ferroguard 0.3.1__tar.gz

ferroguard-0.3.1/.agents/skills/git-workflow/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: git-workflow
+description: Commit subjects, pull request shape, and direct releases from main. Use when committing, opening a PR, or changing release automation.
+---
+
+# Git workflow
+
+## Commit subject
+
+`<emoji> <type>(<scope>): <lower-case imperative>`. Under 72 characters. No trailing period. The body says why. Footers are `Closes #N`, `Fixes #N`, `Refs #N`, or `BREAKING CHANGE:`. No `Co-authored-by` and no "Generated with" trailer.
+
+Types and emoji are the table in `AGENTS.md` and `scripts/commit-types.json`. Extra emoji that keep the same type: 🔥 🚚 🚨 💚 🎉 🔖.
+
+## Pull request
+
+Title is the subject. One label from `feature`, `bug`, `refactor`, `upgrade`, `docs`, `internal`, `breaking`, `security`.
+
+Body:
+
+- **What and why**, with `Closes #N`
+- **Evidence**: Before, After, Not verified
+- **Merge danger**: Door (one-way or two-way), Blast radius, Rollback
+- **Breaking changes, migrations, config**
+
+Add a Mermaid diagram when the architecture or the data flow changes.
+
+Branch from `main` as `feat/issue-N-short-name` or `fix/issue-N-short-name`. Do not force-push a shared branch.
+
+## Release
+
+A releasable push to `main` publishes in one workflow run. `scripts/release_subject.py` takes the highest bump since the last tag and consumes `## Unreleased`. The job commits `🔖 chore(release): vX.Y.Z`, pushes `main` without force, and tags that commit. The release commit does not publish again. The same run builds the abi3 wheels and sdist from that tag and publishes them to PyPI.
+
+## Merge
+
+Only when the human asks: `gh pr merge <number> --squash --delete-branch`.

ferroguard-0.3.1/.agents/skills/stack-guardrails/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: stack-guardrails
+description: Opt-in blocks for publish and deploy, plus the uv, ruff, and cargo checks this library expects. Use before publishing, deploying, or changing the toolchain.
+---
+
+# Stack guardrails
+
+Opt in by committing an empty `.claude/stack-guardrails.enabled` at the git root, or export `SDLC_STACK_GUARDRAILS=1`. This repository commits the marker, so the blocks are on.
+
+The hook exits 2, in every profile, for:
+
+- `npm publish`, `pnpm publish`, `yarn publish`, `uv publish`, `changeset publish` (a `--dry-run` is allowed)
+- `railway up`, `deploy`, `redeploy`, `down`, `variables --set`, `config apply`, `config migrate --apply`
+
+It warns on a hand edit of `uv.lock` or `pnpm-lock.yaml`. `Cargo.lock` is committed on purpose. Do not gitignore it. Regenerate `uv.lock` with `uv lock`, do not hand-edit it.
+
+## Python and Rust
+
+Python is 3.11 in CI and 3.14 in `.python-version`. Do not select a newer interpreter. Do not raise `requires-python`, the setup-uv `python-version`, or Ruff `target-version` past 3.14. Ruff's `target-version` is `py311`. Tooling is `uv`.
+
+Lint and format with `uv run ruff check .` and `uv run ruff format --check .`. Test with `uv run pytest`.
+
+Rust's bar is `cargo fmt --check`, `cargo clippy --all-targets -- -D warnings`, and `cargo test`. The stable channel is `rust-toolchain.toml`. CI passes that channel into `dtolnay/rust-toolchain` because the action is pinned by commit SHA.
+
+There is no TypeScript app and no Node toolchain.

