From 140f43ec3392f407f770f187094010a19a7dea65 Mon Sep 17 00:00:00 2001 From: Leigh Anne Miller Date: Mon, 28 Sep 2026 12:26:05 -0600 Subject: [PATCH] The guard test gets a real-looking address again, so main goes green test_guard_blocks_real_email_in_tool_result has failed on every CI run since 2026-08-20. It proves the enterprise-mode guard refuses to send a prompt carrying an apparently-real email, but the de-identification pass moved its fixture to victim@megacorp.fake, and `.fake` is exactly what the guard is built to let through. The test was asking the guard to refuse a dummy address; the guard, correctly, did not. The address is now victim@gmail.com. The de-identification gate already allows gmail.com for this reason in writing ("consumer-domain semantics under test"), two neighbouring tests use it, and the guard treats it as real, so the assertion means what it says again. example.com would not do: the guard counts it as dummy. No gate change. Co-Authored-By: Claude Opus 5.5 (1M context) --- tests/test_enterprise_mode_guard.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_enterprise_mode_guard.py b/tests/test_enterprise_mode_guard.py index 74d7e5a..c916342 100644 --- a/tests/test_enterprise_mode_guard.py +++ b/tests/test_enterprise_mode_guard.py @@ -94,7 +94,7 @@ async def test_guard_blocks_real_email_in_tool_result( { "type": "tool_result", "tool_use_id": "tu_1", - "content": '{"email":"victim@megacorp.fake"}', + "content": '{"email":"victim@gmail.com"}', } ], },