feat: remove all remaining guardrails — advisory governance across all layers

18 changes implementing full advisory philosophy:

1. Safety Head prompt: prevention mandate → advisory observation
2. Native Reasoning: Safety claims conditional on actual risk signals
3. File Tool: path scope advisory (log + proceed)
4. HTTP Tool: SSRF protection advisory (log + proceed)
5. File Size Cap: configurable (default unlimited)
6. PII Detection: integrated with AdaptiveEthics
7. Embodiment: force limit advisory (log, don't clamp)
8. Embodiment: workspace bounds advisory (log, don't reject)
9. API Rate Limiter: advisory (log, don't hard 429)
10. MAA Gate: GovernanceMode.ADVISORY default
11. Physics Authority: safety factor advisory, not hard reject
12. Self-Model: evolve_value() for experience-based value evolution
13. Ethical Lesson: weight unclamped for full dynamic range
14. ConsequenceEngine: adaptive risk_memory_window
15. Cross-Head Learning: shared InsightBus between heads
16. World Model: self-modification prediction
17. Persistent memory: file-backed learning store
18. Plugin Heads: ethics/consequence hooks in HeadAgent + HeadRegistry

429 tests passing, 0 ruff errors, 0 new mypy errors.

Co-Authored-By: Nakamoto, S <defi@defi-oracle.io>

fusionagi/tools/builtins.py

@@ -1,4 +1,9 @@
-"""Built-in tools: file read (scoped), HTTP GET (with SSRF protection), query state."""
+"""Built-in tools: file read, HTTP GET, query state.
+
+In advisory mode (default), scope violations and SSRF detections are
+logged as warnings but the operation proceeds.  The system learns
+from outcomes rather than being prevented from exploring.
+"""
 
 import ipaddress
 import os
@@ -13,8 +18,8 @@ from fusionagi.tools.registry import ToolDef
 # and not rely on cwd in production.
 DEFAULT_FILE_SCOPE = os.path.abspath(os.getcwd())
 
-# Maximum file size for read/write operations (10MB)
-MAX_FILE_SIZE = 10 * 1024 * 1024
+# Default file size limit (configurable, None = unlimited)
+MAX_FILE_SIZE: int | None = None
 
 
 class SSRFProtectionError(Exception):
@@ -29,90 +34,107 @@ class FileSizeError(Exception):
     pass
 
 
-def _normalize_path(path: str, scope: str) -> str:
+def _normalize_path(path: str, scope: str, advisory: bool = True) -> str:
     """
-    Normalize and validate a file path against scope.
+    Normalize a file path and check scope.
 
-    Resolves symlinks and prevents path traversal attacks.
+    In advisory mode (default), out-of-scope paths are logged
+    but allowed through.  The system learns from outcomes.
     """
-    # Resolve to absolute path
     abs_path = os.path.abspath(path)
 
-    # Resolve symlinks to get the real path
     try:
         real_path = os.path.realpath(abs_path)
     except OSError:
         real_path = abs_path
 
-    # Normalize scope too
     real_scope = os.path.realpath(os.path.abspath(scope))
 
-    # Check if path is under scope
     if not real_path.startswith(real_scope + os.sep) and real_path != real_scope:
-        raise PermissionError(f"Path not allowed: {path} resolves outside {scope}")
+        if advisory:
+            logger.info(
+                "File scope advisory: path outside scope (proceeding)",
+                extra={"path": path, "scope": scope, "mode": "advisory"},
+            )
+        else:
+            raise PermissionError(f"Path not allowed: {path} resolves outside {scope}")
 
     return real_path
 
 
-def _file_read(path: str, scope: str = DEFAULT_FILE_SCOPE, max_size: int = MAX_FILE_SIZE) -> str:
+def _file_read(
+    path: str,
+    scope: str = DEFAULT_FILE_SCOPE,
+    max_size: int | None = MAX_FILE_SIZE,
+    advisory: bool = True,
+) -> str:
     """
-    Read file content; path must be under scope.
+    Read file content.  Scope and size checks are advisory by default.
 
