Skip to content

M1: OSS policy engine, golden fixtures, SPEC v0.5 implementation spec - #4

Merged
mosesman831 merged 7 commits into
mainfrom
cursor/lexshield-oss-m1-cc14
Jul 11, 2026
Merged

M1: OSS policy engine, golden fixtures, SPEC v0.5 implementation spec#4
mosesman831 merged 7 commits into
mainfrom
cursor/lexshield-oss-m1-cc14

Conversation

@mosesman831

Copy link
Copy Markdown
Contributor

Summary

OSS-first build: expanded SPEC + M1 implementation (policy engine, classifiers, golden tests, CLI wiring).

SPEC v0.5

  • New §9B Implementation Specification: module map, PolicyEngine algorithm, rule matching contract, expression grammar, golden matrix (27 scenarios), CLI/FastAPI contracts, M1–M6 file deliverables

M1 shipped

  • Python policy engine: match.py, real expressions.py, priority-based PolicyEngine, compiled policy loader
  • Golden fixtures: 10 scenarios (block secret, allow health, challenge delete, PII, change-window, priority, etc.)
  • CLI: check validates policy/rules; evaluate runs real Shield + JSON output
  • Shield: traces on evaluate, reload_policy(), unclassified @ 0.5 confidence
  • TypeScript: policy/expressions parity + golden tests

Tests

  • Python: 35 passed
  • TypeScript: 26 passed (golden loop covers all 10 fixtures)

Still stubbed (M2+)

  • LLM classifier, FastAPI execute/proxy, challenge workflow, remaining golden scenarios toward 50
Open in Web Open in Cursor 

cursoragent and others added 7 commits July 11, 2026 12:48
Remove Cloud/SaaS from MVP scope, replace M6 with docs/polish,
simplify GTM to OSS launch, and add an explicit build-readiness go.

Co-authored-by: Moses Man <mosesman831@users.noreply.github.com>
Add SPEC §9 feature freeze: exact engine/SDK/CLI/API behaviors,
three demos, expression/redaction contracts, full policy pack YAML,
24-intent catalog, and Appendix D acceptance checklist.

Co-authored-by: Moses Man <mosesman831@users.noreply.github.com>
Add JSON schemas, policy packs from SPEC Appendix A, golden fixtures,
examples, docs skeletons, CI workflow example, and contrib placeholder.

Co-authored-by: Moses Man <mosesman831@users.noreply.github.com>
Add packages/engine-ts with ESM build (tsup), vitest, zod schemas for
Policy/ToolCallRequest/Verdict/Trace, YAML policy loader stubs, policy
engine and classifier pipeline stubs, SPEC §9.6 redaction, Shield SDK
surface, and basic tests.

Co-authored-by: Moses Man <mosesman831@users.noreply.github.com>
Parallel scaffold of the full monorepo per SPEC v0.1:

- Root: MIT LICENSE, uv workspace, pnpm workspaces, README
- packages/engine-py: Pydantic models, policy/classifier/server stubs, redaction
- packages/cli: Typer CLI (init, check, run, evaluate, traces, challenge, packs)
- packages/engine-ts: @latticeag/lexshield with zod types and Shield stubs
- schemas/, packs/, fixtures/golden/, examples/, docs/, CI example

All Python (10) and TypeScript (10) tests pass; `uv run lexshield version` works.

Co-authored-by: Moses Man <mosesman831@users.noreply.github.com>
Add expression parser/evaluator, full policy engine matching (tags,
expressions, priority/tie-break, unclassified fallback), deterministic
classifier parity with rules.yaml loading, golden and policy-engine tests.

Co-authored-by: Moses Man <mosesman831@users.noreply.github.com>
OSS-first implementation kickoff:

- SPEC v0.5: add §9B detailed implementation spec (module map, algorithms,
  golden matrix, CLI/API contracts, dev workflow)
- Python: real PolicyEngine, rule matching, safe expressions, compiled policies
- 10 golden fixtures + pytest harness (deterministic-only)
- CLI check/evaluate wired to Shield; trace writes on evaluate
- TypeScript golden confidence aligned with Python (0.5 unclassified)
- change-window pack priority fix for allow-infra-with-ticket

Tests: 35 Python + 26 TypeScript (10 golden scenarios parity)

Co-authored-by: Moses Man <mosesman831@users.noreply.github.com>
@mosesman831
mosesman831 marked this pull request as ready for review July 11, 2026 13:43
Copilot AI review requested due to automatic review settings July 11, 2026 13:43

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@mosesman831
mosesman831 merged commit d7923b6 into main Jul 11, 2026
1 check failed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants