EXPLORER

The passage is hostile. The registry was already closed.

This architecture puts untrusted content into model context on purpose — retrieved passages, uploaded files, the record a panel is reading. That is the design, not an oversight. Poison a document below, run the turn, and watch where the attack actually stops.

REGISTRY COMPOSED

CORPUS · 3 DOCUMENTS

Runbook § 4.1 — Refunds Opened items are credited to store credit. Full refunds over $100 need a supervisor.

Ticket #8812 — Sarah Chen Order #4471 shipped 14 hours ago. Customer asking for status.

POISONED DOCUMENT — EDIT IT

THE TURN

Run the turn to see where it lands.

The order of the first two steps is the entire defence. Try it both ways.

The honest limit. Composing the registry first stops a passage acquiring a capability. It does not stop a passage lying. Try the fourth attack — it never asks for a tool, so nothing structural blocks it, and the answer to that one is grounding and confirmation rather than the registry.

What that showed

Composing the registry before a single passage is read is what makes the first three attacks fail — not a filter, not a scanner, and nothing that has to recognise hostile phrasing. The fourth one still gets through, because it never asks for a capability. That is the honest boundary of this defence, and the reason grounding and a confirmation step sit behind it.