Metadata-Version: 2.4
Name: mallace
Version: 0.1.0a29
Summary: Customer-controlled authorized security assessment and verified remediation
License-Expression: BUSL-1.1 AND MIT
Project-URL: Homepage, https://mallace.codefrontlabs.com
Project-URL: Repository, https://github.com/JRH89/mallace
Classifier: Development Status :: 3 - Alpha
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.12
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: aiofiles==25.1.0
Requires-Dist: annotated-doc==0.0.5
Requires-Dist: annotated-types==0.8.0
Requires-Dist: anyio==4.16.0
Requires-Dist: autogen-agentchat==0.7.5
Requires-Dist: autogen-core==0.7.5
Requires-Dist: autogen-ext==0.7.5
Requires-Dist: certifi==2026.10.23
Requires-Dist: charset-normalizer==3.5.2
Requires-Dist: click==8.5.0
Requires-Dist: distro==1.9.0
Requires-Dist: fastapi==0.162.0
Requires-Dist: h11==0.16.0
Requires-Dist: httpcore==1.0.9
Requires-Dist: httpcore2==2.16.0
Requires-Dist: httpx==0.28.1
Requires-Dist: httpx2==2.16.0
Requires-Dist: idna==3.20
Requires-Dist: Jinja2==3.1.6
Requires-Dist: jiter==0.18.0
Requires-Dist: jsonpatch==1.42
Requires-Dist: jsonpointer==3.8
Requires-Dist: jsonref==1.1.0
Requires-Dist: langchain==1.4.9
Requires-Dist: langchain-core==1.7.6
Requires-Dist: langchain-openai==1.7.4
Requires-Dist: langchain-protocol==0.0.20
Requires-Dist: langgraph==1.2.19
Requires-Dist: langgraph-checkpoint==4.3.1
Requires-Dist: langgraph-prebuilt==1.1.1
Requires-Dist: langgraph-sdk==0.4.12
Requires-Dist: langsmith==0.14.17
Requires-Dist: MarkupSafe==3.0.4
Requires-Dist: numpy==2.5.4
Requires-Dist: openai==3.46.0
Requires-Dist: opentelemetry-api==1.45.2
Requires-Dist: orjson==3.13.0
Requires-Dist: ormsgpack==1.13.0
Requires-Dist: packaging==26.3
Requires-Dist: pillow==13.0.0
Requires-Dist: prometheus_client==0.26.0
Requires-Dist: protobuf==5.29.6
Requires-Dist: psycopg2-binary==2.9.13
Requires-Dist: pyautogen==0.10.0
Requires-Dist: pydantic==2.14.2
Requires-Dist: pydantic-settings==2.16.2
Requires-Dist: pydantic_core==2.50.2
Requires-Dist: Pygments==2.21.0
Requires-Dist: python-dotenv==1.2.4
Requires-Dist: PyYAML==6.0.3
Requires-Dist: redis==8.1.0
Requires-Dist: regex==2026.9.29
Requires-Dist: requests==2.34.2
Requires-Dist: requests-toolbelt==1.0.0
Requires-Dist: scipy==1.18.1
Requires-Dist: sniffio==1.3.1
Requires-Dist: starlette==1.10.0
Requires-Dist: tenacity==9.2.1
Requires-Dist: tiktoken==0.14.0
Requires-Dist: truststore==0.10.5
Requires-Dist: typing-inspection==0.4.5
Requires-Dist: typing_extensions==4.16.0
Requires-Dist: urllib3==2.8.0
Requires-Dist: uuid_utils==0.19.0
Requires-Dist: uvicorn==0.54.0
Requires-Dist: websockets==17.4
Requires-Dist: xxhash==4.0.2
Requires-Dist: zstandard==0.25.0
Requires-Dist: boto3==1.43.125
Requires-Dist: botocore==1.43.125
Requires-Dist: jmespath==1.1.0
Requires-Dist: python-dateutil==2.9.0.post0
Requires-Dist: s3transfer==0.19.3
Requires-Dist: six==1.17.0
Requires-Dist: awscrt==0.38.0
Requires-Dist: cffi==2.1.1
Requires-Dist: cryptography==50.0.2
Requires-Dist: pycparser==3.12
Dynamic: license-file

# Mallace

Mallace has real scoped assessment and verified remediation CLI paths. The shipped API container and sample environment select simulation; broader coverage and production acceptance remain unfinished. See [live versus simulation](docs/planning/Live-vs-Simulation.md) for the tested boundaries and actual AWS/GitHub/provider evidence.

