@intutic/proxy 3.0.0 → 3.0.2

package/README.md

@@ -30,6 +30,12 @@ request or response path:
 | Destructive SQL | `plugins/sql_guard.rs`, called from the response gate | Refuse or warn on `DROP`, `TRUNCATE` or an unqualified `DELETE` in a model-emitted shell command against a database outside the allowlist, when an SOP declares `sql_guard:` |
 | Response Cache | `plugins/semantic_cache.rs` | Replay the answer to an identical request (exact match, Valkey), or to a reworded plain-text question in the same context (semantic match, TurboVec). An exchange whose prompt or answer has a DLP match is served but not cached |
 | SOP injection | `sops.rs` | Resolve SOPs by role and inject their content into system prompts |
+| Decision traffic | `decision_traffic.rs`, with `protocol/systemone.rs` and `protocol/decisions.rs` | Govern customer calls to decision models (`POST /v1/systemone`, `POST /v1/decisions`) like LLM calls: DLP on the state, the egress policy, and a version pin that refuses a moving model alias before the call; after it, abstentions under a floor and consequential calls are named in `x-intutic-decision-*` headers, the body unchanged. Each call is metered and written to the decision-traffic log |
+| Decide rules | `decide/gateway.rs` | Ask the SOPs' `decide:` rules of the self-hosted decide engine (`~/.intutic/decide/engine.json`, `INTUTIC_DECIDE_*`): `on: tool_call` rules about each tool call in a response once the deterministic gates allowed it (`DECIDE_REFUSED`, `DECIDE_ESCALATED`), `on: response` rules about the complete response, written into it as a `VIOLATION` or `AMBIGUOUS` note. A rule enforces only under its effective rollout and a pin for the engine's model digest; otherwise it runs as shadow |
+| Rule records | `plugins/response_gate.rs`, `plugins/anomaly/detectors.rs` | Withhold a tool call a qualified `requires_before:` (`action:run_tests[ok] -> …`) gates while its prerequisite is unmet (`PREREQUISITE_UNMET`), and a file-changing call outside `scope_paths` under `scope_paths_mode: enforce` (`OUT_OF_SCOPE`); re-ask a turn whose tool calls leave the declared plan under `plan_steps_mode: enforce` |
+| Reversibility lanes | `sops.rs`, `key_context.rs`, `proxy.rs` | Hold for review the actions in a lane an SOP's `closed_lanes:` (or the workspace's `closedLanes`) closes, as a `review_before:` action is held; under the workspace's `revertLane` setting, hold (`enforce`) or record as a shadowed hold (`shadow`) a reversible-wide action whose revert or rejection rate for the role is over the threshold. Workspace settings come from the control plane's key context |
+| Node kinds | `node_kind.rs`, `plugins/anomaly/graph_detectors.rs` | Hold each agent-graph node to its kind (`node_kind:` SOP key, `x-intutic-node-kind` header): a `code` node may not call a model, a `gate` node may not write files, run shell commands or start a child agent, and a `worker` node may not start a child agent (`NODE_KIND_DENIED`). A header can only add limits |
+| Context isolation | `plugins/anomaly/graph_detectors.rs` | Flag sibling workers handed nearly the same context; advisory by default, re-asks under `context_isolation: enforce` |
 
 ### Model Selection
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intutic/proxy",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "Native high-performance AI agent governance proxy binary",
   "type": "module",
   "main": "bin/proxy.js",