Security audit, batch 3: prompt injection and honest boundaries

[Kurtisone]

Closes the audit. Follow-up to #12 (batch 1) and #13 (batch 2).

Four commits on top of main (091b757). 514 tests green (478
before, +36), ruff check and ruff format --check clean. Verified
by git am on a pristine clone of main.

This batch is the one the audit called architectural and least
urgent — and the most expensive to add later, once an Evolution
Runtime is writing code on its own.

E-2 — indirect prompt injection

A tool result is appended to step_context and re-injected into the
prompt that decides which tool to call next. So the text of a
fetched web page, a search result, or a system log reaches the
router's decision surface. A page containing a plausible
{"tool":"files","content":{"action":"write",...},"done":false} had
a real chance of being followed.

Fixed in two halves, of unequal weight.

Provenance markers (router/prompt.py). Each entry is wrapped in
explicit delimiters, with a header stating the block is quoted data
and that only the user's message decides the next tool. The markers
are stripped out of the tool output before insertion — without that
they are decorative, since a page containing the closing marker ends
the block early and everything after it reads as Forge's own
instructions. The steering hints stay outside the block for the
symmetric reason.

Escalation guard (orchestrator.py). Once a step has dispatched
web_fetch, web_search, research or sysadmin, no later step of
the same run may dispatch shell, test, or files with anything
but read/list. Checked before dispatch, so the tool never runs;
the run ends with a refusal naming which tool brought the outside
data in.

The second half is the one that matters. Prompt wording has failed to
steer this model three separate recorded times on this project (the
web_search chaining saga, review's JSON envelope, memory's
recall hint), so nothing here rests on the first.

Two deliberate calls:

• files:read does not taint. Read-then-write is the one legitimate
  multi-step flow this project actually uses (v3.9). Tainting it
  would break a real flow to defend against the operator's own
  workspace.
• _is_mutating() fails closed on files: anything not demonstrably
  a read or a list counts as a write. files.py's own parser is more
  forgiving than this check, and the gap between two parsers is
  exactly where an escalation would live.

Inert at the default MAX_STEPS=1, where there is never an earlier
step. ALLOW_MUTATION_AFTER_EXTERNAL_DATA=true switches it off for
anyone with a genuine fetch-then-write flow, warning at import like
shell.py's allowlist tripwire.

E-1 — files + test is shell

The docstring called this tool "Sandboxed" and listed a working
directory as what stops commands escaping to the host — the same
claim shell.py already retracted about itself, still standing here.

Running pytest means executing the Python code in the workspace. That
is what a test runner is. pytest test_x.py runs whatever sits at
module level, and pytest auto-loads conftest.py before collecting
anything, so even an invocation naming one innocuous file executes a
conftest.py next to it. Write a file, then run it.

No code fixes this without a disposable container per run, which this
process cannot do today. So it is stated plainly instead, and a
warning is logged at import when both tools are enabled.

One real bound added alongside, since it was cheap: arguments
pointing outside WORKSPACE_DIR are refused before anything runs, so
the tool can't lint /etc or collect tests from the host. Flags are
skipped so --tb=short still works; a flag's value is checked,
which is what catches pytest -p /tmp/plugin. This bounds where the
executed code may come from, not that it executes — and the docstring
says so rather than implying the check is more than it is.

Unlike files.py's _safe_path, an absolute path is rejected rather
than reinterpreted: there the router genuinely emits /hello.go
meaning the workspace file, here ruff check /etc is most likely
exactly what it looks like.

F-4 — SECURITY.md

The audit's threat model — one operator, one machine, WireGuard
exposure, public repo — is what every judgement in it rested on, and
it lived in the report and nowhere in the repository. Now written
down, along with what is enforced in code versus asked of the model,
and a limits section that states the residual gaps rather than
leaving them to be discovered: the per-run scope of the escalation
guard, the files+test equivalence, that the markers are a nudge,
and that MAX_STEPS=1 is doing real work at the default.

Testing

tests/test_prompt_provenance.py (7) and
tests/test_orchestrator_escalation.py (23) are new; the latter
includes the case that the read-then-write flow is untouched and that
the taint does not survive into the next run. tests/test_test_tool.py
gains 7 for argument confinement and the tripwire.

Verified live in the deployed container, not only in CI:

• The escalation guard, end to end with a stubbed router and the real
  dispatch path (web_fetch → files:write, MAX_STEPS=2): the
  fetch runs, the write is refused before dispatch, pwn.txt is
  never created. Stubbing the router rather than prompting for it is
  deliberate — this model does not chain steps reliably, which is why
  research/recall/sysadmin are deterministic graphs, so no
  prompt reaches the second step dependably. The guard is a backstop
  for a model or a MAX_STEPS that does, and it has to be verified
  as one.
• The files + test tripwire, in the startup log with both tools
  enabled.

Two pre-existing bugs surfaced while testing this branch and are
not caused by it — both reproduce on main, tracked separately:

1. _all_json_objects in router/parser.py counts braces without
   tracking string context, so a valid router object whose content
   holds file text with unbalanced braces (Go, C, Rust, JS, a nested
   dict) is discarded and the run falls through to the plain-text
   chat fallback. hello.py works only because print('...') has no
   braces.
2. Nesting a JSON payload inside a JSON string field needs double
   escaping, which this model does not hold across multi-line file
   content — the inner payload fails with an invalid control
   character even when the outer object parses.

Together they mean files:write through the router fails for most
real file content. Fixed on a separate branch.

Not in this batch

The two router/parser.py faults described above — brace counting
that ignores string context, and the double-escaping a nested JSON
payload requires — are their own branch. They break files:write
through the router for most real file content, and they predate this
work.

The four sysadmin honesty defects found during batch 2's
pre-merge testing (silent journalctl -k fallback, unfiltered
.device units bloating the prompt, sysadmin/research routing
ambiguity, confident-and-wrong synthesis with no "say so if the logs
don't answer" instruction) are separate work, and higher value than
anything left in the audit.