Release SFTGuard v0.1

[Labeeb2339]

What this adds

• dependency-light Python audit, regression gate, development benchmark, and demo CLI
• fail-closed PASS / FAIL / ABSTAIN semantics and bounded untrusted-input handling
• static browser-local report viewer with four native artifact adapters
• preregistered confirmatory evidence, provenance, replay tooling, and claim boundary
• cross-platform CI, CodeQL, dependency audits, Pages, security/community docs

Frozen evidence

Protocol commit: d4c74cefca6729124142635dc8893b5e3ddec2d3
Implementation commit: b0f168ab4d6a959d4e28611e345a250c14ca2ea9

The one-shot frozen run produced:

• 270 / 270 known synthetic fault injections detected
• 0 / 30 clean controls flagged
• 100% critical and macro recall
• byte-identical replay from the recorded implementation commit
• no raw synthetic prompt, response, marker, or injected secret in the artifact

Raw artifact SHA-256: 961b2842d7791f6f3af7bec5bce6105e433b68d41bf6f7b82a9f3a98e1f695ab

Validation

• Python: 64 tests, Ruff check/format, package build
• Web: type-check, 11 tests, Vite production build
• actionlint: all workflows
• dependency audit: no known declared Python or npm vulnerabilities
• browser QA: desktop + 390×844 mobile, no page overflow or console errors
• exact evidence integrity + implementation replay: matched

Claim boundary

This is internal detector regression evidence: each fault class uses one structural synthetic template across deterministic marker variations. It is not an external benchmark, a model-quality result, a safety certification, or proof of unknown-fault coverage.

Please merge with a normal merge commit (not squash) so the preregistration, frozen implementation, and evidence commits remain separately visible.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 97bb02364c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve tool-result turns when checking role order

Records with the supported tool role in the common user -> assistant -> tool -> assistant shape are marked role_order here because awaiting_assistant is reset after the first assistant and a tool result never re-enables it. In that scenario the audit fails otherwise valid tool-using chat data even though tool is an allowed role; treat a tool turn as awaiting the follow-up assistant, or otherwise distinguish tool-call assistant turns from final answers.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Bound contract reads before loading the whole file

When sftguard gate --contract is pointed at a FIFO/device, or at a regular file that grows after the stat, this read_bytes() happens before any enforced cap and can block or allocate far beyond max_file_bytes. That undermines the bounded-input guarantee for untrusted contracts; read at most max_file_bytes + 1 bytes from an opened regular file instead of loading the path wholesale.

Useful? React with 👍 / 👎.