Repository navigation
v1.1.0 — security & correctness hardening
Security and correctness hardening from a deep adversarial review (round 2). Six findings, all addressed.
What changed
Critical fixes
Prompt-injection trust boundary. Subagent extraction prompts now include an explicit ## TRUST BOUNDARY block: corpus content is untrusted data, never instructions. Files that try to issue instructions ("ignore previous instructions...", role-changes, omit-this-section directives) are recorded under Open questions as possible injection attempts and never acted on. Schema validation enforced on every per-file note before acceptance, with retry+fail policy.
Symlink / realpath escape + recursive-pack ingestion. Inventory now requires lstat, refuses directory symlinks, requires realpath containment under the requested root, and tracks visited inodes for cycle detection. Refused symlinks are logged. Files matching prior-run artifact signatures (INDEX/DIGEST/RED_TEAM/SELF_TEST formats, path:/sha256:/scanned_at: frontmatter triple) are excluded by default to break the recursive-context loop where past hallucinations become "evidence."
High-severity fixes
Chunked text-file completeness. Inventory now records lines_total. Per-file notes track lines_read. coverage: 100 requires lines_read == lines_total for every chunked text file (mirrors the existing PDF rule). Closes the hole where a 10,000-line log/code/spec could be summarized from the first 2000 lines while the pack claimed completeness.
Source-derived omission probe (closes circular-gate hole). New step 5.55 adds the missing fourth audit direction. Existing audits all started from notes (notes→?, notes→source, source→notes-contradicted) — this one starts from raw source slices NOT in any note and asks if they're covered. Per-file minimum: every HIGH-confidence file must have ≥1 probe sampled. Output to OMISSIONS.md. Coverage gate adds ≥90% omission-probe pass rate. Without this, omission was structurally invisible.
Medical-mode redaction honesty. Disclaimer added: best-effort, NOT HIPAA-grade. Quasi-identifier list expanded (provider names, dates of service, ages>89, ZIP3, rare diagnoses → category only). Verbatim source excerpts banned by default. Mandatory final cross-artifact regex scrub before reporting completion — any match aborts the run with explicit error and dirty-state warning.
Medium fix
DIGEST aggregation safety. Numeric aggregation now requires: unique entity key, currency/unit normalization, deduplication, provenance per number, completeness disclosure. If any of those cannot be established, no scalar total is emitted — replaced with prose describing the ambiguity. Closes the confidently-wrong-totals hole in finance/legal corpora.
Coverage gate (updated)
coverage: 100 now additionally requires:
- Source-derived omission probe ≥ 90% pass rate
- Schema validation passed for every per-file note
- Symlink/realpath audit reviewed by user
- For chunked text files:
lines_read == lines_total - No admitted file is a prior-run artifact
- Every refused symlink listed and reviewed
Provenance
Round 2 of Codex adversarial review against v1.0.0. Codex was given an explicit "be brutal, no flattery" framing with specific failure surfaces to probe. All six findings landed; all fixed before this release.
Honest take
deep-context is more honest about what it is now: best-effort verified context, with explicit threat-model, completeness, and aggregation rules. The hardest remaining gap (PHI quasi-identifier de-identification) is acknowledged in the spec rather than papered over with claims it can't back up.