Skip to content

v0.1.3 — Observe mode

Choose a tag to compare

@leodavidsec leodavidsec released this 03 Jul 12:57
148ef19

Reeflex Gate 0.1.3 — Observe mode (HIL-DESIGN §8, Phase 0)

Adds an enforcement mode to both adapters. Default stays enforce (unchanged). The new observe mode records every verdict to the audit log but enforces nothing — the action always proceeds — so you can calibrate on real data before turning enforcement on. In observe a core outage fails OPEN (never blocks the site), the opposite of enforce's fail-closed. Zero core changes — mode is an adapter-side audit annotation.

WordPress adapter (reeflex-gate 0.1.3)

  • REEFLEX_MODE constant (enforce | observe, default enforce) + a Enforcement mode dropdown on Settings > Reeflex Gate, with the same locked-field precedence as the other settings (a wp-config constant locks the field read-only).
  • Observe short-circuit in both hooks; audit records gain a mode field carrying the would-be verdict.
  • Plugin Check clean. Enforce behaviour byte-for-byte unchanged.

Claude adapter (reeflex-claude)

  • REEFLEX_MODE=observe env → the PreToolUse hook emits allow while the JSONL audit records the would-be verdict + mode=observe; same fail-open. 146 unit tests pass.

reeflex-verify

  • New --expect-observe flag: asserts every action PROCEEDs (allow) while the audit still shows the would-be verdicts.

Assets

File Use
reeflex-gate-wordpress-standard.zip Standard plugin (Plugins > Add New > Upload)
reeflex-gate-wordpress-mu.zip Must-use form (wp-content/mu-plugins/, wp-config constants)
reeflex-verify.zip CLI conformance/verification tool
reeflex-test-abilities.zip Test-only plugin registering sample abilities

Full changelog: see CHANGELOG.md and reeflex-wordpress/readme.txt.