Configure detection separately from mode
The default engine passes calls through without detecting drift. Statistical detection requires an explicitly selected detector and baseline/live data windows. Observe controls how findings are handled: it records findings without applying repairs or policy blocks. Selecting observe mode does not configure a detector. Wait for detector readiness before relying on findings.
Mode matrix
Choose observe, repair or strict explicitly. SDK default is observe with the no-op engine, which detects nothing. Configuration resolves explicit values over environment over the nearest JSON configuration over defaults. Guard options and later configure updates apply to future calls; an executing call retains its frozen configuration.
| Mode | Repair | Incomplete repair / ambiguity |
|---|---|---|
observe | Never mutates | Log and audit only; preserves upstream outcomes. |
repair | Selective, verified and confidence-gated | Reads fail open with degraded; semantic writes fail closed. Shape/unknown writes default fail closed, with explicit failClosed opt-out; malformed whole bodies pass through without repair. |
strict | Selective, verified | Incomplete repair fails closed; confidence below 0.99 halts for review. Ignores failClosed opt-out. Infrastructure failures still bypass. |
Per-call decisions
Mode names are not outcome names. The status header and audit decision use exactly these five values.
| Decision | Meaning |
|---|---|
ok | No actionable drift reported; this alone does not prove protection was configured. |
repaired | A verified selective patch was applied; bytes may change and byte_identical is false. |
degraded | Policy permits the original read with a loud drift warning. |
bypassed | Inspection unavailable or skipped; original outcome preserved. |
blocked | Policy refusal; distinguish request refusal from a completed response halt. |
Classification and repair metadata
Drift classes are shape, semantic and unknown. Repair header values are applied, skipped and failed. Wrapper events are drift, repair, blocked, bypass and error. An event name does not replace the status enum. Observe never applies a candidate replacement. Semantic writes cannot opt out of protection in repair mode.
Specification
Read the published modes guide and the guard loop.