cendor-sdk 1.4.0

Guardrails maturity (plan-guardrails-v02). Additive and backward-compatible. Requires
cendor-guardrails>=1.2 and cendor-acttrace>=1.4. (Folds the never-released 1.3.0 — Waves 1 & 2
below — into a single minor with Wave 3; if the waves ship separately, 1.3.0 = Waves 1–2 and
1.4.0 = Wave 3.)

Added (Wave 4 — bounded re-ask, streaming checks)

• Agent(reask_on_output_trip=N) — when an output-stage guardrail blocks the final answer,
  re-ask the model to revise it up to N times instead of raising (default 0 = raise immediately).
  Each re-ask is a full model call — its cost lands in tokenguard/acttrace like any other; bounded by
  the cap and max_turns; if every re-ask still trips, the block raises (fail-closed). Applies to
  run / run.aio and per-segment orchestration (non-streaming). The re-asked block is still
  recorded on the audit chain and Result.guardrail_decisions.
• Agent(stream_check_window=N) — on run.stream, also evaluate the output guardrails on the
  buffered text every N characters, so a block fires earlier in the stream (default 0 = final
  text only). Already-yielded deltas can't be unshown, so this narrows the window, it doesn't close it
  (redact mid-stream isn't applied) — single-agent run.stream only.

Added (Wave 3 — hosted rails, config-as-data, grounding)

• Hosted rails via rules — rules.bedrock_guardrail / rules.azure_content_safety /
  rules.model_armor re-exported from cendor-guardrails, usable in Agent(guardrails=[…]) at any
  of the four stages. The client is bring-your-own (duck-typed, metered by the vendor); every verdict
  still lands as a local guardrail_decision in the run's audit chain ("cloud check, local
  evidence"). Also re-exported: rules.groundedness / rules.denied_topics (bring-your-own
  embedding fn) for RAG-hallucination and off-topic gating.
• load_policy() / LoadedPolicy re-exported at the SDK top level — declare deterministic
  guardrails in a versioned JSON/YAML file and pass the result straight to Agent(guardrails=…).
  The policy's content hash + version are stamped into every decision, so the run's audit chain
  proves which policy was active.

Added (Wave 1 — PII bridge, execution model, decision inspection)

• rules.pii() / rules.secrets() / rules.entropy() — PII/secret guardrails bridged from
  acttrace's detector catalogue (the SDK may import libraries; the tool→tool ban only constrains
  the libraries). They gate all four stages by default — including tool_output, which the
  process-global guard() never sees. rules is now the SDK's own superset module (the
  deterministic cendor.guardrails rules re-exported + the three bridged ones). No catch-rate claim
  — coverage is exactly acttrace's catalogue.
• Agent(guardrail_mode=…) + per-run run(agent, input, guardrail_mode="parallel") — overlap
  input-stage guardrails with the first model call (OpenAI-parity, async only) for lower latency on
  the pass path; default "blocking" stays pre-spend. Honest limit: parallel mode can bill a call a
  later trip blocks, and does not apply input redaction before the call.
• Result.guardrail_decisions — every trip/flag recorded during a run, for post-hoc inspection
  without re-reading the audit file (populated for run / run.aio / run.stream / teams).
• judge re-exported from cendor.sdk — the cendor.guardrails.judge helpers (verdict prompt +
  strict-JSON parsing) for building rules.llm_judge checks; the judge call rides an instrumented
  client, so its own spend is budgeted + audited. Per-guardrail timeout / on_error (from
  cendor-guardrails 1.1) flow through rules.custom / rules.llm_judge.

Added (Wave 2 — detection-tier adapters via rules)

• The SDK's rules superset now also re-exports the opt-in detection-tier adapters from
  cendor-guardrails 1.1: rules.classifier (BYO local model), rules.prompt_guard (prompt-injection
  classifier adapter, [promptguard] extra — no jailbreak-detection claim), rules.language
  (language-switch guard), and rules.openai_moderation (OpenAI's free moderation endpoint). See the
  guardrails "Threat model" for what each tier does and doesn't stop.