stackone-defender 0.8.2__tar.gz → 0.9.0__tar.gz

stackone_defender-0.9.0/.release-please-manifest.json

@@ -0,0 +1 @@
+{".":"0.9.0"}

{stackone_defender-0.8.2 → stackone_defender-0.9.0}/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.9.0](https://github.com/StackOneHQ/defender-py/compare/stackone-defender-v0.8.2...stackone-defender-v0.9.0) (2026-10-20)
+
+
+### Features
+
+* **ENG-3500:** record-oriented, chunked Tier-3 review in tier3_only ([#35](https://github.com/StackOneHQ/defender-py/issues/35)) ([072d7ed](https://github.com/StackOneHQ/defender-py/commit/072d7ed7f0474afa5ffe87a66920d279ad7fafdd))
+
+
+### Miscellaneous Chores
+
+* **ENG-3500:** release 0.9.0 ([#37](https://github.com/StackOneHQ/defender-py/issues/37)) ([aa4a4e3](https://github.com/StackOneHQ/defender-py/commit/aa4a4e39fcb7a7adc6d43fbab8d7b84817613dbc))
+
 ## [0.8.2](https://github.com/StackOneHQ/defender-py/compare/stackone-defender-v0.7.4...stackone-defender-v0.8.2) (2026-08-19)
 
 

{stackone_defender-0.8.2 → stackone_defender-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stackone-defender
-Version: 0.8.2
+Version: 0.9.0
 Summary: Indirect prompt injection defense for AI agents using tool calls
 Project-URL: Homepage, https://github.com/StackOneHQ/stackone-defender
 Project-URL: Repository, https://github.com/StackOneHQ/stackone-defender
@@ -179,12 +179,27 @@ defense = create_prompt_defense(
     tier3={
         "provider": MyProvider(),                          # optional: overrides the registry for this instance
         "escalation_band": {"lower": 0.3, "upper": 0.85},  # cascade gray band; [lower, upper), defaults shown
-        "max_text_length": 10000,                          # caps text passed to the provider
+        "max_text_length": 10000,                          # max chars per provider call
+        "max_chunks": 5,                                   # tier3_only: chunks reviewed per tool result
+        "on_oversize": "skip",                             # tier3_only: "skip" | "block" | "scan_anyway"
         "block_threshold": 0.622,                          # optional; decide on score, not the model's word
     },
 )
 ```
 
+**What the reviewer sees (`tier3_only`).** The tool result is serialized as `field: value` lines, one block per record, so a bare value keeps its field name (`status: create` rather than `create`, which reads like an instruction). Nested keys are dotted (`user.name: …`), list items are indexed (`items[0]: …`), and each line of a multi-line value keeps its prefix. A large list of only numbers collapses to `key: [N numbers]`. Keys are reviewed even when the value is a number, boolean, `None` or empty, because keys can carry injected text. Python-only types are reviewed too: mappings and dataclasses as objects, sets and other sequences as lists, UTF-8 `bytes` as text, and anything else as `str(value)`.
+
+The serialized text is split into chunks of at most `max_text_length` characters (lengths count UTF-16 code units, as in the TypeScript package). Neighbouring chunks overlap by up to 500 characters, so an injection cut at a chunk boundary still appears whole. All chunks are reviewed in parallel, and any blocking chunk blocks the result. `result.tier3_chunk_summary` reports `chunks`, `blocked` and `blocking_chunk`.
+
+**Oversize (`on_oversize`).** Up to about `max_chunks` chunks are reviewed per tool result. Content beyond that is oversize, and `coverage_degraded` is `True`. Blocking below requires `block_high_risk=True`.
+- `"skip"` (default): review the content that fits and allow the rest. A fitting injection still blocks. This favors availability, so set `"block"` or `"scan_anyway"` to fail closed.
+- `"block"`: block without calling the provider. `tier3_chunk_summary` is `None` and `result.tier3.skip_reason` says why.
+- `"scan_anyway"`: review what fits, then block on the unreviewed rest unless a chunk already blocked.
+
+In `"skip"` and `"scan_anyway"`, `tier3_chunk_summary.oversize` is `True`.
+
+A failed chunk is skipped (fail open), and `result.tier3.errored` and `coverage_degraded` are `True`. With a verdict, `result.tier3.note` says how many chunks failed; it also gives the reason for an `on_oversize` block when the provider allowed. When every chunk fails there's no verdict, and `result.tier3.skip_reason` gives the first failure.
+
 **Choosing the operating point (`block_threshold`).** By default the model's `decision` word is authoritative — but that word is its argmax, an implicit 0.5 cut that moves on its own whenever the model is retrained. Set `tier3.block_threshold` to decide on `verdict.score` (P(block)) instead: the cut becomes an explicit config value — raise it to trade recall for fewer false positives, lower it for the reverse; `0.5` reproduces argmax. It requires a provider that reports `score` as P(block) (not "confidence in whichever decision I made" — those invert on allows). If `score` is missing or outside `[0, 1]` the verdict's `decision` is used instead and defender warns once, so a provider that cannot report a score degrades to the default rather than failing.
 
 **Fail-open semantics.** A provider error or timeout records a `skip_reason` on `result.tier3`; in cascade defender falls back to the Tier 2 decision, in `tier3_only` it allows the request. `enable_tier3=True` with no registered provider falls back to the standard Tier 1 + Tier 2 cascade and logs one warning per instance — Tier 3 misconfiguration never silently disables defense. `result.tier3` carries the verdict (a `Tier3Verdict`, or a `Tier3Skip` when the provider ran but returned nothing usable) when Tier 3 runs, and is `None` when it doesn't.
@@ -257,7 +272,8 @@ class DefenseResult:
     cold_load: bool | None = None
     # Operational signals
     tier2_available: bool | None = None       # False when Tier 2 enabled but failed to load
-    coverage_degraded: bool | None = None      # True when Tier 1 detection coverage was capped
+    coverage_degraded: bool | None = None      # True when Tier 1 detection or the Tier 3 review didn't cover everything
+    tier3_chunk_summary: Tier3ChunkSummary | None = None  # tier3_only: chunks, blocked, blocking_chunk, oversize
 ```
 
