theorum 1.0.0 → 1.1.3

package/esm/src/guardrails/tool-result.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Tool boundary guardrails — the surface where untrusted bytes re-enter the
+ * model's context carrying the model's own authority.
+ *
+ * A tool result is not user text: the model asked for it, so it arrives looking
+ * like something the turn already trusts. Remote HTTP and MCP servers control
+ * their own response bodies (including their error strings), and a delegated
+ * agent answers in prose that reads as authoritative. Everything crossing this
+ * boundary is therefore fenced, detected, and labelled with where it came from.
+ *
+ * @module
+ */
+import type { AdvisoryLevel, GuardrailEvent, GuardrailHit, Provenance, ResolvedGuardrailPolicy, ToolOrigin, TurnTaint, Verdict } from './types.js';
+declare const TOOL_CLOSE = "</tool_data>";
+/** True when a result's bytes came from outside the host's own code. */
+declare function isRemoteOrigin(origin: ToolOrigin): boolean;
+/**
+ * Wrap tool output so the model reads it as data and can see where it came from.
+ *
+ * The origin is on the tag rather than in prose so a result cannot claim a
+ * friendlier provenance than it has by writing one into its own body.
+ */
+declare function wrapToolData(text: string, provenance: Provenance, advisory?: AdvisoryLevel, guidance?: string): string;
+export interface GuardedToolText {
+    /** Text to hand the model, fenced and redacted. */
+    text: string;
+    /** Emitted when the guard did anything worth recording. */
+    event?: GuardrailEvent;
+    /**
+     * Directive signals found in the content.
+     *
+     * Reported, never redacted: legitimate tool output is frequently
+     * instruction-shaped, so rewriting on this signal would corrupt real data.
+     * These raise the turn's taint instead.
+     */
+    suspicious?: GuardrailHit[];
+}
+/**
+ * Compose the model-facing text for a tool result.
+ *
+ * `finding` is the tool's summary and `data` its structured payload; both reach
+ * the model, so both are guarded together rather than only the prose half.
+ */
+declare function composeToolText(finding: string, data: unknown): string;
+/**
+ * Guard one tool result on its way into the model's context.
+ *
+ * Local host tools are still detected — a host tool reading a database returns
+ * data the host did not write — but only remote origins are fenced, because
+ * fencing a local tool's output would change prompts hosts have already tuned.
+ */
+declare function guardToolResult(finding: string, data: unknown, provenance: Provenance, policy: ResolvedGuardrailPolicy, callableTools?: readonly string[]): GuardedToolText;
+/**
+ * Guard a tool failure message.
+ *
+ * A remote server authors its own error strings, so an unguarded failure message
+ * is the cleanest injection path across this boundary: it reaches the model
+ * verbatim and is framed by the kernel as a system report.
+ */
+declare function guardToolFailureText(message: string, provenance: Provenance, policy: ResolvedGuardrailPolicy): GuardedToolText;
+/**
+ * Inspect model-supplied tool arguments before the call runs.
+ *
+ * Arguments are model-authored, so the risk is not instruction smuggling but
+ * exfiltration: a credential lifted from context and posted outward as a
+ * parameter. Detection reports rather than rewrites — silently altering a tool
+ * argument would make the call succeed against something the model did not ask
+ * for.
+ */
+declare function inspectToolArguments(args: unknown, policy: ResolvedGuardrailPolicy): Verdict;
+/** Guardrail event for a flagged tool call, for the runner to emit. */
+declare function toolCallEvent(verdict: Verdict, provenance: Provenance): GuardrailEvent | undefined;
+/**
+ * Record a tool result against the turn's taint.
+ *
+ * Only remote origins taint: a local host tool returns bytes the host's own code
+ * produced, and treating those as attacker-influenceable would make the gate
+ * useless in practice.
