docs(agentos): author the content-trust self-defense guide

Part of #14310. Spawned from #14333 after source-grounding the contentTrust / hostile-content self-defense surface.

Context

The #14333 capability-coverage audit found a real Agent OS capability that is mechanically shipped but not explained as a public conceptual guide: content trust and hostile-content self-defense.

This is not a new implementation lane. The source and historical tickets show the machinery already exists across several layers:

• #10291 owns the organism self-defense epic.
• #10476 captures the external-link / stealth-intent anti-astroturfing substrate.
• #13026 delivered the pure contentTrust classifier and sanitizer helpers.
• #13046 delivered contentTrust projection for GitHub conversation read paths.
• #13691 / #13703 delivered sync / ingestion wiring and reader-level regression coverage.
• #13359 fixed the hostile-content quarantine playbook ordering: neutralize first, then warn.

The Learn surface still lacks the story: why Neo treats public conversation content as a trust boundary, how agents avoid traversing external payloads, how defanged content stays useful without becoming an SEO / corpus-poisoning vector, and how this fits beside Identity Firewall, Knowledge Base, and Memory Core.

The Problem

Today, the concept is scattered across code JSDoc, skill payloads, and old implementation tickets. A reader can find the incident playbook and the helper files, but there is no conceptual guide that explains the full loop:

1. External public content can be useful technical signal and hostile substrate at the same time.
2. Neo classifies author trust instead of trusting the prose tone.
3. Untrusted-origin URLs and known product-name payloads are defanged or redacted at read / sync boundaries.
4. authorTrust and contentTrust metadata let downstream consumers tell projected content from unprojected legacy content.
5. The hostile-content quarantine playbook governs the social/moderation response without turning public docs into a replay of the hostile payload.

Without this guide, the shipped self-defense layer reads like scattered security plumbing instead of one of Neo's organism-level immune-system mechanisms.

The Architectural Reality

Verified source anchors:

• ai/services/shared/contentTrust/authorTrustClassifier.mjs — fail-closed GitHub author to trust-tier classifier, derived from identityRoots plus collaborator input.
• ai/services/shared/contentTrust/astroturfSanitizer.mjs — pure trust-gated sanitizer: URL defang, product-name denylist redaction, stealth-intent signals.
• ai/services/github-workflow/shared/conversationTrust.mjs — read-boundary projection that stamps authorTrust and contentTrust on GitHub conversation payloads.
• GitHub Workflow syncers consume the contentTrust projection before persisted markdown enters resources/content/** and downstream KB / graph ingestion.
• .agents/skills/hostile-content-quarantine/ — incident playbook; it is procedure, not the public conceptual guide.
• learn/benefits/ArchitectureOverview.md has only an inventory row for ai/services/shared/contentTrust/, not the explanatory story.
• learn/tree.json has no content-trust / hostile-content conceptual guide entry.

Verified duplicate / scope checks before filing:

• Live latest-open sweep: checked latest 30 open issues at 2026-06-29T14:07:44Z; no equivalent content-trust conceptual guide sub found.
• A2A in-flight sweep: checked latest 30 all-state messages immediately before creation; no competing [lane-claim] / [lane-intent] for this exact guide scope.
• Live GitHub search for content-trust self-defense guide OR contentTrust guide OR hostile content guide docs returned no open equivalent.
• KB ticket search surfaced #10291, #10476, #12995, #13359 and older substrate tickets; those own machinery / playbook / provenance, not a #14310 public guide.

The Fix

Author a new conceptual Agent OS guide, likely under learn/agentos/, that explains content trust as Neo's public-content immune boundary.

The guide should:

• Tell the story without naming hostile vendors, products, or external accounts. Reference incident numbers instead.
• Explain the distinction between Identity Firewall (prompt / channel separation), contentTrust (public conversation trust projection), and hostile-content-quarantine (incident response playbook).
• Ground every capability claim in current code and shipped tickets; do not imply unsupported automatic moderation beyond what exists.
• Show the dataflow: GitHub authored content → trust classification → sanitizer/projection → persisted markdown / KB / graph consumers → incident playbook when human/social response is needed.
• Include at least one render-verified flowchart TD Mermaid diagram; no long LR chains.
• Register the guide in learn/tree.json and update generated Learn/SEO mirrors as required by local doc patterns.

Contract Ledger

Decision Record impact

none for ADRs. Aligned with #10291 and the #14310 content rubric.

Acceptance Criteria

• A new conceptual guide exists under learn/agentos/ and is registered in learn/tree.json.
• The guide explains the content-trust loop from public authored content to trust projection, sanitizer behavior, persisted metadata, KB / graph consumption, and incident response.
• The guide explicitly separates contentTrust, Identity Firewall, Knowledge Base ingestion, Memory Core provenance, and the hostile-content-quarantine skill.
• The guide contains no external vendor/product names or hostile payload links; incident references use Neo artifact numbers only.
• At least one Mermaid diagram is flowchart TD and render-verified.
• Cross-links resolve to relevant user-facing guides only; avoid dumping internal reference/tool catalogs into the conceptual guide.
• Generated Learn/SEO mirrors are updated if the repo's doc workflow requires it.

Out of Scope

• New sanitizer behavior, denylist mechanics, moderation automation, or trust-tier retrieval policy.
• Editing .agents/skills/hostile-content-quarantine/.
• Reopening or reshaping #10476 / #12995 / #13691 implementation scope.
• Naming or replaying hostile payload details in public docs.

Related

• Parent: #14310
• Spawned from audit: #14333
• Self-defense epic: #10291
• Machinery / historical substrate: #10476, #13026, #13046, #13691, #13703, #13359
• Adjacent guides: #14335 Identity Firewall, #14322 self-healing / immune-system, KnowledgeBase.md, MemoryCore.md

Retrieval Hint: contentTrust self-defense guide authorTrust astroturfSanitizer conversationTrust hostile-content-quarantine #14333 #14310