feat: v0.6.0 — embeddable judge + native in-process SDKs (PyO3 / napi)

Reworked the SDKs to a3s-code's architecture: native in-process bindings, not subprocess wrappers.

Rust lib:
- src/config.rs: unified ACL config (SdkConfig) — one sentry.acl with rules + llm{}/agent{} backends
  + deny{} sinks + fail mode → builds the Pipeline + Enforcer
- src/sdk.rs: embeddable Sentry — create(acl) + evaluate(event)->Decision + evaluate_and_enforce
- rules.rs: LiveRules::from_engine (build L1 from in-memory rules)
- example policy/sentry.acl; 43 lib + 12 integration tests green, clippy clean

Native SDKs (replace the subprocess wrappers):
- sdk/python: PyO3 + maturin (abi3-py39), import a3s_sentry — Sentry.create/evaluate/
  evaluate_and_enforce, event builders, Decision/EnforceAction. 8 tests (maturin develop verified)
- sdk/typescript: napi-rs, @a3s-lab/sentry — same surface, generated .d.ts. 4 tests (napi build verified)
- both judge in-process (no daemon); verified against the embedded engine (SSRF->block/DenyEgress,
  SDK-authored ACL rule fires at tier=Rules)
- publish-python.yml -> maturin wheels; publish-ts.yml -> napi per-platform binaries

Author: RoyLin

.github/workflows/publish-python.yml

@@ -1,7 +1,7 @@
 name: publish-python
 
-# Publish the Python SDK to PyPI on a `python-vX.Y.Z` tag (independent of the daemon's `v*` tags).
-# Requires a `PYPI_API_TOKEN` repository secret.
+# Publish the native PyO3 Python SDK to PyPI on a `python-vX.Y.Z` tag (independent of the daemon's
+# `v*` tags). Builds an abi3 wheel per platform with maturin. Requires a `PYPI_API_TOKEN` secret.
 on:
   push:
     tags: ["python-v*"]
@@ -10,24 +10,35 @@ permissions:
   contents: read
 
 jobs:
+  wheels:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with: { submodules: true }
+      - uses: PyO3/maturin-action@v1
+        with:
+          command: build
+          args: --release --out dist --manifest-path sdk/python/Cargo.toml
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-${{ matrix.os }}
+          path: dist
+
   publish:
+    needs: wheels
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: sdk/python
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+      - uses: PyO3/maturin-action@v1
         with:
-          python-version: "3.12"
-      - name: test
-        run: python -m unittest discover -s tests -t . # integration tests auto-skip (no binary)
-      - name: build
-        run: |
-          pip install --upgrade build twine
-          python -m build
-      - name: publish
-        run: twine upload dist/*
+          command: upload
+          args: --skip-existing dist/*
         env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}

.github/workflows/publish-ts.yml

@@ -1,30 +1,60 @@
 name: publish-ts
 
-# Publish the TypeScript SDK (@a3s-lab/sentry) to npm on a `ts-vX.Y.Z` tag (independent of the
-# daemon's `v*` tags). Requires an `NPM_TOKEN` repository secret.
+# Publish the native napi SDK (@a3s-lab/sentry) to npm on a `ts-vX.Y.Z` tag. Builds the native addon
+# per platform, then publishes the main package + per-platform binaries (the napi-rs convention).
+# Requires an `NPM_TOKEN` secret. (The per-platform sub-packages live under the @a3s-lab npm scope.)
 on:
   push:
     tags: ["ts-v*"]
 
