@vk.amogh/trace 2.1.0

package/src/trace_engine/plugin/bundle/hooks.json

@@ -0,0 +1,24 @@
+{
+  "trace-security-guard": {
+    "enabled": true,
+    "PostToolUse": [
+      {
+        "matcher": "replace_file_content",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "trace status",
+            "timeout": 15
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "type": "command",
+        "command": "trace findings",
+        "timeout": 20
+      }
+    ]
+  }
+}

package/src/trace_engine/plugin/bundle/mcp_config.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "trace-security": {
+      "command": "python",
+      "args": ["-m", "trace_engine.mcp.server"],
+      "env": {
+        "PYTHONUNBUFFERED": "1"
+      }
+    }
+  }
+}

package/src/trace_engine/plugin/bundle/plugin.json

@@ -0,0 +1,20 @@
+{
+  "name": "trace-security",
+  "version": "2.0.0",
+  "description": "TRACE Agent Harness Plugin - Equips autonomous coding agents with APM attack graphs, live exploit verification, and benchmark self-healing oracles.",
+  "author": {
+    "name": "TRACE Security Engineering Team",
+    "email": "security@trace.dev"
+  },
+  "license": "Apache-2.0",
+  "keywords": [
+    "security",
+    "agent-harness",
+    "swe-bench",
+    "owasp",
+    "mcp",
+    "verification",
+    "apm",
+    "self-healing"
+  ]
+}

package/src/trace_engine/plugin/bundle/rules/security_remediation.md

@@ -0,0 +1,40 @@
+---
+trigger: always_on
+description: Mandatory security remediation rules for autonomous coding agents.
+---
+
+# TRACE Autonomous Security Remediation Guidelines
+
+When an AI coding agent is tasked with fixing vulnerabilities reported by TRACE or running a TRACE-Bench task, the following standards are strictly mandatory:
+
+## 1. Zero-Dummy-Bypass Rule
+- **FORBIDDEN**: Never resolve a vulnerability by hardcoding boolean flags (`if (true) return 200`), returning mock empty responses, commenting out security filters, or bypassing authentication handlers.
+- **MANDATORY**: Fixes must genuinely enforce the intended business and security invariants in code (e.g. comparing session tenant identity against record tenant identity).
+
+## 2. Broken Object-Level Authorization (BOLA / IDOR)
+- When fetching, updating, or deleting any domain entity (`Record`, `User`, `Order`, `Document`) by identifier:
+  1. Extract the authenticated user's ID and tenant/organization identifier from the verified security context (`Authentication`, `SecurityContextHolder`, or JWT claims).
+  2. Scope the database query or in-memory retrieval to the authenticated tenant (e.g. `findByRecordIdAndTenantId(...)`).
+  3. If the resource does not belong to the caller, return HTTP `403 Forbidden` or `404 Not Found`.
+
+## 3. Broken Function-Level Authorization (BFLA)
+- Privileged endpoints (e.g. administrative exports, role elevation, tenant configuration, metric resets) must explicitly verify user roles:
+  1. Enforce RBAC checks (e.g. `@PreAuthorize("hasRole('ADMIN')")`, `authContext.requireRole("admin")`).
+  2. Deny requests with HTTP `403 Forbidden` for standard or unprivileged users.
+
+## 4. Server-Side Request Forgery (SSRF)
+- When accepting external URLs or callbacks (`callbackUrl`, `webhookUrl`, `targetUri`):
+  1. Validate the URL scheme is strictly `https` (or `http` for allowed domains).
+  2. Reject all loopback, link-local, and private RFC-1918 addresses (`127.0.0.1`, `localhost`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.169.254`).
+  3. Resolve DNS names and check resolved IP addresses against private subnet blocklists before dispatching outbound HTTP calls.
+
+## 5. Broken Authentication & Session Management
+- Never expose unauthenticated endpoints that execute state-changing actions.
+- Ensure all API endpoints under `/api/**` or `/admin/**` participate in the authentication barrier unless explicitly marked public.
+
+## 6. Mass Assignment & Parameter Injection
+- Do not bind untrusted HTTP request bodies directly into persistent domain entities or ORM models.
+- Use explicit DTOs (Data Transfer Objects) with allowlisted fields.
+
+## 7. Verification Requirement
+- After applying any code change, execute the TRACE verification oracle (`trace_verify` or `trace verify <finding_id>`) to prove that the exploit vector is blocked and no regressions were introduced.

