Commit graph

2 commits

Author SHA1 Message Date
a7e8ffecb8 chore(deps): re-pin llm-ingestion-okf to v0.3.1 + migrate tests to stable error codes
Pin dae0bd1a -> v0.3.1 (=692f2df) on the public Forgejo mirror; uv.lock pins
the exact commit behind the tag.

- Drop the mypy override: the library ships py.typed from v0.2.0, so strict
  mode now follows its real types instead of follow_untyped_imports.
- Migrate 8 library-error assertions from pytest.raises(match=...) to
  exc.value.code — message text is explicitly unstable from v0.3.0, the
  codes are the stability contract.
- Fix a real breakage the bump surfaced: IngestResult gained a required
  `stamp` field (d3a3bcc), which the delegation fake did not construct.
- The read-only SQL test loses resolution under the code contract
  (`sql_failed` is generic), so it now proves read-onlyness by effect —
  the write never lands — instead of by message wording.
- Correct the guard plan: G1's persist-gate anchor (ingest.py:372-387) died
  with the 2026-07-16 adoption. Door A is ungated by the library's own
  README, so gating stays our responsibility at the call site.

Verified: 426 tests green, golden output byte-exact unchanged, full gate
clean (ruff + format + mypy strict).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RmNAgbRXUgvoSKxVK4Bevv
2026-07-20 07:22:09 +02:00
b46f32c682 docs(security): llm-ingestion-guard adopsjonsplan — trust-grense-kartlegging + status planned
Fulgte guard-repoets inclusion/adoption-brief. Kartla repoets ingest-flater mot
briefens §7-checklist: ingest file/sql = førstepart (verbatim render, 0 modellkall,
0 egress-call-sites i src); http = dormant untrusted (avvist fail-fast, extending.md);
inbox = kjørt-bevist injeksjonsflate men førstepart + uwiret (C-F7/C-N2). Status: planned.
Ingen wiring/dep lagt til — kun plan + maskinlesbar markørlinje i STATE.md (local-only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-16 07:40:24 +02:00