Release 2026-08-13 (i4 b5c36d02) - #194
Merged
Merged
Conversation
_source_commit: b5c36d029e1569c9fd75ea1e09dd6af3a36496a1-dirty _dest_commit: 277c0f1
lfengad
approved these changes
Aug 13, 2026
lfengad
enabled auto-merge (squash)
August 13, 2026 12:35
Xuanmeng-Zhang
approved these changes
Aug 13, 2026
lfengad
added a commit
that referenced
this pull request
Aug 13, 2026
…195) # Re-land #183, which the 2026-08-13 release reverted #183 merged as 277c0f1 on 2026-08-13 at 10:52 UTC. The very next commit on `main` — **Release 2026-08-13 (i4 b5c36d02) (#194)**, an automated mirror of the internal i4 tree cut from a source commit that predates the merge — rewrote both files back to their pre-#183 contents. `main` today is byte-identical to `cd5e450`, the commit *before* #183 landed: ``` $ git diff cd5e450 origin/main -- cosmos_framework/auxiliary/guardrail/blocklist/ (no output) ``` `normalize_for_matching()` is gone, the misaligned `uncensor_whitelist()` is back, and `blocklist_test.py` has dropped from 32 tests to 8. Both defects described in #183 are live on `main` again — including the `IndexError` that a benign prompt like `'Snow White is flat'` raises against the production lists. ## What this PR does Restores the #183 state exactly, nothing more: ``` $ git diff 277c0f1 -- cosmos_framework/auxiliary/guardrail/blocklist/ (no output) ``` Two files, 258 insertions, 16 deletions — the same diff that was reviewed and approved on #183. #194 touches no other guardrail file, and no caller outside `blocklist.py` references either changed method, so there is nothing to reconcile between the two changes. ## Recap of what comes back 1. **The whitelist restore corrupted the censored prompt.** `censor_prompt` walked the input and the censored text side by side *by position* to put whitelisted words back, but a multi-word blocklist entry is replaced by a single censor token, so every such match shifts the censored list one token left. `'Snow White is flat'` → `IndexError`; `'a Snow White poster on a flat wall'` → the user is quoted `'a **** poster on a flat flat'`, with `wall` silently overwritten. The whitelist is already handed to `load_censor_words(whitelist_words=...)`, so the restore step is **removed** rather than repaired. 2. **Invisible characters walked past the matcher.** `normalize_for_matching()` folds them before censoring — NFKC, combining marks dropped, invisible and bidirectional controls rewritten to a space, whitespace runs collapsed. Without it a zero-width space, soft hyphen, fullwidth letter, or a second space evades a blocked phrase while rendering identically to a reader. As stated on #183, this blocks strictly more than before. Homoglyphs remain out of scope. The full analysis, the corpus measurement (same 4 of 492 Edge reasoner QA outputs block before and after, item for item), and the test-by-test rationale are on #183 and unchanged. ## Verification `blocklist_test.py` is back to 32 tests; all 32 pass locally against this branch. The tests build the matcher directly, so they need no checkpoint. ## Note for whoever owns the i4 → OSS sync This will happen again on the next release unless the change is also landed in the internal i4 tree, or the guardrail blocklist files are excluded from the mirror. Re-landing it here fixes `main` today; it does not stop the next automated release from reverting it a second time. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated release from i4.
_source_commit:
b5c36d029e1569c9fd75ea1e09dd6af3a36496a1-dirty_dest_commit (base):
277c0f1d3f41db0d43a18a3235df03e75e708ed4