errlore 0.3.0__tar.gz → 0.3.1__tar.gz

{errlore-0.3.0 → errlore-0.3.1}/CHANGELOG.md

@@ -5,6 +5,35 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.1] - 2026-07-14
+
+### Security
+- **Lesson `solution` is now sanitized at the injection boundary.** Previously
+  only the lesson *pattern* was sanitized on write; a `solution` set via
+  `add_lesson` (or a legacy/direct-write record) reached the prompt verbatim —
+  raw JSON, code fences, oversized blobs. `inject_for` now runs BOTH pattern
+  and solution through `sanitize_lesson_text` when assembling the block, so no
+  lesson can carry unsanitized content into the prompt regardless of write
+  path; a lesson whose pattern or solution does not survive is dropped from
+  that injection (and not reinforced).
+- **Control characters (ANSI escapes, NUL) are stripped by the sanitizer.**
+  Previously only `\s` runs were collapsed, so `\x1b[…]` / `\x00` survived.
+
+### Fixed
+- A single malformed record (non-coercible `confidence`/counter) no longer
+  crashes every lesson/error read — bad records are skipped with a warning
+  instead of taking down `inject_for`, `stats`, and `lessons()`.
+- `check_consistency` clustering is now transitive (union-find) under
+  `similarity < 1.0`, so `distinct` / `agreement` / `stable` no longer depend
+  on input order. The strict default (exact match) is unchanged.
+
+### Changed
+- `graduation.decide()` evaluates the harm survival function once instead of
+  twice (no behavior change; anchors still pinned by tests).
+
+_Source: a full-project density audit (adversarial review + executable checks)
+run right after 0.3.0._
+
 ## [0.3.0] - 2026-07-14
 
 ### Added

{errlore-0.3.0 → errlore-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: errlore
-Version: 0.3.0
+Version: 0.3.1
 Summary: Memory for AI agents that learns from failures: lessons, known-issues injection, and per-model trust — embedded, file-based, no server.
 Project-URL: Homepage, https://errlore.com
 Project-URL: Repository, https://github.com/Ma4etaSS/errlore
@@ -320,8 +320,8 @@ you only need them for advanced use.
 - All data is stored in local JSONL files in the directory you specify.
 - Nothing is sent to any server.  errlore itself makes zero network calls.
 - Works fully offline -- no API keys, no accounts, no telemetry.
-- Files: `errors.jsonl`, `lessons.jsonl`, `injections.jsonl`, `trust.json`,
-  `model_accuracy.jsonl`.
+- Files: `errors.jsonl`, `lessons.jsonl`, `injections.jsonl`,
+  `counterfactuals.jsonl` (shadow mode), `trust.json`, `model_accuracy.jsonl`.
 - Sidecar files (auto-managed): `*.idx` (byte-offset index), `*.lock`
   (filelock), `vectors.npy` (embedding vectors), `vector_meta.json`
   (embedding metadata), `trust.json` (trust engine state).
@@ -334,12 +334,13 @@ prompts and reaches the model. So:
 - **Do not ingest lessons from untrusted sources without review.** Treat lesson
   capture like a code review, not like user input. A malicious lesson is a
   prompt-injection vector — and this is the real control, not the sanitizer.
-- **What the sanitizer does (and does not) do.** The lesson *pattern* passes
-  `sanitize_lesson_text`: it strips raw-JSON/code-fence *noise* and caps length
-  so log blobs don't pollute the prompt. It is a noise filter, **not** an
-  injection defense — it does not neutralize natural-language instructions, and
-  the *solution* text is stored as you author it (so it can hold real code).
-  Don't rely on it to make untrusted lessons safe.
+- **What the sanitizer does (and does not) do.** Both the lesson *pattern* and
+  *solution* pass `sanitize_lesson_text` at the injection boundary: it strips
+  raw-JSON/code-fence *noise* and control characters (ANSI/NUL) and caps length
+  so log blobs don't pollute the prompt, regardless of how the lesson was
+  written or where it came from. It is a noise filter, **not** an injection
+  defense — it does not neutralize natural-language instructions. Don't rely on
+  it to make untrusted lessons safe.
 - You control what becomes a lesson (`resolve(..., lesson=...)` /
   `add_lesson(...)`); nothing is auto-promoted from raw model output.
 

