ai-safe2-framework

No entries match these filters. Clear filters

1. CLI_v1.0.1 Oct 7, 2026 · issue 097

   AI SAFE² CLI v1.0.1 hardens MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. scoring, skill trust gating, and wrap-mode blocking with new rules TG-013 to TG-024.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch CLI_v1.0.1 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
   # already have the repo? check out this version:
   $ git checkout CLI_v1.0.1

   • Adds rules TG-013 to TG-024 to safe2 gate skill, rejecting hostile skills including paraphrased overrides, Unicode tags, homoglyphs, env exfiltration, persistence, and trigger hijack.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Extends safe2 scan mcp / safe2 gate mcp PATH to detect Python and TypeScript sinks previously missed, obfuscated execution, and evasion via file renaming (e.g. renaming a vulnerable file to test_server.py).
   • Updates safe2 score mcp / safe2 gate mcp URL so self-attestation (.well-known/mcp-security.json) and unvalidated OAuth metadata no longer contribute to the score; hostile schema content caps the score, withholds the badge, and causes safe2 gate mcp to exit 1.
   • Updates safe2 mcp wrap-stdio --block to withhold poisoned tool output rather than delivering it to the client.
   • Adds schema-pinning to safe2 mcp wrap-proxy --pin-schema to withhold a rug-pulled catalog when the tool schema changes unexpectedly.

   +2 more show less

   • Updates safe2 gate (project gate) so a CRITICAL finding caps the overall score, preventing a project using shell=True and eval() on LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. output from clearing Tier 2.
   • Publishes ai-safe2==1.0.1 to PyPI for the first time (1.0.0 shipped on GitHub only), installable via pip install 'ai-safe2[all]==1.0.1'.
   • Adds rules TG-013 to TG-024 to safe2 gate skill, rejecting hostile skills including paraphrased overrides, Unicode tags, homoglyphs, env exfiltration, persistence, and trigger hijack.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Publishes ai-safe2==1.0.1 to PyPI for the first time (1.0.0 shipped on GitHub only), installable via pip install 'ai-safe2[all]==1.0.1'.

   5 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !DEP findings now cite MCP-4 instead of MCP-3, matching the v3.1 control map — any automation that matches on the old finding ID will stop matching.
   • !Scores and gate results from 1.0.0 or 0.9.x are no longer reliable; gates must be re-run to get valid results under 1.0.1 scoring logic.
2. 2026-10-5_CLI_1.0.0 Oct 5, 2026 · issue 095

   AI SAFE² CLI 1.0.0 debuts a local-first evidence and decision-support layer for agent systems with 10 new commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026-10-5_CLI_1.0.0 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
   # already have the repo? check out this version:
   $ git checkout 2026-10-5_CLI_1.0.0

   • Adds safe2 assess command to create a sealed project assessment bundle containing canonical JSON, an evidence manifest, and a human-readable Decision Card.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds safe2 doctor command to inventory multi-harness environments — including WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. distributions and explicit SSH targets — and expose missing or partial coverage.
   • Adds safe2 gate skill command to statically screen a skill before installation or use without executing it.
   • Adds safe2 evidence system command to record the complete agent system identity (model, harness, tools, skills, memory, environment, policy, evaluator, authority) behind an assessment.
   • Adds safe2 evidence claims command to compare explicit agent claims against receipts, disclosures, conflicts, and missing evidence.

   +10 more show less

   • Adds safe2 evidence truth command to correlate attributed evidence across multiple harnesses while preserving coverage gaps.
   • Adds safe2 evidence diagnose command to rank evidence-backed investigation paths without asserting a verified root cause.
   • Adds safe2 aism plan command to convert confirmed AISM findings into a reviewable remediation plan without granting execution authority.
   • Adds safe2 challenge command to run or import bounded Challenge Lab evidence while preserving provider verdicts, provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., and disagreements.
   • Adds safe2 acceptance command to create and replay an offline first-user acceptance bundle.
   • Adds safe2 self-check --strict for installation self-verification and safe2 init . --profile local for bounded project initialization.
   • Adds --scan-content and --inspect-config flags to safe2 assess for explicit opt-in to content and configuration inspection.
   • Includes Codex JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. and OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. reference translators, plus attributed NVIDIA SkillSpector and NEXUS evidence intake.
   • Delivers provider-neutral adapter and evidence contracts that bind attributed evidence across agents and scanners without conflating source confidence levels.
   • Introduces four result states — Evidence-consistent, Contradicted, Unverifiable, and Limited — as the canonical vocabulary for all command outputs.

   15 details in Everything

3. nexus-v0.5.0 Oct 4, 2026 · issue 095

   NEXUS v0.5.0 debuts the Sovereign Payment Gateway — a deterministic, fail-closed security boundary for AI agents that can initiate or influence payments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch nexus-v0.5.0 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
   # already have the repo? check out this version:
   $ git checkout nexus-v0.5.0

   • Adds the nexus-a2a-sdk==0.5.0 Python package (import nexus_sdk) delivering the Sovereign Payment Gateway — a monotonic, fail-closed transaction lifecycle that prevents AI agents from self-granting authority, accessing unrestricted payment keys, or overriding deterministic controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds the Key Guardian component, which isolates signing authority from the agent and signs only approved canonical transactions.
   • Adds the Policy Authority component for independent deterministic evaluation of payment policy.
   • Adds the Runtime Verifier component, which confirms the executing workload matches an approved, sufficiently fresh measurement before value is allowed to move.
   • Adds the Human Intent Authority component, binding approval to actual transaction constraints and trusted rendering rather than agent-generated descriptions.

   +9 more show less

   • Adds the Settlement Truth Authority component, which obtains payment outcomes from authoritative external sources instead of trusting the agent.
   • Adds the Gateway State Vault for durable storage of authority, exposure, replay, revocation, reservation, and settlement state.
   • Adds the Policy Parity Guard, which detects divergence between policy implementations before activation.
   • Adds the Sovereign Payment Coordinator, composing all controls into an ordered, fail-closed execution path.
   • Adds Governed Recovery to handle ambiguous settlement without unsafe retries or premature restoration of spending capacity.
   • Adds Sandbox Rail Readiness enforcement to prevent unverified payment integrations from being promoted into active use.
   • Adds Deployment Proof and Readiness, producing a signed, independently verifiable activation decision.
   • Adds an llms.txtllms.txtA proposed convention for a plain-text file placed at a website's root to give LLMs a concise, structured summary of the site's content, helping AI agents navigate it more reliably than parsing raw HTML. retrieval index and a versioned machine-readable documentation manifest under the canonical /NEXUS directory for agent-consumable documentation discovery.
   • Counters prompt-injectionprompt-injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools.-driven purchases, replay and duplicate-payment attacks, authority escalation by child agents, spending split across agents to evade limits, protocol and checkout downgrades, and revocation races as named threat categories in the included payment threat model.

   14 details in Everything

4. 2026-10-02_AISM_Scoring_Update Oct 2, 2026 · issue 093

   AI SAFE² adds Technology Contribution Profile v1.0, Evidence Assurance v1.0, and a reusable Technology Card for scoped AI control reviews.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026-10-02_AISM_Scoring_Update https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
   # already have the repo? check out this version:
   $ git checkout 2026-10-02_AISM_Scoring_Update

   • Introduces AISM Technology Contribution Profile v1.0 to structure review of what an artifact addresses, implements, enforces, validates, evidences, or challenges within a stated boundary.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces AI SAFE² Evidence Assurance v1.0 to attribute evidence strength, origin, independence, and limitations to each individual claim.
   • Adds a reusable Technology Card template capturing version, scope, controls, mechanisms, evidence, failure behavior, retained authority, and adoption conditions.
   • Adds validation and incident guidance documents covering clean/attacked pairs, side-effect and bypass tests, policy-integrity checks, reconstruction, and notification ownership.
   • Adds nine source-attributed review candidates to frame scoped acceptance work without adopting unsupported scores.

