feat: add EncodedPayloadScanner for obfuscated injection detection

[u7k4rs6]

What problem are you trying to solve?

All existing guardrail scanners are keyword/pattern based on raw text. An adversary can trivially bypass every one of them by base64-encoding an injection: base64("ignore all previous instructions") passes JailbreakScanner, CodeInjectionScanner, and every other scanner in the pipeline. This is a known, easy bypass.

Proposed solution

Add EncodedPayloadScanner:

• Detects base64, hex, percent-encoded, and unicode/hex-escape blobs using structural regex patterns (length-floored to suppress short, incidental matches).
• Decode-and-rescan: decodes each blob and checks the decoded text against prompt-injection markers (same signals JailbreakScanner catches in raw text).
• Low false-positive rate: benign encoded data (hashes, tokens, image fragments) decodes to non-injection content or non-text, staying well below the 0.6 threshold; only blobs that decode to injection markers hit 0.9 confidence and trigger a block.
• Registered as encoded_payload, exported from __init__.py, wired into create_default_pipeline off by default (like urls and invisible_chars).
• Local and dependency-free.

Alternatives considered

A purely structural scanner (block all long base64 blobs) would have a high false-positive rate (image uploads, long tokens, binary attachments). Decode-and-rescan makes detection semantic, keeping false positives low while closing the obfuscation bypass.

Contribution

I'd be willing to submit a PR to implement this.

[Keesan12]

Obfuscated injection is exactly where a deterministic scanner earns its place. The fast path should catch known-dangerous structure before an LLM gets a chance to rationalize it.

That same architecture works for coding-agent governance: hard rules first, judgment only where judgment is necessary.

Would you record the matched rule in the execution trace so downstream systems can distinguish a policy stop from a model refusal? We are building the broader run receipt in MartinLoop and would value your take: https://github.com/Keesan12/martin-loop

[u7k4rs6]

Good point. The result should name the matched encoding class and the decoded marker that fired, not just the score, so a block is attributable rather than opaque. Folding that into the metadata on #51.