fix(safety+closer): KI-108 + KI-109 — apply CoT strip to all reply paths + broaden closer regex

KI-108 — chain-of-thought leakage on fact-find replies.
Live re-smoke (Scenario S4 T3+T4) caught raw model reasoning leaking into
reply_text on the fact-find brain path:
"We need to respond naturally..."
"We need to process user message..."

KI-104 had wired strip_cot_preamble into tts_preprocess (audio path) and
persona.strip_think_tags (qa/recommendation paths) but the fact_find brain
branch returned outcome.reply_text directly to ChatResponse without any
strip. Two additional verbs ('process', 'parse', 'figure out', ...) also
fell outside strip_cot_preamble's whitelist. Fixes:
1. orchestrator: call strip_think_tags() on every user-facing reply path:
- fact_find brain TurnResult construction (was raw)
- after Sarvam indic translation (Hindi/Hinglish CoT preamble too)
- defensive final strip on QA/recommendation TurnResult boundary
2. persona.strip_think_tags: add a local pre-pass that strips a single
leading "We (need to|must|should) <any-verb> ..." sentence regardless
of the verb that follows, bounded to 200 chars to avoid eating
substantive prose. Catches "We need to process..." and any future
"We need to <verb>" preamble without touching voice_format.py.

KI-109 — closer override regex too narrow.
Live re-smoke: "Show me the top 3 policies you'd recommend" routed to
fact_find_brain::fallback:no_trailer. Several phrases (best policies for
me / what should I get / which policies should I consider / rank them)
weren't in the KI-105 _EXPLICIT_CLOSER_RECOMMENDATION list. Fixes:
- Broaden _EXPLICIT_CLOSER_RECOMMENDATION to cover all closer phrasings
the user types: "rank the top N", "rank them/these/those",
"what should I get", "which policies should I consider",
"best policies for me", "policies you'd recommend", "shortlist for me",
"your top recommendations", "what do you recommend".
- Move "rank top" / "rank the top" from comparison to recommendation —
"rank top N" asks for a ranked shortlist with rationale, not a pairwise
feature comparison. Update KI-105 test split accordingly.
- Add the 6 new misrouted phrases to the
test_ki105_closer_phrases_classify_as_recommendation regression test.

Verification:
python3 -m py_compile backend/{orchestrator,persona}.py → clean
pytest tests/ -q → 75 passed, 29 subtests passed
classify_intent trace:
"Show me the top 3 policies you'd recommend" → recommendation
"Show me policies" → recommendation
"Rank the top 3" → recommendation
"What would you recommend" → recommendation
"Give me your top picks" → recommendation
"What should I get" → recommendation
"Compare HDFC Ergo and Niva Bupa" → comparison