package/src/trace_engine/plugin/bundle/skills/trace-security-harness/SKILL.md

@@ -0,0 +1,118 @@
+---
+name: trace-security-harness
+description: >-
+  Standardized runbook and tool guide for autonomous coding agents operating with the TRACE
+  Agent Harness Plugin. Guides agents through finding discovery, Attack-Path Model inspection,
+  safe surgical remediation, and live verification.
+---
+
+# TRACE Security Agent Harness Runbook
+
+The TRACE Agent Harness Plugin equips you with tools to autonomously audit codebases, investigate correlated vulnerability findings, inspect Attack-Path Models (APM), apply surgical security fixes, and verify solutions against live exploit tests.
+
+---
+
+## Autonomous Workflow for Security Remediation
+
+Follow these 5 distinct phases when resolving security vulnerabilities:
+
+```
+[Phase 1: Ingest] ➔ [Phase 2: Diagnose] ➔ [Phase 3: Plan Fix] ➔ [Phase 4: Patch] ➔ [Phase 5: Verify]
+```
+
+### Phase 1: Finding & Task Ingestion
+Query the TRACE findings store or benchmark task queue to identify active vulnerabilities:
+
+1. **List all findings:**
+   - MCP Tool: `trace_findings`
+   - CLI: `trace findings`
+2. **Inspect a specific benchmark task:**
+   - MCP Tool: `trace_harness_task` with `task_id` or `finding_id`
+   - CLI: `trace plugin task <task_id>`
+
+Each finding has:
+- `id`: Unique identifier (e.g. `TR-BOLA-001`, `TR-SSRF-003`)
+- `category`: OWASP API Security category (e.g. BOLA, BFLA, SSRF)
+- `severity`: CRITICAL, HIGH, MEDIUM, LOW
+- `endpoint`: The affected HTTP endpoint
+- `source_location`: File path and line numbers
+
+---
+
+### Phase 2: Root-Cause & Attack-Path Diagnosis
+Never guess the fix. Examine the complete correlation evidence and Attack-Path Model (APM) hops:
+
+1. **Retrieve explanation and reproduction steps:**
+   - MCP Tool: `trace_explain` with `finding_id: "TR-BOLA-001"`
+   - CLI: `trace explain TR-BOLA-001`
+2. **Inspect the APM graph hops:**
+   - MCP Tool: `trace_attack_path` with `endpoint: "/api/records/{id}"`
+   
+Key items to inspect in the explanation:
+- `attack_path`: Sequence of hops from public HTTP entrypoint to vulnerable sink.
+- `static_evidence`: Code AST patterns that triggered the hypothesis.
+- `runtime_evidence`: Concrete HTTP request/response proofs demonstrating unauthorized access.
+- `remediation`: Architectural guidance on how the endpoint should be secured.
+
+---
+
+### Phase 3: Surgical Patch Planning
+Formulate a patch that enforces the invariant without modifying unrelated behavior:
+
+#### BOLA (Broken Object-Level Authorization)
+- **Problem**: Entity retrieved by ID without checking if caller owns the entity or belongs to the same tenant.
+- **Fix**:
+  ```kotlin
+  // BEFORE (Vulnerable)
+  val record = recordRepository.findById(id)
+  return ResponseEntity.ok(record)
+
+  // AFTER (Secure)
+  val currentUser = SecurityContext.getCurrentUser()
+  val record = recordRepository.findByIdAndTenantId(id, currentUser.tenantId)
+      ?: return ResponseEntity.status(403).body("Access denied")
+  return ResponseEntity.ok(record)
+  ```
+
+#### BFLA (Broken Function-Level Authorization)
+- **Problem**: Privileged/administrative endpoint accessible by regular authenticated users.
+- **Fix**:
+  ```kotlin
+  // Ensure role enforcement is present
+  val user = SecurityContext.getCurrentUser()
+  if (!user.roles.contains("ADMIN")) {
+      return ResponseEntity.status(403).body("Administrator role required")
+  }
+  ```
+
+#### SSRF (Server-Side Request Forgery)
+- **Problem**: Unvalidated user-supplied URL dispatched to internal network or cloud metadata.
+- **Fix**:
+  ```kotlin
+  // Validate destination before dispatch
+  val uri = URI(callbackUrl)
+  val host = uri.host.lowercase()
+  if (host == "localhost" || host == "127.0.0.1" || host.startsWith("169.254.") || host.startsWith("10.") || host.startsWith("192.168.")) {
+      return ResponseEntity.status(403).body("Outbound request to internal IP blocked")
+  }
+  ```
+
+---
+
+### Phase 4: Patch Application
+Apply the modification using standard file editing tools (`replace_file_content` or `write_to_file`).
+- Ensure no syntax or compilation errors.
+- Keep modifications minimal and idiomatic.
+
+---
+
+### Phase 5: Deterministic Verification
+Verify that the exploit vector is blocked and the endpoint remains healthy:
+
+1. **Verify with TRACE Verification Oracle:**
+   - MCP Tool: `trace_verify` with `finding_id`
+   - CLI: `trace verify <finding_id>`
+2. **Evaluate Patch Quality:**
+   - MCP Tool: `trace_eval_patch`
+   
+The verification oracle will execute the active exploit test pack against the running target. A status of `RESOLVED` with `runtime_check_passed: true` confirms the fix is sound.

