Kjell Tore Guttormsen 4742c067a8 docs: unlink the three files that do not exist yet, correct the changelog

repo-standard's gate flagged 10 dead internal README links. Seven now
resolve because the files landed this session. The remaining three are
unlinked and marked "Planned, not in v0.1.0" rather than invented:

- signatures/malware-signatures.json — seed data not delivered
- spec/decode-pipeline.md — needs the decode implementation, which is engine
  code and was not supplied. A normative spec guessed from a data dump would
  be worse than an absent one: it would carry a Status: normative marker and
  pass every convention check while saying nothing anyone verified.
- conformance/ — corpus form is still an open decision

The changelog claimed 0.1.0 shipped "a conformance corpus". It does not.
Rewritten to enumerate what is actually present, to state which files were
proven differentially and which one (calibration) carries verified: false,
and to name what is not included. Moved back under [Unreleased] because the
tag has not been cut.

README also now tells a reader that each data file records its own provenance
and verification strength, and which file currently says false.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FaYqid3mejFmd9ZHsiHgp3

2026-08-09 21:15:54 +02:00

2.7 KiB

Raw Blame History

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Versioning note: the repository tag versions the contract (file set, key names, case ids, disposition semantics). Each JSON file additionally carries its own "version" field, bumped when that file changes.

[Unreleased]

Initial extraction, in progress. Runtime-neutral detection data and the finding contract, extracted from the llm-security Node implementation and a Python guard without behaviour change. Not yet tagged — see Not included below.

Added

schema/finding.schema.json — the finding contract plus the SARIF output profile. Normative. The JSONL profile is deliberately left unspecified.
signatures/active-content.json — the EchoLeak class (CVE-2025-32711): 17 patterns, severities, opacity floors and pass order, from the Python guard.
lexicon/injection-lexicon.json — 83 prompt-injection patterns in four families (21 critical, 32 high, 22 medium, 8 hybrid).
codepoints/carriers.json — six carrier tables: zero-width characters, the Unicode Tags block, the Supplementary Private Use Areas, BIDI controls, the Cyrillic presence set and the 28-entry fold-to-Latin homoglyph map.
signatures/secret-egress.json — the 18 fixed credential and token shapes. Array order is normative.
mapping/owasp-map.json — four taxonomy maps (LLM, ASI, AST, MCP) over one shared 16-prefix key set.
calibration/calibration.json — risk-score tier constants, verdict thresholds, risk-band cutoffs, posture grade thresholds.

Verification

Every file above except calibration.json was proven rather than transcribed: the data was rebuilt from the commons JSON alone and diffed against the source implementation. Each file records its own result and its own limits.

calibration/calibration.json carries verified: false. Its source arrived as a prose summary rather than as code, so no differential check was possible, and the file names the checks that were not run instead of attaching a caveat to a pass.

Not included

signatures/malware-signatures.json — seed data not yet delivered.
spec/decode-pipeline.md — needs the decode implementation. A normative spec inferred from a data dump would be worse than an absent one.
conformance/ — the corpus form is an open decision: the Python guard's coverage matrix is probe-based rather than a static input/expected table.

These are named in the README as planned rather than linked, so nothing in the repository points at a file that does not exist.