- Python 100%
Kjell Tore Guttormsen
1e63643157
Module 10 of the build order — interface only in the stdlib core (PLAN §67/§94, BRIEF §7/§10). lexicon and entropy see surface signals; they are structurally blind to semantic poisoning — a factually false or subtly biased claim, in clean prose, carrying no suspicious token. Catching that needs grounding against a source of truth (embedding classifier, retrieval check, LLM judge) — a model call, and models never live in this core. So this module ships exactly two things and no detector logic: - SourceGroundingCheck: the text -> Report protocol a [judge] implementation must satisfy to plug in. runtime_checkable for a coarse callable-vs-not isinstance gate; a conforming impl may be a plain function or a stateful callable holding a retriever/client — the grounding source of truth is the impl's concern, never a seam parameter. Its findings flow through disposition like any other detector's, with zero grounding-specific plumbing. - no_grounding_check (bound as DEFAULT_GROUNDING_CHECK): the pass-through default returning an empty Report. The honest scope note made structural — semantic poisoning is not solved at the text layer, and the core does not pretend to. Design choice, tested: the default returns NO finding (not an INFO "unchecked" marker). An INFO finding would flip every artifact to found and trip the quarantine_default floor in disposition, quarantining every upload for a check that never ran. The seam stays silent; the honesty lives in the contract. 8 new tests (pass-through empties, silence on semantic poison, protocol conformance incl. a stateful judge stub, and a composition test proving a plugged-in check's HIGH finding fails secure through disposition unchanged); 169 green total. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HyRCQMocjZ6SmSQ6JidJ2k |
||
|---|---|---|
| docs | ||
| src/llm_ingestion_guard | ||
| tests | ||
| .gitignore | ||
| CHANGELOG.md | ||
| CLAUDE.md | ||
| LICENSE | ||
| pyproject.toml | ||
| README.md | ||
llm-ingestion-pipeline-security
A reusable, minimal, dependency-light defensive layer for LLM ingestion pipelines — the write-time siblings of query-time chatbot guardrails.
Where mature guardrails (LLM Guard, NeMo Guardrails, Rebuff, Vigil, …) sit between a user and a model at query time, this library hardens the other shape: untrusted content flowing through an LLM enrichment/summarization/extraction step into a persisted, downstream-consumed artifact (RAG corpus, knowledge base, wiki). It packages the architectural contract — sanitize → fence → tool-less quarantined transform → per-stage capability isolation → scan output before commit → fail-secure — as composable, framework-agnostic code.
Status: brief / pre-implementation. Start with the design brief:
- Design brief — what this repo should contain and why.
The contract is extracted from a working reference implementation (the
claude-code-llm-wiki Stage B enrichment pipeline).