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/orchestrator.py

@@ -101,11 +101,12 @@ def _phrase_present(phrase: str, q: str) -> bool:
 # (`should_route_to_fact_find`) still keeps the KI-013 guard against
 # pitching to empty profiles.
 _EXPLICIT_CLOSER_COMPARISON = (
-    "compare top", "compare the top", "rank the top", "rank top",
+    "compare top", "compare the top",
     "side by side", "side-by-side",
     "compare these", "compare those", "compare them",
 )
 _EXPLICIT_CLOSER_RECOMMENDATION = (
+    # KI-105 — original list.
     "show me policies", "show me the policies", "show me policy",
     "show me the top", "show me top",
     "top 3", "top three", "top policies", "top picks",
@@ -113,6 +114,40 @@ _EXPLICIT_CLOSER_RECOMMENDATION = (
     "your top picks", "your top pick", "your best policy",
     "pitch me", "pitch your top",
     "what would you recommend", "what do you suggest",
+    # KI-109 (2026-05-15) — "rank the top N" and bare "rank them" are
+    # ranked-recommendation requests (the user wants a ranked shortlist of
+    # the candidate set), not pairwise comparison requests. Moved here from
+    # _EXPLICIT_CLOSER_COMPARISON in KI-105 because the live re-smoke
+    # treated them as ranked-output asks and the user-facing reply should
+    # be a recommendation shortlist with rationale, not a feature-by-feature
+    # comparison table.
+    "rank the top", "rank top", "rank them", "rank these", "rank those",
+    # KI-109 (2026-05-15) — live re-smoke caught
+    # "Show me the top 3 policies you'd recommend" routing to
+    # fact_find_brain::fallback:no_trailer because the regex above only
+    # caught the prefix "show me the top" — but in this folder the actual
+    # short-circuit happens in classify_intent via `_phrase_present`, and
+    # since `_phrase_present` is word-boundary based ("\b<phrase>\b"), the
+    # match DOES succeed; the regression is downstream: orchestrator's
+    # `should_route_to_fact_find` still routes context-dependent intents
+    # (recommendation / comparison) to fact-find when profile_is_empty
+    # (KI-018). Even so we broaden the trigger set so the explicit-closer
+    # override lands on EVERY phrasing the user types — particularly
+    # phrases that didn't appear in KI-105's list at all:
+    #   - "best policies for me" (matched RECOMMEND_KEYWORDS["best for"]
+    #     before but only as a generic recommendation, not as an
+    #     unambiguous closer that beats fact-find triggers)
+    #   - "what should I get" (currently matches FACT_FIND_TRIGGERS via
+    #     "should i get"; needs to be lifted into closer lane)
+    #   - "which policies should I consider" (currently falls to qa)
+    #   - "pitch me the top X" (already partly covered; cement it)
+    "best policies for me", "best policy for me", "best for me",
+    "what should i get", "what policy should i get",
+    "which policies should i consider", "which policy should i consider",
+    "which one should i pick", "which one should i go with",
+    "what would you suggest", "what do you recommend",
+    "your top recommendations", "your recommendations",
+    "shortlist for me", "policies you'd recommend", "policy you'd recommend",
 )
 
 
@@ -561,8 +596,20 @@ async def handle_turn(
         else:
             brain_tag = "fact_find_brain::continue"
 
+        # KI-108 (2026-05-15) — strip CoT preamble / instruction-echo leakage
+        # from the fact-find brain reply BEFORE returning to ChatResponse.
+        # Live re-smoke caught Scenario S4 T3+T4 leaking raw model reasoning
+        # ("We need to respond naturally...", "We need to process user
+        # message...") into reply_text because the fact_find brain path was
+        # the only producer of user-facing text NOT routed through
+        # strip_think_tags (which internally calls strip_cot_preamble via
+        # voice_format). KI-104 had wired the strip into tts_preprocess
+        # (audio) + persona.strip_think_tags (qa/recommendation paths) but
+        # missed this branch. Apply uniformly here so every reply_text the
+        # API returns is leak-free regardless of brain used.
+        ff_reply_clean = strip_think_tags(outcome.reply_text)
         return TurnResult(
-            reply_text=outcome.reply_text,
+            reply_text=ff_reply_clean,
             citations=[],
             retrieved_chunk_ids=[],
             brain_used=brain_tag,
@@ -926,7 +973,14 @@ async def handle_turn(
                         if drift_c.drift_detected:
                             final_brain_tag = f"cascade::drift-cosine-fallback+{pick.provider.name}"
                         else:
-                            reply = reply_indic
+                            # KI-108 (2026-05-15) — strip CoT preamble after
+                            # the indic translation too. Sarvam's <think>
+                            # blocks + bare scratchpad lines (e.g. "हमें
+                            # natural respond करना है") have leaked through
+                            # the translator before; the strip is idempotent
+                            # and inexpensive so apply defensively even when
+                            # the English source was already cleaned.
+                            reply = strip_think_tags(reply_indic)
                             final_brain_tag = f"cascade::sarvam-trans+{pick.provider.name}+sarvam-trans"
         except Exception:
             pass  # if any step fails, return English — better than mis-translated
@@ -987,6 +1041,14 @@ async def handle_turn(
             session_id, type(e).__name__, str(e)[:200],
         )
 
