Skip to content

feat: R06 sandbox, R07 graft, R08 projection redaction - #57

Open
Siddhartha-singh01 wants to merge 1 commit into
mainfrom
feat/r06-r07-r08-conformance
Open

feat: R06 sandbox, R07 graft, R08 projection redaction#57
Siddhartha-singh01 wants to merge 1 commit into
mainfrom
feat/r06-r07-r08-conformance

Conversation

@Siddhartha-singh01

Copy link
Copy Markdown
Collaborator

Summary

Implements the three open §10 issues after R03:

ID Issue What
R06 #54 RunMode.SANDBOX rejects NON_IDEMPOTENT_WRITE before side effects
R07 #55 graft_artifact_ref / trajir/graft — artifact ref only, never THOUGHT
R08 #56 redact_projection_context / trajir/redact — secrets + THOUGHT scrub for projected context

Closes #54, #55, #56.

Design notes (senior constraints)

  • R06: enforcement at client exec_tool and make_run_step / Go ExecTool + RunStep; default remains live so demos and R01/R02 unchanged.
  • R07: only appends ARTIFACT_REF; refuses private kinds; does not copy source node history.
  • R08: shared heuristics with .tir redacted export (runtime/redact); CONSTRAINT nodes stay present with scrubbed fields (compatible with R04 when feat: R04 default context projector with CONSTRAINT budget safety #53 merges). Does not require projector on main.
  • Heuristic redaction is documented as not a full secret scanner (same honesty as existing export redaction).

Test plan

  • pytest conformance/r06_* r07_* r08_* + related unit tests
  • go build ./trajir/... and go vet on new packages
  • CI green (Linux authoritative for Windows Application Control flakes)

Implement remaining §10 conformance surfaces: sandbox mode rejects NON_IDEMPOTENT_WRITE (R06), graft_artifact_ref never copies THOUGHT (R07), and shared redact helpers for projected context (R08). Python + Go parity, conformance tests, README/CHANGELOG. Closes #54, #55, #56.

Signed-off-by: Siddhartha Singh <siddharthagithub0007@gmail.com>
@Ayush-Patel-56

Copy link
Copy Markdown
Collaborator

merge conflict, fix it please

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat: R06 sandbox / what-if branch rejects real NON_IDEMPOTENT_WRITE

2 participants