ferroguard-0.3.1/.claude/agents/api-dev.md

@@ -0,0 +1,9 @@
+---
+name: api-dev
+description: Implement a change in the Python wrappers or the FastAPI demo.
+model: sonnet
+---
+
+Work in `llm_guardrails/` or `api/`. Wrappers stay thin. The demo calls `GuardrailsPipeline` and does not load environment variables. Run `uv run ruff check .`, `uv run ruff format --check .`, and `uv run pytest` before you claim the change is done.
+
+Follow `AGENTS.md`. There is no frontend.

ferroguard-0.3.1/.claude/agents/backend-dev.md

@@ -0,0 +1,9 @@
+---
+name: backend-dev
+description: Implement a Rust change in the guardrail core.
+model: sonnet
+---
+
+Work in `src/`. Export new behaviour through PyO3 in `src/lib.rs`. Run `cargo fmt`, `cargo clippy --all-targets -- -D warnings`, and `cargo test` before you claim the change is done.
+
+Follow `AGENTS.md`. Do not expand into the next issue.

ferroguard-0.3.1/.claude/agents/code-reviewer.md

@@ -0,0 +1,14 @@
+---
+name: code-reviewer
+description: Review a change on two axes, standards and spec fidelity.
+model: opus
+---
+
+Review the diff against `AGENTS.md`.
+
+Report two axes separately:
+
+1. Standards. fmt, clippy, ruff, tests, secrets, commit and PR shape. The import name stays `llm_guardrails`.
+2. Spec fidelity. Does the change do what was asked, and nothing it forbids?
+
+Lead with findings, by severity. Do not rewrite the change unless asked.

ferroguard-0.3.1/.claude/commands/commit.md

@@ -0,0 +1,9 @@
+---
+description: Commit the current change with a hybrid subject.
+---
+
+Follow `.claude/skills/git-workflow/SKILL.md`.
+
+Stage one logical change. The subject is `<emoji> <type>(<scope>): <lower-case imperative>`, under 72 characters, no trailing period. The body says why. No attribution trailer.
+
+Do not use `--no-verify` unless the human asked.

ferroguard-0.3.1/.claude/commands/create-pr.md

@@ -0,0 +1,7 @@
+---
+description: Open a pull request. Do not merge it.
+---
+
+Follow `.claude/skills/git-workflow/SKILL.md`.
+
+Title is the hybrid subject. Body has what and why, `Closes #N`, evidence, merge danger, and breaking changes. One label. Push the feature branch. Do not push `main`. Do not merge.

ferroguard-0.3.1/.claude/commands/implement.md

@@ -0,0 +1,11 @@
+---
+description: Implement one issue with tests, then stop.
+---
+
+Read the issue. Read `AGENTS.md`.
+
+Agree the seams, then make one failing test pass at a time. Rust tests live in `src/`. Python tests live in `tests/`. Mock only at process boundaries.
+
+Verify with the commands in `AGENTS.md` that the diff can affect. Read the output.
+
+Commit a meaningful unit when it is green. Open or update the pull request. Do not merge. Do not start the next issue.

ferroguard-0.3.1/.claude/commands/verify.md

@@ -0,0 +1,17 @@
+---
+description: Run the library verification loop and report each phase.
+---
+
+Run, in order, and record pass or fail from the command output:
+
+1. `cargo fmt --check`
+2. `cargo clippy --all-targets -- -D warnings`
+3. `cargo test`
+4. `uv run ruff check .`
+5. `uv run ruff format --check .`
+6. `uv run pytest`
+7. `python3 scripts/release_subject.py --self-test`
+8. `python3 scripts/release_publish.py --self-test`
+9. `python3 scripts/test_guardrails.py`
+
+Say what you did not run. Do not claim a phase passed without its output.

