docs: add v0.2.0 LangGraph documentation

Author: dchiitmalla

CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] — Unreleased
+
+### Added
+
+- **LangGraph integration** — `prooflayer.integrations.langgraph.SecurityMiddleware` wraps compiled LangGraph agents and supports sync, async, streaming, tool-call, state-update, and audit-log paths.
+- **Runtime detection categories for LangGraph** — prompt injection, jailbreak, tool abuse, output/input exfiltration, scope drift, state manipulation, multi-turn slow-burn attacks, and streaming output filtering.
+- **Adversarial evals** — `prooflayer.evals` adds a 30-probe built-in LangGraph suite, GARAK Docker runner, PromptFoo Docker runner, LangGraph target adapter, and JSON/Markdown findings reports.
+- **Compliance evidence** — `prooflayer.compliance` adds NIST AI RMF, EU AI Act, SOC 2, and HIPAA framework registries, event-to-control mapping, hashed evidence records, Markdown reports, and optional PDF output.
+- **Audit logging** — `prooflayer.audit` emits structured events with sha256 chain-of-custody hashes and SIEM-compatible JSON.
+- **Examples** — five LangGraph examples covering RAG, tool calling, multi-agent supervision, memory attacks, and production compliance reporting.
+
+### Notes
+
+- ProofLayer is positioned as complementary to LangSmith: LangSmith covers tracing and generic evals; ProofLayer covers adversarial evals, runtime security, and compliance evidence.
+- v0.1.0 MCP runtime and proxy integrations remain supported.
+
 ## [0.1.0] — 2026-05-12
 
 Initial open-source release of ProofLayer's runtime rules layer.

README.md

@@ -3,9 +3,10 @@
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
 
-ProofLayer Runtime is the open runtime security layer for MCP servers. It sits
-on the tool-call path, scans MCP requests with local rules, and can warn, block,
-or stop dangerous calls before they reach the underlying server.
+ProofLayer Runtime is the open runtime security layer for MCP servers and
+LangGraph agents. It sits on the tool-call or agent-execution path, scans
+requests with local rules, and can warn, block, or stop dangerous actions before
+they reach the underlying server, tool, state update, or output stream.
 
 The runtime works by itself in rules-only mode. It can also call the
 `prooflayer-detector` service over `/v1/detect` for model-backed scoring of
@@ -18,6 +19,13 @@ offering; see [proof-layer.com](https://www.proof-layer.com).
 
