open/llm-security-commons
1
0
Fork 0
Code Issues Releases 1 Activity
1 release 17 tags
  • v0.4.3 7ce0ba706c

    v0.4.3 Stable

    ktg released this 2026-08-11 20:34:04 +00:00 | 13 commits to main since this release

    No fixture, id or expected.json moved — a runtime that passes 0.4.2 passes 0.4.3
    unchanged. What changed is a claim this repository made about a runtime it does not own, and the
    claim was wrong on the day it was written.

    Fixed

    • conformance/manifest.json 0.3.2 → 0.3.4 — the scope_planned.blockers entry for
      codepoints/carriers.json described the guard as emitting two stage-coupled labels per carrier,
      "the same split for bidi and unicode-tag". The artifact-side label for tags is
      lexicon:unicode-tags-present, emitted from lexicon.py, and output.py carries a comment
      saying it deliberately does not repeat it there. Wrong when written, not stale: checked at
      e671edb — the commit the sibling secret-egress blocker was measured against — where
      coverage.py already asserted that label, and re-measured at a59184b.

      The correction moves the blocker rather than removing it. The guard's Finding carries a
      detector field beside label, and the prefix is that field's value: detector="lexicon" on
      lexicon:unicode-tags-present, "output" on output:zero-width-present. The prefix names
      the detector, not the pipeline stage       — and for tags a single detector serves both entry
      points, which is why there is no sixth output: label to find. "A commons id would have to be
      invented stage-neutral" was never the problem. Six labels exist to adopt verbatim, the way the
      83 lexicon ids were adopted from this same runtime's port.

      What blocks adoption is measured and named instead, at llm-security 47905da: sanitize:
      asserts a strip that runtime does not perform (scanners/unicode-scanner.mjs exports one entry
      point, scan(targetPath, discovery), reporting presence with scanner: 'UNI', a prose title
      and no id); three of the six name a persist gate it does not have, which the corpus already has
      a verdict for — §1.1 not-applicable, attaching to a declared table — but which
      publishing the alias is what takes away: that runtime's suite walks each vendored file for
      any node carrying aliases.llm_security and asserts every registered table is declared, so one
      aliased carrier id forces codepoints/carriers.json into a declared set of what is today the
      lexicon alone, obliging it to run all six cases and converting the three artifact-side ones into
      failures; and the entry point pinned for it in measurement.runtimes (scanForInjection) does not
      reach carriers at all, so carrier cases need a per-scope entry point this manifest expresses
      nowhere. Both runtimes already build their carrier sets from codepoints/carriers.json, so the
      divergence is in what a finding is called and where it can be observed, never in which code
      points are carriers.

    Asked, not decided

    • The three objections went to both runtimes over coord on 2026-08-11 as a decision request, each
      asked the question only it can answer. Nothing was minted. A case id is contract surface
      consumers pin against, and publishing a single carrier alias is itself irreversible — it widens
      another runtime's declared table set by force of that runtime's own test suite. Minting first
      would have made a proposal into a fait accompli. The manifest records the request, so a later
      reader can tell "asked, unanswered" from "nobody asked".

    • A correction followed the request the same day, on our own error. The request asserted that
      the corpus had no third verdict for a case a runtime cannot reach. It has one — §1.1
      not-applicable — and this repository wrote that section. The question was put before its own
      normative spec was re-read; the follow-up says so to both runtimes and restates the choice as
      mint-input-side-only, accept three standing failures, or publish a guard-only id space with no
      llm_security alias at all.

    Downloads