open/llm-ingestion-pipeline-security
1
0
Fork 0
Code Issues Releases 5 Activity

docs: finish the 1.4.0 release on the doc surfaces

Browse source 
The 1.4.0 release commit (d19de8c) dated the CHANGELOG heading and nothing
else, so the tag went out with README, ADOPTION-BRIEF and BRIEF still
naming 1.3.0 and the install pin still installing 1.3.0. This bumps the
badge, status line and install pin in README, the status and "as of"
lines in ADOPTION-BRIEF (test count 868 -> 893) and BRIEF's status line.
The tag itself is not moved.

Three claims that went false earlier are corrected against the code:

- README said `resource` is deliberately not on the frontmatter allowlist
  and that a `sources` block list of mappings is refused. Both stopped
  being true in 1.3.0. The paragraph now names the four mapping carriers
  and says `resource` / `usage_window` are admitted inside a `sources`
  entry only.
- README described the `resource` https-allowlist without its scope. It
  covers the top-level `resource` only; `sources[].resource` is never
  URL-validated (measured: `javascript:` there imports with no error).
- LIMITATIONS still listed `tags: [a, b]` among the routes that fail.
  It parses since 1.4.0.

Gates after the edit: 893 passed, coverage exit 0, redos-sweep exit 0,
45 LIMITATIONS entries.
This commit is contained in:
Kjell Tore Guttormsen 2026-09-23 12:25:33 +02:00
commit 79285e1265
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
5 changed files with 30 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

9
CLAUDE.md
View file

@ -11,11 +11,10 @@ framework-agnostisk kode.
Referanse-implementasjon: `claude-code-llm-wiki` Stage B (`tools/wiki_ingest/`).
Lexikon-seed: `injection-patterns.mjs` fra `llm-security`-pluginen.
Repoet er på **v1.4.0 i koden, UUTGITT** (`pyproject.toml` + `__init__.py` er
bumpet; README-badge, install-pinnen, ADOPTION-BRIEF og BRIEF står med vilje
igjen på `1.3.0`, som er den siste taggen som FINNES — en install-pin må peke på
en ekte tag). Release-commiten (CHANGELOG-overskrift datert, de fire
dokumentflatene bumpet, tag) er ikke tatt. Den eksporterte Python-surfacen er frosset under semver
Repoet er på **v1.4.0, tagget og pushet** (`d19de8c`). Release-commiten daterte
bare CHANGELOG-en; de fire dokumentflatene (README-badge + install-pin,
ADOPTION-BRIEF, BRIEF) ble bumpet i en egen docs-commit etterpå — taggen selv
bærer fortsatt `1.3.0` i de flatene, og tags flyttes aldri. Den eksporterte Python-surfacen er frosset under semver
(deteksjonsatferd er det IKKE; kalibrering flytter seg i 1.x). Stdlib-kjernen er
bygget og testet (15 moduler +
topp-nivå wiring, showcase + korpus), inkl. OKF-adapter og aktivt-innhold-