claude-config: record the security caveats of the unhobbling posture (guardrail deletion, notes poisoning)

[claude]

Context

Signed-off decision Q8 of the context-engineering integration contract (2026-09-01): the
corpus's fresh-pass critique found the security consequences of the unhobbling posture raised
by NO prior layer (gap G-SEC): deleting behavioral guardrails makes surrounding context the
judgment input without re-securing the named worst cases (e.g. file deletion), and
notes-file/memory patterns carry a poisoning surface (the memory cookbook itself names
"memory poisoning" as a critical risk with mitigations deferred to unfetched code). Filed as
its own item because burial has a safety cost.

Proposed work

• Add a security caveat to the deletion-recommending surfaces: audit-instructions'
  deletion-class checks and unhobble's experiment posture note that guardrail deletions in
  security-relevant domains require the exception register's protected classes (sibling
  item) and a review:security-review lens on the diff.
• Add a memory/notes-poisoning caution to any convention that mandates persistent notes
  files (sequenced with the session-flow notes-file convention if it proceeds): notes are
  untrusted input on re-read.
• Decide whether review:security-review's checklist gains an "instruction-surface deletions"
  lens.

Acceptance criteria

• Deletion-recommending skills name the security carve-out.
• Any notes-file convention carries the poisoning caution at birth.
• A recorded decision on the security-review lens.

Status

The first criterion is met by #3588 (merged as ae3aa802). Every deletion-recommending surface
now names the carve-out: audit-instructions criteria I1, I4 and I5 hold a candidate matching a
protected class and propose compression instead of deletion, and unhobble Phase 4 restores such
a rule whether or not the ledger logged a stumble against it, rather than leaving it deleted on
silence. The protected classes are Gate 0's six, adopted by reference in
docs/conventions/instruction-exception-register/, and they include secret-handling and
irreversible-action — the file-deletion worst case this issue names.

What that change does NOT do, and why this issue stays open at priority high:

• It is a categorical hold, not a review requirement. Nothing yet routes a guardrail-touching
  deletion diff to review:security-review, which is the second half of the first bullet.
• The notes-poisoning caution has no home, because no notes-file convention was minted (V6
  declined it on sequencing grounds — see docs/specs/context-engineering-vertical-decisions.md).
  The caution should land with that convention if it is ever written; until then there is nothing
  to attach it to, and this criterion cannot be cleared by writing prose somewhere arbitrary.
• The security-review lens decision is untouched.

References

Both docs/topics/** paths this issue originally cited are gone and neither will resolve. The
context-engineering-claude-5 slice was pruned from main by the topic-docs v3.0.0 adoption
(#3557) before its corpus-input note was written, so G-SEC exists only as this issue. The
integration contract was contract tier and pruned before merge per that same convention; it
survives as the pasted body of #3588.

• feat(conventions): absorb the context-engineering corpus and add the instruction exception register #3588 — the merged pull request whose body carries the signed-off contract, including Q8.
• docs/conventions/instruction-exception-register/README.md — the protected classes and the
  consumers that read them.
• docs/specs/context-engineering-critical-apparatus.md — the G-SEC critique rows.
• docs/specs/context-engineering-vertical-decisions.md — V6, why no notes-file convention was
  minted.