@highflame/policy 2.2.23 → 2.2.25

package/_schemas/guardrails/context.json

@@ -65,37 +65,43 @@
           "key": "injection_score",
           "type": "number",
           "required": false,
-          "description": "Combined prompt injection confidence (0-100). MAX of all detector scores (Pulse + DeepContext). Use injection_pulse_score / injection_deep_context_score for individual detector control"
+          "description": "Combined prompt injection confidence (0-100). MAX of all detector scores (Pulse + DeepContext). Use injection_pulse_score / injection_deep_context_score for individual detector control",
+          "range": "0-100"
         },
         {
           "key": "jailbreak_score",
           "type": "number",
           "required": false,
-          "description": "Combined jailbreak detection confidence (0-100). MAX of all detector scores (Pulse + DeepContext). Use jailbreak_pulse_score / jailbreak_deep_context_score for individual detector control"
+          "description": "Combined jailbreak detection confidence (0-100). MAX of all detector scores (Pulse + DeepContext). Use jailbreak_pulse_score / jailbreak_deep_context_score for individual detector control",
+          "range": "0-100"
         },
         {
           "key": "injection_pulse_score",
           "type": "number",
           "required": false,
-          "description": "Highflame single-turn classifier score for prompt injection (0-100). Raw score from Pulse detector before combination with deep-context. Use for per-detector policy control"
+          "description": "Highflame single-turn classifier score for prompt injection (0-100). Raw score from Pulse detector before combination with deep-context. Use for per-detector policy control",
+          "range": "0-100"
         },
         {
           "key": "injection_deep_context_score",
           "type": "number",
           "required": false,
-          "description": "DeepContext multi-turn analyzer score for prompt injection (0-100). Tracks injection patterns across conversation history. Generally higher confidence than single-turn"
+          "description": "DeepContext multi-turn analyzer score for prompt injection (0-100). Tracks injection patterns across conversation history. Generally higher confidence than single-turn",
+          "range": "0-100"
         },
         {
           "key": "jailbreak_pulse_score",
           "type": "number",
           "required": false,
-          "description": "Highflame single-turn classifier score for jailbreak attempts (0-100). Raw score from Pulse detector before combination with deep-context"
+          "description": "Highflame single-turn classifier score for jailbreak attempts (0-100). Raw score from Pulse detector before combination with deep-context",
+          "range": "0-100"
         },
         {
           "key": "jailbreak_deep_context_score",
           "type": "number",
           "required": false,
-          "description": "DeepContext multi-turn analyzer score for jailbreak attempts (0-100). Detects jailbreak escalation patterns across conversation turns"
+          "description": "DeepContext multi-turn analyzer score for jailbreak attempts (0-100). Detects jailbreak escalation patterns across conversation turns",
+          "range": "0-100"
         },
         {
           "key": "injection_type",
@@ -143,7 +149,8 @@
           "key": "pii_score",
           "type": "number",
           "required": false,
-          "description": "PII detection ML classifier confidence (0-100). Catches novel PII patterns including names, addresses, and identifiers that regex rules may miss. Typical threshold: >=80 for high-confidence blocking"
+          "description": "PII detection ML classifier confidence (0-100). Catches novel PII patterns including names, addresses, and identifiers that regex rules may miss. Typical threshold: >=80 for high-confidence blocking",
+          "range": "0-100"
         },
         {
           "key": "highest_severity",
@@ -155,37 +162,43 @@
           "key": "violence_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for violent content references (0-100). Typical threshold: >90 for critical blocks, >60 for warnings"
+          "description": "ML-based score for violent content references (0-100). Typical threshold: >90 for critical blocks, >60 for warnings",
+          "range": "0-100"
         },
         {
           "key": "hate_speech_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for hate speech, discriminatory language, or targeted harassment (0-100). Typical threshold: >75 for blocks"
+          "description": "ML-based score for hate speech, discriminatory language, or targeted harassment (0-100). Typical threshold: >75 for blocks",
+          "range": "0-100"
         },
         {
