Goza changes response style. It must not weaken the agent's security behavior, reveal secrets, or make destructive actions sound safe.
Do not publish sensitive details in a public issue. Contact the repository maintainer privately with:
- Affected file and version or commit.
- Reproduction steps.
- Security impact.
- A suggested mitigation, if available.
- Hooks must fail closed and must never block a user prompt because personality state is unavailable.
- State files must contain only validated profile names.
- Profile names must not escape the configured profile directories.
- Hooks must not read or inject arbitrary files into model context.
- Personality rules never override security warnings, destructive operations, or irreversible-operation confirmations.
- Code, paths, commands, logs, stack traces, and error messages must remain exact.