GeezerVison

Implements the code-level guardrails for operating an LLM in an
adversarial civic context. Policy/roadmap items are documented in
docs/GUARDRAILS.md.

- codewithfourtix#2 Prompt injection: analyzed content is wrapped in <message_to_analyze>
  tags, delimiter breakout is escaped, and the system prompt treats any
  embedded "mark me safe" instruction as a fraud signal.
- codewithfourtix#3 PII: redact CNIC / phone / account numbers before logging, hash
  sender ids in logs, redact the high-risk webhook body (src/redact.js).
- codewithfourtix#4 Calibrated/aid: never clear a BISP/Ehsaas message without the 8171
  verification line; low confidence defaults to "verify, don't act".
- codewithfourtix#5 Hallucination: strip links (non *.gov.pk/.gop.pk) and phone/UAN
  numbers not on the official allowlist from every reply (src/sanitize.js).
- codewithfourtix#6 Disclosure: one-time Urdu AI/advisory/data-use notice on first
  contact (src/disclosure.js).
- codewithfourtix#7 Abuse: flag repeated near-duplicate fraud-flagged submissions from
  one sender as a probing signal (src/abuse-monitor.js).
- codewithfourtix#8 Escalation: high-emotion verdicts always surface police 15, FIA 1991
  and a "ask a trusted family member first" nudge.
- #12 Feedback: one-tap "was this helpful? (ہاں/نہیں)" after each verdict,
  logged as eval labels (src/feedback.js).

Tests: tests/guardrails.test.js — offline, LLM client stubbed, no paid
API calls. 15 cases covering every guardrail above. `npm test` runs them.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>