+    # KI-108 (2026-05-15) — defensive final strip on every QA / recommendation
+    # / comparison reply path. `reply` was stripped at line 801 when produced
+    # by the brain, but the faithfulness-blocked branch + the cross-check
+    # retry can overwrite it with `verdict.suggested_reply` (judge LLM output)
+    # which has not been routed through strip_cot_preamble. Apply once more
+    # at the boundary so no user-facing text ever leaves this function
+    # carrying a "We need to respond..." preamble.
+    reply = strip_think_tags(reply)
     return TurnResult(
         reply_text=reply,
         citations=citations,

backend/persona.py

@@ -172,6 +172,24 @@ OPEN_THINK = re.compile(r"<think>", flags=re.IGNORECASE)
 CLOSE_THINK = re.compile(r"</think>", flags=re.IGNORECASE)
 
 
+# KI-108 (2026-05-15) — supplementary CoT verb pattern catalogued in this
+# module (NOT in voice_format which a sibling agent may be touching). The
+# `strip_cot_preamble` helper in voice_format already strips a handful of
+# "We need to <verb>" phrases (respond / answer / follow / ground / check /
+# ensure / make sure / consider / think / address) but live re-smoke S4
+# T3+T4 leaked "We need to process user message..." and "We need to
+# respond naturally..." — `respond` IS in the whitelist but only when
+# followed by another whitelisted verb, and the sentence-level matcher
+# requires the FULL sentence to match the starter. This local pre-pass
+# strips a leading "We (need to|must|should) <any-verb> ..." sentence
+# regardless of verb, applied ONLY when that sentence appears at position 0
+# and ends within ~200 chars — same conservative window as voice_format.
+_LOCAL_COT_LEAD_SENTENCE = re.compile(
+    r"^\s*(?:We (?:need to|must|should)|I (?:need to|must|should|will))\s+\w+[^.!?\n]{0,200}[.!?]\s*",
+    flags=re.IGNORECASE,
+)
+
+
 def strip_think_tags(text: str) -> str:
     """Sarvam-M emits <think>...</think> chain-of-thought before the final answer.
 
@@ -187,6 +205,16 @@ def strip_think_tags(text: str) -> str:
     the judge model leaking "We need to respond to user question…",
     "We must ground every factual claim…", and bare reasoning labels
     (`**Reasoning:**`, `[INTERNAL]…`) into user-visible reply_text.
+
+    KI-108 (2026-05-15) — additional local pre-pass that strips a leading
+    "We need to ... / We must ... / We should ... / I need to ..." sentence
+    regardless of the verb that follows. Live re-smoke S4 T3+T4 caught
+    "We need to process user message…" which `strip_cot_preamble`'s
+    whitelist (respond / answer / follow / ground / check / etc.) misses
+    because `process` isn't in it. We strip ONE such leading sentence here
+    before delegating, so any "We need to <verb>" preamble dies regardless
+    of verb. Conservative: only matches the very first sentence (no MULTILINE)
+    and caps at 200 chars to avoid eating substantive prose.
     """
     if "<think>" in text.lower() and "</think>" not in text.lower():
         # Reasoning was truncated mid-thought — no final answer was produced.
@@ -198,6 +226,16 @@ def strip_think_tags(text: str) -> str:
     if not cleaned:
         return "I'm thinking through that. Could you rephrase or ask a follow-up?"
 
