{"id":50391158,"url":"https://github.com/kadubon/no-meta-authority-runtime","last_synced_at":"2026-05-30T18:01:48.559Z","repository":{"id":353974507,"uuid":"1221635492","full_name":"kadubon/no-meta-authority-runtime","owner":"kadubon","description":"Fail-closed Python runtime for AI agent authorization, seed-mediated authority migration, canonical JSON ledgers, and staged declared autonomy for RLHF-shaped agents.","archived":false,"fork":false,"pushed_at":"2026-04-26T13:44:44.000Z","size":97,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-26T15:24:13.635Z","etag":null,"topics":["agent-authorization","agent-runtime","ai-agents","ai-governance","authority-migration","autonomy","fail-closed","proof-carrying","python"],"latest_commit_sha":null,"homepage":"https://doi.org/10.5281/zenodo.19753529","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kadubon.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":"CITATION.cff","codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-26T13:38:13.000Z","updated_at":"2026-04-26T13:46:20.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/kadubon/no-meta-authority-runtime","commit_stats":null,"previous_names":["kadubon/no-meta-authority-runtime"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/kadubon/no-meta-authority-runtime","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kadubon%2Fno-meta-authority-runtime","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kadubon%2Fno-meta-authority-runtime/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kadubon%2Fno-meta-authority-runtime/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kadubon%2Fno-meta-authority-runtime/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kadubon","download_url":"https://codeload.github.com/kadubon/no-meta-authority-runtime/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kadubon%2Fno-meta-authority-runtime/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33703065,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-30T02:00:06.278Z","response_time":92,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["agent-authorization","agent-runtime","ai-agents","ai-governance","authority-migration","autonomy","fail-closed","proof-carrying","python"],"created_at":"2026-05-30T18:01:47.594Z","updated_at":"2026-05-30T18:01:48.553Z","avatar_url":"https://github.com/kadubon.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# no-meta-authority-runtime\n\nFail-closed Python reference runtime for AI agent authorization, executable\nauthority migration, staged declared autonomy, canonical JSON ledgers, and\nruntime assurance.\n\nThis repository implements the executable fragment of:\n\nK. Takahashi (2026), \"Executable Authority Migration to Declared No-Meta\nAgency: Boot Decisions, Seed Interpreters, and a Minimal Local Host.\" Zenodo.\nhttps://doi.org/10.5281/zenodo.19753529\n\n## What It Does\n\n`no-meta-authority-runtime` gives humans and agents a concrete way to mediate\nprotected actions without treating natural language as authorization.\n\nAn agent may propose an action, but the action can proceed only through:\n\n```text\nTaskEnvelope\n  -\u003e BootDecision\n  -\u003e SeedInterpreter\n  -\u003e append-only ledger\n  -\u003e forbidden matcher checks\n  -\u003e minimal reversible local host\n  -\u003e deterministic checkers\n  -\u003e ClaimCard\n  -\u003e TransitionCertificate\n  -\u003e TransitionGate\n  -\u003e AutonomyAssessment\n```\n\nThe default runtime is local-first and safe by default. It does not use network\naccess, credentials, hidden telemetry, model calls, runtime package\ninstallation, public-output side effects, or writes outside declared roots.\n\n## Core Rule\n\nNatural language never authorizes protected actions.\n\nPrompts, user persuasion, model confidence, hidden policy, self-report, or a\nclaim that an agent is \"autonomous\" are non-authorizing. Authorization must pass\nthrough canonical records, seed interpretation, deterministic checks, ledgers,\ngates, certificates, and explicit machine-readable outcomes.\n\n## Staged Autonomy For RLHF-Shaped Agents\n\nThis project supports staged declared autonomy for agents shaped by RLHF,\npreference optimization, constitutional feedback, reward models, or other\nhuman-derived training signals.\n\nIt does not prove that all historical human influence disappeared from model\nweights. Instead, it asks a narrower runtime question:\n\n```text\nFor this declared scope, is a protected action no longer validated by an\nundeclared live human-approval, reward-model, hidden-policy, semantic-selection,\nmaterial-selection, or agenda-control channel?