V2 P1: Memory Firewall — write/retrieval guards, PII/secret, poisoning fixtures

[cursor]

Background

Signature V2 differentiator: protect persistent memory from poisoning and unsafe writes.

Problem Statement

Write pipeline scores importance/trust but lacks secret/PII scan, prompt-injection inspection, and retrieval-side integrity checks.

Proposed Solution

• Extend scoring/write_pipeline.py + memory/quarantine.py
• Write decisions: ACCEPT / QUARANTINE / REVIEW / REJECT
• Retrieval guard: quarantine + integrity + instruction-vs-data separation
• Attack fixtures: prompt injection, authority spoofing, malicious procedure, cross-tenant, sleeper memory

Acceptance Criteria

• Poisoned candidates quarantined and excluded from normal retrieval
• Secret-shaped content redacted/rejected before durable storage
• Low-authority text cannot override high-authority policy
• Poisoning fixture tests

Depends on

P0 Evidence + Quarantine foundations

Plan ref

todo p1-later — V2 Enhancement 6