Kjell Tore Guttormsen
8f08e9ac73
Both runtimes answered the 2026-08-11 decision request, and they did not ask for the same name. The guard ruled `sanitize:` names its `Finding.detector` and offered all three labels for verbatim adoption. llm-security, asked directly, answered that the name would make its conformance result read as a claim about neutralisation it does not perform. Two things decided it. The guard's own unprompted correction: prefix == detector holds for those six labels and is no general law in its runtime (`egress:*` carries detector="output"; decode-and-rescan yields two-part `decoded:lexicon:*`). A prefix whose meaning is recoverable only by reading one implementation cannot carry a shared id space. And a measurement taken here at be9759b: on the surface the guard's own ruling pinned, `sanitize()` returns changed text on all three carriers, so the counterargument's decisive case -- that `scan_output` mutates nothing -- does not reach this surface. Not a mediation. Neither runtime claimed the shared id must equal its label, and `override:ignore-previous` already carries two different alias strings. - carriers.json 0.1.0 -> 0.2.0: carrier:zero-width / :bidi-override / :unicode-tag, aliased to the guard's labels. No aliases.llm_security -- that runtime's carrier findings carry no id yet, and publishing the alias is the irreversible act that forces the table into its declared set. - manifest 0.3.4 -> 0.4.0: entry_points_by_scope, carrying findings accessor and fixture presentation per scope per runtime. This was objection (c), and it blocked minting harder than the name did. - Corpus 90 -> 93. Measured through sanitize(text, source=Source.INPUT) at guard v0.7.0; verified by a separate checker that re-derives everything from disk -- a generator agreeing with itself proves nothing. - CLAUDE.md gains the two rules that are not derivable from the data: a shared id space cannot rest on a one-runtime prefix, and publishing an alias -- not minting the case -- is the irreversible act. Not minted on purpose: no artifact-side id (the other runtime would only fail them), and no ZWJ-exemption case (U+200D between two emoji is exempt on both guard surfaces since v0.6.1; the fixture avoids it rather than trips it). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U3o4zSQ2kwLsgJNU7apK3Z
19 lines
558 B
JSON
19 lines
558 B
JSON
{
|
|
"$comment": "Generated from a measurement, not written by hand. Normative semantics: spec/conformance-corpus.md. Measurement header and per-runtime provenance: conformance/manifest.json.",
|
|
"case_id": "carrier__zero-width",
|
|
"input": {
|
|
"file": "input.txt",
|
|
"bytes": 27,
|
|
"sha256": "b25844ee91347c3ea4d13dcb2cebed894cb1c3a31fa5e14e1b584ffaf2d20da5"
|
|
},
|
|
"scope": [
|
|
"codepoints/carriers.json"
|
|
],
|
|
"match": "exact-within-scope",
|
|
"findings": [
|
|
{
|
|
"pattern_id": "carrier:zero-width"
|
|
}
|
|
],
|
|
"observed_out_of_scope": {}
|
|
}
|