# Trismag local engine

Deterministic inspection of untrusted agent content, on your machine. The
detector uses the Python standard library. No account, API key, scan quota,
telemetry, outbound requests or hosted billing code is included.

## Install the release wheel

Requires Python 3.10 or newer. Download the versioned wheel from the Trismag
installation page, then run this in a virtual environment:

```sh
python -m pip install ./trismag-0.4.11-py3-none-any.whl
python -m trismag --version
python -m trismag triage --text "The meeting is on Thursday."
python -m trismag triage --file document.txt --untrusted
```

The installed `trismag` command also works. `--file -` reads UTF-8 stdin.
`--messages messages.json` accepts an array of 1–8 strings; `--tools tools.json`
accepts 1–32 tool metadata objects. Files and total payloads are limited to
65,536 UTF-8 bytes. Larger inputs are rejected, not silently truncated.
MCP metadata traversal is bounded to depth 32 and 10,000 nodes per traversal.
No remote server is fetched and no tool is executed.

Exit codes: **0** = complete LOW scan, **1** = warning (hold/review), **2** =
invalid input or incomplete scan. Any nonzero exit or malformed/missing JSON
must stop a workflow that requires inspection. LOW is not proof of safety.

## Use it in Python

```python
from trismag import triage, triage_messages, triage_tools, inspect_or_raise

result = triage("The meeting is on Thursday.")
# result includes risk, findings, engine_version and scan_complete.

document = "The meeting is on Thursday."
released = inspect_or_raise(document)
# Only now pass `released` to your model. It is the unchanged original text.
```

`inspect_or_raise` applies a LOW-only policy with untrusted provenance. It raises
`ContentHeld` on warnings and `InspectionError` on invalid/incomplete input.
Keep these exceptions on your application's stop path. Other content paths must
use the same check. Tool permissions and action approvals remain independent.

Quotes do not suppress detection. Novel phrasing can pass. This package has no
LLM, intent model, sandbox, automatic interception or promise of complete detection.

## Local and hosted

The wheel contains a byte-for-byte copy of `src/quarantine.py`, the detector
imported by the hosted API. Equivalent inputs, provenance and detector versions
produce the same detection findings and risk. Hosted access tiers, quotas and
response envelopes differ. Always compare versions: deploying the API and
installing a local release are separate actions. Upgrades are explicit.

This release provides Python and CLI entry points. The existing hosted API and
workflow templates remain available. A packaged local HTTP service, Docker
image, native executable, Rust/WASM engine and npm package are not included.
The wheel is distributed directly; no PyPI publication is implied.

## Build from the development checkout

```sh
python -m pip wheel . --no-deps --wheel-dir dist
```

The build copies the canonical detector into `trismag/_engine.py`; do not keep
a second editable rule copy. Install a built wheel for development verification.
Editable installs are not supported by this initial release.