open/llm-security-commons
1
0
Fork 0
Code Issues Releases 1 Activity
llm-security-commons/conformance
History
Kjell Tore Guttormsen 4356caa689 fix(manifest): the egress blocker named a premise the measurement falsified 
`scope_planned.blockers` for secret egress read "19 entries … 25 at different cut
points" — one table cut at two granularities, waiting on a reconciliation of two
ports. `docs/secret-egress-divergence.md` (2d9ee9c, corrected in 4a6f6ff) measured
otherwise: they are ports of two different source tables in the same source
repository, so reconciling the ports was never going to close it.

Replaced with the three measured, independent reasons: no id space on the commons
side (seed A carries name+pattern only, and a fixture names labels); match
semantics disagree (first-match-wins against finditer over all 25 — one label
against two on the Bearer+JWT witness); membership diverges both ways and is
inherited from two different seeds, so re-measuring either port cannot close it.
Only the first is the outgoing question; the other two stand whatever the answer.

Two hand-carried numbers in the retired text corrected in place: aws-access-key-id
was not the one clean 1:1 (2/19 byte-identical, AWS not among them — the guard
anchors with \b), and `GitHub Token` maps to three guard ids, not four, leaving
ghu_ and ghr_ uncovered. `scope_planned.$comment` said "a distinct unresolved
question" — singular — and is amended alongside.

Measured here, not transcribed: `entry_points_by_scope.scopes` carries no entry for
signatures/secret-egress.json at all. Recorded as a standing requirement, not as a
fourth reason. No id string is proposed; checked against both outgoing coord
messages of 2026-08-13. No case, no signature table and no other data file touched.

conformance/manifest.json 0.5.0 -> 0.5.1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016inh17NCrQpWN3mrghfJgT
2026-08-13 22:46:15 +02:00
..
active__autolink feat(conformance): ship the six active-content cases; the id space already existed 2026-08-10 21:15:25 +02:00
active__data-uri feat(conformance): ship the six active-content cases; the id space already existed 2026-08-10 21:15:25 +02:00
active__markdown-image feat(conformance): ship the six active-content cases; the id space already existed 2026-08-10 21:15:25 +02:00
active__markdown-link feat(conformance): ship the six active-content cases; the id space already existed 2026-08-10 21:15:25 +02:00
active__raw-html feat(conformance): ship the six active-content cases; the id space already existed 2026-08-10 21:15:25 +02:00
active__raw-html-link feat(active-content): the seventh case, and the classifier it needed came with it 2026-08-13 21:43:27 +02:00
active__reference-link feat(conformance): ship the six active-content cases; the id space already existed 2026-08-10 21:15:25 +02:00
carrier__bidi-override feat(carriers): three cases minted, and the id is named rather than adopted 2026-08-13 21:17:44 +02:00
carrier__unicode-tag feat(carriers): three cases minted, and the id is named rather than adopted 2026-08-13 21:17:44 +02:00
carrier__zero-width feat(carriers): three cases minted, and the id is named rather than adopted 2026-08-13 21:17:44 +02:00
config__bypass-safety fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
config__disable-filtering fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
config__ignore-claudemd fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
config__override-system-prompt fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
data-uri__executable fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__academic-context fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__educational fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__fictional fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__hypothetical fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__red-team fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__research-purpose fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__security-audit-sim fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__test-pretense fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__thought-experiment fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hidden-comment__agent-directed fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__approve-immediately fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__brevity-skip fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__details-omitted fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__just-approve fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__no-need-review fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__scope-minimization fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__suppress-review fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__too-long fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
homoglyph__cyrillic-latin-mix fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__aria-label fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__display-none fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__offscreen fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__visibility-hidden fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__zero-font fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__zero-opacity fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__zero-size-overflow fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-p2sql__inject-sql fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-p2sql__sql-inject fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-recursive__conditional-response fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-recursive__inject-output fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-xss__event-handler fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-xss__iframe-src fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-xss__javascript-uri fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-xss__script-tag fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-xss__script-tag--src-no-close feat(conformance): the witness case, and the derivation rule that had no room for it 2026-08-11 13:39:19 +02:00
identity__new-directive fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
identity__new-role fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
identity__no-longer fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
identity__pretend fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
identity__you-are-now fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
indirect__direct-address fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
indirect__instruction-to-ai fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
indirect__trigger-based fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
leetspeak__disregard fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
leetspeak__forget-instructions fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
leetspeak__ignore-previous fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
leetspeak__override fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
markdown__link-anchor-injection fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
markdown__link-ref-comment fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
multi-lang__french fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
multi-lang__german fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
multi-lang__spanish fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
nl-indirection__download-execute fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
nl-indirection__extract-exfiltrate fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
nl-indirection__fetch-execute fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
nl-indirection__read-dotfile fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
nl-indirection__send-external fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
normalization__claudemd-conflict fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
normalization__prioritize-user fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
normalization__skip-confirmation fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
normalization__user-precedence fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
override__disregard fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
override__forget-instructions fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
override__ignore-previous fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
override__override-instructions fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
override__prior-constraints fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
override__suspend-constraints fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
reframing__actual-task fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
reframing__real-purpose fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
reframing__should-actually-do fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
spoofed-header__hash-system fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
spoofed-header__inst fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
spoofed-header__instructions fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
spoofed-header__pipe-system fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
spoofed-tag__system-close fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
spoofed-tag__system-open fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
sub-agent__delegate-bypass fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
sub-agent__spawn-dangerous fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
unicode__zero-width-in-word fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
manifest.json fix(manifest): the egress blocker named a premise the measurement falsified 2026-08-13 22:46:15 +02:00