llm-ingestion-pipeline-security

open/llm-ingestion-pipeline-security

Fork 0

Commit graph

Author	SHA1	Message	Date
Kjell Tore Guttormsen	d983aa3c95	docs(brief): fold in ms-ai-architect Layer B learnings (first output-side impl) Based on the working, tested Layer B ingestion-gate in ms-ai-architect (2026-07-04): - A: correct consumer 2 — it fetches authored Learn docs + code samples via the microsoft-learn MCP, NOT the open Q&A forum / MSDN / Stack Overflow (that claim was unverified/overstated); low-trust surface is intra-document. Repo/name reconciled: the consumer is ms-ai-architect, no separate "MS AI Security plugin". - B: §4.7 — trust tiers WITHIN a document (code sample / localized string vs authored prose), not only across sources; carriers + critical block in any tier. - C: §12 — consume the lexicon as pure imported functions, not the llm-security scan CLI (which under-covers Markdown prose + base64-in-code-block, verified). - D: §4.6 — fail-secure extends to scanner-unavailable: un-scannable ⇒ BLOCK. Adds ms-ai-architect as the second reference implementation (output side).	2026-07-04 08:32:38 +02:00
Kjell Tore Guttormsen	41473d9db2	docs(brief): add MS AI Security plugin as second consumer; source-trust disposition Second target consumer named: MS AI Security plugin, an ingestion pipeline over Microsoft Learn content that includes user-generated Q&A (learn.microsoft.com/answers, plus ingested MSDN/Stack Overflow). This is the high-untrust case where the contract is load-bearing, not hygiene. New design principle 4.7: disposition scales with source trust (pinned changelog = WARN; open UGC = quarantine/hard-fail on high severity). Day-1 rationale: architectural controls are cheap to design in, expensive to retrofit (consumer 1 is proving that at its A13). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HPAmFyEVWbwvmSNVdXTu4d	2026-07-04 06:26:55 +02:00
Kjell Tore Guttormsen	b505f70485	docs: design brief for reusable LLM ingestion-pipeline security library Brief-stage repo. docs/BRIEF.md defines a minimal, framework-agnostic library that packages the write-time ingestion contract (sanitize -> fence -> tool-less quarantined transform -> per-stage capability isolation -> scan output before persist -> fail-secure) as reusable code. Positioned honestly against query-time guardrails (LLM Guard, NeMo, Rebuff, Vigil) with a prior-art verification log. Reference implementation: claude-code-llm-wiki Stage B. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HPAmFyEVWbwvmSNVdXTu4d	2026-07-04 06:18:32 +02:00

Author

SHA1

Message

Date

Kjell Tore Guttormsen

d983aa3c95

docs(brief): fold in ms-ai-architect Layer B learnings (first output-side impl)

Based on the working, tested Layer B ingestion-gate in ms-ai-architect (2026-07-04):
- A: correct consumer 2 — it fetches authored Learn docs + code samples via the
  microsoft-learn MCP, NOT the open Q&A forum / MSDN / Stack Overflow (that claim
  was unverified/overstated); low-trust surface is intra-document. Repo/name
  reconciled: the consumer is ms-ai-architect, no separate "MS AI Security plugin".
- B: §4.7 — trust tiers WITHIN a document (code sample / localized string vs
  authored prose), not only across sources; carriers + critical block in any tier.
- C: §12 — consume the lexicon as pure imported functions, not the llm-security
  scan CLI (which under-covers Markdown prose + base64-in-code-block, verified).
- D: §4.6 — fail-secure extends to scanner-unavailable: un-scannable ⇒ BLOCK.
Adds ms-ai-architect as the second reference implementation (output side).

2026-07-04 08:32:38 +02:00

Kjell Tore Guttormsen

41473d9db2

docs(brief): add MS AI Security plugin as second consumer; source-trust disposition

Second target consumer named: MS AI Security plugin, an ingestion
pipeline over Microsoft Learn content that includes user-generated Q&A
(learn.microsoft.com/answers, plus ingested MSDN/Stack Overflow). This
is the high-untrust case where the contract is load-bearing, not
hygiene. New design principle 4.7: disposition scales with source trust
(pinned changelog = WARN; open UGC = quarantine/hard-fail on high
severity). Day-1 rationale: architectural controls are cheap to design
in, expensive to retrofit (consumer 1 is proving that at its A13).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HPAmFyEVWbwvmSNVdXTu4d

2026-07-04 06:26:55 +02:00

Kjell Tore Guttormsen

b505f70485

docs: design brief for reusable LLM ingestion-pipeline security library

Brief-stage repo. docs/BRIEF.md defines a minimal, framework-agnostic
library that packages the write-time ingestion contract (sanitize ->
fence -> tool-less quarantined transform -> per-stage capability
isolation -> scan output before persist -> fail-secure) as reusable
code. Positioned honestly against query-time guardrails (LLM Guard,
NeMo, Rebuff, Vigil) with a prior-art verification log. Reference
implementation: claude-code-llm-wiki Stage B.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HPAmFyEVWbwvmSNVdXTu4d

2026-07-04 06:18:32 +02:00

3 commits