open/llm-ingestion-okf
1
0
Fork 0
Code Issues Pull requests Releases Activity

docs(okf-v0.2): decide Door C's allow_reserved stance for the 0.3.x pin bump

Browse source 
Guard v0.3.3 added allow_reserved (default True) to okf.import_bundle,
reversing the phase-2 plan's "reserved-name rejection is unconditional"
reading -- an unqualified call would now merge index.md/log.md instead
of refusing them. Decided: pin allow_reserved=False explicitly at the
pin bump, keeping the original commitment. No code change yet -- the
installed pin is still v0.2.0, where the kwarg does not exist.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KZPHJpPeSMzVqvbQRxh2Ux
This commit is contained in:
Kjell Tore Guttormsen 2026-08-01 19:56:04 +02:00
commit 89f9f9e4cf
1 changed files with 12 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

19
docs/plan/phase-2-doors-b-c.md
View file

@ -124,13 +124,18 @@ No scanning, sanitizing, or quarantine logic is implemented here.
verdict for at all is refused. Only the guard's non-blocking floor merges —
the same floor Door B applies, with `quarantine_review` reported as its own
bucket rather than folded into rejection.
- **Upstream has already moved past the pin (observed, not acted on).** The
guard's `main` carries a commit that adds `allow_reserved=True` to
`okf.import_bundle` and *scans* `index.md`/`log.md` in a mode-b import
instead of path-rejecting them. The pin is the `v0.2.0` tag, where the
kwarg does not exist and rejection is unconditional, so this door is built
against the tag. Whoever bumps the pin owns re-checking that branch: today
a reserved name in a received bundle arrives as a per-concept rejection.
- **Upstream has released past the pin, and the decision is now taken.** `main`'s
`allow_reserved=True` kwarg shipped in guard `v0.3.3` (confirmed by a
19-fixture measurement against a scratch venv, unrelated to the pinned
install). The kwarg defaults `True`, so an unqualified call now *merges*
`index.md`/`log.md` in a mode-b import instead of path-rejecting them —
reversing this plan's original "no allow_reserved toggle, rejection is
unconditional" reading. Decided: when the pin bumps into the `0.3.x` line,
`guard_adapter.import_gate` passes `allow_reserved=False` explicitly,
keeping the reserved-name refusal this plan committed to. Today the pin is
still `v0.2.0`, where the kwarg does not exist and rejection is
unconditional by construction — no code changes yet; whoever bumps the pin
adds the kwarg and a test pinning it, per assumption B1.
- **`origin`/`channel` are validated against the guard's pinned vocabulary.**
The guard derives trust from `origin` by enum *identity*, so an unrecognised
string would be silently downgraded to untrusted. The library refuses to