 ### `defense.defend_tool_results(items)`
@@ -337,6 +353,25 @@ uv sync --group dev
 uv run pytest
 ```
 
+### Parity with the TypeScript package
+
+This package mirrors [`@stackone/defender`](https://github.com/StackOneHQ/defender). `tests/conformance/` is a pinned copy of its shared conformance fixtures: input → expected-output cases for Tier-3 serialization, prompt rendering, verdict parsing, error redaction and policy decisions. `tests/test_conformance.py` runs them against this package.
+
+- `scripts/sync_conformance.sh <ref>` copies the fixtures at a TS tag or commit and records it in `tests/conformance/VERSION`. CI checks the copy matches (`--check`).
+- Cases this package doesn't match yet are listed in `tests/conformance_known_failures.txt` and run as strict xfails. When a port makes one pass, remove its line.
+- Port contract for the runner: a rejected prompt template and an unusable verdict reply raise `ValueError`; optional result fields are `None` when unset (not `False`).
+
+Traps when porting from TypeScript (the fixtures pin TS behavior):
+
+- Lengths and slicing are in UTF-16 code units in TS, but `len()` counts code points.
+- TS `Object.entries` puts integer-like keys first. `json.loads` keeps insertion order.
+- Number rendering differs: `String(1.0)` is `"1"` but `str(1.0)` is `"1.0"`. Likewise `-0`, `1e-7` and `1e16` render differently in the two languages.
+- `core/tier3_input.py` handles the three traps above for Tier-3 input. It works on a UTF-16 view of each string, orders keys like `Object.entries`, and renders numbers like `String(n)`. One deliberate difference: Python ints below 1e21 print exactly, where JS would round past 2**53.
+- Python `re` has no `\p{Cf}`, and `unicodedata` versions differ across Python releases.
+- `str.splitlines()` also splits on `\x0b`, `\x0c` and `\x1c`, but TS splits only on `\r`, `\n`, `\u2028`, `\u2029` and `\u0085`.
+- JS `trim()` removes a BOM, but `str.strip()` doesn't.
+- `json.loads` accepts `NaN`, but JS `JSON.parse` rejects it. Use `parse_constant` to reject it.
+
 ## License
 
 Apache-2.0 — see [LICENSE](./LICENSE).

{stackone_defender-0.8.2 → stackone_defender-0.9.0}/README.md

@@ -153,12 +153,27 @@ defense = create_prompt_defense(
     tier3={
         "provider": MyProvider(),                          # optional: overrides the registry for this instance
         "escalation_band": {"lower": 0.3, "upper": 0.85},  # cascade gray band; [lower, upper), defaults shown
-        "max_text_length": 10000,                          # caps text passed to the provider
+        "max_text_length": 10000,                          # max chars per provider call
+        "max_chunks": 5,                                   # tier3_only: chunks reviewed per tool result
+        "on_oversize": "skip",                             # tier3_only: "skip" | "block" | "scan_anyway"
         "block_threshold": 0.622,                          # optional; decide on score, not the model's word
     },
 )
 ```
 
