mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-23 20:25:56 +00:00
rcourtman
97a30b0600
Execution posture is now profile-owned through the core-only, never-serialized tools.ExecutionProfile. Both Patrol profiles are non-interactive, deny infrastructure mutations, and clear any inherited autonomous mode. Detection restricts pulse-state mutations to an explicit allowlist of the finding lifecycle tools - a blanket pulse-state allowance would also permit alert dismissal and knowledge writes - while investigation denies all pulse-state mutations, keeping it structurally read-only. InvocationPolicy gains the allowlist and Allows() is now tool-name-aware. Chat turns build ONE effective request executor (control level, autonomy, profile, resolved context) BEFORE provider projection and clone that executor per provider attempt, reversing the previous project-from-base-then-clone order so the offered schema and the runtime boundary always agree. Scheduled Patrol (ExecutePatrolStream) now runs under the detection profile instead of autonomous mode - closing its direct view of Docker/Kubernetes mutation subactions - and ListAvailableTools projects through the identical path. toolsForExecutionMode's mode booleans are replaced by the profile on the executor itself. Non-interactive profiles independently hide pulse_question from the manifest AND runtime-block it before the interactive-call-set special case: a fabricated question call returns a non-interactive error without emitting a waiting event, and sibling tool calls from the same provider turn keep processing. Approval waits never block for non-interactive profiles (they queue), and the tool-only-turn wrap-up guardrail is interactive-profile-owned instead of keyed on autonomy. The system prompt describes detection and investigation modes directly rather than claiming controlled or autonomous execution; the investigation prompt directs the model toward typed action proposals. Proofs: detection allowlist enforcement (alerts resolve and knowledge remember blocked, finding tools allowed, projection agrees), investigation structural read-only (patrol mutation tools dropped from the manifest and blocked at runtime), profile clone isolation, profile prompt modes, and question-tool hiding across profiles.