olyx-guardrails 1.1.0 → 1.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c330386f60e14497f63e1e07978fa28aa3b21b028685662fd524964689d6b340
-  data.tar.gz: 052c2af355cc8351a69052e1e07e5e8655c723b4f17b46c86f0d9726b4978d1d
+  metadata.gz: 3beec90de1af339d911ceeb8efd92759f478198cef96679313608caad32b20fa
+  data.tar.gz: e812ebb1c97a9d359a4cf98e93bbd28724356c80a72d94b0ae1b6fbeffa6a3cf
 SHA512:
-  metadata.gz: 94dbcc7502ced8d907c5154c585ab735330b33fa4b8a7cd0f3d74e4ec6cc1d325991ecb15fbcb9a00a5033b263486e4c040285fa0243e8a92540c7ec171c1647
-  data.tar.gz: fd53482fe7bb8c4f977d01cc0ea0064b10ef29ca5d722b024862b7d581d54647fb7e7d6b6a935b4874bc80f67c5fbd152b004d5454c925a54287084cd2b763b0
+  metadata.gz: ab91be7e1659df86895cb9a011f01bb782b48e7d4f153936570e95734b4ef72a86a6abdc5494f78f09f669a2ad4e05a1173d8e92a0fd584b5423de9a83f5a73b
+  data.tar.gz: 67861f12b3535faa4e52b50c440ef8d1696488ab88a32bfeda8ef16c50e99e90223b270177696730c99ee8ffb74a32e23fb35977beb7cd43e48507051525e320

data/CHANGELOG.md

@@ -3,6 +3,30 @@
 All notable changes to olyx-guardrails are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.3] - 2026-08-07
+
+### Changed
+
+- Added the Bundler release task expected by the trusted publishing workflow.
+
+## [1.1.2] - 2026-08-07
+
+### Changed
+
+- Added a tag-based RubyGems release workflow using trusted publishing.
+
+## [1.1.1] - 2026-07-24
+
+### Changed
+
+- The published gem now contains only runtime code, generator templates, and
+  its README, changelog, and license. Guides and runnable examples remain
+  available from the canonical repository.
+- Removed two internal, one-use indirection layers from Rails policy-path
+  normalization and policy redaction. Public behavior is unchanged.
+- The package manifest is now tested as an exact consumer-facing contract, and
+  path-like Rails policy configuration has direct boundary coverage.
+
 ## [1.1.0] - 2026-07-23
 
 ### Changed
@@ -142,4 +166,4 @@ Initial public release.
   compatibility contract.
 - Least-privilege, SHA-pinned CI actions; CodeQL and OpenSSF Scorecard
   scanning; a private vulnerability-reporting process (see
-  [SECURITY.md](SECURITY.md)).
+  [security policy](https://github.com/Olyx-labs/olyx-guardrails/security/policy)).

data/README.md

@@ -97,8 +97,9 @@ The default policy:
 - has no custom restricted-content rules.
 
 Production applications should construct an explicit policy instead of relying
-on defaults. See the [Policies guide](docs/POLICIES.md) for the complete rule
-language and YAML examples.
+on defaults. See the
+[Policies guide](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/POLICIES.md)
+for the complete rule language and YAML examples.
 
 ## Rails quick start
 
@@ -137,9 +138,10 @@ end
 Rails enforcement is opt-in. The gem does not scan parameters, callbacks,
 uploads, jobs, GraphQL operations, or Action Cable messages globally.
 
-The [Rails integration guide](docs/RAILS.md) covers every adapter, boot-time
-configuration, safe YAML loading, instrumentation payloads, and notification
-delivery.
+The
+[Rails integration guide](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/RAILS.md)
+covers every adapter, boot-time configuration, safe YAML loading,
+instrumentation payloads, and notification delivery.
 
 ## Choose the right entry point
 
@@ -191,31 +193,34 @@ The gem owns normalization, validation, failure handling, and safe result
 merging. The application owns model selection, prompting, authentication,
 timeouts, retries, and transport. LLM analysis findings can add a violation but cannot clear a deterministic finding.
 