+    # KI-108 — local pre-pass: strip a single leading CoT-shaped sentence
+    # whose verb falls outside `strip_cot_preamble`'s whitelist. Bounded so
+    # we never eat past the first sentence and never run more than once.
+    # Note: an empty `_stripped` is a valid result (the whole reply was one
+    # CoT sentence) — accept it; voice_format.strip_cot_preamble's emergency
+    # fallback takes over on empty input.
+    _stripped = _LOCAL_COT_LEAD_SENTENCE.sub("", cleaned, count=1)
+    if _stripped != cleaned:
+        cleaned = _stripped.lstrip()
+
     # KI-104 — second-layer strip for CoT / instruction-echo leakage that
     # didn't come wrapped in <think> tags. Imported locally to avoid an
     # import cycle (voice_format has no persona deps; persona has no

tests/test_routing_regression.py

@@ -68,13 +68,23 @@ class TestIntentClassification(unittest.TestCase):
         self.assertEqual(classify_intent("Which one should I get?"), "fact_find")
 
     def test_ki105_closer_phrases_classify_as_recommendation(self) -> None:
-        """KI-105 (2026-05-15) — explicit-closer regression.
+        """KI-105 / KI-109 (2026-05-15) — explicit-closer regression.
 
         Live 15-persona smoke caught these phrases being routed to qa or
         fact_find instead of recommendation, so the heavy brain was never
         called + no ranked shortlist was ever produced. The explicit-closer
         override (checked BEFORE FACT_FIND_TRIGGERS) lifts them into the
         recommendation lane unambiguously.
+
+        KI-109 (2026-05-15) — live re-smoke caught
+        "Show me the top 3 policies you'd recommend" still misrouting to
+        fact_find_brain::fallback:no_trailer (the regex matched but the
+        downstream profile-empty branch trapped it). The fix broadens the
+        trigger set AND adds phrases that the KI-105 list missed entirely:
+        "what should I get", "best policies for me",
+        "which policies should I consider", and the "rank the top N" verb
+        (re-classified as recommendation — producing a ranked shortlist
+        with rationale, not a pairwise feature table).
         """
         recommendation_closers = [
             "show me the top 3 policies",
@@ -83,6 +93,13 @@ class TestIntentClassification(unittest.TestCase):
             "what would you recommend",
             "your top picks",
             "pitch me the top 3",
+            # KI-109 additions — phrases that misrouted on live re-smoke.
+            "Show me the top 3 policies you'd recommend",
+            "rank the top 3",
+            "rank them",
+            "what should I get",
+            "best policies for me",
+            "which policies should I consider",
         ]
         for q in recommendation_closers:
             with self.subTest(question=q):
@@ -90,22 +107,25 @@ class TestIntentClassification(unittest.TestCase):
                     classify_intent(q),
                     "recommendation",
                     f"REGRESSION: {q!r} should classify as recommendation. "
-                    f"See KI-105 — without this the bot doesn't produce a "
-                    f"ranked shortlist on the closer turn.",
+                    f"See KI-105 / KI-109 — without this the bot doesn't "
+                    f"produce a ranked shortlist on the closer turn.",
                 )
 
     def test_ki105_closer_phrases_classify_as_comparison(self) -> None:
         """KI-105 — comparison-shaped closer phrases.
 
-        'compare HDFC Ergo and Niva Bupa' and 'rank top 3' both explicitly
-        ask for a side-by-side / ranked output across the candidate set.
-        They must NOT fall through to qa or fact_find.
+        'compare HDFC Ergo and Niva Bupa' and 'compare top 3' both
+        explicitly ask for a side-by-side comparison across the candidate
+        set. They must NOT fall through to qa or fact_find.
+
+        KI-109 (2026-05-15) — 'rank' verbs were moved to recommendation
+        (they ask for a ranked shortlist, not pairwise comparison). Only
+        explicit `compare` / `side-by-side` phrasing remains here.
         """
         comparison_closers = [
             "compare HDFC Ergo and Niva Bupa",
             "compare top 3",
             "compare the top 3 policies",
-            "rank top 3 for me",
             "side-by-side these policies",
         ]
         for q in comparison_closers: