diff --git a/AGENTS.md b/AGENTS.md
index 5af19ab..f386cf8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -134,6 +134,23 @@ work queue.
 - App-specific state, feature logic, and domain behavior belong in downstream
   applications.
 
+## Confidential External Identities
+
+Never record external customer, vendor, user, client-site, or private-project
+identities in tracked files, git metadata, reviews, releases, issues, or
+handoffs. Use anonymous role-based wording such as "a downstream integration"
+or "a production consumer." Public package and platform names are allowed
+only when technically required to identify a dependency or supported
+integration.
+
+**Zero tolerance, no exceptions.** This is not a case-by-case judgment call.
+Every upstream vendor, customer, client, or third-party identity — regardless
+of how well-known, already public, or seemingly harmless — is forbidden from
+appearing in any file, commit, tag, branch name, PR, issue, roadmap, TODO, or
+agent output anywhere in this repo. If a vendor name is already present
+anywhere in tracked files, it must be anonymized on sight, not left in place
+because it predates this rule.
+
 ## Upstream Requests and Roadmap Self-Expansion
 
 Full directive: project-team [AGENTS.md](../AGENTS.md) "Upstream Requests and
diff --git a/package-lock.json b/package-lock.json
index b8f0d9f..66b1eb5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -569,9 +569,9 @@
       }
     },
     "node_modules/@phcdevworks/spectre-tokens": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@phcdevworks/spectre-tokens/-/spectre-tokens-4.0.0.tgz",
-      "integrity": "sha512-QlfE7mCJWKv8WiiLByzYzZ2Sd0aPcOPFr9JHZGCRpZj9WyMkbZ0pMZqW71VVvgxafDYTt3gWLppqCJ3EgyZpAQ==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@phcdevworks/spectre-tokens/-/spectre-tokens-4.1.0.tgz",
+      "integrity": "sha512-bwetMPEj+ZOoJ19SyzX76Z6S5yvVf+sr2Ecxmuy9m/BMoFxXCBs57O/uLkl6g63I+Xus21cFhcVWenGjSz73ew==",
       "funding": [
         {
           "type": "github",