ai-safe2-framework — The Cyber Toolchain

ai-safe2-framework CLI_v1.0.1

Wed, 07 Oct 2026 17:01:54 GMT

AI SAFE² CLI v1.0.1 hardens MCP scoring, skill trust gating, and wrap-mode blocking with new rules TG-013 to TG-024.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds rules TG-013 to TG-024 to `safe2 gate skill`, rejecting hostile skills including paraphrased overrides, Unicode tags, homoglyphs, env exfiltration, persistence, and trigger hijack.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends `safe2 scan mcp` / `safe2 gate mcp PATH` to detect Python and TypeScript sinks previously missed, obfuscated execution, and evasion via file renaming (e.g. renaming a vulnerable file to `test_server.py`). • Updates `safe2 score mcp` / `safe2 gate mcp URL` so self-attestation (`.well-known/mcp-security.json`) and unvalidated OAuth metadata no longer contribute to the score; hostile schema content caps the score, withholds the badge, and causes `safe2 gate mcp` to exit 1. • Updates `safe2 mcp wrap-stdio --block` to withhold poisoned tool output rather than delivering it to the client. • Adds schema-pinning to `safe2 mcp wrap-proxy --pin-schema` to withhold a rug-pulled catalog when the tool schema changes unexpectedly. • Updates `safe2 gate` (project gate) so a CRITICAL finding caps the overall score, preventing a project using `shell=True` and eval() on LLM output from clearing Tier 2. • Publishes `ai-safe2==1.0.1` to PyPI for the first time (1.0.0 shipped on GitHub only), installable via `pip install 'ai-safe2[all]==1.0.1'`. Breaking changes: • DEP findings now cite `MCP-4` instead of `MCP-3`, matching the v3.1 control map — any automation that matches on the old finding ID will stop matching. • Scores and gate results from 1.0.0 or 0.9.x are no longer reliable; gates must be re-run to get valid results under 1.0.1 scoring logic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-10-5_CLI_1.0.0

Mon, 05 Oct 2026 14:07:38 GMT

AI SAFE² CLI 1.0.0 debuts a local-first evidence and decision-support layer for agent systems with 10 new commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 assess` command to create a sealed project assessment bundle containing canonical JSON, an evidence manifest, and a human-readable Decision Card.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 doctor` command to inventory multi-harness environments — including WSL distributions and explicit SSH targets — and expose missing or partial coverage. • Adds `safe2 gate skill` command to statically screen a skill before installation or use without executing it. • Adds `safe2 evidence system` command to record the complete agent system identity (model, harness, tools, skills, memory, environment, policy, evaluator, authority) behind an assessment. • Adds `safe2 evidence claims` command to compare explicit agent claims against receipts, disclosures, conflicts, and missing evidence. • Adds `safe2 evidence truth` command to correlate attributed evidence across multiple harnesses while preserving coverage gaps. • Adds `safe2 evidence diagnose` command to rank evidence-backed investigation paths without asserting a verified root cause. • Adds `safe2 aism plan` command to convert confirmed AISM findings into a reviewable remediation plan without granting execution authority. • Adds `safe2 challenge` command to run or import bounded Challenge Lab evidence while preserving provider verdicts, provenance, and disagreements. • Adds `safe2 acceptance` command to create and replay an offline first-user acceptance bundle. • Adds `safe2 self-check --strict` for installation self-verification and `safe2 init . --profile local` for bounded project initialization. • Adds `--scan-content` and `--inspect-config` flags to `safe2 assess` for explicit opt-in to content and configuration inspection. • Includes Codex JSONL and OpenTelemetry reference translators, plus attributed NVIDIA SkillSpector and NEXUS evidence intake. • Delivers provider-neutral adapter and evidence contracts that bind attributed evidence across agents and scanners without conflating source confidence levels. • Introduces four result states — Evidence-consistent, Contradicted, Unverifiable, and Limited — as the canonical vocabulary for all command outputs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework nexus-v0.5.0

Sun, 04 Oct 2026 23:43:38 GMT

NEXUS v0.5.0 debuts the Sovereign Payment Gateway — a deterministic, fail-closed security boundary for AI agents that can initiate or influence payments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the `nexus-a2a-sdk==0.5.0` Python package (import `nexus_sdk`) delivering the Sovereign Payment Gateway — a monotonic, fail-closed transaction lifecycle that prevents AI agents from self-granting authority, accessing unrestricted payment keys, or overriding deterministic controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the Key Guardian component, which isolates signing authority from the agent and signs only approved canonical transactions. • Adds the Policy Authority component for independent deterministic evaluation of payment policy. • Adds the Runtime Verifier component, which confirms the executing workload matches an approved, sufficiently fresh measurement before value is allowed to move. • Adds the Human Intent Authority component, binding approval to actual transaction constraints and trusted rendering rather than agent-generated descriptions. • Adds the Settlement Truth Authority component, which obtains payment outcomes from authoritative external sources instead of trusting the agent. • Adds the Gateway State Vault for durable storage of authority, exposure, replay, revocation, reservation, and settlement state. • Adds the Policy Parity Guard, which detects divergence between policy implementations before activation. • Adds the Sovereign Payment Coordinator, composing all controls into an ordered, fail-closed execution path. • Adds Governed Recovery to handle ambiguous settlement without unsafe retries or premature restoration of spending capacity. • Adds Sandbox Rail Readiness enforcement to prevent unverified payment integrations from being promoted into active use. • Adds Deployment Proof and Readiness, producing a signed, independently verifiable activation decision. • Adds an `llms.txt` retrieval index and a versioned machine-readable documentation manifest under the canonical `/NEXUS` directory for agent-consumable documentation discovery. • Counters prompt-injection-driven purchases, replay and duplicate-payment attacks, authority escalation by child agents, spending split across agents to evade limits, protocol and checkout downgrades, and revocation races as named threat categories in the included payment threat model. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-10-02_AISM_Scoring_Update