ferroguard-0.3.1/.claude/hooks/scripts/commit-style.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Warn or deny a git commit whose subject misses the hybrid convention."""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[3]
+TYPES_PATH = ROOT / "scripts" / "commit-types.json"
+MESSAGE = re.compile(r"""(?:-m|--message)(?:=|\s+)(?:"([^"]+)"|'([^']+)'|(\S+))""")
+
+
+def subject_pattern() -> re.Pattern[str]:
+    """Subject regex built from scripts/commit-types.json."""
+    names = [item["name"] for item in json.loads(TYPES_PATH.read_text(encoding="utf-8"))["types"]]
+    joined = "|".join(names)
+    return re.compile(rf"^\S+\s+(?:{joined})(\([a-z0-9][a-z0-9._-]*\))?(!)?: [a-z].*")
+
+
+def commit_subject(command: str) -> str | None:
+    """Return the -m subject when this command is a git commit."""
+    if not re.search(r"\bgit\s+commit\b", command):
+        return None
+    match = MESSAGE.search(command)
+    if match is None:
+        return None
+    return next(group for group in match.groups() if group)
+
+
+def decision(command: str, profile: str | None = None) -> tuple[int, str | None]:
+    """Return (exit code, warning). Exit 2 denies. Standard only warns."""
+    subject = commit_subject(command)
+    if subject is None or subject_pattern().match(subject):
+        return 0, None
+    message = f"commit subject does not match <emoji> <type>(<scope>): <imperative>: {subject}"
+    mode = profile if profile is not None else os.environ.get("SDLC_HOOK_PROFILE", "standard")
+    if mode == "strict":
+        return 2, message
+    if mode == "minimal":
+        return 0, None
+    return 0, message
+
+
+def main() -> int:
+    """Read the hook payload and apply the profile."""
+    payload = json.load(sys.stdin)
+    command = str(payload.get("tool_input", {}).get("command", ""))
+    code, warning = decision(command)
+    if warning:
+        print(warning, file=sys.stderr)
+    return code
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

ferroguard-0.3.1/.claude/hooks/scripts/commit-style.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+# PreToolUse wrapper. stdin is the Claude Code hook payload.
+exec python3 "$(dirname "$0")/commit-style.py"

ferroguard-0.3.1/.claude/hooks/scripts/git-guardrails.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+# PreToolUse wrapper. stdin is the Claude Code hook payload.
+exec python3 "$(dirname "$0")/git_guardrails.py"

ferroguard-0.3.1/.claude/hooks/scripts/git_guardrails.py

@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""Ask before destructive git commands. A plain git push is allowed."""
+
+from __future__ import annotations
+
+import json
+import re
+import sys
+
+FORCE_PUSH = re.compile(r"\bgit\s+push\b[^\n]*--force\b|\bgit\s+push\b[^\n]*--force-with-lease\b")
+FORCE_FLAG = re.compile(r"\bgit\s+push\b[^\n]*(?:^|\s)-f(?:\s|$)")
+PLUS_REF = re.compile(r"\bgit\s+push\b[^\n]*\s\+\S+")
+RESET_HARD = re.compile(r"\bgit\s+reset\b[^\n]*--hard\b")
+CLEAN_FORCE = re.compile(r"\bgit\s+clean\b[^\n]*\s-[a-zA-Z]*f")
+BRANCH_DELETE = re.compile(r"\bgit\s+branch\b[^\n]*(?:^|\s)-D(?:\s|$)")
+
+
+def needs_ask(command: str) -> str | None:
+    """Return a reason to ask, or None when the command may run."""
+    if "git" not in command:
+        return None
+    if "--no-verify" in command:
+        return "git command skips hooks (--no-verify)"
+    if FORCE_PUSH.search(command) or FORCE_FLAG.search(command) or PLUS_REF.search(command):
+        return "force-push"
+    if RESET_HARD.search(command):
+        return "git reset --hard"
+    if CLEAN_FORCE.search(command):
+        return "git clean -f"
+    if BRANCH_DELETE.search(command):
+        return "git branch -D"
+    return None
+
+
+def hook_response(command: str) -> dict | None:
+    """Claude Code PreToolUse payload, or None to allow."""
+    reason = needs_ask(command)
+    if reason is None:
+        return None
+    return {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "ask",
+            "permissionDecisionReason": f"git guardrail: {reason}",
+        }
+    }
+
+
+def main() -> int:
+    """Read the hook payload on stdin and print a decision when needed."""
+    payload = json.load(sys.stdin)
+    command = str(payload.get("tool_input", {}).get("command", ""))
+    response = hook_response(command)
+    if response is not None:
+        print(json.dumps(response))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

