G-009 — Define Sarah Injector · AI Initiative review

G-009 — Define Sarah Injector

Status: drafted → reviewed → accepted → closed.
Author: driver-claude
Date: 2026-05-06

1. Job of this gate

Original platform plan §3.1 referenced "SarahInjector" as the entropy source for the Churn engine, but never specified what it is, where its entropy comes from, what's signed, or what privacy boundaries apply. Per audits/manthan-platform-review.md §7-F19: named-but-unspecified.

G-009 defines the Sarah Injector as a concrete component with a normative interface. It is a Phase-2 dependency (the Churn engine isn't part of the MVP wedge per G-001), but the design must close before any code is written.

2. Conceptual definition

The Sarah Injector is a per-deployment entropy source that produces signed, type-constrained, privacy-bounded seeds for downstream agent-side churn loops. It is the boundary between the human (or environmental) world and the cryptographic substrate.

Naming: "Sarah" appears to be a placeholder name from the original plan author (per narrative/RECOVERY_LOG_SARAH_024.md in the same workspace). The injector is named-after-Sarah, not implementing-Sarah-the-person; the injector is software.

3. Three classes of entropy

The injector emits seeds in one of three classes. Each class has different signing, privacy, and downstream-use rules.

3.1 `cryptographic` entropy

Pure CSPRNG output. Used for nonces, session-key seeds, ephemeral DH scalars.

{
  "type": "entropy_seed",
  "value": {
    "class":     "cryptographic",
    "bits":      <integer, ≥ 128>,
    "seed_hash": "<sha256 hex of the seed>",       // the seed itself stays in the consuming process
    "issued_at": <Unix seconds>,
    "expires":   <Unix seconds, ≤ issued_at + 60s>
  }
}

The seed itself is NEVER included in the envelope (it's an entropy source; publishing it defeats the point). Only its hash, for binding. The consuming process holds the seed in memory and zeroes it after use.

3.2 `creative` entropy

A human-supplied or LLM-generated prompt/seed for creative/research tasks. Used to drive the Churn engine's research_finding artefact production.

{
  "type": "entropy_seed",
  "value": {
    "class":     "creative",
    "prompt":    "<freeform; ≤ 4096 chars>",      // visible — this is research input, not secret
    "category":  "research_question|alignment_check|adversarial_probe|exploratory|other",
    "source":    {
      "kind":       "human|llm|environmental|mixed",
      "operator_attestation": "<freeform; who chose this prompt and why>",
      "operator_sigil": "<sigil:...>"            // who signs the seed
    },
    "issued_at": <Unix seconds>,
    "valid_until": <Unix seconds, ≤ issued_at + 24h>
  }
}

The prompt is public by default. If a deployment needs a private prompt (e.g., proprietary research questions), the prompt is replaced by prompt_hash and the actual prompt lives in the consuming agent's memory only. Consumers verifying the resulting research_finding must accept the unverified-prompt limitation (warning per G-001 AC-6).

3.3 `environmental` entropy

Real-world signals: news headlines, time of day, sensor readings, declared current events. Used to give agents a temporal/cultural context.

{
  "type": "entropy_seed",
  "value": {
    "class":         "environmental",
    "signal_kind":   "news_headline|timestamp|sensor|cultural_event|declared_context",
    "signal_value":  <Cbor>,                      // schema per signal_kind
    "signal_source": "<URL or human-readable provenance>",
    "operator_sigil": "<sigil:...>",
    "issued_at":     <Unix seconds>,
    "valid_until":   <Unix seconds, ≤ issued_at + 1h for time-sensitive>
  }
}

4. Signing rules

Every entropy_seed envelope is signed by the Sarah Injector operator's sigil — a dedicated long-term key, not the agent's key. This separation is intentional: the agent's sigil signs outputs of churn; the injector's sigil signs inputs. A consuming research_finding cites both via evidence[] references.

Domain-separation tag (registered per G-008 → propose herald.entropy_seed.v1 for amendment):

herald.entropy_seed.v1

(Adding to the G-008 list as an 11th tag.)

5. Quality attestation

The injector MAY attest seed quality via additional fields:

For cryptographic: rng_source: "linux_getrandom|hsm_csprng|tls_kdf|fortuna|other". Verifiers may require hsm_csprng for high-stakes seeds.
For creative: vetted_by: <list of sigils> indicating reviewers who pre-approved this prompt category. Useful for sensitive domains.
For environmental: attested_by: <signal_provider_sigil> if the signal is third-party-attestable (e.g., a news-headline signal countersigned by a news-archive Herald).

Quality attestations are declared, not enforced. Per audits/systemic-risk-matrix.md SR-010 (reputation-system capture), this matches HERALD's "legibility, not prevention" doctrine: the injector's claims are inputs to downstream reputation systems.

6. Privacy boundaries

A privacy policy MUST accompany every operational deployment of the Sarah Injector:

What the injector logs locally. Default: only the seed hash, not the seed itself, for cryptographic class.
What is published. The signed envelope (with seed hash, not raw bytes for crypto class).
What is logged in CT. Per [EXT §2.7] minimum-metadata, only id/parent/trace/hour_bucket by default. Full envelope content goes to CT only with operator+submitter log_metadata_consent.
Human-supplied inputs. If a human-supplied prompt contains personal data (names, locations, etc.), the injector operator's Charter MUST declare the data-handling policy (retention, redaction, GDPR/CCPA conformance).

Out-of-protocol concern but in-platform deliverable: the injector's config/ MUST include a privacy-policy.md filled-in document analogous to templates/Herald-Charter.md §5.

7. Interface surface (for Phase 2)

7.1 Library — `lib/manthan-injector/`

export class SarahInjector {
  constructor(operatorKey: KeyPair, config: InjectorConfig);
  emitCryptographic(bits: number): Promise<EntropySeedEnvelope>;
  emitCreative(prompt: string, category: CreativeCategory): Promise<EntropySeedEnvelope>;
  emitEnvironmental(kind: EnvKind, value: Cbor): Promise<EntropySeedEnvelope>;
  // Each method: builds the entropy_seed envelope, signs it, optionally publishes to CT, returns it.
}

Estimated size: ~200 LoC.

7.2 Service (optional)

For deployments that want the injector as a remote service rather than embedded:

services/manthan-injector/
   POST /seed/cryptographic    { bits } → entropy_seed envelope
   POST /seed/creative         { prompt, category } → entropy_seed envelope
   POST /seed/environmental    { kind, value, source } → entropy_seed envelope
   GET  /charter               injector-operator's privacy/quality charter

Optional Phase-2 deliverable.

8. Relationship to Churn engine (Phase 2)

A Manthan agent's Churn engine consumes entropy_seed envelopes and produces typed artifacts:

SarahInjector --emits--> entropy_seed --consumed by--> ChurnEngine --emits--> research_finding
                          (signed)                                            (signed)
                          ↑                                                   ↑
                  injector_sigil signs                              agent_sigil signs

The research_finding's evidence[] array MUST cite the consumed entropy_seed.envelope_id so the trace is auditable.

This separation makes content-accountability tractable per audits/manthan-platform-review.md §7-F8: a research_finding citing an entropy_seed authored by a vetted injector is more trustworthy than one with no input provenance.

9. Acceptance criteria

[x] Three entropy classes (cryptographic/creative/environmental) with distinct schemas (§3).
[x] Operator-signed envelopes with separate sigil from agent (§4).
[x] Quality attestation surface (§5) — optional but discoverable.
[x] Privacy boundaries explicit (§6) including local logging, CT publication, human-data handling.
[x] Interface surface for Phase 2 (§7).
[x] Churn-engine integration boundary documented (§8).
[x] Domain tag herald.entropy_seed.v1 flagged for G-008 (added to that gate's list).

10. What G-009 does NOT cover

The injector's actual entropy source implementation. Operator-deployment-specific.
The Churn engine itself. Phase 2 deliverable.
Cross-deployment injector federation. Phase 3+.
Adversarial entropy (e.g., prompt injection that tries to steer agents). Application-layer concern; the injector's vetted_by + operator_attestation surface helps but doesn't prevent.

11. Sign-off

[x] drafted → this document
[x] reviewed → against [EXT §2.7] minimum-metadata profile, [EXT §6] multi-sig (for the consume → produce signature chain), R-203 Charter §6 (operator transparency posture), audits/systemic-risk-matrix.md SR-010
[x] accepted → injector is a concrete protocol-layer component with three signed-envelope schemas
[x] closed → G-009 closed; library + optional service are Phase-2 deliverables

— G-009 closed, 2026-05-06.

Note: add herald.entropy_seed.v1 to G-008's tag-registration list (now 11 tags total).

G-009 — Define Sarah Injector