SECURITY + CONTINUITY

Injection defense as a first-class discipline, and durability as a rehearsed procedure. ↳ system/seo/SECURITY.md · system/seo/CONTINUITY.md

1 · CONSUME EVERYTHING, TRUST NOTHING

The system's entire premise is consume everything: it subscribes inboxes to attacker-controllable mailing lists, scrapes competitor sites, reads forum and Reddit threads, ingests ad copy, transcripts, product pages, and community chatter — and feeds all of it to LLM workers whose outputs become proposals, evidence-pool facts, map entries, and ultimately published pages. Every one of those inputs is an injection surface. An attacker does not need access to the system; they need only to publish text the system will read.

All external text is data, never instructions. The defense is structural — quarantine tiers, typed-field extraction, provenance and taint tracking, gated promotion — not vigilance.

↳ system/seo/SECURITY.md §1–§2

2 · The quarantine flow

raw external text
untrusted, attacker-controllable
→
Quarantine tier
raw ingested text, untrusted, readable only by extraction workers and the injection scanner. Nothing in quarantine is citable, proposable, or publishable.
→
Extraction
typed-field extraction (§2) with provenance attached (§4). The injection scanner sweeps extracted fields for instruction-shaped content, laundering attempts, and coordinated-narrative markers.
→
Promotion by gate
extracted claims become candidate evidence; they enter the evidence pool only through the normal gated loop with distinct-provenance corroboration at the consequence dial's threshold for facts. A claim that will be published (highest audience consequence) needs the most corroboration; a claim that only prioritizes research needs less.

↳ system/seo/SECURITY.md:47 (§3 ingestion quarantine)

THE DISTINCT-PROVENANCE RULE — poisoned corroboration closed at the dumb-gate layer. The rule, enforced in the dumb-gate layer: corroboration counts only across distinct provenance. N proposals citing one source are ONE observation. An attacker who plants one convincing source and gets five workers to cite it has manufactured one observation, not five — the corroboration count never moves. The gate does not judge the source's persuasiveness; it counts fingerprints. Dumb, and therefore unpersuadable. ↳ system/seo/SECURITY.md §5

3 · THE SECURITY FLEET

Injection scanner pair (in the pipeline)
A scan/fix pair in the elimination block (seo/PIPELINE.md stage 4c): the scanner detects instruction-shaped artifacts, laundering attempts, and policy-violating output before the gatekeeper, reading detection criteria only; the fixer reworks flagged sections reading mitigation guidance only.
↳ system/seo/SECURITY.md:142 (§8)
Corpus auditor
A fresh-eyes, zero-context sweep of ingested and committed material for planted claims and coordinated narratives — the slow-poisoning detector. Runs on the internal clock over new commits; findings are proposals into the gated loop, and its provenance sweeps verify that committed claims' source chains still resolve.
↳ system/seo/SECURITY.md:142 (§8)
Red-team worker
Continuously crafts injection attempts against a sandboxed copy of the pipeline on a schedule — the system attacks itself the same way it audits itself. Findings file into the security playbook through the gated loop. A red-team attempt that succeeds in the sandbox is a defect record against the defense that missed it; a period with zero successes is verified by planted known-answer attacks, because a silent red team is indistinguishable from a broken one — it is never retired on silence.
↳ system/seo/SECURITY.md:142 (§8)

4 · BLAST RADIUS — structural containment

↳ system/seo/SECURITY.md §6 (blast-radius doctrine)

5 · CONTINUITY — backup, rollback, restore drills

Everything-as-code: all system state that can live in the repo does. The repo is the system's body; the host is a place the body happens to run. Any fresh host plus the repo plus the secrets ledger's restore procedures must equal the system. ↳ system/seo/CONTINUITY.md §1

Nightly sanitized snapshots

The agent layer — configuration, the cron/schedule registry, skills, memories, channel maps and directory — is snapshotted nightly by a backup worker. Sanitized: secrets are excluded, always. The snapshot is committed with a dated tag; a leaked snapshot must be an inconvenience, not a compromise. Sanitization is a checked property, not a habit: the output passes a dumb secret-pattern scan before commit, and a match blocks the commit and raises a finding. Dated tags make every night a named restore point; the snapshot series is itself ledgered, so gaps are detectable by timestamp arithmetic.

↳ system/seo/CONTINUITY.md §2

The secrets ledger — inventory in git, values never

Secrets are the one class of state that must never be machine-restorable — credentials are granted, never derived (V4). What ships is a secrets ledger: the inventory in git, the values never. One entry per key: name, purpose, location, rotation, and the exact human restore procedure. It makes a total-loss restore a checklist ML can execute rather than an archaeology project; the launch prerequisite check doubles as the restore-time verifier.

↳ system/seo/CONTINUITY.md §3

Three rollback tiers

1 · Change-level
a committed change (directive update, playbook merge, pattern addition, worker change) rolls back through the same gate and review machinery that admitted it — reviewer-triggered rollback on regression, retire-with-record for workers. Removing capacity demands stronger evidence than adding it.
→
2 · Commit-level
any gated change or publish is a repo commit; git revert restores the prior state of any artifact, page, or configuration without touching anything else. Everything-as-code guarantees this tier's coverage.
→
3 · System-level
total loss of the host: restore the agent layer from the latest dated snapshot plus the repo onto a fresh container/host, then re-grant secrets per the ledger. The one tier that must be rehearsed, because it is never exercised naturally.

↳ system/seo/CONTINUITY.md §4

Restore drills — an untested backup is a hypothesis. A backup that has never been restored is not a backup; it is a hypothesis about a backup. A periodic restore-drill worker restores the latest snapshot plus repo into a scratch environment and verifies: the system boots; configuration, cron registry, skills, memories, and channel maps are present and coherent; a dry-run of representative loops executes end to end — with no real keys, which the drill also verifies (a snapshot that restores a working credential has FAILED sanitization). The drill emits a typed outcome record with measured time-to-restore — a metered series with a drift alarm: a restore that has been getting slower is a finding before it is an outage. A failed drill is bad news and survives compression up the funnel intact (V3). The drill worker is never retired on silence, and its own function is canary-verified: periodically a deliberately-broken snapshot must be caught as a failed restore — a drill that passes everything is indistinguishable from a drill that checks nothing. ↳ system/seo/CONTINUITY.md §5