Files
resolutionflow/backend
Michael Chihlas d0ebdef9e8
All checks were successful
Mirror to GitHub / mirror (push) Successful in 10s
fix(ai): full-sweep audit — placeholders only in system prompts + CI guardrail
The "AI parrots example content from system prompt" bug bit us twice in
one day across two different prompt sites. Patching individual prompts
is treating the symptom; this commit makes the rule structural.

Audit + sanitize:
- assistant_chat_service.ASSISTANT_SYSTEM_PROMPT — already cleaned in
  prior commits, but the [FORK] schema still had literal "Brief reason"
  / "Short name" / "One sentence" placeholders. Replaced with
  <angle-bracket> placeholders. Anti-parrot rule itself rewritten to
  describe the failure mode abstractly instead of naming "jsmith" so
  the rule no longer trips the guardrail (and so the model doesn't
  see "jsmith" as a token at all).
- ai_chat_service.py — removed three concrete-example offenders:
  "Get-Service ADSync" command literal, the "DC01 server_name" intake
  form payload (in two places), and the inline interview demos using
  "Azure AD Sync failures" / "Exchange Online mailbox migration".
  Replaced with technology-neutral schema descriptions.
- ai_tree_generator_service.BRANCH_DETAIL_SYSTEM_PROMPT — replaced the
  fully-fleshed DNS troubleshooting tree (with literal Dnscache /
  ipconfig / google.com / Start-Service) with a placeholder schema
  showing only ID-linkage shape.
- kb_conversion_service.PROCEDURAL_SYSTEM_PROMPT — replaced the worked
  Server Manager + DC01 example payload with a placeholder schema.

Guardrail (tests/test_prompt_anti_parrot.py):
- Imports every module under app/services/ and app/core/ and walks
  every uppercase string constant ending in _PROMPT, _SCHEMA,
  _PROTOCOL, _FORMAT, or _CONTEXT.
- test 1: known-leaked-token list (jsmith, DC01, ADSync, Dnscache,
  google.com, "Outlook keeps", "Teams drops") must not appear in any
  prompt constant. Add to the list when a new leak shows up in prod —
  the list IS the audit trail.
- test 2: marker blocks ([QUESTIONS], [ACTIONS], [SUGGEST_FIX], etc.)
  must contain placeholders only. Distinguishes JSON keys (followed
  by ':', allowed) from JSON values (followed by ',' / ']' / '}',
  must be <placeholder>); allows pipe-separated enum types
  (text|password|select) and a small set of fixed enum values
  (question, diagnostic_check, decision, action, ...). Verified by
  feeding the test a known-bad block — caught it correctly.

Documented the rule in CLAUDE.md → AI / FlowPilot lessons, naming
the test as the enforcement point so future contributors know how to
extend it (add to the known-leaked list when a new leak surfaces).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-22 02:09:30 -04:00
..

Troubleshooting Decision Tree - Backend API

FastAPI backend for the Troubleshooting Decision Tree application.

Quick Start

1. Set up Python environment

cd backend
python -m venv venv

# Windows
venv\Scripts\activate

# macOS/Linux
source venv/bin/activate

pip install -r requirements.txt

2. Start PostgreSQL database

Using Docker:

docker-compose up -d

Or install PostgreSQL locally and create a database:

CREATE DATABASE decision_tree;

3. Configure environment

Copy the example env file and update as needed:

cp .env.example .env

4. Run database migrations

alembic upgrade head

5. Start the server

uvicorn app.main:app --reload --host 0.0.0.0 --port 8000

The API will be available at:

API Endpoints

Authentication

  • POST /api/v1/auth/register - Register new user
  • POST /api/v1/auth/login - Login (form data)
  • POST /api/v1/auth/login/json - Login (JSON body)
  • POST /api/v1/auth/refresh - Refresh token
  • GET /api/v1/auth/me - Get current user
  • POST /api/v1/auth/logout - Logout

Trees

  • GET /api/v1/trees - List all trees
  • GET /api/v1/trees/categories - List categories
  • GET /api/v1/trees/search?q=query - Search trees
  • GET /api/v1/trees/{id} - Get specific tree
  • POST /api/v1/trees - Create tree (engineer/admin)
  • PUT /api/v1/trees/{id} - Update tree (engineer/admin)
  • DELETE /api/v1/trees/{id} - Delete tree (admin)

Sessions

  • GET /api/v1/sessions - List user's sessions
  • GET /api/v1/sessions/{id} - Get specific session
  • POST /api/v1/sessions - Start new session
  • PUT /api/v1/sessions/{id} - Update session
  • POST /api/v1/sessions/{id}/complete - Complete session
  • POST /api/v1/sessions/{id}/export - Export session

Development

Create new migration

alembic revision --autogenerate -m "description"

Run migrations

alembic upgrade head

Rollback migration

alembic downgrade -1

Project Structure

backend/
├── alembic/              # Database migrations
│   └── versions/
├── app/
│   ├── api/
│   │   ├── endpoints/    # API route handlers
│   │   ├── deps.py       # Dependencies (auth, etc.)
│   │   └── router.py     # Main router
│   ├── core/
│   │   ├── config.py     # Settings
│   │   ├── database.py   # DB connection
│   │   └── security.py   # JWT, password hashing
│   ├── models/           # SQLAlchemy models
│   ├── schemas/          # Pydantic schemas
│   └── main.py           # FastAPI app
├── tests/
├── alembic.ini
├── docker-compose.yml
├── requirements.txt
└── README.md