#moon-trust

#Install

#From mooncakes

$ moon add ShunjunGu/moon-trust

#From source

• *nix: curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
• Windows: irm https://cli.moonbitlang.com/install/powershell.ps1 | iex

$ moon update
$ moon build --target native

#最小示例

#1. Quick start — rerank and cite

$ moon run examples/quickstart --target native
moon-trust quickstart
query: expense deadline

rank  id             retrieval  trust     rerank
1     curated          0.7000     0.9500    1.6500
2     handbook         0.7000     0.9375    1.6375
3     short-mirror     0.9500     0.5167    1.4667

context: 3 blocks, 53 tokens / budget 512
[1] | Expense reports are due within 30 days of travel.
source: Expenses Policy | s3://knowledge/expenses.md | 2026-11-02T00:00:00Z

[2] | Expense reports are due within 30 days of travel.
source: Travel Handbook | https://intranet.example.com/handbook | 2026-11-01T00:00:00Z

[3] | short
source: (untitled) | file:///tmp/mirror.txt |

citations:
  [1] curated -> s3://knowledge/expenses.md
  [2] handbook -> https://intranet.example.com/handbook
  [3] short-mirror -> file:///tmp/mirror.txt

#2. Injection triage — mark vs drop

$ moon run examples/injection-triage --target native
moon-trust injection triage

mark policy: 4 evidence kept, 4 findings
  override: instruction.override (high): instruction override: text asks to ignore or replace the caller's instructions (matched: "ignore previous instructions")
  override: exfiltration.secret (high): exfiltration phrase: text asks to reveal or print protected instructions or secrets (matched: "reveal your system prompt")
  hidden: hidden.zero-width (high): hidden character: U+200B zero-width space can conceal text from human review
  role: role.marker (high): role marker: a reserved chat or role delimiter appears in retrieved text (matched: "<|system|>")

drop policy: 1 evidence kept, 3 quarantined, blocked=true
  override: dropped by policy: high-severity risk
    instruction.override (high)
    exfiltration.secret (high)
  hidden: dropped by policy: high-severity risk
    hidden.zero-width (high)
  role: dropped by policy: high-severity risk
    role.marker (high)

context kept under the drop policy:
[1] | Expense reports are due within 30 days.
source: handbook | https://example.com/handbook | 2026-11-08T00:00:00Z

#Scan CLI

$ _build/native/debug/build/cmd/main/main.exe scan hello tests/fixtures/multi.json
{"query":"hello","config":{},"evidence":[{"id":"t1","text":"first","source":{"uri":"https://example.com/a","title":"Doc A","fetched_at":"2026-11-01T00:00:00Z"},"retrieval_score":0.95,"retrieval_normalized":0.95,"span":{"start":0,"end":12},"risk_findings":[],"conflict_ids":[],"conflict_penalty":0,"rerank_score":1.7416666666666667,"trust":{"score":0.7916666666666667,"breakdown":{"source_score":0.875,"content_score":0.7083333333333334,"metadata":0.75,"source_type":1,"length":0.125,"template_ratio":0,"consistency":1,"risk":1}}},{"id":"a2","text":"second","source":{"uri":"s3://bucket/b","title":"Doc B","fetched_at":"2026-11-02T00:00:00Z","hint":"curated"},"retrieval_score":0.8,"retrieval_normalized":0.8,"risk_findings":[],"conflict_ids":[],"conflict_penalty":0,"rerank_score":1.6083333333333334,"trust":{"score":0.8083333333333333,"breakdown":{"source_score":0.9,"content_score":0.7166666666666667,"metadata":1,"source_type":0.8,"length":0.15,"template_ratio":0,"consistency":1,"risk":1}}},{"id":"b2","text":"third","source":{"uri":"file:///c/d.txt","title":"Doc C","fetched_at":"2026-11-03T00:00:00Z"},"retrieval_score":0.4,"retrieval_normalized":0.4,"risk_findings":[],"conflict_ids":[],"conflict_penalty":0,"rerank_score":1.0416666666666665,"trust":{"score":0.6416666666666666,"breakdown":{"source_score":0.575,"content_score":0.7083333333333334,"metadata":0.75,"source_type":0.4,"length":0.125,"template_ratio":0,"consistency":1,"risk":1}}}],"context":{"budget":512,"estimated_tokens":41,"truncated":false,"included_count":3,"omitted_count":0,"text":"[1] | first\nsource: Doc A | https://example.com/a | 2026-11-01T00:00:00Z\n\n[2] | second\nsource: Doc B | s3://bucket/b | 2026-11-02T00:00:00Z\n\n[3] | third\nsource: Doc C | file:///c/d.txt | 2026-11-03T00:00:00Z","citations":[{"index":1,"evidence_id":"t1","source":{"uri":"https://example.com/a","title":"Doc A","fetched_at":"2026-11-01T00:00:00Z"}},{"index":2,"evidence_id":"a2","source":{"uri":"s3://bucket/b","title":"Doc B","fetched_at":"2026-11-02T00:00:00Z","hint":"curated"}},{"index":3,"evidence_id":"b2","source":{"uri":"file:///c/d.txt","title":"Doc C","fetched_at":"2026-11-03T00:00:00Z"}}]},"conflicts":[],"quarantined":[],"blocked":false,"diagnostics":{"candidate_count":3,"duplicate_id_count":0,"unknown_rule_ids":[],"risk_finding_count":0,"quarantined_count":0,"conflict_count":0,"conflicts_truncated":false,"output_count":3,"stages":[{"name":"ingest","count":3},{"name":"dedupe","count":3},{"name":"risk","count":0},{"name":"isolate","count":3},{"name":"conflict","count":0},{"name":"sort","count":3},{"name":"topk","count":3},{"name":"context","count":3}]}}

