Unify the three guards on one shared model (protocol 33, SCHEMA 24)

[fylorn]

Unifies the three guards (outbound redaction, tool-call inspection, content filter) on one model defined in tw-guard, so the desktop app and the enterprise edition share the policy shape, built-in catalogs, validation, rule views and the "test" logic. The desktop app writes the policy to config.yaml; the enterprise edition stores the same structure in system settings.

Commits:

• Part 1 (16c451e): shared layer in tw-guard / tw-dialect (policy, view, trial, content engine with strip and code point rules, redaction flow, caller-text walker).
• Add two built-in tool-call rules for credential and file exfiltration #266 (93ff769): two code-backed tool-call rules (secret-to-unknown-host, upload-file-to-host).
• Part 2 (d86320b): desktop config, gateway flow and control API on the shared model.
• 73d9328: why legacy completions (/v1/completions, /v1/complete) are not content-screened.
• Say which rule a cut tool call matched, not who produced it #269 (414759e): the tool-call cut messages name the rule, not who produced the call (a plugin can produce one too).
• a20ca47: README (three protections).

Breaking changes

Config

• security.hidden_text and security.output_limit are removed. A config.yaml that still has either key does not load (the app starts in safe mode) until the key is deleted. No migration, by design.
• Hidden characters are built-in content rules: unicode-tags, bidi-controls (on), zero-width, private-use (off).
• Content rule actions are block | strip | record (warn / log removed). Custom content rules can match by codepoints; custom redaction rules accept label (placeholder <<TW_{LABEL}_n>>).

Gateway behaviour

• Content screening runs before the request starts. Stripped text is removed from user messages and tool results, and the stripped body (plus the IR decoded again from it) is what gets redacted, recorded and sent on every hop. Refused requests still leave a failed row (denied).
• Compaction requests (/v1/responses/compact, /backend-api/codex/responses/compact) are now screened like generation requests. Token-count requests are deliberately not screened.
• WebSocket frames: response.create frames are screened and stripped; other frames go through code point rules only.
• The output limit is removed everywhere.
• Fix: tool-call excerpts are masked with the stored-body redaction before tool_call_flagged is emitted. A secret restored from a placeholder used to reach the event, the security log and system notifications in the clear.

Control API: CONTROL_API_VERSION = 33

• Guard is redact | inspect_tools | content; SecurityDetail / SecurityView have those three fields.
• PUT /security/{guard}/limit (SetSecurityLimit) is removed.
• Types come from tw-guard: SecurityRuleView gains label; Matcher gains email, cn-mobile-phone, builtin; RuleAction gains strip; ContentMatch gains codepoints; CustomRuleSave gains label; SecurityTestRequest gains label and action; SecurityTestResult gains output and refused.
• Events: hidden_text_found and output_limited are removed; content_matched now has match, action, outcome (recorded | stripped | blocked), count and revealed (no blocked flag).
• SecurityOutcome and SecurityOutcomeCounts gain stripped; SecurityEventView gains match and revealed; /summary security counts are secrets, secrets_replaced, tool_calls, tool_calls_cut, content, content_blocked, content_stripped.

Request store: SCHEMA = 24

The security log gains match and revealed. Request history is reset on upgrade.

Message codes

• Added: config.rule_codepoints_bad (name, detail), config.rule_label_bad (name, label), gw.content.refused_invisible_message / gw.content.refused_invisible_tool_result (rule, name, count), security.bad_codepoints (detail), security.bad_label (label), security.content_action_unknown (action), security.pattern_empty, security.unknown_guard (guard).
• Renamed (Say which rule a cut tool call matched, not who produced it #269, same parameters unless noted): gw.toolcall.cut → gw.toolcall.response_cut, gw.toolcall.blocked → gw.toolcall.response_withheld, gw.ws.toolcall_cut → gw.toolcall.connection_cut (detail → why).
• Removed: config.output_limit_range, gw.hidden_text.refused_message, gw.hidden_text.refused_tool_result, gw.output_limit.cut, gw.output_limit.withheld, security.guard_unknown, security.limit_range, security.no_custom_rules, security.no_limit, security.nothing_to_test, security.unknown_content_action.

Rust API (layer one, used by the enterprise edition)

• tw_guard::output is deleted. In tw_guard::hidden only the config-file scan remains. content::Action::Warn / Log and content::scan_request / worst are gone; use tw_guard::content::screen and tw_guard::policy.
• The enterprise CI job builds enterprise feat/guard-unify (Unify the request guards with thinkwatch-core's rule model ThinkWatch#72), which moves to the shared model, and passes.

Checks

cargo fmt --check, cargo clippy --workspace --all-targets -D warnings (plus tw-api / tw-guard with ts), and cargo test --workspace: 2181 passed.

Other sides

• Lite: branch guard-unify-ui is on these types and messages; it lands with the pin bump once a core release is tagged.
• Enterprise: Unify the request guards with thinkwatch-core's rule model ThinkWatch#72 (pins this branch by rev until the release tag).
• Site docs: Docs for the three request guards (Core #268, Enterprise #72) thinkwatch.github.io#52, merged at release.

🤖 Generated with Claude Code