Kjell Tore Guttormsen 0903785187 release(0.6.1): the ZWJ fix gets a tag a consumer can pin

a59184b fixed a hard-block that reached every emoji-composed document, and
llm-ingestion-okf was told so -- while the fix sat untagged on main. A consumer
cannot pin what has no tag, so the notice was a promise the repo had not kept.

SURFACES MOVED (the eight the 0.5.0 sweep established, plus the ninth verified)

  pyproject.toml           0.6.0 -> 0.6.1
  __init__.py              0.6.0 -> 0.6.1
  CHANGELOG.md             [0.6.1] entry, [Unreleased] reset to "Nothing yet."
  README.md                badge, install tag @v0.6.1
  docs/ADOPTION-BRIEF.md   `v0.6.0` x2, and 727 -> 736 passing
  CLAUDE.md                one clause: ZWJ judged by context, not identity
  SECURITY.md              `0.6.x` -- still true at 0.6.1, verified, not moved
  docs/BRIEF.md            `v0.6 (alpha)` -- likewise
  README.md:36             `v0.6`, alpha -- likewise
  forge description        re-verified THIS release: 178 codepoints, no version
                           claim. Not inherited from 0.6.0's check.

PATCH, NOT MINOR -- and it was asked, not assumed. 6bcb898 made "loosens the
upload door" the criterion for minor, and this loosens it too, so the reading
was put to the operator with the count rather than settled quietly. 0.6.0 was a
policy choice (`<base>` left the active name set by decision); this restores a
contract the module already published, against a class never meant to be
blocked. Measured loosening: 1 document of 1126 across the three FP populations
(reference-corpus 1/389, vendor-harvest 0/187, generated-notes 0/550), against
0.6.0's 25 + 2 + 2. Operator chose patch.

VERIFIED ON THE BUMPED TREE, NOT THE PRE-BUMP ONE

  736 passed; coverage 128/128 recall, 6/6 documented gaps hold
  `git grep '0\.6\.0'` returns provenance only -- LIMITATIONS history, the
    census script, source docstrings, tests, README's pre-0.6.0 numbers
  docs/LIMITATIONS.md: 34 items, README says 34
  __version__ and pyproject agree at 0.6.1
  no tracked file carries a stale current-state version or test count

The sweep tool itself was wrong first: `git grep -E '\b727\b'` returns nothing,
because POSIX ERE has no `\b`. An empty result read as "clean" when the claim
was there. Every sweep above is plain `git grep`.

Still to prove before this is announced: a scratch-venv install at the tag with
the resolved version asserted -- the README line above is only true once v0.6.1
resolves.

2026-08-11 22:30:32 +02:00

2.6 KiB

Raw Blame History

llm-ingestion-pipeline-security

Kontekst

Gjenbrukbar, minimal defensiv layer for LLM ingestion-pipelines (write-time), til forskjell fra query-time chatbot-guardrails. Pakker det arkitektoniske kontraktet — sanitize → fence → tool-less karantenert transform → per-stadium capability-isolasjon → scan output før commit → fail-secure — som komponerbar, framework-agnostisk kode.

Referanse-implementasjon: claude-code-llm-wiki Stage B (tools/wiki_ingest/). Lexikon-seed: injection-patterns.mjs fra llm-security-pluginen.

Repoet er på v0.6 (alpha): stdlib-kjernen er bygget og testet (15 moduler + topp-nivå wiring, showcase + korpus), inkl. OKF-adapter og aktivt-innhold- detektor (EchoLeak-klassen) i output-gaten. Mode-b import_bundle skanner reserverte strukturfiler (index.md/log.md) i mottatte bundles i stedet for å path-avvise dem; upload-front-end beholder shadow-reject (allow_reserved=False). Output-gatens decode-and-rescan mater dekodet base64-klartekst gjennom BÅDE lexicon og secret-egress (LLM02), så en base64-innpakket credential fanges som decoded:egress:* i stedet for å forsvinne; hex-innpakket er en dokumentert restgap (entropy eksponerer kun base64-klartekst). active:raw-html krever nå et EKSTERNT mål på URL-attributt-grenen, og <base> er ute av det aktive navnesettet; scanner og mutator har hver sin predikat (is_active_tag / is_defangable_tag). ZWJ (U+200D) dømmes på KONTEKST, ikke identitet — unntas kun mellom to emoji, på begge flater (sanitize eier predikatet, output importerer det). Start med docs/BRIEF.md for design, README.md for bruk, docs/PLAN.md for byggerekkefølgen.

Konvensjoner

Norsk for dialog og planer, engelsk for kode og innhold (repoet er publisert).
Ingen GitHub — kun Forgejo (git.fromaitochitta.com).
Remote satt: offentlig open/-speil på Forgejo; push hver commit (durabelt autorisert).
Minimal-dependency: stdlib-first kjerne; ML/judge-detektorer bak extras.

Communication patterns

Linking to local files

When pointing to local files in responses, always use markdown link syntax with a descriptive name:

Use [Human-friendly name](file:///absolute/path) — never bare file:///... URLs or autolinks <file://...>.
Always use absolute paths. Never ~/ or relative paths.
For multiple files, render as a bullet list of named markdown links.

Why: bare file:// URLs only render the first as clickable across multiple lines. Named markdown links make each entry independently clickable and look cleaner.

Example:

Brief