Task — engineering-spec@1

"Rust denylist enforcement at emit/ingest + admin binary hardening"

draftTASK-MEMORY-244

module memory · class product · priority p1 · created 2026-07-08 · shipped null
depends on TASK-MEMORY-202 · blocks none

TASK-MEMORY-244: Rust denylist enforcement at emit/ingest + admin binary hardening

1. Description

secret-shaped content rejected at validate; admin runs require dedicated role + break-glass flag + chained invocation row

Migrated 2026-07-08 from the memory improvement backlog, folded into the task system as class: improvement. Source report refs: R87, R88.

Acceptance criteria

[ ] secret-shaped content rejected at validate; admin runs require dedicated role + break-glass flag + chained invocation row