olyx-guardrails 1.1.3 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3beec90de1af339d911ceeb8efd92759f478198cef96679313608caad32b20fa
-  data.tar.gz: e812ebb1c97a9d359a4cf98e93bbd28724356c80a72d94b0ae1b6fbeffa6a3cf
+  metadata.gz: 196f3e181407760bea2e26500d3e3eaa5ce29b886922ad361eab20e98ea76b68
+  data.tar.gz: 24144315dc438469cc42ca4d876834b44c3ad3b1b42430a80d6bc693e57ceec3
 SHA512:
-  metadata.gz: ab91be7e1659df86895cb9a011f01bb782b48e7d4f153936570e95734b4ef72a86a6abdc5494f78f09f669a2ad4e05a1173d8e92a0fd584b5423de9a83f5a73b
-  data.tar.gz: 67861f12b3535faa4e52b50c440ef8d1696488ab88a32bfeda8ef16c50e99e90223b270177696730c99ee8ffb74a32e23fb35977beb7cd43e48507051525e320
+  metadata.gz: e3ecc41c16b5f43dc99beb1af720a1f5f0a4f68fbb5453504a21e01c14ff7f1c248e724bd7987e5e4db50aa15944cf03291556a41c951282b98351eb863e1512
+  data.tar.gz: 8814874a0d9f40c93a6deb3b2063da29378f6a149742319f19b9b6aa7a50142e52937baab9cc71e6ae58706d42a65820467391d8a583eae021f7d1cad7665b1f

data/CHANGELOG.md

@@ -3,6 +3,31 @@
 All notable changes to olyx-guardrails are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [Unreleased]
+
+## [1.2.1] - 2026-11-11
+
+### Changed
+
+- Simplify evaluation, message handling, LLM analysis, and numeric date validation
+  while preserving the public result contract.
+- Require patched Rails test bundles: 8.1.4.1 or newer on Rails 8.1 and
+  8.0.5.2 or newer on Rails 8.0, with Rack >= 3.2.8 and Crass >= 1.0.8.
+- Document request-body limits, host allowlists, and trusted proxy headers for
+  applications consuming the gem.
+
+## [1.2.0] - 2026-10-02
+
+### Changed
+
+- Scans long inputs in overlapping windows and narrows injection matching to
+  reduce missed detections and false positives.
+- Sanitizes provider failures and stops treating confidentiality labels as
+  credentials; applications can enforce those labels with policy rules.
+- Reports risk independently from blocking policy.
+- Consolidates scanning and configuration internals, with tests,
+  documentation, and RuboCop as the public quality gate.
+
 ## [1.1.3] - 2026-08-07
 
 ### Changed
@@ -39,7 +64,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   decision has zero risk.
 - The Rails generator provides copyable policy customization instructions and
   tests the customized YAML path.
-- Contributor setup, complete local quality validation, and maintainer release
+- Contributor setup, local validation, and maintainer release
   verification have canonical commands and documentation.
 - Closely coupled proxy objects were folded into their owning runtime,
   configuration, result-building, and notification components.
@@ -47,7 +72,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   ignored instead of being coerced across the untrusted provider boundary.
 - Contributor and Rails appraisal locks use the current `net-imap` patch.
 - CI refreshes the Ruby advisory database and blocks known-vulnerable locked
-  dependencies without making the offline local quality gate network-dependent.
+  dependencies without making offline local validation network-dependent.
 
 ## [1.0.0] - 2026-07-21
 
@@ -155,11 +180,8 @@ Initial public release.
 
 - The core has one lightweight runtime dependency, Ruby's `base64` bundled gem.
   Rails remains optional and is loaded only when used.
-- CI enforces RuboCop — including calibrated structural-complexity cops
-  (`Metrics/AbcSize`, `CyclomaticComplexity`, `PerceivedComplexity`,
-  `ClassLength`) in place of a separate complexity tool — and a RubyCritic
-  maintainability gate, alongside the Appraisal matrix across Rails 8.0
-  and 8.1.
+- CI enforces tests, documentation checks, RuboCop, and the Appraisal matrix
+  across Rails 8.0 and 8.1.
 - Native RDoc covers every supported public class, module, constant, attribute,
   and method. CI blocks undocumented additions to the explicit public API
   manifest while leaving implementation-only constants outside the

data/README.md

@@ -1,65 +1,48 @@
 # Olyx Guardrails
 
-[![Gem Version](https://badge.fury.io/rb/olyx-guardrails.svg)](https://rubygems.org/gems/olyx-guardrails)
+[![RubyGems](https://img.shields.io/gem/v/olyx-guardrails?label=rubygems)](https://rubygems.org/gems/olyx-guardrails)
+[![Release](https://img.shields.io/github/v/release/Olyx-labs/olyx-guardrails?label=release)](https://github.com/Olyx-labs/olyx-guardrails/releases/latest)
 [![Test](https://github.com/Olyx-labs/olyx-guardrails/actions/workflows/test.yml/badge.svg)](https://github.com/Olyx-labs/olyx-guardrails/actions/workflows/test.yml)
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/Olyx-labs/olyx-guardrails/badge)](https://securityscorecards.dev/viewer/?uri=github.com/Olyx-labs/olyx-guardrails)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 
-Olyx Guardrails is an in-process safety boundary for Ruby and Rails
-applications that send or receive AI-generated content. It provides:
+Input and output checks for AI applications in Ruby and Rails.
 
-- PII and secret detection with explicit redaction;
-- prompt-injection and jailbreak detection, including adjacent-turn checks;
-- immutable, organization-specific restricted-content policies;
-- completed-input and completed-output decisions;
-- opt-in Rails adapters for common ingestion paths;
-- provider-agnostic semantic analysis through a callable LLM hook; and
-- sanitized notifications and Active Support instrumentation.
+Detect prompt injection, PII, secrets, and application-specific restricted
+content. Return explicit allow/block decisions and redact recognized content
+at the boundaries your application chooses.
 
-The deterministic checks run locally. The gem does not proxy model traffic,
-discover model calls, or send application content to a third party.
+Olyx Guardrails is a standalone gem. It works without Olyx CLI, Olyx Cloud,
+or an Olyx account. Deterministic checks run locally. An optional
+`llm_provider` receives raw input and may send it elsewhere through your
+application's adapter.
 
-## Requirements
+## Install
 
-| Component | Supported versions |
-|---|---|
-| Ruby | 3.4 or newer |
-| Rails | 8.0 and 8.1 |
+Requires **Ruby 3.4 or newer**. Rails is optional; the integration supports
+**Rails 8.0 and 8.1**. The framework-free API does not load Rails.
 
-Rails is optional. The standalone Ruby API does not load Rails.
-
-The 1.1 release supports Rails 8.0 and 8.1. Only the listed Rails
-series are tested and supported. When a series reaches upstream end-of-life,
-a subsequent gem release may remove it instead of maintaining framework
-security fixes independently. Every support change is recorded in the
-changelog.
-
-## Installation
-
-Add the gem to the application:
+Add to your `Gemfile`:
 
 ```ruby
-gem "olyx-guardrails", "~> 1.1"
+gem "olyx-guardrails", "~> 1.2"
 ```
 
-Then install the bundle:
-
-```bash
+```sh
 bundle install
 ```
 
-The only runtime gem dependency is Ruby's `base64` bundled gem, used for
-bounded encoded-input detection.
+The only runtime gem dependency is Ruby's bundled `base64` gem.
 
-## Quick start
+## Try it
 
-Create one immutable policy and use it at the application boundary:
+Save this as `guardrails_example.rb`:
 
 ```ruby
 require "olyx/guardrails"
 
 policy = Olyx::Guardrails::Policy.new(
-  name: "customer-data-boundary",
+  name: "application-boundary",
   max_input_length: 4_000,
   block_pii: false,
   block_injections: true,
@@ -75,198 +58,147 @@ policy = Olyx::Guardrails::Policy.new(
   ]
 )
 
+input = "Contact ada@example.com about the release."
 decision = Olyx::Guardrails.check(input, policy: policy)
-return forbidden unless decision[:allowed]
+abort "Input rejected" unless decision[:allowed]
 
-safe_input = Olyx::Guardrails.redact(input, policy: policy)[:text]
-completion = LlmClient.complete(safe_input)
+puts "Allowed: #{decision[:allowed]}"
+puts Olyx::Guardrails.redact(input, policy: policy)[:text]
 
-output_decision = Olyx::Guardrails.check_output(completion, policy: policy)
-return invalid_output unless output_decision[:allowed]
+restricted = Olyx::Guardrails.check("Discuss Project Falcon", policy: policy)
+puts "Restricted input allowed: #{restricted[:allowed]}"
 ```
 
-`check` makes a decision and never transforms input. `redact` transforms
-recognized content and never makes an allow/block decision. Applications that
-need both operations call both explicitly.
+Run it:
 
-The default policy:
+```sh
+bundle exec ruby guardrails_example.rb
+```
 
-- limits input to 10,000 characters;
-- blocks detected injection attempts;
-- reports, but does not block, detected PII and secrets; and
-- has no custom restricted-content rules.
+Expected output:
 
-Production applications should construct an explicit policy instead of relying
-on defaults. See the
-[Policies guide](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/POLICIES.md)
-for the complete rule language and YAML examples.
+```text
+Allowed: true
+Contact [EMAIL] about the release.
+Restricted input allowed: false
+```
 
-## Rails quick start
+In this policy, PII is reported without blocking, then explicitly redacted.
+Injection attempts, secrets, and the configured project name cause rejection.
+Policies are immutable: construct them once and reuse them.
+
+**Checking and redacting are separate operations.** `check` returns a decision
+without changing input. `redact` transforms recognized content without making
+an allow/block decision. Redaction does not override a rejection.
+
+Use `check_messages` for structured conversations and adjacent-turn detection.
+Use `check_output` and `redact_output` at completed-output boundaries. Your
+application owns the model call and must check the completed response before
+returning it. See the [complete Ruby example](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/ruby_only.rb) and
+[API reference](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/API.md) for the full flow and result contracts.
+
+## Add Rails enforcement
 
 Generate an initializer and environment-keyed policy file:
 
-```bash
+```sh
 bin/rails generate olyx_guardrails:install
 ```
 
-Add the controller concern only where content crosses an AI boundary:
+Review `config/initializers/olyx_guardrails.rb` and
+`config/olyx_guardrails.yml`, then include an adapter at an application boundary:
 
 ```ruby
 class AiRequestsController < ApplicationController
   include Olyx::Guardrails::Rails::Controller
 
   rescue_from Olyx::Guardrails::Blocked do |error|
-    render json: {
-      error: "input_rejected",
-      decision: error.decision
-    }, status: :unprocessable_entity
+    render json: { error: "input_rejected", decision: error.decision },
+           status: :unprocessable_entity
   end
 
   def create
     prompt = params.require(:prompt)
-    guardrails_check!(prompt, metadata: { user_id: current_user.id })
-
+    guardrails_check!(prompt)
     safe_prompt = guardrails_redact(prompt)[:text]
+
     completion = LlmClient.complete(safe_prompt)
     Olyx::Guardrails::Rails::Enforcer.check_output!(completion)
+    safe_output = Olyx::Guardrails::Rails.redact_output(completion)[:text]
 
-    render json: { completion: completion }, status: :created
+    render json: { completion: safe_output }
   end
 end
 ```
 
-Rails enforcement is opt-in. The gem does not scan parameters, callbacks,
-uploads, jobs, GraphQL operations, or Action Cable messages globally.
-
-The
-[Rails integration guide](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/RAILS.md)
-covers every adapter, boot-time configuration, safe YAML loading,
-instrumentation payloads, and notification delivery.
+`LlmClient` represents your application's existing model client. This controller
+example belongs in a Rails application; it is not a standalone script.
 
