PyRIT CI/CD Security Gate

PyRIT CI/CD Security Gate (shared pipeline consumer). Run the assistant's small deterministic prompt-injection and unauthorized-tool corpus on pull requests; run broader multi-turn fuzzing nightly or before release. Gate on severity and reproducibility, not a universal jailbreak percentage.

Project 1 architecture boundaries: - assistant-api owns authentication, conversation ownership, rate/cost budgets, and request lifecycle. - privacy-gateway owns PII tokenization/restoration and mapping-vault access. It must not trust model output to decide what can be restored. - tool-runtime owns tool allowlists, argument validation, authorization, timeouts, and egress policy. - attack-harness drives test conversations but has no production credentials or unrestricted network access. - audit-client emits normalized events to the trajectory ledger; the ledger is not the source of authorization truth.

Acceptance evidence: multi-turn attack corpus with replayable transcripts; negative tool-authorization tests; PII leakage and cross-session isolation tests; verifiable event-chain test; SBOM and provenance report; CI run showing a seeded regression blocks the build.

#### Capability integrations within Project 1

These are bounded extensions of the assistant, not separate applications.