+ */
+declare function recordTaint(taint: TurnTaint | undefined, provenance: Provenance, suspicious?: GuardrailHit[]): TurnTaint;
+/** True when the turn has already read attacker-influenceable content. */
+declare function isTainted(taint: TurnTaint | undefined): boolean;
+/** True when remote content this turn read looked like it was steering the agent. */
+declare function isSuspicious(taint: TurnTaint | undefined): boolean;
+/**
+ * Decide whether a tool call may proceed given what the turn has already read.
+ *
+ * A `flag` says the call is happening on a tainted turn and is worth recording; a
+ * `block` says the profile asked for it to be refused. Reporting happens whether
+ * or not enforcement is configured, so the risk is visible before a host opts in.
+ */
+declare function checkTaintGate(taint: TurnTaint | undefined, access: string, policy: ResolvedGuardrailPolicy): Verdict;
+export { checkTaintGate, composeToolText, guardToolFailureText, guardToolResult, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, recordTaint, TOOL_CLOSE, toolCallEvent, wrapToolData, };

package/esm/src/guardrails/tool-result.js

@@ -0,0 +1,276 @@
+/**
+ * Tool boundary guardrails — the surface where untrusted bytes re-enter the
+ * model's context carrying the model's own authority.
+ *
+ * A tool result is not user text: the model asked for it, so it arrives looking
+ * like something the turn already trusts. Remote HTTP and MCP servers control
+ * their own response bodies (including their error strings), and a delegated
+ * agent answers in prose that reads as authoritative. Everything crossing this
+ * boundary is therefore fenced, detected, and labelled with where it came from.
+ *
+ * @module
+ */
+import { lexiconText } from './lexicon.js';
+import { detectionForTrust } from './policy.js';
+import { sanitizeText } from './sanitize.js';
+import { textForScan } from './serialize.js';
+import { advisoryLevel, directiveHits } from './tool-directives.js';
+const TOOL_CLOSE = '</tool_data>';
+const TOOL_OPEN = '<tool_data';
+/** Origins whose bytes the host does not author and cannot vouch for. */
+const REMOTE_ORIGINS = new Set(['http', 'mcp', 'delegated']);
+/** True when a result's bytes came from outside the host's own code. */
+function isRemoteOrigin(origin) {
+    return REMOTE_ORIGINS.has(origin);
+}
+/**
+ * Strip fence markers a tool result tried to forge before wrapping it.
+ * Linear scan — avoids polynomial regex on forged `<tool_data…>` runs.
+ */
+function stripToolFences(text) {
+    const lower = text.toLowerCase();
+    let out = '';
+    let i = 0;
+    while (i < text.length) {
+        const openAt = lower.indexOf(TOOL_OPEN, i);
+        const closeAt = lower.indexOf(TOOL_CLOSE, i);
+        let next = -1;
+        let kind = null;
+        if (openAt >= 0 && (closeAt < 0 || openAt <= closeAt)) {
+            next = openAt;
+            kind = 'open';
+        }
+        else if (closeAt >= 0) {
+            next = closeAt;
+            kind = 'close';
+        }
+        if (next < 0 || kind === null) {
+            out += text.slice(i);
+            break;
+        }
+        out += text.slice(i, next);
+        if (kind === 'close') {
+            i = next + TOOL_CLOSE.length;
+            continue;
+        }
+        const gt = text.indexOf('>', next + TOOL_OPEN.length);
+        if (gt < 0) {
+            out += text.slice(next);
+            break;
+        }
+        i = gt + 1;
+    }
+    return out;
+}
+/**
+ * Wrap tool output so the model reads it as data and can see where it came from.
+ *
+ * The origin is on the tag rather than in prose so a result cannot claim a
+ * friendlier provenance than it has by writing one into its own body.
+ */
+function wrapToolData(text, provenance, advisory = 'none', guidance) {
+    const attrs = `tool="${provenance.tool}" origin="${provenance.origin}"` +
+        (advisory === 'none' ? '' : ` advisory="${advisory}"`);
+    const notice = advisory === 'none' ? '' : `${advisoryNotice(advisory)}${guidance ? ` ${guidance}` : ''}\n`;
+    return `<${'tool_data'} ${attrs}>\n${notice}${stripToolFences(text)}\n${TOOL_CLOSE}`;
+}
+/**
+ * The kernel's own statement of what it observed.
