Wire renderSegments provenance into the parser and retire the strict-mode nonce (cross-runtime) #542

Activity

1. Seth Juarez (sethjuarez)

   added

   enhancementNew feature or requestNew feature or request

   on Sep 10, 2026
2. sethjuarez commented on Sep 10, 2026

   

   Seth Juarez (sethjuarez)

   on Sep 10, 2026

   MemberAuthor

   More actions

   Follow-up: per-format provenance is not uniform — Mustache needs its own engine, Jinja does not

   Wiring the parse side (above) is sufficient for Jinja on its own: jinja_subset already emits real literal/interp provenance with source/strict, and it's conformant across all 7 runtimes via RenderSegmentVectors. Once prepare() consumes segments and parses structurally, Jinja requires no additional engine work and the nonce is fully retired for the Jinja path — provenance makes injected markers inert by construction.

   The remaining exposure is every other format, and Mustache is the concrete case today.

   Mustache renderSegments is a false-provenance stub

   runtime/python/prompty/prompty/renderers/mustache.py implements render_segments by wrapping the entire chevron output as a single literal span. That labels interpolated content as authored template text. Under a structural parser that trusts literal spans, this is an injection bypass — strictly worse than the nonce it would replace. It passes conformance only because RenderSegmentVectors (schema/model/conformance/vectors/render-segments.tsp) is jinja2-only (5 cases, zero Mustache) — the stub passes by omission.

   "Can we project provenance from the Mustache library's own IR?"

   Partly, per-runtime — but it's the wrong cross-runtime foundation.

   • Python/chevron: yes, concretely. chevron.tokenizer.tokenize() is public and yields a clean, projectable token stream:

     tokenize("Hello {{name}}! {{#items}}<{{x}}>{{/items}} bye")
       ('literal','Hello ') ('variable','name') ('literal','! ')
       ('section','items')  ('literal','<')      ('variable','x')
       ('literal','>')      ('end','items')       ('literal',' bye')
     

     A literal token → literal span; text emitted while resolving a variable/section value → interp span with source = <root key>. Mustache is easier to make injection-safe than Jinja — interpolation is pure key-lookup, no arbitrary expressions.

   • But do not depend on lib internals at runtime. Mustache spans 7 runtimes on 7 different libs (chevron, mustache.js, GRMustache, …). Token models differ, some expose no public IR, and the edges (sections, lambdas, standalone-tag/whitespace handling, partials) vary per implementation. Depending on each lib's internal IR = 7 fragile projections against private APIs = exactly the 7× authored-surface problem Shrink the authored surface: TypeSpec as single source of truth, hand-write only what conformance requires #511 is trying to shrink.

   • The strong Mustache render vectors don't transfer. They pin flat-string render equivalence (output text), not literal/interp attribution. Provenance still needs its own Mustache RenderSegmentVectors regardless of implementation.

   Recommendation

   Same pattern that made Jinja work: own a small mustache-subset tokenizer that emits provenance, and add Mustache RenderSegmentVectors. Use chevron's token model as the reference shape / golden-generator (oracle) — the way jinja_subset generates its goldens — but keep the shipped code free of chevron internals. Grammar is tiny (literal / variable / section / inverted / partial / comment), so this is cheap.

   Opaque * (CustomTool-style / unknown renderers)

   Any renderer that can't emit honest provenance must not be trusted by the structural parser. Two options to decide as part of this issue:

   • A (uniform): every registered format ships an owned provenance engine; opaque renderers are rejected in strict mode.
   • B (two-tier): structural parse for provenance-capable formats; keep the nonce as a fallback floor only for opaque renderers.

   Added acceptance criteria

   • RenderSegmentVectors gains Mustache cases (literal vs {{var}} vs section-emitted interp with source), green across all 7 runtimes.
   • Mustache render_segments emits true per-token provenance (no whole-output literal stub) in all 7 runtimes.
   • A decision is recorded for opaque/* renderers (reject-in-strict vs nonce-fallback).
   • Explicitly: the Jinja path needs no engine changes and drops the nonce entirely once parse consumes segments.