Spine Lite — .NET

Spine Lite ports the authority-separation pattern into Semantic Kernel's function invocation pipeline. Six effect classes, fail-closed default, cryptographic receipt chain, enforced as an IFunctionInvocationFilter before the function executes.

v0.1.0 is single-process local enforcement. Distributed gating, Ed25519 signing, and PAR tracking belong in a future M87.Spine.Pro package.

Repository role: .NET port of the Spine Lite governance pattern, built on Semantic Kernel. Effect taxonomy and receipt format are wire-compatible with M87-Spine-lite (the original Claude Code hook implementation), not with spine-lite-python, which uses a separate taxonomy. Status: Published to NuGet (M87.Spine 0.1.0).

Install

dotnet add package M87.Spine

Targets net8.0. Pinned to Microsoft.SemanticKernel 1.75.0.

Minimal example

usingMicrosoft.Extensions.DependencyInjection;usingMicrosoft.SemanticKernel;usingM87.Spine;usingM87.Spine.Configuration;usingM87.Spine.Models;vargate=ManifestGate.Load("manifest.json");varclassifier=newEffectClassifier(gate);varevaluator=newPolicyEvaluator();usingvaremitter=newReceiptEmitter("receipts.jsonl",sessionId:"demo");varoptions=newSpineOptions{ManifestPath="manifest.json",ReceiptLogPath="receipts.jsonl",Posture=Posture.Normal,};varfilter=newSpineFilter(gate,classifier,evaluator,emitter,options);varbuilder=Kernel.CreateBuilder();builder.Services.AddSingleton<IFunctionInvocationFilter>(filter);varkernel=builder.Build();

A full runnable demo lives at samples/BasicSemanticKernelHost/.

The seven invariants

1. Proposal ≠ Execution. The kernel proposes a function call; the filter intercepts before invocation.
2. Authority Separation.EffectClassifier, PolicyEvaluator, and ReceiptEmitter are distinct services.
3. Fail-Closed Default. Unknown function denies. Missing manifest entry denies. Classification failure denies. Exception during evaluation denies.
4. Artifact-Backed Completion. Every approve and every deny emits a SHA-256-chained receipt. No invocation completes without a receipt.
5. Structured Memory. Receipt log is append-only JSONL. Manifest is hashed at load and verified.
6. Model Interchangeability. No dependency on a specific LLM. The filter operates on Semantic Kernel function metadata.
7. Narrative ≠ Runtime. SK [Description] attributes are advisory. Authority lives in the manifest.

Six effect classes (wire-faithful with M87-Spine-lite)

Wire string	Meaning
SHELL_SAFE	Read-only shell (git status, ls, cat)
SHELL_MUTATING	State-changing shell (git add, mkdir, cp)
SHELL_DANGEROUS	Destructive (rm -rf, sudo, chmod)
NETWORK_ATTEMPT	Outbound network (curl, wget, pip install)
SCOPED_WRITE	Allowed file writes within repo boundary
RESTRICTED_WRITE	Blocked writes (.env, secrets, credentials)

Posture matrix

Posture	Behavior
NORMAL	Honors manifest's allowed flag.
ELEVATED	Denies all NETWORK_ATTEMPT regardless of manifest; otherwise NORMAL.
LOCKDOWN	Denies everything except SHELL_SAFE on allowed entries.

What this is not

• Not Spine Pro. No distributed gate. No cross-machine signing. No PAR tracking over time.
• Not auto-function-calling aware. v0.1.0 registers IFunctionInvocationFilter only; IAutoFunctionInvocationFilter is out of scope.
• Not a replacement for runtime sandboxing. Spine enforces a manifest contract; it does not constrain what an executing function can reach inside the host process.

Receipts are byte-compatible with M87-Spine-lite v0.1.0. Twelve top-level fields (receipt_id, session_id, proposal_id, sequence_number, timestamp, executor, action, result, budget_snapshot, git_context, previous_receipt_hash, receipt_hash); SHA-256 chain. Schema at tests/M87.Spine.Tests/fixtures/receipt.schema.json.

License

MIT. See LICENSE.

Contributing

Community-maintained beyond v0.1.0. Open issues and PRs welcome. Receipt schema (v1.0.0) and manifest schema (v1.0.0) are frozen for cross-language interop; additive changes go to v1.1.0, breaking changes to v2.0.0.