Kjell Tore Guttormsen 0772dafb70 feat(okf): scan reserved index.md/log.md in mode-b import, not path-reject (review MAJOR #2 )

A received OKF bundle MAY legitimately carry index.md (directory listing, read
first under progressive disclosure) and log.md (update history) at any level
(spec §3.1/§6/§7). import_bundle previously hard-rejected those basenames in the
T4 path gate, so a conformant third-party bundle was over-blocked in full
(FAIL_SECURE) — and because the reject fired before scan_concept, index.md's
body (the highest-priority injection surface) was never scanned.

import_bundle now defaults allow_reserved=True: reserved basenames are scanned
as structural files (path-safety checks — traversal / absolute / backslash / .md
— still apply). The shadow-reject (an *upload* masquerading as index.md) is
preserved: the front-end passes allow_reserved=False so a materialized upload
landing on a reserved basename is still refused. That front-end opt-in was
required to keep the shadow-reject once the default flipped (not in the plan's
Filer set; traced from the code).

- okf.py: validate_concept_path/_validate_concept/import_bundle gain the
  keyword; validate_concept_path default stays False (strict standalone).
- tests: +3 (legit index/log admit; injection in index.md body caught;
  okf_version frontmatter admits). Per-concept-iteration test switched to a
  traversal vector; mode-b showcase's index.md surface reframed from
  reserved-name-reject to index.md-body-scan.
- README honest-limits + CLAUDE.md context note the mode-b/upload distinction.

Suite: 341 -> 344 passed. Core invariant intact (dependencies=[]).

2026-07-15 06:43:50 +02:00

2 KiB

Raw Blame History

llm-ingestion-pipeline-security

Kontekst

Gjenbrukbar, minimal defensiv layer for LLM ingestion-pipelines (write-time), til forskjell fra query-time chatbot-guardrails. Pakker det arkitektoniske kontraktet — sanitize → fence → tool-less karantenert transform → per-stadium capability-isolasjon → scan output før commit → fail-secure — som komponerbar, framework-agnostisk kode.

Referanse-implementasjon: claude-code-llm-wiki Stage B (tools/wiki_ingest/). Lexikon-seed: injection-patterns.mjs fra llm-security-pluginen.

Repoet er på v0.2 (alpha): stdlib-kjernen er bygget og testet (12 moduler + topp-nivå wiring, showcase + korpus), inkl. OKF-adapter og aktivt-innhold- detektor (EchoLeak-klassen) i output-gaten. Mode-b import_bundle skanner reserverte strukturfiler (index.md/log.md) i mottatte bundles i stedet for å path-avvise dem; upload-front-end beholder shadow-reject (allow_reserved=False). Start med docs/BRIEF.md for design, README.md for bruk, docs/PLAN.md for byggerekkefølgen.

Konvensjoner

Norsk for dialog og planer, engelsk for kode og innhold (repoet er publisert).
Ingen GitHub — kun Forgejo (git.fromaitochitta.com).
Remote satt: offentlig open/-speil på Forgejo; push hver commit (durabelt autorisert).
Minimal-dependency: stdlib-first kjerne; ML/judge-detektorer bak extras.

Communication patterns

Linking to local files

When pointing to local files in responses, always use markdown link syntax with a descriptive name:

Use [Human-friendly name](file:///absolute/path) — never bare file:///... URLs or autolinks <file://...>.
Always use absolute paths. Never ~/ or relative paths.
For multiple files, render as a bullet list of named markdown links.

Why: bare file:// URLs only render the first as clickable across multiple lines. Named markdown links make each entry independently clickable and look cleaner.

Example:

Brief