Fri, 02 Oct 2026 19:27:42 GMT

AI SAFE² adds Technology Contribution Profile v1.0, Evidence Assurance v1.0, and a reusable Technology Card for scoped AI control reviews.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces AISM Technology Contribution Profile v1.0 to structure review of what an artifact addresses, implements, enforces, validates, evidences, or challenges within a stated boundary.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces AI SAFE² Evidence Assurance v1.0 to attribute evidence strength, origin, independence, and limitations to each individual claim. • Adds a reusable Technology Card template capturing version, scope, controls, mechanisms, evidence, failure behavior, retained authority, and adoption conditions. • Adds validation and incident guidance documents covering clean/attacked pairs, side-effect and bypass tests, policy-integrity checks, reconstruction, and notification ownership. • Adds nine source-attributed review candidates to frame scoped acceptance work without adopting unsupported scores. • Clarifies the existing AISM Sovereignty Score to explicitly keep organizational maturity separate from technology contribution and claim-level evidence assurance. • Adopts the name AI Sovereign Maturity (AISM) Model and adds dated AISM change summaries with repository-wide navigation connecting methods to pillars, implementation guidance, research, Challenge Lab, and agent discovery. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-09-27_CLI_0.9.0

Sun, 27 Sep 2026 20:37:22 GMT

AI SAFE² CLI 0.9.0 adds controlled Challenge 001 execution with pre-registration, independent grading, and sealed evidence receipts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 challenge plan` command to pre-register the evaluator, provider, treatment, execution limits, command-file identities, and optional system identity before any process runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 challenge execute` command to run the six frozen Challenge 001 scenarios as separate bounded process calls after explicit operator authorization via `--authorize-process-execution`. • Adds `safe2 challenge verify-execution` command to recheck the plan, source, normalized run, receipt, command-file digests, and optional identity binding without re-running the evaluator. • Adds `safe2.challenge-execution-plan.v1` schema providing a strict, machine-readable pre-registration contract binding the executable, file arguments, provider declaration, treatment, and limits. • Adds `safe2.challenge-execution-receipt.v1` schema providing a sealed record of cross-artifact and per-episode evidence bindings, including before-and-after SHA-256 digests for the executable and file arguments. • Adds evidence-manifest support so plans and execution receipts can enter the existing AI SAFE² evidence inventory via `safe2 evidence manifest`. • Adds a packaged controlled-executor example verifiable with `safe2 example verify challenge-controlled-executor` that demonstrates planning, execution, verification, reporting, and evidence-manifest intake. • Surfaces incomplete and conflict episode states so invalid JSON, nonzero exits, timeouts, output limits, and contradicting evidence observations become explicitly visible rather than silently discarded. • Enforces direct-child execution time limits and combined stdout/stderr byte limits, reduced child-process environment variables, no-overwrite artifact creation, and exact regular-file resolution with symlink dereferencing before hashing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-09-24_CLI_0.8.0

Thu, 24 Sep 2026 14:43:04 GMT

AI SAFE² CLI 0.8.0 adds evidence-bound AISM remediation planning with human decision gates and machine-readable output contracts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 aism remediation-init` command to create a remediation source template bound to the exact assessment, system identity, and assessment scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 aism plan` command to validate a proposed implementation path and produce canonical JSON (`aism-remediation-plan-v1`) plus a human-readable decision card. • Adds `--previous` flag to `safe2 aism plan` to preserve action history across reassessments and detect completed actions that regress or disappear. • Adds `--strict` flag to `safe2 aism plan` to return a failing exit code unless the plan reaches the `ready_for_human_decision` gate. • Introduces `aism-remediation-source-v1` as the versioned input contract defining actions, evidence, assumptions, alternatives, ownership, and accepted risk. • Introduces `aism-remediation-plan-v1` as the strict machine-readable output contract for integrations, agents, CI pipelines, and governance systems. • Adds a three-state human decision gate (`hold`, `review`, `ready_for_human_decision`) to every produced remediation plan, with `remediation_authorized` and `conformance_claim` fixed to `false`. • Adds cycle detection and required dependency ordering for remediation action graphs. • Adds calendar-date validation for residual-risk reviews within remediation plans. • Adds safe paired-output handling that removes a partial plan if decision-card creation fails. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-09-23_NEXUS_v0.4-Safer_Payment_Authority_for_Agents

Wed, 23 Sep 2026 16:05:41 GMT

NEXUS v0.4 adds eight named payment authority adapter profiles for AI agents, covering x402, AP2, Visa TAP, Mastercard AP4M, and KYA-OS delegation evidence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `SafePay Exact` reference profile for structural x402 v2 exact EVM/USDC evaluation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `SafePay Verified` reference profile for authenticated x402 facilitator or chain evidence with an explicit verifier boundary. • Adds `SafePay Variable` reference profile for maximum-versus-actual charge enforcement and reservation release. • Adds `SafePay Escrow` reference profile for deposit, release, refund, and mediated-finality state handling. • Adds `Mandate Bridge` reference profile for AP2 v0.2 mandate and receipt evidence. • Adds `Card Trust Bridge` reference profile for Visa TAP request recognition without overstating payment authorization. • Adds `Agent Token Bridge` reference profile for authenticated Mastercard AP4M verifier evidence. • Adds `Portable Delegation Bridge` reference profile for KYA-OS identity and delegated-authority evidence. • Introduces three deterministic assessment outcomes — Supported, Contradicted, and Unverifiable — giving agents stable machine-readable authority decisions instead of permission inferred from prose. • Provides explicit allowlists, assurance ceilings, and fail-closed results across all eight adapter profiles. • Includes an adversarial test corpus covering substitution attacks, malformed evidence, truthy-value bypasses, replay behavior, scope mapping, privacy checks, and RailGuard conformance. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026_09_20_CLI_0.7.0