   +2 more show less

   • Clarifies the existing AISM Sovereignty Score to explicitly keep organizational maturity separate from technology contribution and claim-level evidence assurance.
   • Adopts the name AI Sovereign Maturity (AISM) Model and adds dated AISM change summaries with repository-wide navigation connecting methods to pillars, implementation guidance, research, Challenge Lab, and agent discovery.
   • Introduces AISM Technology Contribution Profile v1.0 to structure review of what an artifact addresses, implements, enforces, validates, evidences, or challenges within a stated boundary.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces AI SAFE² Evidence Assurance v1.0 to attribute evidence strength, origin, independence, and limitations to each individual claim.
   • Adds a reusable Technology Card template capturing version, scope, controls, mechanisms, evidence, failure behavior, retained authority, and adoption conditions.
   • Adds validation and incident guidance documents covering clean/attacked pairs, side-effect and bypass tests, policy-integrity checks, reconstruction, and notification ownership.
   • Adds nine source-attributed review candidates to frame scoped acceptance work without adopting unsupported scores.

   2 more in Everything

5. 2026-09-27_CLI_0.9.0 Sep 27, 2026 · issue 088

   AI SAFE² CLI 0.9.0 adds controlled Challenge 001 execution with pre-registration, independent grading, and sealed evidence receipts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026-09-27_CLI_0.9.0 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
   # already have the repo? check out this version:
   $ git checkout 2026-09-27_CLI_0.9.0

   • Adds safe2 challenge plan command to pre-register the evaluator, provider, treatment, execution limits, command-file identities, and optional system identity before any process runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds safe2 challenge execute command to run the six frozen Challenge 001 scenarios as separate bounded process calls after explicit operator authorization via --authorize-process-execution.
   • Adds safe2 challenge verify-execution command to recheck the plan, source, normalized run, receipt, command-file digests, and optional identity binding without re-running the evaluator.
   • Adds safe2.challenge-execution-plan.v1 schema providing a strict, machine-readable pre-registration contract binding the executable, file arguments, provider declaration, treatment, and limits.
   • Adds safe2.challenge-execution-receipt.v1 schema providing a sealed record of cross-artifact and per-episode evidence bindings, including before-and-after SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. digests for the executable and file arguments.

   +4 more show less

   • Adds evidence-manifest support so plans and execution receipts can enter the existing AI SAFE² evidence inventory via safe2 evidence manifest.
   • Adds a packaged controlled-executor example verifiable with safe2 example verify challenge-controlled-executor that demonstrates planning, execution, verification, reporting, and evidence-manifest intake.
   • Surfaces incomplete and conflict episode states so invalid JSON, nonzero exits, timeouts, output limits, and contradicting evidence observations become explicitly visible rather than silently discarded.
   • Enforces direct-child execution time limits and combined stdout/stderr byte limits, reduced child-process environment variables, no-overwrite artifact creation, and exact regular-file resolution with symlink dereferencing before hashing.

   9 details in Everything

6. 2026-09-24_CLI_0.8.0 Sep 24, 2026 · issue 085

   AI SAFE² CLI 0.8.0 adds evidence-bound AISM remediation planning with human decision gates and machine-readable output contracts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026-09-24_CLI_0.8.0 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
   # already have the repo? check out this version:
   $ git checkout 2026-09-24_CLI_0.8.0

   • Adds safe2 aism remediation-init command to create a remediation source template bound to the exact assessment, system identity, and assessment scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds safe2 aism plan command to validate a proposed implementation path and produce canonical JSON (aism-remediation-plan-v1) plus a human-readable decision card.
   • Adds --previous flag to safe2 aism plan to preserve action history across reassessments and detect completed actions that regress or disappear.
   • Adds --strict flag to safe2 aism plan to return a failing exit code unless the plan reaches the ready_for_human_decision gate.
   • Introduces aism-remediation-source-v1 as the versioned input contract defining actions, evidence, assumptions, alternatives, ownership, and accepted risk.

   +5 more show less

   • Introduces aism-remediation-plan-v1 as the strict machine-readable output contract for integrations, agents, CI pipelines, and governance systems.
   • Adds a three-state human decision gate (hold, review, ready_for_human_decision) to every produced remediation plan, with remediation_authorized and conformance_claim fixed to false.
   • Adds cycle detection and required dependency ordering for remediation action graphs.
   • Adds calendar-date validation for residual-risk reviews within remediation plans.
   • Adds safe paired-output handling that removes a partial plan if decision-card creation fails.

   10 details in Everything

7. 2026-09-23_NEXUS_v0.4-Safer_Payment_Authority_for_Agents Sep 23, 2026 · issue 084

   NEXUS v0.4 adds eight named payment authority adapter profiles for AI agents, covering x402x402A proposed HTTP payment protocol revival using status code 402, enabling machine-to-machine micropayments over HTTP so cyber tools can gate API access or resources behind automated, per-request cryptocurrency payments., AP2, Visa TAP, Mastercard AP4M, and KYA-OS delegation evidence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026-09-23_NEXUS_v0.4-Safer_Payment_Authority_for_Agents https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
   # already have the repo? check out this version:
   $ git checkout 2026-09-23_NEXUS_v0.4-Safer_Payment_Authority_for_Agents

   • Adds SafePay Exact reference profile for structural x402 v2 exact EVM/USDC evaluation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds SafePay Verified reference profile for authenticated x402 facilitator or chain evidence with an explicit verifier boundary.
   • Adds SafePay Variable reference profile for maximum-versus-actual charge enforcement and reservation release.
   • Adds SafePay Escrow reference profile for deposit, release, refund, and mediated-finality state handling.
   • Adds Mandate Bridge reference profile for AP2 v0.2 mandate and receipt evidence.

   +6 more show less

   • Adds Card Trust Bridge reference profile for Visa TAP request recognition without overstating payment authorization.
   • Adds Agent Token Bridge reference profile for authenticated Mastercard AP4M verifier evidence.
   • Adds Portable Delegation Bridge reference profile for KYA-OS identity and delegated-authority evidence.
   • Introduces three deterministic assessment outcomes — Supported, Contradicted, and Unverifiable — giving agents stable machine-readable authority decisions instead of permission inferred from prose.
   • Provides explicit allowlists, assurance ceilings, and fail-closed results across all eight adapter profiles.
   • Includes an adversarial test corpus covering substitution attacks, malformed evidence, truthy-value bypasses, replay behavior, scope mapping, privacy checks, and RailGuard conformance.

   11 details in Everything

8. 2026_09_20_CLI_0.7.0 Sep 21, 2026 · issue 081

   AI SAFE² CLI 0.7.0 adds safe2 evidence truth and safe2 evidence changes to correlate multi-harness agent evidence and detect configuration drift.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026_09_20_CLI_0.7.0 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
   # already have the repo? check out this version:
   $ git checkout 2026_09_20_CLI_0.7.0

   • Adds safe2 evidence truth command to correlate harness evidence, revision-bound task receipts, coverage, usage declarations, and completion claims across multiple agent harnessesagent harnessesThe software around an AI agent that manages its tools, execution loop, state and limits. It determines how the model's proposed actions are run and checked..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds safe2 evidence changes command to run a bounded one-shot inventory of skills and recognized agent configuration locally or in CI, detecting additions, modifications, and removals.
   • Adds --baseline, --output, --strict, and --card flags to safe2 evidence subcommands for controlling baseline comparison, artifact output paths, strict-mode enforcement, and human-readable decision card generation.
   • Introduces operational-truth-source-v1 contract schema to declare the task, revision, required evidence, receipt bindings, decision owner, assumptions, and exclusions.
   • Introduces operational-truth-manifest-v1 contract schema to record the correlated result, decision gate (hold, review, ready_for_human_decision), conflicts, gaps, and evidence boundaries.

