weaver-kernel 0.3.0__tar.gz → 0.5.0__tar.gz

{weaver_kernel-0.3.0 → weaver_kernel-0.5.0}/.github/workflows/ci.yml

@@ -45,3 +45,32 @@ jobs:
           python examples/basic_cli.py
           python examples/billing_demo.py
           python examples/http_driver_demo.py
+
+  conformance_stub:
+    name: "Weaver Spec Conformance Stub (v0.1.0)"
+    runs-on: ubuntu-latest
+    needs: test
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      # Placeholder: activate once dgenio/weaver-spec#4 ships the conformance runner.
+      # weaver-spec and weaver-contracts are published on PyPI.
+      # weaver_contracts.conformance does not yet exist (dgenio/weaver-spec#4).
+      # Replace this step with:
+      #   pip install weaver-contracts          # PyPI dist name uses a hyphen
+      #   python -m weaver_contracts.conformance --target agent_kernel
+      - name: weaver-spec conformance suite (stub)
+        run: |
+          echo "weaver-contracts 0.2.0 is on PyPI; weaver_contracts.conformance runner not yet available (dgenio/weaver-spec#4)."
+          echo "Stub passes. Activate when dgenio/weaver-spec#4 ships."

weaver_kernel-0.5.0/.github/workflows/publish.yml

@@ -0,0 +1,74 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  ci:
+    name: "CI gate"
+    uses: ./.github/workflows/ci.yml
+
+  build:
+    name: "Build"
+    needs: ci
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Install build tools
+        run: pip install build
+
+      - name: Build sdist and wheel
+        run: python -m build
+
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        with:
+          name: dist
+          path: dist/
+
+  release:
+    name: "GitHub Release"
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write  # required to create releases
+    steps:
+      - name: Download dist artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        with:
+          name: dist
+          path: dist/
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b  # v2.5.0
+        with:
+          generate_release_notes: true
+          fail_on_unmatched_files: true
+          files: dist/*
+
+  publish:
+    name: "Publish to PyPI"
+    needs: release
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write  # required for Trusted Publisher (OIDC)
+    steps:
+      - name: Download dist artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0

{weaver_kernel-0.3.0 → weaver_kernel-0.5.0}/AGENTS.md

@@ -25,9 +25,12 @@ agent-kernel is part of the **Weaver ecosystem**:
 
 This repo must conform to weaver-spec invariants. Key invariants (all equally critical):
 - **I-01**: Every tool output must pass through a context boundary before reaching the LLM.
-- **I-02**: Context boundaries must enforce budgets (size, depth, field count).
+- **I-02**: Every execution must be authorized and auditable (preceded by a policy decision, followed by a trace event).
 - **I-06**: Tokens must bind principal + capability + constraints; no reuse across principals.
 
+Note: Budget enforcement (size, depth, field count) is an agent-kernel implementation
+constraint that satisfies I-01 — it is not a separate weaver-spec invariant number.
+
 Full spec: [dgenio/weaver-spec](https://github.com/dgenio/weaver-spec)
 
 ## Domain vocabulary

{weaver_kernel-0.3.0 → weaver_kernel-0.5.0}/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-04-12
+
+### Added
+- Built-in `MCPDriver` with stdio and Streamable HTTP transports, tool auto-discovery, normalized MCP result handling, and optional dependency guardrails.
+- Declared weaver-spec v0.1.0 compatibility in README: invariants I-01 (firewall), I-02 (authorization + audit), and I-06 (scoped tokens) are satisfied.
+- Added placeholder `conformance_stub` CI job that will activate once the weaver-spec conformance suite ships (dgenio/weaver-spec#4).
+
+## [0.4.0] - 2026-03-14
+
+### Added
+- Sliding-window rate limiting in `DefaultPolicyEngine` per `(principal_id, capability_id)` pair (#39).
+  Default limits by safety class: 60 READ / 10 WRITE / 2 DESTRUCTIVE per 60s window.
+  Service-role principals get 10× limits. Configurable via constructor.
+- GitHub Release step in publish workflow — creates a release with auto-generated notes and artifacts before publishing to PyPI.
+
+### Fixed
+- `HTTPDriver`: DELETE requests now forward args as query params instead of silently dropping them.
+
+### Removed
+- Dead `_truncate_str` helper in `firewall/transform.py` (defined but never called).
+
 ## [0.3.0] - 2026-03-09
 
