1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
//! # Enlil — the open-source control and audit plane for AI agent actions
//!
//! Enlil sits inline between your agents and any upstream model or tool, and
//! answers the question that blocks agents from reaching production: **what is
//! this agent allowed to do, and can you prove what it did?**
//!
//! *Claude secures Claude. Enlil governs everything your agents touch* — every
//! model, every tool, one audit trail you own.
//!
//! ## What's here
//!
//! * [`engine`] — the inline enforcement engine: prompt-injection and
//! tool-poisoning defense, declarative policy rules, reversible PII redaction,
//! the agent loop-breaker, RiskChain behavioural checks, anomaly detection,
//! SafeFix remediation and the context-window guard.
//! * [`observability`] — per-request traces with the full governance decision path.
//! * [`routing`] — the proxy hot path, protocol detection (OpenAI / MCP / A2A) and
//! the per-provider circuit breaker.
//! * [`cache`] — exact-intent response deduplication (blake3 over request intent;
//! *not* embedding-based similarity).
//! * [`tokens`] — token attribution and model pricing.
//! * [`usage`] — the [`usage::ProxyEnv`] extension seam (see below).
//! * [`server`] — the zero-config single-tenant OSS server.
//!
//! ## Extending it
//!
//! The proxy is generic over [`usage::ProxyEnv`], whose hooks all default to
//! OSS-appropriate no-ops. A downstream deployment can implement them to attach
//! billing, quotas, per-tenant upstream overrides or alert delivery without
//! forking the hot path. The commercial `plumb` crate does exactly this.
pub use EnlilState;