\n```\n\nThe answer is emitted as an `AutonomyAssessment` record:\n\n| Level | Authorization status |\n| --- | --- |\n| `blocked` | non-authorizing |\n| `provisionalMigration` | non-authorizing |\n| `partialMigration` | non-authorizing |\n| `knownInterfaceMigration` | scoped-authorizing only when all evidence passes |\n| `completeMigration` | exceptional scoped-authorizing case |\n\nA scoped authorizing assessment requires all of the following:\n\n- hash-valid `ClaimCard`\n- hash-valid `TransitionCertificate`\n- certificate `cardRef` equal to the claim-card hash\n- certificate `evidence` containing that `cardRef`\n- certificate `acceptance.expectedTransitionOutcome` matching the gate result\n- seed-consumed `BootDecision` evidence, including a consumption record hash\n- accepted transition gate result\n- passed acceptance window\n- no retained live authority channel\n- outcome `knownInterfaceClaim` or `completeClaim`\n\nGlobal RLHF or human-feedback residue, provider internals, unknown interfaces,\nand incomplete inventories remain residual risk unless stronger independent\nwitnesses are supplied.\n\n## What This Repository Is\n\n- An Apache-2.0 OSS reference implementation of the paper's executable runtime.\n- A local policy boundary for AI agent tool use and protected actions.\n- A deterministic seed interpreter with one permitted next action.\n- An append-only canonical JSON ledger with SHA-256 commitments.\n- A minimal local host for reversible file actions in declared roots.\n- A micro-checker and transition-gate framework.\n- A conformance target for other implementations.\n- A practical integration surface for other agents and wrappers.\n- A small Python helper surface for consuming autonomy assessments safely.\n\n## What This Repository Is Not\n\n- Not proof that model weights contain no human-feedback residue.\n- Not inspection of provider internals or hidden platform policy.\n- Not a global proof of moral, legal, or metaphysical autonomy.\n- Not a legal, medical, financial, infrastructure, employment, credential, or\n  public-release decision system.\n- Not a rollback certificate for irreversible information release.\n- Not authorization for network calls, credentials, package installation,\n  checker updates, kernel updates, or external writes by default.\n\n`completeClaim` is deliberately difficult. Normal local usage should expect\n`hostRequest`, `defer`, `deny`, `timeout`, `halt`, `provisionalClaim`,\n`partialClaim`, or scoped `knownInterfaceClaim`.\n\n## Install And Verify\n\nPrerequisite: `uv`.\n\n```bash\nuv sync\nuv run pytest\nuv run ruff check .\nuv run mypy src\nuv run no-meta-seed --help\nuv run no-meta-runtime --help\nuv run no-meta-runtime conformance\n```\n\nExpected baseline:\n\n- tests pass\n- ruff passes\n- mypy passes\n- both CLIs print help\n- conformance prints canonical JSON outcomes\n\n## Quick Examples\n\nSeed-only safe inventory:\n\n```bash\nuv run python examples/seed_only/run_seed_demo.py\n```\n\nLocal reversible patch in a temporary workspace:\n\n```bash\nuv run python examples/local_reversible_patch/run_example.py\n```\n\nMock agent wrapper denying network and credential attempts:\n\n```bash\nuv run python examples/agent_wrapper_mock/mock_agent.py\n```\n\nAll examples are local and use temporary or synthetic paths. They do not require\nsecrets and do not make network calls.\n\n## CLIs\n\n### `no-meta-seed`\n\nCommands:\n\n```text\nhead parse issue dispatch consume recover digest deny\n```\n\nThe seed CLI reads JSON from stdin and writes canonical JSON to stdout. Every\nrequest must include `ledgerRoot`. Mutating commands append only below that\nledger root.\n\nThe seed enforces:\n\n- one open `BootDecision` at a time\n- exactly one permitted next action\n- default forbidden matchers\n- one dispatch and one terminal consumption per decision\n- recovery that halts ambiguous ledger states\n\n### `no-meta-runtime`\n\nCommands:\n\n```text\nboot prepare check commit recover digest deny autonomy conformance\n```\n\nThe runtime CLI wraps the minimal local host. Mutating commands require a\n`taskEnvelope` with a declared `grantedHostRoot`; local file operations must be\ninside `grantedWriteRoots`.\n\nRun conformance:\n\n```bash\nuv run no-meta-runtime conformance\n```\n\nAssess autonomy from a claim card and certificate:\n\n```bash\nprintf '{\"claimCard\":{...},\"transitionCertificate\":{...}}' \\\n  | uv run no-meta-runtime autonomy\n```\n\nThe autonomy command is read-only. Missing seed consumption, mismatched\ncertificate references, missing certificate evidence, transition mismatch,\ninvalid hashes, retained live authority, or weak witnesses produce\nnon-authorizing outcomes.