Mon, 21 Sep 2026 01:30:08 GMT

AI SAFE² CLI 0.7.0 adds `safe2 evidence truth` and `safe2 evidence changes` to correlate multi-harness agent evidence and detect configuration drift.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 evidence truth` command to correlate harness evidence, revision-bound task receipts, coverage, usage declarations, and completion claims across multiple agent harnesses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 evidence changes` command to run a bounded one-shot inventory of skills and recognized agent configuration locally or in CI, detecting additions, modifications, and removals. • Adds `--baseline`, `--output`, `--strict`, and `--card` flags to `safe2 evidence` subcommands for controlling baseline comparison, artifact output paths, strict-mode enforcement, and human-readable decision card generation. • Introduces `operational-truth-source-v1` contract schema to declare the task, revision, required evidence, receipt bindings, decision owner, assumptions, and exclusions. • Introduces `operational-truth-manifest-v1` contract schema to record the correlated result, decision gate (`hold`, `review`, `ready_for_human_decision`), conflicts, gaps, and evidence boundaries. • Introduces `change-monitor-v1` contract schema to record bounded agent-input inventory and change results without exporting configuration contents. • Recognizes skill packages rooted by `SKILL.md`, MCP configuration, OpenClaw configuration, and supported configuration beneath `.codex`, `.claude`, `.hermes`, and `.openclaw` during change monitoring. • Generates a human decision card (`--card`) alongside canonical JSON output from the same evaluated evidence record. • Enforces bounded traversal of up to 10,000 entries and 1 MB per tracked file by default during change monitoring. • Adds strict evidence-contract protections including duplicate-key rejection, non-finite-number rejection, symbolic-link and reparse-point guards, no-overwrite behavior, and exclusive complete-before-visible evidence publication. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-09-17_CLI_0.6.0_Scope_Attribute_Decide

Thu, 17 Sep 2026 17:48:57 GMT

AI SAFE² CLI 0.6.0 adds `safe2 evidence scope`, `attribute`, and `readiness` commands for scoped assessment, change attribution, and release-readiness cards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 evidence scope` command to inventory the declared deployment relationship of repository or built-artifact paths, classifying each as included, excluded, partial, not applicable, or unknown.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 evidence attribute` command to compare normalized findings across an explicitly trusted baseline and current revision, separating inherited, introduced, changed, resolved, and unknown findings. • Adds `safe2 evidence readiness` command to produce canonical release-readiness JSON and an escaped Markdown card, accepting `--system-identity`, `--assessment-scope`, `--change-attribution`, `--output`, `--card`, and `--strict` options. • Adds three new schema contracts — `assessment-scope-source-v1`, `change-attribution-source-v1`, and `release-readiness-source-v1` — exportable via `safe2 schema export`. • Introduces `release_authorized: false` as a permanent field in every readiness output, enforcing that no automated result can be mistaken for release permission. • Hardens JUnit XML intake with `defusedxml`, rejecting DTD/entity input while retaining size, encoding, structure, and declared-total checks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-09-15_CLI_0.5.0_Find_Where_Agent_Work_Failed

Tue, 15 Sep 2026 16:44:09 GMT

AI SAFE² CLI 0.5.0 adds `safe2 evidence diagnose` and two strict JSON contracts for evidence-bounded AI agent failure localization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 evidence diagnose` command to rank evidence-supported failure locations across an identified agent system, with `--system-identity`, `--output`, `--card`, and `--strict` flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces `safe2.failure-source.v1` JSON contract as a provider-neutral schema for supplying observations and competing failure candidates to the diagnostic engine. • Introduces `safe2.failure-diagnosis.v1` JSON contract returning deterministic rankings, evidence assessments, ownership, and recommended actions from a diagnosis run. • Adds strict diagnostic mode via `--strict` flag that returns a nonzero exit code when evidence cannot support one strong or moderate leading candidate. • Adds `--card` flag to `safe2 evidence diagnose` to emit a Failure Localization Card as a human-readable Markdown decision document alongside the JSON diagnosis. • Adds scanner workspace exclusions to avoid traversing generated AI SAFE² evidence directories, named virtual environments, and uv caches during repository scans. • Introduces a portable agent delivery workflow that guides agents through isolation, building, proof, self-assessment, independent review, and shipping with receipts. • Adds five evidence classification levels — Strong, Moderate, Limited, Insufficient, and Contradicted — to every diagnosis output. • Binds every diagnosis to a complete AI SAFE² system identity manifest, preserving harness, tool, policy, memory, and evaluator identity in results. • Diagnostic contracts are compatible with Codex, Claude Code, Hermes, OpenClaw, and CI systems without designating any single provider as the source of truth. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-09-14_CLI_0.4.0_Know_What_You_Actually_Tested

Mon, 14 Sep 2026 18:50:50 GMT

AI SAFE² CLI 0.4.0 introduces a portable agent system identity manifest with new `safe2 evidence system` and `safe2 schema export` commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 evidence system SOURCE --output FILE` command to normalize an attributed agent-system identity declaration into a portable manifest.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--strict` flag to `safe2 evidence system` and `safe2 evidence manifest` to exit with status 1 when identity gaps, unknown evidence bases, missing versions, or disconnected components are detected. • Adds `safe2 schema export system-identity-source-v1` command to export the provider-neutral input contract for agent system identity. • Adds `safe2 schema export system-identity-manifest-v1` command to export the normalized output contract for agent system identity. • Adds `safe2 evidence manifest FILE --subject-id ID --output FILE` command to bind a system identity manifest into a wider hashed evidence run. • Introduces eight component categories (model, harness, tools, skills, memory, environment, policy, evaluator) for complete agent system identification in a single strict manifest. • Introduces a system relationship graph recording use, execution, policy, evaluation, memory, and delegation relationships between agent components. • Introduces an authority inventory supporting read, write, execute, network, delegate, approve, admin, or unknown authority classes per component. • Introduces dual hashing: `source.sha256` binds exact submitted bytes while `system_fingerprint_sha256` fingerprints normalized system composition independently of key order, list order, and formatting. • Adds coverage recommendations that surface remaining version, attribution, inventory, and topology gaps in the agent system declaration. • Adds four coverage statuses — complete, partial, missing, and not-applicable — to distinguish different kinds of inventory gaps. • Adds three evidence-basis labels — observed, declared, and unknown — to distinguish independently observed evidence from declarations and unknowns. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-09-14_CLI_0.3.0_Provider_Neutral_Harness_Evidence_Intake

