Runtime Security 1.4.0

Adapt uses closed intent types, scoped targets, enum values, and one semantic writer.

Control chain

Signals → Policy → Intent → Validator → Guardrails → Semantic Apply → Audit / Undo. Each stage narrows authority; only Semantic Apply mutates.

Injection boundary

HTML/CSS/script generation, inline style, free classes, innerHTML, event handlers, javascript URLs, and Shadow DOM internals are outside v1.

Scope

Targets must resolve under the configured root. Protected/sensitive subtrees, data-velin-adapt="off", and cross-origin content are excluded.

Consumers

Block contracts can narrow permissions. Inspector delegates. Local AI returns IDs. None can expand the engine allowlist.