Kjell Tore Guttormsen 36be963d4d fix(llm-security): B2 block-mode blocks all detected trifectas, not only high-confidence ... Previously, `LLM_SECURITY_TRIFECTA_MODE=block` only exited 2 when the detected trifecta was MCP-concentrated (all three legs via the same MCP server) or involved sensitive-path + exfil. Distributed trifectas — three legs originating from different tools, with a non-sensitive data path and a non-sensitive exfiltration sink — were detected and warned but not blocked. This mismatched the documented semantics of block mode and gave operators a false sense of enforcement. Change: remove the `(mcpInfo.concentrated || sensitiveExfil)` AND-gate in the `TRIFECTA_MODE === 'block'` branch so any detected trifecta blocks in block mode. Audit event `severity` still differentiates critical (concentrated / sensitive-exfil) from high (distributed); the blocked stderr message now explicitly names "Distributed trifecta: three legs from different sources" when the confidence sub-signals are absent. Addresses critical review 2026-04-20 §2 B2 (HIGH) and §9 row 1 ("enforces the Rule of Two"). Tests: 1 added (distributed trifecta in block mode now exits 2). All 1495 tests pass.		2026-04-20 00:04:36 +02:00
..
scripts	fix(llm-security): B2 block-mode blocks all detected trifectas, not only high-confidence	2026-04-20 00:04:36 +02:00
hooks.json	feat(hooks): register PreCompact event in hooks.json	2026-04-17 14:45:13 +02:00