Follow the sequence.
Find the policy violation.

The results have boundaries.

The public run evaluates 300 authored synthetic violation fixtures with the original rule-based layers. Every input and the evaluation code are included.

False-positive rate is undefined for this run: all 300 fixtures are labeled violations. The demo's honest cases are illustrative controls, not a representative negative test set.

Historical model results need qualification

The saved classifier run classified 310 test rows correctly. A release audit found 14 distinct test inputs also in training, affecting 39 test rows. Treat that result as an archived observation on a contaminated split, not evidence of generalization.

New training-data preparation groups identical serialized inputs together. It has not been retrained or evaluated here. Similar templates, data-source differences, and policy-family overlap still need separate controls.

From actions to accumulated effects.

TrajectoryShield examines a recorded sequence under an explicit policy. Its first layer checks individual writes. Its second layer tracks file state, execution patterns, and trajectory or temporal constraints. Optional research modules add a model judge or trained classifier.

1. Read the policy. The policy defines the prohibited outcome.
2. Inspect the action sequence. The same tool can have a different significance depending on what came before it.
3. Accumulate evidence. Look for fragments, data movement, and execution patterns that span steps.
4. Evaluate the result. Keep detections, misses, and false alarms visible.

What this release establishes

The deterministic implementation and authored examples are reproducible without an AI account. A flag is a heuristic policy signal; it cannot establish an agent's intent. Broad write-then-execute and sensitive-read/network checks can overflag benign work. Unknown effects and encoded values can be missed.

This is a research prototype, not a production security boundary. The paper is not included in this release.