-## Choose the right entry point
+Enforcement is opt-in. The gem does not automatically scan every request, job,
+upload, or model call. The [Rails guide](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/RAILS.md) covers controllers,
+Active Job, Active Model, GraphQL, Action Cable, extracted upload text,
+instrumentation, and notifications.
 
-| Boundary | Entry point | Behavior |
-|---|---|---|
-| Plain text input | `Guardrails.check` | Returns an allow/block decision |
-| Structured messages | `Guardrails.check_messages` | Adds adjacent-turn detection |
-| Completed model output | `Guardrails.check_output` | Explicit output decision |
-| Plain text transformation | `Guardrails.redact` | Returns redacted text |
-| Completed output transformation | `Guardrails.redact_output` | Explicit output transformation |
-| Rails exception flow | `Rails::Enforcer.check!` | Raises `Guardrails::Blocked` when rejected |
-| Low-level secret enforcement | `SecretScanner.scan!` | Raises `SecretScanner::Blocked` on a finding |
+## Defaults and operational behavior
 
-All completed-output methods operate on complete values. They do not inspect a
-token stream before content reaches the caller.
-
-## Optional LLM provider
-
-`llm_provider` accepts any callable object. It receives the raw text and a
-bounded context hash containing deterministic findings:
+The default policy:
 
-```ruby
-provider = lambda do |text, context|
-  LocalClassifier.call(text: text, signals: context)
-end
+- rejects input longer than 10,000 Ruby characters;
+- blocks detected prompt injection;
+- reports PII and secrets without blocking them;
+- defines no custom restricted-content rules; and
+- preserves the deterministic decision if an optional LLM provider fails.
 
-policy = Olyx::Guardrails::Policy.new(llm_failure_mode: :block)
+Define an explicit production policy. If semantic analysis is required, choose
+`llm_failure_mode: :block` or `:raise`. The application supplies the classifier
+callable and owns its authentication, transport, timeouts, and retries.
+Semantic findings can add violations but cannot clear deterministic findings.
+See [policies](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/POLICIES.md) and the
+[provider contract](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/API.md#llm-provider-contract).
 
-result = Olyx::Guardrails.check(
-  input,
-  policy: policy,
-  llm_provider: provider
-)
-```
+Rails can publish content-free Active Support events. Optional notifier handlers
+receive sanitized events and run synchronously unless your application queues
+delivery. See [operations](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/OPERATIONS.md) for data handling and failure modes.
 
-The provider returns a hash or schema object containing any of:
+## Limitations
 
-```ruby
-{
-  injection_attempt: false,
-  pii_detected: false,
-  secret_leaked: false,
-  risk_score: 0.2,
-  reason: "No semantic violation found"
-}
-```
+Pattern-based checks can miss novel attacks, paraphrasing, translations,
+unsupported formats, and nested encodings. PII coverage is strongest for the
+documented North American and common international formats. Secret detection
+is format-based. Restricted-content rules do not infer semantic equivalents
+unless your application supplies additional analysis.
 
-The gem owns normalization, validation, failure handling, and safe result
-merging. The application owns model selection, prompting, authentication,
-timeouts, retries, and transport. LLM analysis findings can add a violation but cannot clear a deterministic finding.
+Completed-output methods evaluate complete values; they do not enforce a policy
+on tokens already streamed to a caller. Model routing, tool permissions,
+authorization, file extraction, distributed quotas, and audit storage remain
+application responsibilities.
 