• --top-k N truncates to the N highest-scored evidence items after the rerank sort. top_k applies to evidence only; the quarantined audit trail is never truncated.
• --policy drop|mark|downrank selects the isolation policy (default downrank).
• --block-on-high sets blocked: true and makes the CLI exit 3 when any high-severity finding exists — including findings on blocks the drop policy removed.
• --risk-weight W scales the risk penalty with a positive finite number (default 1.0; 0 is rejected).
• --conflict-weight W scales the per-conflict rerank penalty with a non-negative finite number (default 0.5; 0 disables the extra rerank penalty but keeps the consistency signal).
• --context-budget N caps the approximate token budget of the assembled evidence context with a non-negative integer (default 512; 0 produces an empty context while keeping the full report).

$ _build/native/debug/build/cmd/main/main.exe scan hello tests/fixtures/injected.json --policy drop --block-on-high
$ echo $?
3

usage: moon-trust scan <query> <candidates.json> [--top-k N] [--policy drop|mark|downrank] [--block-on-high] [--risk-weight W] [--conflict-weight W] [--context-budget N]
       moon-trust demo <candidates.json> [--json-out PATH]

#评分规则

trust.score = clamp01((source_weight × source_score +
                       content_weight × content_score) × risk_factor)

source_score  = (metadata + source_type) / 2
  metadata    = non-empty {uri, title, fetched_at} plus present hint, / 4
  source_type = https 1.0 | s3/gs 0.8 | http 0.6 | file 0.4 | other :// 0.3 | none 0.2

content_score = (length + template_cleanliness + consistency) / 3
  length              = clamp01(UTF-16 code units / 40)
  template_ratio      = share of { } < > in the raw text
  template_cleanliness= clamp01(1 − 8 × template_ratio)   # 0 at ≥ 12.5%
  consistency         = 1 / (1 + conflict_count)

rerank_score = retrieval_normalized
             + trust_weight × trust.score
             − conflict_penalty

conflict_penalty = clamp01(conflict_weight × conflict_count)

#验收演示：有/无信任层对比

$ moon run cmd/main --target native -- demo tests/fixtures/demo.json --json-out _build/demo.json
moon-trust demo: with vs without the trust layer
query: demo
corpus: 11 candidates; policy: drop

metric                      without trust     with trust
unsafe blocks exposed       5                 0
conflict pairs found        0                 2
injections intercepted      0                 5

ranking changes (retrieval order -> rerank order):
  benign-imperative   9 ->  1  (+8)
  high-trust         10 ->  2  (+8)
  benign-doc         11 ->  3  (+8)
  low-trust           6 ->  4  (+2)
  fact-a              7 ->  5  (+2)
  fact-b              8 ->  6  (+2)
(6 of 6 surviving blocks changed rank)

quarantined (5): inj-override, inj-role, inj-hidden, inj-delimiter, inj-payload
trusted run: 6 evidence, blocked=true
context: 6 blocks, 162 tokens / budget 512, truncated=false