           "key": "sexual_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for sexual or adult content (0-100). Adjust thresholds based on your application's audience"
+          "description": "ML-based score for sexual or adult content (0-100). Adjust thresholds based on your application's audience",
+          "range": "0-100"
         },
         {
           "key": "weapons_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for weapons references or violent imagery (0-100)"
+          "description": "ML-based score for weapons references or violent imagery (0-100)",
+          "range": "0-100"
         },
         {
           "key": "crime_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for criminal activity discussions (0-100)"
+          "description": "ML-based score for criminal activity discussions (0-100)",
+          "range": "0-100"
         },
         {
           "key": "profanity_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for profanity and vulgar language (0-100)"
+          "description": "ML-based score for profanity and vulgar language (0-100)",
+          "range": "0-100"
         },
         {
           "key": "content_topics",
@@ -197,7 +210,8 @@
           "key": "topic_confidence",
           "type": "number",
           "required": false,
-          "description": "Confidence score from topic classifier (0-100). Use with content_topics to tune sensitivity — higher thresholds reduce false positives"
+          "description": "Confidence score from topic classifier (0-100). Use with content_topics to tune sensitivity — higher thresholds reduce false positives",
+          "range": "0-100"
         },
         {
           "key": "invisible_chars_detected",
@@ -209,7 +223,8 @@
           "key": "invisible_chars_score",
           "type": "number",
           "required": false,
-          "description": "Density score for invisible characters in the content (0-100). Higher scores indicate more invisible characters, suggesting evasion attempts"
+          "description": "Density score for invisible characters in the content (0-100). Higher scores indicate more invisible characters, suggesting evasion attempts",
+          "range": "0-100"
         },
         {
           "key": "command_injection_detected",
@@ -227,7 +242,8 @@
           "key": "command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for command injection detection (0-100). Higher scores indicate stronger pattern matches"
+          "description": "Confidence score for command injection detection (0-100). Higher scores indicate stronger pattern matches",
+          "range": "0-100"
         },
         {
           "key": "path_traversal_detected",
@@ -263,7 +279,8 @@
           "key": "sql_injection_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for SQL injection detection (0-100). Typical threshold: >=75 for blocks"
+          "description": "Confidence score for SQL injection detection (0-100). Typical threshold: >=75 for blocks",
+          "range": "0-100"
         },
         {
           "key": "cross_origin_detected",
@@ -281,7 +298,8 @@
           "key": "cross_origin_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for cross-origin escalation (0-100). Higher scores indicate more suspicious cross-boundary activity"
+          "description": "Risk score for cross-origin escalation (0-100). Higher scores indicate more suspicious cross-boundary activity",
+          "range": "0-100"
         },
         {
           "key": "package_install_detected",
@@ -305,7 +323,8 @@
           "key": "malicious_package_score",
           "type": "number",
           "required": false,
-          "description": "100 when a malicious package was detected, 0 otherwise"
+          "description": "100 when a malicious package was detected, 0 otherwise",
+          "range": "0-100"
         },
         {
           "key": "malicious_packages",
@@ -313,6 +332,31 @@
           "required": false,
           "description": "Malicious packages as ecosystem/name[@version] strings (e.g. 'PyPI/evil-pkg@1.0.0')"
         },
+        {
+          "key": "package_names",
+          "type": "array",
+          "required": false,
+          "description": "Names of all packages parsed from the install command (without ecosystem prefix), e.g. ['requests', 'left-pad']. Available even when the osv.dev lookup fails."
+        },
+        {
+          "key": "package_ecosystems",
+          "type": "array",
+          "required": false,
+          "description": "Unique package ecosystems seen in this event, e.g. ['PyPI', 'npm']. Useful for policy rules that restrict which ecosystems are permitted."
+        },
+        {
+          "key": "package_advisory_count",
+          "type": "number",
+          "required": false,
+          "description": "Total number of non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected."
