• No secrets in git. Use env / operator machine for tokens.
• Treat harvested web text as untrusted until normalized.
• Dual-use: refuse harm packaging; see specs/000-athanor-spine/dual-use-gate.md.
• Report issues privately to zer0state@zer0state.com for sensitive findings.

Proposed operational requirements and verification cases: security/privacy/governance specification. This is an advisory target, not a claim that current harvest/export scripts enforce every control. This does not govern or activate.

Provenance: Notion Sprint 001 Hub [not inspected; Athanor Hub inspected] + Loop 805 Slice N/A + Hash: fd84c7085579f3e7a560b38fc554a4f832fa9c10 (review base)