data-olympus 0.3.3__tar.gz → 0.3.4__tar.gz

{data_olympus-0.3.3 → data_olympus-0.3.4}/CHANGELOG.md

@@ -12,6 +12,37 @@ This project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.3.4] - 2026-07-05
+
+### Fixed
+
+- **Enforcement gate false-positives on prose that merely mentions a governed
+  keyword, for tool calls with a known file path.** `IntentClassifier.classify`
+  scanned `action_diff` (the raw Write/Edit content or Bash command text, up
+  to 4000 chars) for free-text keywords like `auth`, `rls`, `tenant`, `secret`
+  in addition to `intent`, for every tool call. A scratch write whose text
+  simply discussed one of those words as a topic - not an actual governed
+  action - tripped the pre-tool gate regardless of the real (ungoverned)
+  write target, and a fresh `kb_consult` call did not clear it because the
+  consult's own classification (`intent`-only) and the gate's classification
+  (`intent + action_diff`) disagreed on whether the action was governed.
+  Keyword matching on `action_diff` now only applies when the tool call
+  carries no `action_path` (Bash commands and OpenCode's `patch`, whose
+  content is the only signal available); when an `action_path` is present
+  (Write/Edit/MultiEdit), classification uses the path globs and dependency
+  command patterns, unchanged, so this keeps full detection for real governed
+  edits (a patch touching `package.json`) without flagging unrelated prose in
+  files the path globs don't consider governed. Found via a company-knowledge
+  KB audit session that reproduced it live (a scratch `.txt` file containing
+  "RLS tenant boundaries auth trust model" was blocked with no governed path
+  or command in sight); independently reviewed via `codex exec` before
+  release.
+  - The audit's other finding (CX1: the pre-tool gate and the pre-commit
+    `report --staged` gate resolving two different workspace keys) was
+    already fixed in v0.2.0 (#64, worktree-invariant workspace key); no
+    further change needed. It was still visible in that audit only because
+    it predated the deployed kn-dev redeploy.
+
 ## [0.3.3] - 2026-07-05
 
 ### Fixed

{data_olympus-0.3.3 → data_olympus-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: data-olympus
-Version: 0.3.3
+Version: 0.3.4
 Summary: Governance-grade knowledge-base format (OKF-compatible) plus CLI and single-writer MCP server
 Project-URL: Homepage, https://github.com/knaisoma/data-olympus
 Project-URL: Repository, https://github.com/knaisoma/data-olympus

{data_olympus-0.3.3 → data_olympus-0.3.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "data-olympus"
-version = "0.3.3"
+version = "0.3.4"
 description = "Governance-grade knowledge-base format (OKF-compatible) plus CLI and single-writer MCP server"
 readme = "README.md"
 requires-python = ">=3.13"

{data_olympus-0.3.3 → data_olympus-0.3.4}/src/data_olympus/enforce_policy.py

@@ -81,7 +81,21 @@ class IntentClassifier:
         action_diff: str = "",
     ) -> ClassifyResult:
         signals: list[str] = []
-        text = f"{intent} {action_diff}".lower()
+        # Free-text keyword signals always scan `intent` (a short, deliberate
+        # statement of what the agent is about to do - kb_consult's argument -
+        # so a keyword there is a real signal). They scan `action_diff` too,
+        # but ONLY when there is no `action_path`: `action_diff` is arbitrary
+        # write/command CONTENT up to 4000 chars (Write.content, Edit.new_string,
+        # Bash.command, OpenCode patch text), and when a concrete action_path is
+        # already given, path-glob matching below is the intended signal for
+        # that action - layering the free-text net on top blocked benign writes
+        # to ungoverned files that merely discussed a keyword as a topic (a
+        # scratch file quoting "RLS"/"auth" from a security standard). Bash
+        # commands and OpenCode's `patch` tool carry no action_path at all
+        # (their action_diff IS the only content available), so the free-text
+        # net still applies there - dropping it entirely would silently lose
+        # the only governed-decision signal for those two tool shapes.
+        text = intent.lower() if action_path else f"{intent} {action_diff}".lower()
         for kw, rx in self._keyword_res:
             if rx.search(text):
                 signals.append(f"keyword:{kw}")