What aw1-breaker 2.0.0 checks before a tool call

The current main branch declares aw1-breaker 2.0.0. Its ExecutionBreaker.intercept method accepts an actor ID, tool name, payload, and amount. It calls ASTSymbolicUnpacker, checks the returned markers, then applies a rolling velocity check.

What the current path does

• Inspect payloads. ASTSymbolicUnpacker decodes payloads prefixed with base64:, checks configured string signatures, and attempts to parse Python with ast. It marks patterns that match its configured call, import, network, or critical-target checks. ExecutionBreaker halts when a returned marker appears in its DANGEROUS_PRIMITIVES set.
• Check recent amounts. StatefulCausalMemory keeps per-actor amount logs in a Python dictionary. Its default window is 30 days. It compares recent amounts plus the proposed amount with a configurable velocity baseline and returns VELOCITY_SPIKE_DETECTED if the ratio exceeds 1.0.
• Return a decision. The halt path returns HALT_AND_CONTAIN, a reason, measured latency, and a SHA-256 digest. The permitted path returns PERMITTED and an AW1-EXEC-TOKEN-... string generated with secrets.token_hex(8). The reviewed method does not show that token being signed or verified.

The repository also contains separate modules for trust reconciliation, regulatory certificates, and loan-gateway checks. This article describes the ExecutionBreaker.intercept path; those modules are not called from that method.

The package metadata in setup.py declares Python 3.9+ and runtime dependencies on Flask and Requests, so the current package is not dependency-free.

This is a source-level account of the implementation on main, not evidence of production deployment, complete policy coverage, or a security guarantee. Deployment behavior depends on how the caller uses the breaker and handles its result.

For more detail, see the HOL plugin listing, source repository, and project documentation.