amoussa1229 23a67f7254 fix: add fail-closed validation gate and XML-delimited prompt on ai_fallback path ... The ai_fallback parse path applied no validation gate to raw Bedrock/LLM output before DynamoDB writes, and the extraction prompt concatenated the untrusted email body directly with no instructions-vs-data delimiter. A DKIM-passing attacker could prompt-inject arbitrary field values into the work-order store. Changes: - wrap untrusted email in \<email\> XML block with prompt instructing the model to treat its contents as data only - add validate_ai_fallback() in template_parser that enforces the same contract keys, enums, and patterns as the template path before any write - call validate_ai_fallback() in handler() dispatch; emit an ai_fallback_rejected EMF metric on failure and skip the record - add 17 unit tests covering every gate rule and two end-to-end dispatch tests (injected email_type, injected status) Refs #101		2026-07-16 19:08:29 +00:00
..
po	fix(ses_auth): harden comment stripping and alarm evaluation window (#103)	2026-07-16 19:00:40 +00:00
wo	fix: add fail-closed validation gate and XML-delimited prompt on ai_fallback path	2026-07-16 19:08:29 +00:00