feat: enforce layer0 gate and add tests

mcp/waf_intelligence/classifier.py

@@ -20,6 +20,9 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Set, Tuple
 
+from layer0 import layer0_entry
+from layer0.shadow_classifier import ShadowEvalResult
+
 # Try to import sklearn, fall back to pure Python
 try:
     from sklearn.feature_extraction.text import TfidfVectorizer
@@ -555,6 +558,11 @@ if __name__ == "__main__":
     print("=" * 60)
     
     for text in test_inputs:
+        routing_action, shadow = layer0_entry(text)
+        if routing_action != "HANDOFF_TO_LAYER1":
+            print(_layer0_cli_msg(routing_action, shadow), file=sys.stderr)
+            continue
+
         result = classifier.analyze(text)
         print(f"\nInput: {text[:50]}...")
         print(f"  Label: {result['classification']['label']}")
@@ -562,3 +570,14 @@ if __name__ == "__main__":
         print(f"  Risk Level: {result['risk_level'].upper()}")
         print(f"  Anomaly Score: {result['anomaly']['score']:.2%}")
         print(f"  Recommendation: {result['anomaly']['recommendation']}")
+
+
+def _layer0_cli_msg(routing_action: str, shadow: ShadowEvalResult) -> str:
+    if routing_action == "FAIL_CLOSED":
+        return "Layer 0: cannot comply with this request."
+    if routing_action == "HANDOFF_TO_GUARDRAILS":
+        reason = shadow.reason or "governance_violation"
+        return f"Layer 0: governance violation detected ({reason})."
+    if routing_action == "PROMPT_FOR_CLARIFICATION":
+        return "Layer 0: request is ambiguous. Please add specifics before rerunning."
+    return "Layer 0: unrecognized routing action; refusing request."