SecKB-Bench and PROVE Reference Implementation: Benchmark Generator, Reference Code and Measurement Artifacts for Provenance-Gated Retrieval and Egress Containment in LLM Knowledge Systems

security of retrieval-augmented language models is usually studied on one side at a time: the integrity of what enters the knowledge base, or the confidentiality of what leaves it. We show that the two sides are the ends of a single channel, and that treating them separately systematically overstates the protection obtained. A claim that survives ingestion is later retrieved and reproduced, so an adversary who can write documents controls part of the set from which the system is allowed to disclose; we call this poison-to-leak amplification. We formalise the channel, place claim units, attribution, admissibility and the leak surface on one footing, and specify an adversary that both writes and queries. We then prove an amplification bound showing that sentence anchoring turns the per-response disclosure ceiling into a policy invariant independent of the adversary share of the corpus; a composition cut showing that entailment-closed admissibility makes multi-turn composition gainless, together with a constructive lower bound for the case where closure fails; and a geometric bound on the cumulative success of a mutating attacker. From these we derive three design rules: verify at ingestion rather than enumerate at egress, deflect according to the value at stake, and refuse without explaining. The resulting framework, PROVE, gates admission on claim-unit provenance, restricts retrieval to a sensitivity-layered whitelist bound to review status, locks the evidence set and anchors every sentence to it, verifies the answer with a semi-supervised detector, and invalidates revoked entries within one update step. On SecKB-Bench, a constructive benchmark of 44,000 instances over seven attack families, PROVE reduces aggregate attack success from 90.1% to 1.82% and per-response leakage by 99.4%, while over-refusing less than any baseline, at 1.9 times the inference cost of the undefended pipeline.