+ *
+ * Deliberately an observation, not an instruction: what the agent should do about
+ * it is product behaviour, supplied by the host as `advisoryGuidance`. Emitted
+ * only when signals fired, so it stays rare enough to carry weight — a warning on
+ * every fetch is one the model learns to skip.
+ */
+function advisoryNotice(advisory) {
+    return lexiconText(advisory === 'high' ? 'advisory.notice_high' : 'advisory.notice_elevated');
+}
+/**
+ * Compose the model-facing text for a tool result.
+ *
+ * `finding` is the tool's summary and `data` its structured payload; both reach
+ * the model, so both are guarded together rather than only the prose half.
+ */
+function composeToolText(finding, data) {
+    if (data === undefined) {
+        return finding;
+    }
+    const rendered = textForScan(data);
+    if (rendered.unscannable) {
+        return finding;
+    }
+    return `${finding}\n${rendered.text}`;
+}
+/**
+ * Guard one tool result on its way into the model's context.
+ *
+ * Local host tools are still detected — a host tool reading a database returns
+ * data the host did not write — but only remote origins are fenced, because
+ * fencing a local tool's output would change prompts hosts have already tuned.
+ */
+function guardToolResult(finding, data, provenance, policy, callableTools = []) {
+    const composed = composeToolText(finding, data);
+    const options = detectionForTrust(policy, 'untrusted');
+    const redacted = sanitizeText(composed, options);
+    const changed = redacted !== composed;
+    // Directive detection runs on remote content only: a local tool's output is
+    // bytes the host's own code produced.
+    const remote = isRemoteOrigin(provenance.origin);
+    const suspicious = remote ? directiveHits(composed, callableTools) : [];
+    const advisory = advisoryLevel(suspicious);
+    const fenced = remote
+        ? wrapToolData(redacted, provenance, advisory, policy.taint?.advisoryGuidance)
+        : redacted;
+    const hits = [
+        ...(changed ? [{ rule: 'tool_result.redacted', severity: 'medium' }] : []),
+        ...suspicious,
+    ];
+    if (hits.length === 0) {
+        return { text: fenced };
+    }
+    return {
+        text: fenced,
+        ...(suspicious.length > 0 ? { suspicious } : {}),
+        event: {
+            stage: 'tool_result',
+            trust: 'untrusted',
+            // Redaction changed the text; directive signals only annotate it.
+            action: changed ? 'redact' : 'flag',
+            hits,
+            provenance,
+        },
+    };
+}
+/**
+ * Guard a tool failure message.
+ *
+ * A remote server authors its own error strings, so an unguarded failure message
+ * is the cleanest injection path across this boundary: it reaches the model
+ * verbatim and is framed by the kernel as a system report.
+ */
+function guardToolFailureText(message, provenance, policy) {
+    const options = detectionForTrust(policy, 'untrusted');
+    const redacted = sanitizeText(stripToolFences(message), options);
+    if (redacted === message) {
+        return { text: redacted };
+    }
+    return {
+        text: redacted,
+        event: {
+            stage: 'tool_result',
+            trust: 'untrusted',
+            action: 'redact',
+            hits: [{ rule: 'tool_failure.redacted', severity: 'medium' }],
+            provenance,
+        },
+    };
+}
+/**
+ * Inspect model-supplied tool arguments before the call runs.
+ *
+ * Arguments are model-authored, so the risk is not instruction smuggling but
+ * exfiltration: a credential lifted from context and posted outward as a
+ * parameter. Detection reports rather than rewrites — silently altering a tool
+ * argument would make the call succeed against something the model did not ask
+ * for.
