Skip to content

LCORE-3202: Wire shield into response#2234

Draft
Jazzcort wants to merge 3 commits into
lightspeed-core:feature/upgrade-ogx-to-1.0.2from
Jazzcort:wire-shield-into-response
Draft

LCORE-3202: Wire shield into response#2234
Jazzcort wants to merge 3 commits into
lightspeed-core:feature/upgrade-ogx-to-1.0.2from
Jazzcort:wire-shield-into-response

Conversation

@Jazzcort

Copy link
Copy Markdown
Contributor

Description

Wire V2 shield moderation into the Responses API endpoint

Add run_shield_moderation_v2 and build_shield to utils/shields.py to run safety capabilities (question validity, PII redaction) from the new ShieldConfiguration model. Call the new function in the responses endpoint handler alongside the existing Llama Stack shield path.

Type of change

  • Refactor
  • New feature
  • Bug fix
  • CVE fix
  • Optimization
  • Documentation Update
  • Configuration Update
  • Bump-up service version
  • Bump-up dependent library
  • Bump-up library or tool used for development (does not change the final image)
  • CI configuration change
  • Konflux configuration change
  • Unit tests improvement
  • Integration tests improvement
  • End to end tests improvement
  • Benchmarks improvement

Tools used to create PR

Identify any AI code assistants used in this PR (for transparency and review context)

  • Assisted-by: (e.g., Claude, CodeRabbit, Ollama, etc., N/A if not used)
  • Generated by: (e.g., tool name and version; N/A if not used)

Related Tickets & Documents

  • Related Issue #
  • Closes #

Checklist before requesting a review

  • I have performed a self-review of my code.
  • PR has passed all pre-merge test jobs.
  • If it is a core feature, I have added thorough tests.

Testing

  • Please provide detailed steps to perform tests related to this code change.
  • How were the fix/results from this change verified? Please provide relevant screenshots or results.

@coderabbitai

coderabbitai Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3c9e23d3-e732-4af4-8772-ff22351867bf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
✨ Simplify code
  • Create PR with simplified code

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@Jazzcort

Copy link
Copy Markdown
Contributor Author

Should only check the last commit. This PR should land after those two previous commits.

This is just a draft PR. I removed refusal_message and moderation_id from the moderation result since I think we don't need those anymore. But then, we need to dig into all the functions that use moderation result and safely modify them so the missing fields won't cause errors. i.e. OpenAIResponseObject uses both moderation_id and refusal_message. Will it be safe to just remove id field and use moderation_result.message as output? Or, we will have a bigger refactor there for how moderation result is used. Just want to have more info before I move forward. 😁 @asimurka @jrobertboos

@Jazzcort Jazzcort changed the title Wire shield into response LCORE-3202: Wire shield into response Jul 23, 2026

@asimurka asimurka left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, finally we can delete old run_shield_moderation and replace it with v2 but it's ok for now

Comment thread src/utils/shields.py Outdated
return ShieldModerationPassedV2()


def build_shield(shield_config: ShieldConfiguration) -> AbstractSafetyCapability[Any]:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

use object as type var here as well

Eliminates redundant stored state by deriving refusal_response from
message at access time, removing the now-unnecessary
create_refusal_response helper and all constructor-site arguments.
@Jazzcort
Jazzcort force-pushed the wire-shield-into-response branch from 714f48f to 0237198 Compare July 24, 2026 20:09
Jazzcort added 2 commits July 24, 2026 16:33
Introduce AbstractSafetyCapability(AbstractCapability[T]) in
capabilities/base.py, requiring subclasses to implement a run()
method that accepts raw text and returns ShieldModerationResult.
This enables safety capabilities to be invoked outside the
pydantic-ai agent lifecycle.

Migrate QuestionValidity and PiiRedactionCapability to extend the
new base class and implement run():

- QuestionValidity.run() delegates to model_request and maps
  ALLOWED/REJECTED to ShieldModerationPassed/Blocked
- PiiRedactionCapability.run() applies regex redaction and returns
  Blocked when PII is detected

Add unit tests for both run() implementations.
Add run_shield_moderation_v2 and build_shield to utils/shields.py to
run shield moderation through AbstractSafetyCapability instances instead
of the Llama Stack client. Update the responses endpoint to call the new
function with shield configs directly. Include unit tests covering pass,
block, filtering, and error handling paths.
@Jazzcort
Jazzcort force-pushed the wire-shield-into-response branch from 0237198 to b448aac Compare July 24, 2026 20:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants