# SPEC-003 — Safety, privacy + abuse hardening

FDB-005 lands the injection-defense subset (the old `hack`
self-report was the only defense — S4). Consequential actions are
gated *outside* the model: the model proposes, deterministic code
disposes. Quotas, budget caps, memory policies and GDPR controls
follow with FDB-014 (SAF-10+, reserved).

### SAF-01 — Model-proposed channel routing is allowlisted (coverage: test)

A model-proposed answer channel is honored only when it is in the
allowed set: config `allowed-channels` when set, otherwise the
channels already named in config (`chat-channel`, `staff-channel`,
`welcome-channel`, `additional-responders`). Anything else falls back
to the origin channel and is logged. Prompt injection must not be
able to redirect the bot into arbitrary channels.

### SAF-02 — Outbound messages cannot ping (coverage: test)

The bot is constructed with `allowed_mentions = none`: no user, role
or @everyone/@here pings in any outbound message, regardless of what
the model emits.

### SAF-03 — External text is sanitized before prompting (coverage: test)

Text from external sources injected into prompts or tool results —
news-feed content and IGDB results — passes `sanitize_external_text`:
control characters stripped, `@everyone`/`@here` neutralized with a
zero-width space, length capped (default 4000 chars). RSS headlines
and game descriptions are attacker-influenced input.

The `hack` envelope field remains as an advisory signal (logged,
staff-notified) but is no longer the defense.