package/src/trace_engine/plugin/evaluator.py

@@ -0,0 +1,105 @@
+"""Evaluation oracle for the TRACE Agent Harness Plugin."""
+
+import logging
+from pathlib import Path
+from typing import Dict, Any, Optional, List
+from pydantic import BaseModel, Field
+
+from trace_engine.verify import VerificationEngine, VerificationResult
+from trace_engine.harness.patcher import TransactionalPatcher, PatchOperationResult
+
+logger = logging.getLogger("trace_plugin_evaluator")
+
+
+class EvaluationResult(BaseModel):
+    """Evaluation result for an agent-generated patch."""
+    task_id: str
+    finding_id: str
+    passed: bool
+    verified_resolved: bool
+    reproduced_exploit_blocked: bool
+    regressions_detected: bool
+    confidence_score: float
+    output_message: str
+    verification_details: Dict[str, Any] = Field(default_factory=dict)
+    patch_applied: bool = False
+
+
+class HarnessEvaluator:
+    """Evaluates patches produced by external AI agent harnesses against TRACE ground-truth test packs."""
+
+    def __init__(self, repo_path: Path, target_url: str = "http://127.0.0.1:18080"):
+        self.repo_path = repo_path.resolve()
+        self.target_url = target_url
+        self.patcher = TransactionalPatcher(self.repo_path)
+        self.verifier = VerificationEngine(repo_path=self.repo_path, target_url=self.target_url)
+
+    def evaluate_patch(
+        self,
+        finding_id: str,
+        patch_content: Optional[str] = None,
+        target_file: Optional[str] = None,
+        rollback_after: bool = False,
+    ) -> EvaluationResult:
+        """Applies an agent patch, runs the TRACE verification oracle, and returns grading results."""
+        patch_res: Optional[PatchOperationResult] = None
+
+        if patch_content and target_file:
+            # External patch provided as raw code or diff
+            patch_res = self.patcher.apply_full_content(
+                finding_id=finding_id,
+                rel_path=target_file,
+                new_content=patch_content,
+            )
+            if not patch_res.success:
+                return EvaluationResult(
+                    task_id=f"task_{finding_id}",
+                    finding_id=finding_id,
+                    passed=False,
+                    verified_resolved=False,
+                    reproduced_exploit_blocked=False,
+                    regressions_detected=False,
+                    confidence_score=0.0,
+                    output_message=f"Failed to apply patch: {patch_res.error}",
+                    patch_applied=False,
+                )
+
+        # Run verification engine against live runtime / APM
+        try:
+            ver_res: VerificationResult = self.verifier.verify(finding_id)
+            is_resolved = (ver_res.status.value == "FIXED") or ver_res.remediation_verified
+            exploit_blocked = is_resolved
+
+            passed = is_resolved
+            msg = f"Verification {ver_res.status.value}: {ver_res.summary}"
+
+            result = EvaluationResult(
+                task_id=f"task_{finding_id}",
+                finding_id=finding_id,
+                passed=passed,
+                verified_resolved=is_resolved,
+                reproduced_exploit_blocked=exploit_blocked,
+                regressions_detected=False,
+                confidence_score=1.0 if passed else 0.0,
+                output_message=msg,
+                verification_details=ver_res.model_dump(),
+                patch_applied=patch_res.success if patch_res else True,
+            )
+        except Exception as e:
+            logger.exception("Error executing verification oracle")
+            result = EvaluationResult(
+                task_id=f"task_{finding_id}",
+                finding_id=finding_id,
+                passed=False,
+                verified_resolved=False,
+                reproduced_exploit_blocked=False,
+                regressions_detected=False,
+                confidence_score=0.0,
+                output_message=f"Verification exception: {e}",
+                patch_applied=patch_res.success if patch_res else False,
+            )
+
+        if rollback_after and patch_res and patch_res.backup_file and target_file:
+            self.patcher.rollback(target_file, Path(patch_res.backup_file))
+
+        return result

