# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

Versioning note: the repository tag versions **the contract** (file set, key names,
case ids, disposition semantics). Each JSON file additionally carries its own
`"version"` field, bumped when that file changes.

## [Unreleased]

Initial extraction, in progress. Runtime-neutral detection data and the finding contract,
extracted from the `llm-security` Node implementation and a Python guard without behaviour
change. **Not yet tagged** — see *Not included* below.

### Added

- `schema/finding.schema.json` — the finding contract plus the SARIF output profile.
  Normative. The JSONL profile is deliberately left `unspecified`.
- `signatures/active-content.json` — the EchoLeak class (CVE-2025-32711): 17 patterns,
  severities, opacity floors and pass order, from the Python guard.
- `lexicon/injection-lexicon.json` — 83 prompt-injection patterns in four families
  (21 critical, 32 high, 22 medium, 8 hybrid).
- `codepoints/carriers.json` — six carrier tables: zero-width characters, the Unicode Tags
  block, the Supplementary Private Use Areas, BIDI controls, the Cyrillic presence set and
  the 28-entry fold-to-Latin homoglyph map.
- `signatures/secret-egress.json` — the 18 fixed credential and token shapes. Array order
  is normative.
- `mapping/owasp-map.json` — four taxonomy maps (LLM, ASI, AST, MCP) over one shared
  16-prefix key set.
- `calibration/calibration.json` — risk-score tier constants, verdict thresholds, risk-band
  cutoffs, posture grade thresholds.

### Verification

Every file above except `calibration.json` was proven rather than transcribed: the data was
rebuilt **from the commons JSON alone** and diffed against the source implementation. Each
file records its own result and its own limits.

`calibration/calibration.json` carries `verified: false`. Its source arrived as a prose
summary rather than as code, so no differential check was possible, and the file names the
checks that were not run instead of attaching a caveat to a pass.

### Not included

- `signatures/malware-signatures.json` — seed data not yet delivered.
- `spec/decode-pipeline.md` — needs the decode implementation. A normative spec inferred
  from a data dump would be worse than an absent one.
- `conformance/` — the corpus form is an open decision: the Python guard's coverage matrix
  is probe-based rather than a static input/expected table.

These are named in the README as planned rather than linked, so nothing in the repository
points at a file that does not exist.