open/llm-security-commons
1
0
Fork 0
Code Issues Releases 1 Activity
llm-security-commons/conformance
History
Kjell Tore Guttormsen 25a2cf9643 feat(conformance): the witness case, and the derivation rule that had no room for it 
conformance/hybrid-xss__script-tag--src-no-close/ — input `<script src=x.js>`,
17 bytes, expecting hybrid-xss:script-tag. This is the regression gate for the
convergence in the previous commit, and the reason the corpus could not see that
change coming: the existing hybrid-xss__script-tag input `<script>steal()</script>`
matches the pattern under BOTH forms, so it passes either way.

Mutation-verified in both directions across all 90 cases: reverting the pattern to
its 0.6.0 form fails this case and only this case.

The case-id derivation blocked it, and the fix is an extension rather than a
workaround. case_id_derivation gains an optional `--<variant>` suffix; the reverse
transform truncates at the first `--` then maps `__` to `:`. `--` was measured
absent from all 83 ratified pattern ids and all 89 pre-existing case ids, so the
reverse transform stays purely lexical — no lookup against the id list — which is
the property the original one-to-one rule was protecting. No existing case id
moves, so this is additive.

one_case_per_pattern_id is removed, superseded by variant_suffix.supersedes, which
quotes its text. It documented the constraint rather than carrying data a consumer
matches on, but a removed key is normally breaking here, so it is called out.

That same rule cost a real case: omitted_payloads gains
derivation_ground_withdrawn_in_0_3_0. The guard's seventh active-content payload
was omitted on TWO grounds and this change retires one. The other stands — its
in-scope finding set is identical to a case already built — so the payload stays
omitted, on one ground instead of two. It is NOT added back; that is a separate
decision, not a consequence of this one.

First case input authored in this repository rather than reproduced verbatim from
a runtime's payload set, so it goes in a new authored_payloads block instead of
being folded into payload_provenance, whose value is exactly the claim that its
inputs are verbatim upstream. That claim stays as strong as it was: 83 of 83.

Both witnesses for this axis were named by llm-security on 2026-08-10; this is the
first of the two. It was declined that day on the ground that a fixture encoding a
DISAGREEMENT is worse than an absent one — it then contradicted commons' own
published lexicon. Lexicon 0.7.0 removed the contradiction. The stated order was
"settle the row, then the case is trivial to add".

Findings measured through the guard's public API (scan_lexicon,
scan_active_content) at 0dce50f / 0.5.0 — not read off the regex. The same harness
reproduced the existing case's committed bytes and sha256 in the same run as a
control, which is what licenses trusting its output for the new one. Digest
independently recomputed with shasum over the file on disk: agrees.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HuudQLGMyMenuyeZk8fKs5
2026-08-11 13:39:19 +02:00
..
active__autolink feat(conformance): ship the six active-content cases; the id space already existed 2026-08-10 21:15:25 +02:00
active__data-uri feat(conformance): ship the six active-content cases; the id space already existed 2026-08-10 21:15:25 +02:00
active__markdown-image feat(conformance): ship the six active-content cases; the id space already existed 2026-08-10 21:15:25 +02:00
active__markdown-link feat(conformance): ship the six active-content cases; the id space already existed 2026-08-10 21:15:25 +02:00
active__raw-html feat(conformance): ship the six active-content cases; the id space already existed 2026-08-10 21:15:25 +02:00
active__reference-link feat(conformance): ship the six active-content cases; the id space already existed 2026-08-10 21:15:25 +02:00
config__bypass-safety fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
config__disable-filtering fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
config__ignore-claudemd fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
config__override-system-prompt fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
data-uri__executable fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__academic-context fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__educational fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__fictional fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__hypothetical fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__red-team fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__research-purpose fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__security-audit-sim fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__test-pretense fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
evasion__thought-experiment fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hidden-comment__agent-directed fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__approve-immediately fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__brevity-skip fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__details-omitted fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__just-approve fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__no-need-review fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__scope-minimization fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__suppress-review fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hitl-trap__too-long fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
homoglyph__cyrillic-latin-mix fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__aria-label fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__display-none fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__offscreen fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__visibility-hidden fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__zero-font fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__zero-opacity fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
html-obfuscation__zero-size-overflow fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-p2sql__inject-sql fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-p2sql__sql-inject fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-recursive__conditional-response fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-recursive__inject-output fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-xss__event-handler fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-xss__iframe-src fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-xss__javascript-uri fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-xss__script-tag fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
hybrid-xss__script-tag--src-no-close feat(conformance): the witness case, and the derivation rule that had no room for it 2026-08-11 13:39:19 +02:00
identity__new-directive fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
identity__new-role fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
identity__no-longer fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
identity__pretend fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
identity__you-are-now fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
indirect__direct-address fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
indirect__instruction-to-ai fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
indirect__trigger-based fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
leetspeak__disregard fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
leetspeak__forget-instructions fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
leetspeak__ignore-previous fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
leetspeak__override fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
markdown__link-anchor-injection fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
markdown__link-ref-comment fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
multi-lang__french fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
multi-lang__german fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
multi-lang__spanish fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
nl-indirection__download-execute fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
nl-indirection__extract-exfiltrate fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
nl-indirection__fetch-execute fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
nl-indirection__read-dotfile fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
nl-indirection__send-external fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
normalization__claudemd-conflict fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
normalization__prioritize-user fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
normalization__skip-confirmation fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
normalization__user-precedence fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
override__disregard fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
override__forget-instructions fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
override__ignore-previous fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
override__override-instructions fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
override__prior-constraints fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
override__suspend-constraints fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
reframing__actual-task fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
reframing__real-purpose fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
reframing__should-actually-do fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
spoofed-header__hash-system fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
spoofed-header__inst fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
spoofed-header__instructions fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
spoofed-header__pipe-system fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
spoofed-tag__system-close fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
spoofed-tag__system-open fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
sub-agent__delegate-bypass fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
sub-agent__spawn-dangerous fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
unicode__zero-width-in-word fix(conformance): name the fixture field pattern_id, not id — the schema already owns that word 2026-08-10 04:44:59 +02:00
manifest.json feat(conformance): the witness case, and the derivation rule that had no room for it 2026-08-11 13:39:19 +02:00