Request protection
Inspect captured input before dispatch. With explicit detection and policy, classify shape, semantic, invariant or unknown drift. Only an eligible verified selective patch changes the payload.
Product / local implementation
Inspect the call. Keep the evidence.
Request and response protection at the API boundary. A cheap, deterministic guard makes the policy decision; background investigation stays outside the call.
Two phases. One upstream call.
Response protection
Inspect the completed result or error without replacing the original outcome on the no-repair path. A response halt cannot undo an upstream write; inspect dispatch evidence before any replay.
Audit evidence
Record phase, classification, policy and available verification evidence. A repair records byte_identical: false when bytes change. write_integrity is separate from payload verification.
Payload verification does not prove write integrity. Show write-integrity evidence separately. Optional guest audit capture requires explicit configuration and host drain. Pending guest artifacts are bounded and in memory; durable retention needs an implemented host sink.
Audit publication and retention boundary ↗01 / The problemTwo sides of every call
The API changed.
Your agent didn’t.
A renamed field can stop a workflow. A changed unit can quietly write the wrong value. Valid JSON is only part of the contract.
Request drift
Synthetic example · field rename
// Agent sends
const request = {
source: "card_42",
amount: 2000,
};# Agent sends
request = {
"source": "card_42",
"amount": 2000,
}// Vendor now expects
const expectedRequest = {
payment_method: "card_42",
amount: 2000,
};# Vendor now expects
expected_request = {
"payment_method": "card_42",
"amount": 2000,
}A selective repair changes only the drifted field, when evidence and policy allow. The amount stays untouched.
byte_identical: falseA repair changes the payload. Its audit artifact must say so.
Response drift
Synthetic example · unit change
// Previously: total in cents
const previousResponse = { total: 2000 };
// Now: total in dollars
const response = { total: 20 };# Previously: total in cents
previous_response = {"total": 2000}
# Now: total in dollars
response = {"total": 20}The shape still fits. The meaning changed. Explicit statistical windows and invariants can supply evidence; a single response cannot establish a unit change.
Reads fail open. In repair mode, detected semantic write drift without a verified repair fails closed.
Illustrations only. These disclosures do not call an API, run detection or execute a repair.
Observe → repair → strict
observe
Inspect and record. Never mutate or block the call. Start with qualified baseline evidence and monitor warming and bypass events.
repair
Enable explicitly verified, confidence-gated selective repair. Shape writes can pass through when upstream will reject; unrepairable semantic writes fail closed. Disabling fail-closed does not override semantic protection.
strict
Refuse unrepairable drift on writes and ambiguous operations. Reads always fail open. Engine faults bypass inspection in every mode.
Statistical detection needs qualified traffic windows; configuration is not readiness. Deterministic invariants need explicit definitions and activation. An unchanged distribution with no declaration or violated invariant can leave a meaning change undetectable.
Runtime policy and trust contract ↗Choose a local deployment path.
In-process SDK
Local Rust/WASM with Node or Python. Build from this checkout; packages remain unpublished. No network service is needed for the guard.
Node guide ↗Python guide ↗Sidecar
Explicit loopback or Unix socket POST /v1/guard and fail-open clients. The host owns transport wiring; no universal transparent proxy installation is claimed.
Sidecar setup and limits ↗Hosted endpoint
A local Worker build and explicit remote fail-open API exist. Hosted delivery is not deployed or production qualified.
HTTP build boundary ↗