Extends the regex-only pre-check into three stages: regex scan, then
embedding-similarity search against known injection examples, and only
if that score clears a threshold, an LLM judge confirms intent before
blocking. Catches paraphrased injection attempts the fixed regex
patterns miss without paying for an LLM call on every query.
Validated end-to-end against a real Anthropic API key and a live
Qdrant instance: the new path correctly blocked a paraphrased
injection (audit log confirms rule_id: injection.semantic_llm_judge)
while a benign near-miss passed through without ever reaching the LLM
judge. Also documents two reliability issues found while testing with
claude-haiku-4-5 (a non-deterministic policy verdict and a forced
tool-call loop that can end without calling any tool) in
docs/SAFETY_WRITEUP.md section 6 -- unrelated to this change, but
worth recording since they were found in the same pass.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Renders natively in GitLab's markdown view; shows the query path
through both guardrail checks, the three agents, their backing data
stores, and the audit-log side effects.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
RAG + multi-agent (retrieval, policy-compliance, drafting) support
assistant for a fictional shipping company, built in Rust with Qdrant
for vector storage and a hand-rolled Anthropic tool-calling client
(no Rust pydantic-ai equivalent exists). A deterministic supervisor
orchestrates the agents and runs every response through a rule-based
guardrail pipeline with an append-only audit log.
Includes a 44-example golden dataset (normal/injection/policy-
violation/hallucination-bait/out-of-scope) and a regression harness
that scores retrieval, generation, and guardrail correctness
separately, plus a write-up of the failure modes and trade-offs.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
