Oleksandr Kozachuk
34 lines
1.5 KiB
Markdown
34 lines
1.5 KiB
Markdown
# SPEC-003 — Safety, privacy + abuse hardening
|
|
|
|
FDB-005 lands the injection-defense subset (the old `hack`
|
|
self-report was the only defense — S4). Consequential actions are
|
|
gated *outside* the model: the model proposes, deterministic code
|
|
disposes. Quotas, budget caps, memory policies and GDPR controls
|
|
follow with FDB-014 (SAF-10+, reserved).
|
|
|
|
### SAF-01 — Model-proposed channel routing is allowlisted (coverage: test)
|
|
|
|
A model-proposed answer channel is honored only when it is in the
|
|
allowed set: config `allowed-channels` when set, otherwise the
|
|
channels already named in config (`chat-channel`, `staff-channel`,
|
|
`welcome-channel`, `additional-responders`). Anything else falls back
|
|
to the origin channel and is logged. Prompt injection must not be
|
|
able to redirect the bot into arbitrary channels.
|
|
|
|
### SAF-02 — Outbound messages cannot ping (coverage: test)
|
|
|
|
The bot is constructed with `allowed_mentions = none`: no user, role
|
|
or @everyone/@here pings in any outbound message, regardless of what
|
|
the model emits.
|
|
|
|
### SAF-03 — External text is sanitized before prompting (coverage: test)
|
|
|
|
Text from external sources injected into prompts or tool results —
|
|
news-feed content and IGDB results — passes `sanitize_external_text`:
|
|
control characters stripped, `@everyone`/`@here` neutralized with a
|
|
zero-width space, length capped (default 4000 chars). RSS headlines
|
|
and game descriptions are attacker-influenced input.
|
|
|
|
The `hack` envelope field remains as an advisory signal (logged,
|
|
staff-notified) but is no longer the defense.
|