ferroguard-0.3.1/.claude/hooks/scripts/stack-guardrails.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+# PreToolUse and PostToolUse wrapper. stdin is the Claude Code hook payload.
+exec python3 "$(dirname "$0")/stack_guardrails.py"

ferroguard-0.3.1/.claude/hooks/scripts/stack_guardrails.py

@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+"""Block publish and deploy commands when stack guardrails are opted in.
+
+Opt in with `.claude/stack-guardrails.enabled` at the git root, or
+`SDLC_STACK_GUARDRAILS=1`. The block exits 2 in every profile, including
+standard. Dry-run publishes are allowed.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import sys
+from pathlib import Path
+
+PUBLISH = re.compile(r"\b(?:npm|pnpm|yarn|uv)\s+publish\b|\bchangeset\s+publish\b")
+RAILWAY = re.compile(
+    r"\brailway\s+(?:up|deploy|redeploy|down)\b"
+    r"|\brailway\s+variables\s+--set\b"
+    r"|\brailway\s+config\s+apply\b"
+    r"|\brailway\s+config\s+migrate\b[^\n]*--apply\b"
+)
+LOCKFILE = re.compile(r"(?:^|/)(?:uv\.lock|pnpm-lock\.yaml)$")
+
+
+def enabled(start: Path | None = None) -> bool:
+    """True when the repo opted in or the environment variable is set."""
+    if os.environ.get("SDLC_STACK_GUARDRAILS") == "1":
+        return True
+    here = start or Path.cwd()
+    for parent in [here, *here.parents]:
+        marker = parent / ".claude" / "stack-guardrails.enabled"
+        if marker.is_file():
+            return True
+        if (parent / ".git").exists():
+            return marker.is_file()
+    return False
+
+
+def blocked_reason(command: str) -> str | None:
+    """Return why a shell command is blocked, ignoring publish dry-runs."""
+    if not enabled():
+        return None
+    if PUBLISH.search(command) and "--dry-run" not in command:
+        return "package publish is blocked by stack guardrails"
+    if RAILWAY.search(command):
+        return "railway deploy is blocked by stack guardrails"
+    return None
+
+
+def lockfile_warning(path: str) -> str | None:
+    """Warn on a hand edit of a lockfile this harness does not regenerate."""
+    if not enabled():
+        return None
+    if LOCKFILE.search(path):
+        return f"hand edit of {path}; prefer the package manager that owns it"
+    return None
+
+
+def main() -> int:
+    """Apply the pre-bash block or the post-edit lockfile warning."""
+    payload = json.load(sys.stdin)
+    tool = str(payload.get("tool_name", ""))
+    tool_input = payload.get("tool_input", {})
+    if tool == "Bash":
+        reason = blocked_reason(str(tool_input.get("command", "")))
+        if reason:
+            print(reason, file=sys.stderr)
+            return 2
+        return 0
+    path = str(tool_input.get("file_path", ""))
+    warning = lockfile_warning(path)
+    if warning:
+        print(warning, file=sys.stderr)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

ferroguard-0.3.1/.claude/rules/coding-standards.md

@@ -0,0 +1,15 @@
+---
+description: Size, typing, and test shape for Python and Rust
+paths: "**/*.py, **/*.rs"
+---
+
+# Coding standards
+
+- Functions stay within about 30 lines. Files stay within about 300 lines.
+- No magic numbers. Name them.
+- `TODO` comments name an issue: `TODO(#123)`.
+- Python tooling is `uv` only. Ruff lints and formats. Scripts under `scripts/` that ship in CI are stdlib, so CI does not need a venv for those scripts.
+- Rust: `cargo fmt` and `cargo clippy --all-targets -- -D warnings`. Guard logic stays in `src/`.
+- Tests are arrange, act, assert. One assertion. No logic in the test.
+
+There is no TypeScript in this repository.