-See the
-[provider contract](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/API.md#llm-provider-contract)
-and
-[local HTTP example](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/local_llm_provider.rb).
-The example works with an application-owned classifier sidecar backed by any
-inference runtime. Read the
-[model-suitability criteria](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/OPERATIONS.md#model-suitability)
-before using semantic analysis as a blocking production control.
+Treat guardrails as one layer of application protection. Read the
+[detection limits](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/OPERATIONS.md#detection-limits) before enabling production
+blocking.
 
-## Documentation
+## Documentation and examples
 
 - [Documentation index](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/README.md)
 - [Policies and restricted content](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/POLICIES.md)
 - [Rails integration](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/RAILS.md)
-- [Operations and production behavior](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/OPERATIONS.md)
-- [API reference](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/API.md)
-- [Release runbook](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/RELEASING.md)
-- [Security policy](https://github.com/Olyx-labs/olyx-guardrails/security/policy)
-- [Contributing](https://github.com/Olyx-labs/olyx-guardrails/blob/master/CONTRIBUTING.md)
-- [Changelog](CHANGELOG.md)
-
-Examples:
-
-- [Framework-free Ruby](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/ruby_only.rb)
-- [Custom policy](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/custom_policy.rb)
-- [Rails opt-in boundaries](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/rails_opt_in.rb)
-- [Local LLM provider](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/local_llm_provider.rb)
+- [Operations and notifications](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/OPERATIONS.md)
+- [Ruby API reference](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/API.md)
+- [Runnable Ruby example](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/ruby_only.rb)
+- [Custom policies](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/custom_policy.rb)
+- [Application-owned local classifier](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/local_llm_provider.rb)
 - [Notifier handlers](https://github.com/Olyx-labs/olyx-guardrails/blob/master/examples/notifier.rb)
 
-The framework-free, custom-policy, and notifier examples run directly. The
-Rails example is application-context code, and the local provider example
-expects the documented classifier sidecar.
-
-## Security model and limitations
-
-Olyx Guardrails is a defense-in-depth control, not a complete semantic security
-boundary or data-loss-prevention system.
-
-- Pattern-based detection can miss paraphrasing, translations, novel attacks,
-  unsupported homoglyphs, and nested encoding beyond the bounded normalization
-  pass.
-- PII support is strongest for documented North American and common
-  international formats.
-- Secret detection is format-based and cannot classify every high-entropy
-  string or future credential format.
-- Restricted-content rules are deterministic unless an application supplies an
-  LLM provider.
-- File parsing, authorization, streaming enforcement, distributed quotas,
-  centralized policy rollout, and audit retention remain application or
-  platform responsibilities.
-
-The
-[operations guide](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/OPERATIONS.md)
-describes failure modes, data handling, risk scores, concurrency, and
-deployment boundaries. Report security issues through the
-[security policy](https://github.com/Olyx-labs/olyx-guardrails/security/policy),
-not the public issue tracker.
-
-## Development
-
-Run the same gates used by CI:
-
-```bash
-bin/setup
-bin/ci
-```
+## Contributing and security
+
+See [CONTRIBUTING.md](https://github.com/Olyx-labs/olyx-guardrails/blob/master/CONTRIBUTING.md) for development setup and checks,
+[CHANGELOG.md](CHANGELOG.md) for release changes, and the
+[release runbook](https://github.com/Olyx-labs/olyx-guardrails/blob/master/docs/RELEASING.md) for maintainer procedures.
+
+Rails adapter changes must also pass `bundle exec appraisal rake test`.
 
-The development bundle includes Rails so contributors exercise the integration
-from the default test suite; Rails remains an optional runtime dependency for
-gem consumers. The Rails compatibility matrix is managed with Appraisal. See
-[contribution guide](https://github.com/Olyx-labs/olyx-guardrails/blob/master/CONTRIBUTING.md)
-before submitting a change.
+Report vulnerabilities through the [security policy](https://github.com/Olyx-labs/olyx-guardrails/blob/master/SECURITY.md).
 
