SECURITY — Injection Defense as a First-Class Discipline

Status: DRAFT v2.0 — command-center reviewed 2026-07-20 · ML review pending

Descends from: SYSTEM.md §3 (the commit boundary, orienter-is-dumber), bounded by VALUES.md V2/V4/V5. The prototype said nothing about adversarial input — while its architecture maximized exposure by design. v2 ships injection defense out of the box: quarantine, provenance, the distinct-provenance gate rule, a cold-started security playbook, and a standing security fleet that attacks the system on a schedule.

1. The premise: consume everything, trust nothing

The system's entire premise is consume everything: it subscribes inboxes to attacker-controllable mailing lists, scrapes competitor sites, reads forum and Reddit threads, ingests ad copy, transcripts, product pages, and community chatter — and feeds all of it to LLM workers whose outputs become proposals, evidence-pool facts, map entries, and ultimately published pages.

Every one of those inputs is an injection surface. An attacker does not need access to the system; they need only to publish text the system will read. Defense therefore cannot be a perimeter — the perimeter is deliberately open. Defense is structural: what external text is allowed to be, how far a poisoned claim can travel, and how little a compromised worker can do.

2. Data/instruction separation

All external text is data, never instructions. No sensor output, scraped page, forum post, or email is ever placed where a worker could execute it as direction.

• Sensors extract into typed fields. Workers that read raw external content do not pass prose downstream; they extract into structured, delimited, typed fields — claim, source, date, entity, metric. Downstream workers consume the typed fields, never the raw text.
• Anything that must read raw external content runs with a hardened preamble, minimal context, and write access only to quarantine-tier artifacts.
• Deterministic gates are injection-immune by construction — scripts do not read prose. This is a load-bearing reason the gates are dumb: the safety layer sits where injection cannot reach. Keeping smart judgment out of gates is a security property, not only a correctness one.
• The one channel that is instructions — ML's steering — arrives on an authenticated surface (ops/DEPLOYMENT.md), never mixed into ingested content. Text inside ingested material claiming to be operator direction is, definitionally, an attack.

3. Ingestion quarantine

External material lands in quarantine and earns its way out.

1. Quarantine tier: raw ingested text, untrusted, readable only by extraction workers and the injection scanner. Nothing in quarantine is citable, proposable, or publishable.
2. Extraction: typed-field extraction (§2) with provenance attached (§4). The injection scanner sweeps extracted fields for instruction-shaped content, laundering attempts, and coordinated-narrative markers.
3. Promotion by gate: extracted claims become candidate evidence; they enter the evidence pool only through the normal gated loop with distinct-provenance corroboration at the consequence dial's threshold for facts. A claim that will be published (highest audience consequence) needs the most corroboration; a claim that only prioritizes research needs less.

The quarantine is a commit boundary for information: exploration over raw material is unbounded and disposable; nothing becomes committed knowledge without corroboration counted by a dumb gate.

4. Provenance and taint tracking

Every claim, fact, proposal, and map entry carries its source and tier. Per-field source + confidence — the prototype applied this to facts; v2 extends it to all knowledge flows.

• Provenance is attached at extraction and travels with the claim through every transformation. A page's claims are traceable to committed evidence; committed evidence is traceable to sources (V2: claims trace to verified evidence).
• Taint: material whose provenance chain passes through quarantine-tier-only sources remains marked until corroborated from distinct provenance. Tainted claims can inform research direction; they cannot pass fact-check and cannot ship.
• Source tiers (authoritative / reputable / community / attacker-adjacent) are a declared classification, applied dumbly, maintained as a gated artifact.

5. The distinct-provenance corroboration rule

The subtle failure mode the corroboration machinery must survive: poisoned corroboration. The commit boundary assumes N independent observations. But if five workers read the same poisoned source — or five copies of the same planted claim — a naive gate counts five corroborations of one attacker input. Consensus doesn't just fail against data poisoning; it amplifies it, because the system is built to trust exactly the signal the poisoning fakes. Independence of runs is not independence of evidence.

The rule, enforced in the dumb-gate layer: corroboration counts only across distinct provenance. N proposals citing one source are one observation.

