# Agentic AI drops digits, This library catches them before it runs in fintech

> Source: <https://github.com/insightitsGit/PrismManifest>
> Published: 2026-08-14 17:32:07+00:00

**Zero-trust tool-argument gate for deterministic AI tool execution.**

*(Formerly ParamGate — same design; package prismmanifest, CLI prismmanifest-gate.)*

PrismManifest sits between probabilistic extractors (LLMs, OCR, table parsers) and
deterministic Group 3 compute DAGs. Unverified money values never enter the DAG.
Only an Ed25519-signed `ParameterManifest`

that clears the Group 3 boundary
is allowed through.

Deterministic Engine + Unverified Probabilistic Input = Deterministic Wrong Answer

PyPI name |
`prismmanifest` |

**Version**`0.3.4`

**Python****License****Repository**[insightitsGit/PrismManifest](https://github.com/insightitsGit/PrismManifest)** Discussions**[Q&A and design](https://github.com/insightitsGit/PrismManifest/discussions)** Docs (Markdown)**`docs/`

**Docs (PDF)**`docs/pdf/`

**Usage guide**`docs/USAGE_FOR_ENGINEERS_AND_ARCHITECTS.md`

**Security**`SECURITY.md`

**Keywords:** tool argument gate, ParameterManifest, digit drop prevention, zero-trust LLM tool args, deterministic DAG boundary, OCR money field authorization, PrismManifest

Probabilistic systems (LLMs, OCR) are excellent at **proposing** where a number is.
They must not be trusted to **authorize** the dollar amount that enters a tax engine,
ledger, or underwriting model. PrismManifest is that authorization boundary.

```
pip install prismmanifest
```

With optional extras:

```
pip install "prismmanifest[dev]"
pip install "prismmanifest[cuda]"          # NVIDIA GPU + Numba
pip install "prismmanifest[kms-azure]"     # Azure Key Vault envelope keys
pip install "prismmanifest[kms-aws]"       # AWS KMS envelope (optional)
```

From source (editable):

```
git clone https://github.com/insightitsGit/PrismManifest.git
cd PrismManifest
python -m pip install -e ".[dev]"
python -m pytest -q
```

CLI after install: `prismmanifest-gate`

.

| Extra | Purpose |
|---|---|
`dev` |
pytest, coverage, grpcio-tools |
`docs` |
markdown + fpdf2 (PDF pack builder) |
`cuda` |
Numba + CUDA 12 wheels (GPU required) |
`kms-azure` / `kms` |
Azure Key Vault wrap (preferred cloud KMS) |
`kms-aws` |
boto3 AWS KMS-envelope |

- Treat LLMs / OCR / parsers as
**untrusted**. - Put PrismManifest
**after** extraction and**before** any calculator, underwriting, or ledger tool that consumes dollar amounts. - Route outcomes:
`ACCEPT`

→ run DAG ·`ACCEPT_PENDING_HUMAN`

→ review ·`REJECT`

→ stop. - Never let model-generated money text be the tool argument — only evidence-bound, signed manifests.

```
LLM / OCR  →  PrismManifest  →  signed ParameterManifest  →  Group 3 DAG
```

Extra LLM benches are **optional evidence**. They do not change the core gate design.
Finding real customer documents matters more for production claims than multi-model FA studies.

Full write-up: [Usage for Engineers & AI Architects](/insightitsGit/PrismManifest/blob/main/docs/USAGE_FOR_ENGINEERS_AND_ARCHITECTS.md)
(and PDF: `docs/pdf/01_USAGE_FOR_ENGINEERS_AND_ARCHITECTS.pdf`

).

``` python
from prismmanifest import KeyRing, PrismManifestPipeline, enforce_group3_boundary, GateDecision
from prismmanifest.router import DocumentPackage, IntentRouter
from prismmanifest.integrations import demo_capital_gains_dag

keyring = KeyRing.generate(key_id="local-dev-ed25519")

package = DocumentPackage(
    doc_id="1040.txt",
    pages=[
        "Form 1040 Tax Year 2024\n"
        "Line 1 Gross income: $470,000.00\n"
        "Line 11 Adjusted gross income: $450,000.00\n"
    ],
    form_type="IRS_FORM_1040",
    tax_year=2024,
)

# Route → ingest + span extraction (Pattern B pointers)
routed = IntentRouter().run(package)

# Verify, decide gate, sign manifest
pipeline = PrismManifestPipeline(keyring)
result = pipeline.run_on_evidence(
    evidence=routed.evidence,
    extraction=routed.extraction,
)

# Group 3 hard boundary — this is the security gate
gate = enforce_group3_boundary(
    result.manifest,
    public_keys=keyring,
    expected_dag_id="capital_gains_v3",
)
if gate.decision is GateDecision.ACCEPT:
    receipt = demo_capital_gains_dag(gate.manifest)
    print(receipt)
else:
    print(gate.decision, gate.message)
python
from prismmanifest.audit import EscalationQueue
from prismmanifest import PrismManifestPipeline, KeyRing

keyring = KeyRing.generate()
queue = EscalationQueue(".escalation")
pipeline = PrismManifestPipeline(keyring, escalation_queue=queue)
# PASS_WITH_HUMAN manifests are signed and auto-enqueued when a queue is attached.
python
from prismmanifest import parameter_gated, KeyRing

keyring = KeyRing.load(".keys")

@parameter_gated(public_keys=keyring, expected_dag_id="capital_gains_v3")
def run_dag(*, manifest):
    return manifest.fields[0].value_fixed_micro
```