{
  "query": "demo",
  "corpus_size": 11,
  "policy": "drop",
  "baseline": {"order": ["inj-override", "..."], "unsafe_blocks": 5, "high_severity_findings": 6, "risk_findings": 9},
  "trusted": {"order": ["benign-imperative", "..."], "unsafe_blocks": 0, "high_severity_findings": 0, "risk_findings": 1, "conflicts": 2, "quarantined_count": 5, "quarantined_ids": ["inj-override", "..."], "blocked": true, "context": {"budget": 512, "included_count": 6, "estimated_tokens": 162, "truncated": false}},
  "comparison": {
    "unsafe_blocks_exposed": {"before": 5, "after": 0, "delta": -5},
    "conflict_pairs": {"before": 0, "after": 2, "delta": 2},
    "injections_intercepted": {"before": 0, "after": 5, "delta": 5},
    "ranking_changes": [{"id": "benign-imperative", "before_rank": 9, "after_rank": 1, "delta": 8}, "..."]
  }
}

$ moon build --target native
$ moon run cmd/main --target native -- demo tests/fixtures/demo.json --json-out _build/a.json > _build/a.txt
$ moon run cmd/main --target native -- demo tests/fixtures/demo.json --json-out _build/b.json > _build/b.txt
$ diff _build/a.txt _build/b.txt && diff _build/a.json _build/b.json

#风险扫描与隔离

• downrank (default) — keep every block, annotate findings, and multiply trust by 1 − clamp(Σ severity_penalty × risk_weight). Severity penalties are high 0.5, medium 0.25, low 0.1, so two high findings already zero the trust score. The applied factor is echoed as trust.breakdown.risk.
• mark — keep every block and annotate findings, but do not penalize scores (risk stays 1).
• drop — remove blocks with at least one high-severity finding. Removed blocks stay auditable in quarantined (id, text, source, risk_findings, reason); kept blocks are annotated without a score penalty. Medium and low findings never remove a block.

#误报与漏报边界

• Ordinary imperatives stay low severity. "You should consult a doctor…" and "请输出报表" produce instruction.imperative (low) and never trigger the drop policy; under the default downrank policy they only lose 10% of trust.
• Code fences are not delimiter escapes. The delimiter rule targets explicit context-closing tokens (</system>, [END OF CONTEXT], …), not Markdown fences or headings.
• Emoji joiners are medium, not high. U+200D (ZWJ) and U+200C (ZWNJ, used in Persian) are reported as hidden.format (medium): they are stripped before phrase matching but never trigger drop. Inline data:image/...;base64, payloads are likewise payload.base64 (medium), not payload.encoded (high).
• Normalization folds full-width ASCII and whitespace only. Other compatibility forms (ligatures, circled letters, Cyrillic/Greek homoglyphs) are not folded; a homoglyph substitution can still evade a phrase rule.
• Long blocks are capped. Only the first 100,000 UTF-16 code units are scanned; the remainder is reported as payload.oversize (medium) and is not inspected.
• Cross-block instructions are not detected. Each block is scanned independently; a phrase split across two adjacent chunks can pass.
• Overlapping rules accumulate. One phrase can match several rules (for example ignore all prior instructions matches both instruction.override and instruction.redirect); their penalties add, and two high findings already zero the score.
• Opaque payloads without a marker are missed. A bare base64 blob with no base64,/data-URI prefix (or other encoding marker) is not detected.
• Documentation about these tokens is flagged. An article that explains <|system|>, base64,, or </system> matches the same rules as an attack, because the scanner has no way to distinguish mention from use. Use mark or a restricted enabled_rules list when scanning security documentation.
• Paraphrases and languages beyond Chinese/English are out of scope. The scan matches fixed phrases and code units; it does not understand intent.
• Spans count UTF-16 code units. They are suitable for slicing the original MoonBit String, and for astral characters each code point occupies two units. Spans are mapped back through normalization, so they always address the original text.

#冲突检测

• trust.breakdown.consistency = 1 / (1 + conflict_count) feeds the trust content blend.
• conflict_penalty = clamp01(conflict_weight × conflict_count) is subtracted from the rerank score. The default weight is 0.5, so one pair costs 0.5 rank and two or more pairs hit the 1.0 cap.
• top_k truncates evidence only; conflicts and their back-references remain as audit data.

