Unify the request guards with thinkwatch-core's rule model

[fylorn]

The enterprise backend half of the guard unification: outbound redaction, tool-call inspection and the content filter now run on thinkwatch-core's shared rule model (tw_guard::policy, view, trial, content::screen, redact::flow), the same one the desktop gateway uses. The console side is on guard-unify-web and is merged separately.

Pinned to ThinkWatch-Core v0.58.0 (c2a7bc6), the release that carries ThinkWatchProject/ThinkWatch-Core#268; the layer-one crates move from v0.55.0.

Settings

• Three keys, one policy object each, the shape tw_guard::policy defines: security.redact, security.inspect_tools, security.content. Saved through PATCH /api/admin/settings, checked by core's own validation (400 with its message). Seeds ship {} (the factory policy: observe).
• The old keys (security.content_filter_patterns, security.pii_redactor_patterns, security.hidden_text, security.tool_inspection) and models.output_guardrails are converted at boot, in one transaction that also deletes them, under an advisory lock (common::guard_policy::legacy). The conversion keeps behaviour: content rules identical to a built-in rule become that rule; a list with rules runs in enforce with unlisted built-ins switched off; hidden_text maps onto unicode-tags / bidi-controls (block with an empty list still enforces); the four seeded PII patterns become built-in rules, the rest custom rules labelled by their old prefix; a byte cap of N becomes ceil(N / 4) output tokens. Unit tests cover every mapping; an integration test runs it against a real database twice.

Gateway

• Content filter: content::screen on the caller's own bytes; refuse (403, masked quote), strip (the request continues as the stripped body, decoded again — redaction, every hop and the audit row see it), or record. The Responses WebSocket goes through the same pipeline.
• Outbound redaction: flow::look on the whole request body, flow::replace on every hop with the same ledger, restoration by the shared engine; <<TW_LABEL_n>> placeholders. pii_redactor.rs and its own traversal are gone.
• Tool-call inspection: ToolPolicy; calls are judged as the client receives them — converted and with placeholders restored — which is what core's new secret-to-unknown-host rule needs.
• One audit event per hit: gateway.content_{flagged,stripped,blocked}, gateway.redaction_{flagged,replaced}, gateway.tool_call_{flagged,blocked}. Excerpts (and the content refusal quote) are masked with the redaction rules first.
• output_guardrails.rs is gone. A model's max_output_tokens lowers a larger ask and fills a missing one with tw_dialect::params::cap_max_output_tokens, forwarded or converted.

Console API

• GET /api/admin/security → tw_guard::view::detail (settings:read).
• POST /api/admin/security/{guard}/test → tw_guard::trial::run (pii_redactor:read / content_filter:read).
• Writing security.redact takes pii_redactor:write; security.content and security.inspect_tools take content_filter:write.
• Removed: /api/admin/settings/content-filter/test, /content-filter/presets, /pii-redactor/test, /tool-inspection/rules, /tool-inspection/test.
• Models API: max_output_tokens (1–2147483647, null clears) replaces output_guardrails.

CHANGELOG has the upgrade notes under Unreleased.

Tests

cargo fmt --check, cargo clippy --workspace --all-targets -D warnings and the unit tests pass locally; the integration suite passed in full locally (379 tests) and runs in CI on every push. The web side came in from guard-unify-web, and dev was merged in for the clippy fix (#73).

🤖 Generated with Claude Code