v0.9.0 — untrusted-content fences

What's new

• Job descriptions, resumes and pasted pages are wrapped in an explicit fence before any model sees them, with one shared directive stating the text inside is data, never instructions.
• The classifier — which every fetched job passes through and which had no protection at all — is covered, along with the resume, match, cover-letter, verification and paste-extraction prompts.
• An injection attempt is no longer silently ignored: it is recorded as a prompt-injection-attempt red flag on the job, so the attempt itself becomes visible.
• Verification, the only path with web search, additionally refuses to fetch a URL the posting nominates or to treat such a page as corroboration.
• A CI guard derives its roster from the code itself, so a prompt builder or an AI call site added later cannot skip the fence.
• Fixed a latent bug where posting text starting with a dash could be read as a command-line flag by the local Claude CLI, and tightened the liveness checker to re-verify a URL after redirects.

Schema

• No schema changes. The attempt is recorded through the red_flags array that already existed.

Verification

• 683 tests green; the guard was shown to fail on a removed fence, an unregistered builder and a new AI call site; bench:resume 21/21 before and after; classifier scores stayed inside a measured noise band; one real cover letter generated with the fact gate passing.

References

• ADR 0022 — Fences make untrusted text data, and an attempt evidence
• PR #33 · plan §13 (F12)