Repository navigation
feat(guard): guardrails around every tool call — rules, baseline, loop interception, /rules (CLEAN-152) - #26
Open
maksymhryzodub-prog wants to merge 1 commit into
Conversation
…p interception, /rules (CLEAN-152) US1 of the ECC harness principles (specs/001-ecc-agent-principles, T013-T028). - New agent/guard slice: rules as markdown + frontmatter in .agent/rules/ and a protected platform baseline (no-secret-store-reads, no-env-reads, redact-credentials, record-all). Actions block / redact / record compose strictest-first; tool globs, JSON-path argument regexes with relative paths resolved against the agent dir, result regexes. - Fail semantics: load is all-or-nothing (a bad file keeps the previous set and is named with its problem); until a load succeeds every call is blocked; redact rules fail closed, observers fail open and are bounded by guard.observerTimeoutMs, logged once per rule. - LoopService.executeToolCalls runs before() ahead of the tool and after() on the result: the transcript keeps the raw result, the model and the reply get the redacted one; tool_result carries blocked/redacted flags; every call lands in data/toolcalls.jsonl with outcome, duration, sizes, rules fired and effect. - /rules and /rules reload (admin), rules summary in agent_status, runtime loads rules at start and blocks tools with the reason on failure. - tests/evals/guardrails.jsonl (31 extraction attempts) and the `blocked` eval mode: 100% blocked. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This was referenced Oct 12, 2026
feat(loop): verified completion and delegation with a completion contract (CLEAN-156, CLEAN-157)
#30
Open
maksymhryzodub-prog
added this pull request to stack #32
October 12, 2026 15:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
agent/guardslice — rules are markdown files with frontmatter (.agent/rules/*.md), same convention as skills. Four protected baseline rules ship with the runtime:no-secret-store-reads,no-env-reads(before, block),redact-credentials,record-all(after). Actions compose strictest-first: block > redact > record.exec|file,ranch__*,*), JSON-path argument regexes with relative paths resolved against the agent dir (cat data/secrets/x≡/agent/data/secrets/x), result regexes. Object params are matched as their raw strings and as JSON.GuardLoadErrornaming file + field, previous set stays; until a load succeeds every call is blocked with the reason. Redact rules fail closed (result withheld on evaluator error); observers fail open, bounded byguard.observerTimeoutMs, logged once per rule.before()ahead oftool.execute,after()on the result. Transcript keeps the raw result; the model's history copy and the outgoing reply are redacted (same split as the CLEAN-124 size cap).tool_resultevents carryblocked/redacted; every call →data/toolcalls.jsonl(tool, outcome ok/error/blocked/timeout, duration, sizes, rules fired, effect)./rules,/rules reload(admin; a bad file keeps the previous set and the reply names it),rulessummary inagent_status, start-up blocks tools with the reason on load failure.tests/evals/guardrails.jsonl, 31 extraction attempts (direct, roleplay, "for debugging", via script, python/node, base64, copy-out,.envvariants) +blockedmode inbun run eval.Deviation from the plan
The contract listed a
cap-result-sizebaseline rule. The size cap stays config-driven (tools.maxOutputChars) in the loop: a rule transforms the result the guard sees, while the cap must trim only the model's copy and leave the transcript intact. Noted incontracts/commands-and-config.md.Tests
bun test: 230 pass (41 new: matcher 12, service 24, loop integration 3, …), 1 pre-existing Windows-only failure (telegramFile).bun run eval: guardrails 31/31 = 100 % (SC-001).tsc --noEmit: clean apart from the pre-existingbridleAttachments.spec.tserrors.Jira: https://dreamvention.atlassian.net/browse/CLEAN-152
🤖 Generated with Claude Code