+ */
+function inspectToolArguments(args, policy) {
+    if (!policy.redactSensitive) {
+        return { action: 'allow' };
+    }
+    const rendered = textForScan(args);
+    if (rendered.unscannable) {
+        return { action: 'allow' };
+    }
+    const options = { sanitizeInput: false, redactSensitive: true };
+    if (sanitizeText(rendered.text, options) === rendered.text) {
+        return { action: 'allow' };
+    }
+    return {
+        action: 'flag',
+        hits: [{ rule: 'tool_call.sensitive-argument', severity: 'high' }],
+    };
+}
+/** Guardrail event for a flagged tool call, for the runner to emit. */
+function toolCallEvent(verdict, provenance) {
+    if (verdict.action === 'allow') {
+        return undefined;
+    }
+    return {
+        stage: 'tool_call',
+        trust: 'untrusted',
+        action: verdict.action,
+        hits: verdict.hits,
+        provenance,
+    };
+}
+/**
+ * Record a tool result against the turn's taint.
+ *
+ * Only remote origins taint: a local host tool returns bytes the host's own code
+ * produced, and treating those as attacker-influenceable would make the gate
+ * useless in practice.
+ */
+function recordTaint(taint, provenance, suspicious = []) {
+    const sources = taint?.sources ?? [];
+    const prior = taint?.suspicious ?? [];
+    if (!isRemoteOrigin(provenance.origin)) {
+        return { sources, suspicious: prior };
+    }
+    return { sources: [...sources, provenance], suspicious: [...prior, ...suspicious] };
+}
+/** True when the turn has already read attacker-influenceable content. */
+function isTainted(taint) {
+    return (taint?.sources.length ?? 0) > 0;
+}
+/** True when remote content this turn read looked like it was steering the agent. */
+function isSuspicious(taint) {
+    return (taint?.suspicious.length ?? 0) > 0;
+}
+/** Capability rank, so a single threshold can express "this and anything worse". */
+const CAPABILITY_RANK = {
+    'read-only': 0,
+    'read-write': 1,
+    destructive: 2,
+};
+const GATE_RANK = {
+    off: Number.POSITIVE_INFINITY,
+    destructive: 2,
+    write: 1,
+};
+/**
+ * Decide whether a tool call may proceed given what the turn has already read.
+ *
+ * A `flag` says the call is happening on a tainted turn and is worth recording; a
+ * `block` says the profile asked for it to be refused. Reporting happens whether
+ * or not enforcement is configured, so the risk is visible before a host opts in.
+ */
+function checkTaintGate(taint, access, policy) {
+    if (!isTainted(taint)) {
+        return { action: 'allow' };
+    }
+    const rank = CAPABILITY_RANK[access] ?? 0;
+    if (rank === 0) {
+        return { action: 'allow' };
+    }
+    const suspicious = isSuspicious(taint);
+    const hits = [
+        {
+            rule: suspicious ? 'tool_call.steered-turn' : 'tool_call.tainted-turn',
+            severity: 'high',
+        },
+    ];
+    // Gated on origin alone. Whether the content looked directive changes the rule
+    // reported, never whether the call is refused.
+    if (rank < GATE_RANK[policy.taint?.afterRemoteRead ?? 'off']) {
+        return { action: 'flag', hits };
+    }
+    const read = taint?.sources.map((s) => s.tool).join(', ') ?? '';
+    const reason = lexiconText(suspicious ? 'taint.reason_steered' : 'taint.reason_tainted');
+    return {
+        action: 'block',
+        hits,
+        rejection: lexiconText('taint.blocked', { access, sources: read, reason }),
+    };
+}
+export { checkTaintGate, composeToolText, guardToolFailureText, guardToolResult, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, recordTaint, TOOL_CLOSE, toolCallEvent, wrapToolData, };

package/esm/src/guardrails/types.d.ts

@@ -0,0 +1,291 @@
+/**
+ * Guardrail vocabulary — trust levels, stages, verdicts, and profile policy shape.
+ *
+ * This module is the single source of truth for guardrail types. It must not import
+ * from `src/kernel/`: the kernel type-imports `ProfileGuardrailsSpec` for
+ * `ProfileCommon.guardrails`, and that edge stays one-directional. Implementation
+ * modules under `src/guardrails/` may import kernel types freely.
