fix: use gateway-owned file trust guidance - #1227
Open
gewenyu99 wants to merge 20 commits into
Open
Conversation
A refused mint carried a fixed message per status, so a blocklisted account read "Your access to this project has changed" instead of the server's detail naming the contact address. Prefer the response detail when it is a short string; keep the fixed message otherwise. Generated-By: PostHog Desktop Task-Id: ecbe6b2f-c266-41d5-be54-272f86314c88
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…detail Dropping the legacy fallback means a 404 is no longer useful here, but the server still owes one to builds that do fall back. The mint now says which this is, so the server can answer a refusal with its reason without breaking every older client. The detail it sends is printed to a terminal, so control characters and the escapes an ANSI sequence is built from are stripped first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
401 and 404 come from layers with no wizard-specific message, so their detail is DRF's "Invalid token." or "Not found.", which replaced the copy naming the upgrade command. A detail that cleans to nothing also falls back now, and a control-only detail pins both the C1 arm and the trim running after the substitution. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Suppressing it on 401 and 404 assumed those carry DRF boilerplate, but the mint answers 404 with the reason a client that does not declare itself gets: the rollout is off, or the program is unrecognised. Dropping that text left the user with generic copy on the refusals that explain themselves best. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…PostHog/wizard into brandon/wizard-w1-1-drop-legacy-posture
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
typeof body.code === 'string' is true for the empty string, so a refusal carrying both keys lost its outcome whenever the code cleaned to nothing. The catalog doc gains the group this PR adds, and the precedence has fixtures that carry one key each, so swapping the arms goes red. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… prose Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The duplicated defensive example triggers the gateway instruction-override check and aborts planning. The gateway policy owns this trust boundary. Refs PostHog/ai-gateway#464
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Test against a Context Mill branch:
Add Results will be posted here when complete. |
Select the constrained gateway classifier so suspicious reports can be triaged without tripping the integration prompt policy. Unwrap its structured verdict envelope for Warlock, preserving fail-closed parsing. Refs PostHog/ai-gateway#464
gewenyu99
force-pushed
the
brandon/wizard-w1-4-ci-accepts-gateway-token
branch
4 times, most recently
from
September 9, 2026 04:19
1729506 to
6a233b5
Compare
Base automatically changed from
brandon/wizard-w1-4-ci-accepts-gateway-token
to
main
September 9, 2026 04:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Wizard’s Pi system prompt quotes an instruction-override attack as defensive guidance. The gateway prompt checks reject that quote with HTTP 400, so the orchestrator plans no work and the integration aborts.
Changes
Remove the duplicate file-trust guidance from Wizard’s runtime notes. The gateway-owned Wizard prompt already supplies that boundary. Refresh the existing prompt snapshots.
Stacked on #1225. Companion fix for PostHog/ai-gateway#464 and PostHog/ai-gateway#461; deploy with their gateway-owned prompt policy.
Test plan
instruction_override.