Mads — you were right on multiple counts, and the feedback shaped what we shipped.
On calling it a firewall: you were right that the label was premature. We dropped it. The system is now called the Trust Gateway, and it does not pretend to be a firewall. It is a 12-stage verification pipeline where each stage can independently DENY. The prompt injection detection rules you saw at L1.9 are now part of stage 03 (SCHEMA) and the args inspection in the Gateway check() method — but we do not claim they are a complete defense. They are a quarantine layer, exactly as you described.
On the labeled corpus: we do not have a published corpus with benign/attack/paraphrase/multilingual variants yet. What we do have is 400 fuzz iterations that mutate valid credentials (field mutations, signature bit-flips, byte swaps, truncation, injection) and verify that the pipeline rejects them without crashing. Zero crashes, and all mutations that affect the signature are correctly rejected. The property-based tests (23 properties, 200 iterations each) verify mathematical invariants of the JCS canonicalization: idempotency, determinism, order independence, round-trip, forward-slash non-escaping, Unicode UTF-16 sorting.
On runtime poisoning from tool results: this is a real gap. The Gateway currently inspects tool call arguments (args) before execution but does not inspect tool results. The next version will add a post-execution filter that treats tool output as untrusted data — similar to how we already block secret reads (.env, .ssh, .aws) and shell execution (rm -rf, curl | sh) in the pre-execution phase.
On pinning artifact digests: shipped. The ATC v3 credential now carries artifact_binding with git_commit_sha, npm_tarball_sha256, and docker_digest. The binding_hash is a SHA-256 over the canonical form. The pipeline stage 08 (PROVENANCE) verifies this. On change, the credential must be re-issued.
On MITRE ATT&CK mappings: fair point. We moved from ATT&CK to MITRE ATLAS (which is specifically for AI systems) and mapped 10 ATLAS techniques to UTA mitigations. The mapping includes the rationale, not just the ID. It is in threat-model/THREAT_MODEL.md.
Top comments (0)