discord_bot/specs/SPEC-003-safety.md

SPEC-003 — Safety, privacy + abuse hardening

FDB-005 lands the injection-defense subset (the old hack self-report was the only defense — S4). Consequential actions are gated outside the model: the model proposes, deterministic code disposes. Quotas, budget caps, memory policies and GDPR controls follow with FDB-014 (SAF-10+, reserved).

SAF-01 — Model-proposed channel routing is allowlisted (coverage: test)

A model-proposed answer channel is honored only when it is in the allowed set: config allowed-channels when set, otherwise the channels already named in config (chat-channel, staff-channel, welcome-channel, additional-responders). Anything else falls back to the origin channel and is logged. Prompt injection must not be able to redirect the bot into arbitrary channels.

SAF-02 — Outbound messages cannot ping (coverage: test)

The bot is constructed with allowed_mentions = none: no user, role or @everyone/@here pings in any outbound message, regardless of what the model emits.

SAF-03 — External text is sanitized before prompting (coverage: test)

Text from external sources injected into prompts or tool results — news-feed content and IGDB results — passes sanitize_external_text: control characters stripped, @everyone/@here neutralized with a zero-width space, length capped (default 4000 chars). RSS headlines and game descriptions are attacker-influenced input.

The hack envelope field remains as an advisory signal (logged, staff-notified) but is no longer the defense.