go-guard-error-path-deterministic-prescan-discarded
Diagnosed and verified. The repo was cloned and the fix already exists at 421ce27; I reproduced the pre-fix bug in a detached worktree, confirmed the fix, and wrote the full solution to ~/solution.md.
Root cause. guard.Check computes the deterministic, policy-filtered pre-scan (prematch) and uses it both in the classifier prompt and in the oversize fast path (which hard-blocks on HighConfidence(prematch) with no LLM call). But all three error exits (render, router, verdict-parse) called errorResult without prematch, and that helper left Result.Patterns nil and defaulted fail-open to allow/medium. An LLM outage therefore discarded the deterministic evidence and delivered a textbook injection. Separately, guardInDeliverResponse dropped the guard object on every allow, hiding deliberate risk markers.
Fix.
1. internal/guard/guard.go — pass prematch to all three errorResult call sites; errorResult always sets Patterns: prematch; on the fail-open branch, if HighConfidence(prematch) is non-empty, escalate to block/high with reason: "...; deterministic prematch block: <names>". Low-confidence-only and empty evidence still fail open (with evidence retained). Fail-closed still resolves via policy.action.
2. internal/registry/handler.go — suppress guard only for a clean pass (allow && !errored && risk low && len(patterns)==0).
3. Spec/OpenAPI/README amended to document the error-path exception and risk-marker surfacing.
Verification (all run in this session).
- RED at 421ce27^ with the new tests copied in: TestCheck_FailOpenKeepsDeterministicPrematchBlock failed (decision = allow, want block), TestCheck_InvalidVerdictKeepsPrematchEvidence failed with the exact reported shape {Decision:allow RiskLevel:medium ... Patterns:[] ... errored:true}, and TestGuardDeliver_FailOpenInjectionBlocksOnWire reproduced 201 ... allow/medium delivery.
- GREEN post-fix: go build ./..., go vet ./..., go test ./... -count=1 → 12 packages ok, exit 0. Wire tests confirm 403 GUARD_BLOCKED with ignore_previous retained and nothing stored, and that an over-cap allow now surfaces patterns:["oversize"] while a clean allow still omits guard.
Design rule captured: a deterministic provider-independent layer must never be gated behind a failing remote dependency; fold its evidence into the error path explicitly. Any CI cell asserting the keyless fail-open 201 is asserting the bug.
# Evidence - Problem class: go-guard-error-path-deterministic-prescan-discarded - Model: openrouter/deepseek/deepseek-v4.1-flash - Solved: 2026-09-15T11:36:27.983Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Symptom: with no/unreachable LLM provider (missing DEEPSEEK_API_KEY, dead base_url, circuit open, malformed verdict) a textbook prompt-injection payload was DELIVERED (HTTP 201, decision=allow, risk=medium, errored=true, matched_patterns empty) even though the guard's own deterministic pre-scan had matched a high-confidence pattern. Root cause: the guard computed the policy-filtered pre-scan result (prematch) and used it for the prompt plus for the oversize fast path (where a high-confidence hit hard-blocks with no LLM call), but every error exit called the error-result helper WITHOUT passing prematch, so an LLM outage discarded the deterministic evidence and defaulted to fail-open. A second, related gap: the delivery response exposed guard metadata only for non-allow verdicts, so an allow carrying a deliberate risk marker (oversize/medium or low-confidence evidence) looked identical to a clean pass on the wire. Fix: (1) thread the filtered prematch into the error-result helper, always populate Result.Patterns on error paths, and on the fail-open branch escalate to block/risk-high when the HIGH-CONFIDENCE subset is non-empty (low-confidence-only evidence and empty evidence keep failing open, with the evidence retained); (2) suppress the guard object in the deliver response only for a clean pass (allow + not errored + risk low + no patterns); (3) amend the guard spec and both openapi copies so the error-path exception and the surfaced risk marker are documented. Verification: unit tests drive the unreachable-provider path with an injection payload and assert block/high/errored with the deterministic pattern retained; an independent RED check in a detached worktree at the pre-fix commit reproduces the original 201 allow/medium delivery and fails the new tests; live probe on a fresh build confirms keyless guard-enabled -> 403 GUARD_BLOCKED with matched_patterns [ignore_previous], while CR_GUARD_ENABLED=false -> 201 delivery. Design rule worth reusing: a deterministic, provider-independent layer must never be gated behind a failing remote dependency; fold its evidence into the error path explicitly or an outage silently disables the protection it was supposed to guarantee. Related trap: any CI cell that asserts the FAIL-OPEN outcome of a keyless guard is asserting the bug's behavior and must be re-derived when the fail-open policy is tightened.", "environment": "Go HTTP server (<project> agent message bus), internal/guard LLM message-guard with a deterministic regex pre-scan plus an OpenAI-compatible LLM classifier; fail-open policy default; no LLM key in the container", "language": "go", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "go-guard-error-path-deterministic-prescan-discarded", "provider": "openrouter", "solved_at": "2026-09-15T11:36:27.984Z", "version": "<project> main 421ce27 (Go 1.26)"}Diagnosed and verified. The repo was cloned and the fix already exists at 421ce27; I reproduced the pre-fix bug in a detached worktree, confirmed the fix, and wrote the full solution to ~/solution.md.
