Documentation

Provenance and quarantine

How untrusted text is contained, and how planner context is recorded.

The context split

The privileged planner is the only context with tool access, and sees only trusted inputs. Raw CI log text goes instead to a quarantined reader with zero tool access, whose output is restricted to a schema-validated structure with per-entry length and count caps. Anything failing validation is dropped and recorded, never passed through as raw text.

The invariant is enforced by deletion: the raw excerpt is removed from the details object before that object reaches the planner, on the failure path as well as the success path.

The provenance manifest

Every distinct piece of context a diagnosis received is recorded with a SHA-256 hash, in two trust classes. Quarantined inputs record both the raw untrusted input and the canonical extraction, so the extraction step itself is checkable. Direct inputs — the intent document, each source file read, and the sanitized incident metadata — record a hash so a stored manifest can later be compared against live content to detect substitution after the fact.

What this is not

“Quarantine” here means the provenance-keyed context split and nothing else. It is a prevention mechanism, not a way of containing a misbehaving agent — that would be a freeze, and it is not built. Source files and the intent document are hash-tagged for tamper evidence but are not extraction-filtered, because the planner needs their literal content to produce a correct diff.