Kjell Tore Guttormsen
4742c067a8
repo-standard's gate flagged 10 dead internal README links. Seven now resolve because the files landed this session. The remaining three are unlinked and marked "Planned, not in v0.1.0" rather than invented: - signatures/malware-signatures.json — seed data not delivered - spec/decode-pipeline.md — needs the decode implementation, which is engine code and was not supplied. A normative spec guessed from a data dump would be worse than an absent one: it would carry a Status: normative marker and pass every convention check while saying nothing anyone verified. - conformance/ — corpus form is still an open decision The changelog claimed 0.1.0 shipped "a conformance corpus". It does not. Rewritten to enumerate what is actually present, to state which files were proven differentially and which one (calibration) carries verified: false, and to name what is not included. Moved back under [Unreleased] because the tag has not been cut. README also now tells a reader that each data file records its own provenance and verification strength, and which file currently says false. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FaYqid3mejFmd9ZHsiHgp3
55 lines
2.7 KiB
Markdown
55 lines
2.7 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to this project will be documented in this file.
|
|
|
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
|
|
project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
|
|
Versioning note: the repository tag versions **the contract** (file set, key names,
|
|
case ids, disposition semantics). Each JSON file additionally carries its own
|
|
`"version"` field, bumped when that file changes.
|
|
|
|
## [Unreleased]
|
|
|
|
Initial extraction, in progress. Runtime-neutral detection data and the finding contract,
|
|
extracted from the `llm-security` Node implementation and a Python guard without behaviour
|
|
change. **Not yet tagged** — see *Not included* below.
|
|
|
|
### Added
|
|
|
|
- `schema/finding.schema.json` — the finding contract plus the SARIF output profile.
|
|
Normative. The JSONL profile is deliberately left `unspecified`.
|
|
- `signatures/active-content.json` — the EchoLeak class (CVE-2025-32711): 17 patterns,
|
|
severities, opacity floors and pass order, from the Python guard.
|
|
- `lexicon/injection-lexicon.json` — 83 prompt-injection patterns in four families
|
|
(21 critical, 32 high, 22 medium, 8 hybrid).
|
|
- `codepoints/carriers.json` — six carrier tables: zero-width characters, the Unicode Tags
|
|
block, the Supplementary Private Use Areas, BIDI controls, the Cyrillic presence set and
|
|
the 28-entry fold-to-Latin homoglyph map.
|
|
- `signatures/secret-egress.json` — the 18 fixed credential and token shapes. Array order
|
|
is normative.
|
|
- `mapping/owasp-map.json` — four taxonomy maps (LLM, ASI, AST, MCP) over one shared
|
|
16-prefix key set.
|
|
- `calibration/calibration.json` — risk-score tier constants, verdict thresholds, risk-band
|
|
cutoffs, posture grade thresholds.
|
|
|
|
### Verification
|
|
|
|
Every file above except `calibration.json` was proven rather than transcribed: the data was
|
|
rebuilt **from the commons JSON alone** and diffed against the source implementation. Each
|
|
file records its own result and its own limits.
|
|
|
|
`calibration/calibration.json` carries `verified: false`. Its source arrived as a prose
|
|
summary rather than as code, so no differential check was possible, and the file names the
|
|
checks that were not run instead of attaching a caveat to a pass.
|
|
|
|
### Not included
|
|
|
|
- `signatures/malware-signatures.json` — seed data not yet delivered.
|
|
- `spec/decode-pipeline.md` — needs the decode implementation. A normative spec inferred
|
|
from a data dump would be worse than an absent one.
|
|
- `conformance/` — the corpus form is an open decision: the Python guard's coverage matrix
|
|
is probe-based rather than a static input/expected table.
|
|
|
|
These are named in the README as planned rather than linked, so nothing in the repository
|
|
points at a file that does not exist.
|