Assistant v0.6.34 — guardrails that prevent, not alert
Output guardrails now hold model content until the round's checks pass: blocked text stays off the client and out of the session log, closing the residual in #74.
A guardrail that trips after the bytes are on the wire is an alert system, not a guard. Until this release, an output guardrail could flag a response and scrub the in-memory copy while the text had already streamed to the client — and the session-log observer, which fires when the message is added, had already written it.
Assistant v0.6.34 moves the check in front of the write.
Held until the round passes
Model content is now held until the round’s output guardrails have passed.
- Streaming. Text and reasoning events are buffered per round and flushed only on a pass. On a trip the buffer is dropped and an error is emitted. For a tool-call round, the narration is dropped while the tool action still runs — the action is separately guarded.
- Both paths. The check runs before the message enters state, so a blocked response never reaches the session log either. An overflow retry clears the buffer, so an aborted attempt’s content is not attributed to the retry.
- Non-streaming. The same pre-add check covers the ordinary answer, the post-nudge final answer, and tool-round narration.
The accepted cost is stated plainly: a guardrails-enabled deployment now delivers streamed text per round rather than per token. That is the trade for the guarantee that nothing unguarded reaches the client or the log. Deployments without output guardrails are unaffected — the check is a no-op.
Eight regression cases cover the new behavior; five of them fail on the previous code. Suite: 3,865 passed, 27 skipped.
The arc around it
v0.6.34 lands on top of the 2026-10-02 audit batch (v0.6.32, roughly 90 issues across governance, boundaries, MCP, auth, transport, skills, storage and the loop) and the re-landed subagent lifecycle fixes (v0.6.33). The tracing consent gate also changed in this run: product tracing defaults off, and an explicit LANGFUSE_ENABLED=0 can no longer be overridden by config.yaml (v0.6.26).
The assistant source carries the full changelog. The engine is documented for builders and deployment teams — see how to run and build on it.