fix(configurator): preserve broad Firewall setup decisions (#122)

## Root cause

Protected Dev release
[39412434669](https://github.com/stackitcloud/stackit-landing-zone/actions/runs/39412434669),
merged source `0c5188bf60c332adcbecf5372e913021b298e126`, passed 113/114
model cases and 13/13 journey steps, with no transport failures.
`firewall-metro-setup-operations`, repetition 1, omitted the
still-unanswered interruption/operations question. Build and deployment
were skipped; the original failed receipt remains retained.

The general intent classifier could label a broad “continue the central
Firewall setup with HA” request with `firewallFields=[ha]`. That field
hint bypassed the dedicated setup-scope/evidence classifier, making a
broad continuation behave like a narrow HA-only update. Native proposal
validation did not detect the omitted conversational decision.

## Changes

- Always consult the existing dedicated scope/evidence classifier for
active Firewall drafts and multi-turn Firewall conversations,
independently of general field hints.
- Keep the existing semantic distinction: broad setup asks only the next
unanswered business decision; explicit narrow native changes do not
acquire unrelated setup questions, including after earlier broad setup.
- Use null-only evidence fields when no bounded quote fragments exist,
rather than emitting empty enumerations for a newly classified long
native request.
- Add six regression cases covering every remaining/complete setup stage
despite `ha` field hints, explicit narrow changes after broad history,
and empty quote inventories.
- Adapt mock classifier responses and positional schema assertions to
the additional classification call, preserving all semantic expectations
and the no-extra-answer-model contract for missing native IPs.
- Update complete EN/DE guidance and regenerate source bindings. No
curated topic facts, model defaults, native infrastructure, or factual
oracle changed.

## Validation

- Red reproduction: four valid Metro setup cases demonstrated the bypass
before the runtime correction.
- Pinned Node 24.21.0/npm 11.19.0 canonical `npm run check`: **977
passed**, 69 unchanged default-gated cases; lint, types and build
passed.
- Real configured-model Firewall cases: **28/28 passed**, two
independent repetitions; continuous dialogue **13/13 passed**, both exit
0. Both answer and intent models remain
`Qwen/Qwen3-VL-235B-A22B-Instruct-FP8`; execution was disabled and only
the dedicated inference token was used.
- Knowledge SHA:
`0fd2c183ebdf903b2e7d10e50dac5e4b3abd08e9f665fcc15bbab01b95669299`;
unchanged factual suite SHA:
`8c60fd19e7e5a6e8903ccea7987f834112c948b4de8cb60487a1694bc64fe2ee`.
- Exact qualified source: `81acc9da14b7665b5733373773f7e8c608a51b2b`;
committed content manifest retained with the local receipts. No
transport failures occurred during this qualification.

## Release boundary

Refs #95. Dev has not been changed by the failed release. After normal
reviewed integration, a new manual exact-source release must pass its
complete repeated model gate before building and deploying with
`runner_pool_size=1`, then verify hosted warm handoff and replacement
readiness.

Previous failures remain failures. No failed iteration was retried as a
replacement receipt, no oracle was weakened, and no customer Apply or
production operation was performed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: lweberru

landing-zone-configurator/app/apps/api/src/assistant/knowledge-topics.generated.ts

@@ -1512,7 +1512,7 @@ export const assistantKnowledgeTopics = {
         {
           path: "landing-zone-configurator/app/apps/api/src/assistant/model-serving.ts",
           sha256:
-            "2bd270d1afd3937822417d790452180c9323d13b779862198a724948056f7186",
+            "afd22388e2326e4cf45f6fdc970e7725448a8ac11d2be38333cd02ea19642f07",
         },
         {
           path: "landing-zone-configurator/app/apps/api/src/assistant/knowledge.ts",