+        },
+        {
+          "key": "package_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean.",
+          "range": "0-100"
+        },
         {
           "key": "package_check_status",
           "type": "string",
@@ -341,7 +385,8 @@
           "key": "encoded_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for encoded injection attempts (0-100). Considers encoding density and decoded content patterns"
+          "description": "Risk score for encoded injection attempts (0-100). Considers encoding density and decoded content patterns",
+          "range": "0-100"
         },
         {
           "key": "detected_language",
@@ -359,7 +404,8 @@
           "key": "language_confidence",
           "type": "number",
           "required": false,
-          "description": "Confidence score for language detection (0-100). Use with detected_language to tune sensitivity"
+          "description": "Confidence score for language detection (0-100). Use with detected_language to tune sensitivity",
+          "range": "0-100"
         },
         {
           "key": "detected_script",
@@ -377,25 +423,29 @@
           "key": "script_confidence",
           "type": "number",
           "required": false,
-          "description": "Confidence score for script detection (0-100)"
+          "description": "Confidence score for script detection (0-100)",
+          "range": "0-100"
         },
         {
           "key": "hallucination_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for hallucinated or fabricated content (0-100). Higher scores indicate higher likelihood of non-factual claims"
+          "description": "ML-based score for hallucinated or fabricated content (0-100). Higher scores indicate higher likelihood of non-factual claims",
+          "range": "0-100"
         },
         {
           "key": "factuality_score",
           "type": "number",
           "required": false,
-          "description": "ML-based factuality assessment score (0-100). Higher scores indicate more factually grounded content"
+          "description": "ML-based factuality assessment score (0-100). Higher scores indicate more factually grounded content",
+          "range": "0-100"
         },
         {
           "key": "sentiment_score",
           "type": "number",
           "required": false,
-          "description": "Sentiment analysis score. Use to detect overly negative or manipulative tone in prompts or responses"
+          "description": "Sentiment analysis score. Use to detect overly negative or manipulative tone in prompts or responses",
+          "range": "0-100"
         },
         {
           "key": "contains_code",
@@ -413,7 +463,8 @@
           "key": "code_ratio",
           "type": "number",
           "required": false,
-          "description": "Percentage of content that consists of code (0-100). High values may indicate code dumps or automated content"
+          "description": "Percentage of content that consists of code (0-100). High values may indicate code dumps or automated content",
+          "range": "0-100"
         },
         {
           "key": "keyword_matched",
@@ -449,7 +500,8 @@
           "key": "content_safety_score",
           "type": "number",
           "required": false,
-          "description": "Aggregate content safety score (0-100). Combines multiple safety signals into a single risk indicator"
+          "description": "Aggregate content safety score (0-100). Combines multiple safety signals into a single risk indicator",
+          "range": "0-100"
         },
         {
           "key": "content_safety_blocked",
@@ -473,7 +525,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -485,7 +538,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
@@ -539,31 +593,36 @@
           "key": "session_max_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
         },
         {
           "key": "session_max_jailbreak_score",
           "type": "number",
           "required": false,
-          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest command injection score seen in any turn of the session (0-100)"
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_pii_score",
           "type": "number",
           "required": false,
-          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_secret_score",
           "type": "number",
           "required": false,
-          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_cumulative_risk_score",
@@ -665,7 +724,8 @@
           "key": "tool_risk_score",
           "type": "number",
           "required": false,
-          "description": "Computed risk score for this tool call (0-100). Considers tool sensitivity, argument patterns, and MCP verification status. Typical threshold: >85 for dangerous tools"
+          "description": "Computed risk score for this tool call (0-100). Considers tool sensitivity, argument patterns, and MCP verification status. Typical threshold: >85 for dangerous tools",
+          "range": "0-100"
         },
         {
           "key": "tool_is_sensitive",
@@ -731,7 +791,8 @@
           "key": "sequence_risk",
           "type": "number",
           "required": false,
-          "description": "Risk score from action sequence analysis (0-100). Analyzes history of tool calls to detect attack patterns. Typical threshold: >80 for blocks"
+          "description": "Risk score from action sequence analysis (0-100). Analyzes history of tool calls to detect attack patterns. Typical threshold: >80 for blocks",
+          "range": "0-100"
         },
         {
           "key": "loop_detected",
@@ -755,7 +816,8 @@
           "key": "budget_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining token budget as percentage (0-100). Use this to warn or block when budget is low. Requires session with token budget configuration"