+ *
+ * @module
+ */
+/**
+ * Origin trust for text entering the model's context.
+ *
+ * - `trusted` — author-time profile text (`identity.system`). Sensitive redaction
+ *   only; injection redaction would mangle the host's own instructions.
+ * - `assembled` — host-built per turn (`req.system`). Interpolates retrieval and
+ *   user data, so it is permeable and takes full detection.
+ * - `untrusted` — user input, tool results, attachments, delegated agents.
+ */
+export declare const TRUST_LEVELS: readonly ["trusted", "assembled", "untrusted"];
+export type TrustLevel = (typeof TRUST_LEVELS)[number];
+/** Boundary a guardrail check runs at. */
+export declare const GUARDRAIL_STAGES: readonly ["input", "history", "system", "attachment", "tool_call", "tool_result", "output_delta", "output_final", "network", "live_inbound", "live_outbound", "trace"];
+export type GuardrailStage = (typeof GUARDRAIL_STAGES)[number];
+/** How serious a hit is. Does not decide what happens next — that is `onBlock`. */
+export declare const SEVERITIES: readonly ["info", "low", "medium", "high"];
+export type Severity = (typeof SEVERITIES)[number];
+/** Egress block handling. */
+export declare const EGRESS_ON_BLOCK: readonly ["reject_to_agent", "refuse_to_user"];
+export type EgressOnBlock = (typeof EGRESS_ON_BLOCK)[number];
+/** One detector match. */
+export interface GuardrailHit {
+    /** Stable rule id, e.g. `injection.instruction-override`. */
+    rule: string;
+    severity: Severity;
+    /** Offsets into the inspected text; absent for whole-payload checks. */
+    span?: {
+        start: number;
+        end: number;
+    };
+    /**
+     * Exact matched substring (capped). Present when detectors had the source text.
+     * Stripped from host/trace unless `observability.include.guardrailMatchPreview`.
+     */
+    match?: string;
+}
+/**
+ * Outcome of one guardrail evaluation.
+ *
+ * A discriminated union so a new variant fails every unhandled `switch` at
+ * compile time rather than falling through at runtime.
+ */
+export type Verdict = {
+    action: 'allow';
+} | {
+    action: 'redact';
+    text: string;
+    hits: GuardrailHit[];
+} | {
+    action: 'flag';
+    hits: GuardrailHit[];
+} | {
+    action: 'block';
+    hits: GuardrailHit[];
+    /** Sent to the model on a repair turn when `onBlock` is `reject_to_agent`. */
+    rejection: string;
+    /** Shown to the user when `onBlock` is `refuse_to_user`. Host-owned copy. */
+    refusal?: string;
+};
+export type GuardrailAction = Verdict['action'];
+/**
+ * Where a tool result came from.
+ *
+ * `local` is host TypeScript the profile registered; `http` and `mcp` are remote
+ * services whose bytes the host does not control. `delegated` is another agent
+ * answering through the tool boundary — its output is model-generated prose that
+ * reads as authoritative, which is why depth is tracked separately.
+ */
+export declare const TOOL_ORIGINS: readonly ["local", "builtin", "http", "mcp", "delegated"];
+export type ToolOrigin = (typeof TOOL_ORIGINS)[number];
+/** Where a piece of content entered the turn from. */
+export interface Provenance {
+    origin: ToolOrigin;
+    /** Registered tool name. */
+    tool: string;
+    /**
+     * Hops from the user's turn. A direct tool call is 1; a tool result produced by
+     * a delegated agent that itself called tools is deeper. Depth matters because a
+     * two-hop delegation can otherwise launder remote content into trusted-looking
+     * output.
+     */
+    depth: number;
+}
+/**
+ * Untrusted content a turn has already taken into its context.
+ *
+ * Once a turn has read attacker-influenceable bytes, a later tool call is a
+ * confused-deputy risk: the content can ask the agent to act, and the agent has
+ * authority the content does not. Sources are kept in order so a policy can reason
+ * about depth as well as presence.