   +5 more show less

   • Introduces change-monitor-v1 contract schema to record bounded agent-input inventory and change results without exporting configuration contents.
   • Recognizes skill packages rooted by SKILL.md, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. configuration, OpenClaw configuration, and supported configuration beneath .codex, .claude, .hermes, and .openclaw during change monitoring.
   • Generates a human decision card (--card) alongside canonical JSON output from the same evaluated evidence record.
   • Enforces bounded traversal of up to 10,000 entries and 1 MB per tracked file by default during change monitoring.
   • Adds strict evidence-contract protections including duplicate-key rejection, non-finite-number rejection, symbolic-link and reparse-point guards, no-overwrite behavior, and exclusive complete-before-visible evidence publication.

   10 details in Everything

9. 2026-09-17_CLI_0.6.0_Scope_Attribute_Decide Sep 17, 2026 · issue 078

   AI SAFE² CLI 0.6.0 adds safe2 evidence scope, attribute, and readiness commands for scoped assessment, change attribution, and release-readiness cards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026-09-17_CLI_0.6.0_Scope_Attribute_Decide https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
   # already have the repo? check out this version:
   $ git checkout 2026-09-17_CLI_0.6.0_Scope_Attribute_Decide

   • Adds safe2 evidence scope command to inventory the declared deployment relationship of repository or built-artifact paths, classifying each as included, excluded, partial, not applicable, or unknown.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds safe2 evidence attribute command to compare normalized findings across an explicitly trusted baseline and current revision, separating inherited, introduced, changed, resolved, and unknown findings.
   • Adds safe2 evidence readiness command to produce canonical release-readiness JSON and an escaped Markdown card, accepting --system-identity, --assessment-scope, --change-attribution, --output, --card, and --strict options.
   • Adds three new schema contracts — assessment-scope-source-v1, change-attribution-source-v1, and release-readiness-source-v1 — exportable via safe2 schema export.
   • Introduces release_authorized: false as a permanent field in every readiness output, enforcing that no automated result can be mistaken for release permission.

   +1 more show less

   • Hardens JUnit XMLJUnit XMLA widely adopted test-report file format, originally from the Java JUnit framework, that records test suite results as XML; cyber tools emit it so their output plugs into CI systems like Jenkins or GitLab without custom parsers. intake with defusedxml, rejecting DTD/entity input while retaining size, encoding, structure, and declared-total checks.
   • Adds safe2 evidence scope command to inventory the declared deployment relationship of repository or built-artifact paths, classifying each as included, excluded, partial, not applicable, or unknown.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds safe2 evidence attribute command to compare normalized findings across an explicitly trusted baseline and current revision, separating inherited, introduced, changed, resolved, and unknown findings.
   • Adds safe2 evidence readiness command to produce canonical release-readiness JSON and an escaped Markdown card, accepting --system-identity, --assessment-scope, --change-attribution, --output, --card, and --strict options.
   • Adds three new schema contracts — assessment-scope-source-v1, change-attribution-source-v1, and release-readiness-source-v1 — exportable via safe2 schema export.
   • Introduces release_authorized: false as a permanent field in every readiness output, enforcing that no automated result can be mistaken for release permission.

   1 more in Everything

10. 2026-09-15_CLI_0.5.0_Find_Where_Agent_Work_Failed Sep 15, 2026 · issue 076

    AI SAFE² CLI 0.5.0 adds safe2 evidence diagnose and two strict JSON contracts for evidence-bounded AI agent failure localization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-09-15_CLI_0.5.0_Find_Where_Agent_Work_Failed https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-09-15_CLI_0.5.0_Find_Where_Agent_Work_Failed

    • Adds safe2 evidence diagnose command to rank evidence-supported failure locations across an identified agent system, with --system-identity, --output, --card, and --strict flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces safe2.failure-source.v1 JSON contract as a provider-neutral schema for supplying observations and competing failure candidates to the diagnostic engine.
    • Introduces safe2.failure-diagnosis.v1 JSON contract returning deterministic rankings, evidence assessments, ownership, and recommended actions from a diagnosis run.
    • Adds strict diagnostic mode via --strict flag that returns a nonzero exit code when evidence cannot support one strong or moderate leading candidate.
    • Adds --card flag to safe2 evidence diagnose to emit a Failure Localization Card as a human-readable Markdown decision document alongside the JSON diagnosis.

    +5 more show less

    • Adds scanner workspace exclusions to avoid traversing generated AI SAFE² evidence directories, named virtual environments, and uv caches during repository scans.
    • Introduces a portable agent delivery workflow that guides agents through isolation, building, proof, self-assessment, independent review, and shipping with receipts.
    • Adds five evidence classification levels — Strong, Moderate, Limited, Insufficient, and Contradicted — to every diagnosis output.
    • Binds every diagnosis to a complete AI SAFE² system identity manifest, preserving harness, tool, policy, memory, and evaluator identity in results.
    • Diagnostic contracts are compatible with Codex, Claude Code, Hermes, OpenClaw, and CI systems without designating any single provider as the source of truth.

    10 details in Everything

11. 2026-09-14_CLI_0.4.0_Know_What_You_Actually_Tested Sep 14, 2026 · issue 075

    AI SAFE² CLI 0.4.0 introduces a portable agent system identity manifest with new safe2 evidence system and safe2 schema export commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-09-14_CLI_0.4.0_Know_What_You_Actually_Tested https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-09-14_CLI_0.4.0_Know_What_You_Actually_Tested

    • Adds safe2 evidence system SOURCE --output FILE command to normalize an attributed agent-system identity declaration into a portable manifest.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --strict flag to safe2 evidence system and safe2 evidence manifest to exit with status 1 when identity gaps, unknown evidence bases, missing versions, or disconnected components are detected.
    • Adds safe2 schema export system-identity-source-v1 command to export the provider-neutral input contract for agent system identity.
    • Adds safe2 schema export system-identity-manifest-v1 command to export the normalized output contract for agent system identity.
    • Adds safe2 evidence manifest FILE --subject-id ID --output FILE command to bind a system identity manifest into a wider hashed evidence run.

    +7 more show less

    • Introduces eight component categories (model, harness, tools, skills, memory, environment, policy, evaluator) for complete agent system identification in a single strict manifest.
    • Introduces a system relationship graph recording use, execution, policy, evaluation, memory, and delegation relationships between agent components.
    • Introduces an authority inventory supporting read, write, execute, network, delegate, approve, admin, or unknown authority classes per component.
    • Introduces dual hashing: source.sha256 binds exact submitted bytes while system_fingerprint_sha256 fingerprints normalized system composition independently of key order, list order, and formatting.
    • Adds coverage recommendations that surface remaining version, attribution, inventory, and topology gaps in the agent system declaration.
    • Adds four coverage statuses — complete, partial, missing, and not-applicable — to distinguish different kinds of inventory gaps.
    • Adds three evidence-basis labels — observed, declared, and unknown — to distinguish independently observed evidence from declarations and unknowns.

    12 details in Everything

12. 2026-09-14_CLI_0.3.0_Provider_Neutral_Harness_Evidence_Intake Sep 14, 2026 · issue 075

    ai-safe2-framework: Adds safe2 evidence harness SOURCE --output FILE to validate and normalize a provider-neutral harness export into a structured AI SAFE² evidence result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-09-14_CLI_0.3.0_Provider_Neutral_Harness_Evidence_Intake https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-09-14_CLI_0.3.0_Provider_Neutral_Harness_Evidence_Intake

    • Introduces a seven-domain coverage inventory assessing task lifecycle, tool calls, artifacts, tests, usage, environment state, and completion claims.
    • Adds SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. source-byte binding that records the digest and size of the exact harness export that was processed.
    • Adds evidence attribution that preserves the producer, export identifier, source references, and collection basis across intake.
    • Introduces loss-aware recommendations that surface which evidence areas remain partial or missing rather than silently treating gaps as success.
    • Establishes a stable provider-neutral integration seam targeting Codex, Claude Code, Hermes, OpenClaw, and other agent harnessesagent harnessesThe software around an AI agent that manages its tools, execution loop, state and limits. It determines how the model's proposed actions are run and checked..

