Change the boundary, not the application model
PYTHONpython
import os
from openai import OpenAI
client = OpenAI(
base_url="http://127.0.0.1:8787/v1",
api_key=os.environ["SHREDDAR_API_KEY"],
)
response = client.chat.completions.create(
model="configured-upstream",
messages=[{"role": "user", "content": private_context}],
stream=False,
extra_body={
"shreddar_task": "Review termination obligations",
"shreddar_policy": "strict-v1",
"shreddar_privacy_mode": "strict",
},
)
receipt = response.model_extra["shreddar"]["receipt"]Bind every request to purpose and policy
| FIELD | DEFAULT | USE |
|---|---|---|
| shreddar_task | empty | Exact downstream purpose; make this narrow and concrete |
| shreddar_policy | balanced-v1 | Versioned policy identifier |
| shreddar_privacy_mode | balanced | balanced, strict, maximum, or custom |
| model | required | shreddar-demo or configured-upstream |
| stream | false | Streaming is rejected in the alpha |
Inspect the SHREDDAR envelope
- choices contains the guarded model response.
- shreddar.protected_messages shows exactly what was approved for inference.
- shreddar.receipt records policy, route, counts, and integrity metadata.
- shreddar.warnings surfaces uncertainty and boundary conditions.
- Reconstruction occurs only through an authorized application path, never automatically inside an agent tool.
Prove what the upstream saw
- 01
CANARY
Use a synthetic identifier and credential-like canary that must never appear upstream.
- 02
CAPTURE
Inspect protected_messages and an upstream test double rather than assuming proxy behavior.
- 03
FAILURE
Exercise timeout, 4xx, 5xx, blocked output, and local_only paths.
- 04
RECEIPT
Verify the request id and hash chain independently after the call.