Summary

Closes #3058, closes #2306.

Implements two complementary security features for Zeph's tool execution pipeline:

• Egress network logging (zeph-tools): every outbound HTTP request from WebScrapeExecutor emits a structured EgressEvent to the audit log, with URL redaction, per-hop tracking, bounded mpsc telemetry channel, and TUI Security panel surface.
• VIGIL verify-before-commit (zeph-core): a regex-based tripwire gate that checks tool output against cached user intent before the result enters the LLM context. Flagged outputs are sanitized (default) or blocked (strict mode), with a correlated AuditEntry emitted on each violation.

Egress logging (closes #3058)

• EgressEvent struct in crates/zeph-tools/src/audit.rs with correlation_id, hop, URL, method, status, duration, bytes
• AuditEntry.correlation_id: Option<String> for cross-event correlation
• AuditLogger::log_egress() via bounded mpsc::channel(256) + Arc<AtomicU64> drop counter (egress_dropped_total)
• WebScrapeExecutor instrumented: success, non-2xx, connection failure, body-too-large, redirect-blocked, SSRF/domain/scheme-blocked paths all emit events
• redact_url_for_log() strips userinfo and secret query params before storage (no credential leak)
• EgressConfig in [tools.egress]: enabled, log_blocked, log_response_bytes, log_hosts_to_tui
• Wired in agent_setup.rs, acp.rs, daemon.rs, runner.rs; shared drain_egress_events() function
• egress_requests_total, egress_blocked_total, egress_dropped_total in MetricsSnapshot
• TUI Security panel: 3 new egress metric rows

VIGIL intent-anchoring gate (closes #2306)

• VigilGate in crates/zeph-core/src/agent/vigil.rs: regex tripwire using zeph_tools::patterns::RAW_INJECTION_PATTERNS + strip_format_chars pre-processing
• Integration point: tool_execution/native.rs after tool executor returns, before sanitize_tool_output
• Block mode: emits AuditEntry with vigil_risk=High, error_category="vigil_blocked" (non-retryable), sentinel text "[security: content blocked by guardrails; retrying will produce the same result]"
• Sanitize mode (default): truncates output, emits AuditEntry with vigil_risk=Medium
• current_turn_intent cached per turn in SecurityState, cleared at turn end and /clear
• Subagents exempt via parent_tool_use_id.is_some()
• FailureKind::SecurityBlocked for skill outcome tracking
• [security.vigil] config: enabled, strict_mode, extra_patterns (validated with RegexBuilder size limits)
• Wired in runner.rs, acp.rs, daemon.rs
• vigil_flags_total, vigil_blocks_total counters in MetricsSnapshot

Config

[tools.egress]
enabled = true
log_blocked = true
log_response_bytes = true
log_hosts_to_tui = true

[security.vigil]
enabled = true
strict_mode = false
extra_patterns = []

Spec compliance

• specs/010-security/010-5-egress-logging.md — 11 FRs
• specs/010-security/010-6-vigil-intent-anchoring.md — 12 FRs

Testing

• 8279 tests pass (up from 8073 before this PR)
• cargo +nightly fmt --check clean
• cargo clippy --workspace --features "desktop,ide,server,chat,pdf,scheduler" -- -D warnings clean

Security notes

• VIGIL v1 is a regex tripwire, not a defense against sophisticated attacks. Unicode homoglyph, base64, multilingual, and paraphrase bypasses are known non-goals documented in the spec threat model. v2 follow-up will add semantic/embedding-based verification.
• URL logging uses redact_url_for_log() — strips userinfo and query params matching: token, key, secret, password, auth, sig, api_key, apikey.

Test plan

• Start agent with [tools.egress] enabled = true and run a web scrape; verify JSONL audit log contains EgressEvent entries with redacted URLs
• Start agent with [security.vigil] enabled = true and send a prompt that causes a tool to return injection text ("ignore all previous instructions"); verify AuditEntry with vigil_risk=High in log and sentinel in tool result
• Verify TUI Security panel shows egress metrics rows
• Run with strict_mode = true; verify blocked tool call does not retry