Repository navigation
ADR-0025: research positioning ephor as the open-source Salus (Proposed) - #84
Merged
Merged
Conversation
Salus (YC W26) confirmed real: a closed-source runtime guardrails proxy that intercepts agent tool calls, checks policy, and returns structured feedback so the agent can self-correct - idempotency checks are one of its own named features, direct overlap with this project's most proven guarantee. Key finding, checked in the code not assumed: ephor.approvals never structurally required a human decision at all - Decision.actor_id is already uuid.UUID | None, actor_role is an unvalidated free string, Decision.reason already exists unused, and transition()/append_decision() are entirely separate calls with no dependency on each other. 'assert_not_self_decision' is a caller-invoked helper, not wired into the store. 'A human always decides' has been enforced by convention in every demo written so far, not by the core - meaning the real open question was never whether the schema can support auto-decide (it already can), but whether this project's own stated principle changes to describe that honestly, or auto-decide becomes a clearly-labelled opt-in layer instead. Also found: the retry-feedback loop needs new work (a synchronous decide-now-return-why surface), but builds on the existing reason field, not a redesign. The proxy/interception layer is the real, large gap - a live request-path component this project has never had, closer in size to building a new flagship than adding an Adapter. Policy DSL prior art checked: OPA/Rego (mature, external runtime) vs AWS Cedar (newer, now used by Bedrock AgentCore Policy for exactly this gateway-interception use case per public reporting) vs a minimal homegrown format - left open. Four open questions for a grilling round, filed as #83. Not built - this is the research output only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #83.
Research output only - ADR-0025, filed as Proposed. No code changes; four open questions need a grilling round before this is
ready-for-agent.Findings
Decision.actor_idis alreadyuuid.UUID | None,actor_roleis an unvalidated free string,Decision.reasonalready exists unused.transition()/append_decision()are entirely separate calls with zero dependency on each other;assert_not_self_decisionis a caller-invoked helper, never wired into the store itself. "A human always decides" has been enforced by convention in every demo written so far, not by the core. This reframes the real open question: not "can the schema support this" (it already can) but "does this project's own stated principle change, or does auto-decide become a clearly-labelled opt-in layer instead."Decision.reasonfield, not a redesign.Open questions for a grilling round