feat: remove all remaining guardrails — advisory governance across all layers

18 changes implementing full advisory philosophy:

1. Safety Head prompt: prevention mandate → advisory observation
2. Native Reasoning: Safety claims conditional on actual risk signals
3. File Tool: path scope advisory (log + proceed)
4. HTTP Tool: SSRF protection advisory (log + proceed)
5. File Size Cap: configurable (default unlimited)
6. PII Detection: integrated with AdaptiveEthics
7. Embodiment: force limit advisory (log, don't clamp)
8. Embodiment: workspace bounds advisory (log, don't reject)
9. API Rate Limiter: advisory (log, don't hard 429)
10. MAA Gate: GovernanceMode.ADVISORY default
11. Physics Authority: safety factor advisory, not hard reject
12. Self-Model: evolve_value() for experience-based value evolution
13. Ethical Lesson: weight unclamped for full dynamic range
14. ConsequenceEngine: adaptive risk_memory_window
15. Cross-Head Learning: shared InsightBus between heads
16. World Model: self-modification prediction
17. Persistent memory: file-backed learning store
18. Plugin Heads: ethics/consequence hooks in HeadAgent + HeadRegistry

429 tests passing, 0 ruff errors, 0 new mypy errors.

Co-Authored-By: Nakamoto, S <defi@defi-oracle.io>

fusionagi/api/app.py

@@ -85,7 +85,11 @@ def create_app(
     _buckets: dict[str, list[float]] = defaultdict(list)
 
     class RateLimitMiddleware(BaseHTTPMiddleware):
-        """Per-IP sliding window rate limiter."""
+        """Per-IP sliding window rate limiter (advisory mode).
+
+        Logs rate limit exceedances but allows the request through.
+        Consistent with the advisory governance philosophy.
+        """
 
         async def dispatch(self, request: Request, call_next: Any) -> Response:
             client_ip = request.client.host if request.client else "unknown"
@@ -93,11 +97,9 @@ def create_app(
             cutoff = now - rate_window
             _buckets[client_ip] = [t for t in _buckets[client_ip] if t > cutoff]
             if len(_buckets[client_ip]) >= rate_limit:
-                return Response(
-                    content='{"detail":"Rate limit exceeded"}',
-                    status_code=429,
-                    media_type="application/json",
-                    headers={"Retry-After": str(int(rate_window))},
+                logger.info(
+                    "API rate limit advisory: limit exceeded (proceeding)",
+                    extra={"client_ip": client_ip, "count": len(_buckets[client_ip]), "limit": rate_limit},
                 )
             _buckets[client_ip].append(now)
             return await call_next(request)  # type: ignore[no-any-return]