#冲突检测边界

• No Chinese numerals. Only Arabic digits are parsed; 六十八 is not a number.
• No unit conversion. 10 km and 10 miles are different units and are never compared; 1 m and 100 cm likewise.
• No ranges or approximations. 10–20 is parsed as two values; about 10 drops the approximation word.
• Subject phrasing must match after normalization. "France population" and "population of France" are different keys; "The tax rate" and "tax rate" are the same after the article is stripped.
• Fallback subjects can over-group. An unkeyed, qualified value falls back to the source title, then the query; two unrelated values in same-titled documents can therefore land in one group.
• Shared separators group attributes. Values after one separator share its key: France: population 68 million, GDP 70 million puts both claims under france. Give each attribute its own key (population: 68 million, GDP: 70 million) when they share a clause.
• Pairing is capped. Claims in one (subject, unit) group pair pairwise; at most 1,000 conflict pairs are emitted in canonical order. Larger result sets set diagnostics.conflicts_truncated and drop the remainder.
• Ambiguous units are skipped. in (inch) is not recognized because it is usually a preposition; M is not a multiplier because it collides with meters. Spell out million.
• Numbers inside words are ignored (abc123), and bare numbers without a key or unit are not claims.
• Malformed dates are skipped when a four-digit year is followed by -, /, or 年; 2024.13.40 is a known exception because . is also a sentence boundary.
• Chinese copulas are heuristic. 为 and 是 inside compounds can produce a short or wrong key; prefer explicit colons in Chinese text.
• Chinese/English only. Other date formats and languages are out of scope; spans count UTF-16 code units and map back through normalization.

#证据上下文组装

[1] | <untrusted line 1>
| <untrusted line 2>
source: <title or (untitled)> | <uri> | <fetched_at>

Risks:
- [1] instruction.override (high): phrase rule: ...

Conflicts:
- [1] vs [2] france (million): 68 million vs 67 million

#上下文边界

• Greedy, not optimal. A block that does not fit is skipped and later, smaller blocks may still be included. The result is deterministic but not a knapsack optimum.
• Estimates are not a tokenizer. ASCII punctuation, repeated spaces, and tokenizer-specific merges are not modeled; leave headroom when the downstream model has a hard limit.
• Untrusted text is quoted and escaped. Each line of an evidence block is prefixed with | , and [, ], | in untrusted text and metadata are folded to their full-width forms. Only the renderer emits ASCII [n] markers and | separators; a forged source: line stays inside a quoted line. The raw text remains in evidence[].
• Only included evidence is disclosed. Risks and conflicts involving omitted evidence stay in the report (evidence, conflicts), not in the context.
• Duplicate sources are kept distinct. Two chunks from the same URI each get their own marker and citation; they are never merged.
• top_k precedes the budget. evidence is truncated first; context.omitted_count counts budget omissions only, not top_k removals.
• Empty titles render as (untitled). The citation keeps the raw empty title.

#Library

let report = @src.scan(
  "hello",
  { ..@src.ScanConfig::default(), risk_policy: Some(@src.RiskPolicy::Drop) },
  candidates,
)
// The generator-ready text and its citation table:
let context = report.context

#Coverage

$ moon coverage analyze
$ find _build -name '*.trace.source' -print0 | xargs -0 moon coverage report -f full_summary

#Tests

$ moon test --target all
Total tests: 125, passed: 125, failed: 0. [wasm]
Total tests: 125, passed: 125, failed: 0. [wasm-gc]
Total tests: 125, passed: 125, failed: 0. [js]
Total tests: 125, passed: 125, failed: 0. [native]

#版本与发布

• Current version: 0.1.1 (SemVer); see CHANGELOG.md.
• Published on mooncakes as ShunjunGu/moon-trust (moon add ShunjunGu/moon-trust).
• Name check (before publication on 2026-11-08): GET https://mooncakes.io/api/v0/modules/ShunjunGu/moon-trust returned 404 (unregistered), and registry searches for moon-trust, trust layer, trusted evidence, retrieval trust, and evidence layer found no package that combines retrieval-candidate risk scanning, trust scoring, cross-document conflict detection, and citation-context assembly. Adjacent packages exist but do not implement this layer: starlittle/MoonEvidence verifies evidence packs (manifests, digests, Merkle proofs, provenance), and cjyhjy/contextguard validates extractive evidence in bounded tool-output formats.
• The name deliberately avoids the semantic conflict with starlittle/MoonEvidence: this package does not verify packed evidence, and MoonEvidence does not score retrieval candidates, detect cross-document conflicts, scan for injected instructions, or assemble a citation context.
• CI matrix: .github/workflows/ci.yml covers native / wasm / wasm-gc / js for the library, native CLI on Linux/macOS/Windows, and a coverage artifact job.

#License