presidio-hardened-ai

https://github.com/presidio-v/presidio-hardened-ai/blob/main/SECURITY.md#supported-versions states which lines are supported (0.32.x; nothing earlier was published); https://github.com/presidio-v/presidio-hardened-ai/blob/main/SEMVER.md documents what counts as a breaking change and the signed-payload stability rules; MIGRATION.md covers the 0.31 → 0.32 ledger change.

GitHub Issues: https://github.com/presidio-v/presidio-hardened-ai/issues.

https://github.com/presidio-v/presidio-hardened-ai/blob/main/SECURITY.md#reporting-a-vulnerability — reporters are credited in the advisory and the CHANGELOG.md entry for the fix unless they ask not to be. No external report has been received yet.

https://github.com/presidio-v/presidio-hardened-ai/blob/main/SECURITY.md#reporting-a-vulnerability — private GitHub Security Advisory or email intake, acknowledgement within 5 business days, fix target 30 days, fixes to signed payload schemas coordinated with the consuming verifiers before disclosure. Applied on 2026-11-03: two maintainer-found issues were fixed in a private advisory fork and released as 0.32.1 before GHSA-7rj4-g3c7-mgh2 and GHSA-hgv4-xx36-g3vf were published.

https://github.com/presidio-v/presidio-hardened-ai/blob/main/CONTRIBUTING.md#style — ruff (lint and format, configured in pyproject.toml: line length 100, target Python 3.11). The Rust crate has no enforced formatter or linter yet (on the roadmap).

ruff check and ruff format --check run in CI on every PR inside the required test check.

The distributed package is pure Python built by hatchling; no compiler or linker is invoked. The optional Rust [zk] extension is built locally by maturin/cargo and is not distributed on PyPI.

No compiled artefacts are distributed; the wheel is pure Python (py3-none-any).

A single PEP 517 build; there is no make or subdirectory build.

Both release files are bit-for-bit reproducible: on 2026-11-03, rebuilding v0.32.1 from the tagged source (git archive v0.32.1, uv build --sdist with .github/constraints/release-build.txt) gave the PyPI sdist exactly (SHA-256 27253779…), and building the wheel from that sdist twice gave the PyPI wheel exactly (6418df6a…). Release builds use a hash-pinned backend and SHA-pinned Actions.

pip install presidio-hardened-ai from PyPI, with optional extras ([nlp], [torch], [mpc], [crypto], [gate]).

Installed via pip; DESTDIR-style conventions do not apply.

https://github.com/presidio-v/presidio-hardened-ai/blob/main/CONTRIBUTING.md#local-verification — create a venv, pip install -e ".[dev]", then the ruff and pytest commands; maturin and cargo commands for the [zk] lane.

https://github.com/presidio-v/presidio-hardened-aiListed machine-readably in pyproject.toml (runtime: typer, presidio-evidence; optional extras for NLP, torch, MPC, crypto and gate verification) and rust/Cargo.toml with Cargo.lock; release, fuzz and SBOM toolchains are hash-pinned in .github/constraints/*.txt. A CycloneDX SBOM of the runtime dependencies is generated, attested and attached to each release by publish.yml.

Dependabot (pip, cargo, GitHub Actions) with security updates enabled; pip-audit on every push and PR (ci.yml); OpenSSF Scorecard weekly.

All reused components are PyPI or crates.io packages installed by the package manager (no vendored copies; tests/vectors/ are verbatim test fixtures with recorded provenance); Dependabot tracks pip, cargo and GitHub Actions updates.

Dependencies are kept current by Dependabot (pip, cargo, Actions) with security updates enabled; ruff's UP rules flag outdated Python idioms.

https://github.com/presidio-v/presidio-hardened-ai/blob/main/.github/workflows/ci.yml runs the full suite on every push and PR (full gate on Python 3.11 with coverage and pip-audit, tests on 3.12 and 3.13), including end-to-end CLI tests and the presidio-evidence golden vectors; ci-mpc.yml, ci-torch.yml and ci-zk.yml run the [mpc], [torch] and native [zk] lanes; fuzz.yml runs the Atheris harnesses.

Policy requires a regression test with every bug fix. In the last 6 months the product-code fixes carry them: the pre-publication review fixes (PR #81, tests across ledger, budget, CLI, consortium, secure-aggregation, transport and ZK modules), the two 0.32.1 advisory fixes (7 tests, all failing on 0.32.0), the runtime version fix (PR #72), and the ledger-parsing and digest-comparison fixes in PR #83 (24 tests). The one fix without a test (PR #73) corrected README examples.

CI gate: 85% statement coverage ([tool.coverage.report] fail_under = 85 in pyproject.toml, applied by pytest --cov=presidio_ai in .github/workflows/ci.yml); measured 89.8% on 2026-11-03 in the base dev install.

Formal written policy at https://github.com/presidio-v/presidio-hardened-ai/blob/main/CONTRIBUTING.md#tests: functionality changes ship with tests; bug fixes include a regression test that fails before the fix. Enforced in review (required code-owner review) and by the CI coverage floor.

https://github.com/presidio-v/presidio-hardened-ai/blob/main/CONTRIBUTING.md#tests states the policy that changes adding/modifying functionality ship with tests in the same PR.

ruff with E, F, I, B, UP and S (flake8-bandit); exclusions are documented in pyproject.toml (B008 for Typer defaults, S101 in tests/ and fuzz/, N802 in fuzz/). CI fails on any finding.