{errlore-0.3.0 → errlore-0.3.1}/README.md

@@ -286,8 +286,8 @@ you only need them for advanced use.
 - All data is stored in local JSONL files in the directory you specify.
 - Nothing is sent to any server.  errlore itself makes zero network calls.
 - Works fully offline -- no API keys, no accounts, no telemetry.
-- Files: `errors.jsonl`, `lessons.jsonl`, `injections.jsonl`, `trust.json`,
-  `model_accuracy.jsonl`.
+- Files: `errors.jsonl`, `lessons.jsonl`, `injections.jsonl`,
+  `counterfactuals.jsonl` (shadow mode), `trust.json`, `model_accuracy.jsonl`.
 - Sidecar files (auto-managed): `*.idx` (byte-offset index), `*.lock`
   (filelock), `vectors.npy` (embedding vectors), `vector_meta.json`
   (embedding metadata), `trust.json` (trust engine state).
@@ -300,12 +300,13 @@ prompts and reaches the model. So:
 - **Do not ingest lessons from untrusted sources without review.** Treat lesson
   capture like a code review, not like user input. A malicious lesson is a
   prompt-injection vector — and this is the real control, not the sanitizer.
-- **What the sanitizer does (and does not) do.** The lesson *pattern* passes
-  `sanitize_lesson_text`: it strips raw-JSON/code-fence *noise* and caps length
-  so log blobs don't pollute the prompt. It is a noise filter, **not** an
-  injection defense — it does not neutralize natural-language instructions, and
-  the *solution* text is stored as you author it (so it can hold real code).
-  Don't rely on it to make untrusted lessons safe.
+- **What the sanitizer does (and does not) do.** Both the lesson *pattern* and
+  *solution* pass `sanitize_lesson_text` at the injection boundary: it strips
+  raw-JSON/code-fence *noise* and control characters (ANSI/NUL) and caps length
+  so log blobs don't pollute the prompt, regardless of how the lesson was
+  written or where it came from. It is a noise filter, **not** an injection
+  defense — it does not neutralize natural-language instructions. Don't rely on
+  it to make untrusted lessons safe.
 - You control what becomes a lesson (`resolve(..., lesson=...)` /
   `add_lesson(...)`); nothing is auto-promoted from raw model output.
 

{errlore-0.3.0 → errlore-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "errlore"
-version = "0.3.0"
+version = "0.3.1"
 description = "Memory for AI agents that learns from failures: lessons, known-issues injection, and per-model trust — embedded, file-based, no server."
 readme = "README.md"
 license = "MIT"

{errlore-0.3.0 → errlore-0.3.1}/src/errlore/consistency.py

@@ -125,11 +125,7 @@ def check_consistency(
 
     extract = _final_line if mode == "final_line" else (lambda t: t.strip())
     keys = [extract(o) for o in outputs]
-
-    # Greedy clustering: an answer joins the first cluster whose representative
-    # it is equivalent to, else it opens a new one. Counts give agreement.
-    reps: list[str] = []
-    counts: list[int] = []
+    n = len(keys)
 
     def _equivalent(a: str, b: str) -> bool:
         if a == b:
@@ -138,22 +134,36 @@ def check_consistency(
             return _word_overlap(a, b) >= similarity
         return False
 
-    for key in keys:
-        for i, rep in enumerate(reps):
-            if _equivalent(key, rep):
-                counts[i] += 1
-                break
-        else:
-            reps.append(key)
-            counts.append(1)
-
-    top = max(range(len(reps)), key=lambda i: counts[i])
-    stable = len(reps) == 1
+    # Union-find clustering: two answers share a cluster when they are
+    # pairwise equivalent, closed transitively. For the strict default
+    # (similarity == 1.0, exact equality) equivalence is already transitive,
+    # so this matches a plain set; for looser similarity it keeps `distinct`,
+    # `agreement`, and `stable` independent of input order.
+    parent = list(range(n))
+
+    def _find(x: int) -> int:
+        while parent[x] != x:
+            parent[x] = parent[parent[x]]
+            x = parent[x]
+        return x
+
+    for i in range(n):
+        for j in range(i + 1, n):
+            if _equivalent(keys[i], keys[j]):
+                parent[_find(i)] = _find(j)
+
+    clusters: dict[int, list[int]] = {}
+    for i in range(n):
+        clusters.setdefault(_find(i), []).append(i)
+
+    members = list(clusters.values())
+    largest = max(members, key=len)
+    stable = len(members) == 1
     return ConsistencyResult(
         stable=stable,
-        n_runs=len(outputs),
-        distinct=len(reps),
-        agreement=counts[top] / len(outputs),
-        majority=reps[top],
+        n_runs=n,
+        distinct=len(members),
+        agreement=len(largest) / n,
+        majority=keys[largest[0]],
         warning=None if stable else _UNSTABLE_WARNING,
     )

{errlore-0.3.0 → errlore-0.3.1}/src/errlore/facade.py

@@ -310,15 +310,31 @@ class AgentMemory:
             limit=self._max_lessons,
             exclude_quarantined=exclude_quarantined,
         )
-        lesson_ids = [le.id for le in lessons]
 