 ### Added

{weaver_kernel-0.3.0 → weaver_kernel-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: weaver-kernel
-Version: 0.3.0
+Version: 0.5.0
 Summary: Capability-based security kernel for AI agents operating in large tool ecosystems
 Project-URL: Homepage, https://github.com/dgenio/agent-kernel
 Project-URL: Repository, https://github.com/dgenio/agent-kernel
@@ -223,13 +223,14 @@ Requires-Python: >=3.10
 Requires-Dist: httpx>=0.27
 Provides-Extra: dev
 Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: mcp>=1.6; extra == 'dev'
 Requires-Dist: mypy>=1.10; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
 Requires-Dist: pytest-cov>=5.0; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
 Requires-Dist: ruff>=0.4; extra == 'dev'
 Provides-Extra: mcp
-Requires-Dist: mcp>=1.0; extra == 'mcp'
+Requires-Dist: mcp>=1.6; extra == 'mcp'
 Provides-Extra: otel
 Requires-Dist: opentelemetry-api>=1.20; extra == 'otel'
 Description-Content-Type: text/markdown
@@ -346,6 +347,19 @@ asyncio.run(main())
 
 `agent-kernel` sits **above** `contextweaver` (context compilation) and **above** raw tool execution. It provides the authorization, execution, and audit layer.
 
+## Weaver Spec Compatibility: v0.1.0
+
+agent-kernel is a compliant implementation of [weaver-spec v0.1.0](https://github.com/dgenio/weaver-spec).
+The following invariants are satisfied:
+
+| Invariant | Description | How agent-kernel satisfies it |
+|-----------|-------------|-------------------------------|
+| **I-01** | LLM never sees raw tool output by default | `Context Firewall` always transforms `RawResult → Frame`; raw driver output is not returned by default, and non-admin principals cannot obtain `raw` response mode |
+| **I-02** | Every execution is authorized and auditable | `PolicyEngine` authorizes at grant time; a valid `CapabilityToken` (HMAC-verified on every `invoke()`) carries the authorization decision; `TraceStore` records every `ActionTrace` |
+| **I-06** | CapabilityTokens are scoped | Tokens bind `principal_id + capability_id + constraints` with an explicit TTL; `revoke(token_id)` / `revoke_all(principal_id)` are supported |
+
+See [docs/agent-context/invariants.md](docs/agent-context/invariants.md) for the full internal invariant list and [weaver-spec INVARIANTS.md](https://github.com/dgenio/weaver-spec/blob/main/docs/INVARIANTS.md) for the specification.
+
 ## Security disclaimers
 
 > **v0.1 is not production-hardened for real authentication.**

{weaver_kernel-0.3.0 → weaver_kernel-0.5.0}/README.md

@@ -110,6 +110,19 @@ asyncio.run(main())
 
 `agent-kernel` sits **above** `contextweaver` (context compilation) and **above** raw tool execution. It provides the authorization, execution, and audit layer.
 
+## Weaver Spec Compatibility: v0.1.0
+
+agent-kernel is a compliant implementation of [weaver-spec v0.1.0](https://github.com/dgenio/weaver-spec).
+The following invariants are satisfied:
+
+| Invariant | Description | How agent-kernel satisfies it |
+|-----------|-------------|-------------------------------|
+| **I-01** | LLM never sees raw tool output by default | `Context Firewall` always transforms `RawResult → Frame`; raw driver output is not returned by default, and non-admin principals cannot obtain `raw` response mode |
+| **I-02** | Every execution is authorized and auditable | `PolicyEngine` authorizes at grant time; a valid `CapabilityToken` (HMAC-verified on every `invoke()`) carries the authorization decision; `TraceStore` records every `ActionTrace` |
+| **I-06** | CapabilityTokens are scoped | Tokens bind `principal_id + capability_id + constraints` with an explicit TTL; `revoke(token_id)` / `revoke_all(principal_id)` are supported |
+
+See [docs/agent-context/invariants.md](docs/agent-context/invariants.md) for the full internal invariant list and [weaver-spec INVARIANTS.md](https://github.com/dgenio/weaver-spec/blob/main/docs/INVARIANTS.md) for the specification.
+
 ## Security disclaimers
 
 > **v0.1 is not production-hardened for real authentication.**

{weaver_kernel-0.3.0 → weaver_kernel-0.5.0}/RELEASE.md

@@ -16,7 +16,7 @@ Update the `version` field in `pyproject.toml`:
 
 ```toml
 [project]
-version = "0.3.0"
+version = "0.4.0"
 ```
 
 ### 2. Update the changelog
@@ -25,7 +25,7 @@ Add a new section to `CHANGELOG.md` under `## [Unreleased]`, then rename it
 to the new version with today's date:
 
 ```markdown
-## [0.3.0] - 2026-04-01
+## [0.4.0] - 2026-03-14
 
 ### Added
 - ...
@@ -42,8 +42,8 @@ to the new version with today's date:
 
 ```bash
 git add pyproject.toml CHANGELOG.md
-git commit -m "release: v0.3.0"
-git tag v0.3.0
+git commit -m "release: v0.4.0"
+git tag v0.4.0
 git push origin main --tags
 ```
 
@@ -53,7 +53,8 @@ Pushing the `v*` tag triggers `.github/workflows/publish.yml`, which:
 
 1. Runs the full CI suite (`make ci` equivalent) as a gate.
 2. Builds the sdist and wheel with `python -m build`.
-3. Publishes to PyPI using Trusted Publisher (OIDC — no API tokens stored).
+3. Creates a GitHub Release with auto-generated notes and the built artifacts attached.
+4. Publishes to PyPI using Trusted Publisher (OIDC — no API tokens stored).
 
 Monitor the workflow run at:
 <https://github.com/dgenio/agent-kernel/actions/workflows/publish.yml>

{weaver_kernel-0.3.0 → weaver_kernel-0.5.0}/docs/agent-context/invariants.md

@@ -11,9 +11,12 @@ All three are equally critical — there is no priority ordering.
 | Invariant | Requirement | Where enforced |
 |-----------|-------------|----------------|
 | **I-01** | Every tool output must pass through a context boundary before reaching the LLM | `Firewall.transform()` in `firewall/transform.py` |
-| **I-02** | Context boundaries must enforce budgets (size, depth, field count) | `Budgets` in `firewall/budgets.py` |
+| **I-02** | Every execution must be authorized and auditable (CapabilityToken validated before execution; TraceEvent recorded after) | `HMACTokenProvider.verify()` + `TraceStore.record()` in `kernel.py`; `PolicyEngine.evaluate()` at grant time in `grant_capability()` |
 | **I-06** | Tokens must bind principal + capability + constraints; no reuse across principals | `HMACTokenProvider.verify()` in `tokens.py` |
 
+> **Budget enforcement** (size, depth, field count via `Budgets` in `firewall/budgets.py`) is an
+> implementation constraint that strengthens I-01. It has no separate invariant number in weaver-spec.
+
 ## Forbidden shortcuts — "never do" list
 
 These constraints are non-negotiable. Violating any one silently degrades security.

weaver_kernel-0.5.0/docs/integrations.md

@@ -0,0 +1,130 @@
+# Integrations
+
+## MCP (Model Context Protocol)
+
+The built-in `MCPDriver` supports both local stdio servers and remote Streamable HTTP servers.
+
+Install the optional dependency first:
+
+```bash
+pip install "weaver-kernel[mcp]"
+```
+
+### Stdio transport
+
+```python
+import asyncio
+
+from agent_kernel import CapabilityRegistry, Kernel, StaticRouter
+from agent_kernel.drivers.mcp import MCPDriver
+
+
+async def main() -> None:
+    registry = CapabilityRegistry()
+    router = StaticRouter(fallback=[])
+    kernel = Kernel(registry=registry, router=router)
+
+    # Connect to a local MCP server process.
+    driver = MCPDriver.from_stdio(
+        command="python",
+        args=["-m", "my_mcp_server"],
+        server_name="local-tools",
+    )
+    kernel.register_driver(driver)
+
+    # Discover tools and register them as capabilities.
+    capabilities = await driver.discover(namespace="local")
+    registry.register_many(capabilities)
+
+    # Route each discovered capability to this MCP driver.
+    for capability in capabilities:
+        router.add_route(capability.capability_id, [driver.driver_id])
+
+
+asyncio.run(main())
+```
+
+### Streamable HTTP transport
+
+```python
+import asyncio
+
+from agent_kernel import CapabilityRegistry, Kernel, StaticRouter
+from agent_kernel.drivers.mcp import MCPDriver
+
+
+async def main() -> None:
+    registry = CapabilityRegistry()
+    router = StaticRouter(fallback=[])
+    kernel = Kernel(registry=registry, router=router)
+
+    # Connect to a remote Streamable HTTP MCP server.
+    # Note: max_retries > 0 creates at-least-once delivery semantics for
+    # tools/call — if a connection drops after the server processes the
+    # request but before the response arrives, the call will be repeated.
+    # Ensure target tools are idempotent, or set max_retries=0 for
+    # WRITE/DESTRUCTIVE capabilities.
+    driver = MCPDriver.from_http(
+        url="https://example.com/mcp",
+        server_name="remote-tools",
+        max_retries=1,
+    )
+    kernel.register_driver(driver)
+
+    # Discover tools and register them as capabilities.
+    capabilities = await driver.discover(namespace="remote")
+    registry.register_many(capabilities)
+
+    # Route each discovered capability to this MCP driver.
+    for capability in capabilities:
+        router.add_route(capability.capability_id, [driver.driver_id])
+
+
+asyncio.run(main())
+```
+
+### Notes
+
+- `discover()` converts `tools/list` results into `Capability` objects.
+- `execute()` calls `tools/call` and normalizes MCP content blocks for the firewall.
+- MCP `isError` responses raise `DriverError` with the server-provided detail.
+- If `mcp` is not installed, factory methods raise a helpful `ImportError`.
+
+## HTTPDriver
+
+The built-in `HTTPDriver` supports GET, POST, PUT, DELETE:
+
+```python
+from agent_kernel.drivers.http import HTTPDriver, HTTPEndpoint
+
+driver = HTTPDriver(driver_id="my_api")
+driver.register_endpoint("users.list", HTTPEndpoint(
+    url="https://api.example.com/users",
+    method="GET",
+    headers={"Authorization": "Bearer ..."},
+))
+kernel.register_driver(driver)
+```
+
+## Custom drivers
+
+Any object implementing the `Driver` protocol can be registered:
+
+```python
+class Driver(Protocol):
+    @property
+    def driver_id(self) -> str: ...
+    async def execute(self, ctx: ExecutionContext) -> RawResult: ...
+```
+
+## Capability mapping
+
+When mapping MCP tools to capabilities, prefer task-shaped names:
+
+| MCP tool | Capability ID | Safety class |
+|----------|--------------|--------------|
+| `list_files` | `fs.list_files` | READ |
+| `read_file` | `fs.read_file` | READ |
+| `write_file` | `fs.write_file` | WRITE |
+| `delete_file` | `fs.delete_file` | DESTRUCTIVE |
+| `execute_code` | `sandbox.run_code` | DESTRUCTIVE |

{weaver_kernel-0.3.0 → weaver_kernel-0.5.0}/docs/security.md

@@ -35,4 +35,8 @@ Consider an agent that obtains a token for `billing.list_invoices` then passes i
 - The `AGENT_KERNEL_SECRET` must be kept secret. Rotate it if compromised.
 - The default `InMemoryDriver` has no persistence — suitable for testing only.
 - PII redaction is heuristic (regex-based). It is not a substitute for proper data governance.
-- There is no rate limiting or quota enforcement in v0.1.
+- Rate limiting is enforced per `(principal_id, capability_id)` pair using a sliding window.
+  Default limits: 60 READ / 10 WRITE / 2 DESTRUCTIVE invocations per 60-second window.
+  Principals with the `"service"` role receive 10× the default limits. Limits are
+  configurable via `DefaultPolicyEngine(rate_limits=...)`. There is no distributed or
+  persistent rate-limit state — limits reset on process restart.

{weaver_kernel-0.3.0 → weaver_kernel-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "weaver-kernel"
-version = "0.3.0"
+version = "0.5.0"
 description = "Capability-based security kernel for AI agents operating in large tool ecosystems"
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -38,8 +38,9 @@ dev = [
     "ruff>=0.4",
     "mypy>=1.10",
     "httpx>=0.27",
+    "mcp>=1.6",
 ]
-mcp = ["mcp>=1.0"]
+mcp = ["mcp>=1.6"]
 otel = ["opentelemetry-api>=1.20"]
 
 [tool.hatch.build.targets.wheel]

{weaver_kernel-0.3.0 → weaver_kernel-0.5.0}/src/agent_kernel/__init__.py

@@ -37,6 +37,7 @@ Errors::
 
 from .drivers.base import Driver, ExecutionContext
 from .drivers.http import HTTPDriver
+from .drivers.mcp import MCPDriver
 from .drivers.memory import InMemoryDriver, make_billing_driver
 from .enums import SafetyClass, SensitivityTag
 from .errors import (
@@ -78,7 +79,7 @@ from .router import StaticRouter
 from .tokens import CapabilityToken, HMACTokenProvider
 from .trace import TraceStore
 
-__version__ = "0.1.0"
+__version__ = "0.4.0"
 
 __all__ = [
     # version
@@ -129,6 +130,7 @@ __all__ = [
     "ExecutionContext",
     "InMemoryDriver",
     "HTTPDriver",
+    "MCPDriver",
     "make_billing_driver",
     # firewall
     "Firewall",

{weaver_kernel-0.3.0 → weaver_kernel-0.5.0}/src/agent_kernel/drivers/__init__.py

@@ -2,6 +2,7 @@
 
 from .base import Driver, ExecutionContext
 from .http import HTTPDriver
+from .mcp import MCPDriver
 from .memory import InMemoryDriver
 
-__all__ = ["Driver", "ExecutionContext", "HTTPDriver", "InMemoryDriver"]
+__all__ = ["Driver", "ExecutionContext", "HTTPDriver", "MCPDriver", "InMemoryDriver"]

{weaver_kernel-0.3.0 → weaver_kernel-0.5.0}/src/agent_kernel/drivers/http.py

@@ -83,7 +83,7 @@ class HTTPDriver:
         params: dict[str, Any] = {}
         json_body: dict[str, Any] | None = None
 
-        if endpoint.method.upper() == "GET":
+        if endpoint.method.upper() in ("GET", "DELETE"):
             params = {k: v for k, v in ctx.args.items() if k != "operation"}
         else:
             json_body = {k: v for k, v in ctx.args.items() if k != "operation"}