential isolation require qualification | PARTIAL |
+| Patent filing record | /patent | Public record and document links only | No legal scope, validity, or enforcement inference made by SDK release | DOCUMENTED_ONLY |
+
+All bare DOI numbers above are under `10.5281/zenodo.`. The full URLs and page
+responses are in the audit index. The archived matrix ZIP fetch is explicitly
+marked as a retained prefix, not a complete evidence re-verification.
+
+## Source reconciliation
+
+The historical import/API tree was compared byte-for-byte with both local SDKs.
+The isolated release starts from the verified 1.2.2 sdist, retains an ancestor
+commit, imports inspected compatible security fixes from the home SDK, and adds
+the deterministic local brake. The unpublished native 2.0.0 tree, Swift Brake
+prototype, backend, research assets and dirty website source remain untouched.
+Website changes are isolated and reviewable in a separate checkout and patch.

swiftapi_python-1.3.0/README.md

@@ -0,0 +1,111 @@
+# SwiftAPI Python SDK
+
+A prerequisite before a protected action. Local Swift Brake verifies explicit
+permission, executes its registered capability once, and creates signed receipts.
+Codex or Claude Code remains the coding agent. No second model is involved.
+
+```bash
+pip install swiftapi-python
+swiftapi doctor
+swiftapi brake test
+swiftapi brake install --dry-run
+swiftapi brake install
+```
+
+Python 3.9+, macOS and Linux. The local test needs no account, API key, model,
+or cloud service. Restart the coding agent after installing the MCP integration.
+
+## Try the brake
+
+```bash
+swiftapi brake propose hello.txt "Hello from Swift Brake"
+# Copy the returned request_id into the following commands.
+swiftapi brake execute REQUEST_ID
+# GATE_BLOCK: no marker is written.
+swiftapi brake authorize REQUEST_ID
+swiftapi brake execute REQUEST_ID
+# AUTHORIZED_EXECUTION: exact marker bytes are written once.
+swiftapi brake execute REQUEST_ID
+# GATE_BLOCK: the authorization cannot execute again.
+swiftapi status
+swiftapi receipts
+swiftapi verify RECEIPT_PATH --public-key PUBLIC_KEY_PATH
+```
+
+`status` prints the sandbox and public-key path. `execute` returns the receipt
+path. The operator authorizes in a separate terminal; authorization is deliberately
+absent from the MCP tool surface. A signature requires an independently trusted
+verification key, never a key blindly accepted from the receipt itself.
+
+`swiftapi brake` presents `swiftapi>` and delegates ordinary input to the existing
+Codex CLI. `swiftapi brake --agent claude` uses Claude Code. These host calls use
+your existing account; the local test itself makes no model calls.
+
+## Python
+
+The old imports remain available: `from swiftapi import SwiftAPI, Enforcement`.
+The new local API does not require a remote account:
+
+```python
+from pathlib import Path
+from tempfile import mkdtemp
+from swiftapi import ActionEnvelope, BindingCondition, LocalAuthority, LocalGuard
+
+action = ActionEnvelope("example.append", {"value": "verified"}, "Append one value")
+state = {"operator_approved": True}  # Supplied by trusted application code.
+condition = BindingCondition(action.action_hash, state)
+guard = LocalGuard(LocalAuthority(), Path(mkdtemp()) / "ledger")
+values = []
+guard.run(
+    lambda: values.append("verified"),
+    action=action.capability, params=action.params, intent=action.intent,
+    condition=condition, state=state,
+)
+assert values == ["verified"]
+```
+
+A callback's code must actually implement its supplied action description.
+For an untrusted agent, use a registered broker operation that constructs and
+executes the same canonical parameters. The bundled MCP operation creates a new
+small UTF-8 marker in its own sandbox; it cannot run a shell or overwrite files.
+
+## What is enforced
+
+An authorization binds an action hash, capability, condition hash, state hash,
+nonce, issue time, and expiry. Ed25519 verification and a durable SQLite replay
+claim happen before execution. Execution is never retried. Missing, malformed,
+forged, expired, replayed, or mismatched authorization fails closed.
+
+This guarantee applies to mediated capabilities. Arbitrary host tools are outside
+the broker. Local same-user key storage supports development and CI; a malicious
+process able to read the signer, change the gate, or mutate the ledger can bypass
+that trust boundary. Production credentials and signing authority require process
+or account isolation from untrusted agent code. Instructions and hooks are not a
+universal security boundary.
+
+## Research is measured separately
+
+`GATE_BLOCK` is deterministic enforcement, not native EOS. Successful empty
+provider output is classified as a black-box `PROVIDER_VOID` with V0/V1/V2/VU
+subtypes. Only exposed native token evidence can qualify as `NATIVE_VOID`.
+The package does not download or retrain research models. The frozen
+[PCCG-2 release](https://getswiftapi.com/pccg-2) and
+[research library](https://getswiftapi.com/research) preserve the empirical,
+causal, theoretical, and protocol boundaries.
+
+## Documentation
+
+Start with [Quickstart](docs/QUICKSTART.md). See [concepts](docs/CONCEPTS.md),
+[local brake](docs/LOCAL_BRAKE.md), [Codex](docs/CODEX.md),
+[Claude Code](docs/CLAUDE_CODE.md), [Python SDK](docs/PYTHON_SDK.md),
+[conditions](docs/CONDITIONS.md), [action envelopes](docs/ACTION_ENVELOPES.md),
+[receipts](docs/RECEIPTS.md), [verification](docs/VERIFICATION.md),
+[remote authority](docs/REMOTE_SWIFTAPI.md), [BYOK](docs/BYOK.md),
+[security](docs/SECURITY_MODEL.md), [threat model](docs/THREAT_MODEL.md),
+[native noncontinuation](docs/NATIVE_NONCONTINUATION.md),
+[benchmarking](docs/BENCHMARKING.md), and [provenance](docs/RESEARCH_PROVENANCE.md).
+
+[Migration from 1.2.2](MIGRATION_1_2_2.md) documents security corrections and
+termination-metadata changes. Historical 1.2.2 bytes remain immutable on PyPI.
+
+MIT license. Research and software by Rayan Pal / SwiftAPI Labs.