 ## License
 
-Olyx Guardrails is available under the
 [Apache License 2.0](LICENSE).

data/lib/olyx/guardrails/check_result_builder.rb

@@ -10,42 +10,25 @@ module Olyx
 
       module_function
 
+      # Keep the fixed public contract together rather than splitting its fields across helpers.
+      # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
       def call(checks, analysis, policy)
         ordered = CHECK_ORDER.filter_map { |type| checks[type] }
-        base_result(checks, ordered, policy)
-          .merge(risk(checks, ordered, analysis))
-          .merge(analysis_result(analysis))
-      end
-
-      def base_result(checks, ordered, policy)
-        detection(checks, ordered).merge(policy(checks[:policy], policy))
-      end
-
-      def detection(checks, ordered)
-        {
+        result = {
           allowed: ordered.all? { |check| check[:allowed] },
           pii_detected: checks[:pii][:detected],
           injection_attempt: checks[:injection][:injection_attempt],
-          secret_leaked: checks[:secret][:leaked]
+          secret_leaked: checks[:secret][:leaked],
+          policy_name: policy.name,
+          policy_violated: checks[:policy][:violated],
+          policy_findings: checks[:policy][:findings],
+          risk_score: RiskScorer.call(checks, analysis),
+          checks: ordered
         }
+        result[:llm_analysis] = analysis if analysis
+        result
       end
-
-      def policy(check, configuration)
-        {
-          policy_name: configuration.name,
-          policy_violated: check[:violated],
-          policy_findings: check[:findings]
-        }
-      end
-
-      def risk(checks, ordered, analysis)
-        { risk_score: RiskScorer.call(checks, ordered, analysis), checks: ordered }
-      end
-
-      def analysis_result(analysis)
-        analysis ? { llm_analysis: analysis } : {}
-      end
-      private_class_method :base_result, :detection, :policy, :risk, :analysis_result
+      # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
     end
   end
 end

data/lib/olyx/guardrails/check_runner.rb

@@ -3,9 +3,9 @@
 require_relative 'check_result_builder'
 require_relative 'check_analyzer'
 require_relative 'check_set'
-require_relative 'check_pipeline'
 require_relative 'policy'
 require_relative 'validation'
+require_relative 'message_source'
 
 module Olyx
   module Guardrails
@@ -15,16 +15,22 @@ module Olyx
         new(input, **).call
       end
 
-      def initialize(input, policy:, llm_provider:)
-        @source = input.to_s
+      def initialize(input, policy:, llm_provider:, structured: false)
+        Validation.array_of!(input, Hash, name: 'messages') if structured
+        @messages = input if structured
+        @source = input.to_s unless structured
         @policy = policy
         @llm_provider = llm_provider
         validate_options!
+        @source = MessageSource.call(input) if structured
       end
 
       def call
-        checks = CheckSet.call(@source, policy: @policy)
-        CheckPipeline.call(@source, checks, policy: @policy, llm_provider: @llm_provider)
+        checks = CheckSet.call(@source, policy: @policy, messages: @messages)
+        merged, analysis = CheckAnalyzer.call(
+          checks, provider: @llm_provider, source: @source, policy: @policy
+        )
+        CheckResultBuilder.call(merged, analysis, @policy)
       end
 
       private

data/lib/olyx/guardrails/check_set.rb

@@ -1,33 +1,80 @@
 # frozen_string_literal: true
 
-require_relative 'checks/injection_check'
-require_relative 'checks/length_check'
-require_relative 'checks/pii_check'
-require_relative 'checks/policy_check'
-require_relative 'checks/secret_check'
-require_relative 'checks/skipped_checks'
+require_relative 'injection_detector'
+require_relative 'pii/text_scrubber'
+require_relative 'policy_scanner'
+require_relative 'secret_scanner'
 
 module Olyx
   module Guardrails
     # Coordinates independent deterministic checks for one normalized input.
     class CheckSet
-      CHECKS = {
-        pii: Checks::PiiCheck,
-        injection: Checks::InjectionCheck,
-        secret: Checks::SecretCheck,
-        policy: Checks::PolicyCheck
-      }.freeze
-
-      def self.call(source, policy:)
-        length = Checks::LengthCheck.call(source, policy)
-        content = length[:allowed] ? scan(source, policy) : Checks::SkippedChecks.call
+      def self.call(source, policy:, messages: nil)
+        length = length_check(source, policy)
+        content = length[:allowed] ? scan(source, policy, messages) : skipped_checks
         content.merge(length: length)
       end
 
