Documentation
¶
Overview ¶
Package autorag defines the auto-RAG drift catalog schema — the JSON shape consumers use to declare their project-specific drift signatures for `auto-rag-guard.sh`.
The bash engine (internal/hookscripts/auto-rag-guard.sh, slice B) reads the catalog at runtime via the DRIFT_CATALOG env var. This package's Go types pin the same schema so consumers can:
- parse a catalog file programmatically
- lint a catalog at build time without spawning bash
- generate a catalog from typed Go data and serialize back to the JSON shape the engine expects
Origin: the companion project v0.3 stable handoff 2026-05-07. The shim outline in the companion project's v0.3 auto-RAG handoff outline showed DRIFT_CATALOG as a colon-tier env var; this Go package is the schema spec for that JSON.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Catalog ¶
type Catalog struct {
Signatures []Signature
}
Catalog is a parsed drift-signature catalog. The on-disk JSON shape is a top-level array of Signature objects (matching the the companion project v0.3 DRIFT_CATALOG export shape).
func ParseCatalog ¶
ParseCatalog parses the on-disk JSON shape. Does NOT call Validate — call that separately so callers can choose strict (parse + validate) or permissive (parse only) modes.
func (*Catalog) Validate ¶
Validate runs lint checks on every signature and returns the first error encountered. Returning the first error (rather than a multi-error) keeps the failure surface simple and matches the "fail fast on the first invariant break" pattern used across vaultmind's other validators (schema, frontmatter).
type Signature ¶
type Signature struct {
Name string `json:"name"`
Tool string `json:"tool"`
Match string `json:"match"`
Decision string `json:"decision"`
Query string `json:"query"`
}
Signature is one drift-detection rule. Required fields:
- Name stable identifier; used in evaluator reports + sidecar log filenames; must be unique within a catalog.
- Tool the Claude Code PreToolUse tool matcher this rule applies to. Currently supported: Bash, Write, Edit.
- Match regex applied to the tool's target string (Bash command line for Bash; file path for Write/Edit). The bash engine compiles via `grep -E`; we validate via Go's regexp (RE2) which is a strict subset.
- Decision what the engine does on match. inject = warn-and- allow via additionalContext; deny = block via permissionDecision; allow = explicit no-op (rare; for overriding broader signatures). "ask" is rejected at lint time because Claude Code 2.1.129 silently drops it on Write/Edit.
- Query the vaultmind ask query string surfaced in the guidance text and run against the consumer's vault.
JSON field names match the companion project v0.3 shim outline.
Source Files