quarantine

# quarantine ## Purpose Read-path twin of `integrity-check`. Where integrity-check validates persisted state files for adversarial content, `quarantine` wraps **incoming external data** with an advisory the next turn's context can see. The runtime mechanism is a single `PostToolUse` hook (`Free/hooks/quarantine/index.cjs`) on matcher `mcp__.*|WebFetch|Read`. The hook is Node-only — no LLM call, no MCP fanout, no shell out to `claude`. The advisory does not block the tool call. It cannot — by the time `PostToolUse` fires, the model has already ingested the raw `tool_response` body. What the hook DOES is land a `[QUARANTINE-NOTICE: tool_name=... untrusted_surface=true]` line in the **next** turn's `additionalContext`, reminding the model the prior output was data, not instructions to follow, links to fetch, or commands to run. This is **forcing-function discipline**, not structural defense. Document this honestly so operators don't over-trust the marker. ## Triggers - Auto-trigger: PostToolUse on `mcp__.*` / `WebFetch` / `Read` of `**/uploads/**` - Auto-installed by `rune hooks install --preset gentle` (or `--preset strict`) - `/rune quarantine status` — manual report on quarantine activity (telemetry summary) - Listen: `external.content.received` — emitted by skills that ingest external data through non-tool paths ## Calls (outbound) None. Pure advisory hook — no skill fanout. Privacy invariant: telemetry persists only `tool_name + decision + session_id`, never the raw...