v1.0 · Release Candidate
Trust boundaries,
statically verified.¶
Wardline is a semantic boundary enforcement framework for Python. Define a four-tier trust hierarchy, mark your validation points, and the scanner proves that untrusted input never reaches privileged code — before it ships.
Capabilities
Everything a trust boundary needs¶
Wardline ships as a static scanner, a decorator library, a runtime enforcer, and a governance register — all driven by one portable YAML manifest.
Four-tier authority model¶
INTEGRAL → ASSURED → GUARDED → EXTERNAL_RAW. Data flows down freely; flowing up requires an explicit validation boundary. Eight canonical taint states with a commutative join lattice.
AST scanner with taint propagation¶
Three-phase engine — variable, function, and callgraph — catches violations without running your code. Resilient: parse errors skip the file, rule crashes emit a TOOL-ERROR finding.
SARIF 2.1.0 output¶
Findings emit native SARIF for GitHub Code Scanning, the VS Code SARIF Viewer, and any CI system that speaks the format. No glue code, no custom parsers.
Exception governance¶
A control-law state machine tracks every exception from request through approval, expiry, and retirement. Audit trails, retention rules, and SIEM export are built in.
Portable manifest¶
One wardline.yaml declares tier assignments, boundaries, and exceptions. Monorepo overlays let sub-packages extend the root policy without forking it.
Runtime enforcement¶
Descriptor-based boundary checks catch anything the scanner can't prove statically — protocol violations, dynamic dispatch, plugin surfaces — with deterministic failure modes.
Why Wardline
Catch boundary violations at scan time¶
The scanner catches violations Python code reviews miss every day: untrusted input reaching a function that trusts its arguments. Here's a PY-WL-003 violation and its fix.
Violation · PY-WL-003
@external_boundary
def handle_webhook(payload: dict) -> None:
record_audit_event(payload) # (1)!
@integrity_critical
def record_audit_event(data: dict) -> None:
db.write_audit(data)
- Violation: Raw external input (
payload) flows directly to an integrity-critical function without validation. The scanner flags this as a tier-4 → tier-1 boundary crossing.
Validated
@external_boundary
def handle_webhook(payload: dict) -> None:
validated = parse_payload(payload) # (1)!
record_audit_event(validated)
@validates_shape
def parse_payload(raw: dict) -> AuditRecord: # (2)!
if "action" not in raw:
raise ValueError("missing action")
return AuditRecord(action=raw["action"])
@integrity_critical
def record_audit_event(record: AuditRecord) -> None:
db.write_audit(record)
- Input now passes through a validation boundary before reaching privileged code.
- The
@validates_shapedecorator marks this function as a trust boundary. Data flowing out is promoted from tier-4 to tier-2.
Where to start
Find your path¶
For implementers
Build a binding¶
Need the spec offline or for compliance?¶
The canonical PDF is a single-file reference — suitable for air-gapped environments, compliance artifact submissions, or reading on a plane. Same content as the online chapters, built from the same Markdown source.