Answering question 3 from the OKF round (flat vs hierarchical bundles) turned
up a conflict that is real in code, not just between two spec texts:
method-spec.md:66-69 skip any link target containing a path separator
okf.py:123-125 `if "/" in target: continue` — implemented as written
okf-index.mjs:110 okr emits `${sd}/index.md`
okf-links.mjs:23 okr *requires* a leading `/`
So every link okr produces is skipped by the navigator, and okr cannot write a
flat bundle at all (routeLevel always returns a subdirectory). Worse, the
robustness rule at :72-73 mandates that the skip be silent — a hierarchical
bundle yields a read-context of the root index and nothing else, with no error.
On okr's own okf-realistic fixture all 8 concept files vanish.
The separator ban is the wrong proxy for the security property it wants: it
conflates "contains a separator" with "escapes the bundle". Method-spec already
carries the precise rule two lines below (:73, boundary-checked, fail-closed),
and okr has correct prior art (okf-links.mjs:20-26).
Direction: let navigation traverse hierarchy; keep door A flat in v1. This is
also what makes a shared Python/Node fixture suite possible at all.
Neither spec is edited. Decision is the operator's.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HBJNsFsBRaAhqGKjjiGjoQ
llm-ingestion-okf is blocked: door A has no free-text connector. Assessment
requested by the implementation repo; this is direction, not a spec edit.
Recommendation: solve in the spec. The real defect is that §5 conflates source
type (transport) with body form — `http` already renders verbatim, so the
verbatim mode exists but is bound to the wrong axis. Separate them with an
extraction-level `render: table|verbatim`; no new source type needed.
Also specifies what §5 must say about verbatim render (strict UTF-8, CRLF→LF
vs the LF-only rule, deterministic fence width, mandatory fencing as a
navigation-injection defence per method-spec §3 Step 1, max_rows semantics),
and flags that free text is untrusted-by-origin over a local transport —
which may pull guard Trigger A forward.
ingest-spec.md is untouched. Decision is the operator's.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HBJNsFsBRaAhqGKjjiGjoQ
The Claude SDK implementation (claude-code-llm-wiki) runs the same adoption task
in parallel; it owns guard wiring in its repo-local modules (ingest.py/verdicts.py/
okf.py), while shared/ and the ingest-spec gate contract are commons-owned. Record
the reciprocal boundary in the adoption plan so the division of labor survives
between sessions.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Score the guard brief's §7 checklist against the commons-specified architecture:
all implemented ingest paths (file/sql) are first-party, so the decisive
untrusted-ingest box is currently NO. Record the two designed untrusted boundaries
where the guard belongs when built — the http/MCP connector (sanitize + scan-before-
persist at ingest materialization) and a received-external OKF bundle (okf.import_bundle)
— and explicitly exclude the promotion gate as a first-party path the guard must not
wire. Plan only; the guard is not implemented.
Add .gitignore keeping STATE.md LOCAL-ONLY (commons is subtree-consumed and
open-publish-intended; STATE must never reach a consumer's shared/ or a public mirror).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