+**What the reviewer sees (`tier3_only`).** The tool result is serialized as `field: value` lines, one block per record, so a bare value keeps its field name (`status: create` rather than `create`, which reads like an instruction). Nested keys are dotted (`user.name: …`), list items are indexed (`items[0]: …`), and each line of a multi-line value keeps its prefix. A large list of only numbers collapses to `key: [N numbers]`. Keys are reviewed even when the value is a number, boolean, `None` or empty, because keys can carry injected text. Python-only types are reviewed too: mappings and dataclasses as objects, sets and other sequences as lists, UTF-8 `bytes` as text, and anything else as `str(value)`.
+
+The serialized text is split into chunks of at most `max_text_length` characters (lengths count UTF-16 code units, as in the TypeScript package). Neighbouring chunks overlap by up to 500 characters, so an injection cut at a chunk boundary still appears whole. All chunks are reviewed in parallel, and any blocking chunk blocks the result. `result.tier3_chunk_summary` reports `chunks`, `blocked` and `blocking_chunk`.
+
+**Oversize (`on_oversize`).** Up to about `max_chunks` chunks are reviewed per tool result. Content beyond that is oversize, and `coverage_degraded` is `True`. Blocking below requires `block_high_risk=True`.
+- `"skip"` (default): review the content that fits and allow the rest. A fitting injection still blocks. This favors availability, so set `"block"` or `"scan_anyway"` to fail closed.
+- `"block"`: block without calling the provider. `tier3_chunk_summary` is `None` and `result.tier3.skip_reason` says why.
+- `"scan_anyway"`: review what fits, then block on the unreviewed rest unless a chunk already blocked.
+
+In `"skip"` and `"scan_anyway"`, `tier3_chunk_summary.oversize` is `True`.
+
+A failed chunk is skipped (fail open), and `result.tier3.errored` and `coverage_degraded` are `True`. With a verdict, `result.tier3.note` says how many chunks failed; it also gives the reason for an `on_oversize` block when the provider allowed. When every chunk fails there's no verdict, and `result.tier3.skip_reason` gives the first failure.
+
 **Choosing the operating point (`block_threshold`).** By default the model's `decision` word is authoritative — but that word is its argmax, an implicit 0.5 cut that moves on its own whenever the model is retrained. Set `tier3.block_threshold` to decide on `verdict.score` (P(block)) instead: the cut becomes an explicit config value — raise it to trade recall for fewer false positives, lower it for the reverse; `0.5` reproduces argmax. It requires a provider that reports `score` as P(block) (not "confidence in whichever decision I made" — those invert on allows). If `score` is missing or outside `[0, 1]` the verdict's `decision` is used instead and defender warns once, so a provider that cannot report a score degrades to the default rather than failing.
 
 **Fail-open semantics.** A provider error or timeout records a `skip_reason` on `result.tier3`; in cascade defender falls back to the Tier 2 decision, in `tier3_only` it allows the request. `enable_tier3=True` with no registered provider falls back to the standard Tier 1 + Tier 2 cascade and logs one warning per instance — Tier 3 misconfiguration never silently disables defense. `result.tier3` carries the verdict (a `Tier3Verdict`, or a `Tier3Skip` when the provider ran but returned nothing usable) when Tier 3 runs, and is `None` when it doesn't.
@@ -231,7 +246,8 @@ class DefenseResult:
     cold_load: bool | None = None
     # Operational signals
     tier2_available: bool | None = None       # False when Tier 2 enabled but failed to load
-    coverage_degraded: bool | None = None      # True when Tier 1 detection coverage was capped
+    coverage_degraded: bool | None = None      # True when Tier 1 detection or the Tier 3 review didn't cover everything
+    tier3_chunk_summary: Tier3ChunkSummary | None = None  # tier3_only: chunks, blocked, blocking_chunk, oversize
 ```
 
 ### `defense.defend_tool_results(items)`
@@ -311,6 +327,25 @@ uv sync --group dev
 uv run pytest
 ```
 