-See the [provider contract](docs/API.md#llm-provider-contract) and the
-[local HTTP example](examples/local_llm_provider.rb). The example works with
-an application-owned classifier sidecar backed by any inference runtime. Read
-the [model-suitability criteria](docs/OPERATIONS.md#model-suitability) before
-using semantic analysis as a blocking production control.
+See the
+[provider contract](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/API.md#llm-provider-contract)
+and
+[local HTTP example](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/local_llm_provider.rb).
+The example works with an application-owned classifier sidecar backed by any
+inference runtime. Read the
+[model-suitability criteria](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/OPERATIONS.md#model-suitability)
+before using semantic analysis as a blocking production control.
 
 ## Documentation
 
-- [Documentation index](docs/README.md)
-- [Policies and restricted content](docs/POLICIES.md)
-- [Rails integration](docs/RAILS.md)
-- [Operations and production behavior](docs/OPERATIONS.md)
-- [API reference](docs/API.md)
-- [Release runbook](docs/RELEASING.md)
-- [Security policy](SECURITY.md)
-- [Contributing](CONTRIBUTING.md)
+- [Documentation index](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/README.md)
+- [Policies and restricted content](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/POLICIES.md)
+- [Rails integration](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/RAILS.md)
+- [Operations and production behavior](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/OPERATIONS.md)
+- [API reference](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/API.md)
+- [Release runbook](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/RELEASING.md)
+- [Security policy](https://github.com/Olyx-labs/olyx-guardrails/security/policy)
+- [Contributing](https://github.com/Olyx-labs/olyx-guardrails/blob/master/CONTRIBUTING.md)
 - [Changelog](CHANGELOG.md)
 
 Examples:
 
-- [Framework-free Ruby](examples/ruby_only.rb)
-- [Custom policy](examples/custom_policy.rb)
-- [Rails opt-in boundaries](examples/rails_opt_in.rb)
-- [Local LLM provider](examples/local_llm_provider.rb)
-- [Notifier handlers](examples/notifier.rb)
+- [Framework-free Ruby](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/ruby_only.rb)
+- [Custom policy](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/custom_policy.rb)
+- [Rails opt-in boundaries](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/rails_opt_in.rb)
+- [Local LLM provider](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/local_llm_provider.rb)
+- [Notifier handlers](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/notifier.rb)
 
 The framework-free, custom-policy, and notifier examples run directly. The
 Rails example is application-context code, and the local provider example
@@ -239,9 +244,12 @@ boundary or data-loss-prevention system.
   centralized policy rollout, and audit retention remain application or
   platform responsibilities.
 
-The [operations guide](docs/OPERATIONS.md) describes failure modes, data
-handling, risk scores, concurrency, and deployment boundaries. Report security
-issues through [SECURITY.md](SECURITY.md), not the public issue tracker.
+The
+[operations guide](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/OPERATIONS.md)
+describes failure modes, data handling, risk scores, concurrency, and
+deployment boundaries. Report security issues through the
+[security policy](https://github.com/Olyx-labs/olyx-guardrails/security/policy),
+not the public issue tracker.
 
 ## Development
 
@@ -255,7 +263,8 @@ bin/ci
 The development bundle includes Rails so contributors exercise the integration
 from the default test suite; Rails remains an optional runtime dependency for
 gem consumers. The Rails compatibility matrix is managed with Appraisal. See
-[CONTRIBUTING.md](CONTRIBUTING.md) before submitting a change.
+[contribution guide](https://github.com/Olyx-labs/olyx-guardrails/blob/master/CONTRIBUTING.md)
+before submitting a change.
 
 ## License
 

data/lib/olyx/guardrails/policy/redaction_result.rb

@@ -1,5 +1,9 @@
 # frozen_string_literal: true
 
+require_relative 'finding_presenter'
+require_relative 'redaction_spans'
+require_relative 'unmatched_transformer'
+
 module Olyx
   module Guardrails
     module PolicyComponents
@@ -9,7 +13,7 @@ module Olyx
 
         def call(source, findings, transform)
           {
-            text: PolicyRedactor.call(source, findings, transform: transform),
+            text: UnmatchedTransformer.call(source, RedactionSpans.call(findings), transform),
             violated: findings.any?,
             findings: FindingPresenter.call(findings)
           }

data/lib/olyx/guardrails/policy_scanner.rb

@@ -1,10 +1,8 @@
 # frozen_string_literal: true
 
-require_relative 'policy/finding_presenter'
 require_relative 'policy/match_collector'
 require_relative 'policy/redaction_result'
 require_relative 'policy/scan_result'
-require_relative 'policy_redactor'
 
 module Olyx
   # Policy-driven safety checks and redaction for Ruby applications.

