docs: correct the guardrail claim — it now matches the code - #7
Merged
Merged
Conversation
These pages claimed an organisation's guardrail policy "filters context exactly as it filters anything else" and that "a document cannot smuggle an instruction past your policy just by being called context". That was not true when written: Engine.php filtered only the user's message, and the assembled context preamble reached the model unfiltered. The code is now fixed (hermiq-guardrail-preamble-filter), so the claim holds — but the wording was still overstated, and these are the pages a reader trusts to decide what is safe to put in a Context. State it accurately instead: - The context bundle IS filtered, separately from the user's message, so an operator can tell which one tripped. - Guardrail filtering is OFF BY DEFAULT — it is a policy you enable. - It does NOT cover the RAG retrieval block, which remains unfiltered. A security page that overstates its protection is worse than one that admits a gap.
rubenvdlinde
added a commit
that referenced
this pull request
Jul 26, 2026
… host (fixes #44) (#47) Hermiq is Vue 3 while the OpenBuild/OpenRegister host is Vue 2.7. A Vue-3 SFC handed to the host is interpreted under the host's incompatible Vue runtime and renders blank (hermiq#44). Adopt the leaf-mount-render escape hatch shipped in @conduction/nextcloud-vue@1.0.0-beta.223 + openregister LeafDescriptor.renderMode (PR#2129) + ADR-066 Decision #7: - src/integration-leaf.js: register renderMode 'mount' with a mount(el, props) / unmount(el) pair instead of the tab/widget SFC refs. mount() createApp()s Hermiq's OWN Vue 3 app rooted at the host-owned element (chat tab for the single-entity sidebar surface, run-history widget for detail-page/dashboard surfaces), keyed in a per-element Map so the same leaf can mount into several elements; unmount() destroys the instance for that element and is guarded against a double-unmount. - lib/Listener/RegisterAgentLeafListener.php: declare renderMode LeafDescriptor::RENDER_MODE_MOUNT so the server descriptor matches the JS registration under the shared id hermiq-agent (gate-24 integration-parity). - tests: stub LeafDescriptor gains the RENDER_MODE_* constants + getRenderMode(); listener test asserts renderMode 'mount'. The agent-leaf webpack entry stays self-contained (excluded from splitChunks) so the globally-injected bundle inlines its own framework and its registration fires synchronously. Also fixes pre-existing phpcs errors: missing @PARAM $agentMaxTokens docs on four ProviderFactory driver methods. Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These pages claimed guardrails "filter context exactly as they filter anything else" and that "a document cannot smuggle an instruction past your policy". That was not true when written — Engine.php filtered only the user's message. The code is now fixed (#6), so the claim holds — but the wording was still overstated, and these are the pages a reader trusts to decide what is safe to put in a Context.
Now states it accurately: the context bundle is filtered (separately from your message, so an operator can tell which tripped); filtering is off by default; and it does not cover the RAG retrieval block.
A security page that overstates its protection is worse than one that admits a gap.