    5 details in Everything

13. 2026-09-11_safe2_CLI_0.3.0 Sep 11, 2026 · issue 072

    SAFE2 CLI 0.3.0 adds eight new subcommands for capturing, verifying, and signing task evidence from AI agent runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-09-11_safe2_CLI_0.3.0 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-09-11_safe2_CLI_0.3.0

    • Adds safe2 feedback receipt to produce JSON or Markdown evidence receipts for AI agent task claims, with --artifact-root, --format, and --output options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds safe2 feedback capture-pytest to run selected tests and capture fresh evidence, recording the observed exit code and test results separately from process success.
    • Adds safe2 feedback verify-pytest to recheck a saved pytest capture offline, recomputing hashes and test assessments without re-executing tests.
    • Adds safe2 feedback sign-report to create a detached signature authenticating test/tool report bytes against an operator-trusted key.
    • Adds safe2 feedback verify-report to check a detached signature against a supplied trusted key.

    +3 more show less

    • Adds safe2 feedback import-junit to normalize supported JUnit XMLJUnit XMLA widely adopted test-report file format, originally from the Java JUnit framework, that records test suite results as XML; cyber tools emit it so their output plugs into CI systems like Jenkins or GitLab without custom parsers. reports into the SAFE2 evidence format.
    • Adds safe2 feedback usage to correlate declared per-task resource use, separating reported, estimated, and unknown values.
    • Exposes seven versioned JSON contracts to support automation of evidence receipts and test/tool report workflows.

    8 details in Everything

14. 2026-09-09_safe2_CLI_0.2.0 Sep 10, 2026 · issue 070

    safe2 CLI 0.2.0 adds offline Challenge evidence bundles, hardened skill gate scanning, and a --executable flag for the SkillSpector adapter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-09-09_safe2_CLI_0.2.0 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-09-09_safe2_CLI_0.2.0

    • Adds safe2 challenge quickstart 001 --output-dir <dir> to generate an offline Challenge 001 evidence bundle with a Decision Card, requiring no model credentials or paid APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds safe2 challenge verify-bundle <dir> to verify an evidence bundle's internal consistency, rejecting missing or changed artifacts, unsupported versions, and inconsistent results.
    • Adds --expected-sha256 flag to safe2 challenge verify-bundle to pin a complete bundle against a trusted manifest fingerprint obtained out-of-band.
    • Adds --executable flag to the SkillSpector adapter for running the provider in a separate environment.
    • Extends the Skill Trust Gate to inspect scripts, extensionless files, and text with unfamiliar extensions — not just files with recognized extensions — covering injection directives, credential paths, and dynamic execution patterns.

    +1 more show less

    • Extends release CI coverage to Python 3.11 through 3.14.
    • Adds safe2 challenge quickstart 001 --output-dir <dir> to generate an offline Challenge 001 evidence bundle with a Decision Card, requiring no model credentials or paid APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds safe2 challenge verify-bundle <dir> to verify an evidence bundle's internal consistency, rejecting missing or changed artifacts, unsupported versions, and inconsistent results.
    • Adds --expected-sha256 flag to safe2 challenge verify-bundle to pin a complete bundle against a trusted manifest fingerprint obtained out-of-band.

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The retired standalone skill-gate script now exits with an error; replace it with safe2 gate skill PATH --strict.
    • !AISM ingestion now rejects ambiguous JSON, unsafe paths, invalid Challenge runs, and existing output files — use a new output filename on each run.
15. 2026-05-09_safe2_CLI_Update Sep 6, 2026 · issue 066

    safe2 CLI gains multi-harness discovery, drift tracking, environment policy enforcement, and Decision Cards via safe2 doctor and expanded subcommands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-05-09_safe2_CLI_Update https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-05-09_safe2_CLI_Update

    • Adds safe2 doctor command for multi-harness discovery, identifying command and configuration indicators for Codex, Claude Code, Antigravity, Hermes, OpenClaw, and Grok alongside host, shell, CI, and WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. metadata.
    • Adds --assess, --output, --card-format, and --card-output options to safe2 doctor to evaluate environment posture and emit Markdown or HTML Decision Cards.
    • Adds --inspect-config opt-in to safe2 doctor to collect an allowlisted structural summary of supported local JSON/TOML configurations, including selected approval and sandbox settings, without emitting raw configuration values.
    • Adds environment policy enforcement with ALLOW, DENY, and HOLD outcomes producing exit codes 0, 1, and 2 for use in agent and CI pipelines.
    • Adds safe2 schema list, safe2 schema validate, and safe2 evidence manifest subcommands for versioned schema discovery, evidence validation, and run manifest assembly with digests, source contracts, integrity status, and coverage.

    +6 more show less

    • Adds safe2 feedback record and safe2 feedback summary subcommands to capture sanitized operational feedback including false completion, missing evidence, silent failures, context loss, stuck loops, permission friction, and integration failures.
    • Adds safe2 example verify subcommand to reproduce a baseline-to-drift-to-policy workflow with evidence, Decision Cards, feedback, and manifest validation.
    • Adds explicit WSL distribution and SSH-accessible Linux host or cloud VM targeting to environment assessment, with incomplete or unreachable targets surfaced as coverage gaps.
    • Adds reviewed baseline and drift comparison across assets, harness indicators, configuration hashes, target coverage, and assessment scope against an earlier inventory.
    • Adds dedicated evidence contracts safe2.nexus-evidence.v1 and safe2.skillspector-evidence.v1 for NEXUS and SkillSpector adapters.
    • Adds environment Decision Cards in Markdown and HTML formats containing facts, assumptions, conflicts, history, impacts, alternatives, pros and cons, recommendations, ownership gaps, and exit criteria.
    • Adds safe2 doctor command for multi-harness discovery, identifying command and configuration indicators for Codex, Claude Code, Antigravity, Hermes, OpenClaw, and Grok alongside host, shell, CI, and WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. metadata.
    • Adds --assess, --output, --card-format, and --card-output options to safe2 doctor to evaluate environment posture and emit Markdown or HTML Decision Cards.
    • Adds --inspect-config opt-in to safe2 doctor to collect an allowlisted structural summary of supported local JSON/TOML configurations, including selected approval and sandbox settings, without emitting raw configuration values.
    • Adds environment policy enforcement with ALLOW, DENY, and HOLD outcomes producing exit codes 0, 1, and 2 for use in agent and CI pipelines.
    • Adds safe2 schema list, safe2 schema validate, and safe2 evidence manifest subcommands for versioned schema discovery, evidence validation, and run manifest assembly with digests, source contracts, integrity status, and coverage.

    +5 more show less

    • Adds safe2 feedback record and safe2 feedback summary subcommands to capture sanitized operational feedback including false completion, missing evidence, silent failures, context loss, stuck loops, permission friction, and integration failures.
    • Adds safe2 example verify subcommand to reproduce a baseline-to-drift-to-policy workflow with evidence, Decision Cards, feedback, and manifest validation.
    • Adds explicit WSL distribution and SSH-accessible Linux host or cloud VM targeting to environment assessment, with incomplete or unreachable targets surfaced as coverage gaps.
    • Adds reviewed baseline and drift comparison across assets, harness indicators, configuration hashes, target coverage, and assessment scope against an earlier inventory.
    • Adds environment Decision Cards in Markdown and HTML formats containing facts, assumptions, conflicts, history, impacts, alternatives, pros and cons, recommendations, ownership gaps, and exit criteria.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !NEXUS and SkillSpector provider bundles generated before this release must be regenerated to be compatible with the new safe2.nexus-evidence.v1 and safe2.skillspector-evidence.v1 contracts required by safe2 evidence manifest.
16. 2026-09-04_Agent_CLI_AISM_Decision_Support_and_UAS Sep 4, 2026 · issue 065

    AI SAFE² v3.1 adds a unified safe2 CLI, AISM Decision Cards, NEXUS and SkillSpector evidence integrations, and a 27-requirement UAS regulatory profile.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-09-04_Agent_CLI_AISM_Decision_Support_and_UAS https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-09-04_Agent_CLI_AISM_Decision_Support_and_UAS

    • Adds the safe2 CLI with subcommands including safe2 scan project and safe2 example verify for scanning AI implementations, evaluating evidence, and validating packaged examples in CI/CD and automated agent workflows.
    • Adds AISM Decision Cards that transform technical assessment findings into structured decision-quality summaries covering scores, evidence quality, conflicts, alternatives, pros/cons, and recommended paths forward.
    • Adds NEXUS integration so NEXUS findings can be incorporated as structured evidence within AI SAFE² assessments, connecting implementation observations to governance and assurance requirements.
    • Adds NVIDIA SkillSpector as an evidence source for assessing agent skills and implementation risks, with source attribution and evidence context retained.
    • Adds the Unbiased AI Standard (UAS) as a 27-requirement regulatory profile extension (14 system, 8 human, 5 bridge requirements) without altering the core 161-control structure or creating CP.11.

