fix defects D1-D12 batch 1, structured envelope, saf gates + ops kill-switches

specs/SPEC-003-safety.md

@@ -0,0 +1,33 @@
+# SPEC-003 — Safety, privacy + abuse hardening
+
+FDB-005 lands the injection-defense subset (the old `hack`
+self-report was the only defense — S4). Consequential actions are
+gated *outside* the model: the model proposes, deterministic code
+disposes. Quotas, budget caps, memory policies and GDPR controls
+follow with FDB-014 (SAF-10+, reserved).
+
+### SAF-01 — Model-proposed channel routing is allowlisted (coverage: test)
+
+A model-proposed answer channel is honored only when it is in the
+allowed set: config `allowed-channels` when set, otherwise the
+channels already named in config (`chat-channel`, `staff-channel`,
+`welcome-channel`, `additional-responders`). Anything else falls back
+to the origin channel and is logged. Prompt injection must not be
+able to redirect the bot into arbitrary channels.
+
+### SAF-02 — Outbound messages cannot ping (coverage: test)
+
+The bot is constructed with `allowed_mentions = none`: no user, role
+or @everyone/@here pings in any outbound message, regardless of what
+the model emits.
+
+### SAF-03 — External text is sanitized before prompting (coverage: test)
+
+Text from external sources injected into prompts or tool results —
+news-feed content and IGDB results — passes `sanitize_external_text`:
+control characters stripped, `@everyone`/`@here` neutralized with a
+zero-width space, length capped (default 4000 chars). RSS headlines
+and game descriptions are attacker-influenced input.
+
+The `hack` envelope field remains as an advisory signal (logged,
+staff-notified) but is no longer the defense.

specs/SPEC-006-operator-controls.md

@@ -0,0 +1,58 @@
+# SPEC-006 — Staff / operator controls
+
+Staff operate the bot from the staff channel without SSH. Runtime
+flags live in memory — a restart resets to config defaults (D-008).
+The staff-alert path is a tested contract: alerts are the
+business-critical feature on the restaurant deployment.
+
+### OPS-01 — Staff commands only work in the staff channel (coverage: test)
+
+`!bot …` commands are honored only when sent in the configured staff
+channel. In any other channel the text is treated as a normal
+message.
+
+### OPS-02 — Pause and resume (coverage: test)
+
+`!bot pause` stops all public replying (messages are ignored, no
+model calls); `!bot resume` restores it and clears quiet mode. Staff
+commands keep working while paused.
+
+### OPS-03 — Image kill-switch (coverage: test)
+
+`!bot images off` drops the picture part of any response before
+generation (answer text still goes out); `!bot images on` restores.
+
+### OPS-04 — Quiet mode with auto-resume (coverage: test)
+
+`!bot quiet <minutes>` silences public replies for N minutes, then
+the bot resumes by itself. Friday-service panic button that cannot be
+forgotten.
+
+### OPS-05 — Status report (coverage: test)
+
+`!bot status` answers in the staff channel with the current flags
+(replies / images / tasks / remaining quiet time).
+
+### OPS-06 — Keyword-forced staff alerts (coverage: test)
+
+When a user message matches any configured `staff-alert-keywords`
+regex and the model set no staff note, a staff alert is forced with
+user + message excerpt. Alerting must not depend solely on the
+model's judgement.
+
+### OPS-07 — Staff alerts are rate-limited (coverage: test)
+
+At most `staff-alert-max-per-hour` (default 10) alerts reach the
+staff channel per rolling hour; excess alerts are logged. An
+injection or a glitch must not be able to flood staff.
+
+### OPS-08 — Lost staff alerts are logged (coverage: test)
+
+When a staff alert cannot be delivered (staff channel unresolved),
+the alert text is written to the error log — never silently dropped.
+
+### OPS-09 — Self-tasking kill-switch (coverage: test)
+
+`!bot tasks off` disables bot-initiated posting (today: the boreness
+loop; later: the FDB-011 scheduler); `!bot tasks on` restores.
+Bot-initiated posts also respect pause/quiet.