 permissions:
   contents: read
 
+defaults:
+  run:
+    working-directory: sdk/typescript
+
 jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        settings:
+          - { host: ubuntu-latest, target: x86_64-unknown-linux-gnu }
+          - { host: macos-latest, target: aarch64-apple-darwin }
+          - { host: windows-latest, target: x86_64-pc-windows-msvc }
+    runs-on: ${{ matrix.settings.host }}
+    steps:
+      - uses: actions/checkout@v4
+        with: { submodules: true }
+      - uses: actions/setup-node@v4
+        with: { node-version: "20" }
+      - uses: dtolnay/rust-toolchain@stable
+        with: { targets: ${{ matrix.settings.target }} }
+      - run: npm install
+      - run: npm run build -- --target ${{ matrix.settings.target }}
+      - run: npm test
+      - uses: actions/upload-artifact@v4
+        with:
+          name: bindings-${{ matrix.settings.target }}
+          path: sdk/typescript/*.node
+
   publish:
+    needs: build
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: sdk/typescript
     steps:
       - uses: actions/checkout@v4
+        with: { submodules: true }
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
-      - run: npm ci
-      - name: build + test
-        run: npm test # tsc + node --test; the integration test auto-skips (no binary)
-      - name: publish
-        run: npm publish --access public
+      - run: npm install
+      - uses: actions/download-artifact@v4
+        with:
+          path: sdk/typescript/artifacts
+      - run: npx napi artifacts --dir artifacts
+      - run: npx napi prepublish -t npm
+      - run: npm publish --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [0.6.0] — embeddable judge + native in-process SDKs
+
+The SDKs are now **native in-process bindings** (PyO3 / napi-rs), not subprocess wrappers — the Rust
+L1/L2/L3 judge embedded in your process, matching [`@a3s-lab/code`](https://github.com/A3S-Lab/Code)'s
+architecture. Build the judge from one ACL config and judge events in-process; no daemon, no subprocess.
+
+### Added
+- **Embeddable `Sentry`** (`src/sdk.rs`, `src/config.rs`) — `Sentry::create(acl)` builds the pipeline
+  from one ACL config; `evaluate(event) -> Option<Decision>` and `evaluate_and_enforce` judge in
+  process. The unified `sentry.acl` carries everything — rules + optional `llm {}` (L2) / `agent {}`
+  (L3) backends + `deny {}` sinks + fail mode (example: [`policy/sentry.acl`](policy/sentry.acl)).
+  Plus `LiveRules::from_engine` to build L1 from in-memory rules.
+- **Native SDKs** (replacing the subprocess wrappers):
+  - **Python** ([`sdk/python`](sdk/python), `a3s-sentry`) — PyO3 + maturin, abi3-py39 wheels.
+    `Sentry.create` / `evaluate` / `evaluate_and_enforce`, event builders, `Decision`/`EnforceAction`.
+    8 tests.
+  - **TypeScript** ([`sdk/typescript`](sdk/typescript), `@a3s-lab/sentry`) — napi-rs, generated
+    `.d.ts`, prebuilt per-platform binaries. Same surface. 4 tests.
+  - Both judge in-process and are verified against the embedded engine (a cloud-metadata SSRF →
+    `block`/`DenyEgress`; an SDK-authored ACL rule firing at `tier=Rules`). The PyPI/npm publish
+    workflows are rebuilt for native artifacts (maturin wheels / napi binaries).
+
 ## [0.5.2] — Python + TypeScript SDKs; the policy language is ACL
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-sentry"
-version = "0.5.2"
+version = "0.6.0"
 edition = "2021"
 license = "MIT"
 description = "Tiered (L1 rules / L2 LLM / L3 agent) runtime security control for AI agents, built on a3s-observer."

Cargo.toml

@@ -143,40 +143,38 @@ in-house ruleset) and keep the escalation machinery.
 
 ## SDKs (Python · TypeScript)
 
-Drive sentry from your own code — author ACL policy, run the judge, submit events, stream typed
-decisions, read metrics — instead of wiring stdin/stdout by hand. Both are dependency-free and mirror
-the same model; each is contract-tested against the real binary (an SSRF event round-trips to a
-`block`, and an SDK-authored ACL rule fires through the daemon's own parser).
+**Native, in-process** SDKs — the Rust L1/L2/L3 judge embedded via PyO3 (Python) and napi-rs
+(TypeScript), the same model as [`@a3s-lab/code`](https://github.com/A3S-Lab/Code). Build the judge
+from one ACL config (the daemon's whole config in a single file — rules + L2/L3 backends + sinks) and
+evaluate observer events in-process; no daemon, no subprocess. Each is verified by judging real events
+through the embedded engine (a cloud-metadata SSRF → `block`/`DenyEgress`; an SDK-authored ACL rule
+firing at `tier=Rules`).
 
