Correctover-CCS v4.1.0

Agent Runtime Verification Protocol — 同步拦截，结构级 Fail-Closed 保证

---

What is CCS?

CCS (Correctover Conformance Standard) is the Agent Runtime Verification Protocol — a protocol-level validation framework that provides structural fail-closed guarantee for LLM agent systems.

Unlike observer-pattern hooks that fail-open when the governance layer crashes, CCS ensures that if verification fails, the action is NEVER executed. This eliminates CWE-636 (failure to use fail-safe defaults) at the protocol level.

Core Properties

• Structural Fail-Closed: Governance failure → action blocked (never executed)
• Synchronous Interception: Validation happens BEFORE the tool call, not after
• Sub-10μs Overhead: P50<10μs, P99<25μs (Python)
• Semantic-Aware Verification: Intent-level code analysis, not keyword matching
• Multi-Framework: CrewAI, LangChain, AutoGen, Ibex, Patronus

The Problem CCS Solves

AI Agent frameworks rely on observer-pattern governance hooks that are structurally fail-open. When the governance layer crashes, tool calls proceed unchecked — exposing systems to command injection, SSRF, and data exfiltration. CCS formalizes runtime conformance as Required(τ) ⊆ Supported(τ) — a simple, empirically-grounded criterion that guarantees fail-closed enforcement.

---

Quick Start

Python

pip install correctover-ccs

from ccs import govern

# Wrap any function with CCS governance
@govern(policy="default")
def search_web(query: str) -> str:
    return fetch_api(query)

search_web("test")  # ✅ Governed — validated before execution

TypeScript

npm install @correctover/ccs

import { govern } from "@correctover/ccs";

const governedSearch = govern(searchWeb, { policy: "default" });
governedSearch("test"); // ✅ Fail-closed guaranteed

4-Line Integration

from ccs import ConformantCrewAgent

agent = ConformantCrewAgent(my_crewai_agent)
result = agent.execute_task("Your task")
print(result.conformant)  # True / False

---

Architecture

┌─────────────────────────────────────────────────┐
│                   Agent Layer                    │
│   CrewAI / LangChain / AutoGen / Ibex / Patronus │
├─────────────────────────────────────────────────┤
│              CCS Runtime (v4.1.0)               │
│  ┌──────────┬──────────┬──────────┬──────────┐  │
│  │ Structure│  Schema  │  Latency │   Cost   │  │
│  │ Verifier │ Validator│  Monitor │  Monitor │  │
│  ├──────────┼──────────┼──────────┼──────────┤  │
│  │ Identity │ Integrity│  Policy  │ Failover │  │
│  │ Tracker  │  Checker │  Engine  │  Engine  │  │
│  ──────────┴──────────┴────────────────────┘  │
├─────────────────────────────────────────────────┤
│                 Tool / Action                    │
│  (Blocked if ANY dimension fails → Fail-Closed) │
└─────────────────────────────────────────────────┘

---

6-Dimension Verification

Dimension	Verifies	Failure Mode
Structure	Action has valid structure (agent_id, action_type, required fields)	Malformed action rejected
Schema	Output matches expected schema	Invalid output rejected
Latency	Response time within bounds	Timeout → Fail-Closed
Cost	Token usage within limits	Budget exceeded → blocked
Identity	Action is traceable (unique ID)	Untraceable → rejected
Integrity	Output is complete (non-empty, valid hash)	Corrupted → rejected

---

API Reference

Core

Interface	Description
govern(fn, options?)	Wrap function with CCS governance
getRuntime(config?)	Get global CCS runtime singleton
ConformantCrewAgent(agent)	CrewAI integration wrapper
ConformantLangChainAgent(agent)	LangChain integration wrapper
ConformantAutoGenAgent(agent)	AutoGen integration wrapper

Runtime

Method	Returns	Description
evaluate(toolName, toolInput, policy?)	{result, latencyUs}	Evaluate governance
registerPolicy(name, policy)	void	Register custom policy
getStats()	RuntimeStats	Performance statistics
getHealth()	HealthStatus	System health check

Custom Policy

from ccs import CCSPolicy, GovernanceResult

class BlockDeletePolicy(CCSPolicy):
    def evaluate(self, tool_name: str, tool_input: dict) -> GovernanceResult:
        if "delete" in tool_name or "rm" in tool_name:
            return GovernanceResult.DENY
        return GovernanceResult.ALLOW

---

Performance

Benchmarked on 50,000 iterations per scenario (CANON benchmark — see docs/performance_benchmark_20260725.md):

Metric	Value
P50 Latency	<10μs
P99 Latency	<25μs
audit_log impact on P50	None

Test environment: Python 3.12, CANON benchmark

---

Semantic-Aware Verification

CCS goes beyond keyword matching. The verification engine performs intent-level code analysis:

exec() → isDictKeyConstant? → isSandboxedExec? → isCodeExecutionEngine?
→ isSafeEvalPattern? → none match → CRITICAL

This semantic depth means CCS can distinguish between benign and malicious code patterns that keyword-based scanners conflate — a key differentiator in real-world agent security auditing.

---

Framework Adapters

Framework	Package	Status
CrewAI	correctover-crewai	✅ v4.1.0
LangChain	correctover-ccs	✅ v4.1.0
AutoGen	correctover-ccs	✅ v4.1.0
Ibex	correctover-ibex	✅ v4.1.0
Patronus	correctover-patronus	✅ v4.1.0
VS Code	correctover extension	✅ v4.1.0

---

Deployment

Local

pip install correctover-ccs

Docker

FROM python:3.12-slim
RUN pip install correctover-ccs
COPY . /app
CMD ["python", "app.py"]

Kubernetes

apiVersion: apps/v1
kind: Deployment
metadata:
  name: correctover-ccs
spec:
  template:
    spec:
      containers:
      - name: ccs
        image: correctover/ccs:4.1.0
        env:
        - name: CCS_POLICY
          value: "default"

---

Standards & Research

• Protocol: CCS v4.1 Specification
• Paper: DOI: 10.5281/zenodo.21271910
• Benchmark Dataset: 50,000 conformance traces per scenario (docs/performance_benchmark_20260725.md)

---

License

Commercial Proprietary License — © 2026 Correctover. All rights reserved.

Source code is publicly available for review, but remains proprietary. Commercial licensing inquiries: wangguigui@correctover.com

---

Enterprise Audit Service

Need a deep-dive security audit of your AI agent stack? Our team runs the same fail-closed methodology on your production tool surfaces — covering the RCE / SSRF / credential-hijack patterns CCS detects at runtime.

→ Book an enterprise audit

Get an audit for your team: correctover.com/audit | wangguigui@correctover.com

---

Contact

• Website: correctover.com
• Email: wangguigui@correctover.com
• GitHub: github.com/Correctover

---

Correctover — Failover ≠ Correctover™