[hidb4ai]

Which issue or RFC does this PR close?

Implements owned inference-boundary protection and reversible operation input encoding from RFC #2086, including the implementation merged from #2314. Replaces the corresponding scope of #2264. Context reuse/check is isolated in dependent #2313, and input-encoding evaluation is in dependent #2315. Independent Unix-socket support is in #2312.

Rationale for this change

A checked prompt can still change during provider serialization, and a provider can return forbidden content or an incomplete response. Enforcing protection therefore checks the final request before transmission and the complete raw response before delivery. A mandatory refusal must also leave pending Memory work retryable.

What changes are included in this PR?

• Add opt-in target, carrier, content, retention, completion, and window checks at owned OpenAI/Anthropic and configured embedding/rerank HTTP transports.
• Buffer bounded OpenAI Chat SSE before release, including reasoning and tool arguments split across events. Withhold ambiguous tool indices, opaque references, and Responses image-generation tools/results.
• Propagate mandatory privacy refusals through advisory decision paths, apply the deployment policy to spawned Topic Memory generation, and preserve pending Memory work across failure and restart.
• Preserve known provider usage on failed delivery and keep missing usage unknown. Add bilingual configuration and behavior documentation.

Are there any user-facing changes?

Protection defaults to disabled. Enforcing mode requires an explicitly configured supported target and withholds requests or responses whose required checks cannot complete. Strict streaming buffering delays first content. No HTTP endpoint, database table, or migration is added. Admission inspects and refuses; it does not mask secrets, create placeholder mappings, or restore hidden values. SecretStr protects configuration display only. Allowed bytes are not a guarantee of model understanding or correct tool decisions.

How was this change tested?

• Privacy, real loopback HTTP/SSE, and Atomic/Topic worker recovery regressions: 77 passed. Controlled Atomic Memory outputs include the required description field. These verify exact allowed request/response bytes, literal template markers, and zero upstream requests when forbidden content is present.
• make check: passed, including lint, types, lock consistency, and integration manifest checks.
• The tests use controlled provider responses and real local transports/processes. They do not establish live provider compatibility or hidden upstream retention behavior.

AI usage statement

OpenAI Codex assisted with implementation, review fixes, regression tests, splitting, documentation, and validation.

[hidb4ai]

Enforcing-mode protection still has three gaps at this commit. The inline comments include reproductions; these should be fixed before merging.

[hidb4ai]

Three current correctness issues remain: a Responses content-assembly bypass, a Chat SSE response-model bypass, and a retry regression in observation modes. Details and reproductions are inline.

[knqiufan]

Reviewed 564a7a6. One additional mixed-failure case remains in reranking: an ordinary failure can hide a completed mandatory privacy refusal. The existing all-privacy-failure usage discussion is not repeated.

[hireview001]

LGTM

[hidb4ai]

Two correctness issues remain at this commit: a native-SDK SSE assembly bypass and acceptance of evaluation records whose original run identity is missing. Reproductions and required behavior are inline.