[v2] Implement ShadowNetwork Simulator

[SHAURYASANYAL3]

Phase 3: State Lattice (DB & Network)

The Context

Agents reaching out to the internet must be strictly controlled to prevent data exfiltration. The Network Shadow Model analyzes outbound requests prior to execution.

Tasks

• Build a ShadowNetwork class that accepts a NetworkAction and outputs a MutationResult.
• Simulate payload boundaries: track target domain, method, and payload size.
• Implement Network-specific StateInvariant checks:
  • domain_whitelist_only: Enforce strict destination boundaries.
  • no_pii_exfiltration: Run regex/pattern matching against the payload to detect emails, SSNs, or keys before they leave the system. (Again, pure regex, no LLMs).

Part of Epic #651

[arcgod-design]

Hi @SHAURYASANYAL3! I'd love to implement the ShadowNetwork simulator for AgentWatch v2 under SSoC '26. I'm @arcgod-design.

My Approach:

• Build the ShadowNetwork class that accepts a NetworkAction and outputs a MutationResult without executing the real request
• Track target domain, HTTP method, and payload size boundaries as the simulation state
• Implement Network-specific StateInvariant checks:
  • domain_whitelist_only: reject any request to a domain not in the configured whitelist
  • no_pii_exfiltration: run regex/pattern matching on the payload to detect emails, SSNs, API keys, and other PII patterns
• Write unit tests covering allowed domains, blocked domains, clean payloads, and payloads with PII

Could you please assign this to me (@arcgod-design)? Ready to start immediately!