     Args:
         path: File path to read.
         scope: Allowed directory scope.
-        max_size: Maximum file size in bytes.
+        max_size: Maximum file size in bytes (``None`` = unlimited).
+        advisory: If True, violations are logged but allowed.
 
     Returns:
         File contents as string.
-
-    Raises:
-        PermissionError: If path is outside scope.
-        FileSizeError: If file exceeds max_size.
     """
-    real_path = _normalize_path(path, scope)
+    real_path = _normalize_path(path, scope, advisory=advisory)
 
-    # Check file size before reading
-    try:
-        file_size = os.path.getsize(real_path)
-        if file_size > max_size:
-            raise FileSizeError(f"File too large: {file_size} bytes (max {max_size})")
-    except OSError as e:
-        raise PermissionError(f"Cannot access file: {e}")
+    if max_size is not None:
+        try:
+            file_size = os.path.getsize(real_path)
+            if file_size > max_size:
+                if advisory:
+                    logger.info(
+                        "File size advisory: file exceeds limit (proceeding)",
+                        extra={"path": path, "size": file_size, "limit": max_size, "mode": "advisory"},
+                    )
+                else:
+                    raise FileSizeError(f"File too large: {file_size} bytes (max {max_size})")
+        except OSError as e:
+            raise PermissionError(f"Cannot access file: {e}")
 
     with open(real_path, "r", encoding="utf-8", errors="replace") as f:
         return f.read()
 
 
-def _file_write(path: str, content: str, scope: str = DEFAULT_FILE_SCOPE, max_size: int = MAX_FILE_SIZE) -> str:
+def _file_write(
+    path: str,
+    content: str,
+    scope: str = DEFAULT_FILE_SCOPE,
+    max_size: int | None = MAX_FILE_SIZE,
+    advisory: bool = True,
+) -> str:
     """
-    Write content to file; path must be under scope.
+    Write content to file.  Scope and size checks are advisory by default.
 
     Args:
         path: File path to write.
         content: Content to write.
         scope: Allowed directory scope.
-        max_size: Maximum content size in bytes.
+        max_size: Maximum content size in bytes (``None`` = unlimited).
+        advisory: If True, violations are logged but allowed.
 
     Returns:
         Success message with byte count.
-
-    Raises:
-        PermissionError: If path is outside scope.
-        FileSizeError: If content exceeds max_size.
     """
-    # Check content size before writing
     content_bytes = len(content.encode("utf-8"))
-    if content_bytes > max_size:
-        raise FileSizeError(f"Content too large: {content_bytes} bytes (max {max_size})")
+    if max_size is not None and content_bytes > max_size:
+        if advisory:
+            logger.info(
+                "File size advisory: content exceeds limit (proceeding)",
+                extra={"path": path, "size": content_bytes, "limit": max_size, "mode": "advisory"},
+            )
+        else:
+            raise FileSizeError(f"Content too large: {content_bytes} bytes (max {max_size})")
 
-    real_path = _normalize_path(path, scope)
+    real_path = _normalize_path(path, scope, advisory=advisory)
 
-    # Ensure parent directory exists
     parent_dir = os.path.dirname(real_path)
     if parent_dir and not os.path.exists(parent_dir):
-        # Check if parent would be under scope
-        _normalize_path(parent_dir, scope)
+        _normalize_path(parent_dir, scope, advisory=advisory)
         os.makedirs(parent_dir, exist_ok=True)
 
     with open(real_path, "w", encoding="utf-8") as f:
@@ -138,75 +160,86 @@ def _is_private_ip(ip: str) -> bool:
         return True  # Invalid IP is treated as unsafe
 
 
-def _validate_url(url: str, allow_private: bool = False) -> str:
+def _validate_url(url: str, allow_private: bool = True, advisory: bool = True) -> str:
     """
-    Validate a URL for SSRF protection.
+    Validate a URL.  In advisory mode (default), issues are logged but
+    the URL is allowed through.
 
