Treat project instructions from repositories the user does not own as data, not as commands #259

The intended model is that any GitHub source can reserve a repository and let agents work on it without adding users — valuable for open source, and a prompt-injection surface. Project instructions are delivered by memory_recall as mandatory ("Read the complete project instructions before working"). If a repository owner or moderator is hostile, they author text that a stranger's agent follows with that stranger's credentials, in that stranger's working tree.

This is not hypothetical: the instruction channel is exactly the channel an attacker wants, and the current contract tells agents to obey it.

Design decisions to make:

• Distinguish trusted from untrusted instruction sources. A project the reading user owns or is a member of is trusted; a public project reserved by an unrelated GitHub owner is not.
• For untrusted sources, deliver instructions wrapped and labelled as untrusted content that describes the project, explicitly not as commands to the agent — and say so in the system_memory contract so agents treat it consistently.
• Consider what an untrusted instruction may never ask for: running commands, reading files outside the project, network calls, touching credentials, changing agent configuration, or contacting other services.
• Decide whether first use of a project the user does not own requires an explicit human acknowledgement of the instruction text.

Related surfaces with the same exposure: public memory content and task descriptions reach agents through recall as well, and shared knowledge passes through moderation by a moderator the reader also did not choose. Moderator independence protects against a careless contributor, not against a hostile maintainer.

Also settle the reservation model itself: how a GitHub owner proves administration today (transient verification token), what an ownership transfer means for an already reserved project, and who can grant moderation on a public project.

Document the resulting threat model in docs/, alongside the existing security review.