fix(optics): remove Gate-era enforcement from Optics

docs/governance/LEGACY-STALE-NAMES.json

@@ -29,6 +29,20 @@
       "disposition": "FROZEN_DEBT",
       "reviewed_on": "2026-09-27",
       "reason": "The rollback test asserts the sealed 3.1.0 workflow field on the legacy file. The match is a compatibility needle. The path stays in the legacy scan and in hits. It is not an intentional leftover and it is not added to legacy_scan.exclude_prefixes."
+    },
+    {
+      "path": "packages/vantio-cli/test/interceptor.test.js",
+      "count": 0,
+      "disposition": "REMOVED",
+      "reviewed_on": "2026-09-30",
+      "reason": "The two sight_loop needles were assertions on a BLOCKED_HOST ingest event. Optics no longer emits that enforcement event, so those assertions are gone. The CLI still does not emit sight_loop. The path is no longer in hits."
+    },
+    {
+      "path": "packages/vantio-cli/bin/interceptor.cjs",
+      "count": 0,
+      "disposition": "REMOVED",
+      "reviewed_on": "2026-09-30",
+      "reason": "The two sight_loop needles were comments on the retired ingest body. That body is gone. Optics does not emit sight_loop. The path is no longer in hits."
     }
   ],
   "intentional_leftovers": {
@@ -289,10 +303,6 @@
       "path": "packages/vantio-agent-sdk/package.json",
       "count": 2
     },
-    {
-      "path": "packages/vantio-cli/bin/interceptor.cjs",
-      "count": 2
-    },
     {
       "path": "packages/vantio-cli/test/account-retirement.test.js",
       "count": 2
@@ -301,10 +311,6 @@
       "path": "packages/vantio-cli/test/inspect.test.js",
       "count": 1
     },
-    {
-      "path": "packages/vantio-cli/test/interceptor.test.js",
-      "count": 2
-    },
     {
       "path": "packages/vantio-gate-mcp/src/policy.js",
       "count": 1

packages/vantio-agent-sdk-py/tests/test_sdk.py

@@ -10,7 +10,7 @@
 import warnings
 from pathlib import Path
 
-from vantio import get_current_trace_id, report_anomaly, shield
+from vantio import fetch_policy, get_current_trace_id, redact_pii, report_anomaly, shield
 from vantio.sdk import VantioContext, _normalize_policy
 
 from .mock_server import MockServer
@@ -134,7 +134,7 @@ async def test_noop_when_cloud_ingest_is_not_activated(self) -> None:
                 await report_anomaly(target_host="api.openai.com")
             config_hits = [r for r in server.requests if r.path.startswith("/api/v1/config")]
             ingest_hits = [r for r in server.requests if r.path.startswith("/api/v1/ingest")]
-            self.assertEqual(len(config_hits), 1, "wrap loads Gate policy when a key is set")
+            self.assertEqual(len(config_hits), 0, "Optics does not load Gate policy when a key is set")
             self.assertEqual(len(ingest_hits), 0, "report_anomaly stays off without VANTIO_CLOUD_INGEST")
 
     async def test_noop_when_url_or_key_missing_even_with_cloud_ingest_true(self) -> None:
@@ -266,5 +266,27 @@ def test_dry_run_defaults_false_on_non_boolean(self) -> None:
         self.assertFalse(p.dry_run)
 
 
+class ObservationalSdkTests(unittest.TestCase):
+    def test_fetch_policy_does_not_call_the_network(self) -> None:
+        def boom(*_args, **_kwargs):
+            raise AssertionError("fetch_policy must not open a URL")
+
+        original = urllib.request.urlopen
+        urllib.request.urlopen = boom
+        try:
+            policy = fetch_policy("vk_test_dummy", ingest_url="http://127.0.0.1:9")
+        finally:
+            urllib.request.urlopen = original
+        self.assertFalse(policy.enforce)
+        self.assertFalse(policy.pii_redact)
+
+    def test_redact_pii_returns_the_original_text(self) -> None:
+        raw = "Contact bob@example.com or call 555-123-4567"
+        result = redact_pii(raw)
+        self.assertEqual(result.text, raw)
+        self.assertEqual(result.redactions, [])
+        self.assertNotIn("VANTIO_REDACTED", result.text)
+
+
 if __name__ == "__main__":
     unittest.main()