data/lib/olyx/guardrails/rails/configuration_values.rb

@@ -2,7 +2,6 @@
 
 require_relative '../policy'
 require_relative 'filter_parameters'
-require_relative 'path_value'
 
 module Olyx
   module Guardrails
@@ -18,7 +17,10 @@ module Olyx
         end
 
         def path(value)
-          PathValue.call(value)
+          normalized = value.respond_to?(:to_path) ? value.to_path : value
+          return normalized.dup.freeze if normalized.is_a?(String) && !normalized.empty?
+
+          raise ArgumentError, 'Rails policy_path must be a path-like value'
         end
 
         def filter_parameters(value)

data/lib/olyx/guardrails/version.rb

@@ -3,6 +3,6 @@
 module Olyx
   module Guardrails
     # The current gem version, following semantic versioning.
-    VERSION = '1.1.0'
+    VERSION = '1.1.3'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: olyx-guardrails
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.3
 platform: ruby
 authors:
 - Moses Njoroge
@@ -42,30 +42,10 @@ extensions: []
 extra_rdoc_files:
 - CHANGELOG.md
 - README.md
-- docs/API.md
-- docs/OPERATIONS.md
-- docs/POLICIES.md
-- docs/RAILS.md
-- docs/README.md
-- docs/RELEASING.md
 files:
 - CHANGELOG.md
-- CODE_OF_CONDUCT.md
-- CONTRIBUTING.md
 - LICENSE
 - README.md
-- SECURITY.md
-- docs/API.md
-- docs/OPERATIONS.md
-- docs/POLICIES.md
-- docs/RAILS.md
-- docs/README.md
-- docs/RELEASING.md
-- examples/custom_policy.rb
-- examples/local_llm_provider.rb
-- examples/notifier.rb
-- examples/rails_opt_in.rb
-- examples/ruby_only.rb
 - lib/generators/olyx_guardrails/install_generator.rb
 - lib/generators/olyx_guardrails/templates/initializer.rb.tt
 - lib/generators/olyx_guardrails/templates/policy.yml.tt
@@ -158,7 +138,6 @@ files:
 - lib/olyx/guardrails/policy/unmatched_segment_builder.rb
 - lib/olyx/guardrails/policy/unmatched_transformer.rb
 - lib/olyx/guardrails/policy_aware_redactor.rb
-- lib/olyx/guardrails/policy_redactor.rb
 - lib/olyx/guardrails/policy_rule.rb
 - lib/olyx/guardrails/policy_rule/configuration.rb
 - lib/olyx/guardrails/policy_rule/description_value.rb
@@ -195,7 +174,6 @@ files:
 - lib/olyx/guardrails/rails/job_argument.rb
 - lib/olyx/guardrails/rails/job_reference.rb
 - lib/olyx/guardrails/rails/notification_dispatcher.rb
-- lib/olyx/guardrails/rails/path_value.rb
 - lib/olyx/guardrails/rails/policy_document.rb
 - lib/olyx/guardrails/rails/policy_file.rb
 - lib/olyx/guardrails/rails/policy_file_error.rb

data/CODE_OF_CONDUCT.md

@@ -1,25 +0,0 @@
-# Code of Conduct
-
-## Our commitment
-
-We are committed to a welcoming, professional, and harassment-free community
-for everyone, regardless of background, identity, experience, or ability.
-
-## Expected behavior
-
-- Be respectful, constructive, and specific.
-- Assume good intent while addressing harmful impact.
-- Accept technical feedback without personal attacks.
-- Respect privacy and confidentiality.
-- Focus disagreement on ideas, evidence, and project outcomes.
-
-Harassment, discrimination, threats, sexualized conduct, sustained disruption, doxing, or publication of another person's private information are not acceptable.
-
-## Enforcement
-
-Report conduct concerns privately to `conduct@olyxai.io`. Maintainers may edit
-or remove contributions, issue warnings, temporarily restrict participation, or
-permanently ban participants when necessary. Reports will be handled as
-confidentially as reasonably possible, with conflicts of interest recused.
-
-This policy applies in project spaces and when someone is publicly representing the project.