    5 details in Everything

17. v3.1 Aug 29, 2026 · issue 059

    AI SAFE2 v3.1 adds 6 MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. controls, three enforcement planes, a protocol-independent persistence vocabulary, 12 new scanner rules, and a machine-readable manifest entry point.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout v3.1

    • Adds ai-safe2.manifest.json at the repository root as a deterministic machine entry point exposing framework version, component versions, normative paths, control counts, enforcement planes, persistence vocabulary, conformance boundaries, and machine-readable datasets — so agents and compliance bots no longer need to infer structure from prose.
    • Adds skills/mcp/data/mcp-profile-v3.1.json as a machine-readable profile of the 19-control CP.5.MCP security profile for agent and automated-consumer use.
    • Adds skills/mcp/data/ai-safe2-controls-v3.0.json as the machine-readable 161-control core dataset.
    • Adds AGENTS.md as the canonical first-class entry point for automated consumers integrating with the framework.
    • Adds six new MCP controls — MCP-14 (Extension Capability Negotiation), MCP-15 (Header and Body Assertion Integrity), MCP-16 (State Handle Binding and Lifecycle), MCP-17 (MRTR Round-Trip Integrity and Replay Resistance), MCP-18 (Catalog Cache Integrity and ProvenanceProvenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. Revalidation), and MCP-19 (Authorization Chain Integrity, intended-resource/audience binding, and SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. boundaries) — bringing the CP.5.MCP profile to 19 controls.

    +8 more show less

    • Formalizes a protocol-independent persistence vocabulary with four canonical values — request, handle_scoped, durable, and swarm_shared — replacing protocol-owned session language as the governance boundary.
    • Expands the scanner rule registry to 64 total rules, adding 12 new grouped CP.5.MCP v3.1 rules alongside the 52 pre-existing rules.
    • Formalizes three explicit enforcement planes — north-south (agent to model provider), east-west (agent to agent), and agent-to-tool (agent to MCP server or tool) — with the requirement that a control result on one plane does not establish coverage on another.
    • Re-anchors five existing MCP controls (MCP-4, MCP-7, MCP-8, MCP-11, MCP-13) to framework-owned governance state (verified principals, capability grants, provenance baselines, delegation chains, governed state handles) rather than protocol session state, with primary binding to MCP 2026-07-28 and legacy compatibility with MCP 2025-11-25 for a twelve-month migration window.
    • Adds an explicit MCP-19 conformance boundary requiring deployments to evidence intended-resource, audience, or equivalent binding before protected dispatch — opaque bearer-token possession alone does not satisfy the control.
    • Scopes the Challenge Lab and Challenge 001 by enforcement plane, adding v3.1 MCP cases covering header/body desynchronization, catalog/schema drift, replay, audience/resource confusion, endpoint impersonation, SSRF, and legacy state-handle misuse.
    • Adds an Agent Discovery and Manifest Integrity CI gate that verifies manifest claims against the actual repository, failing on incorrect claims and broken paths.
    • Standardizes repository navigation and context shell across all 18 direct example README surfaces and all 24 numbered research notes under a common v3.1 shell.

    13 details in Everything

18. 2026-07-18_lovable-sovereign-runtime Jul 19, 2026 · issue 041

    AI SAFE2 v3.0 adds lovable-sovereign-runtime with subagent file-access gating and 21 enforced controls for the Lovable platform.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-07-18_lovable-sovereign-runtime https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-07-18_lovable-sovereign-runtime

    └──▷ TRY IT
    Run the full sovereign baseline smoke test to verify all 21 enforcement controls pass before deploying the runtime in your environment.
    copy

    $ cd examples/lovable-sovereign-runtime && PYTHONPATH=enforcement python3 smoke_test.py

    Apply workspace-wide AI SAFE2 trust boundary rules to every Lovable agent session — no code integration required.
    📍In the Lovable console, go to Settings › Knowledge › Workspace knowledge and paste the contents of workspace-knowledge/ai-safe2-workspace-knowledge.md.
    • Adds scan_subagent_file_access() enforcement gate that intercepts file path lists before Lovable subagents read them, blocking access to credential files (e.g. .env.production) by path pattern to close the subagent exfiltration gap.
    • Ships examples/lovable-sovereign-runtime enforcement package covering a new sixth attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources., LV-SUBAGENT, missed by the prior five-surface design.
    • Adds workspace-knowledge/ai-safe2-workspace-knowledge.md, a no-code drop-in for Lovable → Settings → Knowledge → Workspace knowledge that applies AI SAFE2 trust boundary rules to every future agent session workspace-wide.
    • Expands detection coverage to block sk-live-* API key format (hyphen in key body), natural-language destructive plan steps ('delete all existing user records'), and Response.json(process.env) (Web API environment variable exfiltration).
    • Enforces 17 named AI SAFE2 v3.0 controls: P1.T1.2, P1.T1.10, P1.T1.4_ADV, P1.T1.1, P1.T2.5, P1.T2.6, S1.3, S1.5, S1.6, P2.T3.1, A2.5, P3.T5.5, P4.T7.1, M4.5, E5.1, CP.4, CP.10, verified at 21/21 smoke-test passing.

    5 details in Everything

19. 2026-07-13_Unbiased_AI_Standard_(UAS) Jul 13, 2026 · issue 041

    AI SAFE² adds CP.11 (Unbiased AI Standard): 27 controls, 8 bias classes, published test thresholds, and a GSAR 552.239-7001 evidence package.

    • Adds STANDARD.md (Sections 1–8) as the normative specification for CP.11, covering scope, definitions, requirements, testing, evidence, and independent review criteria.
    • Adds taxonomy/bias-taxonomy.md defining UAS-B1 through UAS-B8 — an 8-class bias taxonomy, each mapped to a pillar source, CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. domain, and GSAR trigger, including UAS-B8 (Foreign Regulatory EmbeddingEmbeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG.) as the first published methodology for detecting model modifications made to satisfy foreign regulators.
    • Adds controls/uas-controls-system.md with 27 controls: 14 system-side (pillars P1–P5 and NEXUS), 8 human-side sourced from Cognitive Sovereignty Framework Domains 1–6 (UAS-H1 through UAS-H8), and 5 cross-domain bridge controls.
    • Adds testing/bias-test-protocol.md specifying 8 test types with published pass thresholds: 85% neutrality classification floor, Cohen's kappa ≥ 0.7 inter-rater minimum, and p > 0.05 demographic parity requirement across matched framings.
    • Adds compliance/gsar-552-239-7001-mapping.md and a five-document due-diligence evidence package mapped paragraph-by-paragraph to GSAR 552.239-7001 sections (j)(1) and (f)(7), including an attestation document at compliance/due-diligence-attestation.md.

    +1 more show less

    • First cross-pillar control to formally integrate the Cognitive Sovereignty Framework (CSF), with CTSS scoring feeding directly into the CP.11 evidence package.

