Add SOVRINT governed-session profiles across TypeScript, Python, and Go

.github/workflows/sovrint-extension-validate.yml

@@ -0,0 +1,165 @@
+name: SOVRINT Extension Validation
+
+on:
+  pull_request:
+    paths:
+      - "docs/sovrint/**"
+      - "sovrint/**"
+      - "nodejs/src/sovrint.ts"
+      - "nodejs/test/sovrint.test.ts"
+      - "nodejs/src/index.ts"
+      - "python/copilot/sovrint.py"
+      - "python/test_sovrint.py"
+      - "python/copilot/__init__.py"
+      - "go/sovrint.go"
+      - "go/sovrint_test.go"
+      - "cookbook/**/sovrint-governed-session.md"
+      - "SOVRINT_*.md"
+      - ".github/workflows/sovrint-extension-validate.yml"
+  push:
+    branches:
+      - main
+      - feat/sovrint-governed-sdk-profile-v1
+
+permissions:
+  contents: read
+
+jobs:
+  common-contracts:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install validators
+        run: python -m pip install --disable-pip-version-check PyYAML==6.0.2 jsonschema==4.23.0
+
+      - name: Validate JSON and YAML contracts
+        run: |
+          python - <<'PY'
+          import json
+          from pathlib import Path
+
+          import yaml
+          from jsonschema import Draft202012Validator, FormatChecker
+
+          for path in Path("sovrint").rglob("*.json"):
+              json.loads(path.read_text(encoding="utf-8"))
+              print(f"valid json: {path}")
+
+          for path in Path("sovrint").rglob("*.yaml"):
+              yaml.safe_load(path.read_text(encoding="utf-8"))
+              print(f"valid yaml: {path}")
+
+          profile_schema = json.loads(
+              Path("sovrint/schemas/security-profile.schema.json").read_text(encoding="utf-8")
+          )
+          profile_validator = Draft202012Validator(
+              profile_schema,
+              format_checker=FormatChecker(),
+          )
+          for path in Path("sovrint/profiles").glob("*.json"):
+              profile = json.loads(path.read_text(encoding="utf-8"))
+              profile_validator.validate(profile)
+              if profile["audit"]["includeArguments"] is not False:
+                  raise SystemExit(f"profile exposes arguments: {path}")
+              if profile["audit"]["includeResults"] is not False:
+                  raise SystemExit(f"profile exposes results: {path}")
+              print(f"valid profile: {path}")
+
+          event_schema = json.loads(
+              Path("sovrint/schemas/audit-event.schema.json").read_text(encoding="utf-8")
+          )
+          event = json.loads(
+              Path("sovrint/examples/audit-event.example.json").read_text(encoding="utf-8")
+          )
+          Draft202012Validator(
+              event_schema,
+              format_checker=FormatChecker(),
+          ).validate(event)
+          if event.get("metadata", {}).get("simulationOnly") is not True:
+              raise SystemExit("audit example must remain simulation-only")
+          print("valid audit event example")
+          PY
+
+      - name: Validate extension manifest paths
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+
+          import yaml
+
+          manifest = yaml.safe_load(Path("sovrint/manifest.yaml").read_text(encoding="utf-8"))
+          listed = []
+          for value in manifest["components"].values():
+              listed.extend(value)
+          missing = [path for path in listed if not Path(path).exists()]
+          if missing:
+              raise SystemExit(f"manifest paths missing: {missing}")
+          print(f"validated {len(listed)} manifest paths")
+          PY
+
+  nodejs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: nodejs/package-lock.json
+
+      - name: Install Node.js dependencies
+        working-directory: nodejs
+        run: npm ci
+
+      - name: Typecheck Node.js SDK
+        working-directory: nodejs
+        run: npm run typecheck
+
+      - name: Test SOVRINT TypeScript helpers
+        working-directory: nodejs
+        run: npx vitest run test/sovrint.test.ts
+
+  python:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install Python SDK and test dependencies
+        run: python -m pip install --disable-pip-version-check -e "./python[dev]"
+
+      - name: Compile Python helper
+        run: python -m compileall -q python/copilot/sovrint.py
+
+      - name: Test SOVRINT Python helpers
+        run: pytest -q python/test_sovrint.py
+
+  go:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go/go.mod
+
+      - name: Test SOVRINT Go helpers
+        working-directory: go
+        run: go test -run Sovrint ./...

SOVRINT_CHANGELOG.md

@@ -0,0 +1,25 @@
+# SOVRINT™ Extension Changelog
+
+## v1.0 — 2026-06-26
+
+Added:
+
+- governed-session architecture and security documentation;
+- governance, integrity, and evidence interface guide;
+- strict and read-only JSON profiles;
+- research profile constants in TypeScript, Python, and Go;
+- shared profile and audit-event schemas;
+- extension manifest and permission matrix;
+- bounded audit-event example;
+- TypeScript helper module and tests;
+- Python helper module and tests;
+- Go helper module and tests;
+- TypeScript, Python, Go, and .NET recipes;
+- root extension index and attribution;
+- cross-language validation workflow.
+
+Compatibility:
+
+- upstream JSON-RPC protocol unchanged;
+- existing SDK users unaffected unless they apply the SOVRINT helpers;
+- existing package names and client/session APIs preserved.

