open/llm-security-commons
1
0
Fork 0
Code Issues Releases 1 Activity

fix(spec): section 7 stated its own premise and then applied itself beyond it

Browse source 
Section 7 justified the fixture-is-ground-truth ordering with "Two
implementations that return different verdicts" and then stated the rule
with no scope. For signatures/active-content.json there is no second
implementation, and the seed runtime has stated the classification behind
it is calibration it does not freeze. As written, section 7 turned a change
they reserved into a bug on their side.

New section 7.1 keys the scope on a structural property, never on a table
name: a scope only one runtime implements, whose payload that runtime
authored. It creates no fourth verdict - the declaration schema closes
result with additionalProperties:false over four counts, so a fifth would
break every consumer's parser. The case still fails and is still named in
failed_cases; what changes is what the failure licenses concluding.

Two limits are stated rather than left to inference: it does not reach a
third-party implementer of the same table, and it is not a licence for a
runtime to self-declare its own divergence as calibration.

manifest.json 0.6.1 -> 0.6.2 retires the open-question sentence, quoted
rather than dropped. The retirement is partial: "section 7 is NOT amended
by this block" stays true, because the spec was amended by its own release.

Neighbours measured over the whole repository, widened past "ground truth"
to the second paragraph's own wording. CONVENTIONS.md and CLAUDE.md carried
the premise and are changed; SECURITY.md gets a cross-reference only, since
its claim is about a fixture expecting too little and 7.1 does not narrow
that direction; README.md and docs/extraction-plan.md are named as
deliberately untouched.

Breaking in category, minor in number - 0.x, per the reading [0.3.0]
recorded.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012pZ2FLQ6xkWvj2VcwgwnQv
This commit is contained in:
Kjell Tore Guttormsen 2026-08-13 23:31:28 +02:00
commit f0a511369d
6 changed files with 157 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

7
CLAUDE.md
View file

@ -65,6 +65,13 @@ Ingen. Data + prosa. Filformater: JSON (data + schema), Markdown (spec), rå tek
- `expected.json` er ground truth. Er en runtime uenig med `expected.json`, er runtimen
feil — med mindre fixturen selv bevises feil, og da endres fixturen i eget commit med
begrunnelse.
- **Regelen over er skopet, og skopet er bærende.** Er casens scope en tabell bare ÉN runtime
implementerer, og den runtimen skrev payloaden, finnes ikke den andre implementasjonen
regelen dømmer mellom. Da er en divergens fra *den* runtimen verken en bevist feil fixture
eller nødvendigvis deres bug: fixturen skrives ikke om på divergensen alene, den føres mot
versjonen som er pinnet, og re-pinning er en egen release. Mot en TREDJEPARTS-implementasjon
av samme tabell gjelder §7 uendret. Til og med `v0.8.1` sto regelen uskopet. Se
`spec/conformance-corpus.md` §7.1.
- **En case er ikke mintbar uten inngangspunkt for sitt scope.** Korpuset pinner ikke
lenger ett inngangspunkt per runtime for alt — `manifest.json` →
`entry_points_by_scope` bærer inngangspunkt, **findings-accessor** og