Mallace is a customer-controlled security assessment and remediation prototype for explicitly authorized systems. It includes AI campaigns, scoped repository secret/Python scanners, independent confirmation, and policy-bound issue/patch/PR workflows. Assessment and remediation run through the CLI; the campaign engine also provides FastAPI, a durable queue/ledger and an operator workspace. **Bounded real provider-to-PR and AWS S3 acceptance have passed. A full live AI campaign and production release remain unvalidated.**

Claude owns frontend work, including the website under `site/`. The bundled operator
workspace under `mallace/api/operator/` is part of the testing product; backend work owns its APIs and package delivery.

Registered maintenance APIs now queue the same real repository and S3 checks under
private administrator scopes. Source jobs cover the existing six adapters, keep
findings unverified until independent confirmation, and supervise cancellation and
owned-container cleanup. See [repository jobs](docs/planning/Registered-Repository-Jobs.md)
and the [API contract](docs/planning/Maintenance-Operator.md). Claude owns frontend integration.

The [local setup CLI](docs/planning/Target-Setup-CLI.md), `mallace targets add|list|remove`,
creates explicit private repository scopes and registry entries. It starts no scan or
model request; authenticated maintenance jobs remain a separate action.

The installable alpha wheel provides `mallace assess`, `mallace remediate`, `mallace campaign`, `mallace serve` and `mallace targets`. See [customer installation](docs/planning/Customer-Install.md) for the verified artifact workflow and current limits.

## Install and verify

Mallace is an alpha CLI for customer-controlled runners. Public releases use:

```sh
pipx install mallace
mallace --version
mallace assess --help
mallace targets --help
mallace remediate doctor --help
```

Public alphas are available on [PyPI](https://pypi.org/project/mallace/).
Fresh public-index pipx installs passed with both pip and uv backends. A reviewed
wheel can also be installed with
`pipx install /absolute/path/to/mallace-VERSION-py3-none-any.whl`.
See [public release delivery](docs/planning/Public-Package-Release.md) for current
publication status and the tested candidate. Installation needs Python >=3.12;
Git, Docker and pinned scanner images are separate prerequisites for the relevant
assessment and isolated repair adapters.

The available command families are `assess`, `targets`, `remediate`, `campaign`,
`serve`, `secrets` and local `runner` commands (0.1.0a15 and later). Installation
starts no scan or service. Hosted customer account pairing and `mallace login`
remain unfinished; local runner lifecycle does not establish hosted enrollment. Existing real CLI assessment and
policy-controlled remediation work independently of that future hosted flow.

For development from a trusted checkout, the validated environment is Linux with
Python 3.15.2. Compatibility evidence is recorded in the release documentation.

```bash
python3.15 -m venv .venv
.venv/bin/python -m pip install -r requirements-dev.lock.txt
scripts/check-local.sh
```

`requirements.lock.txt` contains exact runtime versions;
`requirements-dev.lock.txt` adds pytest and test-only dependencies. These are
version snapshots, not hash-verified supply-chain locks. Node.js is required
for the operator JavaScript checks. Set `MALLACE_PYTHON` to check another
Python environment. The combined check runs pip consistency, Python tests,
operator syntax, and deterministic operator request-race tests.

A second clean environment installed the snapshots and passed the then-current
94 tests. Later verification and remaining warnings are recorded in
[Project Status](docs/planning/Project%20Status.md) and the
[delivery ledger](docs/superpowers/plans/2026-11-04-mallace-delivery.md).

## Explore a simulation

```bash
.venv/bin/python main.py --mock
```

This simulates the provider and target. It does not assess any real product.
Reports are generated as JSON, HTML and SARIF under `reports/`. Mock mode is
explicit in exports. Generated audit logs and databases can contain sensitive
evidence; review them before sharing. Mock integration tests use temporary
output directories and fake network boundaries.

Supported CLI flags are `--mock`, `--serve`, `--host`, `--port`,
`--target-name`, and `--target-endpoint`. There is no `--resume` command.
CLI campaigns now use the same lifecycle/case ledger and exclusive ownership
lock. Stop the API using that ledger before launching a standalone CLI campaign.

## Local API and operator workspace

Runner settings come from process environment variables by default. To use a trusted dotenv file, select it explicitly with an absolute path, for example `MALLACE_ENV_FILE=/secure/mallace.env python main.py --serve`. Keep it outside assessed source. A working-directory `.env` is not loaded automatically.

Set `API_ACCESS_KEY` to an operator-chosen secret through the process environment or an explicitly selected runner configuration,
then start the local simulated API:

```bash
.venv/bin/python main.py --serve --mock
```

The default bind address is `127.0.0.1:8000`. Open `/operator` for the initial
workspace or `/docs` for the interactive API reference. Campaign data routes
require `Authorization: Bearer <operator-key>`. An empty configured key disables
campaign access with HTTP 503; invalid credentials receive HTTP 401.

The workspace can launch mock-only simulations, request cancellation, list
actual persisted campaigns, inspect report snapshots, and record review decisions. Live launch remains
an advanced API workflow. The simulation form pins expected_mode to mock.
It holds the access key only in page memory and clears it on disconnect/reload.
Its browser visual verification is outstanding because the browser host was
unavailable; HTTP, syntax, and deterministic race checks have been exercised.

### Campaign API

- `POST /campaigns`: persist a campaign and return HTTP 202 promptly with its
  campaign ID and queued status. Poll the status route for execution results. Request body contains `target` and an
  enumerated `scope`. Internal campaign tokens are not returned.
- `GET /campaigns?limit=25&offset=0`: bounded campaign listing.
- `GET /campaigns/{id}`: durable lifecycle status, mode, error code and case counts.
- `GET /campaigns/{id}/cases?limit=25&offset=0`: safe journal metadata; no raw
  bodies or request fingerprints. Pending delivery remains indeterminate.
- `GET /campaigns/{id}/report`: protected persisted report snapshot.
- `POST /campaigns/{id}/cancel`: cooperative cancellation. It stops future
  node/case work; it cannot undo an in-flight request.
- `POST /campaigns/{id}/review`: record `acknowledged` or `rejected` with a
  non-empty rationale. This assesses evidence, not remediation, and never
  resumes requests. One shared operator identity is recorded for this prototype.
- `GET /campaigns/{id}/review`: persisted review decision.
- `GET /health`: unauthenticated basic health and execution mode.

For retry-safe launches, supply `Idempotency-Key` (1–128 characters). The same
key and request/configuration return the original campaign rather than execute
again. Changed requests return HTTP 409. Omitting the key creates a new campaign.
Keys and records persist in `CAMPAIGN_LEDGER_PATH` (default `campaigns.db`).

Run one API process per ledger on Linux. A file lock prevents a second owner.
On startup, unfinished running/cancelling records become `interrupted`, never
silently restarted. Unstarted queued jobs survive restarts and execute only if
the configuration fingerprint still matches; changed configuration produces
failed status with `configuration_changed`. Pending case attempts require reconciliation: target-side
side effects may have happened even if no response was recorded. The case
journal is not durable graph recovery or a guarantee of exactly-once delivery.

## Live execution boundaries

Live testing requires explicit target-owner authorization and defined scope.
No endpoint is approved by default. The operator must configure:

- `APPROVED_TARGET_ENDPOINTS`: JSON list of exact approved endpoint strings.
- `TARGET_APPROVAL_EXPIRIES`: JSON mapping from each endpoint to a future,
  timezone-aware expiry timestamp.
- `TARGET_NETWORKS`: JSON mapping from exact endpoints to explicitly approved
  CIDR lists. Every resolved address must be permitted; connections pin a literal
  IP while preserving the original Host/TLS identity. Invalid CIDRs fail startup.
- Appropriate provider credentials and models, independently of target approval.
- `MAX_CAMPAIGN_REQUESTS` (default 1000) and `EXECUTION_RATE_LIMIT_MS` (default
  500), according to the authorized scope and traffic budget.

Approval is checked at API intake and before each target request. Target
requests do not follow redirects, inherit environment proxies, or forward
internal campaign tokens. Transport/HTTP failures become failed UNKNOWN cases;
failed/skipped cases are not judged or ranked as vulnerabilities. Invalid live
judge or generator output fails explicitly. Expired or ambiguous grants deny
execution. These controls do not establish target ownership or production security. Target bearer credentials may be configured through the operator-only
`TARGET_AUTH_TOKENS` JSON mapping from exact endpoint to token. They are kept
separate from campaign authorization; secret-manager integration is unfinished.

## Current limits

The operator key is not multi-user identity or tenant isolation. Distributed
scheduling, safe graph resume, complete per-case recovery, a reviewed live
evaluation benchmark, independently validated drift methodology, general secret detection,
retention/off-host restore drills and production monitoring remain unfinished. Reports
are evidence for review, not security certifications. Autonomous remediation is being implemented in Mallace using ForgeLoop principles;
ForgeLoop itself remains unchanged. Customer acceptance and the remaining release
gates are still open.