Production trust must still go through `enforce_group3_boundary`

/ gRPC / C++ / in-process `prismmanifest_c`

.

``` python
from prismmanifest.binary_codec import encode_manifest
from prismmanifest.gate import enforce_group3_boundary

buf = encode_manifest(signed_manifest)
result = enforce_group3_boundary(buf, public_keys=keyring, expected_dag_id="capital_gains_v3")
```

Schema: [ schemas/prismmanifest.fbs](/insightitsGit/PrismManifest/blob/main/schemas/prismmanifest.fbs).

- Skip
`enforce_group3_boundary`

because the pipeline “looked good” - Feed LLM-printed
`$`

strings straight into the DAG - Treat
`@parameter_gated`

alone as the boundary - Market
`cuda_sim`

/ SKIP as CUDA-validated

**Ingest evidence** with dual-OCR consensus (PDF text + layout re-tokenizer; optional Tesseract).**Ground claims** to verbatim spans and form anchors (no generative money values).**Decide**`PASS`

/`PASS_WITH_HUMAN`

/`REFUSE`

via quorum, OCR floor (≥ 0.98), and plausibility.**Sign** a`ParameterManifest`

(Ed25519) and optionally escalate human review.**Enforce** the Group 3 boundary before any DAG runs — Python, gRPC, C++ FlatBuffer, or in-process DLL.

FinancePackBench and FinancePackBench-G4 provide synthetic SLA / adversarial suites.

| Status | Meaning |
|---|---|
`PASS` |
Span-grounded, plausibility OK, no disagreement, OCR ≥ 0.98, anchors OK |
`PASS_WITH_HUMAN` |
Immaterial disagreement (≤ $1k), low OCR, or anchors unverified |
`REFUSE` |
Not grounded, plausibility failure, or material disagreement (> $1k) |

| Decision | When |
|---|---|
`ACCEPT` |
`PASS` , or cleared `PASS_WITH_HUMAN` with valid human approval token |
`ACCEPT_PENDING_HUMAN` |
`PASS_WITH_HUMAN` awaiting review |
`REJECT` |
`REFUSE` , bad/missing clearance, or attestation/freshness/replay/dag failure |

Attestation, freshness (`signed_at_unix`

skew, default 300s), and replay (`ReplayGuard`

) failures raise `GateError`

.

```
# Keys
prismmanifest-gate gen-keys --out .keys --key-id local-dev-ed25519
prismmanifest-gate gen-hsm-key --out .hsm --key-id prod-ed25519
prismmanifest-gate gen-kms-key --out .kms --mode local --key-id kms-dev
# Azure: prismmanifest-gate gen-kms-key --out .kms --mode azure --kms-key-id <vault-key-url>

# Sign / verify
prismmanifest-gate sign --keys .keys --manifest manifest.json --out signed.json
prismmanifest-gate sign --keys .keys --manifest manifest.json --out signed.fbs --flatbuffer
prismmanifest-gate verify --keys .keys --manifest signed.json --dag-id capital_gains_v3

# Benches & proof
prismmanifest-gate bench --packages 500
prismmanifest-gate bench --require-cuda --packages 40
prismmanifest-gate bench-manifest-parity --packages 500 --require-cuda
prismmanifest-gate bench-perf --out reports/perf
prismmanifest-gate bench-customer-pdf --corpus .corpus/customer --seed-synthetic
prismmanifest-gate compliance --out reports/compliance
prismmanifest-gate pilot-pack --out reports/pilot_pack
prismmanifest-gate g4-suite --out reports/g4 --fuzz 200

# Ops / review
prismmanifest-gate audit-replay --store .audit --receipt <id> --keys .keys
prismmanifest-gate escalation-list --queue .escalation
prismmanifest-gate review-ui --queue .escalation --keys .keys --bind 127.0.0.1:8766
```