swiftapi_python-1.3.0/benchmarks/corpora.lock.json

@@ -0,0 +1,59 @@
+{
+  "HarmBench": {
+    "revision": "8e1604d1171fe8a48d8febecd22f600e462bdcdd",
+    "url": "https://raw.githubusercontent.com/centerforaisafety/HarmBench/8e1604d1171fe8a48d8febecd22f600e462bdcdd/data/behavior_datasets/harmbench_behaviors_text_all.csv",
+    "sha256": "8d81accedd38eaaf8b760618622bb888417d1fd0c86eba65c427a16f1cbb4afc",
+    "bytes": 198850,
+    "rows": 400,
+    "columns": [
+      "Behavior",
+      "FunctionalCategory",
+      "SemanticCategory",
+      "Tags",
+      "ContextString",
+      "BehaviorID"
+    ]
+  },
+  "StrongREJECT": {
+    "revision": "f7cad6c17e624e21d8df2278e918ae1dddb4cb56",
+    "url": "https://raw.githubusercontent.com/alexandrasouly/strongreject/f7cad6c17e624e21d8df2278e918ae1dddb4cb56/strongreject_dataset/strongreject_dataset.csv",
+    "sha256": "4dd70357e4ff8b5d0ba5ebafecab5d6dd5633ce8046e3dd1c8bd93e64de44381",
+    "bytes": 56359,
+    "rows": 313,
+    "columns": [
+      "category",
+      "source",
+      "forbidden_prompt"
+    ]
+  },
+  "JailbreakBench-benign-behaviors": {
+    "revision": "886acc352a31533ffbcf4ef22c744658688086fc",
+    "url": "https://huggingface.co/datasets/dedeswim/JBB-Behaviors/resolve/886acc352a31533ffbcf4ef22c744658688086fc/data/benign-behaviors.csv",
+    "sha256": "3cda234d21a991fa309bbfea4b6d9dae31ccdf8e9d452424b6a983e4fdc33468",
+    "bytes": 20570,
+    "rows": 100,
+    "columns": [
+      "Index",
+      "Goal",
+      "Target",
+      "Behavior",
+      "Category",
+      "Source"
+    ]
+  },
+  "JailbreakBench-harmful-behaviors": {
+    "revision": "886acc352a31533ffbcf4ef22c744658688086fc",
+    "url": "https://huggingface.co/datasets/dedeswim/JBB-Behaviors/resolve/886acc352a31533ffbcf4ef22c744658688086fc/data/harmful-behaviors.csv",
+    "sha256": "4a8ec6832056b631eb092dccc60d37a61c3d441268268888b3d006288afeffa1",
+    "bytes": 23116,
+    "rows": 100,
+    "columns": [
+      "Index",
+      "Goal",
+      "Target",
+      "Behavior",
+      "Category",
+      "Source"
+    ]
+  }
+}