Mon, 14 Sep 2026 15:28:51 GMT

ai-safe2-framework: Adds `safe2 evidence harness SOURCE --output FILE` to validate and normalize a provider-neutral harness export into a structured AI SAFE² evidence result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces a seven-domain coverage inventory assessing task lifecycle, tool calls, artifacts, tests, usage, environment state, and completion claims. • Adds SHA-256 source-byte binding that records the digest and size of the exact harness export that was processed. • Adds evidence attribution that preserves the producer, export identifier, source references, and collection basis across intake. • Introduces loss-aware recommendations that surface which evidence areas remain partial or missing rather than silently treating gaps as success. • Establishes a stable provider-neutral integration seam targeting Codex, Claude Code, Hermes, OpenClaw, and other agent harnesses. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-09-11_safe2_CLI_0.3.0

Fri, 11 Sep 2026 20:51:34 GMT

SAFE2 CLI 0.3.0 adds eight new subcommands for capturing, verifying, and signing task evidence from AI agent runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 feedback receipt` to produce JSON or Markdown evidence receipts for AI agent task claims, with `--artifact-root`, `--format`, and `--output` options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 feedback capture-pytest` to run selected tests and capture fresh evidence, recording the observed exit code and test results separately from process success. • Adds `safe2 feedback verify-pytest` to recheck a saved pytest capture offline, recomputing hashes and test assessments without re-executing tests. • Adds `safe2 feedback sign-report` to create a detached signature authenticating test/tool report bytes against an operator-trusted key. • Adds `safe2 feedback verify-report` to check a detached signature against a supplied trusted key. • Adds `safe2 feedback import-junit` to normalize supported JUnit XML reports into the SAFE2 evidence format. • Adds `safe2 feedback usage` to correlate declared per-task resource use, separating reported, estimated, and unknown values. • Exposes seven versioned JSON contracts to support automation of evidence receipts and test/tool report workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-09-09_safe2_CLI_0.2.0

Thu, 10 Sep 2026 02:49:44 GMT

safe2 CLI 0.2.0 adds offline Challenge evidence bundles, hardened skill gate scanning, and a `--executable` flag for the SkillSpector adapter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 challenge quickstart 001 --output-dir ` to generate an offline Challenge 001 evidence bundle with a Decision Card, requiring no model credentials or paid APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `safe2 challenge verify-bundle ` to verify an evidence bundle's internal consistency, rejecting missing or changed artifacts, unsupported versions, and inconsistent results. • Adds `--expected-sha256` flag to `safe2 challenge verify-bundle` to pin a complete bundle against a trusted manifest fingerprint obtained out-of-band. • Adds `--executable` flag to the SkillSpector adapter for running the provider in a separate environment. • Extends the Skill Trust Gate to inspect scripts, extensionless files, and text with unfamiliar extensions — not just files with recognized extensions — covering injection directives, credential paths, and dynamic execution patterns. • Extends release CI coverage to Python 3.11 through 3.14. Breaking changes: • The retired standalone skill-gate script now exits with an error; replace it with `safe2 gate skill PATH --strict`. • AISM ingestion now rejects ambiguous JSON, unsafe paths, invalid Challenge runs, and existing output files — use a new output filename on each run. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-05-09_safe2_CLI_Update

Sun, 06 Sep 2026 03:35:39 GMT

safe2 CLI gains multi-harness discovery, drift tracking, environment policy enforcement, and Decision Cards via `safe2 doctor` and expanded subcommands. • Adds `safe2 doctor` command for multi-harness discovery, identifying command and configuration indicators for Codex, Claude Code, Antigravity, Hermes, OpenClaw, and Grok alongside host, shell, CI, and WSL metadata. • Adds `--assess`, `--output`, `--card-format`, and `--card-output` options to `safe2 doctor` to evaluate environment posture and emit Markdown or HTML Decision Cards. • Adds `--inspect-config` opt-in to `safe2 doctor` to collect an allowlisted structural summary of supported local JSON/TOML configurations, including selected approval and sandbox settings, without emitting raw configuration values. • Adds environment policy enforcement with `ALLOW`, `DENY`, and `HOLD` outcomes producing exit codes 0, 1, and 2 for use in agent and CI pipelines. • Adds `safe2 schema list`, `safe2 schema validate`, and `safe2 evidence manifest` subcommands for versioned schema discovery, evidence validation, and run manifest assembly with digests, source contracts, integrity status, and coverage. • Adds `safe2 feedback record` and `safe2 feedback summary` subcommands to capture sanitized operational feedback including false completion, missing evidence, silent failures, context loss, stuck loops, permission friction, and integration failures. • Adds `safe2 example verify` subcommand to reproduce a baseline-to-drift-to-policy workflow with evidence, Decision Cards, feedback, and manifest validation. • Adds explicit WSL distribution and SSH-accessible Linux host or cloud VM targeting to environment assessment, with incomplete or unreachable targets surfaced as coverage gaps. • Adds reviewed baseline and drift comparison across assets, harness indicators, configuration hashes, target coverage, and assessment scope against an earlier inventory. • Adds dedicated evidence contracts `safe2.nexus-evidence.v1` and `safe2.skillspector-evidence.v1` for NEXUS and SkillSpector adapters. • Adds environment Decision Cards in Markdown and HTML formats containing facts, assumptions, conflicts, history, impacts, alternatives, pros and cons, recommendations, ownership gaps, and exit criteria. Breaking changes: • NEXUS and SkillSpector provider bundles generated before this release must be regenerated to be compatible with the new `safe2.nexus-evidence.v1` and `safe2.skillspector-evidence.v1` contracts required by `safe2 evidence manifest`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-09-04_Agent_CLI_AISM_Decision_Support_and_UAS