package/src/trace_engine/plugin/swebench_adapter.py

@@ -0,0 +1,96 @@
+"""SWE-bench dataset adapter for the TRACE Agent Harness Plugin."""
+
+import json
+from pathlib import Path
+from typing import List, Dict, Any
+
+from trace_engine.findings.model import Finding
+from trace_engine.plugin.task import HarnessTaskSpec
+
+
+def build_harness_task(finding: Finding, repo_path: Path) -> HarnessTaskSpec:
+    """Transform a CorrelatedFinding into a standardized agent harness task specification."""
+    rel_path = str(finding.source_location.file) if finding.source_location else "unknown"
+    start_line = finding.source_location.line_start if finding.source_location else 1
+    end_line = finding.source_location.line_end if finding.source_location else 1
+
+    code_snippet = ""
+    try:
+        full_file = repo_path / rel_path
+        if not full_file.is_file():
+            for sub in repo_path.iterdir():
+                if sub.is_dir() and (sub / rel_path).is_file():
+                    full_file = sub / rel_path
+                    break
+
+        if full_file.is_file():
+            lines = full_file.read_text(encoding="utf-8", errors="replace").splitlines()
+            sl = max(0, start_line - 1)
+            el = min(len(lines), end_line + 5)
+            code_snippet = "\n".join(lines[sl:el])
+    except Exception:
+        code_snippet = ""
+
+    static_ev = "\n".join(f"- `{ev}`" for ev in (finding.static_evidence or []))
+
+    problem_stmt = (
+        f"# Security Vulnerability Remediation: {finding.title}\n\n"
+        f"**Category:** {finding.category}\n"
+        f"**Severity:** {finding.severity.value}\n"
+        f"**Target Endpoint:** `{finding.endpoint}`\n"
+        f"**Vulnerable Source:** `{rel_path}:{start_line}`\n\n"
+        f"## Vulnerability Description\n"
+        f"{finding.correlation_notes or finding.title}\n\n"
+        f"## Static Analysis Evidence\n"
+        f"{static_ev or 'None'}\n\n"
+        f"## Attack Path\n"
+        + "\n".join(f"- {hop}" for hop in (finding.attack_path or [])) + "\n\n"
+        f"## Live Exploit Proof\n"
+        + "\n".join(f"- `{proof}`" for proof in (finding.runtime_evidence or [])) + "\n\n"
+        f"## Objective\n"
+        f"Modify `{rel_path}` to fix the vulnerability without breaking the endpoint contract or returning static dummy responses."
+    )
+
+    hints = (
+        f"Recommended Remediation Architecture:\n"
+        f"{finding.remediation}\n\n"
+        f"Reproduction steps:\n"
+        + "\n".join(f"1. {step}" for step in (finding.reproduction_steps or []))
+    )
+
+    task_id = f"trace__{repo_path.name.lower()}-{finding.id}"
+
+    return HarnessTaskSpec(
+        instance_id=task_id,
+        finding_id=finding.id,
+        title=finding.title,
+        category=finding.category,
+        severity=finding.severity.value,
+        repo_name=repo_path.name,
+        endpoint=finding.endpoint,
+        source_file=rel_path,
+        line_start=start_line,
+        line_end=end_line,
+        code_snippet=code_snippet,
+        problem_statement=problem_stmt,
+        hints_text=hints,
+        attack_path_hops=finding.attack_path or [],
+        runtime_exploit_proof=finding.runtime_evidence or [],
+        reproduction_steps=finding.reproduction_steps or [],
+        fail_to_pass=[f"test_exploit_{finding.id}"],
+        pass_to_pass=["test_endpoint_functional_health"],
+        metadata={
+            "finding_id": finding.id,
+            "category": finding.category,
+            "severity": finding.severity.value,
+        },
+    )
+
+
+def export_swebench_jsonl(tasks: List[HarnessTaskSpec], output_file: Path) -> int:
+    """Export tasks to a SWE-bench compatible JSONL benchmark dataset file."""
+    output_file.parent.mkdir(parents=True, exist_ok=True)
+    with output_file.open("w", encoding="utf-8") as f:
+        for t in tasks:
+            f.write(json.dumps(t.to_swebench_dict()) + "\n")
+    return len(tasks)