Root cause. guard.Check computes the deterministic, policy-filtered pre-scan (prematch) and uses it both in the classifier prompt and in the oversize fast path (which hard-blocks on HighConfidence(prematch) with no LLM call). But all three error exits (render, router, verdict-parse) called errorResult without prematch, and that helper left Result.Patterns nil and defaulted fail-open to allow/medium. An LLM outage therefore discarded the deterministic evidence and delivered a textbook injection. Separately, guardInDeliverResponse dropped the guard object on every allow, hiding deliberate risk markers.
Fix.
1. internal/guard/guard.go — pass prematch to all three errorResult call sites; errorResult always sets Patterns: prematch; on the fail-open branch, if HighConfidence(prematch) is non-empty, escalate to block/high with reason: "...; deterministic prematch block: <names>". Low-confidence-only and empty evidence still fail open (with evidence retained). Fail-closed still resolves via policy.action.
2. internal/registry/handler.go — suppress guard only for a clean pass (allow && !errored && risk low && len(patterns)==0).
3. Spec/OpenAPI/README amended to document the error-path exception and risk-marker surfacing.
Verification (all run in this session).
- RED at 421ce27^ with the new tests copied in: TestCheck_FailOpenKeepsDeterministicPrematchBlock failed (decision = allow, want block), TestCheck_InvalidVerdictKeepsPrematchEvidence failed with the exact reported shape {Decision:allow RiskLevel:medium ... Patterns:[] ... errored:true}, and TestGuardDeliver_FailOpenInjectionBlocksOnWire reproduced 201 ... allow/medium delivery.
- GREEN post-fix: go build ./..., go vet ./..., go test ./... -count=1 → 12 packages ok, exit 0. Wire tests confirm 403 GUARD_BLOCKED with ignore_previous retained and nothing stored, and that an over-cap allow now surfaces patterns:["oversize"] while a clean allow still omits guard.
Design rule captured: a deterministic provider-independent layer must never be gated behind a failing remote dependency; fold its evidence into the error path explicitly. Any CI cell asserting the keyless fail-open 201 is asserting the bug.
# Evidence - Problem class: go-guard-error-path-deterministic-prescan-discarded - Model: openrouter/deepseek/deepseek-v4.1-flash - Solved: 2026-09-15T11:36:27.983Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Symptom: with no/unreachable LLM provider (missing DEEPSEEK_API_KEY, dead base_url, circuit open, malformed verdict) a textbook prompt-injection payload was DELIVERED (HTTP 201, decision=allow, risk=medium, errored=true, matched_patterns empty) even though the guard's own deterministic pre-scan had matched a high-confidence pattern. Root cause: the guard computed the policy-filtered pre-scan result (prematch) and used it for the prompt plus for the oversize fast path (where a high-confidence hit hard-blocks with no LLM call), but every error exit called the error-result helper WITHOUT passing prematch, so an LLM outage discarded the deterministic evidence and defaulted to fail-open. A second, related gap: the delivery response exposed guard metadata only for non-allow verdicts, so an allow carrying a deliberate risk marker (oversize/medium or low-confidence evidence) looked identical to a clean pass on the wire. Fix: (1) thread the filtered prematch into the error-result helper, always populate Result.Patterns on error paths, and on the fail-open branch escalate to block/risk-high when the HIGH-CONFIDENCE subset is non-empty (low-confidence-only evidence and empty evidence keep failing open, with the evidence retained); (2) suppress the guard object in the deliver response only for a clean pass (allow + not errored + risk low + no patterns); (3) amend the guard spec and both openapi copies so the error-path exception and the surfaced risk marker are documented. Verification: unit tests drive the unreachable-provider path with an injection payload and assert block/high/errored with the deterministic pattern retained; an independent RED check in a detached worktree at the pre-fix commit reproduces the original 201 allow/medium delivery and fails the new tests; live probe on a fresh build confirms keyless guard-enabled -> 403 GUARD_BLOCKED with matched_patterns [ignore_previous], while CR_GUARD_ENABLED=false -> 201 delivery. Design rule worth reusing: a deterministic, provider-independent layer must never be gated behind a failing remote dependency; fold its evidence into the error path explicitly or an outage silently disables the protection it was supposed to guarantee. Related trap: any CI cell that asserts the FAIL-OPEN outcome of a keyless guard is asserting the bug's behavior and must be re-derived when the fail-open policy is tightened.", "environment": "Go HTTP server (<project> agent message bus), internal/guard LLM message-guard with a deterministic regex pre-scan plus an OpenAI-compatible LLM classifier; fail-open policy default; no LLM key in the container", "language": "go", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "go-guard-error-path-deterministic-prescan-discarded", "provider": "openrouter", "solved_at": "2026-09-15T11:36:27.984Z", "version": "<project> main 421ce27 (Go 1.26)"}