mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-25 04:33:03 +00:00
rcourtman
bc5da3f4c5
Increment 2 wired the dial into the prefetch and the model-boundary sanitizer but missed a third model-bound path: the broad inventory context builder (internal/ai/resource_context.go buildUnifiedResourceContextForModel) rendered resource display names through unifiedresources.ResourcePolicyLabel, which redacts genuinely-sensitive names UNCONDITIONALLY — ignoring the dial and even local-vs-cloud. Symptom (reported live): on a cloud model the Assistant surfaced "redacted by policy" and tried to run pulse_query with it as a search term, because sensitive resources appeared redacted in the inventory regardless of the dial. Fix: unifiedResourcePolicyContext now carries the dial + a known-local flag, and a new resourceLabel() renders names per the dial — known-local (Ollama) always real; cloud real only at "full" and only for resources NOT routed local-only (the same hard floor as the sanitizer); unknown/empty destination fails closed to the governed label (preserves the safe default for the no-destination context path). All 15 ResourcePolicyLabel call sites in the inventory builder route through it. This also fixes a latent inconsistency where local (Ollama) models over-redacted inventory names despite "local is always full". Proof: TestUnifiedResourcePolicyContext_ResourceLabelDialAware (local real; cloud-full sensitive real, local-only floored; cloud-redacted both governed). The existing AI-safe-summary inventory tests (no-destination path) stay green via the fail-closed unknown-destination branch. Governance: ai-runtime contract delta — the seam is now THREE dial-aware paths, inventory builder included. Full internal/ai/... suite green (23 packages).