CAS-Fenced D1 Rule Registry
Deterministic Wire Interception Rules
Every rule in contextshim_rules is ordered by priority and protected by optimistic compare-and-swap (expected_version) so concurrent agent or operator edits never clobber production policy.
| Rule ID & Name | Mode | Priority | Predicates | CAS Version | Status | Action |
|---|---|---|---|---|---|---|
rule-sec-secret-redactionOutbound Credential & Secret Egress Blocker | respond_directly | 100 | regex: /(AKIA[0-9A-Z]{16}|-----BEGIN (RS.../ · keywords: [BEGIN PRIVATE KEY, AWS_SECRET_ACCESS_KEY, BEGIN OPENSSH PRIVATE KEY] · scope: any | CAS v1 | Enabled | |
rule-ping-healthDeterministic Wire Readiness Responder | respond_directly | 95 | regex: /^\s*(contextshim:ping|ping:wire|.../ · scope: user | CAS v1 | Enabled | |
rule-faq-pricing-shortcircuitVerified SaaS Plan & Quota Cache Responder | respond_directly | 85 | keywords: [contextshim pricing, contextshim plans, contextshim tiers] · scope: user | CAS v1 | Enabled | |
rule-sql-readonly-guardRead-Only Parameterized SQL Guardrail Injector | inject_context | 75 | keywords: [select , sql, postgres] · scope: user | CAS v1 | Enabled | |
rule-coding-standardsRepository Engineering Standards Injector | inject_context | 70 | keywords: [write code, implement, typescript] · scope: user | CAS v1 | Enabled | |
rule-json-contract-enforcerStrict RFC 8259 JSON Schema Enforcer | inject_context | 65 | keywords: [return json, json schema, valid json only] · scope: user | CAS v1 | Enabled |
Create or Update Wire Rule
Set expected_version = 0 when creating a new rule, or click Load in Editor above to populate a live rule's CAS version.