Kjell Tore Guttormsen
0af8f68cae
Module 11 (final) — the top-level wiring. The library never makes the model call (no SDK imported by the core), so the public surface is the toolkit plus two library-side bookends around the caller's tool-less transform (Form 1, chosen with the operator over an export-only toolkit and a full orchestrator — the bookends fit existing pipelines with least friction, encode the two halves the library can stand for, and impose no control flow): - prepare_input(text, source=INPUT) -> PreparedInput(fenced, nonce, report): §6 steps 1-2, sanitize THEN fence (carrier can never smuggle a forged delimiter). Merged report carries both steps' findings; renders no disposition. - screen_output(text, policy, *, provenance, transform_failed) -> DispositionResult: §6 steps 6-7, scan_output under guard() so a scanner error fails CLOSED (FAIL_SECURE, never a silent persist). transform_failed routes the compound forced-fallback rule. - __all__ exports the full framework-agnostic surface: detectors, result types, disposition machinery + presets, contract asserters, the grounding seam. Docs: README refreshed from the stale "brief / pre-implementation" line to a v0.1 alpha status with a Form-1 quickstart, the §6 adopt-this checklist, and an honest -limitations section (structural unsolvability at the text layer; semantic poisoning invisible to lexicon+entropy; text-only, no multimodal). CHANGELOG seeded; CLAUDE.md remote/status lines corrected (remote IS set, no longer brief-stage). 10 wiring tests (public surface, prepare_input compose, screen_output fail-closed + compound). 189 green (showcase + corpora follow). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HyRCQMocjZ6SmSQ6JidJ2k
31 lines
1.6 KiB
Markdown
31 lines
1.6 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to this project will be documented in this file.
|
|
|
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
|
|
## [Unreleased] — v0.1.0 (alpha)
|
|
|
|
The stdlib-only core, built test-first (TDD) per `docs/PLAN.md`.
|
|
|
|
### Added
|
|
|
|
- `report` — shared `Finding` / `Report` / `Severity` / `Source` types.
|
|
- `sanitize` — carrier stripping (zero-width, BIDI, Unicode-tag, HTML comment,
|
|
`data:`); byte-identical on clean input.
|
|
- `entropy` — Shannon / base64-like / hex-blob detection; base64 decode-and-rescan.
|
|
- `lexicon` — JSON pattern data + loader; raw/normalized/homoglyph/rot13 variants;
|
|
ReDoS-bounded, size-capped.
|
|
- `fence` — randomized per-call spotlight delimiter; attacker marker-strip.
|
|
- `neutralize` — opt-in defang of active-content output (byte-identical when clean).
|
|
- `output` — compose lexicon + entropy + decode-rescan over emitted text; secret
|
|
egress patterns (OWASP LLM02); report-only, never mutates.
|
|
- `disposition` — WARN | QUARANTINE_REVIEW | FAIL_SECURE under a source-trust
|
|
policy; compound-signal escalation; fail-**closed** when the scanner errors.
|
|
- `contract` — write-time asserters that raise: `assert_tool_less`,
|
|
`assert_credential_allowlist`, `scoped_env`.
|
|
- `grounding` — the `SourceGroundingCheck` seam for semantic poisoning (interface
|
|
only; `[judge]` implementation plugs in behind an extra).
|
|
- Top-level wiring — the `prepare_input` / `screen_output` §6 bookends plus the
|
|
full public surface; end-to-end showcase and adversarial + false-positive corpora.
|