Mechanical classification and the untrusted-content delimiters.
Proposal V1 §4. Classification is string-exact and has no model in the loop:
* ``command`` - the text is exactly a :data:`COMMAND_VOCABULARY` token.
``STATUS`` is a command whether or not it arrived as a reply; §4 lists it as
the standalone verb and P4 pins the reply vocabulary without it, so there is
no reading under which a ``STATUS`` reply is an approval.
* ``structured-reply`` - the text is exactly a :data:`REPLY_VOCABULARY` token
AND the reply resolved to an outbound audit id. Both conditions, never one.
* ``free-text`` - everything else, including an uncorrelated ``YES``.
The only normalisation is stripping surrounding whitespace. Case is *not*
folded: ``yes`` is free text, because widening the match is how a mechanical
vocabulary quietly stops being mechanical.
§2 makes free text display-only. :func:`render_untrusted` is the single place
it may be shown, and it does two things: it wraps the body in delimiters that
carry the message's own id, and it neutralises any literal ``<<<`` in the body
so a message cannot forge its own closing delimiter. Neutralisation applies to
the RENDERED copy only - the stored text stays verbatim, because the operator's
words are evidence.
Dependencies
------------
- oc_diagnostics (_dbg structured logger)
- option_c_connector_contracts (COMMAND_VOCABULARY, REPLY_VOCABULARY, InboundClassification, InboundMessage - the vocabularies and message types)
1.15.0