-- **Python** — [`sdk/python`](sdk/python) (`pip install a3s-sentry`), async:
+- **Python** — [`sdk/python`](sdk/python) (`pip install a3s-sentry`):
 
   ```python
-  from a3s_sentry import Sentry, SentryConfig, Event, Policy, Rule, Verdict, Severity, Action
+  from a3s_sentry import Sentry, egress, tool_exec
 
-  Policy([Rule("no-netcat", "ToolExec", r"(?i)\b(ncat|netcat)\b",
-               Verdict.BLOCK, Severity.MEDIUM, "netcat", Action.DENY_EXEC)]).write("rules.acl")
-
-  async with Sentry(SentryConfig(policy="rules.acl", egress_deny="egress.txt")) as s:
-      await s.submit(Event.egress(1, "169.254.169.254", 80))      # cloud-metadata SSRF
-      async for audit in s.decisions():
-          print(audit.decision.verdict, audit.subject); break
+  sentry = Sentry.create("sentry.acl")               # ACL file path or content
+  d = sentry.evaluate(egress(1, "169.254.169.254", 80))   # cloud-metadata SSRF
+  print(d.verdict, d.action.kind, d.action.target)   # block DenyEgress 169.254.169.254
+  d2, enforced = sentry.evaluate_and_enforce(tool_exec(2, ["/usr/bin/ncat", "h", "4444"]))
   ```
 
-- **TypeScript** — [`sdk/typescript`](sdk/typescript) (`@a3s-lab/sentry`), Node 18+:
+- **TypeScript** — [`sdk/typescript`](sdk/typescript) (`@a3s-lab/sentry`, Node ≥12):
 
   ```ts
-  import { Sentry, Policy, Event } from "@a3s-lab/sentry";
-
-  new Policy([{ name: "no-netcat", on: "ToolExec", match: "(?i)\\b(ncat|netcat)\\b",
-                verdict: "block", severity: "medium", reason: "netcat", action: "deny-exec" }])
-    .write("rules.acl");
+  import { Sentry, egress } from "@a3s-lab/sentry";
 
-  const s = new Sentry({ policy: "rules.acl", egressDeny: "egress.txt" });
-  await s.start();
-  await s.submit(Event.egress(1, "169.254.169.254", 80));
-  for await (const audit of s.decisions()) { console.log(audit.decision.verdict, audit.subject); break; }
+  const sentry = Sentry.create("sentry.acl");
+  const d = sentry.evaluate(egress(1, "169.254.169.254", 80));
+  if (d?.verdict === "block") console.log(d.reason, d.action); // { kind: "DenyEgress", target: "…" }
   ```
 
+The `sentry.acl` config — rules, optional `llm {}` (L2) / `agent {}` (L3) backends, and `deny {}`
+sinks — is shown in each SDK's README. Event builders (`egress`, `toolExec`, `dns`, `fileAccess`,
+`sslContent`, `securityAction`) construct the event JSON `evaluate` takes.
+
 ## Speculative parallelism
 
 By default the tiers run serially (L2, then L3 only if L2 escalates). Set `A3S_SENTRY_SPECULATE=high`

README.md

@@ -0,0 +1,29 @@
+# a3s-sentry — unified ACL config for the embeddable SDK (`Sentry.create("sentry.acl")`).
+#
+# Where the daemon takes env vars + a rules-only policy, the in-process SDK reads ONE ACL file with
+# everything: the fail mode, the L2/L3 backends, the deny-file sinks, and the L1 rules. Every block /
+# field is optional except a rule's required fields; the built-in default rules always apply.
+
+fail_closed = false
+# speculate = "high"     # uncomment to run L2 + L3 in parallel at/above this severity
+
+# L2 — a fast LLM classifier (OpenAI-compatible). Omit for rules-only / rules+L3.
+# llm { url = "http://llm:18051/v1", model = "glm", key = "...", timeout_s = 30 }
+
+# L3 — a deep a3s-code agent investigation. Omit if you don't run L3.
+# agent { bin = "a3s-code", skills = "./skills", timeout_s = 120 }
+
+# Deny-file sinks the kernel guards read. Omit to judge without enforcing.
+deny {
+  egress = "egress-deny.txt"
+  exec   = "exec-deny.txt"
+}
+
+# L1 site rules — evaluated before the built-in defaults; first match wins. Separate inline-object
+# fields with commas (or put one per line).
+rules = [
+  { name = "no-netcat", on = "ToolExec", match = "(?i)\\b(ncat|netcat)\\b",
+    verdict = "block", severity = "medium", reason = "netcat invocation", action = "deny-exec" },
+  { name = "admin-egress", on = "Egress", match = "^10\\.0\\.99\\.",
+    verdict = "escalate", severity = "medium", reason = "connection into the admin subnet" },
+]

policy/sentry.acl

@@ -1,6 +1,5 @@
+target/
 __pycache__/
-*.pyc
-*.egg-info/
+*.so
 dist/
-build/
-.pytest_cache/
+.venv/