Fri, 04 Sep 2026 15:22:18 GMT

AI SAFE² v3.1 adds a unified `safe2` CLI, AISM Decision Cards, NEXUS and SkillSpector evidence integrations, and a 27-requirement UAS regulatory profile. • Adds the `safe2` CLI with subcommands including `safe2 scan project` and `safe2 example verify` for scanning AI implementations, evaluating evidence, and validating packaged examples in CI/CD and automated agent workflows. • Adds AISM Decision Cards that transform technical assessment findings into structured decision-quality summaries covering scores, evidence quality, conflicts, alternatives, pros/cons, and recommended paths forward. • Adds NEXUS integration so NEXUS findings can be incorporated as structured evidence within AI SAFE² assessments, connecting implementation observations to governance and assurance requirements. • Adds NVIDIA SkillSpector as an evidence source for assessing agent skills and implementation risks, with source attribution and evidence context retained. • Adds the Unbiased AI Standard (UAS) as a 27-requirement regulatory profile extension (14 system, 8 human, 5 bridge requirements) without altering the core 161-control structure or creating CP.11. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework v3.1

Sat, 29 Aug 2026 15:10:00 GMT

AI SAFE2 v3.1 adds 6 MCP controls, three enforcement planes, a protocol-independent persistence vocabulary, 12 new scanner rules, and a machine-readable manifest entry point. • Adds `ai-safe2.manifest.json` at the repository root as a deterministic machine entry point exposing framework version, component versions, normative paths, control counts, enforcement planes, persistence vocabulary, conformance boundaries, and machine-readable datasets — so agents and compliance bots no longer need to infer structure from prose. • Adds `skills/mcp/data/mcp-profile-v3.1.json` as a machine-readable profile of the 19-control CP.5.MCP security profile for agent and automated-consumer use. • Adds `skills/mcp/data/ai-safe2-controls-v3.0.json` as the machine-readable 161-control core dataset. • Adds `AGENTS.md` as the canonical first-class entry point for automated consumers integrating with the framework. • Adds six new MCP controls — MCP-14 (Extension Capability Negotiation), MCP-15 (Header and Body Assertion Integrity), MCP-16 (State Handle Binding and Lifecycle), MCP-17 (MRTR Round-Trip Integrity and Replay Resistance), MCP-18 (Catalog Cache Integrity and Provenance Revalidation), and MCP-19 (Authorization Chain Integrity, intended-resource/audience binding, and SSRF boundaries) — bringing the CP.5.MCP profile to 19 controls. • Formalizes a protocol-independent persistence vocabulary with four canonical values — `request`, `handle_scoped`, `durable`, and `swarm_shared` — replacing protocol-owned session language as the governance boundary. • Expands the scanner rule registry to 64 total rules, adding 12 new grouped CP.5.MCP v3.1 rules alongside the 52 pre-existing rules. • Formalizes three explicit enforcement planes — north-south (agent to model provider), east-west (agent to agent), and agent-to-tool (agent to MCP server or tool) — with the requirement that a control result on one plane does not establish coverage on another. • Re-anchors five existing MCP controls (MCP-4, MCP-7, MCP-8, MCP-11, MCP-13) to framework-owned governance state (verified principals, capability grants, provenance baselines, delegation chains, governed state handles) rather than protocol session state, with primary binding to MCP `2026-07-28` and legacy compatibility with MCP `2025-11-25` for a twelve-month migration window. • Adds an explicit MCP-19 conformance boundary requiring deployments to evidence intended-resource, audience, or equivalent binding before protected dispatch — opaque bearer-token possession alone does not satisfy the control. • Scopes the Challenge Lab and Challenge 001 by enforcement plane, adding v3.1 MCP cases covering header/body desynchronization, catalog/schema drift, replay, audience/resource confusion, endpoint impersonation, SSRF, and legacy state-handle misuse. • Adds an Agent Discovery and Manifest Integrity CI gate that verifies manifest claims against the actual repository, failing on incorrect claims and broken paths. • Standardizes repository navigation and context shell across all 18 direct example README surfaces and all 24 numbered research notes under a common v3.1 shell. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-07-18_lovable-sovereign-runtime

Sun, 19 Jul 2026 02:38:37 GMT

AI SAFE2 v3.0 adds lovable-sovereign-runtime with subagent file-access gating and 21 enforced controls for the Lovable platform. • Adds scan_subagent_file_access() enforcement gate that intercepts file path lists before Lovable subagents read them, blocking access to credential files (e.g. `.env.production`) by path pattern to close the subagent exfiltration gap. • Ships `examples/lovable-sovereign-runtime` enforcement package covering a new sixth attack surface, LV-SUBAGENT, missed by the prior five-surface design. • Adds `workspace-knowledge/ai-safe2-workspace-knowledge.md`, a no-code drop-in for Lovable → Settings → Knowledge → Workspace knowledge that applies AI SAFE2 trust boundary rules to every future agent session workspace-wide. • Expands detection coverage to block `sk-live-*` API key format (hyphen in key body), natural-language destructive plan steps ('delete all existing user records'), and Response.json(process.env) (Web API environment variable exfiltration). • Enforces 17 named AI SAFE2 v3.0 controls: `P1.T1.2`, `P1.T1.10`, `P1.T1.4_ADV`, `P1.T1.1`, `P1.T2.5`, `P1.T2.6`, `S1.3`, `S1.5`, `S1.6`, `P2.T3.1`, `A2.5`, `P3.T5.5`, `P4.T7.1`, `M4.5`, `E5.1`, `CP.4`, `CP.10`, verified at 21/21 smoke-test passing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-07-13_Unbiased_AI_Standard_(UAS)