landing-zone-configurator/app/apps/api/src/assistant/model-serving.ts

@@ -1551,9 +1551,7 @@ Reviewed knowledge: ${JSON.stringify({ fields: draftFields, ...topicKnowledge })
     let setupDecisions: z.infer<typeof requirementQuotesSchema> | null = null;
     if (
       ["firewall-infrastructure", "firewall-policy"].includes(intent.topic) &&
-      (intent.mode === "draft" || requirementSources.length > 1) &&
-      (intent.firewallFields.length === 0 ||
-        intent.networkScope === "sna-and-firewall")
+      (intent.mode === "draft" || requirementSources.length > 1)
     ) {
       const quoteSources = [
         ...new Set(
@@ -1574,9 +1572,9 @@ Reviewed knowledge: ${JSON.stringify({ fields: draftFields, ...topicKnowledge })
             .filter((quote) => quote.length > 0 && quote.length <= 600),
         ),
       ].map((text, index) => ({ id: `user-evidence-${index}`, text }));
-      const evidence = z
-        .enum(quoteSources.map((source) => source.id))
-        .nullable();
+      const evidence = quoteSources.length
+        ? z.enum(quoteSources.map((source) => source.id)).nullable()
+        : z.null();
       const selection = (
         field:
           | "setupRequest"

landing-zone-configurator/app/tests/assistant-firewall.test.ts

@@ -118,6 +118,13 @@ function model(
             entry.text.includes(quote),
           )?.id ??
           quote);
+    const setupScope =
+      targets.setupScope ??
+      (mode === "advice"
+        ? "advice"
+        : targets.fields?.length
+          ? "field-update"
+          : "setup");
     return Response.json({
       choices: [
         {
@@ -127,13 +134,13 @@ function model(
             content: JSON.stringify(
               schemaName === "firewall_setup_decisions"
                 ? {
-                    scope:
-                      targets.setupScope ??
-                      (mode === "advice" ? "advice" : "setup"),
+                    scope: setupScope,
                     setupRequest: source(
                       targets.setupRequest ??
-                        JSON.parse(body.messages.at(-1).content)
-                          .latestUserMessage,
+                        (setupScope === "setup"
+                          ? JSON.parse(body.messages.at(-1).content)
+                              .latestUserMessage
+                          : null),
                     ),
                     capacityDeferred: source(
                       targets.capacityDeferred
@@ -859,6 +866,173 @@ it("keeps a narrow native patch free of setup questions even when the general cl
   expect(result.questions).toEqual([]);
 });
 
