eric/promptkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Clarify inspected input identifier disclosure

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-08 21:19:24 +00:00
parent c7e22c0dbe
commit 5a63b649f9
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/roadmap/remediation.md
View File

@@ -89,6 +89,11 @@ visit counts or a wall-clock threshold a public guarantee.
### Finding 3 — Qualify The Public Variable-Disclosure Statement (P3) ### Finding 3 — Qualify The Public Variable-Disclosure Statement (P3)
**Status: Resolved.** Request and method GoDoc now expressly distinguish caller
values from intentionally reported resolved input identifiers. Existing direct
name and privacy coverage passed in the assembled verification; no runtime
behavior or confidentiality mechanism changed.
Location: [public request GoDoc](../../requirements.go), `Vars` (lines 22–24). Location: [public request GoDoc](../../requirements.go), `Vars` (lines 22–24).
The comment says that supplied values are not returned in inspection. The comment says that supplied values are not returned in inspection.

7
requirements.go
View File

@@ -21,7 +21,8 @@ type RequirementInspectionRequest struct {
ProfileID string ProfileID string
// Vars supplies string values for caller-variable lookups and simple // Vars supplies string values for caller-variable lookups and simple
// conditions. Presence is determined by exact map key, including an empty // conditions. Presence is determined by exact map key, including an empty
// value; values are not returned in the inspection. // value. Inspection reports caller keys and presence, not their values.
// A supplied value may nevertheless appear as a resolved input identifier.
Vars map[string]string Vars map[string]string
// SessionID, when nonblank after the normal session-ID normalization, // SessionID, when nonblank after the normal session-ID normalization,
// bypasses the prompt's session template during discovery. // bypasses the prompt's session template during discovery.
@@ -164,6 +165,10 @@ type RequirementInspection struct {
// a useful partial result with Complete false. The returned inventories do // a useful partial result with Complete false. The returned inventories do
// not reject otherwise valid templates or prohibit their use. // not reject otherwise valid templates or prohibit their use.
// //
// Results exclude artifact payloads, prompt contents, and unrelated supplied
// values. Resolved input identifiers may equal the caller values that supply
// them; those identifiers are intentionally included in the inventory.
//
// This method does not perform artifact, schema, credential, rendering, // This method does not perform artifact, schema, credential, rendering,
// validation, capacity, observation, provider, or execution work. Complete // validation, capacity, observation, provider, or execution work. Complete
// describes dependency discovery, not whether every dependency is supplied or // describes dependency discovery, not whether every dependency is supplied or