Rondo STD 117 Prompt Protection

# Rondo-STD-117: Prompt Protection

> ⚠️ **NOT BUILT — design only (2026-06-14 status-hygiene, RONDO-429).** No
> prompt-template version-tracking / degradation-detection exists. (The word
> "injection" in the code is prompt CONSTRUCTION, not defense.) See
> `reports/SPEC-STATUS-TRUTH-2026-06-14.md`.

*Task templates are code. Track versions, detect weakening, prevent silent degradation of AI review quality.*

**Product:** Rondo
**Category:** STD
**Created:** 2026-03-20 | **Updated:** 2026-03-20 | **Status:** DESIGNED
**Classification:** open
**Version:** 1.0
**Owner:** Mark G. Hubers
**Reviewed:** not-yet
**Depends on:** Rondo-REQ-100 (Core), Rondo-STD-113 (Audit Trail), CORE-STD-011 (Self-Correction), CORE-STD-012, CORE-STD-021, CORE-STD-013 | **Used by:** Rondo-REQ-108 (Template Promotion), Rondo-IFS-101 (Caliber Integration)
**Cross-pollinated from:** Caliber Rondo-STD-107 (Security — prompt protection/versioning) — elevated from quality concern to security standard

---

## 1. Purpose & Scope

**What this spec does:** Task templates define what AI is asked to do. A weakened template (rules removed, severity lowered, checks skipped) is an invisible quality hole — AI does less, nobody notices until the codebase degrades. This spec versions task templates, detects weakening (fewer rules, lower bars), and alerts when templates change.

**Users:** Mark (primary). Claude AI agents dispatching to other models. Future: teams needing multi-model AI orchestration, batch processing, cost optimization across AI providers.

---

## 2. The Problem

Task templates define what AI is asked to do. A weakened template (rules removed, severity lowered, checks skipped) degrades review quality silently — AI does less, nobody notices until code quality drops. Templates are code. They need versioning, change detection, and weakening alerts, just like source code.

---

## 3. Requirements


*All requirements use MUST/SHOULD priority per CORE-STD-012.*

| ID | Requirement | Priority | Verified By |
|----|-------------|----------|-------------|
| 001 | Every task template has a version hash (SHA-256 of content) | MUST | Hash test |
| 002 | Template changes detected by hash comparison against last-known version | MUST | Change test |
| 003 | Weakening detection: if a template change REMOVES rules, LOWERS severity thresholds, or SKIPS checks, flag as "WEAKENED" (severity: warn) | MUST | Weaken test |
| 004 | Strengthening detection: if a template change ADDS rules or RAISES bars, flag as "STRENGTHENED" (severity: info — positive change) | SHOULD | Strengthen test |
| 005 | Template change log: old_hash, new_hash, change_type (weakened/strengthened/modified), changed_at, changed_by | MUST | Log test |
| 006 | Alert on weakening: "Template 'review_forward' was weakened: 3 rules removed" shown in preflight | MUST | Alert test |
| 007 | Template freeze: `rondo freeze <template>` — changes require explicit `rondo unfreeze` with reason | SHOULD | Freeze test |
| 008 | Frozen template modified → finding (severity: block). Someone changed a frozen template without unfreezing. | MUST | Frozen test |
| 009 | `rondo templates --changes` CLI: show template change history | SHOULD | History test |
| 010 | Rule counting: parse template for rule-like patterns (numbered items, "MUST", "NEVER", constraint keywords). Compare counts across versions. | SHOULD | Count test |
| 011 | When OB-connected: template versions and change events included in OAResult | SHOULD | Integration test |
| 012 | CORE-STD-011 integration: track whether template changes improved or degraded dispatch quality (guess: "this change will improve results" → measure: did results actually improve?) | SHOULD | Correction test |


---

## 4. Architecture / Design

Template protection operates as a pre-dispatch check: before dispatching a task, compare the current template hash against the last-known hash. If changed, classify the change (weakened/strengthened/modified) by comparing rule counts and severity thresholds. Frozen templates require explicit unfreeze before changes are accepted.

---

## 5. Data Model

Template record: `{template_name, current_hash (SHA-256), rule_count, severity_thresholds: dict, frozen: bool, last_changed_at, last_changed_by}`. Change log entry: `{template_name, old_hash, new_hash, change_type: "weakened"|"strengthened"|"modified", changed_at, changed_by, rule_delta: int}`.

---

## 6. Data Boundary

Template protection is internal to Rondo. Template records and change logs are stored locally (TOML or JSONL). When OB-connected, template versions and change events are included in OAResult. The boundary is the change event metadata in results, not the template content itself.

---

## 7. MCP / API Interface

No MCP interface for template management. Templates are managed via `rondo freeze`, `rondo unfreeze`, and `rondo templates --changes` CLI commands. CORE-STD-021 MCP tools do not expose template management — it is a local development concern.

---

## 8. States & Modes

Templates have two states: `ACTIVE` (normal, changes detected and classified) and `FROZEN` (locked, changes produce block findings). Frozen templates require `rondo unfreeze <template> --reason "..."` before modification. Freeze/unfreeze events are logged in the change log.

**State Machine Type:** BIDIRECTIONAL
**Rationale:** Templates transition ACTIVE ↔ FROZEN via freeze/unfreeze commands. Both directions are explicit human actions with logged reasons. The cycle can repeat indefinitely.
**Rollback:** `rondo unfreeze <template> --reason "..."` returns a FROZEN template to ACTIVE.

---

## 9. Configuration