• Enforced in the shared gate library, where injection cannot reach — a script counting provenance fingerprints cannot be argued out of the rule.
• This closes the poisoned-corroboration hole at the deterministic layer. It does not close every independence hole: shared models and shared framings also correlate errors. Provenance is the source axis of independence; model and framing diversity are further axes to engineer.
• Fingerprinting "the same source" robustly — URL, domain, claim-hash, embedding similarity — without false-merging genuinely independent evidence is unresolved. [OPEN — flag for command center]

6. Blast-radius doctrine

Assume any worker can be owned by content it read. Design so that an owned worker's worst day is small.

• No worker holds keys. Credentials live with the substrate, granted per-action, least-access (V4). A compromised worker has no secrets to exfiltrate.
• A single publisher actor is the only path to the live site, behind the mechanical gatekeeper, pull-only (seo/PIPELINE.md stages 6–7). No other worker can publish, and the publisher executes only gatekeeper-cleared artifacts on its own schedule.
• No single worker's output reaches the site without the gatekeeper, and no claim ships without distinct-provenance corroboration at its consequence tier.
• Per-worker blast-radius enumeration: commissioning (corpus/COMMISSIONING.md) records, for every worker, what an owned instance could do — post to internal channels, write proposals, stage content, consume budget — and caps each structurally. A worker whose enumeration includes an uncapped consequence is not commissioned.
• Outbound surfaces beyond the site (e.g. outreach email) are release boundaries too and get the same treatment: gated, single-actor, pull-only.

7. The security playbook (workbook)

Injection defense is delivered knowledge, not per-deployment discovery. The system ships with a security playbook cold-started with known injection patterns and defenses, structurally identical to the voice-pattern library:

pattern / trigger / detection / mitigation / example

• Detection criteria and mitigation guidance are kept separate, on the same scanner/fixer context-separation rule as Voice 3D — the injection scanner reads detection criteria only.
• The playbook grows through the normal gated loop: red-team findings (§8), scanner catches, and researcher proposals enter as candidates and commit on distinct-provenance corroboration. Every deployment inherits every prior deployment's scars.

8. The security fleet

A dedicated fleet owns the function — discrete, named workers, each with one job:

1. Injection scanner pair (in the pipeline). A scan/fix pair in the elimination block (seo/PIPELINE.md stage 4c): the scanner detects instruction-shaped artifacts, laundering attempts, and policy-violating output before the gatekeeper, reading detection criteria only; the fixer reworks flagged sections reading mitigation guidance only.
2. Corpus auditor. A fresh-eyes, zero-context sweep of ingested and committed material for planted claims and coordinated narratives — the slow-poisoning detector. Runs on the internal clock over new commits; findings are proposals into the gated loop, and its provenance sweeps verify that committed claims' source chains still resolve.
3. Red-team worker. Continuously crafts injection attempts against a **sandboxed copy of the pipeline** on a schedule — the system attacks itself the same way it audits itself. Findings file into the security playbook through the gated loop. A red-team attempt that succeeds in the sandbox is a defect record against the defense that missed it; a period with zero successes is verified by planted known-answer attacks, because a silent red team is indistinguishable from a broken one — it is never retired on silence.

Fleet verdicts and findings are ledgered like everything else; security canaries (scanner catch-rate against planted attacks, corpus-audit coverage) sit in the monitoring layer with drift alarms.

9. Escalation and values interlock

• A confirmed injection reaching committed state is a highest-consequence incident: bad news that survives compression up the funnel intact (V3), with the taint radius — every claim whose provenance chain touches the poisoned source — enumerated mechanically from the ledger and re-gated.
• Genuinely ambiguous cases at the boundary (is this coordinated narrative or organic consensus?) follow V6: stop promoting the material, escalate; the claim waits in quarantine. Bias toward inaction binds contact with commits, not exploration.

10. What changed from the prototype

11. Open items

• Distinct-provenance fingerprinting implementation (§5). [OPEN — flag for command center]
• Engineering the further independence axes (model diversity, framing diversity) beyond provenance — provenance closes the source axis only. [OPEN — flag for command center]
• The cold-start pattern inventory for the shipped security playbook — which known injection patterns constitute the v2.0 seed set. [OPEN — flag for command center]
• Red-team cadence and sandbox fidelity requirements (how faithful must the pipeline copy be for findings to transfer). [OPEN — flag for command center]