SOVRINT_EXTENSION.md

@@ -0,0 +1,24 @@
+# SOVRINT™ Governed SDK Extension
+
+**Author:** Katrina Pietroniro  
+**Version:** 1.0  
+**Status:** Additive and opt-in
+
+This repository includes a governed-session extension around the existing Copilot SDK interfaces. The upstream JSON-RPC protocol remains unchanged.
+
+The extension includes permission profiles, session-configuration helpers, custom-tool guards, bounded audit events, shared schemas, tests, and cross-language recipes.
+
+## Documentation
+
+- [Architecture](docs/sovrint/README.md)
+- [Security profile](docs/sovrint/SECURITY_PROFILE.md)
+- [Governance, integrity, and evidence interfaces](docs/sovrint/GOVERNANCE_INTEGRITY_EVIDENCE.md)
+
+## Recipes
+
+- [TypeScript](cookbook/nodejs/sovrint-governed-session.md)
+- [Python](cookbook/python/sovrint-governed-session.md)
+- [Go](cookbook/go/sovrint-governed-session.md)
+- [.NET](cookbook/dotnet/sovrint-governed-session.md)
+
+Existing SDK behavior remains unchanged unless an application applies the extension helpers.

SOVRINT_EXTENSION_ATTRIBUTION.md

@@ -0,0 +1,8 @@
+# SOVRINT™ Extension Attribution
+
+**Author:** Katrina Pietroniro  
+**Initial integration date:** 2026-06-26
+
+This attribution applies to the governed-session profiles, permission composition, session constraints, custom-tool guards, bounded audit events, interface documentation, schemas, tests, and recipes added under the SOVRINT extension.
+
+The original Copilot SDK code remains attributed to its existing authors. Repository licensing remains unchanged.

cookbook/dotnet/sovrint-governed-session.md

@@ -0,0 +1,107 @@
+# SOVRINT Governed Session — .NET
+
+The TypeScript, Python, and Go packages in this repository include first-class SOVRINT helper modules. This .NET recipe applies the same control principles through the documented native `SessionConfig` surface.
+
+## Conservative profile
+
+```csharp
+using GitHub.Copilot.SDK;
+
+const string SovrintSystemAppend = @"
+Operate under a bounded SOVRINT governed-session profile.
+Use only explicitly exposed tools and declared authority.
+Treat observations, inferences, recommendations, governance decisions,
+integrity findings, and accepted evidence as distinct classes.
+Do not claim approval, verification, restoration, or EvidenceGrid acceptance
+without an explicit external result.
+";
+
+static SessionConfig ApplySovrintStrictProfile(SessionConfig config)
+{
+    if (config.SystemMessage?.Mode == SystemMessageMode.Replace)
+    {
+        throw new InvalidOperationException(
+            "The SOVRINT strict profile forbids system-message replacement."
+        );
+    }
+
+    var existing = config.SystemMessage?.Content;
+    config.SystemMessage = new SystemMessageConfig
+    {
+        Mode = SystemMessageMode.Append,
+        Content = string.Join(
+            Environment.NewLine + Environment.NewLine,
+            new[] { existing, SovrintSystemAppend }.Where(value => !string.IsNullOrWhiteSpace(value))
+        )
+    };
+
+    // An explicit empty allowlist exposes no inherited first-party tools.
+    config.AvailableTools = [];
+
+    // Caller-defined tools must be explicitly supplied after review.
+    config.Tools = [];
+
+    return config;
+}
+
+await using var client = new CopilotClient();
+await client.StartAsync();
+
+var config = ApplySovrintStrictProfile(new SessionConfig
+{
+    Model = "gpt-5",
+    Streaming = true,
+});
+
+await using var session = await client.CreateSessionAsync(config);
+await session.SendAsync(new MessageOptions
+{
+    Prompt = "Summarize the supplied text without using tools."
+});
+```
+
+## Read-oriented profile
+
+A read-oriented deployment should provide an explicit `AvailableTools` allowlist containing only reviewed read operations. Do not infer tool safety from names alone; validate the actual SDK and CLI tool identifiers available in the deployed version.
+
+```csharp
+var config = new SessionConfig
+{
+    Model = "gpt-5",
+    Streaming = true,
+    AvailableTools =
+    [
+        // Add only reviewed read-tool identifiers for the deployed CLI version.
+    ],
+    SystemMessage = new SystemMessageConfig
+    {
+        Mode = SystemMessageMode.Append,
+        Content = SovrintSystemAppend + Environment.NewLine +
+                  "Operate in read-only mode."
+    }
+};
+```
+
+## Custom tools
+
+Custom tools are application code. Wrap their handlers with application authorization and bounded audit recording before placing them in `SessionConfig.Tools`.
+
+The wrapper should record only:
+
+- session reference;
+- tool name;
+- invocation reference;
+- decision;
+- reason code;
+- timestamp;
+- evidence status.
+
+It should not place arguments, results, credentials, prompts, or raw file contents into the audit event.
+
+## Boundaries
+
+- system-message append content is guidance, not a complete enforcement boundary;
+- an empty tool allowlist is safer than inheriting an unknown tool surface;
+- local application approval is not a global governance decision;
+- an audit event is not EvidenceGrid acceptance;
+- unknown or unsupported permission surfaces should fail closed.