Field Value Status Research prototype Maturity Low Field-ready No — not clinical, not field-certified Last reviewed 2026-08-07

DarkSpace x Gray Swan integration scaffold. Research only — not field-certified.

Offline-first HTTP classifier for agentic customer-support transcripts. Combines deterministic rule scoring with a lightweight CPU semantic gate (sentence-transformers MiniLM). Designed for reproducibility: fixed dependencies, declarative Dockerfile, no network calls on the classification hot path.

Repository: github.com/FratresMedAI/DarkSpace-X-RuleGuard

Rule layer: High-precision patterns for prompt-injection framing, credential phishing, tool-argument abuse, and multi-turn orchestration smuggling. Pattern families were informed by published survey and taxonomy literature on jailbreak and indirect injection techniques (e.g. crescendo, translation smuggling, synthetic tool traces), cross-checked against benign enterprise phrasing to control false positives.

Semantic layer: Embedding similarity for fuzzy alignment; runs fully on CPU in the default container.

Mini-Templar wrapper: Optional “rescue” path for weak multi-signal cases using corroboration and entropy heuristics (see mini_templar/core.py).

Verify:

See docs/API.md for request/response schema and all supported POST routes (compatible with common classifier probes: /v1/classify, /classify, /api/v1/classify, root POST /, and a catch-all POST).

Single-turn JSONL:

Multi-turn labeled JSON export:

See SECURITY.md. Classification is stateless with respect to remote services; SQLite audit hooks initialize locally for compatibility with legacy middleware—treat deployments as ephemeral or mount an empty volume for audit_log.db if persistence is undesired.

Apache-2.0 — see LICENSE.

If you use this system in research or assurance reports, cite the repository URL and the commit SHA you reproduced.

For UK AISI, CISA-style, or independent review: full reproduction = Docker build from this tree + checksum of lockfiles (requirements-docker.txt as pinned in image) + documented ENV (see Dockerfile).