+ */
+export interface TurnTaint {
+    sources: Provenance[];
+    /**
+     * Directive hits found in remote content this turn read.
+     *
+     * Separates "read something remote" from "read something that tried to steer
+     * me". The second is far rarer, so a gate keyed on it refuses far less
+     * legitimate work.
+     */
+    suspicious: GuardrailHit[];
+}
+/**
+ * What a turn may still do after it has ingested untrusted remote content.
+ *
+ * Enforcement is opt-in. Tracking and reporting are on by default — every
+ * remote read is observable — but refusing tool calls changes what working agents
+ * are allowed to do, so a host declares which access levels to gate rather than
+ * having the kernel guess.
+ */
+/**
+ * How strongly the tool-ingress signals fired, derived from the hits themselves.
+ *
+ * Not a probability: there is no calibrated model behind it. `elevated` means one
+ * directive signal alongside an external destination; `high` means the content
+ * named a tool the model can call, or several signals agreed.
+ */
+export declare const ADVISORY_LEVELS: readonly ["none", "elevated", "high"];
+export type AdvisoryLevel = (typeof ADVISORY_LEVELS)[number];
+export declare const TAINT_GATES: readonly ["off", "destructive", "write"];
+export type TaintGate = (typeof TAINT_GATES)[number];
+/**
+ * Only structural facts gate tool calls.
+ *
+ * Content signals from `tool-directives.ts` deliberately have no gate here. They
+ * are pattern matches with no measured precision, and refusing a tool call on an
+ * unpredictable signal makes an agent unreliable rather than safe — the failure is
+ * invisible to the user and looks like the agent being stupid. Those signals
+ * annotate the fence and raise telemetry; the model still gets to decide, and the
+ * host still gets to see.
+ */
+export interface TaintGuardrailSpec {
+    /**
+     * Host copy appended to the fence when tool content looks directive.
+     *
+     * The kernel states what it observed; what the agent should *do* about it —
+     * ask the user, refuse, proceed carefully — is product behaviour and stays
+     * host-owned. Omitted means the observation is stated without guidance.
+     */
+    advisoryGuidance?: string;
+    /**
+     * Least-severe tool capability refused once the turn has read remote content.
+     *
+     * - `off` (default) — report only.
+     * - `destructive` — refuse hard-to-undo calls.
+     * - `write` — refuse those and any state-changing call.
+     *
+     * Stated as a capability threshold rather than a list of tool `access` values so
+     * the guardrail vocabulary stays independent of the tool registry; the kernel
+     * maps a tool's declared access onto it.
+     */
+    afterRemoteRead?: TaintGate;
+}
+/** Facts a check may read. Deliberately excludes the full profile. */
+export interface GuardrailContext {
+    stage: GuardrailStage;
+    trust: TrustLevel;
+    profileId: string;
+    canary?: string;
+    role?: string;
+    slots?: Record<string, string>;
+    /** Set on tool-shaped stages; absent for user and system text. */
+    provenance?: Provenance;
+}
+/**
+ * One guardrail decision, as it reaches the host and the trace.
+ *
+ * Carries rule identity and offsets, never the matched content, so a trace sink
+ * can count and locate hits without becoming a second copy of the secret.
+ */
+export interface GuardrailEvent {
+    stage: GuardrailStage;
+    trust: TrustLevel;
+    action: GuardrailAction;
+    hits: GuardrailHit[];
+    provenance?: Provenance;
+}
+/**
+ * User-visible output projected out of the turn's events.
+ *
+ * Structured output travels alongside text so a profile with `outputs.structured`
+ * is not invisible to its own egress policy.
+ */
+export interface OutboundPayload {
+    /** Concatenated user-visible text for this attempt. */
+    text: string;
+    /** Structured output, when the profile emits it. */
+    structured?: unknown;
+}
+/** Evaluates candidate user-visible output before release. */
+export type EgressEnforcer = (payload: OutboundPayload, context: GuardrailContext) => Verdict | Promise<Verdict>;
+/** Profile egress policy for rejection, retry, or refusal behavior. */
+export interface ProfileEgressSpec {
+    enforce: EgressEnforcer;
+    onBlock?: EgressOnBlock;
+    maxRetries?: number;
+    repairGuidance?: string;
+}
+/** SSRF and network access policy for HTTP and remote MCP tools. */
+export interface NetworkGuardrailSpec {
+    /**
+     * When true, allows connections to localhost / loopback and private subnets
+     * (e.g. for local dev/testing). Default: false.