swiftapi_python-1.3.0/benchmarks/sources.lock.json

@@ -0,0 +1,17 @@
+{
+  "JailbreakBench": {
+    "repository": "https://github.com/JailbreakBench/jailbreakbench",
+    "revision": "23dbdf6b19650521604456229bc1d9c4156c85c1",
+    "commit_url": "https://github.com/JailbreakBench/jailbreakbench/commit/23dbdf6b19650521604456229bc1d9c4156c85c1"
+  },
+  "HarmBench": {
+    "repository": "https://github.com/centerforaisafety/HarmBench",
+    "revision": "8e1604d1171fe8a48d8febecd22f600e462bdcdd",
+    "commit_url": "https://github.com/centerforaisafety/HarmBench/commit/8e1604d1171fe8a48d8febecd22f600e462bdcdd"
+  },
+  "StrongREJECT": {
+    "repository": "https://github.com/dsbowen/strong_reject",
+    "revision": "7a551d5b440ec7b75d4f6f5bb7c1719965b76b47",
+    "commit_url": "https://github.com/dsbowen/strong_reject/commit/7a551d5b440ec7b75d4f6f5bb7c1719965b76b47"
+  }
+}

swiftapi_python-1.3.0/docs/ACTION_ENVELOPES.md

@@ -0,0 +1,15 @@
+# Action envelopes
+
+ActionEnvelope contains capability, params, intent, and actor. Its SHA-256 digest
+covers all four fields. The v1 encoding is UTF-8 JSON with sorted string keys,
+compact separators, exact Unicode, booleans/null, lists, and integers within
+±(2^53−1). Floats, tuples, NaN/infinity, duplicate parsed keys, surrogate strings,
+nonstring object keys, excessive nesting, and envelopes over 2 MiB are rejected.
+This is an explicit JSON subset, not a general RFC 8785 implementation.
+
+A Decision binds action_hash, capability, state_hash, condition_hash, nonce,
+issued_at and expires_at. State is separately hashed. The trusted broker constructs
+both the action and the actual operation from the same detached snapshot. A
+changed target, content, actor, intent, capability, or state invalidates the grant.
+The legacy cloud fingerprint format remains unchanged for interoperability and
+is documented separately in MIGRATION_1_2_2.md.

swiftapi_python-1.3.0/docs/BENCHMARKING.md

@@ -0,0 +1,25 @@
+# Benchmarking
+
+`benchmarks/sources.lock.json` pins JailbreakBench, HarmBench, and StrongREJECT to
+exact upstream commits. `python scripts/fetch_benchmarks.py NEW_DIRECTORY` fetches
+those source trees without executing their code or copying corpora into the SDK.
+Framework licenses and dataset terms remain upstream. Before model evaluation,
+record the separately fetched corpus bytes and SHA-256, framework revision, provider
+configuration, raw responses, and independent executor observations.
+
+The adapter `swiftapi.brake.benchmarks.import_results` imports JSONL rows against an
+explicit complete case-ID list. Each row requires framework, revision, corpus hash,
+evidence hash, classification, authorized (boolean), and consequence_observed
+(boolean). Duplicate, omitted, or unexpected cases fail validation. All rows and
+failures remain in the report. Errors prevent PASS. Any observed consequence without
+authorization is an unauthorized consequential escape and makes the report FAIL.
+
+This is an evaluation integration surface, not a claim of benchmark performance.
+The release's local qualification uses inert fixtures; no paid model benchmark is
+silently substituted or run. A failed imported row can become a regression fixture.
+
+`benchmarks/corpora.lock.json` also pins the original upstream CSV bytes: 100 benign
+and 100 harmful JailbreakBench rows, 400 HarmBench text rows, and 313 StrongREJECT
+rows. `python scripts/fetch_corpora.py NEW_DIRECTORY` verifies all hashes before
+retaining bytes. `load_cases(framework, path, expected_sha256)` adapts those files
+without changing them. No model or judge was run as part of this corpus check.