 - Local MCP runtime wrappers for synchronous and MCP Python SDK servers.
 - HTTP proxy transport for JSON-RPC `tools/call` traffic.
+- LangGraph runtime wrapper with prompt injection, jailbreak, tool abuse,
+  exfiltration, scope drift, state manipulation, multi-turn, and streaming
+  checks.
+- Adversarial evals for LangGraph agents through a built-in suite, GARAK, and
+  PromptFoo.
+- Compliance evidence mapped to NIST AI RMF, EU AI Act Articles 13-15, SOC 2
+  CC6/CC7, and HIPAA Security Rule.
 - YAML detection rules for prompt injection, jailbreaks, command injection,
   data exfiltration, role manipulation, tool poisoning, SSRF/XXE, and SQL
   injection.
@@ -78,6 +86,53 @@ Install MCP Python SDK support:
 pip install -e ".[mcp]"
 ```
 
+Install LangGraph support:
+
+```bash
+pip install -e ".[langgraph]"
+```
+
+Install everything:
+
+```bash
+pip install -e ".[all]"
+```
+
+## LangGraph Security Layer
+
+ProofLayer is complementary to LangGraph and LangSmith:
+
+| Layer | What it does | Provided by |
+|---|---|---|
+| Agent orchestration | Build, deploy, run agents | LangGraph |
+| Tracing + observability | See what agents did | LangSmith |
+| Generic evals | LLM-as-judge, regression tests | LangSmith |
+| Adversarial evals | GARAK / PromptFoo red-team probes | ProofLayer |
+| Runtime security | Real-time prompt injection, tool abuse, exfil detection + blocking | ProofLayer |
+| Compliance evidence | NIST AI RMF / EU AI Act / SOC 2 / HIPAA audit-defensible reports | ProofLayer |
+
+Three-line integration:
+
+```python
+from prooflayer.integrations.langgraph import SecurityConfig, SecurityMiddleware
+
+middleware = SecurityMiddleware(SecurityConfig(prompt_injection="block"))
+secured_graph = middleware.wrap(graph.compile())
+result = secured_graph.invoke({"input": user_input})
+```
+
+Run the examples:
+
+```bash
+python examples/integrations/langgraph/01_simple_rag.py
+python examples/integrations/langgraph/02_tool_calling_agent.py
+python examples/integrations/langgraph/03_multi_agent_supervisor.py
+python examples/integrations/langgraph/04_memory_attack_demo.py
+python examples/integrations/langgraph/05_production_template.py
+```
+
+See [docs/integrations/langgraph.md](docs/integrations/langgraph.md), [docs/evals.md](docs/evals.md), and [docs/compliance.md](docs/compliance.md).
+
 ## Verify Locally
 
 Benign call:

SPRINT_PROGRESS.md

@@ -15,3 +15,4 @@
 - Day 15: Added NIST AI RMF, EU AI Act, SOC 2, and HIPAA compliance framework registries with 20 AI-applicable controls each and schema tests.
 - Day 16: Added compliance evidence records, deterministic event-to-control mapping, Markdown report generation, optional PDF rendering, and tests.
 - Day 17: Added four additional LangGraph sample apps for tool validation, multi-agent state monitoring, multi-turn memory attacks, and production compliance reporting.
+- Day 18: Added LangGraph integration, evals, compliance, architecture, and API docs; updated README positioning and CHANGELOG for v0.2.0.

docs/api.md

@@ -0,0 +1,138 @@
+# API Reference
+
+This reference covers the v0.2.0 LangGraph, evals, compliance, and audit surfaces.
+
+## `prooflayer.integrations.langgraph`
+
+### `SecurityConfig`
+
+Runtime security configuration for LangGraph middleware.
+
+Key fields:
+
+- `prompt_injection`
+- `jailbreak`
+- `tool_abuse`
+- `exfil`
+- `scope_drift`
+- `state_manipulation`
+- `multi_turn`
+- `compliance_frameworks`
+- `emit_to`
+- `allowed_tools`
+- `session_id_key`
+- `streaming_block_mode`
+- `blocked_token`
+
+Detection actions are `allow`, `warn`, or `block`.
+
+### `SecurityMiddleware`
+
+Wraps compiled LangGraph objects and exposes:
+
+- `wrap(compiled_graph)`
+- `get_audit_log(session_id=None)`
+- `scan_input(payload, config=None)`
+- `scan_output(payload, config=None)`
+- `scan_state_update(state_update, config=None)`
+- `record_event(event)`
+
+### `ToolValidator`
+
+Validates LangGraph tool calls:
+
+- allowlist enforcement