data/CONTRIBUTING.md

@@ -1,132 +0,0 @@
-# Contributing
-
-Thank you for improving Olyx Guardrails.
-
-## Development setup
-
-Detection logic (`lib/olyx/guardrails/pii/`, `secrets/`, `injection_detector.rb`,
-`policy*`, and friends) remains independent of Rails at gem runtime. The
-repository installs Rails as a development and test dependency so every
-contributor runs the integration tests from the same default bundle. Consuming
-applications that use only `require "olyx/guardrails"` do not load Rails.
-
-Prepare the complete development bundle:
-
-```bash
-rbenv install
-bin/setup
-```
-
-Run the complete pre-pull-request gate:
-
-```bash
-bin/ci
-```
-
-`bin/ci` runs coverage-enforced tests, documentation validation, public RDoc
-coverage, RuboCop, RubyCritic, and the strict per-file quality gate. Individual
-tests remain runnable through `bundle exec ruby -Itest path/to/test_file.rb`.
-CI separately refreshes the Ruby advisory database and audits the committed
-dependency lockfile. This network-backed check stays outside `bin/ci` so the
-local quality gate remains reproducible offline after setup.
-
-### Rails adapter changes
-
-```bash
-bundle exec appraisal rake test
-```
-
-Run this in addition to the above only when the change touches
-`lib/olyx/guardrails/rails/`, `lib/generators/`, or their tests. The Appraisal
-matrix covers Rails 8.0 and 8.1; Rails integration changes must pass every
-configured line while the standalone core remains free of Rails runtime
-dependencies.
-
-Ruby 3.4 or newer is supported. Changes must remain compatible with the oldest
-supported Ruby unless the same pull request deliberately changes the gem's
-requirement.
-
-RubyCritic is a blocking regression gate configured in `.rubycritic.yml`.
-Do not lower its baseline to merge a change. Refactor new hot spots and ratchet
-the minimum upward when sustained improvements raise the measured score.
-The minimum score is 95; new files must remain focused on one reason to change,
-and every production file must remain A-rated. RubyCritic smells, duplication,
-and per-file complexity are review signals, not automatic design instructions:
-address genuine responsibility or clarity problems, but do not introduce proxy
-methods, unnecessary indirection, or metaprogramming merely to silence a
-heuristic.
-
-RuboCop's `Metrics/AbcSize` (max 10), `Metrics/CyclomaticComplexity` (max 7),
-`Metrics/PerceivedComplexity` (max 7), and `Metrics/ClassLength` (max 60 lines)
-are the blocking structural-complexity gate, calibrated against this
-codebase's measured distribution rather than RuboCop's looser defaults. Do not
-split cohesive code, hide behavior behind dynamic dispatch, or weaken a public
-API merely to improve a score. A public DSL or metaprogramming macro that
-genuinely needs more room is a `# rubocop:disable` with an inline reason, or a
-file-level exclude in `.rubocop.yml` with a comment explaining the constraint
-— reviewed like any other exception, not a separate exemption file.
-
-## Documentation
-
-Public documentation follows the same contract discipline as production code:
-
-- write simple, declarative sentences in the present tense;
-- keep the README focused on the shortest correct integration;
-- place task-oriented explanations in the appropriate guide;
-- keep signatures, defaults, return shapes, and exceptions in `docs/API.md`;
-- use complete, copyable examples with synthetic data;
-- link to one canonical explanation instead of duplicating it; and
-- update documentation and tests in the same change as public behavior.
-
-Run `ruby script/documentation_gate.rb` after changing Markdown. The gate checks
-local files and heading anchors. CI also syntax-checks every Ruby example.
-
-Public code comments use native RDoc conventions and the same concise,
-declarative style. Document behavior, accepted arguments, return values,
-exceptions, security boundaries, and non-obvious edge cases. Do not narrate
-implementation mechanics or repeat the method name. Add supported source files
-to the RDoc whitelist in `olyx-guardrails.gemspec`; implementation-only
-constants remain outside that manifest and are not compatibility commitments.
-
-## Pull requests
-
-Contributions follow the same fork-and-pull-request workflow used by established
-open-source projects:
-
-1. Open an issue first for substantial API, policy, or architectural changes.
-   Small fixes may go directly to a pull request.
-2. Fork the repository and create a focused branch from the latest `master`.
-   Do not work directly on `master`.
-3. Add tests for behavior changes and adversarial regression tests for
-   security-sensitive fixes.
-4. Update README, API reference, examples, and changelog when public behavior
-   changes.
-5. Run `bin/ci` locally, plus the Appraisal Rails matrix when the change touches
-   `lib/olyx/guardrails/rails/` or `lib/generators/`.
-6. Open a draft pull request early when maintainer feedback would prevent
-   rework. Mark it ready only when its description and validation checklist are
-   complete.
-
-Pull requests run with read-only GitHub token permissions, including
-contributions from forks. CI never requires repository secrets. The protected
-default branch requires the supported Ruby and Rails matrix, dependency audit,
-quality gate, CodeQL analysis, resolved review conversations, and maintainer
-approval. Maintainers squash approved pull requests, and GitHub deletes the
-source branch after merge.
-
-Maintainers may ask for a pull request to be split when unrelated behavior,
-refactoring, or generated dependency changes make review unsafe. Force-pushing
-a contributor branch is acceptable while responding to review; GitHub
-dismisses stale approvals when the protected branch changes.
-
-Maintainer releases follow [docs/RELEASING.md](docs/RELEASING.md). Do not
-publish an artifact that has not completed that runbook.
-
-Never include real credentials, personal data, production endpoints, or
-customer content in fixtures. Use clearly synthetic values.
-
-By submitting a contribution, you agree that it is licensed under the
-Apache-2.0 license used by this project.
-
-Security vulnerabilities must follow [SECURITY.md](SECURITY.md), not the public
-issue tracker.

