0.1.x is an alpha developer-tool line. Security fixes are made on the default branch; no long-term support window is promised yet.

Please use GitHub's private vulnerability reporting for this repository if it is enabled, or email support@samsarix.com. Do not include credentials, private prompts, customer data, or active exploit material in a public issue. If neither private channel is available, open a minimal public issue asking for a private contact channel without disclosing sensitive details.

Samsarix Agent Swarm coordinates application-supplied async responders. The library:

• treats task text, context, responder output, run records, run contracts, and suite manifests as untrusted data;
• validates JSON-compatible metadata and the versioned run-record, contract, and suite schemas;
• restricts suite references to bounded relative paths that remain inside the manifest directory after resolution;
• bounds rounds, retries, timeouts, task size, reply size, context size, metadata depth, and local transcript memory;
• propagates cancellation and refuses silent file overwrite;
• does not read credentials, open network connections, execute tools, evaluate code, or run shell commands;
• does not provide a sandbox, authentication system, authorization policy, or secret store.

The embedding application owns model credentials, prompt redaction, tenant isolation, tool permissions, network egress, provider budgets, and authorization. Never execute model output as code or a command without a separate trusted policy and sandbox boundary.

There is no telemetry. State remains in memory unless the caller explicitly writes a run record. Saved JSON records contain full tasks, replies, metadata, timestamps, and errors; applications should choose an appropriate protected location and retention period. Avoid putting secrets in task text or responder error messages.

The package has no provider client and incurs no API cost on its own. A custom responder may incur cost. Keep max_retries=0 unless duplicate calls are known to be safe, set a response timeout, cap provider output, and enforce account-level budgets in the adapter or provider.

• bypass of the configured round/retry/timeout limits;
• cross-run state corruption caused by the library's concurrency controls;
• path handling that silently overwrites an unintended file;
• unsafe run-record, contract, or suite parsing that produces code execution, path escape, or unbounded resource use;
• package/build behavior that ships unexpected executable code or secrets.

Model quality, prompt injection inside an application-supplied responder, provider compromise, and downstream execution of model text are not vulnerabilities in this library unless repository code creates or bypasses the relevant security boundary.