The architecture is informed by the production Data Sanitization Proxy that has shipped inside the BlackUnicorn Command Centre. The standalone library keeps the load-bearing primitives and strips out everything platform-specific.
Each phase emits a uniform result. Any error in any stage halts the request. There is no cleartext fallback — not because we hide it behind a flag, but because no such code path exists.
Verify the caller from a signed session. No self-reported headers.
Nine-stage pipeline. NFKC → blocklist → regex → struct → NER → operator-lists → coreference → escalation.
Type-preserving placeholders. Session-scoped. AES-256-GCM map.
HIGH → L1 local. MEDIUM → L2 contracted. LOW → any. No override.
Reverse only the runes the outbound map created. Unknown ones stay masked.
HMAC-SHA-256, never raw text. Tamper-evident store. Audit-on-audit.
Non-negotiable. Skip any one and Runelm is decorative.
If the classifier errors, the pseudonymizer crashes, the integrity check fails — the request is blocked. There is no best-effort path past a failure. The whole point of the system is that no external call goes out unless every safety step succeeded.
Every code path that calls an LLM must go through Runelm. One shared client module. Direct httpx, fetch, or SDK calls to provider URLs are prohibited by code review. If a single path bypasses Runelm, the system provides no guarantee.
Only reverse placeholders that the outbound substitution map created for this session. If the LLM response contains a placeholder-shaped token not in your map, leave it alone. Otherwise prompt injection can trick the model into outputting fake placeholders to extract real values.
Any sensitivity boost based on caller role (finance, security-ops) must come from authenticated session identity — signed JWT, mTLS subject, session-cookie principal. Never from a self-reported HTTP header. A self-reported caller can claim any identity.
Layered. Order matters. Later stages can only escalate the level, never lower it.
The classification level forces the routing decision. There is no --allow-l3-for-high flag. The system enforces the policy, it does not ask.
| Level | Allowed tier | Examples |
|---|---|---|
| BLOCKED | none | API keys, credentials, private keys, MFA codes |
| HIGH | L1 local only | Revenue, forecasts, active engagement names, pre-disclosure vulnerability findings |
| MEDIUM | L1 + L2 contracted | Aggregated metrics, anonymized cohorts, employee names in non-sensitive context |
| LOW | any provider | Public docs, generic coding help, market news |