Kjell Tore Guttormsen
0772dafb70
A received OKF bundle MAY legitimately carry index.md (directory listing, read first under progressive disclosure) and log.md (update history) at any level (spec §3.1/§6/§7). import_bundle previously hard-rejected those basenames in the T4 path gate, so a conformant third-party bundle was over-blocked in full (FAIL_SECURE) — and because the reject fired before scan_concept, index.md's body (the highest-priority injection surface) was never scanned. import_bundle now defaults allow_reserved=True: reserved basenames are scanned as structural files (path-safety checks — traversal / absolute / backslash / .md — still apply). The shadow-reject (an *upload* masquerading as index.md) is preserved: the front-end passes allow_reserved=False so a materialized upload landing on a reserved basename is still refused. That front-end opt-in was required to keep the shadow-reject once the default flipped (not in the plan's Filer set; traced from the code). - okf.py: validate_concept_path/_validate_concept/import_bundle gain the keyword; validate_concept_path default stays False (strict standalone). - tests: +3 (legit index/log admit; injection in index.md body caught; okf_version frontmatter admits). Per-concept-iteration test switched to a traversal vector; mode-b showcase's index.md surface reframed from reserved-name-reject to index.md-body-scan. - README honest-limits + CLAUDE.md context note the mode-b/upload distinction. Suite: 341 -> 344 passed. Core invariant intact (dependencies=[]).
43 lines
2 KiB
Markdown
43 lines
2 KiB
Markdown
# llm-ingestion-pipeline-security
|
|
|
|
## Kontekst
|
|
|
|
Gjenbrukbar, minimal defensiv layer for LLM **ingestion**-pipelines (write-time),
|
|
til forskjell fra query-time chatbot-guardrails. Pakker det arkitektoniske
|
|
kontraktet — sanitize → fence → tool-less karantenert transform → per-stadium
|
|
capability-isolasjon → scan output før commit → fail-secure — som komponerbar,
|
|
framework-agnostisk kode.
|
|
|
|
Referanse-implementasjon: `claude-code-llm-wiki` Stage B (`tools/wiki_ingest/`).
|
|
Lexikon-seed: `injection-patterns.mjs` fra `llm-security`-pluginen.
|
|
|
|
Repoet er på **v0.2 (alpha)**: stdlib-kjernen er bygget og testet (12 moduler +
|
|
topp-nivå wiring, showcase + korpus), inkl. OKF-adapter og aktivt-innhold-
|
|
detektor (EchoLeak-klassen) i output-gaten. Mode-b `import_bundle` skanner
|
|
reserverte strukturfiler (`index.md`/`log.md`) i mottatte bundles i stedet for å
|
|
path-avvise dem; upload-front-end beholder shadow-reject (`allow_reserved=False`).
|
|
Start med `docs/BRIEF.md` for design, `README.md` for bruk, `docs/PLAN.md` for
|
|
byggerekkefølgen.
|
|
|
|
## Konvensjoner
|
|
|
|
- Norsk for dialog og planer, engelsk for kode og innhold (repoet er publisert).
|
|
- Ingen GitHub — kun Forgejo (`git.fromaitochitta.com`).
|
|
- Remote satt: offentlig `open/`-speil på Forgejo; push hver commit (durabelt autorisert).
|
|
- Minimal-dependency: stdlib-first kjerne; ML/judge-detektorer bak extras.
|
|
|
|
## Communication patterns
|
|
|
|
### Linking to local files
|
|
|
|
When pointing to local files in responses, always use markdown link syntax with a descriptive name:
|
|
|
|
- Use `[Human-friendly name](file:///absolute/path)` — never bare `file:///...` URLs or autolinks `<file://...>`.
|
|
- Always use absolute paths. Never `~/` or relative paths.
|
|
- For multiple files, render as a bullet list of named markdown links.
|
|
|
|
Why: bare `file://` URLs only render the first as clickable across multiple lines. Named markdown links make each entry independently clickable and look cleaner.
|
|
|
|
Example:
|
|
|
|
- [Brief](file:///Users/ktg/repos/llm-ingestion-pipeline-security/docs/BRIEF.md)
|