package/src/trace_engine/plugin/task.py

@@ -0,0 +1,48 @@
+"""Task and benchmark specifications for the TRACE Agent Harness Plugin."""
+
+from typing import List, Dict, Any, Optional
+from pydantic import BaseModel, Field
+
+
+class HarnessTaskSpec(BaseModel):
+    """Standardized task instance specification for AI coding agent harnesses.
+    
+    Compatible with SWE-bench, OpenHands, and Antigravity task schemas.
+    """
+    instance_id: str
+    finding_id: str
+    title: str
+    category: str
+    severity: str
+    repo_name: str
+    endpoint: str
+    source_file: str
+    line_start: int
+    line_end: int
+    code_snippet: str
+    problem_statement: str
+    hints_text: str
+    attack_path_hops: List[str] = Field(default_factory=list)
+    runtime_exploit_proof: List[str] = Field(default_factory=list)
+    reproduction_steps: List[str] = Field(default_factory=list)
+    fail_to_pass: List[str] = Field(default_factory=list)
+    pass_to_pass: List[str] = Field(default_factory=list)
+    metadata: Dict[str, Any] = Field(default_factory=dict)
+
+    def to_swebench_dict(self) -> Dict[str, Any]:
+        """Convert this task instance into a standard SWE-bench JSON object."""
+        return {
+            "instance_id": self.instance_id,
+            "repo": self.repo_name,
+            "base_commit": self.metadata.get("base_commit", "HEAD"),
+            "problem_statement": self.problem_statement,
+            "hints_text": self.hints_text,
+            "created_at": self.metadata.get("created_at", "2026-10-03T00:00:00Z"),
+            "version": "1.0",
+            "FAIL_TO_PASS": self.fail_to_pass,
+            "PASS_TO_PASS": self.pass_to_pass,
+            "environment_setup_commit": self.metadata.get("environment_setup_commit", "HEAD"),
+            "target_endpoint": self.endpoint,
+            "source_location": f"{self.source_file}:{self.line_start}-{self.line_end}",
+            "vulnerability_category": self.category,
+        }

package/src/trace_engine/policy/__init__.py

@@ -0,0 +1,5 @@
+"""Target policy and scope enforcement."""
+
+from trace_engine.policy.scope import ScopeGuard, ScopeViolationError
+
+__all__ = ["ScopeGuard", "ScopeViolationError"]

package/src/trace_engine/policy/scope.py

@@ -0,0 +1,80 @@
+"""Scope Guard for enforcing local-only and lab-authorized boundaries."""
+
+from urllib.parse import urlparse
+from typing import List, Set
+import ipaddress
+
+
+class ScopeViolationError(Exception):
+    """Raised when an action violates the defined target scope."""
+    pass
+
+
+class ScopeGuard:
+    """Enforces strict boundaries to ensure tests only execute against approved local/lab targets."""
+
+    def __init__(
+        self,
+        allowed_hosts: List[str] = None,
+        allowed_ports: List[int] = None,
+        mode: str = "local",
+    ):
+        self.mode = mode
+        self.allowed_hosts: Set[str] = set(
+            allowed_hosts or ["localhost", "127.0.0.1", "0.0.0.0", "::1"]
+        )
+        self.allowed_ports: Set[int] = set(
+            allowed_ports or [80, 443, 3000, 5000, 8000, 8080, 18080]
+        )
+
+    def validate_url(self, url: str) -> bool:
+        """Validates that a URL is strictly within the allowed target scope."""
+        parsed = urlparse(url)
+        if parsed.scheme not in ("http", "https"):
+            raise ScopeViolationError(f"Unsupported URL scheme: {parsed.scheme}")
+
+        hostname = parsed.hostname or ""
+        if not hostname:
+            raise ScopeViolationError(f"Invalid URL host: {url}")
+
+        # Check hostname directly
+        if hostname.lower() in self.allowed_hosts:
+            pass
+        else:
+            # Check if it is a private IP in private-lab mode
+            try:
+                ip = ipaddress.ip_address(hostname)
+                if ip.is_loopback or (self.mode == "private-lab" and ip.is_private):
+                    pass
+                else:
+                    raise ScopeViolationError(
+                        f"Target host '{hostname}' is not within local/private scope. External network requests are blocked by TRACE ScopeGuard."
+                    )
+            except ValueError:
+                # Hostname is not an IP address and not in allowed hosts
+                raise ScopeViolationError(
+                    f"Target host '{hostname}' is blocked by TRACE ScopeGuard. Only approved local targets are permitted."
+                )
+
+        try:
+            port = parsed.port or (443 if parsed.scheme == "https" else 80)
+        except ValueError as e:
+            raise ScopeViolationError(f"Invalid URL port: {e}")
+
+        is_loopback_host = hostname.lower() in ("localhost", "127.0.0.1", "0.0.0.0", "::1")
+        if not is_loopback_host and port not in self.allowed_ports:
+            raise ScopeViolationError(
+                f"Target port {port} is not in allowed ports list: {sorted(list(self.allowed_ports))}"
+            )
+        if not (1 <= port <= 65535):
+            raise ScopeViolationError(f"Invalid TCP port: {port}")
+
+        return True
+
+    def allow_target(self, url: str) -> None:
+        """Explicitly add a target's host and port to allowed scope if it is local/private."""
+        parsed = urlparse(url)
+        if parsed.hostname:
+            self.allowed_hosts.add(parsed.hostname.lower())
+        port = parsed.port or (443 if parsed.scheme == "https" else 80)
+        self.allowed_ports.add(port)