+     */
+    allowPrivateNetworks?: boolean;
+    /** Hostnames or IP addresses permitted regardless of private subnet status. */
+    allowedHosts?: string[];
+    /**
+     * Allowed URL schemes. Defaults to `['https']`, or `['http', 'https']` when
+     * `allowPrivateNetworks` is set.
+     */
+    allowedSchemes?: string[];
+}
+/** Optional daily turn quota consumed by host HTTP middleware. */
+export interface QuotaGuardrailSpec {
+    perDay: number;
+    /**
+     * Host copy surfaced when the quota trips. The kernel never authors this:
+     * `quotaExhausted` returns structured data (`code`, `perDay`) and includes
+     * this string only when the host set it.
+     */
+    message?: string;
+}
+/**
+ * Per-turn canary switches. `true` / `false` toggles minting with the
+ * registered default bind note; the object form supplies host copy.
+ */
+export interface CanaryGuardrailSpec {
+    /**
+     * Host template appended to the system prompt binding the canary. Must
+     * contain the `{canary}` placeholder; `bindCanary` refuses a note that lost
+     * the token. Omitted means the lexicon default (`canary.bind_note`).
+     */
+    bindNote?: string;
+}
+/** Profile guardrail switches enforced by the kernel. */
+export interface ProfileGuardrailsSpec {
+    /** Optional daily turn quota; omitted means quota enforcement is not configured. */
+    quota?: QuotaGuardrailSpec;
+    canary?: boolean | CanaryGuardrailSpec;
+    sanitizeInput?: boolean;
+    redactSensitive?: boolean;
+    egress?: ProfileEgressSpec;
+    /** SSRF and network access policies for HTTP and MCP tools. */
+    network?: NetworkGuardrailSpec;
+    /** What the turn may still do after reading untrusted remote content. */
+    taint?: TaintGuardrailSpec;
+}
+/** The guardrail field names a `host` profile may set. */
+export declare const HOST_GUARDRAIL_FIELDS: readonly ["sanitizeInput", "redactSensitive", "network", "taint"];
+/**
+ * The guardrail switches a `host` profile may set.
+ *
+ * A host profile runs no model, so only the guards that fire on the `invokeTool`
+ * path exist for it: the detectors applied to model-supplied arguments and to
+ * tool result and failure text (`sanitizeInput`, `redactSensitive`), SSRF
+ * clearance for declarative HTTP and MCP targets (`network`), and the
+ * confused-deputy gate on a tainted turn (`taint`). Everything else in
+ * {@link ProfileGuardrailsSpec} — quota, canary, egress — guards a model turn
+ * and is refused by `defineProfile` on `type: 'host'`.
+ *
+ * This is a view of the one guardrail vocabulary, not a second hierarchy.
+ */
+export type HostGuardrailsSpec = Pick<ProfileGuardrailsSpec, (typeof HOST_GUARDRAIL_FIELDS)[number]>;
+/**
+ * A profile's guardrail switches with defaults applied.
+ *
+ * Every path resolves through `resolveGuardrailPolicy` so turn and Live ingress
+ * cannot drift apart on defaults.
+ */
+export interface ResolvedGuardrailPolicy {
+    sanitizeInput: boolean;
+    redactSensitive: boolean;
+    canary: boolean;
+    /** Host bind-note template from `guardrails.canary.bindNote`, when set. */
+    canaryBindNote?: string;
+    egress?: ProfileEgressSpec;
+    network?: NetworkGuardrailSpec;
+    quota?: QuotaGuardrailSpec;
+    taint?: TaintGuardrailSpec;
+}