data/SECURITY.md

@@ -1,61 +0,0 @@
-# Security Policy
-
-## Supported versions
-
-Security fixes are provided for the latest released minor version. Users should
-upgrade to the latest patch release before reporting an issue.
-
-| Version | Supported |
-|---|---|
-| 1.1.x | Yes |
-| <= 1.0 | No |
-
-## Reporting a vulnerability
-
-Do not open a public issue for a suspected vulnerability.
-
-Use a
-[private GitHub security advisory](https://github.com/Olyx-labs/olyx-guardrails/security/advisories/new)
-or email `mosesnjoroge@olyxai.io` with:
-
-- the affected version and component;
-- reproduction steps or a minimal proof of concept;
-- expected and observed behavior;
-- the potential confidentiality, integrity, or availability impact; and
-- any suggested remediation or disclosure constraints;
-- whether the issue is already public; and
-- a secure contact method for follow-up.
-
-You should receive an acknowledgement within three business days and an initial
-assessment within seven business days. We will coordinate remediation and
-disclosure with the reporter.
-
-## Response process
-
-After triage, the maintainer will:
-
-1. confirm the affected supported versions and severity;
-2. reproduce the issue using synthetic data;
-3. develop a fix and adversarial regression test in private;
-4. prepare release notes and upgrade guidance;
-5. publish a patched gem; and
-6. disclose the issue after supported users can upgrade.
-
-Timelines after the initial assessment depend on severity, exploitability, and
-release coordination. The reporter receives material status changes through
-the private reporting channel.
-
-## Safe research
-
-Good-faith research must use systems and data the researcher owns or has
-permission to test. Do not access another person's data, degrade a service,
-perform denial-of-service testing, use social engineering, or publicly disclose
-an unpatched issue. Reports that follow these boundaries will not be pursued
-for accidental, non-destructive violations of this policy.
-
-## Scope notes
-
-Pattern-based guardrails are defense-in-depth controls, not complete semantic
-security boundaries. Documented detection limitations alone are not
-vulnerabilities, but bypasses of a documented invariant—especially redaction,
-blocking, or third-party data-egress guarantees—are in scope.