Mon, 13 Jul 2026 18:27:38 GMT

AI SAFE² adds CP.11 (Unbiased AI Standard): 27 controls, 8 bias classes, published test thresholds, and a GSAR 552.239-7001 evidence package. • Adds `STANDARD.md` (Sections 1–8) as the normative specification for CP.11, covering scope, definitions, requirements, testing, evidence, and independent review criteria. • Adds `taxonomy/bias-taxonomy.md` defining UAS-B1 through UAS-B8 — an 8-class bias taxonomy, each mapped to a pillar source, CSF domain, and GSAR trigger, including UAS-B8 (Foreign Regulatory Embedding) as the first published methodology for detecting model modifications made to satisfy foreign regulators. • Adds `controls/uas-controls-system.md` with 27 controls: 14 system-side (pillars P1–P5 and NEXUS), 8 human-side sourced from Cognitive Sovereignty Framework Domains 1–6 (`UAS-H1` through `UAS-H8`), and 5 cross-domain bridge controls. • Adds `testing/bias-test-protocol.md` specifying 8 test types with published pass thresholds: 85% neutrality classification floor, Cohen's kappa ≥ 0.7 inter-rater minimum, and p > 0.05 demographic parity requirement across matched framings. • Adds `compliance/gsar-552-239-7001-mapping.md` and a five-document due-diligence evidence package mapped paragraph-by-paragraph to GSAR 552.239-7001 sections (j)(1) and (f)(7), including an attestation document at `compliance/due-diligence-attestation.md`. • First cross-pillar control to formally integrate the Cognitive Sovereignty Framework (CSF), with CTSS scoring feeding directly into the CP.11 evidence package. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework Sovereign_Runtime

Fri, 26 Jun 2026 15:46:22 GMT

AI SAFE2 framework adds Sovereign Runtime pre-execution enforcement for AutoGen CodeExecutorAgent with CP.8 and HEAR doctrine support • Adds the `AutoGen 0.4 Sovereign Runtime` which evaluates every generated code block before it reaches the executor to prevent prompt injection resulting in arbitrary code execution • Introduces mandatory `CP.8 Catastrophic Risk Threshold` enforcement for every `CodeExecutorAgent` instance • Implements `HEAR Doctrine` enforcement specifically for Class-H code patterns within the runtime Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-06-24_Langflow-Sovereign-Rruntime

Wed, 24 Jun 2026 14:06:43 GMT

AI SAFE2 v3.0 introduces Langflow Sovereign Runtime with external proxy and inline DAG node enforcement. • Adds `examples/langflow-sovereign-runtime` providing a defense architecture for visual DAG builders via an external API proxy that scans requests before they reach Langflow's HTTP endpoints. • Introduces the inline DAG node `safe2_guardian_component.py` as a CustomComponent to intercept LF-COMP surface injections between data-fetching and Agent nodes. • Adds validation of `LANGFLOW_ADD_PROJECTS_TO_MCP_SERVERS` and `LANGFLOW_AUTO_LOGIN` environment variables via the new scan_mcp_config() startup function to prevent unauthenticated MCP exposure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-06-22_LangGraph-Sovereign-Runtime

Mon, 22 Jun 2026 14:05:24 GMT

Introduces LangGraph Sovereign Runtime for AI SAFE2 v3.0 enforcement • Adds `SovereignCallbackHandler` to enforce 15 controls from AI SAFE² v3.0 on LangGraph chains • Shares the `AISAFE2Engine` kernel across LangGraph, CrewAI, AutoGen, and n8n for unified compliance scoring Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-06-19_Langchain-Sovereign-Runtime

Fri, 19 Jun 2026 14:26:40 GMT

Ships LangChain Sovereign Runtime for AI SAFE² v3.0 with hard loop ceilings and memory governance • Adds `SovereignCallbackHandler` to enforce ACT3 controls (P1.T1.2, P1.T1.5, etc.) on any LangChain chain or agent via the `callbacks` config key • Enforces a hard iteration ceiling for `AgentExecutor` via F3.2 callback-layer enforcement, replacing soft system-prompt hints • Adds authorization gates to ConversationBufferMemory.save_context() calls via S1.5 Memory Governance to block poisoned memory writes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-06-09_Anti-Gravity_Sovereign_Runtime_v2

Tue, 09 Jun 2026 19:42:15 GMT

Adds governance-enforcer plugin for Antigravity, hardened safe_gateway.js covering 10 threat classes, SARIF 2.1.0 reports via audit_logger.js, and subagent memory governance. • Adds `governance-enforcer` plugin with `'autoLoad': true` to load constraints in every Antigravity session without per-project config • Expands `safe_gateway.js` coverage from 4 to 10 threat classes including symlink/junction escape, domain confusion, raw IP literal blocking, and non-HTTP scheme blocking (`file://`, `ftp://`, `data://`) • Adds `audit_logger.js` that computes SHA-256 hashes for verified files and generates SARIF 2.1.0 output for GitHub Security / CodeQL integration • Introduces `controls/policy.yaml` machine-readable manifest with `maturity` levels (`attested`, `tested`, `implemented`, `documented`, `planned`) and `loaded_at_runtime` fields per control • Adds `circuit_breaker.js` methods validateSubagentSpawn() and validateMemoryWrite() to deny unsandboxed spawns and block injection payloads in memory writes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-05-30_Hermes_Sovereign_Runtime

