docs: reframe novelty claim to composite write-time contract (review MAJOR #3)

Replace the unverified/absolute novelty statement with the defensible
four-part-contract form, verified against a focused adversarial PyPI+GitHub
survey (2026-07-15):

- BRIEF §11: 'assumed, not verified' -> verified survey with sources. Names
  aig-guardian (real, query-time; blurs only the minimal-dep-library
  differentiator), GuardLLM (nearest neighbour, runtime hardening, no
  scan-before-persist / capability isolation / fail-secure), and ipi-scanner
  (orphaned placeholder repo, recorded for honesty not as prior art).
- README: differentiator moved from 'library vs hosted/model' to the full
  four-part write-time contract.
- PLAN §27-31: drop the unverifiable 'the first' superlative.

Also promotes the v1.0 session plan (PLAN-v1.md) and the cross-model review
(review-2026-07.md) into docs/ on the open/ mirror, referenced by PLAN.md's
re-sequencing addendum.

docs/BRIEF.md

@@ -235,10 +235,47 @@ are grounded:
 - *LlamaFirewall as an open-source guardrail reference* — arXiv 2505.03574.
   - https://arxiv.org/pdf/2505.03574
 
-Marked **assumed, not verified**: the specific claim that no existing *library*
-packages the full write-time contract as minimal-dependency code. The search
-found no such library, but absence of evidence is not proof; a focused survey of
-PyPI + GitHub topics should confirm before the README makes a novelty claim.
+**Novelty claim — verified (focused, adversarial PyPI + GitHub survey, 2026-07-15).**
+The claim was re-checked by searching for the library that would *disprove* it, not
+confirm it. It survives, but only in the **composite-contract** form below — never as
+an absolute "the only" / "the first" claim. Characterizations are from PyPI metadata,
+project READMEs, and author write-ups, not a line-by-line code audit.
+
+- **`aig-guardian`** — PyPI v2.0.0, Apache-2.0, real repo (`killertcell428/ai-guardian`),
+  actively developed. Shares this library's *packaging philosophy* (zero-dep core +
+  `[fastapi]/[langchain]/[openai]` extras). Does **not** disprove the contract: it is
+  **query-time** middleware (`check_input`/`check_output`/`check_context`; its RAG
+  feature scans retrieved chunks as they enter the prompt), with no write-time
+  quarantine → scan-before-persist → fail-secure ingestion stage. Blurs the
+  "minimal-dep library" differentiator, not the contract.
+  - https://pypi.org/project/aig-guardian/
+- **`GuardLLM`** — PyPI/GitHub v1.1.0, MIT, minimal-dep (only hard dep
+  `beautifulsoup4`). The nearest neighbour. Hardens *untrusted content at runtime*
+  (wraps inbound web/tool/MCP/email content before the LLM reads it; provenance +
+  outbound DLP). Does **not** package the write-time contract: no scan-before-persist
+  stage, no per-stage *capability* isolation, no named fail-secure disposition.
+  - https://github.com/mhcoen/guardllm
+- **`ipi-scanner`** — PyPI v0.1.0, *ingestion-time* single-stage detector on paper,
+  but an **orphaned placeholder**: its metadata points at the literal template repo
+  `github.com/username/ipi-scanner` (404) and the license field is empty. Recorded for
+  honesty, not as prior art — unconfirmable, and even at face value a verdict-only
+  detector, not the contract.
+  - https://pypi.org/project/ipi-scanner/
+- **Query-time incumbents** (LLM Guard, NeMo Guardrails, Guardrails AI, Rebuff, Vigil,
+  LlamaFirewall, Resk-LLM) — all sit between a user and a model at query time; none
+  address the write-time ingestion path (tracked in the rows above).
+
+**Surviving, defensible form (this is what the README may claim):** existing OSS
+tools are either single-stage *detectors* (emit a risk verdict, leave quarantine,
+capability isolation, scan-before-persist, and fail-secure disposition to the
+integrator) or runtime content-hardening; **no library packages the full four-part
+*write-time ingestion* contract (quarantine → per-stage capability isolation →
+scan-before-persist → fail-secure disposition) as composable minimal-dependency
+code.** The nearest neighbour, GuardLLM, hardens content at runtime but has no
+persist stage. Scoped, not absolute — and re-runnable: repeat the survey (search
+"RAG ingestion security", "write-time / ingestion-time prompt injection", "ingest
+guard") and confirm no new candidate covers all four parts together before making
+the claim again.
 
 ## 12. Reference implementation and target consumers