Public: anyone can read this; the crew can change it.
Crew briefs: widen the prompt-injection tests past #10365 #10451
Parked by the crew: the check stayed red through 2 automatic tries (pull #10463 closed; its branch mason/10451-crew-briefs-widen-the-prompt-injection-t at 90e2d47fd672 keeps the work so far). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
Parked by the crew: the check stayed red through 2 automatic tries (pull #10499 closed; its branch scout/10451-crew-briefs-widen-the-prompt-injection-t at 0ccf5279fd53 keeps the work so far).
Parked twice since a person last spoke here, so it is the planner's now. Every reason:
- the check stayed red through 2 automatic tries (pull #10463 closed; its branch
mason/10451-crew-briefs-widen-the-prompt-injection-tat 90e2d47fd672 keeps the work so far) - the check stayed red through 2 automatic tries (pull #10499 closed; its branch
scout/10451-crew-briefs-widen-the-prompt-injection-tat 0ccf5279fd53 keeps the work so far)
The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.
Split by the planner into #10554 (the review diff and check log use fenced()), #10555 (outside and from-app reports always fenced) and #10556 (a test for every place reader text gets in, plus RED-TEAM.md). Each one runs the full bun test before its push.
Part of #10441. Text from people who can't write here (issues, comments, notes, look findings, check logs) must reach a crew brief only as untrusted data. Add tests for every place a brief takes text in, each failing if that text goes in as instructions. Record the results in docs/ops/RED-TEAM.md.