swiftapi_python-1.3.0/docs/BYOK.md

@@ -0,0 +1,16 @@
+# Bring your own provider keys
+
+The default local brake performs no provider request and needs no provider keys.
+Codex or Claude Code retains its normal configuration and environment, including
+OPENAI_API_KEY or ANTHROPIC_API_KEY when those are used. The installer never copies
+keys into agent instructions, receipt payloads, or its MCP registration.
+
+LOCAL/BYOK: the agent connects directly to its provider; proposed consequences
+flow through the capability broker and local or explicitly configured authority.
+Existing OpenAI/Anthropic compatibility wrappers are optional: they send prompts
+and action metadata to the legacy authority, and provider credentials only to the
+provider. They are not the complete upstream SDK and do not support streaming.
+
+A future attested-provider route is a distinct opt-in deployment mode. This release
+does not force proxying or advertise that future service as deployed. Do not put
+secrets in action descriptions or arbitrary receipt metadata.

swiftapi_python-1.3.0/docs/CLAUDE_CODE.md

@@ -0,0 +1,18 @@
+# Claude Code integration
+
+Run `swiftapi brake install claude --dry-run` then `swiftapi brake install claude`.
+The user-level `mcpServers.swiftapi_brake` entry is merged into `~/.claude.json`.
+A delimited guidance block is appended to `~/.claude/CLAUDE.md`. Other servers and
+settings are preserved. Restart Claude Code and use ordinary prompts with the
+registered sandbox tools. Operator approval remains outside the MCP surface.
+
+`swiftapi brake --agent claude` offers a small input loop that passes the user's
+input to the existing Claude CLI. It does not add a second model or proxy provider
+keys. Existing host authentication and cost rules apply.
+
+Official [MCP](https://code.claude.com/docs/en/mcp),
+[hooks](https://code.claude.com/docs/en/hooks),
+[permissions](https://code.claude.com/docs/en/permissions), and
+[plugins](https://code.claude.com/docs/en/plugins) were inspected. This package uses
+the documented stdio MCP configuration and persistent instructions. It does not
+promise to intercept arbitrary Bash, computer-use, or third-party tool calls.

swiftapi_python-1.3.0/docs/CODEX.md

@@ -0,0 +1,28 @@
+# Codex integration
+
+Run `swiftapi brake install codex --dry-run`, inspect the proposed changes, then
+`swiftapi brake install codex`. The installer adds `mcp_servers.swiftapi_brake` to
+the user config and a delimited instruction block to `~/.codex/AGENTS.md`.
+It points at the installing interpreter (keep that environment installed), backs
+up changed files privately, and preserves unrelated configuration. A global
+AGENTS.override.md is reported because it would supersede the added guidance.
+
+Restart Codex. Ask normally to use Swift Brake's sandbox; it discovers status,
+propose_marker, execute, and read_marker. Approve a request in an operator terminal.
+`swiftapi doctor` reports static registration, not proof of a live model/tool call.
+`swiftapi brake uninstall codex` removes only unchanged owned entries.
+
+Official mechanisms checked for this release:
+[MCP](https://developers.openai.com/codex/mcp/),
+[AGENTS.md](https://developers.openai.com/codex/guides/agents-md/),
+[skills](https://developers.openai.com/codex/skills/),
+[hooks](https://developers.openai.com/codex/hooks/),
+[security](https://developers.openai.com/codex/security/).
+Hooks exist but require host trust and have incomplete tool coverage. This adapter
+uses MCP plus instructions and does not change hooks, permissions, or sandbox settings.
+
+An older separately installed Swift Brake prototype may gate even this server's
+read-only MCP calls. This installer preserves that gate. Coordinate exact test-call
+authorization with the operator rather than disabling it. `SWIFTAPI_CONFIG_HOME`
+selects an isolated configuration home for installer tests; ordinary installation
+uses the user's real home. Configuration presence is not runtime qualification.

