Skip to content

0057 — ARIA security, cost, and isolation invariants (Group L)

Status

Folded into OPERATIONS/aria.md (A-D1 rate limits, A-V1 layered injection defense incl. 0093-item-14 instruction_override hard-block, A-V2 wash-trade aggregate filters, A-D2 continuous multiplier, A-I2 envelope-parse ladder, A-I3 per-player cost model), SYSTEMS/realtime-bus.md (A-I1 single-recipient room), and OPERATIONS/aria.md § Security log retention (A-V3 GDPR) — defer to those pages for the canonical description (2026-08-04, re-verified). All items verified present in target docs; classifier Layers 3/5 accurately marked BUILT DARK behind ARIA_PROMPT_CLASSIFIER_ENABLED (confirmed in gameserver core/config.py). (re-verified 2026-08-06)

Context

Eight audit findings clustered around three sub-problems on ARIA: input/output security — the prompt-injection defense was unspecified beyond "25+ regex patterns," JSON-envelope parse-failure was undefined, the realtime bus's personal:{user_id} rooms had no documented single-recipient invariant, and cross-player market aggregates feeding ARIA had no defense against wash-trade poisoning once ADR-0038 dropped the explicit anti-gaming layer; economics — rate-limit bindingness and multi-regional cost-cap accounting were ambiguous; and behaviour/compliance — the consciousness-level multiplier's continuous-vs-atomic gating and security-log retention conflicted with GDPR right-to-erasure. This ADR made rate limits binding hard caps (A-D1), specified a five-layer injection defense with a classifier-driven hard-block on adversarial categories (A-V1), closed the aggregate-poisoning gap via the multi-account discount (ADR-0056) plus reciprocal-trade exclusion (A-V2), made the consciousness multiplier continuous per-call rather than atomic (A-D2), locked personal:{user_id} as single-recipient (A-I1), defined the envelope parse-failure escalation ladder (A-I2), made cost caps per-player with the platform absorbing aggregate LLM spend (A-I3), and set 90-day-raw-then-anonymize retention on security logs to satisfy GDPR (A-V3). ARIA's per-player, no-aggregate-ML constraint (ADR-0016) still doesn't eliminate cross-player exposure via aggregates/logs/cost pooling — that's what this ADR closes.

Folded into: - OPERATIONS/aria.md — A-D1, A-V1 (incl. the ADR-0093 item-14 instruction_override hard-block amendment below), A-V2, A-D2, A-I2, A-I3, and § Security log retention (A-V3) - SYSTEMS/realtime-bus.md — A-I1 single-recipient room invariant

  • ADR-0016 — per-player ARIA, no aggregate ML.
  • ADR-0017 — consciousness-level scale.
  • ADR-0038 — observation-log learning model that replaced the original anti-gaming layer (the gap A-V2 closes).
  • ADR-0053 — periodic-service surface used by the 90-day anonymization job.
  • ADR-0056 — multi-account discount layer used by A-V2.
  • ../SYSTEMS/aria-dialogue.md — consciousness multiplier semantics.
  • ../DATA_MODELS/player.md — aria_violation_count, aria_blocked_until, aria_bonus_multiplier.

Addendum — 2026-07-10 (Max ruling: layer-4 hard-block categories)

Per ADR-0093 item 14, A-V1's Layer 3 classifier category set gains a fourth category and a category-gated hard-block policy on top of the existing probability threshold. This addendum is the canon reference; the A-V1 section above is unchanged.

  • New category: instruction_override. Added to the classifier's category set alongside the existing jailbreak / extraction / role_confusion / off-topic / clean.
  • Four categories hard-block: a classification of instruction_override, extraction, jailbreak, or role_confusion triggers a hard 400 with a lore-friendly rejection message, independent of the inject_probability threshold.
  • Every other classification (off-topic, clean) flows through the existing pipeline: filtered, logged, and trust-laddered per A-I2 — no hard block.

This does not change the inject_probability ≥ 0.6 threshold check at A-V1 — the category-based hard-block is an additional, independent gate on the four listed categories.