open/llm-ingestion-okf
1
0
Fork 0
Code Issues Releases 1 Activity

feat(profiles): DEFAULT stamps commons' O2 generated, V1 executed

Browse source 
Commons ratified V1 2026-08-02 and executed it at `54e0ec7`; verified
against their tree rather than taken on report. ingest-spec.md:217 now
defines `generated` as `{ by: process:okf-ingest, at: <ingested_at> }`,
unquoted, `at` repeating `ingested_at` verbatim. `generated: true` no
longer appears in the spec.

`DEFAULT` states commons' §5 layer, so its stamp is theirs to decide.
`DEFAULT.ownership` gains the actor; the four goldens this repo's plan
named in advance were regenerated by RUNNING the materializer, each on
its own case's `ingested-at.txt`. The v0.2 golden was untouched, as
predicted -- it has carried the O2 form since D5.

Not a migration onto OKF v0.2: `DEFAULT` stays v0.1 on every axis
upstream owns and still emits no `sources`. Commons' spec and the Google
version are independent axes, and comments that narrated them as one
were rewritten rather than left to mislead. README and CLAUDE.md said
the additive rule without that boundary, which would have told a
consumer their DEFAULT bytes can never move; both now state it.

V-A3 is amended, not dropped. `DEFAULT` must OWN the mapping it now
writes -- a profile refusing its own output fires the collision gate on
files its own previous run wrote -- while a mapping naming a foreign
actor, or §7's `human:` actor on curated content, stays unowned. That
half is what carried the safety and it is asserted directly.

§11's stamp-integrity condition moved with the value: the forgeable
stamp was `true` and is now the mapping naming the ingest actor. The
defence was never the value -- the §3 scan globs `ingest-*.md`, so a
Door C import is unreachable however well it forges. Second spoof test
added; both were hand-mutated (glob widened to `*.md`) to confirm they
can fail.

The characterization test derived its foreign-stamp fixture from the
literal `generated: true`, which V1 leaves without a referent -- a
silent no-op waiting to happen. It now derives the needle from the
profile and asserts the substitution occurred.

Door B is deliberately untouched: not the ingest-spec's, marker is
`generated` + `source_file`, disjoint from Door A's `ingest_manifest`,
and the divergence predates V1.

Nothing released or notified. The pilot set pins `v0.5.0a2`, not `main`,
so this is invisible to portfolio-optimiser's freeze and demo; the
consumer exposure report is owed at the release that carries this.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VwcjUXbKySLbEG5WqTNkta
This commit is contained in:
Kjell Tore Guttormsen 2026-08-09 12:29:05 +02:00
commit 8318605e34
15 changed files with 280 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

39
tests/test_materialize.py
View file

@ -113,7 +113,7 @@ def test_file_source_concept_file_exact_bytes(file_setup: tuple[Path, Path]) ->
"source_query: orders.csv\n"
f"ingested_at: {INGESTED_AT}\n"
f"ingest_manifest: {stamp_of(manifest_path)}\n"
"generated: true\n"
f"generated: {{ by: process:okf-ingest, at: {INGESTED_AT} }}\n"
"---\n"
"\n"
"| a | b |\n"
@ -371,6 +371,43 @@ def test_a_door_c_import_survives_a_same_stem_materialize_run(
assert (bundle / "ingest-orders.md").is_file()
def test_a_door_c_import_forging_the_o2_stamp_survives_a_materialize_run(
file_setup: tuple[Path, Path],
) -> None:
"""The test above with the value V1 made forgeable. ingest-spec §11 lists
"Stamp integrity (curated writers)" as a red condition, and V1 changed WHICH
value satisfies it: the forgeable stamp used to be the literal `true`, and is
now the O2 mapping naming the ingest actor. The old test keeps exercising a
value `DEFAULT` still owns, so it did not stop testing anything — but on its
own it would leave the current threat unexercised.
The defence is structural rather than a judgement about the value: the §3
scan globs `ingest-*.md`, so a `import-`-prefixed file is never a candidate
no matter how perfectly it forges the stamp. Door C writes external concepts
verbatim and cannot screen this, which is exactly why the namespace, not the
parse, has to be what holds.
"""
manifest_path, bundle = file_setup
bundle.mkdir()
imported = bundle / "import-external.md"
forged = (
"---\n"
"type: Concept\n"
"title: Imported Concept\n"
"provenance:\n"
f" generated: {{ by: process:okf-ingest, at: {INGESTED_AT} }}\n"
" ingest_manifest: manifest@deadbeef\n"
"---\n\nExternally imported body.\n"
)
imported.write_text(forged, encoding="utf-8")
materialize_bundle(manifest_path, bundle, INGESTED_AT)
assert imported.is_file()
assert imported.read_text(encoding="utf-8") == forged
assert (bundle / "ingest-orders.md").is_file()
def test_second_manifest_does_not_delete_first_manifests_stamped_file(tmp_path: Path) -> None:
# §10.2 per-manifest ownership: two manifests writing into ONE bundle each
# own only the files whose stamp names them by stem. Running manifest B