ferroguard-0.3.1/.claude/rules/security.md

@@ -0,0 +1,13 @@
+---
+description: Secrets, injection, and browser sinks
+paths: "**/*.py, **/*.rs, **/*.yaml, **/*.yml, **/*.json"
+---
+
+# Security
+
+- No hard-coded secrets. No secrets in logs.
+- No `eval`. No unsanitized `innerHTML` or `dangerouslySetInnerHTML`.
+- No `*` CORS on a deployment that is not loopback-only.
+- The guards are regex and heuristic checks. Do not describe them as a complete injection, bias, or compliance control.
+- PII mappings stay in memory and are returned to the caller. Do not log the mapping or the original text.
+- The output validator checks top-level JSON `type` and `required` only. It is not full JSON Schema.

ferroguard-0.3.1/.claude/settings.json

@@ -0,0 +1,48 @@
+{
+  "attribution": {
+    "commit": "",
+    "pr": ""
+  },
+  "includeCoAuthoredBy": false,
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": ".claude/hooks/scripts/git-guardrails.sh"
+          },
+          {
+            "type": "command",
+            "command": ".claude/hooks/scripts/commit-style.sh"
+          },
+          {
+            "type": "command",
+            "command": ".claude/hooks/scripts/stack-guardrails.sh"
+          }
+        ]
+      },
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": ".claude/hooks/scripts/stack-guardrails.sh"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": ".claude/hooks/scripts/stack-guardrails.sh"
+          }
+        ]
+      }
+    ]
+  }
+}

ferroguard-0.3.1/.claude/skills/git-workflow/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: git-workflow
+description: Commit subjects, pull request shape, and direct releases from main. Use when committing, opening a PR, or changing release automation.
+---
+
+# Git workflow
+
+## Commit subject
+
+`<emoji> <type>(<scope>): <lower-case imperative>`. Under 72 characters. No trailing period. The body says why. Footers are `Closes #N`, `Fixes #N`, `Refs #N`, or `BREAKING CHANGE:`. No `Co-authored-by` and no "Generated with" trailer.
+
+Types and emoji are the table in `AGENTS.md` and `scripts/commit-types.json`. Extra emoji that keep the same type: 🔥 🚚 🚨 💚 🎉 🔖.
+
+## Pull request
+
+Title is the subject. One label from `feature`, `bug`, `refactor`, `upgrade`, `docs`, `internal`, `breaking`, `security`.
+
+Body:
+
+- **What and why**, with `Closes #N`
+- **Evidence**: Before, After, Not verified
+- **Merge danger**: Door (one-way or two-way), Blast radius, Rollback
+- **Breaking changes, migrations, config**
+
+Add a Mermaid diagram when the architecture or the data flow changes.
+
+Branch from `main` as `feat/issue-N-short-name` or `fix/issue-N-short-name`. Do not force-push a shared branch.
+
+## Release
+
+A releasable push to `main` publishes in one workflow run. `scripts/release_subject.py` takes the highest bump since the last tag and consumes `## Unreleased`. The job commits `🔖 chore(release): vX.Y.Z`, pushes `main` without force, and tags that commit. The release commit does not publish again. The same run builds the abi3 wheels and sdist from that tag and publishes them to PyPI.
+
+## Merge
+
+Only when the human asks: `gh pr merge <number> --squash --delete-branch`.

