Skip to main content
@@ -385,5 +384,3 @@ function resultNextStep(result: ActionResult) {
}
export default App
-
-
diff --git a/infra/terraform/components/public-sandbox/main.tf b/infra/terraform/components/public-sandbox/main.tf
index e25f609..4e2e061 100644
--- a/infra/terraform/components/public-sandbox/main.tf
+++ b/infra/terraform/components/public-sandbox/main.tf
@@ -149,11 +149,11 @@ resource "google_cloud_run_v2_service" "sandbox" {
value = "true"
}
- # The public sandbox project does not have access to the Gemma publisher
- # model, so use an available Vertex model for the same privacy contract.
+ # Vertex Model Garden MaaS: request-based Gemma privacy redaction without
+ # a dedicated GPU endpoint. See SAI-72 for the deployment evidence.
env {
name = "STAYLONG_PRIVACY_MODEL"
- value = "gemini-2.5-flash"
+ value = "gemma-4-26b-a4b-it-maas"
}
env {
diff --git a/src/staylong/api/app.py b/src/staylong/api/app.py
index 3d4e9e4..576f004 100644
--- a/src/staylong/api/app.py
+++ b/src/staylong/api/app.py
@@ -610,12 +610,18 @@ def _now() -> datetime:
def _raise_safe_intake_error(error: Exception) -> None:
"""Map policy refusals to plain language without returning internal details."""
from staylong.agents.intake import MedicalTriageRefusalRequired
+ from staylong.privacy.gemma import PrivacyGuardError
if isinstance(error, MedicalTriageRefusalRequired):
raise HTTPException(
status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
detail=str(error),
) from None
+ if isinstance(error, PrivacyGuardError):
+ raise HTTPException(
+ status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+ detail="StayLong could not safely prepare your plan. Please try again.",
+ ) from None
raise error
diff --git a/src/staylong/privacy/gemma.py b/src/staylong/privacy/gemma.py
index 13a9bee..58584de 100644
--- a/src/staylong/privacy/gemma.py
+++ b/src/staylong/privacy/gemma.py
@@ -69,7 +69,7 @@ def __init__(
*,
project_id: str,
location: str = "global",
- model_id: str = "gemma-3-27b-it",
+ model_id: str = "gemma-4-26b-a4b-it-maas",
) -> None:
if not project_id.strip():
raise ValueError("project_id must be configured for Gemma.")
@@ -106,14 +106,13 @@ def build_vertex_gemma_privacy_guard(
) -> GemmaPrivacyGuard:
"""Build the privacy guard with the configured Vertex-hosted model.
- Gemma remains the default model. Environments that do not have access to
- the Gemma publisher model can explicitly select another approved Vertex
- model (for example ``gemini-2.5-flash``) via ``STAYLONG_PRIVACY_MODEL``.
+ Gemma MaaS remains the default model. Deployments may explicitly select a
+ different approved Gemma model through ``STAYLONG_PRIVACY_MODEL``.
"""
return GemmaPrivacyGuard(
provider=VertexGemmaJsonProvider(
project_id=project_id,
location=location,
- model_id=os.getenv("STAYLONG_PRIVACY_MODEL", "gemma-3-27b-it"),
+ model_id=os.getenv("STAYLONG_PRIVACY_MODEL", "gemma-4-26b-a4b-it-maas"),
)
)
diff --git a/tests/api/test_public_sandbox_api.py b/tests/api/test_public_sandbox_api.py
index 1fed1c5..8e15c69 100644
--- a/tests/api/test_public_sandbox_api.py
+++ b/tests/api/test_public_sandbox_api.py
@@ -13,7 +13,15 @@
from tests.api.test_taskmaster_api import ANSWERS, StaticProvider
-def _public_client() -> TestClient:
+class FailingPrivacyGuard:
+ def redact(self, text: str):
+ from staylong.privacy.gemma import PrivacyGuardError
+
+ del text
+ raise PrivacyGuardError("privacy provider unavailable")
+
+
+def _public_client(*, privacy_guard: object | None = None) -> TestClient:
from staylong.api.app import PublicSandboxConfig
workflow = TaskmasterWorkflow(
@@ -21,6 +29,7 @@ def _public_client() -> TestClient:
repository=InMemoryWorkflowRepository(),
event_repository=InMemoryEventRepository(),
calendar=CalendarDemoAdapter(),
+ privacy_guard=privacy_guard,
)
return TestClient(
create_app(
@@ -84,6 +93,20 @@ def test_private_workflow_route_still_requires_bearer_authentication() -> None:
assert response.status_code == 401
+def test_public_workflow_fails_closed_when_privacy_guard_is_unavailable() -> None:
+ """Do not persist or begin a plan if Gemma cannot protect the concern."""
