docs(confidence-engine): close pre-tester security review

docs/current-handoff.md

@@ -134,6 +134,51 @@ Jenkins SCM branch used to load the Jenkinsfile is conceptually separate from th
 - No punctuation/HTML/SQL-style content stripping introduced.
 - Reasoning semantics unchanged.
 
+## Pre-Tester Input Security Review
+
+**Status:** closed — sufficient for controlled external-user testing. Not a general security audit, penetration test, or production-launch certification.
+
+### SQL injection
+- No raw request-driven SQL construction found.
+- Persistence uses Supabase/PostgREST query-builder boundaries.
+- SQL-character stripping / sanitisation is not warranted.
+
+### XSS
+- Normal user-controlled text is React-escaped.
+- No user-controlled unsafe HTML sink found.
+- HTML / script stripping of prose is not warranted.
+
+### Reasoning error disclosure
+- Browser-facing reasoning errors have been sanitised (commit `2cb2d55`).
+
+### Focused user input
+- Bounded to 10,000 characters server-side on `/api/focused-investigation/deconstruct`.
+- UI exposes matching `maxLength` and character counter (commit `a6796c6`).
+
+### Investigation snapshot size
+- Authenticated persistence envelope currently lacks a whole-snapshot size ceiling.
+- Not classified as an outstanding pre-tester blocker.
+- Legitimate investigation size / turn depth is not yet known.
+- No arbitrary product ceiling imposed before real-user evidence exists.
+- Monitor snapshot growth later via metadata (serialized bytes / revision / contribution count) without logging investigation content.
+- Malformed-envelope / runtime validation remains a separate future hardening opportunity.
+
+### Prompt injection
+- Assessed as **low risk under the current architecture** — not claimed to be impossible or "solved".
+- Untrusted scenario / answer / persisted text can influence model reasoning.
+- No evidence it gains application authority: no model-accessible arbitrary tools, DB targeting, auth identity control, ownership bypass, deletion, or arbitrary external requests found.
+- Model/provider configuration is server-owned; model output passes through parsing/structured validation/domain boundaries before application mutation.
+- No prompt-injection phrase / keyword filtering warranted; do not strip instruction-like natural-language content.
+- Not a pre-tester blocker.
+
+### Deferred non-security observations (backlog only — no code change)
+- Orchestrator update flow contains an implicitly correct but indent-control-flow-unclear fall-through / else structure worth cleaning up later.
+- Investigation overview validation may accept unexpected extra fields.
+- Provider JSON recovery is intentionally/permissively capable of recovering malformed JSON; may merit a future robustness review.
+
+### Tester-readiness position
+Identified MEDIUM pre-tester security work is sufficiently addressed for controlled external-user testing. The application has **not** been generally security-audited, penetration-tested, or certified as production-secure or commercially launch-ready.
+
 ## CURRENT MVP DIRECTION
 
 Initial-decomposition hardening is frozen for the current MVP stage.

docs/current-project-state.md

@@ -287,6 +287,35 @@ The following material learnings are carried forward as durable context for safe
   User-selected/active investigation ownership must survive substantive ties and
   question-formulation rejection. (Already documented in `docs/current-handoff.md`.)
 
+## 11. Pre-Tester Input Security Review (closed)
+
+**Status:** closed — sufficient for controlled external-user testing. Not a general security audit, penetration test, or production-launch certification.
+
+### SQL injection
+- No raw request-driven SQL construction found; persistence uses Supabase/PostgREST query-builder boundaries.
+
+### XSS
+- Normal user-controlled text is React-escaped; no unsafe HTML sink found.
+
+### Reasoning error disclosure
+- Browser-facing reasoning errors sanitised (commit `2cb2d55`).
+
+### Focused input bound
+- 10,000-character server-side + UI boundary on focused investigation (commit `a6796c6`).
+
+### Investigation snapshot size envelope
+- Authenticated persistence lacks a whole-snapshot size ceiling. Not a pre-tester blocker — legitimate size/depth is unknown; monitor via metadata later without logging content.
+
+### Prompt injection
+- **Low risk under the current architecture.** Untrusted text can influence model reasoning but no evidence it gains application authority. No model-accessible arbitrary tools, DB targeting, auth control, or privileged side effects found. Output passes structured validation before application mutation. Not a pre-tester blocker.
+
+### Deferred non-security observations
+- Orchestrator update flow indentation/control-flow clarity deferred.
+- Investigation overview validation may accept unexpected extra fields.
+- Provider JSON recovery permissiveness deferred as future robustness review.
+
+---
+
 ### RTO learning from Experiments 14–17
 
 Since the handoff document was written, further learning has emerged from Return-to-Origin work (RTO.14–17):