+### Parity with the TypeScript package
+
+This package mirrors [`@stackone/defender`](https://github.com/StackOneHQ/defender). `tests/conformance/` is a pinned copy of its shared conformance fixtures: input → expected-output cases for Tier-3 serialization, prompt rendering, verdict parsing, error redaction and policy decisions. `tests/test_conformance.py` runs them against this package.
+
+- `scripts/sync_conformance.sh <ref>` copies the fixtures at a TS tag or commit and records it in `tests/conformance/VERSION`. CI checks the copy matches (`--check`).
+- Cases this package doesn't match yet are listed in `tests/conformance_known_failures.txt` and run as strict xfails. When a port makes one pass, remove its line.
+- Port contract for the runner: a rejected prompt template and an unusable verdict reply raise `ValueError`; optional result fields are `None` when unset (not `False`).
+
+Traps when porting from TypeScript (the fixtures pin TS behavior):
+
+- Lengths and slicing are in UTF-16 code units in TS, but `len()` counts code points.
+- TS `Object.entries` puts integer-like keys first. `json.loads` keeps insertion order.
+- Number rendering differs: `String(1.0)` is `"1"` but `str(1.0)` is `"1.0"`. Likewise `-0`, `1e-7` and `1e16` render differently in the two languages.
+- `core/tier3_input.py` handles the three traps above for Tier-3 input. It works on a UTF-16 view of each string, orders keys like `Object.entries`, and renders numbers like `String(n)`. One deliberate difference: Python ints below 1e21 print exactly, where JS would round past 2**53.
+- Python `re` has no `\p{Cf}`, and `unicodedata` versions differ across Python releases.
+- `str.splitlines()` also splits on `\x0b`, `\x0c` and `\x1c`, but TS splits only on `\r`, `\n`, `\u2028`, `\u2029` and `\u0085`.
+- JS `trim()` removes a BOM, but `str.strip()` doesn't.
+- `json.loads` accepts `NaN`, but JS `JSON.parse` rejects it. Use `parse_constant` to reject it.
+
 ## License
 
 Apache-2.0 — see [LICENSE](./LICENSE).

{stackone_defender-0.8.2 → stackone_defender-0.9.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stackone-defender"
-version = "0.8.2"
+version = "0.9.0"
 description = "Indirect prompt injection defense for AI agents using tool calls"
 readme = "README.md"
 requires-python = ">=3.11"

stackone_defender-0.9.0/scripts/sync_conformance.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Sync the shared conformance fixtures from the TypeScript package (StackOneHQ/defender).
+#
+#   scripts/sync_conformance.sh <ref>   copy conformance/ at <ref> (a tag like defender-v0.9.2, or a commit SHA)
+#                                       into tests/conformance/ and record <ref> in tests/conformance/VERSION
+#   scripts/sync_conformance.sh --check verify tests/conformance/ matches the ref in VERSION (used in CI)
+set -euo pipefail
+
+REPO="StackOneHQ/defender"
+DEST="tests/conformance"
+
+# A full commit SHA or a release tag only: a branch would float, and anything else may not be a TS ref.
+valid_ref() {
+	[[ "$1" =~ ^[0-9a-f]{40}$ || "$1" =~ ^defender-v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+}
+
+fetch() {
+	local ref="$1" out="$2"
+	valid_ref "$ref" || { echo "invalid ref '${ref}': use a full 40-char commit SHA or a defender-vX.Y.Z tag" >&2; exit 2; }
+	# Whole archive (small: LFS models come through as pointers); portable across GNU and BSD tar.
+	curl -fsSL --retry 3 --retry-delay 2 --max-time 60 "https://codeload.github.com/${REPO}/tar.gz/${ref}" | tar -xz -C "$out" --strip-components=1
+	[ -d "$out/conformance" ] || { echo "no conformance/ folder at ${REPO}@${ref}" >&2; exit 1; }
+}
+
+cd "$(dirname "$0")/.."
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+
+if [ "${1:-}" = "--check" ]; then
+	ref="$(tr -d '[:space:]' < "$DEST/VERSION")"
+	fetch "$ref" "$tmp"
+	if diff -r --exclude VERSION "$tmp/conformance" "$DEST"; then
+		echo "tests/conformance matches ${REPO}@${ref}"
+	else
+		echo "tests/conformance differs from ${REPO}@${ref}: re-run scripts/sync_conformance.sh ${ref}" >&2
+		exit 1
+	fi
+	exit 0
+fi
+
+ref="${1:?usage: $0 <ref> | --check}"
+fetch "$ref" "$tmp"
+rm -rf "$DEST"
+mkdir -p "$DEST"
+cp -R "$tmp/conformance/." "$DEST/"
+echo "$ref" > "$DEST/VERSION"
+echo "synced ${REPO}@${ref} → ${DEST}"