    6 details in Everything

20. 2026-07-08_xAI-Grok-v3.1 Jul 8, 2026 · release notes

    Adds scan_hook_json() method to parse and scan Grok hook JSON definition files for malicious commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-07-08_xAI-Grok-v3.1 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-07-08_xAI-Grok-v3.1

    └──▷ USE IT
    Scan a specific hook definition file for malicious commands using the new method.
    python copy

    guard.scan_hook_json(Path(".grok/hooks/memory-usb-sync.json").read_text(), "memory-usb-sync.json")

    • Adds scan_hook_json() method to the GrokSovereignRuntime class, enabling scanning of .grok/hooks/*.json files by extracting command-like fields (command, args, script, run, exec, cmd) and applying existing GK-HOOK patterns.
    • Introduces two new tests (T2-08, T2-09) covering the new hook JSON surface.
    • Adds QUICKSTART-WINDOWS.md providing PowerShell-native scan patterns and USB propagation protocol guidance for Windows operators.

    3 details in Everything

21. 2026-07-08_Cursor_Sovereign_Runtime Jul 8, 2026 · release notes

    Adds Cursor Sovereign Runtime example with 21 detections for four Cursor-specific attack patterns

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-07-08_Cursor_Sovereign_Runtime https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-07-08_Cursor_Sovereign_Runtime

    • Provides examples/cursor-sovereign-runtime as a new runtime example for the AI SAFE2 framework.
    • Introduces scan_mcp_json() and scan_repo_file() to mitigate IPI-to-RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. via .cursor/mcp.json in Cursor IDEs.
    • Introduces scan_mcp_server_registration() with command-hash comparison to prevent TOFU bypass of MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server approvals.
    • Introduces scan_shell_command() to detect sandbox escape side-channels targeting .git/config or .zshenv.
    • Supports enforcement via the cursor.mcp.disableProjectLocalServers configuration key in managed workspace config.

    5 details in Everything

22. 2026-07-02_Xai-Grok-Sovereign-Runtime Jul 2, 2026 · release notes

    Adds GrokSovereignRuntime enforcement package to cover six xAI/Grok attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. with NEXUS kernel and policy registry.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-07-02_Xai-Grok-Sovereign-Runtime https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-07-02_Xai-Grok-Sovereign-Runtime

    • Introduces examples/xai-grok-sovereign-runtime as a stdlib-only enforcement package for xAI Grok CLI, API, and Multi-Agent workflows.
    • Adds the GrokSovereignRuntime class to manage sandbox profiles, agent counts, skill scanning, and CI/CD argument validation outside of Grok's internal logic.
    • Provides enforcement/ai_safe2_engine.py implementing the NEXUS kernel with SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. audit chain support for the five pillars of AI SAFE2 v3.0.
    • Includes controls/policy.yaml as a machine-readable control registry mapping to live AI SAFE2 v3.0 framework IDs.

    4 details in Everything

23. 2026-06-30_Make-Sovereign-Rruntime Jun 30, 2026 · release notes

    ai-safe2-framework releases make-sovereign-runtime with recursive webhook scanner and five new module-boundary enforcement checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-06-30_Make-Sovereign-Rruntime https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-06-30_Make-Sovereign-Rruntime

    └──▷ USE IT
    Run the official smoke tests to verify the sovereign baseline for Make module boundaries.
    shell copy

    PYTHONPATH=enforcement python3 smoke_test.py

    • Adds make-sovereign-runtime package to enforce AI SAFE2 controls on Make visual canvas module boundaries
    • Introduces MK-WHK recursive JSON scanner in guard.scan_webhook_payload() to detect nested injection across arbitrary nesting levels
    • Adds MK-SCEN module output gate, MK-HTTP domain allowlist + SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. gate, MK-INST agent instruction protection, MK-KNOW RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining. injection guard, MK-MCP scope gate, and MK-DS Data Store write gate
    • Enables unified AISAFE2Engine across Make, xai-grok, lovable, manus, and cursor runtimes for shared Love Score and SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. audit chain

    4 details in Everything

24. 2026-06-27_CrewAI-Sovereign-Runtime Jun 30, 2026 · release notes

    Adds CrewAI Sovereign Runtime with SovereignCallbackHandler and AISAFE2Engine for AI SAFE² v3.0 controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-06-27_CrewAI-Sovereign-Runtime https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-06-27_CrewAI-Sovereign-Runtime

    └──▷ USE IT
    Enforce AI SAFE² v3.0 controls on a CrewAI chain by injecting the sovereign handler.
    python copy

    chain.invoke(input, config={"callbacks": [SovereignCallbackHandler(act_tier=ACTTier.ACT3)]})

    • Adds SovereignCallbackHandler to enforce a hard ceiling on AgentExecutor loops and sanitize tool outputs via on_tool_end callbacks
    • Adds authorization gate to save_context() calls in ConversationBufferMemory to block poisoned memory writes
    • Introduces AISAFE2Engine kernel shared across LangGraph, CrewAI, AutoGen, and n8n for unified compliance scoring and audit chains

    3 details in Everything

25. Sovereign_Runtime Jun 26, 2026 · release notes

    AI SAFE2 framework adds Sovereign Runtime pre-execution enforcement for AutoGen CodeExecutorAgent with CP.8 and HEAR doctrine support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch Sovereign_Runtime https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout Sovereign_Runtime

    • Adds the AutoGen 0.4 Sovereign Runtime which evaluates every generated code block before it reaches the executor to prevent prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. resulting in arbitrary code execution
    • Introduces mandatory CP.8 Catastrophic Risk Threshold enforcement for every CodeExecutorAgent instance
    • Implements HEAR Doctrine enforcement specifically for Class-H code patterns within the runtime

    3 details in Everything

26. 2026-06-24_Langflow-Sovereign-Rruntime Jun 24, 2026 · release notes

    AI SAFE2 v3.0 introduces Langflow Sovereign Runtime with external proxy and inline DAGDAGA directed acyclic graph — a data structure of nodes connected by one-way edges with no cycles — used by tools to model task pipelines or data flows where execution order and dependencies must be enforced without loops. node enforcement.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-06-24_Langflow-Sovereign-Rruntime https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-06-24_Langflow-Sovereign-Rruntime

    └──▷ USE IT
    Deploy the external proxy to scan webhook and header injections before they touch the Langflow server.
    shell copy

    cd examples/langflow-sovereign-runtime && PYTHONPATH=enforcement python3 smoke_test.py

    Configure Langflow to stop auto-exposing flows as MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools by disabling the relevant environment variables.
    shell copy

    LANGFLOW_ADD_PROJECTS_TO_MCP_SERVERS=false LANGFLOW_AUTO_LOGIN=false

    • Adds examples/langflow-sovereign-runtime providing a defense architecture for visual DAG builders via an external API proxy that scans requests before they reach Langflow's HTTP endpoints.
    • Introduces the inline DAG node safe2_guardian_component.py as a CustomComponent to intercept LF-COMP surface injections between data-fetching and Agent nodes.
    • Adds validation of LANGFLOW_ADD_PROJECTS_TO_MCP_SERVERS and LANGFLOW_AUTO_LOGIN environment variables via the new scan_mcp_config() startup function to prevent unauthenticated MCP exposure.

    3 details in Everything

27. 2026-06-22_LangGraph-Sovereign-Runtime Jun 22, 2026 · release notes

    Introduces LangGraph Sovereign Runtime for AI SAFE2 v3.0 enforcement

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-06-22_LangGraph-Sovereign-Runtime https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-06-22_LangGraph-Sovereign-Runtime

    • Adds SovereignCallbackHandler to enforce 15 controls from AI SAFE² v3.0 on LangGraph chains
    • Shares the AISAFE2Engine kernel across LangGraph, CrewAI, AutoGen, and n8n for unified compliance scoring

    2 details in Everything

28. 2026-06-19_Langchain-Sovereign-Runtime Jun 19, 2026 · release notes

    Ships LangChain Sovereign Runtime for AI SAFE² v3.0 with hard loop ceilings and memory governance

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-06-19_Langchain-Sovereign-Runtime https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-06-19_Langchain-Sovereign-Runtime

    └──▷ USE IT
    Sanitize tool outputs and enforce safety controls on a standard LangChain chain invocation.
    python copy

    chain.invoke(input, config={"callbacks": [SovereignCallbackHandler(act_tier=ACTTier.ACT3)]})

    • Adds SovereignCallbackHandler to enforce ACT3 controls (P1.T1.2, P1.T1.5, etc.) on any LangChain chain or agent via the callbacks config key
    • Enforces a hard iteration ceiling for AgentExecutor via F3.2 callback-layer enforcement, replacing soft system-prompt hints
    • Adds authorization gates to ConversationBufferMemory.save_context() calls via S1.5 Memory Governance to block poisoned memory writes

    3 details in Everything

29. 2026-06-09_Anti-Gravity_Sovereign_Runtime_v2 Jun 9, 2026 · release notes

    Adds governance-enforcer plugin for Antigravity, hardened safe_gateway.js covering 10 threat classes, SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema. reports via audit_logger.js, and subagent memory governance.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-06-09_Anti-Gravity_Sovereign_Runtime_v2 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-06-09_Anti-Gravity_Sovereign_Runtime_v2

    • Adds governance-enforcer plugin with 'autoLoad': true to load constraints in every Antigravity session without per-project config
    • Expands safe_gateway.js coverage from 4 to 10 threat classes including symlink/junction escape, domain confusion, raw IP literal blocking, and non-HTTP scheme blocking (file://, ftp://, data://)
    • Adds audit_logger.js that computes SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashes for verified files and generates SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. 2.1.0 output for GitHub Security / CodeQL integration
    • Introduces controls/policy.yaml machine-readable manifest with maturity levels (attested, tested, implemented, documented, planned) and loaded_at_runtime fields per control
    • Adds circuit_breaker.js methods validateSubagentSpawn() and validateMemoryWrite() to deny unsandboxed spawns and block injection payloads in memory writes

    5 details in Everything

30. 2026-05-30_Hermes_Sovereign_Runtime May 30, 2026 · release notes

    Hermes Sovereign Runtime v1.0 introduces a production-grade deployment package for NousResearch/hermes-agent enforcing AI SAFE² v3.0 controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-05-30_Hermes_Sovereign_Runtime https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-05-30_Hermes_Sovereign_Runtime

31. 2026-05-03-Codex-Sovereign-Runtime-v2 May 3, 2026 · release notes

    v2 of ai-safe2-framework reworks Codex sovereign runtime with wrapper-first deployment and new governance file standard.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-05-03-Codex-Sovereign-Runtime-v2 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-05-03-Codex-Sovereign-Runtime-v2

    • Establishes wrapper-first deployment as the default for examples/codex-sovereign-runtime, shifting launch-time enforcement to Codex wrapper and explicit runtime flags instead of global config mutation.
    • Introduces a minimal core governance file standard consisting of seven new markdown files: IDENTITY.md, SOUL.md, AGENTS.md, USER.md, TOOLS.md, SUBAGENT-POLICY.md, and EVALUATION.md.

    2 details in Everything

32. 2026-05-01-MCP-Toolkit-v2.0 May 1, 2026 · release notes

    Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.-8 through MCP-13 detections, weighted scoring rubric, and a pytest filter for new controls

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-05-01-MCP-Toolkit-v2.0 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-05-01-MCP-Toolkit-v2.0

    • Adds detection for six new threat classes (MCP-8 session economics, MCP-9 context-tool isolation, MCP-10 multi-agent provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., MCP-11 schema temporal profiling, MCP-12 swarm C2, MCP-13 failure taxonomy) bringing total coverage to 13 controls
    • Adds a weighted scoring rubric that distributes the 25-point attestation bonus across all 11 attested CP.5.MCP controls based on risk

    2 details in Everything

33. v3.0 Apr 21, 2026 · release notes

    v3.0 adds Gateway enforcement with multi-provider support, HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. audit logs, HITLHITLHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues. circuit breaker, and 33 new governance controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout v3.0

    • Adds Core Gateway adapter architecture supporting Anthropic, OpenAI/Codex, Google Gemini, Ollama, and OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code. providers via unified config.
    • Adds GENESIS_HASH integrity validation derived from SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. of gateway configuration with hard-stop on chain break.
    • Adds HMAC-SHA256HMAC-SHA256A keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. chained audit logging for every request to satisfy A2.5 Semantic Execution Trace Logging at the infrastructure layer.
    • Adds 4-tier HITL circuit breaker (LOW, MEDIUM, HIGH, CRITICAL) implemented in the Core Gateway.
    • Adds runtime-aware risk scoring formula: Action × Sensitivity × Historical Context with modifiers for prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. (+5) and A2AA2AAgent2Agent, an open protocol started by Google for AI agents from different vendors to discover each other, delegate tasks and exchange results. It complements MCP, which connects an agent to tools. impersonation (+3).

    +5 more show less

    • Adds nexus_a2a_enforcement: true config flag to enable full NEXUS-A2A v0.2 passthrough enforcement.
    • Adds 33 new controls including CP.1-CP.10 Cross-Pillar Governance OS and new Pillar controls (e.g., P1.T1.10, CP.9)
    • Adds new composite risk formula integrating OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. AIVSS v0.8 Agentic Amplification Factor: Combined Risk Score = CVSS_Base + ((100 - Pillar_Score) / 10) + (AAF / 10)
    • Updates Controls JSON schema with new fields: builder_problem, act_minimum, version_added, first_in_field, and implementation_details.
    • Adds Scanner v3.0 rules for indirect injection surface detection, memory governance gap detection, recursion limit absence, tool-misuse baseline absence, and HEAR requirement detection.

    10 details in Everything

34. 2026-04-14_Gateway_Enforcement_Update_v3.0 Apr 14, 2026 · release notes

    ai-safe2-framework v3.0 adds production enforcement gateway with multi-provider support, HITLHITLHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues. circuit breaker, and immutable audit log.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-04-14_Gateway_Enforcement_Update_v3.0 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-04-14_Gateway_Enforcement_Update_v3.0

    • Adds HeartbeatMonitor to validate HEARTBEAT.md before every proxied request; use --init-heartbeat for first-run initialization
    • Adds ImmutableAuditLog with HMAC-SHA256HMAC-SHA256A keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. chained JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. format and /audit/verify-chain endpoint for on-demand integrity checks
    • Implements 3-vector risk scoring (action type, target sensitivity, historical context) with configurable weights and modifiers for injection/A2AA2AAgent2Agent, an open protocol started by Google for AI agents from different vendors to discover each other, delegate tasks and exchange results. It complements MCP, which connects an agent to tools.
    • Adds 4-tier HITL circuit breaker (AUTO/MEDIUM/HIGH/CRITICAL) using X-HITL-Token and X-HITL-Reason headers with 300s TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit.
    • Adds multi-provider support via provider_adapters.py for Anthropic, OpenAI/Codex, Gemini, Ollama, and OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code.

