docs: add RFC-2 — mid-stream LLM guardrails design doc - #31
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9b6eaab4e6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| **Mechanism.** `StreamingGuard` wraps the token stream. `onChunk(chunk)` appends to an accumulated buffer and evaluates the pattern list against the buffer on every call (`src/streaming/index.ts:108`). Each pattern carries a mode — abort or observe (`:64`). On an abort match, the guard throws immediately (`:126`), before the token propagates; on an observe match, it pushes a violation and continues (`:128`). The buffer is trimmed to a window so the match cost does not grow with response length (`:117`). | ||
|
|
||
| **Data model.** A pattern is a compiled regex plus a label plus a mode (`abort | observe`). Default patterns cover contact-info leaks and non-existent business entities as abort; placeholders, markdown artifacts, and price-commitment language as observe. Callers extend or override via a factory (`createStreamingGuard`). The guard holds the accumulated buffer, the pattern list, an `onViolate` handler, and an `onAbort` handler. |
There was a problem hiding this comment.
This documents default streaming abort coverage for “non-existent business entities,” but the built-in abort list only contains CONTACT_LEAK_PATTERN and BUSINESS_LEAK_PATTERN (src/streaming/index.ts:83-97), and the business pattern is for commission/partner-status text (src/patterns/business.ts), not invented projects/builders. In production, users relying on this RFC could believe entity fabrication is prevented mid-stream when those checks are only post-hoc/batch-style, so this should describe the shipped coverage accurately or add the missing streaming rule.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Amended the RFC to describe the actual streaming abort coverage — contact-info leaks (CONTACT_LEAK_PATTERN) and business-sensitive leaks, i.e. commission-rate / partner-status text (BUSINESS_LEAK_PATTERN, src/patterns/business.ts). Entity fabrication is caught in the batch checkResponse scope (src/check.ts — HALLUCINATION: invented names, FABRICATED_BUILDER), not mid-stream. The Rollout section carried the same overclaim; fixed that too. Thanks for the catch.
9b6eaab to
3a45c65
Compare
1 participant
What
Adds
docs/rfc-tripwire.md— RFC-2, the design document for Tripwire'smid-stream guardrail: a per-chunk streaming guard that aborts on a
hard-policy match before the offending token is yielded.
Why
The behavior shipped in
@ykstormsorg/tripwirev1.1.0 (StreamingGuard/createStreamingGuard,src/streaming/index.ts) had no written designrationale in-repo. This RFC records the motivation (irreversible mid-stream
delivery), the two-tier abort/observe severity model, the ~4.7µs/chunk
CI-measured cost basis, alternatives considered, prior art, open questions,
and rollout.
Scope
Docs only. No code, no dependency, no behavior change. One new file, additive.
Notes
src/streaming/index.tsandsrc/check.ts..github/workflows/benchmark.yml.