mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-13 11:40:53 +08:00
BaaRai
8acf1be46e
Phase B, part 1 of the agentic attack-class audit (issue #124). - Planner and cold-digest compactor: a code-owned untrusted-data tail after the rendered body. Worker summaries, facts, digests, traces and tool outputs are data; they cannot add goals, targets or scope, end the task, or be relayed through steer_work as instructions. - The #49 untrusted-content block moves out of the editable section [A] of the worker, mainagent, auto and pentest seeds into a code-owned tail, also applied to the reporter. A body that already carries the block verbatim (rows seeded before this change) does not get it twice. - Planner user message: a code-owned goal anchor after the situational block restates the task goal and the operation constraints and asks each new intent to name the goal id it serves. The message builder is factored into plannerRoundInput for pure tests. - bbot-recon skill: every event field is untrusted; only scope_distance == 0 reaches insert_assets; scope_distance > 0 stays an intel fact with source=third_party_intel, never auto-scoped; FINDING text is a lead. Tests: prompt_injection_seed_test.go checks that a PromptOverride without the block still renders the tail for every role, planner and compactor included, that the block is not duplicated, and that the planner input ends with the goal anchor. shipped_skills_test.go checks the bbot markers.