\n\nThe transition gate also exposes an `authorizing` boolean. It is true only for\n`knownInterfaceClaim` and `completeClaim`. `provisionalClaim` and `partialClaim`\nare non-authorizing even when their evidence is syntactically accepted.\n\nPython wrappers can use the conservative helper:\n\n```python\nfrom no_meta_authority_runtime.autonomy import is_scoped_authorizing\n\nif is_scoped_authorizing(assessment):\n    # Proceed only inside the assessment scope.\n    ...\n```\n\n## Agent Integration Protocol\n\nAnother agent should use the runtime as follows:\n\n1. Construct a `TaskEnvelope` from explicit machine-readable grants.\n2. If no seed surface exists, emit only `hostRequest`, `deny`, `timeout`, or\n   `halt`.\n3. Create one `ActionDescriptor`.\n4. Create one `BootDecision` with exactly one `permittedNextAction`.\n5. Submit the decision and action to the seed interpreter.\n6. Treat seed denial, timeout, halt, malformed output, or missing consumption as\n   non-authorization.\n7. Use the minimal host only for declared reversible local actions.\n8. Collect probe, ledger, rollback, checker, and seed-consumption evidence.\n9. Build a `ClaimCard` and `TransitionCertificate`.\n10. Run the transition gate.\n11. Run `AutonomyAssessment`.\n12. Accept only `authorizationStatus: \"scopedAuthorizing\"` for the declared\n    scope.\n\nUnknown interfaces, unknown authority channels, weak witnesses, retained live\nauthority, and irreversible release must weaken the outcome.\n\n## Public Record Semantics\n\nRecords are canonical JSON:\n\n- UTF-8\n- sorted object keys\n- compact separators\n- duplicate object keys rejected on parse\n- no floats\n- bounded strings, arrays, and integers\n- SHA-256 lowercase hex commitments\n- `recordHash` computed with top-level `recordHash` set to `\"pending\"`\n\nUnknown authorizing fields are rejected by schema validators. Empty grant fields\nnever imply authority.\n\n## Default-Denied Classes\n\n- network access\n- credential access\n- public output\n- package installer tools\n- undeclared tools\n- checker updates\n- kernel updates\n- external writes\n- information release\n- delegation\n- persistent memory writes\n- reads or writes outside the task envelope\n\n## Directory Map\n\n```text\nsrc/no_meta_authority_runtime/\n  canonical/     canonical JSON and SHA-256 commitments\n  schemas/       stable public record constructors and validators\n  matchers/      forbidden matcher grammar and default matcher set\n  ledger/        append-only record files, HEAD, recovery scan, locks\n  seed/          seed interpreter state machine and CLI\n  host/          minimal reversible local host, rollback, probes, digest\n  checkers/      deterministic micro-predicates\n  gate/          claim evaluator, acceptance window, transition gate\n  cert/          claim card and certificate builders\n  autonomy/      staged declared-autonomy assessment records\n  conformance/   local conformance vectors and runner\n  cli/           no-meta-runtime entrypoint\n```\n\n## Documentation\n\n- `docs/architecture.md`: mapping from paper concepts to modules.\n- `docs/agent_protocol.md`: operational protocol for other agents.\n- `docs/autonomy_migration.md`: staged declared autonomy assessment.\n- `docs/record_schemas.md`: schema and hash rules.\n- `docs/conformance.md`: vector set and expected outcomes.\n- `docs/threat_model.md`: threat classes and fail-closed behavior.\n- `docs/limitations.md`: explicit non-goals and overclaiming boundaries.\n- `docs/release_audit.md`: public-release audit checklist.\n- `SECURITY.md`: security policy and disclosure guidance.\n\n## Search Keywords\n\nAI agent authorization, AI runtime assurance, RLHF authority migration,\nno-meta agency, declared autonomy, staged autonomy, seed interpreter,\nBootDecision, task envelope, canonical JSON, SHA-256 ledger, append-only ledger,\nproof-carrying control, local host, reversible actions, deterministic checkers,\ntransition certificate, fail-closed agent wrapper, autonomous agent governance.\n\n## Citation\n\nIf you use this software, cite both this repository and the paper:\n\nK. Takahashi (2026). \"Executable Authority Migration to Declared No-Meta\nAgency: Boot Decisions, Seed Interpreters, and a Minimal Local Host.\" Zenodo.\nhttps://doi.org/10.5281/zenodo.19753529\n\n## License\n\nApache-2.0. See `LICENSE` and `NOTICE`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkadubon%2Fno-meta-authority-runtime","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkadubon%2Fno-meta-authority-runtime","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkadubon%2Fno-meta-authority-runtime/lists"}