# 5.10 — Prompt injection defenses (GREEN)

Phase: 5 — Chat + Rate Limiter (Surface D)
Stage: GREEN

Depends on: [5.4](5.4-injection-test.md)

- [ ] System prompt is compile-time constant, unreachable by user input; cluster snapshot digest injected in a delimited block explicitly labelled untrusted data; user message always last; **no tool-calling** — model reads pre-built digest, cannot query anything; `max_tokens: 1500` cap

## Verify

```bash
go test ./... -run TestInjection -v
```