Release 2026-08-13 (i4 b5c36d02) - #194

…195)

# Re-land #183, which the 2026-08-13 release reverted

#183 merged as 277c0f1 on 2026-08-13 at 10:52 UTC. The very next commit
on
`main` — **Release 2026-08-13 (i4 b5c36d02) (#194)**, an automated
mirror of the
internal i4 tree cut from a source commit that predates the merge —
rewrote both
files back to their pre-#183 contents.

`main` today is byte-identical to `cd5e450`, the commit *before* #183
landed:

```
$ git diff cd5e450 origin/main -- cosmos_framework/auxiliary/guardrail/blocklist/
(no output)
```

`normalize_for_matching()` is gone, the misaligned
`uncensor_whitelist()` is
back, and `blocklist_test.py` has dropped from 32 tests to 8. Both
defects
described in #183 are live on `main` again — including the `IndexError`
that a
benign prompt like `'Snow White is flat'` raises against the production
lists.

## What this PR does

Restores the #183 state exactly, nothing more:

```
$ git diff 277c0f1 -- cosmos_framework/auxiliary/guardrail/blocklist/
(no output)
```

Two files, 258 insertions, 16 deletions — the same diff that was
reviewed and
approved on #183. #194 touches no other guardrail file, and no caller
outside
`blocklist.py` references either changed method, so there is nothing to
reconcile between the two changes.

## Recap of what comes back

1. **The whitelist restore corrupted the censored prompt.**
`censor_prompt`
walked the input and the censored text side by side *by position* to put
whitelisted words back, but a multi-word blocklist entry is replaced by
a
single censor token, so every such match shifts the censored list one
token
left. `'Snow White is flat'` → `IndexError`; `'a Snow White poster on a
flat
wall'` → the user is quoted `'a **** poster on a flat flat'`, with
`wall`
   silently overwritten. The whitelist is already handed to
`load_censor_words(whitelist_words=...)`, so the restore step is
**removed**
   rather than repaired.

2. **Invisible characters walked past the matcher.**
`normalize_for_matching()` folds them before censoring — NFKC, combining
marks dropped, invisible and bidirectional controls rewritten to a
space,
whitespace runs collapsed. Without it a zero-width space, soft hyphen,
fullwidth letter, or a second space evades a blocked phrase while
rendering
identically to a reader. As stated on #183, this blocks strictly more
than
   before. Homoglyphs remain out of scope.

The full analysis, the corpus measurement (same 4 of 492 Edge reasoner
QA
outputs block before and after, item for item), and the test-by-test
rationale
are on #183 and unchanged.

## Verification

`blocklist_test.py` is back to 32 tests; all 32 pass locally against
this
branch. The tests build the matcher directly, so they need no
checkpoint.

## Note for whoever owns the i4 → OSS sync

This will happen again on the next release unless the change is also
landed in
the internal i4 tree, or the guardrail blocklist files are excluded from
the
mirror. Re-landing it here fixes `main` today; it does not stop the next
automated release from reverting it a second time.

🤖 Generated with [Claude Code](https://claude.com/claude-code)