riotpiao.com/tasks/5.10-prompt-injection-defenses.md

5.10 — Prompt injection defenses (GREEN)

Phase: 5 — Chat + Rate Limiter (Surface D) Stage: GREEN

Depends on: 5.4

• System prompt is compile-time constant, unreachable by user input; cluster snapshot digest injected in a delimited block explicitly labelled untrusted data; user message always last; no tool-calling — model reads pre-built digest, cannot query anything; max_tokens: 1500 cap

Verify

go test ./... -run TestInjection -v