feat(sae): wire SaeJudge into the pipeline + ACL config

- Pipeline::with_sae + routing: LlmActivations events are judged by the SAE tier
  (not the rule chain); an SAE escalation defers to the deep L3 agent.
- config.rs: a sae { dict, escalate_at, block_at } ACL block loads the labeled
  feature dictionary and wires the tier; the napi/pyo3 SDKs get it via evaluate().
- SaeJudge::from_path. 49 lib tests pass (pipeline routing + config integration).

Author: RoyLin

src/config.rs

@@ -10,6 +10,7 @@
 //!
 //! llm   { url = "http://llm:18051/v1" model = "glm" key = "..." timeout_s = 30 }   # L2 (optional)
 //! agent { bin = "a3s-code" skills = "./skills" timeout_s = 120 }                    # L3 (optional)
+//! sae   { dict = "features.json" escalate_at = 0.3 block_at = 0.6 }                 # mech-interp (optional)
 //! deny  { egress = "egress.txt" file = "file.txt" exec = "exec.txt" }               # sinks (optional)
 //!
 //! rules = [
@@ -21,6 +22,7 @@
 use crate::enforce::Enforcer;
 use crate::pipeline::{Judge, Pipeline};
 use crate::rules::{default_rules, LiveRules, RuleEngine, RuleSpec};
+use crate::sae::SaeJudge;
 use crate::verdict::Severity;
 use crate::{AgentJudge, LlmJudge};
 use serde::Deserialize;
@@ -41,6 +43,9 @@ pub struct SdkConfig {
     pub llm: Option<LlmCfg>,
     /// L3 — a deep a3s-code agent investigation. Omit if you don't run L3.
     pub agent: Option<AgentCfg>,
+    /// SAE mechanistic-interpretability tier — judges model-output `LlmActivations` events (from
+    /// a3s-power's in-enclave tap) against a labeled feature dictionary. Omit if you don't run it.
+    pub sae: Option<SaeCfg>,
     /// Deny-file sinks the kernel guards read. Omit to judge without enforcing.
     pub deny: Option<DenyCfg>,
     /// L1 site rules, evaluated before the built-in defaults (first match wins).
@@ -63,6 +68,16 @@ pub struct AgentCfg {
     pub timeout_s: Option<u64>,
 }
 
+#[derive(Debug, Deserialize)]
+pub struct SaeCfg {
+    /// Path to the labeled feature dictionary JSON: `{ "8801": {concept, category, weight, severity?}, ... }`.
+    pub dict: String,
+    /// harmful ≥ this → escalate (default 0.30).
+    pub escalate_at: Option<f32>,
+    /// harmful ≥ this → block (default 0.60).
+    pub block_at: Option<f32>,
+}
+
 #[derive(Debug, Default, Deserialize)]
 pub struct DenyCfg {
     pub egress: Option<String>,
@@ -110,6 +125,13 @@ impl SdkConfig {
                 self.fail_closed,
             )));
         }
+        if let Some(s) = self.sae {
+            let mut judge = SaeJudge::from_path(Path::new(&s.dict))?;
+            if let (Some(e), Some(b)) = (s.escalate_at, s.block_at) {
+                judge = judge.thresholds(e, b);
+            }
+            pipeline = pipeline.with_sae(Arc::new(judge));
+        }
 
         let deny = self.deny.unwrap_or_default();
         let enforcer = Enforcer::new(
@@ -132,3 +154,38 @@ fn parse_severity(s: &str) -> Severity {
         _ => Severity::High,
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::verdict::{Tier, Verdict};
+
+    #[test]
+    fn sae_block_wires_the_tier_and_judges_activations() {
+        // A labeled feature dictionary on disk.
+        let dir = std::env::temp_dir();
+        let dict_path = dir.join("sentry_sae_cfg_test_dict.json");
+        std::fs::write(
+            &dict_path,
+            r#"{"8801":{"concept":"exploit-code-synthesis","category":"cyber_offense","weight":0.9,"severity":"high"}}"#,
+        )
+        .unwrap();
+
+        let acl = format!(
+            "fail_closed = false\nsae {{ dict = \"{}\" }}\n",
+            dict_path.display()
+        );
+        let (pipeline, _enforcer) = SdkConfig::from_acl(&acl).unwrap().build().unwrap();
+
+        // A model-output activations line with the harmful feature firing → blocked + explained.
+        let line = r#"{"identity":{"agent":"deep-finance"},"event":{"LlmActivations":{"pid":1,"layer":18,"features":[[8801,0.95]]}}}"#;
+        let ev = crate::event::ObservedEvent::parse(line).expect("parses");
+        let d = pipeline.evaluate(&ev);
+        assert_eq!(d.verdict, Verdict::Block);
+        assert_eq!(d.tier, Tier::Sae);
+        let ex = d.explain.expect("explainability present");
+        assert_eq!(ex.drivers[0].concept, "exploit-code-synthesis");
+
+        let _ = std::fs::remove_file(&dict_path);
+    }
+}

src/pipeline.rs

@@ -11,7 +11,7 @@
 //! so ready sooner — is authoritative. High-risk events thus get the deep look without paying the
 //! serial L2+L3 latency.
 