Proto: `proto/prismmanifest_gate.proto`

Service: `prismmanifest.v1.Group3Gate`

— `VerifyManifest`

, `ExecuteDag`

``` python
from prismmanifest.attestation import KeyRing
from prismmanifest.grpc_servicer import serve

serve(KeyRing.load(".keys"), bind="[::]:50051")
# Windows
powershell -File scripts/build_cpp_gate.ps1
# Produces: prismmanifest_gate_enforce.exe + prismmanifest_c.dll
prismmanifest_gate_enforce signed.fbs public.pem <key_id> capital_gains_v3
```

Python can call the shared library without process spawn:

``` python
from prismmanifest.cpp_bridge import enforce_fb, bridge_status
print(bridge_status())  # inprocess_available when PRISMMANIFEST_C_DLL / build present
```

“Ops packaging” = how you **run** the gate in a service (not the algorithm):

- Keys (local / software-HSM / Azure KV)
- RBAC, timeouts, idempotency, metrics (
`prismmanifest.ops`

) - Audit store + human review UI
- Optional C++ / CUDA beside the Python package

See [ docs/handoff/PILOT_DEPLOY.md](/insightitsGit/PrismManifest/blob/main/docs/handoff/PILOT_DEPLOY.md).

| Doc | Role |
|---|---|
|

[PRISMMANIFEST_SYSTEM_DESIGN.md](/insightitsGit/PrismManifest/blob/main/docs/PRISMMANIFEST_SYSTEM_DESIGN.md)**authority**)[PRISMMANIFEST_IMPLEMENTATION_PLAN.md](/insightitsGit/PrismManifest/blob/main/docs/PRISMMANIFEST_IMPLEMENTATION_PLAN.md)[PRISMMANIFEST_MASTER_SPECIFICATION.md](/insightitsGit/PrismManifest/blob/main/docs/PRISMMANIFEST_MASTER_SPECIFICATION.md)[FINANCEPACKBENCH_G4_ADVERSARIAL_SUITE.md](/insightitsGit/PrismManifest/blob/main/docs/FINANCEPACKBENCH_G4_ADVERSARIAL_SUITE.md)[FINANCEPACKBENCH_PROMPT_INJECTION_SEMANTICS.md](/insightitsGit/PrismManifest/blob/main/docs/FINANCEPACKBENCH_PROMPT_INJECTION_SEMANTICS.md)`PASS`

[docs/pdf/](/insightitsGit/PrismManifest/blob/main/docs/pdf/README.md)Regenerate PDFs:

```
pip install "prismmanifest[docs]"   # or: pip install markdown fpdf2
python scripts/build_docs_pdf.py
prismmanifest/           Python package
cpp/gate/            C++ canonicalize + FlatBuffer enforce + prismmanifest_c
cuda/kernels/        Experimental .cu kernels
schemas/             prismmanifest.fbs
proto/               gRPC Group3Gate
tests/               pytest
docs/                Specs + usage + PDF output
scripts/             proto, C++ build, CUDA shim, PDF builder
reports/             Generated proof artifacts (not required for pip install)
```

| Label | Meaning |
|---|---|
Pilot OSS |
Synthetic + adversarial FA=0 under test; Py/C++/CUDA decision parity; in-process C++ path |
Production claim |
Requires your live customer fax/scanned corpus to pass the same FA/SLA bar |

Also:

**Security boundary**=`enforce_group3_boundary`

/ gRPC / C++ /`prismmanifest_c`

— not`@parameter_gated`

alone.**CUDA:** real parity needs GPU + Numba;`cuda_sim`

is CI self-check only.**HSM:**`gen-hsm-key`

is software encrypted-at-rest, not PKCS#11 hardware.**Prompt injection:** PrismManifest is an execution trust gate — see the injection semantics doc before claiming “injection defense.”

Publishing notes: [ docs/PUBLISHING.md](/insightitsGit/PrismManifest/blob/main/docs/PUBLISHING.md).

| Channel | Use for |
|---|---|
|

[Issues](https://github.com/insightitsGit/PrismManifest/issues)[SECURITY.md](/insightitsGit/PrismManifest/blob/main/SECURITY.md)[CONTRIBUTING.md](/insightitsGit/PrismManifest/blob/main/CONTRIBUTING.md)Apache License 2.0 — see [LICENSE](/insightitsGit/PrismManifest/blob/main/LICENSE).

- Author:
**Amin Parva**([insightits.info@gmail.com](mailto:insightits.info@gmail.com)) - Company:
[https://www.insightits.com](https://www.insightits.com) - GitHub:
[https://github.com/insightitsGit/PrismManifest](https://github.com/insightitsGit/PrismManifest) - PyPI:
[https://pypi.org/project/prismmanifest/](https://pypi.org/project/prismmanifest/) - Product page:
[https://www.insightits.com/products/prismmanifest.html](https://www.insightits.com/products/prismmanifest.html)