[Inference] 08 - Integrate workflow anonymization pipeline into chat_complete path - #288786

Draft

jonwalstedt wants to merge 54 commits into

elastic:mainfrom

jonwalstedt:anon/08-pipeline-integration

Commits on Sep 11, 2026

[Workflows] Add sync execution types and Liquid template-string support to kbn-workflows

jonwalstedt
and
claude
committed
646d03a
[Workflows] Address Copilot review comments on withTemplateStringSupport and supportedExecutionModes

jonwalstedt
and
claude
committed
aca1eee
[Workflows] Extract WorkflowExecutionPersistence / StepExecutionPersistence interfaces

jonwalstedt
and
claude
committed
19a626c
[Workflows] Return defensive copies from InMemoryExecutionPersistence getters

jonwalstedt
and
claude
committed
9d1936a
[Workflows] Prevent identity fields from being overwritten in InMemoryExecutionPersistence

jonwalstedt
and
claude
committed
81e19e4
[Workflows] Implement sourceIncludes/sourceExcludes in InMemoryExecutionPersistence

jonwalstedt
and
claude
committed
a372d38
[Workflows] Upgrade defensive copies to structuredClone in InMemoryExecutionPersistence

jonwalstedt
and
claude
committed
7bbb955
[Workflows] Extend synchronous execution for inference capabilities

jonwalstedt
and
claude
committed
1170ac7
[Workflows] Address sync-execution review comments

jonwalstedt
and
claude
committed
730617f
[Workflows] Remove WorkflowTriggerMatchOutcome from public server index

jonwalstedt
and
claude
committed
21fdd6c
[Workflows] Document capabilities threat model and add serialization test

jonwalstedt
and
claude
committed
f1c4d27
[Workflows] Address remaining sync-execution review findings

jonwalstedt
and
claude
committed
7b4b653
[Workflows] Fix critic review findings in sync-execution test pass

jonwalstedt
and
claude
committed
d98dcfe
[Workflows] Replace hardcoded trigger conflict check with registration-driven exclusivity

jonwalstedt
and
claude
committed
6381b82
[Inference] Add standalone RE2-only PII detection runtime for workflow anonymization

jonwalstedt
and
claude
committed
6a0e61b
[Inference] Add native RegExp fallback to PII detection runtime

jonwalstedt
and
claude
committed
9e51e89
[Inference] Fix HMAC input format and add generateEntityToken tests

jonwalstedt
and
claude
committed
6e39e7c
[Inference] Fix err type narrowing and timeout message in PiiRegexWorkerService

jonwalstedt
and
claude
committed
d37ee5b
[Inference] Add PiiRegexWorkerService integration tests

jonwalstedt
and
claude
committed
031d123
[Inference] Add anonymization config + decouple from third-effort anonymization plugin

jonwalstedt
and
claude
committed
df1c217
fix(inference): mark anonymization encryptionKey as sensitive in config schema
jonwalstedt
committed
9b9e075
test(inference): add test for provider registered without synchronous execution support
jonwalstedt
committed
cd97fea
fix(inference): resolve workflow anonymization options once at startup; log minThreads override rationale
jonwalstedt
committed
602f8ff
test(inference): add unit tests for sentinel-based capability plumbing
jonwalstedt
committed
4959684
fix(inference): decouple workflow encryptionKey from legacy saltPromise path

jonwalstedt
and
claude
committed
fc810e9
fix(inference): add maxLength bound to encryptionKey config schema

jonwalstedt
and
claude
committed
09b8ebf
feat(inference): add workflowDrivenMinThreads config for operator-controlled thread pre-warming

jonwalstedt
and
claude
committed
d560f10
[Inference] Add anonymization contract, workflow steps, and inference_workflows integration

jonwalstedt
and
claude
committed
f2cc3cd
[Inference] Fix tsconfig.json: add @kbn/workflows-management-plugin dependency

jonwalstedt
and
claude
committed
fabe3fc
[Workflows] Fix config comment: workflowDriven not workflow_driven

jonwalstedt
and
claude
committed
0e0d34b
[Inference] Integrate workflow anonymization pipeline into chat_complete path

jonwalstedt
and
claude
committed
2d2d524
fix(inference): read sessionId/agentId from workflowAnonymization metadata field
jonwalstedt
committed
22a53e7
fix(inference): read agentId from metadata and sessionId from request options in pipeline
jonwalstedt
committed
1b982dc
fix(inference): decouple workflow encryptionKey from legacy saltPromise path

jonwalstedt
and
claude
committed
ccaf12f
fix(inference): mark encryptionKey sensitive and add maxLength bound

jonwalstedt
and
claude
committed
fba545c
feat(inference): add workflowDrivenMinThreads config for operator-controlled thread pre-warming

jonwalstedt
and
claude
committed
6eedf23
fix(inference): update test to use current sessionId/agentId API shape

jonwalstedt
and
claude
committed
62a86e6
fix(inference): gate PiiRegexWorkerService on workflowDriven; add piiRegexWorker to tests

jonwalstedt
and
claude
committed
4df47cf
refactor(inference): split workers config into separate anonymization and workflowAnonymization blocks

jonwalstedt
and
claude
committed
2ed1bcb
[Workflows] Update comment regarding the added supportedExecutionModes property
jonwalstedt
committed
1925d1f
[Workflows] Fix type errors from ZodOptional/ZodDefault unwrapping

jonwalstedt
and
claude
committed
0861c14
[Workflows] Constrain template-string widening to Liquid expressions + add tests

jonwalstedt
and
claude
committed
cfd0c2f
[Workflows] Use safeExtend to handle refined connector paramsSchemas

jonwalstedt
and
claude
committed
419b168
[Workflows] Address self-review: fix template-string widening correctness

jonwalstedt
and
claude
committed
c3f9682
[Inference] Fix zero-length match test to use a* instead of a+

jonwalstedt
and
claude
committed
fbf8130
feat(inference): enforce RE2-only patterns on sync path in PiiRegexWorkerService

jonwalstedt
and
claude
committed
066fccb
fix(inference): rely on AbortSignal alone for task timeout, drop pool rebuild

jonwalstedt
and
claude
committed
5598fd0
fix(inference): address code-review findings in PII detection runtime

jonwalstedt
and
claude
committed
f884fc6
fix(inference): address code review findings on PII detection runtime

jonwalstedt
and
claude
committed
500894a
fix(inference): correct allow_unsafe docstring in PiiRegexWorkerService.run()
jonwalstedt
committed
e6c8be3
fix(inference): correct Piscina queue-saturation message match in PiiRegexWorkerService
jonwalstedt
committed
d47b403
fix(inference): rename misleading describe block in execute_regex_rules.test.ts
jonwalstedt
committed
7cabaec
fix(inference): narrow allow_unsafe blast radius to rule level in PiiRegexWorkerService

jonwalstedt
and
claude
committed
d7fd5eb
docs(inference): update PiiDetectionFailureMode docstring for narrowed allow_unsafe semantics

jonwalstedt
and
claude
committed
cd63215