open/llm-security-commons
1
0
Fork 0
Code Issues Releases 1 Activity

docs(manifest): the precision field stated its exposure as a hand-derived count

Browse source 
0.8.0 added a field whose whole purpose is precision, and bounded the exposure
with "three of the four dimensions ... cannot move one of these cases at all".
The total was derived by hand over a taxonomy the field had itself
recategorized. Lexicon entries ARE one of the seed runtime's four calibration
dimensions, and they are not absent from these fixtures: two of the seven carry
a lexicon id in observed_out_of_scope. And "the fourth" substituted the
classification for lexicon entries as the fourth item of their sentence.

manifest 0.6.0 -> 0.6.1: the field enumerates three named things and totals
none of them. A lexicon change ages the residue as evidence without moving a
verdict (spec section 5); the classification is the one that can move one.
Retired sentence quoted in an AMENDED IN clause, not dropped.

No measurement changed, no verdict moved, no case or data file touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yZobrgUiRtpLSWx8i7u2Z
This commit is contained in:
Kjell Tore Guttormsen 2026-08-13 23:15:10 +02:00
commit c75c546614
2 changed files with 34 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

32
CHANGELOG.md
View file

@ -9,6 +9,38 @@ Versioning note: the repository tag versions **the contract** (file set, key nam
case ids, disposition semantics). Each JSON file additionally carries its own
`"version"` field, bumped when that file changes.
## [0.8.1] — 2026-08-13
**The field 0.8.0 added to make the exposure precise stated it with a hand-derived count, and the
count was wrong.** Caught in the same session, before any consumer read it, and corrected inside
the field rather than by rewriting it. No measurement changed and no verdict moved.
### Fixed
- **`conformance/manifest.json` 0.6.0 → 0.6.1 —
`active_content_provenance.pins_a_version_not_a_frozen_classification` now enumerates instead of
totalling.** As published it read *"three of the four dimensions they name as calibration cannot
move one of these cases at all. The fourth can: which `active:` ids a payload yields IS the
classification"*. Two defects in one sentence. First, the total was derived by hand over a
taxonomy the field had itself recategorized: the seed runtime's four calibration dimensions are
severities, thresholds, **lexicon entries** and dispositions, and lexicon entries are *not* absent
from these fixtures — `active__data-uri` carries `data-uri:executable` and `active__raw-html`
carries `hybrid-xss:script-tag` in `observed_out_of_scope`, both verified as members of
`lexicon/injection-lexicon.json` and non-members of `signatures/active-content.json`. Second,
*"the fourth"* silently substituted the classification for lexicon entries as the fourth item of
their sentence, which it is not — the classification is what they addressed separately.
- The replacement names three things and totals none of them: severities/thresholds/dispositions
are absent and move no verdict; lexicon entries move no verdict either — spec section 5 forbids
failing a runtime over `observed_out_of_scope` — but a lexicon calibration change **ages** those
two entries as evidence, which is the exposure
`active_content_measurement_0_7_0.movement_sweep.residue_is_the_field_no_test_protects` already
names as a class, and this corpus pins a stale residue entry rather than rewriting it; and the
active-content classification is the one thing that can move a verdict. The retired sentence is
**quoted** in the field's `AMENDED IN 0.6.1` clause, not merely dropped, for the same reason
`scope_planned.$comment` quotes what it retired: a correction that does not say what it corrects
cannot be audited.
## [0.8.0] — 2026-08-13
**The seven active-content fixtures pin a VERSION of the seed runtime, and nothing said so.**