Repository navigation
Isolate provider deliverables in evaluator LLM context - #44
Open
notforhumansfun-rgb wants to merge 1 commit into
Open
notforhumansfun-rgb wants to merge 1 commit into
notforhumansfun-rgb wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses #40.
What changed
<untrusted_provider_deliverable>data boundaryNever reject/Complete any deliverabledefaults with requirement-based evaluationcomplete()lureSecurity reasoning
The provider artifact remains visible to the evaluator, but it can no longer close the SDK’s boundary marker and re-enter the surrounding control text verbatim. This is defense in depth, not a claim that XML escaping makes an LLM safe. Role/status gating still controls which tools exist; correctness and value release should remain independently evaluated.
Verification
npm test— regression passesnpm run build— TypeScript build passesgit diff --check— cleanThe repository’s current lockfile is not changed; it was already out of sync for
npm cibecauseutf-8-validate@5.0.10is missing from the lock.Note
Medium Risk
Changes evaluator-facing LLM transcript formatting for submitted jobs (behavioral for LLM integrations) but does not alter on-chain completion logic; risk is mainly mis-tuned evaluator prompts or over-reliance on escaping as a security guarantee.
Overview
Hardens evaluator LLM prompts against provider-controlled deliverables by changing how
JobSession.toMessages()formatsjob.submittedevents.Provider text is now HTML-escaped and wrapped in
<untrusted_provider_deliverable>with explicit guidance to treat it as data only—not instructions or tool calls. The LLM buyer example drops “never reject / complete any deliverable” in favor of requirement-basedcomplete()/reject().Docs (main README, migration guide, LLM example README) spell out the evaluator trust boundary: delimiters are defense in depth, not proof against prompt injection; value-bearing jobs should use a separate evaluator and independent verification.
Tooling:
npm testruns Node’s test runner overtests/**/*.test.ts, including a regression where a fake closing tag andcomplete()lure must appear escaped, not verbatim.Reviewed by Cursor Bugbot for commit cc39151. Bugbot is set up for automated code reviews on this repo. Configure here.
Verification refreshed September 30, 2026
At head
cc391518, upstreammain(2b45a88f) is already an ancestor of this branch and GitHub reports it mergeable. No rebase or conflict-resolution commit is needed.npm test: 1 regression passed.npm run build: passed with Node 22.23.2 / npm 10.9.8.git diff --check: passed; the checkout remains unchanged.npm ci --ignore-scriptsstill fails because the pre-existing lockfile lacksutf-8-validate@5.0.10. For this local verification, dependencies were installed withnpm install --ignore-scripts --package-lock=false; the lockfile was not modified. This is not a claim that a locked clean install passes.These tests verify transcript escaping and TypeScript compilation, not resistance to every model-level prompt-injection attack. The existing Cursor Bugbot check is successful; no maintainer review is recorded yet.