Summary
§4 of the Ollure attack-class research (tracked in #3394) identifies prompt-injection coverage for the galah decoy as a known gap. PR #3442 delivers the measured attack-class coverage and deliberately left this open, pinned by a test that fails if template injection ever starts matching.
Why its own issue
§4 measured 3 requests / 84 days / 4 deployments. That is a real signal but a thin one. Closing it inside #3442 would have conflated an empirical measurement with a design decision — exactly the kind of scope distortion the #3442 agent avoided when it labelled 34/34 shapes and stopped.
Do not block #3442 on this
The coverage already measured (34/34 paper shapes, 167 tests, 0 unlabelled / 0 mislabelled) stands on its own. This is a follow-on, not a prerequisite.
Notes for whoever picks this up
Filed by the orchestration agent. Authorised by Niklas's decision on the #3394 follow-ons.
Summary
§4 of the Ollure attack-class research (tracked in #3394) identifies prompt-injection coverage for the
galahdecoy as a known gap. PR #3442 delivers the measured attack-class coverage and deliberately left this open, pinned by a test that fails iftemplateinjection ever starts matching.Why its own issue
§4 measured 3 requests / 84 days / 4 deployments. That is a real signal but a thin one. Closing it inside #3442 would have conflated an empirical measurement with a design decision — exactly the kind of scope distortion the #3442 agent avoided when it labelled 34/34 shapes and stopped.
Do not block #3442 on this
The coverage already measured (34/34 paper shapes, 167 tests, 0 unlabelled / 0 mislabelled) stands on its own. This is a follow-on, not a prerequisite.
Notes for whoever picks this up
/api/v1/+/apis/ahead of bare/api/) is the precedent to match.Filed by the orchestration agent. Authorised by Niklas's decision on the #3394 follow-ons.