feat(active-content,okf): bound the last two detection surfaces

`scan_active_content` called directly and `okf.link_graph` were the two surfaces
still reading attacker-supplied text with no cap — the first reached by an
adapter that wants the active-content classes alone, the second running a
`findall` over every body in a bundle. Both are detection-shaped, so they
truncate and flag rather than raise the way the transform surfaces do: what a
detector shortens is its own coverage, not the caller's content.

Truncation is only honest if it is visible, so neither goes quiet: the scanner
emits `active:oversize-input` (LLM10), and `link_graph` records
`(from_id, body_length)` in `LinkGraphResult.truncated` — the field that lets a
caller tell "no links past here" from "no links read past here".

Reached through `scan_output`, the text is already under that surface's cap and
`max_scan_chars` is now passed down, so the flag is raised once, there.

src/llm_ingestion_guard/active_content.py

@@ -60,12 +60,13 @@ from urllib.parse import urlsplit
 from .calibration import (
     ACTIVE_CONTENT_ORDINARY_SEVERITY as _ORDINARY_SEVERITY,
     ACTIVE_CONTENT_SEVERITY as _SEVERITY,
+    MAX_SCAN_CHARS,
     URL_OPAQUE_ENTROPY_H as _OPAQUE_H,
     URL_OPAQUE_HEX_MIN_LEN as _OPAQUE_HEX_LEN,
     URL_OPAQUE_MIN_LEN as _OPAQUE_MIN_LEN,
 )
 from .entropy import is_hex_blob, shannon_entropy, try_decode_base64
-from .report import Finding, Report, Source
+from .report import Finding, Report, Severity, Source
 
 # --- URL defang (shared primitive) -------------------------------------------
 # Rewrite a URL to a form no renderer will resolve, while keeping it readable.
@@ -267,15 +268,35 @@ def is_ordinary_url(url: str) -> bool:
 # shares them.
 
 
-def scan_active_content(text: str, source: Source = Source.OUTPUT) -> Report:
+def scan_active_content(
+    text: str,
+    source: Source = Source.OUTPUT,
+    max_scan_chars: int = MAX_SCAN_CHARS,
+) -> Report:
     """Report active-content constructs with an external target in ``text``.
 
     Report-only (design principles 3 & 4): the input is never mutated and no
     disposition is rendered here. Labels are ``active:<class>``; severities
     mirror ``neutralize``'s (image / raw-html / data-uri HIGH, links MEDIUM).
+
+    Self-safety (OWASP LLM10): the scanned length is capped once, and an
+    ``active:oversize-input`` finding announces that the tail went unread. It
+    truncates rather than raising the way the transform surfaces do — what a
+    detector shortens is its own coverage, not the caller's content. Reached
+    through :func:`~llm_ingestion_guard.output.scan_output` the text is already
+    under that surface's cap, so the flag is raised once, there.
     """
     report = Report()
 
+    if len(text) > max_scan_chars:
+        report.add(Finding(
+            label="active:oversize-input", severity=Severity.MEDIUM,
+            source=source, detector="active_content", count=len(text),
+            owasp="LLM10",
+            evidence=f"input {len(text)} chars exceeds cap {max_scan_chars}; scanned prefix only",
+        ))
+        text = text[:max_scan_chars]
+
     def _flag(cls: str, hits: list[tuple[str, bool]]) -> None:
         """Report one finding for ``cls``, graded by its *worst* member.
 

src/llm_ingestion_guard/okf.py

@@ -26,6 +26,7 @@ import re
 from dataclasses import dataclass
 from enum import Enum
 
+from .calibration import MAX_SCAN_CHARS
 from .output import scan_output
 from .report import Report, Source
 from .disposition import Trust, Disposition, Policy, decide
@@ -428,12 +429,15 @@ class LinkGraphResult:
     signal of §7.2 (a link planted to a not-yet-written concept). ``rejected`` —
     ``(from_id, target, reason)`` for links refused outright (dangerous scheme or
     bundle escape). ``resolved`` — ``(from_id, target_concept_id)`` for links to
-    concepts present in the bundle.
+    concepts present in the bundle. ``truncated`` — ``(from_id, body_length)`` for
+    bodies read only as far as the scan cap, so a caller can tell "no links past
+    here" apart from "no links *read* past here" (OWASP LLM10).
     """
 
     dangling: tuple
     rejected: tuple
     resolved: tuple
+    truncated: tuple = ()
 
 
 def extract_link_targets(body):
@@ -475,14 +479,20 @@ def resolve_link(target, from_concept_id):
     return normalized[: -len(".md")]
 
 
-def link_graph(bundle):
+def link_graph(bundle, max_scan_chars=MAX_SCAN_CHARS):
     """Resolve every cross-link in ``bundle`` against the concepts it contains.
 
     ``bundle`` maps concept path to document text (as :func:`import_bundle`). Only
     the body is scanned for links. See :class:`LinkGraphResult` for the outcome.
+
+    Self-safety (OWASP LLM10): every body is attacker-supplied and each is walked
+    by a `findall`, so each body is capped at ``max_scan_chars`` and recorded in
+    ``truncated``. It truncates rather than raising, the way the scanners do: the
+    graph reports on documents, it does not hand them back, so a shortened scan
+    costs edges — not the caller's content.
     """
     present = {p[: -len(".md")] for p in bundle if p.endswith(".md")}
-    dangling, rejected, resolved = [], [], []
+    dangling, rejected, resolved, truncated = [], [], [], []
 
     for path in sorted(bundle):
         if not path.endswith(".md"):
@@ -493,6 +503,10 @@ def link_graph(bundle):
         except OKFFrontmatterError:
             body = bundle[path]  # unparseable frontmatter is T2's reject, not ours
 
+        if len(body) > max_scan_chars:
+            truncated.append((from_id, len(body)))
+            body = body[:max_scan_chars]
+
         for target in extract_link_targets(body):
             try:
                 concept_id = resolve_link(target, from_id)
@@ -506,7 +520,9 @@ def link_graph(bundle):
             else:
                 dangling.append((from_id, concept_id))
 
-    return LinkGraphResult(tuple(dangling), tuple(rejected), tuple(resolved))
+    return LinkGraphResult(
+        tuple(dangling), tuple(rejected), tuple(resolved), tuple(truncated)
+    )
 
 
 def _normalize_bundle_path(path):

src/llm_ingestion_guard/output.py

@@ -336,6 +336,7 @@ def scan_output(
     # 6. Active-content constructs with an external target (the EchoLeak class,
     #    OWASP LLM05) — reported here so disposition sees them; defanging stays
     #    neutralize's separate, opt-in job.
-    report.extend(scan_active_content(scan_text, source).findings)
+    #    scan_text is already <= cap, so no second oversize finding is emitted.
+    report.extend(scan_active_content(scan_text, source, max_scan_chars).findings)
 
     return report