open/llm-ingestion-pipeline-security
1
0
Fork 0
Code Issues Releases 4 Activity

docs(readme,adoption-brief): advertise v0.4.0, now that it installs

Browse source 
The tag was pushed first and installed into a clean venv before this commit:
0.4.0 resolves from the forge, both new caps fire, and the transform raise is
present. Only then does the install block point at it — a README that advertises
a tag nobody has resolved is how an install line goes stale without anyone
noticing.

The adoption brief was three releases behind (`v0.2`, 126 classes, 4 gaps, 522
tests). Re-measured rather than incremented: 128/128, 6/6, 703 passing.
This commit is contained in:
Kjell Tore Guttormsen 2026-08-10 14:51:11 +02:00
commit 3c56d50e05
2 changed files with 15 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

21
README.md
View file

@ -2,7 +2,7 @@
Write-time defensive layer for Python pipelines that persist LLM output: sanitize, fence, tool-less quarantined transform, capability isolation, scan before persist, fail-secure.
![Version](https://img.shields.io/badge/version-0.3.4-blue)
![Version](https://img.shields.io/badge/version-0.4.0-blue)
![Status](https://img.shields.io/badge/status-alpha-orange)
![Python](https://img.shields.io/badge/python-3.10%2B-purple)
![License](https://img.shields.io/badge/license-MIT-lightgrey)
@ -43,7 +43,7 @@ may still change. There are real limitations, stated plainly below; read them.
Not on PyPI. The guard is distributed from its Forgejo origin — pin a release tag:
```bash
pip install "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v0.3.4"
pip install "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v0.4.0"
```
The `open/` mirror is anonymously readable, so CI needs no deploy key, token, or
@ -99,16 +99,17 @@ the disposition is `FAIL_SECURE`, never a silent persist. Pass
together with a transform failure is treated as a probable forced-fallback attack
and halts regardless of trust tier.
**Unreleased — on `main`, not in `v0.3.4`.** The tag advertised above does not do
this yet; the version it lands under is still open. `prepare_input` fails
**New in `v0.4.0`, and the reason for the major-line bump.** `prepare_input` fails
**closed** on size too: above `MAX_INPUT_CHARS` (1 000 000) it raises
`OversizeInputError`, a `ContractViolation` subclass, rather than returning a
half-sanitized document. The scanners bound their work by
reading a prefix and flagging, which costs only detection in the tail; a
transform returns *content*, where the same move would either drop your data
silently or hand back an untransformed tail — the exact place an attacker would
put the payload. Catch it where you catch your other ingest refusals; the
exception carries sizes and the refusing surface, never any of the input.
half-sanitized document. If you call `sanitize` / `fence` / `neutralize` on
documents that large, this is the upgrade that needs a `try` — everything else in
0.4.0 is additive. The scanners bound their work differently: they read a prefix
and flag, which costs only detection in the tail. A transform returns *content*,
where the same move would either drop your data silently or hand back an
untransformed tail — the exact place an attacker would put the payload. Catch it
where you catch your other ingest refusals; the exception carries sizes and the
refusing surface, never any of the input.
Every primitive is also exported for pipelines that compose the checklist
themselves — `sanitize`, `scan_lexicon`, `scan_entropy`, `scan_output`,