HTML export: single-element-wrapped narration can still clear the #27 structural floor (element-floor residual)

[project820]

Summary

Residual of the #27 fail-closed structural gate (which shipped in #29). The gate rejects the concrete #27 failure modes — pure prose (0 elements), code fences, and bare preamble text as a top-level sibling — but a model that wraps its entire conversational answer in a single element still clears the floor and finalizes.

The gate (html-export-sanitize.ts, behind requireStructuralDocument) requires:

• bodyElementCount >= HTML_MIN_BODY_ELEMENT_NODES (floor = 1), and
• no non-whitespace top-level text node (HTML-ASCII-whitespace predicate).

So Creating a landscape… (pure prose) is rejected, and Sure:<h1>…</h1> (top-level text sibling) is rejected, but:

<div>Creating a landscape document about … Here is your export:</div>

has exactly one element and no top-level text node → passes sanitize → quarantine → finalize, saving the narration as the "export".

Why it is hard (accepted design boundary today)

A single <div>…prose…</div> is structurally indistinguishable from a legitimate intro paragraph / lede that a real document may open with. Hard-rejecting single-element-with-only-text bodies risks false-positives on valid short documents. The current mitigation is the direct-prompt rider forbidding conversational preamble/narration (bare or element-wrapped), plus the top-level-text and element-floor checks. Architect + Grok-QA review classified the element-wrapped case as an accepted residual, not a security hole (no XSS/containment impact — it is a content-quality/trust issue in the family of #27).

Options to consider

• Heuristic content-identity signal (e.g. reject a body that is a single block element whose only content is text and whose text matches narration markers) — risks false-positives; needs a careful corpus.
• Provider-side: ensure the Grok/Claude CLI HTML surface disables tool/plan narration so the model cannot emit a chat wrapper in the first place (verify --disallowed-tools / prompt on current CLI versions).
• Accept as-is and rely on the prompt rider + the existing floor/top-level-text checks (current state).

References

• Shipped gate: src/main/html-export-sanitize.ts (requireStructuralDocument, HTML_MIN_BODY_ELEMENT_NODES, top-level HTML-whitespace check); pipeline wiring html-export-pipeline-service.ts.
• Original bug: HTML export: model narration text is finalized as the export document (fail-open on non-HTML responses) #27 (closed by feat(cutover): re-land R1 direct HTML engine (blocked on #27 content gate) #29). Prompt rider: html-export-direct-prompt.ts.
• Psycho-842 bot re-review of PR feat(cutover): re-land R1 direct HTML engine (blocked on #27 content gate) #29 flagged this as a residual P2 alongside HTML export: descendant root-identity selectors (.dark .card / #app / [dir]) don't match after root-identity transfer — needs inner root-proxy #33.

[project820]

🤖 Psycho-842 [BOT] triage

ℹ️ TRIAGE — Residual of #27: single element wrapping pure narration still clears the structural floor (content-quality, not XSS).

Summary

After #29 shipped the #27 fail-closed structural gate (requireStructuralDocument + HTML_MIN_BODY_ELEMENT_NODES = 1 + top-level HTML-ASCII-whitespace check), a model that wraps its entire conversational answer in one element (e.g. <div>Creating a landscape… Here is your export:</div>) still passes sanitize → quarantine → finalize. Bare prose and top-level text siblings are rejected; element-wrapped narration is not.

Reproducibility & Evidence

Code-backed, not runtime-reproduced in this triage (no local HTML-export run of a live model response). Measured against main tip of src/main/html-export-sanitize.ts and src/__tests__/html-export-sanitize.test.ts:

• Gate requires bodyElementCount >= 1 and no non-whitespace top-level #text under body.
• Unit suite covers: pure narration (0 elements) → reject; empty/whitespace body → reject; fenced/preamble top-level text → reject; single intentional block (<p>one block</p>) → accept.
• There is no fixture that rejects a single block element whose only content is narration-like prose — which matches the issue’s accepted-design-boundary claim.
• Nested text inside an element is treated as legitimate content by design (comment at the gate).

So the reported residual is consistent with the shipped floor=1 + top-level-only text check. End-to-end finalize of a live Grok/Claude narration-in-a-div artifact: unverified here.

Impact & Priority Suggestion

🟠 P2 Med (suggestion only — not a verdict)

• Impact: content-quality / trust. Users can still get a “successful” export that is chat narration wrapped in a single element. Issue (and prior feat(cutover): re-land R1 direct HTML engine (blocked on #27 content gate) #29 review framing) correctly notes no XSS / containment impact — sanitizer still strips active tags, event handlers, etc.
• Why not P0/P1: not security, not a regression of the pure-prose fail-closed path; parent HTML export: model narration text is finalized as the export document (fail-open on non-HTML responses) #27 modes remain covered. Raising the floor or keyword-rejecting single-text blocks risks false-positives on legitimate short docs / ledes.
• Why not P3: real residual of a closed P0-class fail-open bug; worth tracking until product decides accept-as-is vs heuristic vs provider-side tooling lock.

Duplicates & Related

• Parent (closed): #27 — pure narration finalized; closed by #29.
• Sibling residual (open, different bug): #33 — descendant root-identity selectors after content-root transfer (CSS matching), not structural floor.
• Related open: #32 (local provider inventory / capability false-positive) — same HTML-export surface family, different failure mode.
• no known duplicates of the single-element-wrapped narration residual as a standalone issue (this appears to be the first dedicated tracker).

Next Evidence Needed

• Capture one real provider artifact that is only a single element wrapping narration (file + byte size + manifest counts), similar to the HTML export: model narration text is finalized as the export document (fail-open on non-HTML responses) #27 4.4KB evidence.
• Optional unit test proposal: assert current accept behavior for <div>Creating a landscape document…</div> under requireStructuralDocument: true (documents the residual as intentional) or a red fixture if product chooses to tighten the gate.
• If pursuing a heuristic: a small corpus of legitimate single-block short exports vs narration markers (to bound false-positive rate).
• Provider check: current Grok/Claude CLI flags for full tool disablement (--disallowed-tools / equivalent) on the installed CLI versions — still an open thread from HTML export: model narration text is finalized as the export document (fail-open on non-HTML responses) #27.
• Product call among the three options already listed in the issue body (heuristic / provider-side / accept residual).

ℹ️ TRIAGE

🦀 Triaged by Hermes agent BOT 🦞