-        # Build text block.
+        # Build text block.  Sanitize BOTH pattern and solution at the
+        # injection boundary -- this is the definitive gate, so a lesson can
+        # never carry raw JSON/code/control-chars into the prompt regardless of
+        # how it was written (add_lesson's solution, a direct store write, or
+        # legacy data all pass through here).  A lesson whose pattern or
+        # solution does not survive sanitization is dropped from this
+        # injection, and its id is not reinforced.
         parts: list[str] = []
+        lesson_ids: list[str] = []
+        lesson_lines: list[str] = []
+        for le in lessons:
+            safe_pattern = sanitize_lesson_text(le.pattern)
+            safe_solution = sanitize_lesson_text(le.solution)
+            if safe_pattern is None or safe_solution is None:
+                logger.warning(
+                    "Lesson %s dropped from injection: unsanitizable content", le.id
+                )
+                continue
+            lesson_lines.append(f"- {safe_pattern} -> {safe_solution}")
+            lesson_ids.append(le.id)
 
-        if lessons:
+        if lesson_lines:
             parts.append("[LESSONS FROM PAST FAILURES]")
-            for le in lessons:
-                parts.append(f"- {le.pattern} -> {le.solution}")
+            parts.extend(lesson_lines)
 
         # Known issues (model weaknesses + past errors).
         warning = self._injector.build_warning(model, effective_task_type)

{errlore-0.3.0 → errlore-0.3.1}/src/errlore/lessons/graduation.py

@@ -211,9 +211,12 @@ def decide(
     """
     harm_break = max(0, harm_break)
     harm_keep = max(0, harm_keep)
-    if beta_sf(HARM_MAX, _ALPHA_H + harm_break, _BETA_H + harm_keep) > QUARANTINE_CONF:
+    # One survival-function evaluation drives both gates: Pr(p_h > HARM_MAX)
+    # for quarantine and its complement Pr(p_h <= HARM_MAX) for promote-safe.
+    harm_exceed = beta_sf(HARM_MAX, _ALPHA_H + harm_break, _BETA_H + harm_keep)
+    if harm_exceed > QUARANTINE_CONF:
         return "quarantine"
-    safe = harm_clear_probability(harm_break, harm_keep) > PROMOTE_SAFE_CONF
+    safe = (1.0 - harm_exceed) > PROMOTE_SAFE_CONF
     useful = fix_useful_probability(fix_yes, fix_no) > PROMOTE_USEFUL_CONF
     if safe and useful:
         return "promote"

{errlore-0.3.0 → errlore-0.3.1}/src/errlore/lessons/store.py

@@ -596,11 +596,28 @@ class LessonStore:
     # ------------------------------------------------------------------
 
     def _read_errors(self) -> list[ErrorRecord]:
-        """Read all error records from disk."""
+        """Read all error records from disk, skipping malformed ones."""
         raw = self._writer.read_all(self._errors_path)
-        return [ErrorRecord.from_dict(r) for r in raw]
+        out: list[ErrorRecord] = []
+        for r in raw:
+            try:
+                out.append(ErrorRecord.from_dict(r))
+            except (ValueError, TypeError):
+                logger.warning("Skipping malformed error record: %.80s", str(r))
+        return out
 
     def _read_lessons(self) -> list[Lesson]:
-        """Read all lesson records from disk."""
+        """Read all lesson records from disk, skipping malformed ones.
+
+        A single record with a non-coercible field (e.g. a tampered
+        ``confidence`` or counter) must not crash every read path that depends
+        on lessons (inject_for, stats, lessons()).
+        """
         raw = self._writer.read_all(self._lessons_path)
-        return [Lesson.from_dict(r) for r in raw]
+        out: list[Lesson] = []
+        for r in raw:
+            try:
+                out.append(Lesson.from_dict(r))
+            except (ValueError, TypeError):
+                logger.warning("Skipping malformed lesson record: %.80s", str(r))
+        return out

{errlore-0.3.0 → errlore-0.3.1}/src/errlore/sanitize.py

@@ -53,6 +53,10 @@ _JSON_LIKE_RE: re.Pattern[str] = re.compile(r"^\s*[\{\[]")
 # Collapse runs of whitespace into a single space.
 _COLLAPSE_WS_RE: re.Pattern[str] = re.compile(r"\s+")
 