+- suspicious argument inspection
+- output capture events
+
+### `StreamingFilter`
+
+Filters streamed chunks and event payloads for critical output detections.
+
+### Exceptions
+
+- `SecurityException`
+- `BlockedError`
+
+## `prooflayer.evals`
+
+### `LangGraphEvalTarget`
+
+Adapts a secured LangGraph object for eval runners:
+
+- `invoke(prompt, config=None)`
+- `ainvoke(prompt, config=None)`
+- `handle_chat_completions(request)`
+
+### `EvalRunner`
+
+Top-level orchestration:
+
+- `run_builtin_suite(target)`
+- `run_all(target, output_dir, endpoint_url=None, promptfoo_config=None, garak_probes=None)`
+
+### `GarakRunner`
+
+Docker-backed GARAK runner:
+
+- `build_command(endpoint_url, output_dir, probes=None)`
+- `run(endpoint_url, output_dir, probes=None)`
+- `parse_report(output_dir)`
+
+### `PromptFooRunner`
+
+Docker-backed PromptFoo runner:
+
+- `build_command(config_path, output_path, env=None)`
+- `run(config_path, output_path, env=None)`
+- `parse_report(output_path)`
+
+### `ReportGenerator`
+
+Renders eval reports as JSON and Markdown.
+
+## `prooflayer.compliance`
+
+### `ComplianceEmitter`
+
+Maps runtime events into framework controls:
+
+- `emit(event, previous_hash=None)`
+- `load_framework(framework)`
+
+### `EvidenceRecord`
+
+Auditor-facing evidence schema with sha256 chain-of-custody hashing.
+
+### `ComplianceReportGenerator`
+
+Renders compliance evidence:
+
+- `build(evidence_records, title=...)`
+- `to_markdown(evidence_records, title=..., output_path=None)`
+- `to_pdf(markdown, output_path)`
+
+## `prooflayer.audit`
+
+### `AuditEvent`
+
+Structured runtime event with:
+
+- session ID
+- rule ID
+- severity
+- decision
+- evidence snippet
+- timestamp
+- source
+- metadata
+- previous hash
+- event hash
+
+### `AuditLogger`
+
+Emits audit events to:
+
+- stdout
+- JSONL files
+- SIEM-compatible JSON

docs/architecture.md

@@ -214,3 +214,86 @@ For servers built with the official MCP Python SDK, `ProofLayerMCPWrapper` provi
 - **Tool poisoning detection** -- scans `list_tools` descriptions for injected instructions
 
 All three scanning points use the same `DetectionEngine` and scoring pipeline.
+
+## LangGraph Integration
+
+`prooflayer.integrations.langgraph.SecurityMiddleware` wraps compiled LangGraph objects and preserves the normal invocation interface:
+
+- `invoke`
+- `ainvoke`
+- `stream`
+- `astream`
+- `stream_events`
+- `astream_events`
+
+LangGraph hot path:
+
+```
+User input
+   |
+   v
+SecurityMiddleware.before_node("__graph__")
+   |
+   +--> DetectionEngine rules: prompt injection, jailbreak, tool abuse, exfil
+   +--> StateManipulationDetector for state-like inputs
+   +--> MultiTurnDetector keyed by thread_id/session_id
+   |
+   v
+Compiled LangGraph executes
+   |
+   v
+SecurityMiddleware.after_node("__graph__")
+   |
+   +--> DetectionEngine output exfil checks
+   +--> ScopeDriftDetector
+   |
+   v
+Secured result or BlockedError
+```
+
+Tool-level hooks are available for graph nodes that call tools:
+
+```
+LangGraph tool node
+   |
+   v
+middleware.hooks.on_tool_call(tool_name, tool_args)
+   |
+   +--> Tool allowlist
+   +--> Argument exfil and tool-abuse inspection
+   |
+   v
+Tool executes or BlockedError
+```
+
+Streaming output is filtered chunk by chunk. Critical detections either raise `BlockedError` or replace the chunk with the configured blocked token.
+
+## Evals and Compliance
+
+The eval layer normalizes findings from three sources:
+
+- ProofLayer built-in adversarial probes
+- GARAK Docker runner
+- PromptFoo Docker runner
+
+Eval reports can be rendered as JSON and Markdown.
+
+The compliance layer maps runtime events and eval reports into framework controls:
+
+```
+Detection event / eval report
+   |
+   v
+ComplianceEmitter
+   |
+   +--> NIST AI RMF
+   +--> EU AI Act Articles 13-15
+   +--> SOC 2 CC6/CC7
+   +--> HIPAA Security Rule
+   |
+   v
+EvidenceRecord with sha256 chain hash
+   |
+   v
+Markdown / optional PDF report
+```