+it.each([
+  {
+    traffic: false,
+    capacity: false,
+    operations: false,
+    path: "connectivity.firewall.lan_network_range",
+  },
+  {
+    traffic: true,
+    capacity: false,
+    operations: false,
+    path: "connectivity.firewall.flavor",
+  },
+  {
+    traffic: true,
+    capacity: true,
+    operations: false,
+    path: "connectivity.firewall.ha",
+  },
+  { traffic: true, capacity: true, operations: true, path: null },
+])(
+  "classifies broad HA setup independently of general field hints: $path",
+  async (answered) => {
+    const f = fixture();
+    f.values["connectivity.firewall"] = {
+      ...firewall,
+      zone: "eu01-m",
+      flavor: "c1.2",
+      lan_network_range: "10.0.2.0/28",
+      wan_network_range: "10.0.2.16/28",
+    };
+    const message =
+      "Bitte die restliche zentrale Firewall-Einrichtung mit HA fortsetzen. Vorhandene Netz- und VM-Werte behalten, keine Ausführung.";
+    const quotes = {
+      traffic: answered.traffic
+        ? "Über die zentrale Firewall sollen Internet-Verkehr und Verkehr zwischen Projekten laufen."
+        : null,
+      capacity: answered.capacity
+        ? "Wir erwarten 500 Mbit/s Spitzendurchsatz und 10000 parallele Verbindungen."
+        : null,
+      operations: answered.operations
+        ? "Maximal zwei Minuten Unterbrechung sind tolerierbar."
+        : null,
+    };
+    const history = Object.values(quotes).flatMap((content) =>
+      content ? [{ role: "user" as const, content }] : [],
+    );
+    const { engine, request } = model(
+      proposal,
+      "other",
+      "draft",
+      "firewall-infrastructure",
+      "ha",
+      {
+        fields: ["ha"],
+        setupScope: "setup",
+        setupRequest: message,
+        haRequest: message,
+        setupQuotes: quotes,
+      },
+    );
+    const result = await engine.converse(
+      f.selection,
+      f.values,
+      history,
+      message,
+      {
+        regions: [
+          {
+            region: "eu01",
+            fetchedAt: null,
+            products: {
+              availabilityZones: {
+                status: "available",
+                totalOptions: 3,
+                truncated: false,
+                options: ["eu01-m", "eu01-1", "eu01-2"].map((value) => ({
+                  value,
+                  label: value,
+                })),
+              },
+            },
+          },
+        ],
+      },
+    );
+    expect(result.changes).toEqual(proposal.changes);
+    expect(result.questions.map((question) => question.path)).toEqual(
+      answered.path ? [answered.path] : [],
+    );
+    expect(
+      request.mock.calls.filter(
+        ([, options]) =>
+          JSON.parse(String(options?.body)).response_format.json_schema.name ===
+          "firewall_setup_decisions",
+      ),
+    ).toHaveLength(1);
+  },
+);
+
+it("retains an explicit narrow HA update after broad setup despite general field hints", async () => {
+  const f = fixture();
+  const { engine, request } = model(
+    proposal,
+    "other",
+    "draft",
+    "firewall-infrastructure",
+    "ha",
+    { fields: ["ha"], setupScope: "field-update" },
+  );
+  const result = await engine.converse(
+    f.selection,
+    f.values,
+    [
+      {
+        role: "user",
+        content: "Bitte die zentrale Firewall vollständig einrichten.",
+      },
+    ],
+    "Nur HA mit Backup-Zone eu01-2 und vhid 23 ergänzen, keine weiteren Einrichtungsfragen.",
+  );
+  expect(result.changes).toEqual(proposal.changes);
+  expect(result.questions).toEqual([]);
+  expect(
+    request.mock.calls.filter(
+      ([, options]) =>
+        JSON.parse(String(options?.body)).response_format.json_schema.name ===
+        "firewall_setup_decisions",
+    ),
+  ).toHaveLength(1);
+});
+
+it("uses null-only evidence for a long narrow request without bounded quote fragments", async () => {
+  const f = fixture();
+  const { engine, request } = model(
+    proposal,
+    "other",
+    "draft",
+    "firewall-infrastructure",
+    "ha",
+    { fields: ["ha"], setupScope: "field-update" },
+  );
+  const result = await engine.converse(
+    f.selection,
+    f.values,
+    [],
+    `Nur HA mit Backup-Zone eu01-2 und vhid 23 ergänzen; alle anderen Werte erhalten ${"Zusatz ".repeat(100)}`,
+  );
+  expect(result.changes).toEqual(proposal.changes);
+  expect(result.questions).toEqual([]);
+  const classification = request.mock.calls
+    .map(([, options]) => JSON.parse(String(options?.body)))
+    .find(
+      (body) =>
+        body.response_format.json_schema.name === "firewall_setup_decisions",
+    );
+  expect(
+    JSON.parse(classification.messages.at(-1).content).userEvidence,
+  ).toEqual([]);
+  expect(
+    classification.response_format.json_schema.schema.properties.traffic,
+  ).toMatchObject({ type: "null" });
+  expect(
+    JSON.stringify(classification.response_format.json_schema.schema),
+  ).not.toContain('"enum":[]');
+});
+
 it("rejects invented confirmations from the bounded setup decision classifier", async () => {
   const f = fixture();
   const { request } = model(
@@ -922,7 +1096,7 @@ it("restricts explicitly requested IP response values to saved or user-supplied
     [],
     "LAN-IP 10.0.252.8 und HA-VIP 10.0.252.9, Backup-Zone eu01-2, vhid 23 vorschlagen.",
   );
-  const schema = JSON.parse(String(request.mock.calls[1]?.[1]?.body))
+  const schema = JSON.parse(String(request.mock.calls.at(-1)?.[1]?.body))
     .response_format.json_schema.schema;
   const value = schema.properties.changes.items.properties.value;
   expect(value.required).toContain("lan_ip");
@@ -957,7 +1131,12 @@ it("asks for an explicitly requested missing node IP instead of proposing a comp
   expect(response.questions.map((entry) => entry.path)).toEqual([
     "connectivity.firewall.lan_ip",
   ]);
-  expect(request).toHaveBeenCalledTimes(1);
+  expect(
+    request.mock.calls.map(
+      ([, options]) =>
+        JSON.parse(String(options?.body)).response_format.json_schema.name,
+    ),
+  ).toEqual(["conversation_intent", "firewall_setup_decisions"]);
 });
 
