Argus SDK

Argus SDK is Esthien's developer toolkit for the Argus decision boundary. The 0.8 release line provides the enforcement-boundary protocol stack: typed proposals, the policy language with load, validate, diff and compose, and the attestation and evidence chain, with a Python API, the argus command-line interface, five language bindings, and a ROS 2 safety node.

Releases

The command surface of the 0.8 line is runtime-info, regression-eval, evaluate, policy check, policy diff, evidence verify, and evidence export. Install the current patch release with pip install esthien-argus-sdk.

The release process validates these host tuples:

Each tuple has a recorded installation, CLI, Python API, and evaluation result. Host validation in continuous integration is a supported-host record, not a hardware support claim. No physical board, sensor, or instrument is part of the programme inventory, and a passing tuple does not establish measured hardware or field performance.

Release files carry Sigstore bundles named <artifact>.sigstore.json, verified with scripts/verify_signature.py. The Windows installer is distributed unsigned; Authenticode signing is an open item and requires no change to the Python package.

Current evidence boundary

• The default evaluation path writes digital_source_verification evidence.
• Output source hashes provide integrity traceability. They are not release signatures or a safety certification.
• The SDK does not establish hardware timing, thermal, power, functional-safety certification, production silicon, or customer-system qualification.
• Measured-evidence classes require a separately controlled measurement record and are not asserted by any release.

Distribution boundary

The product distribution path exposes a deliberately narrow command surface. It does not claim source-code secrecy, package encryption, hardware binding, security certification, or production key custody. Those controls require separately approved technical and operational evidence. Release signing is described under Releases.

Local development

Requirements:

• Python 3.11 or later
• A supported Python environment with NumPy, SciPy, and scikit-learn

python -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install --upgrade pip
python -m pip install ".[dev]"
argus --version
argus runtime-info
argus regression-eval --sample --out out\smoke

The default regression profile is packaged with the SDK, so the sample command works without relying on a source-tree-relative configuration path.

Python API

from argus import ConfidenceCoupledSafetyEnvelope, ProfileCompiler

compiler = ProfileCompiler()
envelope = ConfidenceCoupledSafetyEnvelope()

The public Python imports are versioned with the package. Product packages do not expose internal research, hardware-design, or roadmap material.

CLI

argus --version
argus runtime-info
argus regression-eval --sample --out <directory>
argus --help

runtime-info reports the detected host, the validation matrix, and the evidence boundary of the installed release.

Candidate-release build

The candidate builder creates a controlled wheel, dependency inventory, and a machine-readable release manifest. It does not create a public source archive, sign an artifact, or approve distribution. Native packages are built and validated per host tuple.

python -m pip install build==1.6.1
python scripts\build_release.py --out C:\temp\argus-sdk-release-candidate

Any distribution remains blocked until the required host tuples pass, the dependency inventory receives security review, the artifact is signed with an approved release key, and a release-approval record is complete.

Repository layout

src/argus/                 Python API and CLI
src/argus/resources/       Packaged reference profiles
tests/                     Unit, integration, conformance, and formal checks
config/                    Source configuration and research inputs
scripts/build_release.py   Controlled candidate artifact builder
packaging/windows/         Windows installer source and command wrapper
.github/workflows/         Host verification and candidate-build workflows

The 0.8 surface

Each component ships with a recorded evidence class; the release that contains a component is the release that carries its claim.

License and contact

This repository is proprietary. Access does not grant a redistribution or commercial-use license. Contact Esthien Labs for evaluation or licensing discussion.