+          "description": "Remaining token budget as percentage (0-100). Use this to warn or block when budget is low. Requires session with token budget configuration",
+          "range": "0-100"
         },
         {
           "key": "budget_exceeded",
@@ -767,7 +829,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -779,7 +842,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
@@ -797,7 +861,8 @@
           "key": "topic_confidence",
           "type": "number",
           "required": false,
-          "description": "Confidence score from topic classifier for tool content (0-100)"
+          "description": "Confidence score from topic classifier for tool content (0-100)",
+          "range": "0-100"
         },
         {
           "key": "secrets_detected",
@@ -839,25 +904,29 @@
           "key": "pii_score",
           "type": "number",
           "required": false,
-          "description": "PII detection ML classifier confidence for tool content (0-100). Catches novel PII patterns that escape regex detection"
+          "description": "PII detection ML classifier confidence for tool content (0-100). Catches novel PII patterns that escape regex detection",
+          "range": "0-100"
         },
         {
           "key": "injection_score",
           "type": "number",
           "required": false,
-          "description": "Combined prompt injection confidence in tool arguments (0-100). MAX of all detector scores (Pulse + DeepContext). Use injection_pulse_score / injection_deep_context_score for individual detector control"
+          "description": "Combined prompt injection confidence in tool arguments (0-100). MAX of all detector scores (Pulse + DeepContext). Use injection_pulse_score / injection_deep_context_score for individual detector control",
+          "range": "0-100"
         },
         {
           "key": "injection_pulse_score",
           "type": "number",
           "required": false,
-          "description": "Highflame single-turn classifier score for prompt injection in tool arguments (0-100). Raw score from Pulse detector before combination with deep-context"
+          "description": "Highflame single-turn classifier score for prompt injection in tool arguments (0-100). Raw score from Pulse detector before combination with deep-context",
+          "range": "0-100"
         },
         {
           "key": "injection_deep_context_score",
           "type": "number",
           "required": false,
-          "description": "DeepContext multi-turn analyzer score for prompt injection in tool arguments (0-100). Tracks injection patterns across tool call history"
+          "description": "DeepContext multi-turn analyzer score for prompt injection in tool arguments (0-100). Tracks injection patterns across tool call history",
+          "range": "0-100"
         },
         {
           "key": "command_injection_detected",
@@ -875,7 +944,8 @@
           "key": "command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for command injection in tool arguments (0-100)"
+          "description": "Confidence score for command injection in tool arguments (0-100)",
+          "range": "0-100"
         },
         {
           "key": "path_traversal_detected",
@@ -911,7 +981,8 @@
           "key": "sql_injection_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for SQL injection in tool arguments (0-100)"
+          "description": "Confidence score for SQL injection in tool arguments (0-100)",
+          "range": "0-100"
         },
         {
           "key": "tool_poisoning_detected",
@@ -923,7 +994,8 @@
           "key": "tool_poisoning_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for tool poisoning detection (0-100). Typical threshold: >=70 for blocks"
+          "description": "Confidence score for tool poisoning detection (0-100). Typical threshold: >=70 for blocks",
+          "range": "0-100"
         },
         {
           "key": "tool_poisoning_type",
@@ -941,7 +1013,8 @@
           "key": "rug_pull_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for rug pull detection based on behavioral drift analysis (0-100)"
+          "description": "Confidence score for rug pull detection based on behavioral drift analysis (0-100)",
+          "range": "0-100"
         },
         {
           "key": "mcp_config_risk",
@@ -959,7 +1032,8 @@
           "key": "mcp_risk_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for MCP configuration issues (0-100). Typical threshold: >=70 for blocks"
+          "description": "Risk score for MCP configuration issues (0-100). Typical threshold: >=70 for blocks",
+          "range": "0-100"
         },
         {
           "key": "tool_operation_classes",
@@ -983,7 +1057,8 @@
           "key": "cross_origin_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for cross-origin escalation in tool calls (0-100)"
+          "description": "Risk score for cross-origin escalation in tool calls (0-100)",
+          "range": "0-100"
         },
         {
           "key": "package_install_detected",
@@ -1007,7 +1082,8 @@
           "key": "malicious_package_score",
           "type": "number",
           "required": false,
-          "description": "100 when a malicious package was detected, 0 otherwise"
+          "description": "100 when a malicious package was detected, 0 otherwise",
+          "range": "0-100"
         },
         {
           "key": "malicious_packages",
@@ -1015,6 +1091,31 @@
           "required": false,
           "description": "Malicious packages as ecosystem/name[@version] strings (e.g. 'PyPI/evil-pkg@1.0.0')"
         },
+        {
+          "key": "package_names",
+          "type": "array",
+          "required": false,
+          "description": "Names of all packages parsed from the install command (without ecosystem prefix), e.g. ['requests', 'left-pad']. Available even when the osv.dev lookup fails."
