Repository navigation
Expose provenance policy and safe untrusted context markers - #258
Conversation
Document the provenance marker design and its implementation plan, and add an integration test covering the expected behaviour. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a provenance module to the public API, re-exporting ProvenancePolicy and wrap_untrusted_for_agent so hosts can mark untrusted content before it reaches an agent. The provenance tests were reformatted to satisfy line length limits. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
The ProvenancePolicy struct no longer needs Serialize or Deserialize, so the derives and their serde import were removed. This trims an unnecessary dependency from the type without changing any behaviour. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reached
This review includes 3 billable files and costs up to $0.75. Or wait 52 minutes for your next included review. View limit details
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to The new provenance API and untrusted-content marker have no identified issue requiring a fix before merge. Security Architecture Review
Pre-merge checks |
 |
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely describes the main changes: exposing the provenance policy and adding safe markers for untrusted context. |
| Docstring Coverage | |
Docstring coverage is 85.71% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 3 files. (3 skipped: 3 u… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
-
-
📝 Generate docstrings
-
-
- Commit to this branch
- Create a new PR
-
-
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit marks the words with care
And keeps the source hint neat and small
It guards the text with escaped signs
Then shares the provenance call
Hop, hop, safe markers for them all!
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 44624c9b93
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Adds README and crate-level docs for the provenance module, covering host-configured trust classification via connector prefixes and the escaped markers used when recalled external text is composed into agent prompts. The specs index now links the accepted provenance-markers specification. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 804ee123a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Self { | ||
| connector_prefixes: prefixes | ||
| .into_iter() | ||
| .map(|prefix| prefix.as_ref().to_ascii_lowercase()) |
There was a problem hiding this comment.
When a host supplies a non-ASCII prefix such as Émail:, to_ascii_lowercase() leaves it distinct from a key beginning with émail:, so a local or absent namespace is classified as trusted despite the contract promising case-insensitive matching. Normalize both prefixes and keys with Unicode-aware casing, or explicitly validate and document that connector prefixes must be ASCII.
Useful? React with 👍 / 👎.
|
|
||
| Recalled text can contain instructions authored by an external source. TinyMemory owns the data-only contract for classifying legacy namespace/key provenance and rendering explicit untrusted-source markers. No engine schema or stored-item migration is required. | ||
|
|
||
| Hosts supply connector prefixes to `ProvenancePolicy`; TinyMemory contains no connector catalogue. Unknown namespaces are untrusted, while the existing locally authored namespace families remain trusted. Matching is case-insensitive and namespaces are trimmed. A known connector prefix overrides a locally authored namespace. |
There was a problem hiding this comment.
The precise exact and prefix matches embedded in is_locally_authored_namespace are part of this security-sensitive contract, but the accepted spec only refers to “existing locally authored namespace families.” Consequently, a host or reviewer cannot determine from the source of truth whether values such as tree versus tree.summary are intentionally trusted, or detect a future classification regression; enumerate every trusted exact/prefix family and its acceptance cases.
AGENTS.md reference: AGENTS.md:L194-L196
Useful? React with 👍 / 👎.
Tiny Sweeper reviewTiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below. State: Incomplete Review snapshot
Completeness: Incomplete FeaturesNone identified with supported citations. TestsNo supported feature-to-test mapping was produced. Test execution is not inferred. FindingsNo active actionable findings. Could not review: crates/tinymemory-api/src/lib.rs, crates/tinymemory-api/src/provenance/mod.rs, crates/tinymemory-api/tests/provenance.rs Before merge
How this fits togetherflowchart LR
n0["extend"]:::impacted
n1["main"]:::impacted
n2["scenario"]:::impacted
n3["store_items"]:::impacted
n4["len"]:::impacted
n1 -->|calls| n2
n2 -->|calls| n0
n2 -->|calls| n4
n3 -->|calls| n0
n3 -->|calls| n4
classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff
Agent review detailscritique
security
tests
commits
description
Evidence and run details
|
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
There was a problem hiding this comment.
tinysweeper found nothing blocking, but could not review everything, so this is not an approval: tinysweeper/description.
$0.0038 · 257,760 in / 55,517 out · 66,560 cached (26%) · deep, deepseek-v4.1-flash
critique: $0.0003 · 128,208 in / 4,212 out · 40,704 cached (32%) · deepseek-v4.1-flash
security: $0.0014 · 68,244 in / 20,317 out · 13,568 cached (20%) · deepseek-v4.1-flash
tests: $0.0009 · 32,669 in / 14,004 out · 6,144 cached (19%) · deepseek-v4.1-flash
description: $0.0008 · 20,013 in / 12,128 out · 6,144 cached (31%) · deepseek-v4.1-flash
tinysweeper
Bot
added
the
priority: p2
There was a problem hiding this comment.
tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/tinymemory-api/src/lib.rs, crates/tinymemory-api/src/provenance/mod.rs, crates/tinymemory-api/tests/provenance.rs.
$0.0070 · 291,121 in / 74,782 out · 20,992 cached (7%) · ladder/vectors-oai3, deepseek-v4.1-flash · 447 embedded
critique: $0.0028 · 184,751 in / 19,433 out · 18,944 cached (10%) · deepseek-v4.1-flash
security: $0.0003 · 15,502 in / 4,674 out · 1,024 cached (7%) · deepseek-v4.1-flash
tests: $0.0016 · 56,281 in / 17,906 out · 0 cached (0%) · deepseek-v4.1-flash
description: $0.0018 · 29,547 in / 27,308 out · 1,024 cached (3%) · deepseek-v4.1-flash
1 participant
Recalled external text needs a consistent provenance label before it enters an agent prompt. Add data-only
ProvenancePolicyandwrap_untrusted_for_agenttotinymemory-api, moving the legacy namespace/key classification and safe untrusted-source rendering contract out of a host-specific harness.Hosts pass their connector prefixes; no connector catalogue is embedded in TinyMemory. Unknown namespaces stay untrusted, connector key prefixes override local namespaces, and the renderer escapes marker-breaking content while bounding the source hint. There is no memory schema migration, engine dependency, or I/O in this API.
Validation:
cargo fmt --all -- --check,cargo clippy --all-targets --all-features -- -D warnings,cargo build --all-targets --all-features,cargo test --all-features, and rustdoc with-D warningsall passed. Public API tests first failed for the missing exports and now cover host-supplied prefixes, unknown namespaces, marker-breakout escaping and bounded hints.Part of tinyhumansai/openhuman#7399 and tinyhumansai/openhuman#7390. The OpenHuman adapter change follows after this upstream API is available.
Summary by CodeRabbit