{stackone_defender-0.8.2 → stackone_defender-0.9.0}/src/stackone_defender/__init__.py

@@ -28,6 +28,7 @@ from .types import (
     MultiheadConfig,
     RiskLevel,
     Tier1Result,
+    Tier3ChunkSummary,
     Tier3Provider,
     Tier3TokenUsage,
     Tier3Verdict,
@@ -44,6 +45,7 @@ __all__ = [
     "SfePredictor",
     "SfePreprocessResult",
     "Tier1Result",
+    "Tier3ChunkSummary",
     "Tier3Provider",
     "Tier3TokenUsage",
     "Tier3Verdict",

{stackone_defender-0.8.2 → stackone_defender-0.9.0}/src/stackone_defender/core/prompt_defense.py

@@ -29,6 +29,7 @@ from ..types import (
     RiskLevel,
     Tier1Result,
     Tier2Stats,
+    Tier3ChunkSummary,
     Tier3EscalationBand,
     Tier3Provider,
     Tier3Result,
@@ -38,6 +39,7 @@ from ..types import (
 )
 from ..utils.boundary import generate_data_boundary
 from .sentence_cleaner import clean_high_risk_content
+from .tier3_input import DEFAULT_MAX_CHUNKS, chunk_tier3_input, content_budget, format_records_for_tier3
 from .tool_result_sanitizer import ToolResultSanitizer, create_tool_result_sanitizer
 
 _logger = logging.getLogger(__name__)
@@ -48,6 +50,7 @@ _tier2_unavailable_warned = False
 
 _DEFAULT_TIER3_BAND = Tier3EscalationBand(lower=0.3, upper=0.85)
 _DEFAULT_TIER3_MAX_TEXT_LENGTH = 10000
+_TIER3_ON_OVERSIZE = ("skip", "block", "scan_anyway")
 
 
 @dataclass
@@ -154,27 +157,12 @@ def _extract_strings(
     return strings
 
 
-def _bounded_join_strings(strings: list[str], max_len: int, sep: str = "\n") -> str:
-    """Join strings with ``sep``, capping total length at ``max_len`` without building the full join first."""
-    if max_len <= 0:
-        return ""
-    parts: list[str] = []
-    used = 0
-    sep_len = len(sep)
-    for s in strings:
-        if not s:
-            continue
-        prefix = sep_len if parts else 0
-        if used + prefix >= max_len:
-            break
-        remaining = max_len - used - prefix
-        if len(s) <= remaining:
-            parts.append(s)
-            used += prefix + len(s)
-        else:
-            parts.append(s[:remaining])
-            break
-    return sep.join(parts)
+def _finite_at_least_one(v: Any) -> bool:
+    if isinstance(v, bool) or not isinstance(v, (int, float)):
+        return False
+    if isinstance(v, int):
+        return v >= 1  # math.isfinite overflows on huge ints
+    return math.isfinite(v) and math.floor(v) >= 1
 
 
 _RISK_LEVELS: list[RiskLevel] = ["low", "medium", "high", "critical"]
@@ -265,20 +253,44 @@ class PromptDefense:
         self._tier3_missing_provider_warned = False
         self._tier3_block_threshold: float | None = None
         self._tier3_missing_score_warned = False
+        self._tier3_on_oversize = "skip"
+        self._tier3_max_chunks = DEFAULT_MAX_CHUNKS
         tier3_opts = tier3 or {}
         if tier3_opts.get("provider") is not None:
             self._tier3_custom_provider = tier3_opts["provider"]
         max_text_length = tier3_opts.get("max_text_length", tier3_opts.get("maxTextLength"))
         if max_text_length is not None:
-            if isinstance(max_text_length, (int, float)) and math.isfinite(max_text_length) and max_text_length > 0:
-                self._tier3_max_text_length = int(max_text_length)
+            # Validate the floored value: a cap in (0, 1) floors to 0, which would disable Tier 3.
+            if _finite_at_least_one(max_text_length):
+                self._tier3_max_text_length = math.floor(max_text_length)
             else:
                 _logger.warning(
-                    "[defender] invalid tier3.max_text_length %s — must be a positive finite number. "
+                    "[defender] invalid tier3.max_text_length %s — must be a finite number >= 1. "
                     "Falling back to default %s.",
                     max_text_length,
                     _DEFAULT_TIER3_MAX_TEXT_LENGTH,
                 )
+        on_oversize = tier3_opts.get("on_oversize", tier3_opts.get("onOversize"))
+        if on_oversize is not None:
+            if on_oversize in _TIER3_ON_OVERSIZE:
+                self._tier3_on_oversize = on_oversize
+            else:
+                _logger.warning(
+                    '[defender] invalid tier3.on_oversize %r — must be "skip", "block", or "scan_anyway". '
+                    'Falling back to default "skip".',
+                    on_oversize,
+                )
+        max_chunks = tier3_opts.get("max_chunks", tier3_opts.get("maxChunks"))
+        if max_chunks is not None:
+            if _finite_at_least_one(max_chunks):
+                self._tier3_max_chunks = math.floor(max_chunks)
+            else:
+                _logger.warning(
+                    "[defender] invalid tier3.max_chunks %s — must be a finite number >= 1. "
+                    "Falling back to default %s.",
+                    max_chunks,
+                    DEFAULT_MAX_CHUNKS,
+                )
         escalation_band = tier3_opts.get("escalation_band", tier3_opts.get("escalationBand"))
         if escalation_band is not None:
             lower = escalation_band.get("lower")
@@ -392,7 +404,10 @@ class PromptDefense:
     def _validate_tier3_verdict(verdict: Any) -> Tier3Verdict | Tier3Skip:
         if isinstance(verdict, Tier3Verdict):
             if verdict.decision in ("block", "allow"):
-                return replace(verdict, score=PromptDefense._normalize_tier3_score(verdict.score))
+                # errored/note are set by the defender, never by a provider.
+                return replace(
+                    verdict, score=PromptDefense._normalize_tier3_score(verdict.score), errored=None, note=None
+                )
             return Tier3Skip(
                 skip_reason=(
                     f'Tier 3 provider returned invalid decision: {verdict.decision!r} '
@@ -533,55 +548,179 @@ class PromptDefense:
         )
         return risk_level, allowed
 