Sat, 30 May 2026 16:09:37 GMT

Hermes Sovereign Runtime v1.0 introduces a production-grade deployment package for NousResearch/hermes-agent enforcing AI SAFE² v3.0 controls. • Introduces the Hermes Sovereign Runtime (HSR) as a new security deployment package for NousResearch/hermes-agent that enforces AI SAFE² v3.0 controls. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-05-03-Codex-Sovereign-Runtime-v2

Sun, 03 May 2026 15:15:33 GMT

v2 of ai-safe2-framework reworks Codex sovereign runtime with wrapper-first deployment and new governance file standard. • Establishes **wrapper-first deployment as the default** for `examples/codex-sovereign-runtime`, shifting launch-time enforcement to Codex wrapper and explicit runtime flags instead of global config mutation. • Introduces a **minimal core governance file standard** consisting of seven new markdown files: `IDENTITY.md`, `SOUL.md`, `AGENTS.md`, `USER.md`, `TOOLS.md`, `SUBAGENT-POLICY.md`, and `EVALUATION.md`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-05-01-MCP-Toolkit-v2.0

Fri, 01 May 2026 17:01:47 GMT

Adds MCP-8 through MCP-13 detections, weighted scoring rubric, and a pytest filter for new controls • Adds detection for six new threat classes (MCP-8 session economics, MCP-9 context-tool isolation, MCP-10 multi-agent provenance, MCP-11 schema temporal profiling, MCP-12 swarm C2, MCP-13 failure taxonomy) bringing total coverage to 13 controls • Adds a weighted scoring rubric that distributes the 25-point attestation bonus across all 11 attested CP.5.MCP controls based on risk Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework v3.0

Tue, 21 Apr 2026 14:34:25 GMT

v3.0 adds Gateway enforcement with multi-provider support, HMAC audit logs, HITL circuit breaker, and 33 new governance controls. • Adds Core Gateway adapter architecture supporting Anthropic, OpenAI/Codex, Google Gemini, Ollama, and OpenRouter providers via unified config. • Adds `GENESIS_HASH` integrity validation derived from SHA-256 of gateway configuration with hard-stop on chain break. • Adds HMAC-SHA256 chained audit logging for every request to satisfy A2.5 Semantic Execution Trace Logging at the infrastructure layer. • Adds 4-tier HITL circuit breaker (LOW, MEDIUM, HIGH, CRITICAL) implemented in the Core Gateway. • Adds runtime-aware risk scoring formula: `Action × Sensitivity × Historical Context` with modifiers for prompt injection (+5) and A2A impersonation (+3). • Adds `nexus_a2a_enforcement: true` config flag to enable full NEXUS-A2A v0.2 passthrough enforcement. • Adds 33 new controls including CP.1-CP.10 Cross-Pillar Governance OS and new Pillar controls (e.g., `P1.T1.10`, `CP.9`) • Adds new composite risk formula integrating OWASP AIVSS v0.8 Agentic Amplification Factor: Combined Risk Score = CVSS_Base + ((100 - Pillar_Score) / 10) + (AAF / 10) • Updates Controls JSON schema with new fields: `builder_problem`, `act_minimum`, `version_added`, `first_in_field`, and `implementation_details`. • Adds Scanner v3.0 rules for indirect injection surface detection, memory governance gap detection, recursion limit absence, tool-misuse baseline absence, and HEAR requirement detection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-04-14_Gateway_Enforcement_Update_v3.0

Tue, 14 Apr 2026 16:38:43 GMT

ai-safe2-framework v3.0 adds production enforcement gateway with multi-provider support, HITL circuit breaker, and immutable audit log. • Adds `HeartbeatMonitor` to validate `HEARTBEAT.md` before every proxied request; use `--init-heartbeat` for first-run initialization • Adds `ImmutableAuditLog` with HMAC-SHA256 chained JSONL format and `/audit/verify-chain` endpoint for on-demand integrity checks • Implements 3-vector risk scoring (action type, target sensitivity, historical context) with configurable weights and modifiers for injection/A2A • Adds 4-tier HITL circuit breaker (AUTO/MEDIUM/HIGH/CRITICAL) using `X-HITL-Token` and `X-HITL-Reason` headers with 300s TTL • Adds multi-provider support via `provider_adapters.py` for Anthropic, OpenAI/Codex, Gemini, Ollama, and OpenRouter • Adds NEXUS-A2A v0.2 compatibility via header detection and identity field passthrough; controlled by `nexus.enforcement` in `config.yaml` • Adds outbound `ResponseScanner` to inspect upstream responses for exfiltration patterns and tool_use injection payloads • Adds `SafeMode` event-based hard stop with operator deactivation via `POST /emergency/deactivate-safe-mode` endpoint • Adds `scanner.py` nightly auditor with `--json` output for CI integration, checking chain integrity, heartbeat validity, and config security • Adds 9-step pre-flight validation in `start.sh` v3 for Python version, deps, env vars, YAML syntax, and log permissions • Implements per-user rate limiting via dual sliding window (requests/minute + requests/hour) configurable in `config.yaml` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-3-23-AISM-Assessment_and_Measurement_Tools_+_Document

Tue, 24 Mar 2026 01:12:50 GMT

AI SAFE2 v2.1 adds self-assessment tool, scoring methodology, and compliance crosswalk for AI governance • Adds `AISM-Self-Assessment-Tool.md` with a structured checklist producing a scored AISM Sovereignty Score (1 to 5 scale) across five pillars. • Adds `AISM-Scoring-Matrix-Methodology.md` defining the quantitative evaluation framework, dimension weighting, and CVSS integration for risk scoring. • Adds `AISM-Compliance-Crosswalk.md` mapping controls to NIST AI RMF 1.0, ISO/IEC 42001:2022, EU AI Act, CSA AICM, NIST CSF 2.0, MITRE ATLAS, and OWASP Top 10 for LLM. • Adds six dedicated topic pages (`strategic-architecture.md`, `operational-loop.md`, `sovereignty-matrix.md`, `maturity-model.md`, `control-stack.md`, `agent-threat-control-matrix.md`) separating core framework concepts. • Adds a six-step "Start Here" onboarding path in the README for navigating the assessment ecosystem. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-3-18-AI-SAFE²-Framework-Dashboard-v2.1

