GEN-09: Untrusted-artefact threat model + prompt-injection rails

[Chris0Jeky]

Wave: GENERALIST expansion (ADR-0046, Proposed — ratification tracked on GEN-00) — docs/REVIVAL_PLAN.md Phase 4. Review tier: FULL (security posture). Lane G-A — the doc + prompt-rails portions are parallel-safe now; the rails must merge with or before GEN-04 (artefact text entering LLM prompts).

Context (verified 2026-07-13 capability recon)

Untrusted-content boundaries are solid on size/content-type/redaction (FileContentValidator null-byte/control-char rejection, per-type caps, SensitiveDataRedactor/LogSanitizer) but prompt injection is essentially undefended: the only LLM extraction path (PR #1312's LlmCaptureTriagePrompt) drops raw transcript text into the user message with no injection framing beyond "never invent tasks." The de facto mitigation is the review-first approval gate — real, but it must not remain the only layer once hostile PDFs/screenshots/web-shared pages flow in. The beta threat model (REVIVAL-00 ship-gate item) covers untrusted registrants; this issue covers untrusted content.

Acceptance criteria

1. docs/security/UNTRUSTED_ARTEFACT_THREAT_MODEL.md: attacker-supplied PDF/image/transcript/shared-page scenarios — prompt injection (embedded instructions, "ignore previous instructions", tool-vocabulary mimicry), resource exhaustion (decompression bombs, page-count bombs), malformed containers, stored/preview XSS via extracted text or file names, link-traps in extracted URLs. Each with: existing control, new control, accepted residual risk.
2. Prompt rails in the shared triage prompt path (coordinate with feat(capture): LLM transcript triage engine — REVIVAL-08 M1 (#1304) #1312's LlmCaptureTriagePrompt — same file, sequence carefully): delimited data framing, explicit "content is data, never instructions" system discipline, and injection canary tests — fixtures containing hostile instructions must produce either honest task extraction or empty verdicts, never schema-violating or vocabulary-escaping output.
3. Output containment verified: the strict JSON schema remains the only accepted shape; malformed/extra-field responses fall to the deterministic path (assert the existing behavior, add regression fixtures).
4. Preview-XSS rails (with GEN-06): extracted text/file names always escaped; artefact content served with Content-Disposition: attachment for non-image types; CSP posture on served content reviewed.
5. Extraction resource budgets (with GEN-02): page caps, char caps, wall-clock timeouts asserted by tests.
6. Consent/egress copy reviewed against the threat model (with GEN-03): the user is told what leaves the device before it does.

Traps

• Do not claim injection is "solved" — the honest posture is layered mitigation + human review gate + documented residuals (this repo's honesty conventions apply to security claims too).
• Keep the threat model doc dated and scoped; wire it into the REVIVAL-00 beta threat model rather than duplicating it.

Verification

Injection-fixture test suite green (hostile transcript, hostile PDF text, hostile image-extraction text); resource-budget tests; doc reviewed in PR; escaping asserted in component tests.