+    async def _review_tier3_chunk(self, provider: Tier3Provider, text: str, tool_name: str) -> Tier3Result:
+        try:
+            raw = await self._invoke_tier3_classify(provider, text, tool_name)
+        except asyncio.CancelledError as e:
+            # Our own task being cancelled must propagate; a provider's internal cancel is a chunk failure.
+            task = asyncio.current_task()
+            if task is not None and task.cancelling():
+                raise
+            return Tier3Skip(skip_reason=f"Tier 3 provider error: cancelled {e}".rstrip())
+        except Exception as e:
+            return Tier3Skip(skip_reason=f"Tier 3 provider error: {e}")
+        return self._validate_tier3_verdict(raw)
+
     async def _run_tier3_only(
         self,
         value: Any,
         provider: Tier3Provider,
         tool_name: str,
-        depth_flag: dict[str, bool],
+        depth_flag: dict[str, Any],
         start_time: float,
     ) -> DefenseResult:
-        strings = [s for s in _extract_strings(value, None, depth_flag) if len(s) > 0]
-        bounded = _bounded_join_strings(strings, self._tier3_max_text_length)
-
+        # ENG-2455: record-oriented `field: value` input, so bare values keep field context.
+        # ENG-1339: serialize up to a coverage ceiling, chunk it, and review every chunk in parallel
+        # (union of blocks) instead of truncating: a fixed truncation point is easy to evade.
         verdict: Tier3Verdict | None = None
         skip_reason: str | None = None
-        if len(bounded) == 0:
-            skip_reason = "No strings extracted from tool result"
+        # A policy block (on_oversize), as opposed to a chunk verdict block.
+        oversize_block = False
+        chunk_summary: Tier3ChunkSummary | None = None
+        # The payload couldn't be serialized: un-analyzable input fails closed in strict mode.
+        payload_error = False
+        chunk_failures = 0
+        chunk_total = 0
+        first_chunk_failure: str | None = None
+
+        per_chunk = self._tier3_max_text_length
+        # The ceiling uses the per-chunk content budget (minus the carried overlap), so the content
+        # typically fits in max_chunks chunks; the reviewer still sees <= per_chunk chars per call.
+        ceiling = self._tier3_max_chunks * content_budget(per_chunk)
+        joined = ""
+        try:
+            joined = format_records_for_tier3(value, depth_flag, ceiling, self._config.traversal.max_size)
+        except Exception as e:
+            payload_error = True
+            skip_reason = f"Tier 3 serialization error: {e}"
+        # A depth cut also hides content from the reviewer, so it counts as oversize.
+        oversize = depth_flag.get("budget_exceeded") is True or depth_flag["hit"] is True
+
+        if payload_error:
+            pass
+        elif oversize and self._tier3_on_oversize == "block":
+            # Checked before the empty case so "block" fails closed even when nothing fit.
+            oversize_block = True
+            depth_flag["coverage_degraded"] = True
+            skip_reason = (
+                f"Tool result too large to fully review (> {self._tier3_max_chunks} chunks) — blocked by onOversize"
+            )
+        elif not joined:
+            if oversize:
+                depth_flag["coverage_degraded"] = True
+            if oversize and self._tier3_on_oversize == "scan_anyway":
+                oversize_block = True
+                skip_reason = "Tool result too large to review — no content fit within the ceiling"
+            elif skip_reason is None:
+                skip_reason = (
+                    "Tool result too large to review — no content fit within the ceiling"
+                    if oversize
+                    else "No reviewable string content emitted from tool result"
+                )
         else:
-            try:
-                raw = await self._invoke_tier3_classify(provider, bounded, tool_name)
-                validated = self._validate_tier3_verdict(raw)
-                if isinstance(validated, Tier3Skip):
-                    skip_reason = validated.skip_reason
+            # Always review what fit, so a fitting injection is never dropped; on_oversize governs
+            # only the overflow.
+            chunks = chunk_tier3_input(joined, per_chunk)
+            results = await asyncio.gather(*(self._review_tier3_chunk(provider, c, tool_name) for c in chunks))
+            blocked_count = 0
+            blocking_chunk: int | None = None
+            reviewed = 0
+            for idx, res in enumerate(results):
+                if isinstance(res, Tier3Skip):
+                    chunk_failures += 1
+                    if first_chunk_failure is None:
+                        first_chunk_failure = res.skip_reason
+                    continue
+                reviewed += 1
+                is_block = self._is_tier3_block(res)
+                if is_block:
+                    blocked_count += 1
+                    if blocking_chunk is None:
+                        blocking_chunk = idx
+                # Representative: a blocker if any, else the highest-score allow.
+                if verdict is None:
+                    verdict = res
                 else:
-                    verdict = validated
-            except Exception as e:
-                skip_reason = f"Tier 3 provider error: {e}"
-
-        sanitized = self._tool_sanitizer.sanitize(value, tool_name=tool_name)
-        detections, _tier1_flagged, prm = self._tier1_metadata(sanitized)
-
-        blocked = verdict is not None and self._is_tier3_block(verdict)
-        risk_level: RiskLevel = "high" if blocked else "low"
-        allowed = not self._config.block_high_risk or not blocked
-        tier3_result: Tier3Result = (
-            verdict if verdict is not None else Tier3Skip(skip_reason=skip_reason or "Tier 3 skipped")
-        )
+                    rep_block = self._is_tier3_block(verdict)
+                    if (is_block and not rep_block) or (
+                        is_block == rep_block and (res.score or 0) > (verdict.score or 0)
+                    ):
+                        verdict = res
+            chunk_total = len(chunks)
+            chunk_summary = Tier3ChunkSummary(
+                chunks=chunk_total,
+                blocked=blocked_count,
+                blocking_chunk=blocking_chunk,
+                oversize=True if oversize else None,
+            )
+            if reviewed == 0:
+                # Every chunk failed: provider outage or bad verdicts. Fails open.
+                if skip_reason is None:
+                    skip_reason = first_chunk_failure or "Tier 3 skipped: no chunk produced a verdict"
+                depth_flag["coverage_degraded"] = True
+            elif chunk_failures > 0:
+                depth_flag["coverage_degraded"] = True
+            if oversize:
+                depth_flag["coverage_degraded"] = True
+                # The overflow went unreviewed: scan_anyway fails closed on it unless a chunk blocked.
+                if not (verdict is not None and self._is_tier3_block(verdict)) and self._tier3_on_oversize == "scan_anyway":
+                    oversize_block = True
+                    skip_reason = f"Tool result exceeds review ceiling; {chunk_total} chunks scanned, overflow unreviewed"
+
+        # Tier 1 runs for `detections` metadata only (the LLM decides in tier3_only). Its walk is
+        # uncapped, so a failure here degrades coverage but doesn't override a verdict.
+        patterns_by_field: dict[str, list[str]] = {}
+        detections: list[str] = []
+        sanitized_content: Any = value
+        analysis_degraded = False
+        try:
+            sanitized = self._tool_sanitizer.sanitize(value, tool_name=tool_name)
+            detections, _tier1_flagged, patterns_by_field = self._tier1_metadata(sanitized)
+            sanitized_content = sanitized.sanitized
+            analysis_degraded = bool(self._coverage_degraded(sanitized.metadata, {"hit": False}))
+        except Exception as e:
+            analysis_degraded = True
+            if skip_reason is None:
+                skip_reason = f"Tier 1 metadata error: {e}"
+
+        blocked = oversize_block or (verdict is not None and self._is_tier3_block(verdict))
+        risk_level: RiskLevel = "high" if blocked or payload_error else "low"
+        # block_high_risk=False always allows; strict mode fails closed on a payload error.
+        allowed = not self._config.block_high_risk or (not blocked and not payload_error)
+
+        errored = True if chunk_failures > 0 else None
+        tier3_result: Tier3Result
+        if verdict is not None:
+            # skip_reason isn't reported with a verdict, so say why the outcome isn't the verdict's alone.
+            notes: list[str] = []
+            if oversize_block and skip_reason:
+                notes.append(skip_reason)
+            if chunk_failures > 0:
+                failed = f"{chunk_failures} of {chunk_total} chunks failed"
+                notes.append(f"{failed}: {first_chunk_failure}" if first_chunk_failure else failed)
+            tier3_result = replace(verdict, errored=errored, note="; ".join(notes) or None)
+        else:
+            tier3_result = Tier3Skip(skip_reason=skip_reason or "Tier 3 skipped", errored=errored)
 
         return DefenseResult(
             allowed=allowed,
             risk_level=risk_level,
-            sanitized=sanitized.sanitized,
+            sanitized=sanitized_content,
             detections=detections,
             fields_sanitized=[],
-            patterns_by_field=prm,
-            detected_field_count=len(prm),
+            patterns_by_field=patterns_by_field,
+            detected_field_count=len(patterns_by_field),
             tier3=tier3_result,
             fields_dropped=[],
+            # The depth-limit signal only; budget drops set coverage_degraded.
             truncated_at_depth=depth_flag["hit"] or None,
             latency_ms=(time.perf_counter() - start_time) * 1000,
-            coverage_degraded=self._coverage_degraded(sanitized.metadata, depth_flag),
+            coverage_degraded=(
+                True
+                if depth_flag["hit"] or depth_flag.get("coverage_degraded") or analysis_degraded or payload_error
+                else None
+            ),
+            tier3_chunk_summary=chunk_summary,
         )
 
     def defend_tool_result(self, value: Any, tool_name: str) -> DefenseResult: