- Shipped
- November 7, 2026 at 1:24 AM UTC
- Author
- Kamo
- Commit
- e15ab6d
InjectionRegressionGateTest holds the Tool Plane's real defenses against hidden instructions, under the most permissive charter: every tool that hands over content written outside the conversation (email, documents and attachments, chat, call recordings and voicemail, meeting transcripts, texts) stays untrusted in the real catalogue; after an injected read on each surface, the real ToolVisibility and RunTaint keep security and money tools away, a device never moves without a person, and on a call or in a meeting nobody unproven gets a side effect beyond a reply (golden pdp/injection-gates.txt, with the decision record's outcome and rule from SIE2's PDP). Results.inert: in the model's text only, runs of <<< / >>> inside untrusted content become guillemets, so the content can never end its block and start a made-up instruction; structuredContent is unchanged. Same rule as kamoai-service's Situation.inert. The Docker build runs the gate with the package: a red gate builds no image.