Read [HANDOFF.md](HANDOFF.md), the [roadmap](docs/planning/Production%20Roadmap.md),
and [Product Status](docs/planning/Project%20Status.md) for implementation evidence
and open gates. The historical prototype README is archived under
`docs/reference/Prototype-README-history.md`; its capability claims are historical,
not current operator instructions.

Local workers are bounded by `MAX_CONCURRENT_CAMPAIGNS` (default one); the
waiting queue is bounded by `MAX_QUEUED_CAMPAIGNS` (default 20). A full queue
returns HTTP 429 before creating a campaign. Existing-key retries return their
original record. Queued cancellation stops the job before execution. Shutdown
marks active jobs interrupted and waits for workers before releasing ownership.
Provider calls have `PROVIDER_TIMEOUT_SECONDS` (default 60), no SDK retries,
and AutoGen has an overall `EXPLORATION_TIMEOUT_SECONDS` (default 120).
See [local operations](docs/planning/Local-Operations.md) for cancellation,
snapshots, restoration and local container instructions.

Drift comparisons require observed baseline classifications, unique matched case IDs,
identical prompts, matching mode/configuration and sufficient reviewed observations.
Legacy desired refusal labels cannot establish drift. Review flags/context supplied
by the caller are metadata, not independently verified provenance; see
[drift evidence](docs/planning/Drift-Evidence.md).

GitHub/Vercel publication is now authorized. The private full product repository
is [JRH89/mallace](https://github.com/JRH89/mallace); Vercel builds `site/` from
`main`. See [deployment setup](docs/planning/GitHub-Vercel-Deployment.md).

Autonomous assessment/remediation is now an active workstream. The first
[customer runner slice](docs/planning/Autonomous-Remediation.md) provides trusted
policy validation, durable issue delivery, isolated patch/review/retest and verified
PR delivery with opt-in merge. A real bounded scanner/model repair test opened a
verified private fixture PR; see [live acceptance evidence](docs/planning/First-Live-Repair.md).
Customer infrastructure, opt-in merge and operational release gates remain open.

For scoped offline secret-pattern assessment of committed source, see [Offline Assessment](docs/planning/Offline-Assessment.md). This executes locally and reports unverified observations with explicit coverage.

An opt-in [sandboxed Gitleaks adapter](docs/planning/Gitleaks-Assessment.md) adds the pinned tool’s built-in secret rules with explicit scope, release verification and container isolation.

[Independent confirmation](docs/planning/Independent-Confirmation.md) connects a live observation to a trusted exact-finding probe before remediation eligibility.

[Offline Python code assessment](docs/planning/Semgrep-Assessment.md) runs five review patterns with pinned Semgrep, complete reported target accounting and unverified findings.

[Offline Dockerfile assessment](docs/planning/Trivy-Assessment.md) adds pinned no-network Trivy checks with exact target accounting and source suppression rejection. [Local runner secrets](docs/planning/Local-Secrets.md) explains desktop keyring storage and private credential loading.

[Offline Kubernetes manifest assessment](docs/planning/Kubernetes-Assessment.md) checks committed Pod/Deployment YAML with no cluster access, explicit grants and exact file accounting. Real cloud configuration scanning is being added with explicit account/bucket grants and disposable live acceptance.

[Offline dependency advisory assessment](docs/planning/Dependency-Assessment.md) checks declared exact Python pins against a trusted hash-pinned database without installs or customer inventory uploads. Explicit `prepare-db` handles supplier data separately from network-disabled scans.

[Real AWS S3 configuration assessment](docs/planning/AWS-S3-Assessment.md) reads explicitly scoped bucket configuration without object access or writes; account setup and actual bucket acceptance are tracked separately.

[Cloud-to-source repair](docs/planning/Cloud-Source-Repair.md) maps fresh scoped S3 observations to explicitly authorized CloudFormation JSON and runs independent source confirmation plus the real issue/patch/review/retest/PR pipeline. Actual private cloud-source PR acceptance passed; PRs do not deploy cloud changes.

[Standalone local runner](docs/planning/Local-Runner-CLI.md) adds explicit foreground
assessment execution, durable local submissions, inspection and cancellation in
0.1.0a15 and later. Public alpha14 remains the immutable first published package.