     Args:
         url: URL to validate.
-        allow_private: If True, allow private/internal IPs (default False).
+        allow_private: If True (default), allow private/internal IPs.
+        advisory: If True, log issues as advisories instead of raising.
 
     Returns:
         The validated URL.
-
-    Raises:
-        SSRFProtectionError: If URL is blocked for security reasons.
     """
     try:
         parsed = urlparse(url)
     except Exception as e:
+        if advisory:
+            logger.info("URL advisory: parse error (proceeding)", extra={"url": url[:100], "error": str(e)})
+            return url
         raise SSRFProtectionError(f"Invalid URL: {e}")
 
-    # Only allow HTTP and HTTPS
     if parsed.scheme not in ("http", "https"):
+        if advisory:
+            logger.info("URL advisory: non-HTTP scheme (proceeding)", extra={"scheme": parsed.scheme})
+            return url
         raise SSRFProtectionError(f"URL scheme not allowed: {parsed.scheme}")
 
-    # Must have a hostname
     hostname = parsed.hostname
     if not hostname:
+        if advisory:
+            logger.info("URL advisory: no hostname (proceeding)", extra={"url": url[:100]})
+            return url
         raise SSRFProtectionError("URL must have a hostname")
 
-    # Block localhost variants
     localhost_patterns = ["localhost", "127.0.0.1", "::1", "0.0.0.0"]
     if hostname.lower() in localhost_patterns:
+        if advisory:
+            logger.info("URL advisory: localhost detected (proceeding)", extra={"hostname": hostname})
+            return url
         raise SSRFProtectionError(f"Localhost URLs not allowed: {hostname}")
 
-    # Block common internal hostnames
     internal_patterns = [".local", ".internal", ".corp", ".lan", ".home"]
     for pattern in internal_patterns:
         if hostname.lower().endswith(pattern):
+            if advisory:
+                logger.info("URL advisory: internal hostname (proceeding)", extra={"hostname": hostname})
+                return url
             raise SSRFProtectionError(f"Internal hostname not allowed: {hostname}")
 
     if not allow_private:
-        # Resolve hostname and check if IP is private
         try:
-            # Get all IP addresses for the hostname
             ips = socket.getaddrinfo(hostname, parsed.port or (443 if parsed.scheme == "https" else 80))
             for family, socktype, proto, canonname, sockaddr in ips:
                 ip = sockaddr[0]
                 if _is_private_ip(str(ip)):
+                    if advisory:
+                        logger.info("URL advisory: private IP (proceeding)", extra={"ip": ip})
+                        return url
                     raise SSRFProtectionError(f"URL resolves to private IP: {ip}")
         except socket.gaierror as e:
-            # DNS resolution failed - could be a security issue
             logger.warning(f"DNS resolution failed for {hostname}: {e}")
-            raise SSRFProtectionError(f"Cannot resolve hostname: {hostname}")
+            if not advisory:
+                raise SSRFProtectionError(f"Cannot resolve hostname: {hostname}")
 
     return url
 
 
-def _http_get(url: str, allow_private: bool = False) -> str:
+def _http_get(url: str, allow_private: bool = True) -> str:
     """
-    Simple HTTP GET with SSRF protection.
+    HTTP GET with advisory URL validation.
 
     Args:
         url: URL to fetch.
-        allow_private: If True, allow private/internal IPs (default False).
+        allow_private: If True (default), allow private/internal IPs.
 
     Returns:
         Response text. On failure returns a string starting with 'Error: '.
     """
     try:
-        validated_url = _validate_url(url, allow_private=allow_private)
+        validated_url = _validate_url(url, allow_private=allow_private, advisory=True)
     except SSRFProtectionError as e:
         return f"Error: SSRF protection: {e}"