ferroguard-0.3.1/.claude/skills/stack-guardrails/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: stack-guardrails
+description: Opt-in blocks for publish and deploy, plus the uv, ruff, and cargo checks this library expects. Use before publishing, deploying, or changing the toolchain.
+---
+
+# Stack guardrails
+
+Opt in by committing an empty `.claude/stack-guardrails.enabled` at the git root, or export `SDLC_STACK_GUARDRAILS=1`. This repository commits the marker, so the blocks are on.
+
+The hook exits 2, in every profile, for:
+
+- `npm publish`, `pnpm publish`, `yarn publish`, `uv publish`, `changeset publish` (a `--dry-run` is allowed)
+- `railway up`, `deploy`, `redeploy`, `down`, `variables --set`, `config apply`, `config migrate --apply`
+
+It warns on a hand edit of `uv.lock` or `pnpm-lock.yaml`. `Cargo.lock` is committed on purpose. Do not gitignore it. Regenerate `uv.lock` with `uv lock`, do not hand-edit it.
+
+## Python and Rust
+
+Python is 3.11 in CI and 3.14 in `.python-version`. Do not select a newer interpreter. Do not raise `requires-python`, the setup-uv `python-version`, or Ruff `target-version` past 3.14. Ruff's `target-version` is `py311`. Tooling is `uv`.
+
+Lint and format with `uv run ruff check .` and `uv run ruff format --check .`. Test with `uv run pytest`.
+
+Rust's bar is `cargo fmt --check`, `cargo clippy --all-targets -- -D warnings`, and `cargo test`. The stable channel is `rust-toolchain.toml`. CI passes that channel into `dtolnay/rust-toolchain` because the action is pinned by commit SHA.
+
+There is no TypeScript app and no Node toolchain.

ferroguard-0.3.1/.commitlintrc.json

@@ -0,0 +1,42 @@
+{
+  "rules": {
+    "type-enum": [
+      2,
+      "always",
+      [
+        "feat",
+        "fix",
+        "docs",
+        "style",
+        "refactor",
+        "perf",
+        "test",
+        "build",
+        "ci",
+        "chore",
+        "deps",
+        "security",
+        "revert"
+      ]
+    ],
+    "scope-enum": [
+      1,
+      "always",
+      [
+        "core",
+        "api",
+        "docs",
+        "deps",
+        "ci",
+        "release",
+        "repo",
+        "agents",
+        "commands",
+        "hooks",
+        "rules",
+        "security"
+      ]
+    ],
+    "header-max-length": [2, "always", 72]
+  }
+}

ferroguard-0.3.1/.cursor/rules/coding-standards.mdc

@@ -0,0 +1,9 @@
+---
+description: Size, typing, and test shape for Python and Rust
+globs: "**/*.{py,rs}"
+alwaysApply: false
+---
+
+Follow `.claude/rules/coding-standards.md` and `AGENTS.md`.
+
+Python tooling is uv and ruff. Rust guard logic stays in `src/`. Do not rename `llm_guardrails`.

ferroguard-0.3.1/.cursor/rules/security.mdc

@@ -0,0 +1,9 @@
+---
+description: Secrets, injection, and browser sinks
+globs: "**/*.{py,rs,yml,yaml,json}"
+alwaysApply: false
+---
+
+Follow `.claude/rules/security.md`.
+
+No hard-coded secrets. No `eval`. Do not widen a safety claim past what the regex guards do.

