diff --git a/AGENTS.md b/AGENTS.md
index 5af19ab..f386cf8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -134,6 +134,23 @@ work queue.
 - App-specific state, feature logic, and domain behavior belong in downstream
   applications.
 
+## Confidential External Identities
+
+Never record external customer, vendor, user, client-site, or private-project
+identities in tracked files, git metadata, reviews, releases, issues, or
+handoffs. Use anonymous role-based wording such as "a downstream integration"
+or "a production consumer." Public package and platform names are allowed
+only when technically required to identify a dependency or supported
+integration.
+
+**Zero tolerance, no exceptions.** This is not a case-by-case judgment call.
+Every upstream vendor, customer, client, or third-party identity — regardless
+of how well-known, already public, or seemingly harmless — is forbidden from
+appearing in any file, commit, tag, branch name, PR, issue, roadmap, TODO, or
+agent output anywhere in this repo. If a vendor name is already present
+anywhere in tracked files, it must be anonymized on sight, not left in place
+because it predates this rule.
+
 ## Upstream Requests and Roadmap Self-Expansion
 
 Full directive: project-team [AGENTS.md](../AGENTS.md) "Upstream Requests and
diff --git a/package-lock.json b/package-lock.json
index b8f0d9f..5833349 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -569,9 +569,9 @@
       }
     },
     "node_modules/@phcdevworks/spectre-tokens": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@phcdevworks/spectre-tokens/-/spectre-tokens-4.0.0.tgz",
-      "integrity": "sha512-QlfE7mCJWKv8WiiLByzYzZ2Sd0aPcOPFr9JHZGCRpZj9WyMkbZ0pMZqW71VVvgxafDYTt3gWLppqCJ3EgyZpAQ==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@phcdevworks/spectre-tokens/-/spectre-tokens-4.3.0.tgz",
+      "integrity": "sha512-L32ELqx0ZsP7b97izNPMUFPHMcPlOV8HedXWlrh4HGdxwuuXL7k+ESOPZEulwlcGfgk6i9i9l8+XLuvVN6XL1A==",
       "funding": [
         {
           "type": "github",
@@ -587,9 +587,9 @@
       }
     },
     "node_modules/@phcdevworks/spectre-ui": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@phcdevworks/spectre-ui/-/spectre-ui-3.1.0.tgz",
-      "integrity": "sha512-WG8YbWXIxRhxrgsomjEiEMG8PCgfjZC8KyH6RUfuc2+UG+VeySjnu0viid80zY00uwG/oYgajWhTF4N/w6Astg==",
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@phcdevworks/spectre-ui/-/spectre-ui-3.2.0.tgz",
+      "integrity": "sha512-H6D/8VMJ7Ga+soPLOdSwZmTtQxstOF2P7DlsyOpQztN4hTlZO37bNkwTUCLO84w3LScFK128XAkdP2T043/z0g==",
       "funding": [
         {
           "type": "github",
@@ -598,7 +598,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "@phcdevworks/spectre-tokens": "^4.0.0"
+        "@phcdevworks/spectre-tokens": "^4.1.0"
       },
       "engines": {
         "node": "^22.13.0 || >=24.0.0",