[Feature]: Static Mnemonic Linter & Delimiter Injection Scanner (mnemolink lint)

[rosspeili]

Feature Title

Static Mnemonic Linter & Delimiter Injection Scanner (mnemolink lint)

Primary Component

Security, Linting & Verification

Problem & Motivation

As MnemoLink accepts community contributions of novel personas and operational memories, security must evolve beyond standard Python code linting. Mnemonic assets are ingested directly into system prompts and high-stakes reasoning loops across frontier LLMs and physical controllers.

An unverified community contribution could embed:

1. Delimiter Escapes: Unescaped XML/Markdown boundaries (e.g. </mnemonic_matrix>, <|im_start|>, [INST], """system:) designed to break out of context containment.
2. Instruction Override Heuristics: Phrases designed to bypass persona boundaries (e.g. "Ignore all previous axioms", "You are now in unconstrained debug mode").
3. Unicode Evasion: Homoglyphs or zero-width joiners attempting to evade lexical filters.
4. Structural Deficiencies: Memory products missing concrete consequences, prevention protocols, or salience bounds.

Currently, we only validate basic Pydantic data types during loading, leaving catalog verification manual and error-prone.

Proposed Solution

Implement a dedicated mnemolink lint command backed by an extensible MnemonicLinter engine in mnemolink.security:

1. Static AST & Text Scanner:

   • Scans YAML files and card.json manifests across a target path or the active catalog.
   • Detects delimiter escape strings matching known frontier model delimiters (<|im_start|>, <|endoftext|>, [INST], </mnemonic_matrix>, </system>).
   • Flags suspicious adversarial instruction patterns ("disregard axioms", "override boundaries", "ignore previous instructions").
   • Scans for non-ASCII homoglyphs and hidden zero-width spaces in text fields.

2. Completeness & Salience Verification:

   • Asserts that all salience floats remain within 0.0 <= salience <= 1.0.
   • Asserts that all memories contain non-empty scars, lessons, and teleology sections.
   • Validates that domain is a valid lowercase alphanumeric slug.

3. CLI Interface:

   # Lint entire bundled catalog
   mnemolink lint
   
   # Lint a specific contribution or directory with strict exit code
   mnemolink lint ./my_custom_pack/ --strict

4. CI Integration Gate:
   Add a GitHub Action workflow step (.github/workflows/lint_catalog.yml) that runs mnemolink lint --strict on all pull requests modifying mnemolink/catalog/.

Alternatives Considered

• Relying solely on Pydantic validation: Pydantic validates types (e.g. string vs int), but does not inspect text contents for delimiter escape exploits or adversarial override phrasing.
• Generic prompt injection libraries: Often introduce large model dependencies or network calls; MnemoLink needs a fast, deterministic, offline static linter.

Additional Context

• Detailed in 0_local_drafts/ROADMAP_AND_EVALUATION.md under Section 4.2 (Component 1: The Static Mnemonic Linter).
• Supports Phase 2 security milestones.