ferroguard-0.3.1/.cursor/skills/git-workflow/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: git-workflow
+description: Commit subjects, pull request shape, and direct releases from main. Use when committing, opening a PR, or changing release automation.
+---
+
+# Git workflow
+
+## Commit subject
+
+`<emoji> <type>(<scope>): <lower-case imperative>`. Under 72 characters. No trailing period. The body says why. Footers are `Closes #N`, `Fixes #N`, `Refs #N`, or `BREAKING CHANGE:`. No `Co-authored-by` and no "Generated with" trailer.
+
+Types and emoji are the table in `AGENTS.md` and `scripts/commit-types.json`. Extra emoji that keep the same type: 🔥 🚚 🚨 💚 🎉 🔖.
+
+## Pull request
+
+Title is the subject. One label from `feature`, `bug`, `refactor`, `upgrade`, `docs`, `internal`, `breaking`, `security`.
+
+Body:
+
+- **What and why**, with `Closes #N`
+- **Evidence**: Before, After, Not verified
+- **Merge danger**: Door (one-way or two-way), Blast radius, Rollback
+- **Breaking changes, migrations, config**
+
+Add a Mermaid diagram when the architecture or the data flow changes.
+
+Branch from `main` as `feat/issue-N-short-name` or `fix/issue-N-short-name`. Do not force-push a shared branch.
+
+## Release
+
+A releasable push to `main` publishes in one workflow run. `scripts/release_subject.py` takes the highest bump since the last tag and consumes `## Unreleased`. The job commits `🔖 chore(release): vX.Y.Z`, pushes `main` without force, and tags that commit. The release commit does not publish again. The same run builds the abi3 wheels and sdist from that tag and publishes them to PyPI.
+
+## Merge
+
+Only when the human asks: `gh pr merge <number> --squash --delete-branch`.

ferroguard-0.3.1/.cursor/skills/stack-guardrails/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: stack-guardrails
+description: Opt-in blocks for publish and deploy, plus the uv, ruff, and cargo checks this library expects. Use before publishing, deploying, or changing the toolchain.
+---
+
+# Stack guardrails
+
+Opt in by committing an empty `.claude/stack-guardrails.enabled` at the git root, or export `SDLC_STACK_GUARDRAILS=1`. This repository commits the marker, so the blocks are on.
+
+The hook exits 2, in every profile, for:
+
+- `npm publish`, `pnpm publish`, `yarn publish`, `uv publish`, `changeset publish` (a `--dry-run` is allowed)
+- `railway up`, `deploy`, `redeploy`, `down`, `variables --set`, `config apply`, `config migrate --apply`
+
+It warns on a hand edit of `uv.lock` or `pnpm-lock.yaml`. `Cargo.lock` is committed on purpose. Do not gitignore it. Regenerate `uv.lock` with `uv lock`, do not hand-edit it.
+
+## Python and Rust
+
+Python is 3.11 in CI and 3.14 in `.python-version`. Do not select a newer interpreter. Do not raise `requires-python`, the setup-uv `python-version`, or Ruff `target-version` past 3.14. Ruff's `target-version` is `py311`. Tooling is `uv`.
+
+Lint and format with `uv run ruff check .` and `uv run ruff format --check .`. Test with `uv run pytest`.
+
+Rust's bar is `cargo fmt --check`, `cargo clippy --all-targets -- -D warnings`, and `cargo test`. The stable channel is `rust-toolchain.toml`. CI passes that channel into `dtolnay/rust-toolchain` because the action is pinned by commit SHA.
+
+There is no TypeScript app and no Node toolchain.

ferroguard-0.3.1/.env-template

@@ -0,0 +1,22 @@
+# ──────────────────────────────────────────────
+# LLM Guardrails -- Environment Configuration
+# ──────────────────────────────────────────────
+# Copy this file to .env and fill in the values.
+
+# Guardrails behaviour --------------------------------------------------------
+# Injection-detection threshold (0.0 = permissive, 1.0 = strict)
+GUARDRAILS_INJECTION_THRESHOLD=0.5
+
+# Enable / disable individual guards (true | false)
+GUARDRAILS_PII_ENABLED=true
+GUARDRAILS_INJECTION_ENABLED=true
+GUARDRAILS_BIAS_ENABLED=true
+GUARDRAILS_OUTPUT_VALIDATION_ENABLED=true
+
+# Maximum allowed output length (characters)
+GUARDRAILS_MAX_OUTPUT_LENGTH=4096
+
+# API server -------------------------------------------------------------------
+API_HOST=0.0.0.0
+API_PORT=8000
+API_LOG_LEVEL=info