1
0
Fork 0
llm-ingestion-pipeline-secu.../docs
Kjell Tore Guttormsen 0903785187 release(0.6.1): the ZWJ fix gets a tag a consumer can pin
a59184b fixed a hard-block that reached every emoji-composed document, and
llm-ingestion-okf was told so -- while the fix sat untagged on main. A consumer
cannot pin what has no tag, so the notice was a promise the repo had not kept.

SURFACES MOVED (the eight the 0.5.0 sweep established, plus the ninth verified)

  pyproject.toml           0.6.0 -> 0.6.1
  __init__.py              0.6.0 -> 0.6.1
  CHANGELOG.md             [0.6.1] entry, [Unreleased] reset to "Nothing yet."
  README.md                badge, install tag @v0.6.1
  docs/ADOPTION-BRIEF.md   `v0.6.0` x2, and 727 -> 736 passing
  CLAUDE.md                one clause: ZWJ judged by context, not identity
  SECURITY.md              `0.6.x` -- still true at 0.6.1, verified, not moved
  docs/BRIEF.md            `v0.6 (alpha)` -- likewise
  README.md:36             `v0.6`, alpha -- likewise
  forge description        re-verified THIS release: 178 codepoints, no version
                           claim. Not inherited from 0.6.0's check.

PATCH, NOT MINOR -- and it was asked, not assumed. 6bcb898 made "loosens the
upload door" the criterion for minor, and this loosens it too, so the reading
was put to the operator with the count rather than settled quietly. 0.6.0 was a
policy choice (`<base>` left the active name set by decision); this restores a
contract the module already published, against a class never meant to be
blocked. Measured loosening: 1 document of 1126 across the three FP populations
(reference-corpus 1/389, vendor-harvest 0/187, generated-notes 0/550), against
0.6.0's 25 + 2 + 2. Operator chose patch.

VERIFIED ON THE BUMPED TREE, NOT THE PRE-BUMP ONE

  736 passed; coverage 128/128 recall, 6/6 documented gaps hold
  `git grep '0\.6\.0'` returns provenance only -- LIMITATIONS history, the
    census script, source docstrings, tests, README's pre-0.6.0 numbers
  docs/LIMITATIONS.md: 34 items, README says 34
  __version__ and pyproject agree at 0.6.1
  no tracked file carries a stale current-state version or test count

The sweep tool itself was wrong first: `git grep -E '\b727\b'` returns nothing,
because POSIX ERE has no `\b`. An empty result read as "clean" when the claim
was there. Every sweep above is plain `git grep`.

Still to prove before this is announced: a scratch-venv install at the tag with
the resolved version asserted -- the README line above is only true once v0.6.1
resolves.
2026-08-11 22:30:32 +02:00
..
ADOPTION-BRIEF.md release(0.6.1): the ZWJ fix gets a tag a consumer can pin 2026-08-11 22:30:32 +02:00
BRIEF.md release(0.6.0): the raw-html narrowing ships, and the version claims it already made become true 2026-08-11 18:01:36 +02:00
fp-sweep.py measure(fp): the upload door costs a human on 16-53% of benign documents 2026-08-10 21:32:56 +02:00
LIMITATIONS.md fix(zwj): the zero-width check tested identity, so every emoji-composed document was hard-blocked 2026-08-11 22:14:47 +02:00
OKF-INGESTION-BRIEF.md docs: version-sync + SECURITY/CONTRIBUTING + honest-limits (Session E) 2026-07-15 10:08:24 +02:00
PLAN-v1.md docs(plan): the v1.0 gate rested on okf's old pin, and its file list on four surfaces 2026-08-11 06:46:29 +02:00
PLAN.md fix(output): 19 quadratic regex runs on the output path, worst ~5.7h at the cap 2026-07-31 18:31:58 +02:00
rawhtml-census.py fix(active-content): raw-html graded two inert shapes HIGH, and the fix moved a second surface 2026-08-11 16:56:31 +02:00
redos-sweep.py fix(sanitize,okf,active_content): three quadratic patterns, two on the input path 2026-08-01 20:06:36 +02:00
review-2026-07.md docs: reframe novelty claim to composite write-time contract (review MAJOR #3) 2026-07-15 09:22:38 +02:00
URL-SHAPE.md docs(url-shape): make the rule reconstructable, and record what three corpora measured 2026-07-27 08:56:24 +02:00