fix(prompts): resolver must not serve a planned (unactivated) deployment (F-13) - #272
Open
anilguleroglu wants to merge 1 commit into
Open
fix(prompts): resolver must not serve a planned (unactivated) deployment (F-13)#272anilguleroglu wants to merge 1 commit into
anilguleroglu wants to merge 1 commit into
Conversation
…ent (F-13) promotePromptVersion writes a fresh deployment as rolloutStatus: 'planned'; only activatePromptDeployment flips it to 'active'. resolvePromptForEnvironment picked deployments[environment].versionId without ever checking that status, so a promoted-but-not-yet-approved version was served identically to an approved one -- an isolated check showed a planned-only v2 served as "prod". The resolver now only uses the environment's deployment when its rolloutStatus is 'active'; a deployment stuck at 'planned' falls through to the same currentVersion fallback already used when the environment has no deployment configured at all, rather than serving the half-promoted version. Also documented (no behavior change) that /client/v1/agents/responses and /client/v1/responses deliberately default usePublished differently -- flagged in the same finding as a source of confusion, not a bug in itself, since the agent runtime doesn't have prompts' per-environment planned/active state to begin with. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KQq6TnVNHRNU6Wz1eQzPpD
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
P1 finding from the 2026-09-05 finance-institution assessment.
promotePromptVersionwrites a fresh deployment asrolloutStatus: 'planned'; onlyactivatePromptDeploymentflips it to'active'. ButresolvePromptForEnvironment— the function actually used to serve a prompt at request time — pickeddeployments[environment].versionIdwithout ever checking that status. An isolated check in the assessment showed aplanned-only v2 served as "prod".The resolver now only uses the environment's deployment when its
rolloutStatusis'active'. A deployment stuck at'planned'falls through to the samecurrentVersionfallback already used when the environment has no deployment configured at all — so this doesn't change behavior for environments that were never given an explicit deployment, only for the specific "promoted but not yet activated" gap.Also added a comment (no behavior change) on
/client/v1/agents/responsesvs/client/v1/responses's differentusePublisheddefaults, which the same finding flagged as a source of confusion — the agent-execution path uses a simpler singlepublishedVersionfield with no per-environment planned/active state, so it doesn't have this specific bug, just needed the intent written down.Test plan
prompt-service.test.ts: planned deployment is skipped, active deployment is served, no-deployment-at-all still falls back to currentVersionnpx tsc --noEmitcleannpx eslintcleanvitest run: 5049 passed, 0 failed, 5 skipped🤖 Generated with Claude Code
https://claude.ai/code/session_01KQq6TnVNHRNU6Wz1eQzPpD