+ client = _public_client(privacy_guard=FailingPrivacyGuard())
+ response = client.post(
+ "/v1/public/workflows",
+ json={"concern": "Please call 0412 345 678 about the dark hallway."},
+ )
+
+ assert response.status_code == 503
+ assert response.json() == {
+ "detail": "StayLong could not safely prepare your plan. Please try again."
+ }
+
+
def test_public_owner_can_approve_a_sandbox_action() -> None:
"""A session owner may explicitly approve its own sandbox-only next step."""
browser = _public_client()
diff --git a/tests/infra/test_public_sandbox_component.py b/tests/infra/test_public_sandbox_component.py
index 7eee996..ba824da 100644
--- a/tests/infra/test_public_sandbox_component.py
+++ b/tests/infra/test_public_sandbox_component.py
@@ -45,11 +45,11 @@ def test_public_sandbox_enables_vertex_ai_for_gemma_privacy_guard() -> None:
assert 'service = "aiplatform.googleapis.com"' in source
-def test_public_sandbox_selects_an_available_vertex_privacy_model() -> None:
+def test_public_sandbox_selects_the_gemma_maas_privacy_model() -> None:
source = (COMPONENT / "main.tf").read_text(encoding="utf-8")
assert 'name = "STAYLONG_PRIVACY_MODEL"' in source
- assert 'value = "gemini-2.5-flash"' in source
+ assert 'value = "gemma-4-26b-a4b-it-maas"' in source
def test_public_sandbox_outputs_only_url_and_non_sensitive_evidence() -> None:
diff --git a/tests/privacy/test_gemma.py b/tests/privacy/test_gemma.py
index 9f75c56..77f07fa 100644
--- a/tests/privacy/test_gemma.py
+++ b/tests/privacy/test_gemma.py
@@ -55,14 +55,14 @@ def test_gemma_rejects_empty_redacted_text() -> None:
guard.redact("A concern")
-def test_vertex_privacy_guard_uses_explicit_environment_model(monkeypatch) -> None:
+def test_vertex_privacy_guard_defaults_to_gemma_maas_model(monkeypatch) -> None:
captured: dict[str, str] = {}
class RecordingProvider:
def __init__(self, *, project_id: str, location: str, model_id: str) -> None:
captured.update(project_id=project_id, location=location, model_id=model_id)
- monkeypatch.setenv("STAYLONG_PRIVACY_MODEL", "gemini-2.5-flash")
+ monkeypatch.delenv("STAYLONG_PRIVACY_MODEL", raising=False)
monkeypatch.setattr("staylong.privacy.gemma.VertexGemmaJsonProvider", RecordingProvider)
build_vertex_gemma_privacy_guard(project_id="stay-long", location="global")
@@ -70,5 +70,5 @@ def __init__(self, *, project_id: str, location: str, model_id: str) -> None:
assert captured == {
"project_id": "stay-long",
"location": "global",
- "model_id": "gemini-2.5-flash",
+ "model_id": "gemma-4-26b-a4b-it-maas",
}