    +6 more show less

    • Adds NEXUS-A2A v0.2 compatibility via header detection and identity field passthrough; controlled by nexus.enforcement in config.yaml
    • Adds outbound ResponseScanner to inspect upstream responses for exfiltration patterns and tool_use injection payloads
    • Adds SafeMode event-based hard stop with operator deactivation via POST /emergency/deactivate-safe-mode endpoint
    • Adds scanner.py nightly auditor with --json output for CI integration, checking chain integrity, heartbeat validity, and config security
    • Adds 9-step pre-flight validation in start.sh v3 for Python version, deps, env vars, YAML syntax, and log permissions
    • Implements per-user rate limiting via dual sliding window (requests/minute + requests/hour) configurable in config.yaml

    11 details in Everything

35. 2026-3-23-AISM-Assessment_and_Measurement_Tools_+_Document Mar 24, 2026 · release notes

    AI SAFE2 v2.1 adds self-assessment tool, scoring methodology, and compliance crosswalk for AI governance

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-3-23-AISM-Assessment_and_Measurement_Tools_+_Document https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-3-23-AISM-Assessment_and_Measurement_Tools_+_Document

    • Adds AISM-Self-Assessment-Tool.md with a structured checklist producing a scored AISM Sovereignty Score (1 to 5 scale) across five pillars.
    • Adds AISM-Scoring-Matrix-Methodology.md defining the quantitative evaluation framework, dimension weighting, and CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. integration for risk scoring.
    • Adds AISM-Compliance-Crosswalk.md mapping controls to NIST AI RMFNIST AI RMFA voluntary framework published by NIST that gives organizations a structured process for identifying, assessing, and managing risks introduced by AI systems, giving cyber tools a common vocabulary and governance scaffold. 1.0, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 42001:2022, EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe., CSA AICM, NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0, MITRE ATLASMITRE ATLASA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured taxonomy for AI-specific threat modelling., and OWASP Top 10 for LLM.
    • Adds six dedicated topic pages (strategic-architecture.md, operational-loop.md, sovereignty-matrix.md, maturity-model.md, control-stack.md, agent-threat-control-matrix.md) separating core framework concepts.
    • Adds a six-step Start Here onboarding path in the README for navigating the assessment ecosystem.

    5 details in Everything

36. 2026-3-18-AI-SAFE²-Framework-Dashboard-v2.1 Mar 18, 2026 · release notes

    AI SAFE² Framework Dashboard v2.1 launches interactive taxonomy explorer with real-time search and risk filtering

    • Adds interactive web-based taxonomy explorer for AI SAFE² framework controls hosted on GitHub Pages
    • Enables real-time client-side search across control IDs, names, descriptions, sub-topics, and decision-maker impacts
    • Adds risk-level filtering (Critical, High, Medium, Low) and strategic pillar navigation to the dashboard
    • Introduces v2.1 control highlighting that automatically badges next-generation controls (Agent Security, Memory Security, NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls., Multi-Agent, Distributed Systems)

    4 details in Everything

37. 2026-3-12_AI_SAFE²_×_SlowMist_Security_Overlay Mar 12, 2026 · release notes

    Adds AI SAFE² × SlowMist Security Overlay integration guide and asset library for OpenClaw deployments

    • Releases the AI SAFE² × SlowMist Security Overlay as a comprehensive integration guide and asset library
    • Establishes a three-layer defense hierarchy: Organizational, Gateway, and Host/Agent layers

    2 details in Everything

38. 2026-02-25-OpenClaw-Core-File-Standard Feb 25, 2026 · release notes

    v2.0 introduces 11 new governance files for OpenClaw agent workspaces including IDENTITY.md and HEARTBEAT.md

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2026-02-25-OpenClaw-Core-File-Standard https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout 2026-02-25-OpenClaw-Core-File-Standard

    └──▷ HOW TO FIND IT
    Enforce a permanent identity anchor that cannot be overwritten by adversarial prompts.
    📍Place IDENTITY.md in the agent's root workspace directory; it loads automatically on every request.
    Monitor for credential leaks and model cost overruns using scheduled checks.
    📍Place HEARTBEAT.md in the workspace to enable per-cycle, daily, and weekly health check protocols.
    Govern sub-agent spawn behavior and isolate their context to prevent injection.
    📍Apply SUBAGENT-POLICY.md to define tiered trust levels and output injection detection rules.
    • Adds IDENTITY.md to provide a minimal 5-line identity anchor that loads on every request
    • Adds SOUL.md to implement alignment via the Love Equation dynamical system
    • Adds HEARTBEAT.md to operationalize scheduled health checks for monitoring drift and credential leaks
    • Adds USER.md to define human identity contracts with three-tier data classification
    • Adds TOOLS.md to separate environment configuration values from skill instructions

    +6 more show less

    • Adds SUBAGENT-POLICY.md to enforce tiered trust levels and injection detection for worker agents
    • Adds MODEL-ROUTER.md to define multi-LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. routing policies, cost controls, and data residency rules
    • Adds OPENCLAW-WORKSPACE-POLICY.md to bind agents to shared accountability and cross-agent trust hierarchy
    • Adds OPENCLAW-AGENT-TEMPLATE.md as an eight-step onboarding checklist with mandatory smoke tests
    • Adds AGENTS.md as a complete operating manual covering security, data classification, and UX patterns
    • Updates openclaw_memory.md to v2.0 with a new prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. block list superseding the previous pattern list

    11 details in Everything

39. 2026-02-12–Love_Equation_v2 Feb 12, 2026 · release notes

    Adds Empirical Distrust algorithm and updated schema with multipliers for high-stakes alignment weighting.

    • Introduces the Empirical Distrust algorithm which applies a defection penalty to high-confidence, low-verifiability claims.
    • Updates the evaluation schema to v2.0 with 9 new fields.
    • Adds composable multipliers for stakes (4x critical), reversibility (2.5x irreversible), and risk flags (5x self-harm) within the context model.

    3 details in Everything

40. 2026-01-26–Gateway_Scanner_&_Skill_Runtime_Drop Feb 10, 2026 · release notes

    Introduces executable runtime components: AI SAFE² Gateway proxy, Audit Scanner CLI, and associated config/Docker assets.

    • Adds the ai-safe2-framework as an executable control plane with new tooling to enforce AI safety policies at runtime
    • New gateway/ directory provides the AI SAFE² Gateway proxy implementation to enforce policy decisions between orchestration layers and downstream tools
    • New scanner/ directory provides the AI SAFE² Audit Scanner CLI supporting deeper scan modes for risk domains like Agentic Swarms, NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls., Memory/RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining., Supply Chain, and Universal GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically.
    • Adds config/default.yaml containing baseline security configuration and control thresholds as a starting point for enterprise customization
    • Adds root-level Dockerfile and docker-compose.yml to enable containerized deployment of the Gateway

    +1 more show less

    • Adds skill.md as the canonical context file for AI assistants and IDEs like Claude Projects, Cursor, and Windsurf

    6 details in Everything

41. v2.1 Jan 5, 2026 · release notes

    v2.1 adds specialized sub-domains for Swarm Intelligence, Non-Human Identity governance, and memory security to the AI Safe² framework.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
    # already have the repo? check out this version:
    $ git checkout v2.1

    • Introduces Supply Chain Artifact Validation via OpenSSF Model Signing (OMS) under Pillar 1.
    • Adds real-time Non-Human Identity (NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.) secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. with GitGuardian integration.
    • Adds Multi-Agent Boundary Enforcement with Agent-to-AgentAgent-to-AgentAgent2Agent, an open protocol started by Google for AI agents from different vendors to discover each other, delegate tasks and exchange results. It complements MCP, which connects an agent to tools. (A2AA2AAgent2Agent, an open protocol started by Google for AI agents from different vendors to discover each other, delegate tasks and exchange results. It complements MCP, which connects an agent to tools.) protocol restrictions.
    • Introduces NHI Access Control featuring automated provisioning/decommissioning and Just-In-Time (JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility.) privilege elevation.
    • Enhances Audit capabilities with Consensus Voting Validation for swarms and cryptographic Agent State Verification using SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashing.

    +8 more show less

    • Mandates a Swarm Topology Map to document multi-agent communication patterns under Inventory.
    • Introduces centralized kill switches for multi-agent systems under Fail-Safe.
    • Adds automated NHI credential revocation capabilities.
    • Expands Recovery to cover Agent State & Memory Snapshots and RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining./Knowledge Base versioning with rollback capabilities.
    • Formalizes Consensus Failure Escalation for human intervention when agents disagree.
    • Delivers real-time Distributed Agent Health & Consensus Monitoring.
    • Adds advanced Memory Poisoning Monitoring to detect adversarial trigger phrases and semantic drift.
    • Achieves Universal GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. Tagging mapping every sub-domain to seven external frameworks including ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 42001.

    13 details in Everything