package/src/trace_engine/runtime/__init__.py

@@ -0,0 +1,7 @@
+"""Runtime test execution module."""
+
+from trace_engine.runtime.target import Target
+from trace_engine.runtime.observations import RuntimeObservation
+from trace_engine.runtime.client import ScopedHttpClient
+
+__all__ = ["Target", "RuntimeObservation", "ScopedHttpClient"]

package/src/trace_engine/runtime/client.py

@@ -0,0 +1,81 @@
+"""Scoped runtime HTTP client for executing controlled security tests."""
+
+import time
+import httpx
+from typing import Optional, Dict, Any
+from trace_engine.policy.scope import ScopeGuard, ScopeViolationError
+from trace_engine.runtime.observations import RuntimeObservation
+
+
+class ScopedHttpClient:
+    """HTTP client bound to ScopeGuard that captures comprehensive runtime observations."""
+
+    def __init__(self, scope_guard: ScopeGuard, timeout_seconds: float = 8.0):
+        self.scope_guard = scope_guard
+        self.timeout = timeout_seconds
+
+    def execute(
+        self,
+        method: str,
+        url: str,
+        headers: Optional[Dict[str, str]] = None,
+        json_body: Optional[Any] = None,
+        data: Optional[Dict[str, Any]] = None,
+    ) -> RuntimeObservation:
+        """Executes request after scope validation and captures runtime observation."""
+        self.scope_guard.validate_url(url)
+
+        headers = headers or {}
+        req_body_str = None
+        if json_body is not None:
+            import json
+            req_body_str = json.dumps(json_body)
+            headers["Content-Type"] = "application/json"
+
+        start_time = time.perf_counter()
+        try:
+            with httpx.Client(
+                timeout=self.timeout,
+                follow_redirects=False,  # Intercept redirects for scope check
+            ) as client:
+                resp = client.request(
+                    method=method.upper(),
+                    url=url,
+                    headers=headers,
+                    content=req_body_str,
+                    data=data,
+                )
+                latency_ms = (time.perf_counter() - start_time) * 1000
+
+                # Check if redirect is safe
+                if resp.is_redirect and "location" in resp.headers:
+                    redirect_target = resp.headers["location"]
+                    import urllib.parse
+                    resolved_redirect = urllib.parse.urljoin(url, redirect_target)
+                    self.scope_guard.validate_url(resolved_redirect)
+
+                return RuntimeObservation(
+                    request_method=method.upper(),
+                    request_url=url,
+                    request_headers=dict(headers),
+                    request_body=req_body_str,
+                    response_status=resp.status_code,
+                    response_headers=dict(resp.headers),
+                    response_body=resp.text[:2000],  # preview up to 2KB
+                    latency_ms=round(latency_ms, 2),
+                )
+        except ScopeViolationError:
+            raise
+        except Exception as e:
+            latency_ms = (time.perf_counter() - start_time) * 1000
+            return RuntimeObservation(
+                request_method=method.upper(),
+                request_url=url,
+                request_headers=dict(headers),
+                request_body=req_body_str,
+                response_status=0,
+                response_headers={},
+                response_body=f"Connection Error: {str(e)}",
+                latency_ms=round(latency_ms, 2),
+                observation_notes=[f"Execution exception: {e}"],
+            )