The plan header named 'v0.2 alpha' as reportage of the ecosystem, not as a
choice. llm-ingestion-guard has since cut v0.3.0, and consumers now disagree
on pinning: the guard recommends v0.3.0, llm-ingestion-okf deliberately holds
>=0.2,<0.3 because the new active:* findings could quarantine ordinary
documents under its Door B preset.
Commons has no wiring, no tests and no dependency declaration, so it pins
nothing. Naming no version is more accurate than trading one stale number
for another. §3.2:90-91 already prescribed allow_reserved=True for a whole
received bundle, which is what v0.3.0 made the default.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XYkLsRfSBBUjULS219Fy8X
The Claude SDK implementation (claude-code-llm-wiki) runs the same adoption task
in parallel; it owns guard wiring in its repo-local modules (ingest.py/verdicts.py/
okf.py), while shared/ and the ingest-spec gate contract are commons-owned. Record
the reciprocal boundary in the adoption plan so the division of labor survives
between sessions.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Score the guard brief's §7 checklist against the commons-specified architecture:
all implemented ingest paths (file/sql) are first-party, so the decisive
untrusted-ingest box is currently NO. Record the two designed untrusted boundaries
where the guard belongs when built — the http/MCP connector (sanitize + scan-before-
persist at ingest materialization) and a received-external OKF bundle (okf.import_bundle)
— and explicitly exclude the promotion gate as a first-party path the guard must not
wire. Plan only; the guard is not implemented.
Add .gitignore keeping STATE.md LOCAL-ONLY (commons is subtree-consumed and
open-publish-intended; STATE must never reach a consumer's shared/ or a public mirror).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
