Portcullis

The guard pipeline is real code in the request path: deterministic patterns, PII and secret redaction, a genuine LLM semantic classifier, and behavioral guards for budget, loop, lockout and data-flow egress, all exercised by tests and a 1,057-case attack corpus. It stays below 9 because the semantic half is disabled without an OpenAI key and the headline block rate is self-measured.

The gateway is genuinely in the path for both chat and MCP traffic, reads the role policy from the database on every request so hot reload works without restart, and scopes data per organization. No aggregate latency or throughput benchmark appears anywhere to back the low-overhead claim.

Every verdict fans out to Postgres and logs with trace IDs, and the dashboard reads those traces live. The CSV/JSON export claimed in the form has no endpoint in the provided source, so that requirement is only partially evidenced; here the evidence supports the two members who read the samples and found no endpoint over the member who accepted the claim, which is why the median sits below A's 9.

415 pytest cases across 43 files plus a separate mutation harness that expands 58 seeds into 1,057 cases with explicit block and allow expectations and false-alarm tracking. All three members agree this is a strength and the spread is small.

One-command Docker bring-up that runs without a paid key, OpenAI and Ollama behind one interface, YAML policies with strictness and budgets, and OIDC and SCIM identity with per-organization isolation. No horizontal-scaling or production-hardening story is shown.