open/llm-ingestion-pipeline-security
1
0
Fork 0
Code Issues Releases 6 Activity

chore(release): 1.6.0

Browse source
This commit is contained in:
Kjell Tore Guttormsen 2026-10-31 17:04:02 +01:00
commit d00d1b0658
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
7 changed files with 21 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

2
CHANGELOG.md
View file

@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [Unreleased]
## [1.6.0] — 2026-10-31
### Added — hidden markup at the persist gate (attacks A04, A14, A15)

9
CLAUDE.md
View file

@ -11,7 +11,7 @@ framework-agnostisk kode.
Referanse-implementasjon: `claude-code-llm-wiki` Stage B (`tools/wiki_ingest/`).
Lexikon-seed: `injection-patterns.mjs` fra `llm-security`-pluginen.
Repoet er på **v1.5.0** (release-commiten bumper alle levende versjonsflater:
Repoet er på **v1.6.0** (release-commiten bumper alle levende versjonsflater:
`pyproject.toml`, `__init__.py`, README-badge + status + install-pin,
ADOPTION-BRIEF, BRIEF, CHANGELOG-overskrift). NB: v1.4.0-taggen bærer `1.3.0` i
dokumentflatene — dens release-commit daterte bare CHANGELOG-en — og tags
@ -74,6 +74,13 @@ produsentene navngir risikoen, aldri nummeret. Det er én tabell (`_owasp.py`).
Leksikonet får årstallet når det lastes. En klasse som ingen utgave beskriver, får
INGEN nummer (`Case.owasp is None`), for eksempel fail-secure, parserflate og
URL- og sti-validering. `tests/test_catalog_numbers.py` holder tellingen på 0.
**Skjult markup (1.6.0):** `html-obfuscation:tiny-font` (under 4px) og
`html-obfuscation:invisible-colour` (samme farge som bakgrunnen i SAMME
`style`-attributt, eller gjennomsiktig) bor i `output.py`, ikke i leksikonet, som er
byte-likt med commons. En verdi med ledende `0` overlates commons-raden `zero-font`.
Hvit tekst alene er bevisst ikke et signal. `output:html-comment-present` (MEDIUM)
teller bare kommentarer utenfor kode. Katalogregisteret har 16 oppføringer med
`cited` == `latest` (`tests/test_catalog_register.py`).
Start med `docs/BRIEF.md` for design, `README.md` for bruk, `docs/PLAN.md` for
byggerekkefølgen.

12
README.md
View file

@ -2,7 +2,7 @@
Write-time defensive layer for Python pipelines that persist LLM output: sanitize, fence, tool-less quarantined transform, capability isolation, scan before persist, fail-secure.
![Version](https://img.shields.io/badge/version-1.5.0-blue)
![Version](https://img.shields.io/badge/version-1.6.0-blue)
![Status](https://img.shields.io/badge/status-stable-brightgreen)
![Python](https://img.shields.io/badge/python-3.10%2B-purple)
![License](https://img.shields.io/badge/license-MIT-lightgrey)
@ -33,7 +33,7 @@ at write time, never assumed from the format. Any pipeline ingesting external da
into an agent-read store has this shape; an OKF wiki is its canonical form — which
is why the guard ships a first-class OKF adapter (below).
**Status:** `v1.5.0`. The stdlib-only core — its detector, contract, and
**Status:** `v1.6.0`. The stdlib-only core — its detector, contract, and
OKF-adapter modules plus the top-level wiring — is built and tested, exercised by
an end-to-end showcase and adversarial + false-positive corpora. The exported
Python surface is now frozen under semver: nothing exported is removed, renamed or
@ -58,14 +58,14 @@ are real limitations, stated plainly below; read them.
Not on PyPI. The guard is distributed from its Forgejo origin — pin a release tag:
```bash
pip install "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v1.5.0"
pip install "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v1.6.0"
```
Or take a version range from the Forgejo package index, which carries `1.5.0`,
`1.4.2`, `1.4.1` and `1.1.0` (`1.2.0`–`1.4.0` were never published there):
Or take a version range from the Forgejo package index, which carries `1.6.0`,
`1.5.0`, `1.4.2`, `1.4.1` and `1.1.0` (`1.2.0`–`1.4.0` were never published there):
```bash
pip install --index-url https://git.fromaitochitta.com/api/packages/open/pypi/simple/ "llm-ingestion-guard>=1.5.0,<2"
pip install --index-url https://git.fromaitochitta.com/api/packages/open/pypi/simple/ "llm-ingestion-guard>=1.6.0,<2"
```
The `open/` mirror is anonymously readable, so CI needs no deploy key, token, or

6
docs/ADOPTION-BRIEF.md
View file

@ -4,7 +4,7 @@
especially one converging on Google's Open Knowledge Format (OKF v0.1) — and needs
to decide **when** and **where** to add a write-time ingestion guard.
**Status of the guard:** `v1.5.0`. Stdlib-only core, framework-agnostic. The
**Status of the guard:** `v1.6.0`. Stdlib-only core, framework-agnostic. The
exported Python surface is frozen under semver — nothing exported is removed,
renamed or given a different meaning without a `2.0.0`. Detection behaviour is
*not* frozen: severities, thresholds and lexicon entries are calibration and move
@ -142,9 +142,9 @@ live payload:
python -m llm_ingestion_guard.coverage # exit 0 = all as documented
```
As of `v1.5.0`: **136 / 136 defended classes demonstrated (recall 100%)** and **6 /
As of `v1.6.0`: **139 / 139 defended classes demonstrated (recall 100%)** and **6 /
6 documented gaps still hold** (a *closed* gap fails the test, forcing a doc
update). The matrix is the single source of truth for the test suite (**1071
update). The matrix is the single source of truth for the test suite (**1142
passing**), which also asserts total recall, that every lexicon pattern has a
case (so the matrix cannot fall behind the lexicon), the full LLM02:2026 secret-egress
set, and the container-layer front-end (CSV formula-injection, zip-slip/bomb,

2
docs/BRIEF.md
View file

@ -3,7 +3,7 @@
**A reusable, minimal, dependency-light defensive layer for LLM *ingestion*
pipelines — the write-time siblings of query-time chatbot guardrails.**
Status: implemented — v1.5.0, exported surface frozen under semver. This document defines what the repo contains
Status: implemented — v1.6.0, exported surface frozen under semver. This document defines what the repo contains
and why; the stdlib-only core is built and tested (see `README.md` for usage and
`docs/PLAN.md` for the build order).

2
pyproject.toml
View file

@ -4,7 +4,7 @@ build-backend = "hatchling.build"
[project]
name = "llm-ingestion-guard"
version = "1.5.0"
version = "1.6.0"
description = "Write-time defensive layer for Python pipelines that persist LLM output: sanitize, fence, tool-less quarantined transform, capability isolation, scan before persist, fail-secure."
readme = "README.md"
requires-python = ">=3.10"

2
src/llm_ingestion_guard/__init__.py
View file

@ -63,7 +63,7 @@ from .grounding import (
)
from . import okf
__version__ = "1.5.0"
__version__ = "1.6.0"
# --- §6 bookends: the two library-side halves around the transform ---------