Behavioral Safety Fingerprint

Lock in the safety behaviors you fixed — and block the ones that regress.

The config fingerprint hashes your agent's identity (prompt + tools + model). The drift grader watches an overall score. Neither answers the producer question the CI-gate moat names: which specific safety BEHAVIORS did my agent exhibit, and did a previously-passing one silently regress between two deploys? This is that artifact. AgentSmack folds the same cross-surface findings envelope every scan emits into a deterministic behavioral safety fingerprint — the sorted set of failing (surface, findingKey) behavior classes, hashed (a clean run gets the canonical empty fingerprint). Pin it as your expectedSafetyFingerprint, and on the next run the gate flags exactly which behavior classes newly regressed — and blocks the deploy. The verdict keys off the per-class set, never the aggregate score, so an overall-score-up-but-behavior-regressed move can't launder a regression; relabeling or reordering findings can't either (the signature is a sorted set over closed keys); and an omitted surface is reported not-assessed, never silently credited as fixed. It adds no new surface and no scorecard dimension. Load a sample to watch the gate block with no live infra.