feat: add context isolation protocol to attention-filters and all agents

skills/attention-filters/SKILL.md

@@ -107,3 +107,15 @@ Before spawning each agent, verify:
 - [ ] Token count is within 20% of the target for the current workflow tier
 - [ ] Prior-cycle feedback (if any) is summarized, not raw
 - [ ] Excluded artifacts are genuinely absent (search for keywords like file paths from excluded sources)
+
+## Context Isolation
+
+Attention filters control *what* each agent receives. Context isolation controls *how* that context is constructed — ensuring agents operate on provided facts, not ambient knowledge.
+
+### Rules
+
+1. **No session bleed.** Agents receive fresh context only — constructed from task description, artifact files, or extracted sections. They must not inherit session state, chat history, or prior agent prompts.
+2. **No cross-agent contamination.** An agent receives another agent's output only if the attention filter table above explicitly allows it. Guardian does not see Skeptic's output. Skeptic does not see the Maker's diff. Violations produce unreliable reviews.
+3. **Controller-constructed only.** All agent context is assembled by the orchestrator from: (a) the task description, (b) artifact files on disk, or (c) extracted sections of those artifacts. Agents never pull their own context.
+4. **No ambient knowledge.** Agents cannot "remember" findings from prior phases or cycles unless that information is explicitly injected via the cycle-back filtering protocol above. An agent that references information not in its prompt is hallucinating.
+5. **Verification.** Before spawning each agent, confirm the constructed prompt has zero references to other agents' raw outputs that are not in the "Receives" column. Search for file paths, archetype names, and finding descriptions from excluded sources.