open/llm-ingestion-pipeline-security
1
0
Fork 0
Code Issues Releases 4 Activity

docs(readme,adoption-brief): advertise v0.4.0, now that it installs

Browse source 
The tag was pushed first and installed into a clean venv before this commit:
0.4.0 resolves from the forge, both new caps fire, and the transform raise is
present. Only then does the install block point at it — a README that advertises
a tag nobody has resolved is how an install line goes stale without anyone
noticing.

The adoption brief was three releases behind (`v0.2`, 126 classes, 4 gaps, 522
tests). Re-measured rather than incremented: 128/128, 6/6, 703 passing.
This commit is contained in:
Kjell Tore Guttormsen 2026-08-10 14:51:11 +02:00
commit 3c56d50e05
2 changed files with 15 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

21
README.md
View file

@ -2,7 +2,7 @@
Write-time defensive layer for Python pipelines that persist LLM output: sanitize, fence, tool-less quarantined transform, capability isolation, scan before persist, fail-secure. Write-time defensive layer for Python pipelines that persist LLM output: sanitize, fence, tool-less quarantined transform, capability isolation, scan before persist, fail-secure.
![Version](https://img.shields.io/badge/version-0.3.4-blue) ![Version](https://img.shields.io/badge/version-0.4.0-blue)
![Status](https://img.shields.io/badge/status-alpha-orange) ![Status](https://img.shields.io/badge/status-alpha-orange)
![Python](https://img.shields.io/badge/python-3.10%2B-purple) ![Python](https://img.shields.io/badge/python-3.10%2B-purple)
![License](https://img.shields.io/badge/license-MIT-lightgrey) ![License](https://img.shields.io/badge/license-MIT-lightgrey)
@ -43,7 +43,7 @@ may still change. There are real limitations, stated plainly below; read them.
Not on PyPI. The guard is distributed from its Forgejo origin — pin a release tag: Not on PyPI. The guard is distributed from its Forgejo origin — pin a release tag:
```bash ```bash
pip install "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v0.3.4" pip install "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v0.4.0"
``` ```
The `open/` mirror is anonymously readable, so CI needs no deploy key, token, or The `open/` mirror is anonymously readable, so CI needs no deploy key, token, or
@ -99,16 +99,17 @@ the disposition is `FAIL_SECURE`, never a silent persist. Pass
together with a transform failure is treated as a probable forced-fallback attack together with a transform failure is treated as a probable forced-fallback attack
and halts regardless of trust tier. and halts regardless of trust tier.
**Unreleased — on `main`, not in `v0.3.4`.** The tag advertised above does not do **New in `v0.4.0`, and the reason for the major-line bump.** `prepare_input` fails
this yet; the version it lands under is still open. `prepare_input` fails
**closed** on size too: above `MAX_INPUT_CHARS` (1 000 000) it raises **closed** on size too: above `MAX_INPUT_CHARS` (1 000 000) it raises
`OversizeInputError`, a `ContractViolation` subclass, rather than returning a `OversizeInputError`, a `ContractViolation` subclass, rather than returning a
half-sanitized document. The scanners bound their work by half-sanitized document. If you call `sanitize` / `fence` / `neutralize` on
reading a prefix and flagging, which costs only detection in the tail; a documents that large, this is the upgrade that needs a `try` — everything else in
transform returns *content*, where the same move would either drop your data 0.4.0 is additive. The scanners bound their work differently: they read a prefix
silently or hand back an untransformed tail — the exact place an attacker would and flag, which costs only detection in the tail. A transform returns *content*,
put the payload. Catch it where you catch your other ingest refusals; the where the same move would either drop your data silently or hand back an
exception carries sizes and the refusing surface, never any of the input. untransformed tail — the exact place an attacker would put the payload. Catch it
where you catch your other ingest refusals; the exception carries sizes and the
refusing surface, never any of the input.
Every primitive is also exported for pipelines that compose the checklist Every primitive is also exported for pipelines that compose the checklist
themselves — `sanitize`, `scan_lexicon`, `scan_entropy`, `scan_output`, themselves — `sanitize`, `scan_lexicon`, `scan_entropy`, `scan_output`,

8
docs/ADOPTION-BRIEF.md
View file

@ -4,7 +4,7 @@
especially one converging on Google's Open Knowledge Format (OKF v0.1) — and needs especially one converging on Google's Open Knowledge Format (OKF v0.1) — and needs
to decide **when** and **where** to add a write-time ingestion guard. to decide **when** and **where** to add a write-time ingestion guard.
**Status of the guard:** `v0.2` (alpha). Stdlib-only core, framework-agnostic. **Status of the guard:** `v0.4.0` (alpha). Stdlib-only core, framework-agnostic.
Public API may still change. Read the known-limitations section before you rely Public API may still change. Read the known-limitations section before you rely
on it. on it.
@ -140,9 +140,9 @@ live payload:
python -m llm_ingestion_guard.coverage # exit 0 = all as documented python -m llm_ingestion_guard.coverage # exit 0 = all as documented
``` ```
As of `v0.2`: **126 / 126 defended classes demonstrated (recall 100%)** and **4 / As of `v0.4.0`: **128 / 128 defended classes demonstrated (recall 100%)** and **6 /
4 documented gaps still hold** (a *closed* gap fails the test, forcing a doc 6 documented gaps still hold** (a *closed* gap fails the test, forcing a doc
update). The matrix is the single source of truth for the test suite (**522 update). The matrix is the single source of truth for the test suite (**703
passing**), which also asserts total recall, that every lexicon pattern has a passing**), which also asserts total recall, that every lexicon pattern has a
case (so the matrix cannot fall behind the lexicon), the full LLM02 secret-egress case (so the matrix cannot fall behind the lexicon), the full LLM02 secret-egress
set, and the container-layer front-end (CSV formula-injection, zip-slip/bomb, set, and the container-layer front-end (CSV formula-injection, zip-slip/bomb,