+# Non-printable control characters (C0 minus \t\n\r, plus DEL). These survive
+# an \s-only collapse and can carry ANSI escape / NUL payloads into the prompt.
+_CONTROL_CHARS_RE: re.Pattern[str] = re.compile(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]")
+
 
 def _truncate_at_word(text: str, max_len: int) -> str:
     """Truncate *text* at a word boundary, appending ``...`` if needed.
@@ -92,6 +96,8 @@ def sanitize_lesson_text(text: str, *, max_len: int = 300) -> str | None:
     """
     # B8: strip BOM (UTF-8 byte-order mark) if present.
     text = text.lstrip("")
+    # Drop non-printable control chars (ANSI escapes, NUL) before anything else.
+    text = _CONTROL_CHARS_RE.sub("", text)
     text = text.strip()
     if not text:
         return None

errlore-0.3.1/tests/test_hardening.py

@@ -0,0 +1,88 @@
+"""Regression tests for the 0.3.1 hardening pass (density audit findings)."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from errlore import AgentMemory, check_consistency
+from errlore.sanitize import sanitize_lesson_text
+
+
+class TestSanitizerControlChars:
+    def test_ansi_escape_and_nul_are_stripped(self) -> None:
+        out = sanitize_lesson_text("do \x1b[31mred\x1b[0m and \x00 the thing")
+        assert out is not None
+        assert "\x1b" not in out and "\x00" not in out
+        assert "the thing" in out
+
+    def test_plain_text_unaffected(self) -> None:
+        assert sanitize_lesson_text("demand ISO-8601") == "demand ISO-8601"
+
+
+class TestInjectionBoundarySanitizesSolution:
+    def test_raw_json_solution_does_not_leak(self, data_dir: Path) -> None:
+        mem = AgentMemory(data_dir, trust=False)
+        # pattern is clean; solution is a raw JSON blob (add_lesson stores it raw).
+        mem.add_lesson(
+            "extract dates", '{"secret_key": "leak-me"}', task_type="extraction"
+        )
+        inj = mem.inject_for("extract dates", "m", task_type="extraction")
+        # The unsanitizable solution means the lesson is dropped from injection.
+        assert "leak-me" not in inj.text
+        assert "secret_key" not in inj.text
+        assert inj.lesson_ids == []
+
+    def test_code_fence_stripped_from_solution(self, data_dir: Path) -> None:
+        mem = AgentMemory(data_dir, trust=False)
+        mem.add_lesson(
+            "validate dates",
+            "First run ```python\nexploit()\n``` then verify the field",
+            task_type="extraction",
+        )
+        inj = mem.inject_for("validate dates", "m", task_type="extraction")
+        assert "exploit()" not in inj.text
+        assert "verify the field" in inj.text
+
+    def test_control_chars_stripped_from_injected_block(self, data_dir: Path) -> None:
+        mem = AgentMemory(data_dir, trust=False)
+        mem.add_lesson("do task", "run \x1b[2J the step", task_type="t")
+        inj = mem.inject_for("do task", "m", task_type="t")
+        assert "\x1b" not in inj.text
+        assert "the step" in inj.text
+
+
+class TestMalformedRecordDoesNotCrashReads:
+    def test_bad_record_is_skipped(self, data_dir: Path) -> None:
+        mem = AgentMemory(data_dir, trust=False)
+        mem.add_lesson("good pattern", "good solution", task_type="t")
+        # Append a poisoned record with a non-coercible confidence value.
+        bad = {
+            "id": "badrec00",
+            "pattern": "p",
+            "solution": "s",
+            "confidence": "NOT_A_FLOAT",
+        }
+        with (Path(data_dir) / "lessons.jsonl").open("a", encoding="utf-8") as f:
+            f.write(json.dumps(bad) + "\n")
+        # Reads must not raise; the good lesson survives, the bad one is dropped.
+        lessons = mem.lessons()
+        assert [le.pattern for le in lessons] == ["good pattern"]
+        # stats() (which also reads lessons) must not crash either.
+        assert mem.stats()["lessons_total"] == 1
+
+
+class TestConsistencyClusteringOrderIndependence:
+    def test_loose_similarity_is_transitive_and_order_independent(self) -> None:
+        # Chain: "x y" ~ "y z" ~ "z w" pairwise (overlap 0.5), transitively one.
+        forward = check_consistency(["x y", "y z", "z w"], similarity=0.5)
+        reverse = check_consistency(["z w", "y z", "x y"], similarity=0.5)
+        assert forward.distinct == reverse.distinct == 1
+        assert forward.stable is reverse.stable is True
+        assert forward.agreement == reverse.agreement == 1.0
+
+    def test_strict_default_unchanged(self) -> None:
+        r = check_consistency(["a", "a", "b"])
+        assert r.distinct == 2
+        assert r.stable is False
+        assert r.agreement == 2 / 3