 it("still rejects invented computed primary and HA IP defaults after schema narrowing", async () => {
@@ -1365,7 +1544,7 @@ it("requires explicitly requested existing native fields in the answer contract"
     "Name reviewed-fw und Flavor g1.8 vorschlagen.",
   );
   expect(response.changes).toEqual(patch.changes);
-  const schema = JSON.parse(String(request.mock.calls[1]?.[1]?.body))
+  const schema = JSON.parse(String(request.mock.calls.at(-1)?.[1]?.body))
     .response_format.json_schema.schema;
   expect(schema.properties.changes.items.properties.value.required).toEqual([
     "flavor",

landing-zone-configurator/docs/assistant-knowledge/README.de.md

@@ -138,6 +138,16 @@ Effektive Modell-IDs stehen in jedem Nachweis.
 Qualifikation eines alternativen Modells qualifiziert nicht das
 konfigurierte Anwendungsmodell.
 
+Aktive Firewall-Entwuerfe und mehrstufige Firewall-Dialoge verwenden immer
+den spezialisierten Klassifikator fuer Einrichtungsumfang und Belege.
+Ein allgemeiner Feldhinweis wie `ha` darf ihn nicht umgehen: Eine breite
+Einrichtungsfortsetzung mit HA behaelt die noch offenen Entscheidungen zu
+Verkehr, Kapazitaet und Unterbrechung bei. Eine ausdrueckliche gezielte native
+Aenderung bleibt auch nach einem frueheren breiten Einrichtungsdialog eine
+Feldaenderung und erzeugt keine fremden Einrichtungsfragen.
+Gibt es keine begrenzten Nutzerbeleg-Fragmente, erlauben Belegfelder nur null
+statt einer leeren Aufzaehlung.
+
 Beschreibungen von Intent- und Evidenzschemas werden auch im Systemkontext
 des Klassifikators gesendet, nicht nur als Structured-Decoding-Beschraenkung.
 Antwortgenerierung erhaelt geprueftes Feld-/Themenwissen ohne zweiten

landing-zone-configurator/docs/assistant-knowledge/README.md

@@ -100,6 +100,14 @@ without a CI-only classifier override. The effective model IDs are recorded in
 every receipt. Qualification of an alternative model does not qualify the
 application's configured model.
 
+Active Firewall drafts and multi-turn Firewall conversations always use the
+dedicated setup-scope/evidence classifier. A general field hint such as `ha`
+must not bypass it: continuing broad setup with HA retains the remaining
+traffic, capacity and interruption decisions. An explicit narrow native update
+remains a field update, even after an earlier broad setup conversation, and does
+not add unrelated setup questions. If no bounded user-evidence fragments exist,
+evidence fields permit only null rather than an empty enumeration.
+
 Intent and evidence schema descriptions are also sent in the classifier's system
 context, not only as a structured-decoding constraint. Answer generation receives
 the reviewed field and topic knowledge, without a second full schema dump.

landing-zone-configurator/docs/assistant-test-catalogue.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "status": "field-inventory-and-smoke-corpus-not-ai-qualification",
   "engineRevision": "a256f6896d11134fdc351786f1be5eba4e56b2e2",
-  "knowledgeSha256": "6179c3ad16fe011412c165ed1a0d2d71bff0678b9ba3dc2642464fbc3a41db69",
+  "knowledgeSha256": "0fd2c183ebdf903b2e7d10e50dac5e4b3abd08e9f665fcc15bbab01b95669299",
   "sourceDigests": {
     "scripts/assistant-scenarios.ts": "441273d9af541a14185062728a9f9a7044df0e8a7c51645a53eb970a341867d9",
     "scripts/assistant-tests.ts": "5e19b1c74da1ffa996f2d76876cc8dc639da698d0b6f9b7e1fc6637863833a8d"