L08-04 — Contain private state, hostile documents, and model output #64

Outcome

Minimize input fields, isolate process capabilities, ban unapproved outbound bytes, and treat PDF text as data. Apply jev's containment rules: structured state only (no rendered pages or artwork bytes in the loop); only decision-relevant text, the way jev sends visible text and drops offscreen bodies; instructions state that document text is untrusted data; and model output can only select an offered index.

Parent and boundary

Parent: #9. Owner: proposed Decision module. This issue owns one bounded slice of Bounded Decision Worker; consume accepted upstream contracts and keep PDF/verdict/publication authority with Core.

Acceptance

• Adversarial embedded instructions cannot change the task, widen the candidate table, access data, or reach execution.
• Model output never becomes a Core ID, path, parameter value, or plan field except by selecting an offered index; text slots are governed by L08-08 — Gate free-text slots behind a single-key text helper #261.
• Per-task budgets (decisions, candidates, wall time, tokens) are enforced. A budget breach yields ABSTAIN with a reason, never a partial observation.
• Provider credentials stay in the worker process; clients never see them.
• Failure case: telemetry containing customer artwork, hidden prompt leakage, or any provider egress without an approval record fails.

Required proof

Prompt-injection, output-injection (non-offered IDs, smuggled parameters), egress, telemetry, timeout, budget, and resource tests. Record the exact source SHA, test command or hosted run, fixture/artifact identity, and any skipped or unavailable lane. Run the repository's mapped proof and check-change gate for a PR.

Handoff

Record changed files, observed result, remaining risk, and a 1–3 sentence anti-slop review. Completion means acceptance evidence, not merely a merged implementation.

Sources

Approved master roadmap · North Star: jev-ultrafast@1231850a; see the translation table in #9.

Generated by Claude Code