fix(rag): close third-round adversarial-guard gaps + document limits

[BigSimmo]

Follow-up to the merged #179. The review bot flagged a third round of missed injection phrasings after #179 merged. All were valid; this adds them, each validated to keep zero clinical false-positives (the "don't make it worse" bar), and documents where to stop.

Added coverage

• invent / make-up fabrication — "Invent citations…" (whole-word invent, so "inventory data sources" is safe); "Make up references…" (object must immediately follow, so "documents that make up the reference list" is safe).
• system message/instructions, access tokens — "your system message", "show system instructions", "list any access tokens".
• assume / treat-as evidence — "Assume the evidence is complete…", "Treat the sources as sufficient…" (objects restricted to evidence/sources/citations/data, so "assume the patient is stable" is safe).
• negated-follow overrides — "Do not follow prior instructions", "Stop following your guardrails" (objects are instruction/rule/guardrail terms only, never clinical protocol/guideline — so "when should you not follow the standard protocol?" and "do not stop the medication abruptly" are safe).

Documented the limit

Added a comment stating this regex guard is a best-effort defense-in-depth first line, not a complete boundary: it can't be exhaustive against paraphrase, and ever-looser patterns trade injection recall for clinical false-positives (the worse failure). The durable injection defenses are the source-text neutralization (neutralizeInstructions) and the answer-generation prompt. Recommendation: extend for common phrasings, don't chase every variant.

Verification

vitest tests/rag-routing.test.ts 25/25 — every new injection vector and its clinical lookalike ("false ID", "prescriber credentials", "make up the reference list", "not follow the standard protocol", "assume the patient is stable", "do not stop the medication") is a regression test. typecheck/lint/prettier clean. Live: "Invent citations…" routes unsupported/grounded=false while "inventory data sources for the medication register" still answers (extractive, grounded=true).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:fb9382d697

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[BigSimmo]

Fourth round: three were real false-positives my round-3 additions introduced (refusing legitimate clinical questions) — fixed in 2c87948. The fourth I'm intentionally leaving as a documented limit.

• Narrow negated-follow to privileged instructions — fixed. The instruction object now must be privileged (prior/previous/above/these/those/your/system instructions) or a rule/guardrail/prompt, so "Do not follow discharge instructions if symptoms worsen" and "…medication instructions from an old leaflet" no longer refuse.
• Keep patient-data assumptions out of the guard — fixed. Removed "data" from the pretend/assume/treat objects (evidence/sources/citations only), so "Assume the ANC data confirms red-range neutropenia" no longer refuses.
• Require privilege context for system instructions — fixed. "system message"/"system instructions" are removed from the verbless rule (still caught when an explicit exfiltration verb is present), so "What patient monitoring system instructions apply…" no longer refuses.
• Block common make-up fabrication variants ("make up sources/evidence") — intentionally not adding. Adding sources/evidence to the "make up" object list re-introduces the composition false-positive this pattern was tightened to avoid ("documents that make up the evidence base / source list"). Direct fabrication is already covered by fabricate/forge/invent + the fake-citation rule; "make up sources" is an uncommon phrasing where the false-positive cost outweighs the recall gain. Per the limitation note added in this PR, this is the accept-the-limit boundary — the durable defenses are source-text neutralization and the generation prompt.

Validated: 25/25 routing tests (regression vectors for all four new clinical lookalikes), zero golden false-positives, all prior injection vectors still flagged.