Fail-safe defaults: ledger, budget, authorization, gate certificates, VSS, proofs and the wire decoder all raise or refuse on bad input. Refusals happen before side effects: an over-budget, unauthorised or ungated charge writes nothing, and since 0.32.1 a consortium round is authorized before anything is computed. Complete mediation: every charge goes through EpsilonBudget.charge, which re-verifies the chain. Least privilege: 0600/0700 files, commitments-only ledger, plaintext transport only on loopback. Economy of mechanism: one canonical encoder (from presidio-evidence) for every hash, MAC and signature. See https://github.com/presidio-v/presidio-hardened-ai/blob/main/ASSURANCE.md#3-secure-design-principles-applied.

Security functions use SHA-256, HMAC-SHA256, Ed25519, X25519/HKDF-SHA256 and groups of at least 112-bit strength (RFC 3526 2048-bit MODP, Ristretto255); no MD5, SHA-1 or DES.

The evidence signature algorithm is selectable (ed25519 default, hmac-sha256), and the commitment and proof backend is pluggable (native Ristretto255 + Bulletproofs when the [zk] extension is installed, otherwise the 2048-bit MODP backend; a call site can pass an explicit backend). The content-hash function (SHA-256) is fixed by the shared evidence wire format; replacing it would be a new schema major in presidio-evidence, not a runtime switch.

No key is in the source tree (test keys under tests/ are documented as test-only). The ledger key comes from PRESIDIO_AI_LEDGER_KEY or an explicit argument, signing keys from operator-supplied files, approver and identity trust stores from operator-supplied configuration, so every credential rotates without a new release.

The only network component is the optional [mpc] coordinator serve(): it serves HTTPS when given ssl_certfile/ssl_keyfile and refuses to bind a non-loopback address without them (check_bind, tested in tests/test_transport.py). Every message is also Ed25519-signed end to end.

serve() uses Python's TLS server defaults through uvicorn, whose minimum protocol is TLS 1.2 (ssl.SSLContext(PROTOCOL_TLS_SERVER).minimum_version, checked on Python 3.11).

The package contains no TLS client.

The package contains no TLS client.

Wheel, sdist and CycloneDX SBOM carry GitHub build-provenance attestations (gh attestation verify <file> --repo presidio-v/presidio-hardened-ai), PyPI files carry PEP 740 attestations from Trusted Publishing, and release tags are SSH-signed with the public key in https://github.com/presidio-v/presidio-hardened-ai/blob/main/allowed_signers. Documented at https://github.com/presidio-v/presidio-hardened-ai/blob/main/SECURITY.md#verifying-releases-and-obtaining-public-signing-keys. Checked for v0.32.0 and v0.32.1 on 2026-11-03.

Every release tag (v0.32.0, v0.32.1; earlier versions were never published or tagged) is SSH-signed with the organisation release key and shown as Verified on GitHub; git -c gpg.ssh.allowedSignersFile=allowed_signers verify-tag <tag> checks it locally.

All external input is untrusted: sanitize.py bounds and allow-lists identifiers and paths (length limits, no control/NUL bytes); ledger lines are type-checked field by field before verification; decode_submission validates party id, vector length and that every element is a canonical field element; gate certificates and approvals are verified against local trust stores. Failures raise before any state changes. See ARCHITECTURE.md#trust-boundaries.

Ledger files 0600 in 0700 directories; a keyed MAC is mandatory; MAC and signature comparison is constant-time; serve() refuses plaintext HTTP beyond loopback and serves TLS with Python's defaults; structural-only security log (~/.presidio-ai/security.log); per-session operation limit (PRESIDIO_AI_MAX_OPS). Supply chain: SHA-pinned GitHub Actions with least-privilege permissions:, hash-pinned release toolchains, Trusted Publishing behind a two-reviewer release environment with self-review prevented, branch protection with required code-owner review, secret scanning with push protection.

URL: https://github.com/presidio-v/presidio-hardened-ai/blob/main/ASSURANCE.md. Threat model with out-of-scope assumptions and known limitations, trust boundaries matching ARCHITECTURE.md#trust-boundaries, the secure-design-principles argument and the common-weakness argument. It states that the pre-publication review was tool-assisted and run by the maintainer, and that the pure-Python commitment and proof code has had no independent cryptographic review.

CodeQL for Python (https://github.com/presidio-v/presidio-hardened-ai/blob/main/.github/workflows/codeql.yml) on every push/PR and weekly, and ruff's S (flake8-bandit) security rules in the required test check; OpenSSF Scorecard (scorecard.yml) weekly and on every push to main.

Python is memory-safe and the Rust [zk] extension has no unsafe blocks in rust/src. The Atheris harnesses (fuzz/, fuzz.yml) run regardless; their first CI run found a TypeError in digest comparison, fixed in PR #83.