Provenance & security: fail-closed by default

A system that ingests private chat logs, scrapes the web, and writes files an agent named must be paranoid by construction. ADR-0011 sets four standing constraints — fail-closed everywhere, PII-redaction before a byte leaves the machine, isolation of a leaked prompt corpus, and a clean-room rule — and they are not slogans: they show up as real guards in the code you've already met. This lesson connects the policy to the implementation: the Zod boundary, the realpath/path-traversal defense in the SkillStore, the fail-closed DEFAULT_TIER = T4, and PII redaction before the model call.

The four standing constraints

Constraint 1 in code: the path-traversal guard

You saw the SkillStore in Lesson 12. Its security spine is validateSupportPath — a pure function that refuses any relative path that could escape the skill's directory. It mirrors Hermes' has_traversal_component + _resolve_skill_target and is the textbook fail-closed validator: it lists what it allows and denies everything else.

// packages/hermes/src/skills/skill-store.ts:404-433 (condensed)
const validateSupportPath = (relPath: string): Result<string, Error> => {
  if (relPath.length === 0) return err(new Error('file path is required.'));
  if (relPath.includes('\\')) return err(…'use forward slashes.');   // no backslash tricks
  if (relPath.startsWith('/')) return err(…'must be relative.');     // no absolute paths

  const segments = relPath.split('/').filter((s) => s.length > 0);
  for (const segment of segments) {
    if (segment === '..' || segment === '.')                         // no traversal segments
      return err(…'path traversal is not allowed.');
  }
  const first = segments[0];
  if (first === undefined || !isSupportDir(first))                  // must be an ALLOWED subdir
    return err(…'first segment must be one of …');
  return ok(normalized);   // only now: a vetted, confined relative path
};

Notice the shape: every branch is a denial except the final ok. An attacker-controlled ../../etc/passwd is rejected at the .. check; a sneaky references/../../secret is rejected too. The function is pure and never throws, so it composes into the Result world cleanly — security failures surface as typed, fail-closed errors (ADR-0011 §1, "not silent passes").

Constraint 1, again: fail-closed by default tier

The deepest expression of fail-closed isn't a guard you call — it's the default. DEFAULT_TIER = T4 means any work that isn't explicitly classified as autonomous is parked, waiting for a human (Lesson 24, ADR-0005). The ADR draws the line itself: "this is also why DEFAULT_TIER = T4" — the unknown case denies. Unclassified autonomy is impossible by construction, not by remembering to check.

Constraint 2: PII before egress, not before emit

The subtle word is egress. It would be easy to redact PII just before showing a result to a user. ADR-0011 demands more: a Signal derived from a private channel (WhatsApp, Discord, Skool, Circle) is "PII-redacted before it leaves the local machine — before the model call, not merely before emit." The threat model assumes the model endpoint itself is outside the trust boundary, so raw private data must never be in a request payload at all.

Constraints 3 & 4: don't follow data, don't copy source

The last two are about discipline, not runtime checks. CL4R1T4S isolation: a leaked corpus of vendor prompts (and its injection-payload README) "is isolated and never ingested as instruction; it is data to analyze, never a command to follow." This is prompt-injection defense at the ingestion layer — the corpus is inert text, never executed. tac clean-room: tac is an educational-license blueprint, so "its patterns are reimplemented from scratch, with zero verbatim code or prompts, and its source is never published." The entire @alembic/hermes fusion is a from-scratch TypeScript reimplementation precisely because of this rule — which is also why the lessons cite Alembic's own source, never Hermes' Python.

Common confusions