Phase 2: Add Validation Pipeline via Hooks (Week 2)

Part of Epic #270

Objective

Implement 4-layer validation pipeline using rust-genai + MCP hooks.

Tasks

1. Wrap rust-genai Client with Validation

Location: crates/terraphim_multi_agent/src/genai_llm_client.rs

Create ValidatedGenAiClient with:

• Pre-LLM validators (context, permissions, token budget)
• Post-LLM validators (parsing, confidence, security)

2. Add Hooks to MCP Server

Location: crates/terraphim_mcp_server/src/lib.rs

• Pre-tool validation hooks
• Post-tool validation hooks
• Use existing permission system

3. Implement Knowledge-Graph-Based Security

Location: crates/terraphim_rolegraph/src/repository_security.rs

• RepositorySecurityGraph structure
• Command matching via automata
• Synonym resolution via thesaurus
• Learning system for user decisions

4. Command Extraction

Location: crates/terraphim_automata/src/command_matcher.rs

Extract commands from LLM output:

• Backticks
• Code blocks
• Shell prompts
• Natural language

Success Criteria

• 4-layer validation working
• Commands validated in <10µs
• Security graph per repository
• Learning system reduces prompts

Time: 1 week

Start by reading the four named entry points: genai_llm_client.rs, the MCP server lib.rs, repository_security.rs, and command_matcher.rs, along with epic #270. Trace how validation, permissions, command extraction, and learning are currently represented before planning the cross-cutting changes. Done means the four-layer pipeline works, commands validate in under 10µs, each repository has a security graph, and learning reduces prompts.