+        },
+        {
+          "key": "package_ecosystems",
+          "type": "array",
+          "required": false,
+          "description": "Unique package ecosystems seen in this event, e.g. ['PyPI', 'npm']. Useful for policy rules that restrict which ecosystems are permitted."
+        },
+        {
+          "key": "package_advisory_count",
+          "type": "number",
+          "required": false,
+          "description": "Total number of non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected."
+        },
+        {
+          "key": "package_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean.",
+          "range": "0-100"
+        },
         {
           "key": "package_check_status",
           "type": "string",
@@ -1043,7 +1144,8 @@
           "key": "encoded_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for encoded injection in tool arguments (0-100)"
+          "description": "Risk score for encoded injection in tool arguments (0-100)",
+          "range": "0-100"
         },
         {
           "key": "path",
@@ -1061,13 +1163,15 @@
           "key": "invisible_chars_score",
           "type": "number",
           "required": false,
-          "description": "Invisible character attack severity score in tool arguments (0-100)"
+          "description": "Invisible character attack severity score in tool arguments (0-100)",
+          "range": "0-100"
         },
         {
           "key": "indirect_injection_score",
           "type": "number",
           "required": false,
-          "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs, retrieved documents, or external content. Use >=70 for general blocking, >=50 for sensitive tools"
+          "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs, retrieved documents, or external content. Use >=70 for general blocking, >=50 for sensitive tools",
+          "range": "0-100"
         },
         {
           "key": "indirect_injection_type",
@@ -1097,7 +1201,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -1109,7 +1214,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
@@ -1163,31 +1269,36 @@
           "key": "session_max_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
         },
         {
           "key": "session_max_jailbreak_score",
           "type": "number",
           "required": false,
-          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest command injection score seen in any turn of the session (0-100)"
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_pii_score",
           "type": "number",
           "required": false,
-          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_secret_score",
           "type": "number",
           "required": false,
-          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_cumulative_risk_score",
@@ -1337,7 +1448,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -1349,7 +1461,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
@@ -1403,31 +1516,36 @@
           "key": "session_max_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
         },
         {
           "key": "session_max_jailbreak_score",
           "type": "number",
           "required": false,
-          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest command injection score seen in any turn of the session (0-100)"
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_pii_score",
           "type": "number",
           "required": false,
-          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_secret_score",
           "type": "number",
           "required": false,
-          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_cumulative_risk_score",
@@ -1535,7 +1653,8 @@
           "key": "invisible_chars_score",
           "type": "number",
           "required": false,
-          "description": "Invisible character attack severity score (0-100) in write content"
+          "description": "Invisible character attack severity score (0-100) in write content",
+          "range": "0-100"
         },
         {
           "key": "secrets_detected",
@@ -1589,7 +1708,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -1601,7 +1721,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
@@ -1655,31 +1776,36 @@
           "key": "session_max_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
         },
         {
           "key": "session_max_jailbreak_score",
           "type": "number",
           "required": false,
-          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest command injection score seen in any turn of the session (0-100)"
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_pii_score",
           "type": "number",
           "required": false,
-          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_secret_score",
           "type": "number",
           "required": false,
-          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_cumulative_risk_score",
@@ -1793,7 +1919,8 @@
           "key": "tool_poisoning_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for tool poisoning in MCP server tools (0-100)"
+          "description": "Confidence score for tool poisoning in MCP server tools (0-100)",
+          "range": "0-100"
         },
         {
           "key": "tool_poisoning_type",
@@ -1817,7 +1944,8 @@
           "key": "mcp_risk_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for MCP configuration issues (0-100)"
+          "description": "Risk score for MCP configuration issues (0-100)",
+          "range": "0-100"
         },
         {
           "key": "cross_origin_detected",
@@ -1835,13 +1963,15 @@
           "key": "cross_origin_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for cross-origin escalation in server connection (0-100)"
+          "description": "Risk score for cross-origin escalation in server connection (0-100)",
+          "range": "0-100"
         },
         {
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -1853,7 +1983,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
@@ -1907,31 +2038,36 @@
           "key": "session_max_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
         },
         {
           "key": "session_max_jailbreak_score",
           "type": "number",
           "required": false,
-          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest command injection score seen in any turn of the session (0-100)"
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_pii_score",
           "type": "number",
           "required": false,
-          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_secret_score",
           "type": "number",
           "required": false,
-          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_cumulative_risk_score",