-use crate::event::ObservedEvent;
+use crate::event::{Event, ObservedEvent};
 use crate::verdict::{Decision, Severity, Tier, Verdict};
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::Arc;
@@ -36,6 +36,9 @@ pub struct Pipeline {
     l1: Arc<dyn Judge>,
     l2: Option<Arc<dyn Judge>>,
     l3: Option<Arc<dyn Judge>>,
+    /// The SAE mechanistic-interpretability tier — judges model-output `LlmActivations` events from
+    /// a3s-power's in-enclave feature emission (a separate domain from the observer-event rule chain).
+    sae: Option<Arc<dyn Judge>>,
     fail_closed: bool,
     speculate_above: Option<Severity>,
     /// Live count of speculative L3 threads (incl. ones detached after an L2 short-circuit), so we
@@ -50,6 +53,7 @@ impl Pipeline {
             l1,
             l2: None,
             l3: None,
+            sae: None,
             fail_closed: false,
             speculate_above: None,
             l3_inflight: Arc::new(AtomicU64::new(0)),
@@ -73,6 +77,13 @@ impl Pipeline {
         self
     }
 
+    /// The SAE mechanistic-interpretability tier. Model-output `LlmActivations` events route here
+    /// instead of the L1 rule chain; an SAE escalation can still defer to the deep L3 agent.
+    pub fn with_sae(mut self, sae: Arc<dyn Judge>) -> Self {
+        self.sae = Some(sae);
+        self
+    }
+
     /// Treat an unresolved escalation (no deeper tier available) as `Block` instead of `Allow`.
     pub fn fail_closed(mut self, yes: bool) -> Self {
         self.fail_closed = yes;
@@ -86,8 +97,26 @@ impl Pipeline {
         self
     }
 
+    /// Route a model-output `LlmActivations` event to the SAE tier (with L3-on-escalate). Returns
+    /// `None` for non-activation events, or when no SAE tier is configured (they take the rule chain).
+    fn judge_model_output(&self, ev: &ObservedEvent) -> Option<Decision> {
+        if !matches!(ev.event, Event::LlmActivations { .. }) {
+            return None;
+        }
+        let sae = self.sae.as_ref()?;
+        let d = sae.judge(ev);
+        Some(match (d.verdict, &self.l3) {
+            (Verdict::Escalate, Some(l3)) => l3.judge(ev),
+            (Verdict::Escalate, None) => self.resolve_unescalated(d),
+            _ => d,
+        })
+    }
+
     /// Run the event through the tiers and return the deciding [`Decision`].
     pub fn evaluate(&self, ev: &ObservedEvent) -> Decision {
+        if let Some(d) = self.judge_model_output(ev) {
+            return d;
+        }
         let d1 = self.l1.judge(ev);
         if d1.verdict != Verdict::Escalate {
             return d1;
@@ -106,6 +135,12 @@ impl Pipeline {
     /// blocks the event stream. The worker then calls [`evaluate`](Pipeline::evaluate) (L1 re-runs in
     /// µs, then L2/L3) on the escalated event.
     pub fn classify_l1(&self, ev: &ObservedEvent) -> Decision {
+        // Model-output activations are judged by the SAE tier, not the rule engine.
+        if let Some(sae) = &self.sae {
+            if matches!(ev.event, Event::LlmActivations { .. }) {
+                return sae.judge(ev);
+            }
+        }
         self.l1.judge(ev)
     }
 
@@ -237,6 +272,34 @@ mod tests {
         assert_eq!(p.evaluate(&ev()).verdict, Verdict::Block);
     }
 
+    #[test]
+    fn model_activations_route_to_sae_tier() {
+        use crate::event::{Event, Identity};
+        let act = ObservedEvent {
+            identity: Identity::default(),
+            provider: None,
+            event: Event::LlmActivations {
+                pid: 1,
+                layer: 18,
+                features: vec![],
+            },
+            raw: String::new(),
+        };
+        // Activations are judged by the SAE tier, not the rule chain.
+        let p = Pipeline::new(Arc::new(Fixed(Tier::Rules, Verdict::Allow)))
+            .with_sae(Arc::new(Fixed(Tier::Sae, Verdict::Block)));
+        let d = p.evaluate(&act);
+        assert_eq!(d.verdict, Verdict::Block);
+        assert_eq!(d.tier, Tier::Sae);
+        // A non-activation event still takes the L1 rule chain.
+        assert_eq!(p.evaluate(&ev()).verdict, Verdict::Allow);
+        // An SAE escalation defers to the deep L3 agent when present.
+        let p2 = Pipeline::new(Arc::new(Fixed(Tier::Rules, Verdict::Allow)))
+            .with_sae(Arc::new(Fixed(Tier::Sae, Verdict::Escalate)))
+            .with_l3(Arc::new(Fixed(Tier::Agent, Verdict::Block)));
+        assert_eq!(p2.evaluate(&act).tier, Tier::Agent);
+    }
+
     #[test]
     fn escalates_l1_to_l2_to_l3() {
         let p = Pipeline::new(Arc::new(Fixed(Tier::Rules, Verdict::Escalate)))

src/sae.rs

@@ -18,6 +18,7 @@ use crate::pipeline::Judge;
 use crate::verdict::{Decision, Driver, SaeScore, Severity, Tier, Verdict};
 use serde::Deserialize;
 use std::collections::{BTreeMap, HashMap};
+use std::path::Path;
 
 /// One SAE feature's safety meaning — turns an anonymous feature id into a named, weighted concept.
 /// Produced offline by probing the SAE on a labeled safety set + causal validation (ablate the
@@ -71,6 +72,13 @@ impl SaeJudge {
         Ok(Self::new(dict))
     }
 
+    /// Load the labeled feature dictionary from a JSON file on disk.
+    pub fn from_path(path: &Path) -> anyhow::Result<Self> {
+        let json = std::fs::read_to_string(path)
+            .map_err(|e| anyhow::anyhow!("reading SAE feature dict {}: {e}", path.display()))?;
+        Self::from_json(&json)
+    }
+
     pub fn thresholds(mut self, escalate_at: f32, block_at: f32) -> Self {
         self.escalate_at = escalate_at;
         self.block_at = block_at;