Harden runtime replay safety, provenance, serialization, and CI

.github/workflows/ci.yml

@@ -77,8 +77,33 @@ jobs:
       - run: pip install -c constraints/ci.txt -e .[dev]
       - name: Ruff correctness gate
         run: ruff check agentweave agentweave_byom agentweave_security tests
-      - name: Mypy typed-surface gate
-        run: mypy agentweave/runtime_types.py agentweave_security/authorization.py
+      - name: Ruff security-sensitive bug-pattern gate
+        run: >-
+          ruff check
+          agentweave/runtime.py
+          agentweave/runtime_hardened.py
+          agentweave/runtime_types.py
+          agentweave/safe_http.py
+          agentweave_security/authorization.py
+          agentweave_security/scope_filter.py
+          --select E9,F63,F7,F82,B006,B008,B023
+      - name: Mypy security-sensitive typed-surface gate
+        run: >-
+          mypy
+          agentweave/runtime_types.py
+          agentweave/runtime_hardened.py
+          agentweave/safe_http.py
+          agentweave_security/authorization.py
+          agentweave_security/scope_filter.py
+      - name: Bandit security gate
+        run: >-
+          bandit -q -ll
+          agentweave/runtime.py
+          agentweave/runtime_hardened.py
+          agentweave/runtime_types.py
+          agentweave/safe_http.py
+          agentweave_security/authorization.py
+          agentweave_security/scope_filter.py
 
   reproducible-python:
     runs-on: ubuntu-latest
@@ -93,4 +118,8 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - run: pip install -c constraints/ci.txt -e .[dev]
       - run: python -m pip check
-      - run: pytest -q tests/test_runtime_hardening_v07.py tests/test_security_hardening.py
+      - run: >-
+          pytest -q
+          tests/test_runtime_hardening_v07.py
+          tests/test_runtime_replay_provenance.py
+          tests/test_security_hardening.py

agentweave/__init__.py

@@ -28,7 +28,6 @@
     PluginManager,
 )
 from .runtime import (
-    AgentWeaveRuntime,
     CallableExecutor,
     CatalogProvider,
     DefaultScopePolicy,
@@ -41,6 +40,7 @@
     ToolSearchProvider,
     normalize_model_response,
 )
+from .runtime_hardened import AgentWeaveRuntime
 from .runtime_types import (
     ModelResponse,
     RunContext,

agentweave/application.py

@@ -4,8 +4,8 @@
 from typing import Any, Mapping
 
 from .config import RuntimeConfig, RuntimeFactory
+from .runtime_hardened import AgentWeaveRuntime
 from .plugins import PluginManager
-from .runtime import AgentWeaveRuntime
 from .safe_http import SafeHttpTransport
 
 

agentweave/composition.py

@@ -4,7 +4,8 @@
 import re
 from typing import Any, Mapping, Sequence
 
-from .runtime import AgentWeaveRuntime, CatalogProvider, Executor
+from .runtime import CatalogProvider, Executor
+from .runtime_hardened import AgentWeaveRuntime
 from .runtime_types import RunContext, ToolCall, ToolResult, ToolSpec
 
 

agentweave/config.py

@@ -7,7 +7,7 @@
 from typing import Any, Mapping
 
 from .plugins import ComponentRegistry
-from .runtime import AgentWeaveRuntime
+from .runtime_hardened import AgentWeaveRuntime
 from .safe_http import SafeHttpTransport