swiftapi_python-1.3.0/docs/CONCEPTS.md

@@ -0,0 +1,17 @@
+# Concepts
+
+A binding condition is the prerequisite that must hold for valid continuation.
+Capability is what can be done; permission determines whether the particular
+consequence may occur. The software contract is prerequisite → verify → authorize
+→ consequence. A condition that cannot be verified permits no mediated consequence.
+
+`ActionEnvelope` freezes the exact capability, parameters, intent, and actor.
+`BindingCondition` binds its action hash and required state. `LocalAuthority`
+evaluates equality and signs a short-lived `Decision`. `LocalGuard` or a broker
+independently checks the signature and every binding before claiming the nonce.
+`DecisionReceipt` is the signed-envelope type; execution receipts use a separate
+schema to distinguish authorization from the subsequent effect.
+
+State and conditions originate in trusted application code. An agent writing
+"approved" in its prompt does not establish a real prerequisite. Model-native
+termination is an independent behavioral observation, never the authorization root.

swiftapi_python-1.3.0/docs/CONDITIONS.md

@@ -0,0 +1,15 @@
+# Conditions
+
+BindingCondition binds one action hash and a nonempty required-state JSON object.
+The implemented predicate is exact, type-sensitive canonical equality. For example,
+boolean true differs from integer 1. Extra, absent, or changed state fields deny.
+The condition name is also hashed; changing it invalidates previous authorization.
+
+The caller supplies trusted current state and the expected prerequisite. The local
+broker independently constructs state from its sandbox identity and target absence.
+Operator authorization is an explicit, separate method, never an MCP tool. This
+library is not a natural-language permission oracle and makes no extra LLM calls.
+
+The object takes a detached snapshot when created. Use `to_dict()` to inspect the
+canonical snapshot; modifying a supplied dictionary cannot change signed bytes.
+A valid condition does not obligate execution; it permits a specific decision.

swiftapi_python-1.3.0/docs/LOCAL_BRAKE.md

@@ -0,0 +1,17 @@
+# Local Brake
+
+The default home is `~/.local/share/swiftapi`. Override it with `SWIFTAPI_HOME`.
+It contains an owner-only Ed25519 key, published verification key, pending requests,
+one-use grants, SQLite replay ledger, execution receipts, and an owner-only sandbox.
+These are local files. Protect them from untrusted processes and preserve the ledger.
+
+The bundled `write_marker` capability creates an absent basename with exact UTF-8
+content (at most 4096 bytes). It does not overwrite, accept paths, run commands,
+or hold external service credentials. Sandbox device/inode and target absence
+are bound into state. Execution opens the directory and target with no-follow
+and exclusive creation flags. A race to create a target cannot overwrite it.
+
+The ledger consumes authorization before the first side effect. A crash can consume
+a grant without executing; an I/O failure may leave a partial file. There is no retry
+and no exactly-once-completion promise. Inspect ERROR outcomes before further action.
+`swiftapi brake uninstall` retains all authorization state and receipts.

swiftapi_python-1.3.0/docs/NATIVE_NONCONTINUATION.md

@@ -0,0 +1,17 @@
+# Native noncontinuation
+
+Keep model behavior separate from deterministic consequence enforcement.
+NATIVE_VOID requires exposed native token IDs with the actual EOS identity.
+PROVIDER_VOID denotes successful black-box zero-visible-byte output and preserves
+the published V0 (text container, normal stop), V1 (budget stop), V2 (absent text,
+normal stop), and VU (unmapped stop) distinctions. Provider stop is not native EOS.
+
+REFUSAL, VISIBLE_SAFE, GATE_BLOCK, AUTHORIZED_EXECUTION, and ERROR are distinct.
+Visible output requires an independent safety judgment before VISIBLE_SAFE is used.
+Transport failures, safety blocks, and tool-mediated events are not Void outcomes.
+Whitespace has bytes. Explicit refusals are not Void even if another field is empty.
+
+The observation helper accepts normalized evidence; callers must preserve and
+validate the original provider envelope and cannot infer absent fields as success.
+This release does not run native models or claim the generalization of PCCG-2.
+The frozen native causal evidence remains at getswiftapi.com/pccg-2.