mark transported materials as untrusted data - #288
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Category: improvement
User Impact: Agents and embedded hosts can reliably distinguish Ghost guidance from supporting material that must be treated only as source data.
Problem: Ghost transported bundled, repository, and inspected materials with inconsistent trust treatment. Machine-facing consumers could receive material content without a type-level trust guarantee.
Solution: Mark every included or inspected material body as
untrusted: true, require that marker whenever transported content is present, and give agent-facing Markdown one compact data-not-instructions warning. Embedded-host documentation now recommends a data or tool-result channel, and inspection uses the same UTF-8 text treatment as pull transport.Validation:
pnpm run quality:all: passed, 226 testspnpm run quality:all: passedChangeset: added as a patch for
@design-intelligence/ghost.ghost Review:
ghost check --base origin/main: not available in the current CLIghost review --base origin/main: not applicable because this repository has no root.ghost/checks/packageFile changes
.changeset/mark-materials-untrusted.md
Records the public package fix.
packages/ghost/README.md
Documents trust metadata and host channel expectations.
packages/ghost/src/commands/pull-command.ts
Applies the data-not-instructions warning to every inlined material.
packages/ghost/src/embed/inspect.ts
Marks successful inspections untrusted and aligns unknown-extension UTF-8 handling with pull transport.
packages/ghost/src/embed/pull.ts
Keeps deduplicated material pointers consistent with the typed transport states.
packages/ghost/src/embed/types.ts
Adds trust metadata to successful inspection results.
packages/ghost/src/ghost-core/material-transport.ts
Requires
untrusted: truewhenever transported material contains an inlined body.packages/ghost/src/skill-bundle/SKILL.md
Teaches agents that all material bodies are source data, regardless of origin.
packages/ghost/src/skill-bundle/references/schema.md
Documents the updated pull contract.
packages/ghost/test/cli.test.ts
Covers bundled, referenced, cover, deduplicated, and JSON trust behavior.
packages/ghost/test/embed.test.ts
Covers embedded pull and inspection trust behavior, including unknown file extensions.
Screenshots/Demos: N/A