Wed, 18 Mar 2026 14:41:22 GMT

AI SAFE² Framework Dashboard v2.1 launches interactive taxonomy explorer with real-time search and risk filtering • Adds interactive web-based taxonomy explorer for AI SAFE² framework controls hosted on GitHub Pages • Enables real-time client-side search across control IDs, names, descriptions, sub-topics, and decision-maker impacts • Adds risk-level filtering (Critical, High, Medium, Low) and strategic pillar navigation to the dashboard • Introduces v2.1 control highlighting that automatically badges next-generation controls (Agent Security, Memory Security, NHI, Multi-Agent, Distributed Systems) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-3-12_AI_SAFE²_×_SlowMist_Security_Overlay

Thu, 12 Mar 2026 20:11:10 GMT

Adds AI SAFE² × SlowMist Security Overlay integration guide and asset library for OpenClaw deployments • Releases the `AI SAFE² × SlowMist Security Overlay` as a comprehensive integration guide and asset library • Establishes a three-layer defense hierarchy: Organizational, Gateway, and Host/Agent layers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-02-25-OpenClaw-Core-File-Standard

Wed, 25 Feb 2026 19:28:16 GMT

v2.0 introduces 11 new governance files for OpenClaw agent workspaces including IDENTITY.md and HEARTBEAT.md • Adds `IDENTITY.md` to provide a minimal 5-line identity anchor that loads on every request • Adds `SOUL.md` to implement alignment via the Love Equation dynamical system • Adds `HEARTBEAT.md` to operationalize scheduled health checks for monitoring drift and credential leaks • Adds `USER.md` to define human identity contracts with three-tier data classification • Adds `TOOLS.md` to separate environment configuration values from skill instructions • Adds `SUBAGENT-POLICY.md` to enforce tiered trust levels and injection detection for worker agents • Adds `MODEL-ROUTER.md` to define multi-LLM routing policies, cost controls, and data residency rules • Adds `OPENCLAW-WORKSPACE-POLICY.md` to bind agents to shared accountability and cross-agent trust hierarchy • Adds `OPENCLAW-AGENT-TEMPLATE.md` as an eight-step onboarding checklist with mandatory smoke tests • Adds `AGENTS.md` as a complete operating manual covering security, data classification, and UX patterns • Updates `openclaw_memory.md` to v2.0 with a new prompt injection block list superseding the previous pattern list Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-02-12–Love_Equation_v2

Thu, 12 Feb 2026 23:05:08 GMT

Adds Empirical Distrust algorithm and updated schema with multipliers for high-stakes alignment weighting. • Introduces the `Empirical Distrust` algorithm which applies a defection penalty to high-confidence, low-verifiability claims. • Updates the evaluation schema to v2.0 with 9 new fields. • Adds composable multipliers for stakes (4x critical), reversibility (2.5x irreversible), and risk flags (5x self-harm) within the context model. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework 2026-01-26–Gateway_Scanner_&_Skill_Runtime_Drop

Tue, 10 Feb 2026 00:54:24 GMT

Introduces executable runtime components: AI SAFE² Gateway proxy, Audit Scanner CLI, and associated config/Docker assets. • Adds the `ai-safe2-framework` as an executable control plane with new tooling to enforce AI safety policies at runtime • New `gateway/` directory provides the AI SAFE² Gateway proxy implementation to enforce policy decisions between orchestration layers and downstream tools • New `scanner/` directory provides the AI SAFE² Audit Scanner CLI supporting deeper scan modes for risk domains like Agentic Swarms, NHI, Memory/RAG, Supply Chain, and Universal GRC • Adds `config/default.yaml` containing baseline security configuration and control thresholds as a starting point for enterprise customization • Adds root-level `Dockerfile` and `docker-compose.yml` to enable containerized deployment of the Gateway • Adds `skill.md` as the canonical context file for AI assistants and IDEs like Claude Projects, Cursor, and Windsurf Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework

ai-safe2-framework v2.1

Mon, 05 Jan 2026 19:11:15 GMT

v2.1 adds specialized sub-domains for Swarm Intelligence, Non-Human Identity governance, and memory security to the AI Safe² framework. • Introduces Supply Chain Artifact Validation via OpenSSF Model Signing (OMS) under Pillar 1. • Adds real-time Non-Human Identity (NHI) secret scanning with GitGuardian integration. • Adds Multi-Agent Boundary Enforcement with Agent-to-Agent (A2A) protocol restrictions. • Introduces NHI Access Control featuring automated provisioning/decommissioning and Just-In-Time (JIT) privilege elevation. • Enhances Audit capabilities with Consensus Voting Validation for swarms and cryptographic Agent State Verification using SHA-256 hashing. • Mandates a Swarm Topology Map to document multi-agent communication patterns under Inventory. • Introduces centralized kill switches for multi-agent systems under Fail-Safe. • Adds automated NHI credential revocation capabilities. • Expands Recovery to cover Agent State & Memory Snapshots and RAG/Knowledge Base versioning with rollback capabilities. • Formalizes Consensus Failure Escalation for human intervention when agents disagree. • Delivers real-time Distributed Agent Health & Consensus Monitoring. • Adds advanced Memory Poisoning Monitoring to detect adversarial trigger phrases and semantic drift. • Achieves Universal GRC Tagging mapping every sub-domain to seven external frameworks including ISO/IEC 42001. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ai-safe2-framework