Correctover-CCS v4.1.1

Agent Runtime Verification Protocol — 同步拦截，结构级 Fail-Closed 保证

---

What is CCS?

CCS (Correctover Conformance Standard) is the Agent Runtime Verification Protocol — a protocol-level validation framework that provides structural fail-closed guarantee for LLM agent systems.

Unlike observer-pattern hooks that fail-open when the governance layer crashes, CCS ensures that if verification fails, the action is NEVER executed. This addresses CWE-636 (failure to use fail-safe defaults) at the protocol level.

Core Properties

• Structural Fail-Closed: Governance failure → action blocked (never executed)
• Synchronous Interception: Validation happens BEFORE the tool call, not after
• Sub-10μs Overhead: P50<10μs, P99<25μs (Python) — 实测达标：P50=3.90µs / P99=7.50µs（50K 迭代，Squad #0461, 2026-08-21）
• Multi-Framework: CrewAI, LangChain, AutoGen, Ibex, Patronus
• CCS 7-Dimension Verification: Structure / Schema / Latency / Cost / Identity / Integrity / Security

The Problem CCS Solves

AI Agent frameworks rely on observer-pattern governance hooks that are structurally fail-open. When the governance layer crashes, tool calls proceed unchecked — exposing systems to command injection, SSRF, and data exfiltration. CCS formalizes runtime conformance as Required(τ) ⊆ Supported(τ) — a simple, empirically-grounded criterion that guarantees fail-closed enforcement.

---

Quick Start

Python

pip install correctover-ccs

from ccs import govern

# Wrap any function with CCS governance
@govern(policy="default")
def search_web(query: str) -> str:
    return fetch_api(query)

search_web("test")  # ✅ Governed — validated before execution

TypeScript

npm install @correctover/ccs

import { govern } from "@correctover/ccs";

const governedSearch = govern(searchWeb, { policy: "default" });
governedSearch("test"); // ✅ Fail-closed guaranteed

4-Line Integration

from ccs import ConformantCrewAgent

agent = ConformantCrewAgent(my_crewai_agent)
result = agent.execute_task("Your task")
print(result.conformant)  # True / False

---

Architecture

┌─────────────────────────────────────────────────┐
│                   Agent Layer                    │
│   CrewAI / LangChain / AutoGen / Ibex / Patronus │
├─────────────────────────────────────────────────┤
│              CCS Runtime (v4.1.1)               │
│  ┌──────────┬──────────┬──────────┬──────────┐  │
│  │ Structure│  Schema  │  Latency │   Cost   │  │
│  │ Verifier │ Validator│  Monitor │  Monitor │  │
│  ├──────────┼──────────┼──────────┼──────────┤  │
│  │ Identity │ Integrity│  Security│ Failover │  │
│  │ Tracker  │  Checker │  Rules   │  Engine  │  │
│  └──────────┴──────────┴──────────┴──────────┘  │
├─────────────────────────────────────────────────┤
│                 Tool / Action                    │
│  (Blocked if ANY dimension fails → Fail-Closed) │
└─────────────────────────────────────────────────┘

---

7-Dimension Verification

Dimension	Verifies	Failure Mode
Structure	Action has valid structure (agent_id, action_type, required fields)	Malformed action rejected
Schema	Output matches expected schema	Invalid output rejected
Latency	Response time within bounds	Timeout → Fail-Closed
Cost	Token usage within limits	Budget exceeded → blocked
Identity	Action is traceable (unique ID)	Untraceable → rejected
Integrity	Output is complete (non-empty, valid hash)	Corrupted → rejected
Security	Input/output 不含危险命令模式、MCP v2 协议合规	危险子串 → blocked

维度口径：本包统一为 7 维（含 Security），与官方标准口径一致。 Security 维在 v4.1.1 中实现为 MCP v2 协议规则（10 条）+ 安全检测规则（106 条），合计 116 条（源码实算，Squad #0464 2026-08-22）： MCP v2 协议规则见 ccs/mcp_v2（MV2-001~MV2-010）；安全检测规则覆盖 command injection / env exposure / prompt injection / SSRF / path traversal 五类（104 条子串/关键词 + 2 条编译期正则），校验失败即 fail-closed 阻断。

---

API Reference

Core

Interface	Description
govern(fn, options?)	Wrap function with CCS governance
getRuntime(config?)	Get global CCS runtime singleton
ConformantCrewAgent(agent)	CrewAI integration wrapper
ConformantLangChainAgent(agent)	LangChain integration wrapper
ConformantAutoGenAgent(agent)	AutoGen integration wrapper

Runtime

Method	Returns	Description
evaluate(toolName, toolInput, policy?)	{result, latencyUs}	Evaluate governance
registerPolicy(name, policy)	void	Register custom policy
getStats()	RuntimeStats	Performance statistics
getHealth()	HealthStatus	System health check

Custom Policy

from ccs import CCSPolicy, GovernanceResult

class BlockDeletePolicy(CCSPolicy):
    def evaluate(self, tool_name: str, tool_input: dict) -> GovernanceResult:
        if "delete" in tool_name or "rm" in tool_name:
            return GovernanceResult.DENY
        return GovernanceResult.ALLOW

---

Performance

实测（50,000 次迭代，Windows 10 / Python 3.12，Squad #0461 2026-08-21）：

场景	P50	P99	max	判定
默认配置（audit_log=True）简单 dict	3.90µs	7.50µs	868.80µs	✅ 达标
audit_log=False 简单输入	3.90µs	6.90µs	108.20µs	✅ 达标
默认配置 工具形态（args/kwargs）	4.50µs	10.80µs	11,643.70µs	✅ 达标

对照宣称 P50<10µs / P99<25µs @ 50K：实测全部达标。max 尖峰（868µs / 11,643µs）来自 GC 与审计队列，不影响 P99 结论。 参考：历史 benchmark 文档 docs/performance_benchmark_20260725.md。

---

Framework Adapters

Framework	Package	Status
CrewAI	correctover-crewai	✅ v4.1.1
LangChain	correctover-ccs	✅ v4.1.1
AutoGen	correctover-ccs	✅ v4.1.1
Ibex	correctover-ibex	✅ v4.1.1
Patronus	correctover-patronus	✅ v4.1.1
VS Code	correctover extension	✅ v4.1.1

---

Deployment

Local

pip install correctover-ccs

Docker

FROM python:3.12-slim
RUN pip install correctover-ccs
COPY . /app
CMD ["python", "app.py"]

Kubernetes

apiVersion: apps/v1
kind: Deployment
metadata:
  name: correctover-ccs
spec:
  template:
    spec:
      containers:
      - name: ccs
        image: correctover/ccs:4.1.1
        env:
        - name: CCS_POLICY
          value: "default"

---

Standards & Research

• Protocol: CCS v4.1 Specification
• Paper: DOI: 10.5281/zenodo.21271910
• Benchmark: 50,000 conformance traces per scenario（Squad #0461 实测，见 Performance 节）

---

License

Commercial Proprietary License — © 2026 Correctover. All rights reserved.

Source code is publicly available for review, but remains proprietary. Commercial licensing inquiries: wangguigui@correctover.com

---

Enterprise Audit Service

Need a deep-dive security audit of your AI agent stack? Our team runs the same fail-closed methodology on your production tool surfaces — covering the RCE / SSRF / credential-hijack patterns detected at runtime.

→ Book an enterprise audit

Get an audit for your team: correctover.com/audit | wangguigui@correctover.com

---

Contact

• Website: correctover.com
• Email: wangguigui@correctover.com
• GitHub: github.com/Correctover

---

Correctover — Failover ≠ Correctover™