Kjell Tore Guttormsen
0af8f68cae
Module 11 (final) — the top-level wiring. The library never makes the model call (no SDK imported by the core), so the public surface is the toolkit plus two library-side bookends around the caller's tool-less transform (Form 1, chosen with the operator over an export-only toolkit and a full orchestrator — the bookends fit existing pipelines with least friction, encode the two halves the library can stand for, and impose no control flow): - prepare_input(text, source=INPUT) -> PreparedInput(fenced, nonce, report): §6 steps 1-2, sanitize THEN fence (carrier can never smuggle a forged delimiter). Merged report carries both steps' findings; renders no disposition. - screen_output(text, policy, *, provenance, transform_failed) -> DispositionResult: §6 steps 6-7, scan_output under guard() so a scanner error fails CLOSED (FAIL_SECURE, never a silent persist). transform_failed routes the compound forced-fallback rule. - __all__ exports the full framework-agnostic surface: detectors, result types, disposition machinery + presets, contract asserters, the grounding seam. Docs: README refreshed from the stale "brief / pre-implementation" line to a v0.1 alpha status with a Form-1 quickstart, the §6 adopt-this checklist, and an honest -limitations section (structural unsolvability at the text layer; semantic poisoning invisible to lexicon+entropy; text-only, no multimodal). CHANGELOG seeded; CLAUDE.md remote/status lines corrected (remote IS set, no longer brief-stage). 10 wiring tests (public surface, prepare_input compose, screen_output fail-closed + compound). 189 green (showcase + corpora follow). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HyRCQMocjZ6SmSQ6JidJ2k
39 lines
1.7 KiB
Markdown
39 lines
1.7 KiB
Markdown
# llm-ingestion-pipeline-security
|
|
|
|
## Kontekst
|
|
|
|
Gjenbrukbar, minimal defensiv layer for LLM **ingestion**-pipelines (write-time),
|
|
til forskjell fra query-time chatbot-guardrails. Pakker det arkitektoniske
|
|
kontraktet — sanitize → fence → tool-less karantenert transform → per-stadium
|
|
capability-isolasjon → scan output før commit → fail-secure — som komponerbar,
|
|
framework-agnostisk kode.
|
|
|
|
Referanse-implementasjon: `claude-code-llm-wiki` Stage B (`tools/wiki_ingest/`).
|
|
Lexikon-seed: `injection-patterns.mjs` fra `llm-security`-pluginen.
|
|
|
|
Repoet er på **v0.1 (alpha)**: stdlib-kjernen er bygget og testet (10 moduler +
|
|
topp-nivå wiring, showcase + korpus). Start med `docs/BRIEF.md` for design,
|
|
`README.md` for bruk, `docs/PLAN.md` for byggerekkefølgen.
|
|
|
|
## Konvensjoner
|
|
|
|
- Norsk for dialog og planer, engelsk for kode og innhold (repoet er publisert).
|
|
- Ingen GitHub — kun Forgejo (`git.fromaitochitta.com`).
|
|
- Remote satt: offentlig `open/`-speil på Forgejo; push hver commit (durabelt autorisert).
|
|
- Minimal-dependency: stdlib-first kjerne; ML/judge-detektorer bak extras.
|
|
|
|
## Communication patterns
|
|
|
|
### Linking to local files
|
|
|
|
When pointing to local files in responses, always use markdown link syntax with a descriptive name:
|
|
|
|
- Use `[Human-friendly name](file:///absolute/path)` — never bare `file:///...` URLs or autolinks `<file://...>`.
|
|
- Always use absolute paths. Never `~/` or relative paths.
|
|
- For multiple files, render as a bullet list of named markdown links.
|
|
|
|
Why: bare `file://` URLs only render the first as clickable across multiple lines. Named markdown links make each entry independently clickable and look cleaner.
|
|
|
|
Example:
|
|
|
|
- [Brief](file:///Users/ktg/repos/llm-ingestion-pipeline-security/docs/BRIEF.md)
|