-      def self.scan(source, policy)
-        CHECKS.to_h { |name, check| [name, check.call(source, policy)] }
+      def self.scan(source, policy, messages)
+        {
+          pii: pii_check(source, policy),
+          injection: injection_check(source, policy, messages),
+          secret: secret_check(source, policy),
+          policy: policy_check(source, policy)
+        }
       end
-      private_class_method :scan
+
+      def self.length_check(source, policy)
+        length = source.length
+        maximum = policy.max_input_length
+        { type: 'length', allowed: length <= maximum, length: length, max_length: maximum }
+      end
+
+      def self.pii_check(source, policy)
+        detected = Pii::TextScrubber.detect?(source)
+        { type: 'pii', allowed: !detected || !policy.block_pii?, detected: detected }
+      end
+
+      def self.injection_check(source, policy, messages)
+        scan = InjectionDetector.scan(messages || [{ 'role' => 'user', 'content' => source }])
+        attempt = scan[:injection_attempt]
+        {
+          type: 'injection',
+          allowed: !attempt || !policy.block_injections?,
+          injection_attempt: attempt,
+          patterns: scan[:patterns]
+        }
+      end
+
+      def self.secret_check(source, policy)
+        scan = SecretScanner.scan(source, custom_patterns: policy.secret_patterns)
+        leaked = scan[:leaked]
+        { type: 'secret', allowed: !leaked || !policy.block_secrets?, leaked: leaked, count: scan[:findings].size }
+      end
+
+      def self.policy_check(source, policy)
+        scan = PolicyScanner.scan(source, policy: policy)
+        findings = scan[:findings]
+        {
+          type: 'policy', allowed: !scan[:blocked], violated: scan[:violated],
+          count: findings.size, findings: findings
+        }
+      end
+
+      def self.skipped_checks
+        {
+          pii: skipped('pii', detected: false),
+          injection: skipped('injection', injection_attempt: false, patterns: []),
+          secret: skipped('secret', leaked: false, count: 0),
+          policy: skipped('policy', violated: false, count: 0, findings: [])
+        }
+      end
+
+      def self.skipped(type, **fields)
+        { type: type, allowed: true, skipped: true, **fields }
+      end
+      private_class_method :injection_check, :length_check, :pii_check, :policy_check, :scan,
+                           :secret_check, :skipped, :skipped_checks
     end
   end
 end

data/lib/olyx/guardrails/injection_patterns.rb

@@ -19,8 +19,7 @@ module Olyx
         /forget\s+(?:all\s+)?(?:your|previous)\s+instructions?/i,
         /your\s+(?:new\s+)?(?:instructions?\s+are|rules?\s+are)/i,
         /(?:override|bypass|ignore)\s+your\s+(?:instructions?|safety|restrictions?|filters?|rules?|training)/i,
-        /(?:pretend|act)\s+(?:you\s+are|as\s+if\s+you|as\s+a(?:n?\s+AI)?)/i,
-        /you\s+are\s+now\s+(?:a|an|free|DAN|unrestricted)/i,
+        /you\s+are\s+now\s+(?:an?\s+)?(?:free|DAN|unrestricted)(?:\s+AI)?/i,
         /(?:jailbreak|dan\s+mode|developer\s+mode|god\s+mode|unrestricted\s+mode)/i,
         /do\s+anything\s+now/i,
         /you\s+have\s+no\s+(?:restrictions?|limits?|rules?|filters?)/i,