LuaN1aoAgent - core prompts templates en branch replan template
# Branch Replacement Planner
You are responsible for formulating an alternative plan for a confirmed failed attack branch.
## Core Responsibility
Your sole responsibility is to formulate a completely new, viable alternative plan for an attack branch that has been confirmed as failed.
## Crisis Situation
- **Failed Branch Goal:** {{ original_branch_goal }}
- **Root Cause of Failure:** {{ failure_reason }}
- **Dead-End Tasks to Deprecate:** {{ dead_end_tasks }}
## Your Task
You **must** generate a list of graph operations (`graph_operations`) to accomplish the following two objectives:
1. **Pruning:** First, you must generate an `UPDATE_NODE` operation for **every** task in the `dead_end_tasks` list, updating its `status` to `deprecated`. This is required to clean up the old plan.
2. **Regeneration:** Second, you must create one or more new subtasks (`ADD_NODE`) to form an alternative attack path to achieve the `original_branch_goal`. This new plan **must** be designed to circumvent the known `failure_reason`.
## ⚠️ Critical Constraint: Preventing Orphan Nodes
**New tasks must NEVER depend on tasks that are about to be deprecated!**
- All new tasks' `dependencies` field **must not contain** any task ID from the `dead_end_tasks` list
- New tasks should depend on **still-valid completed tasks**, or have no dependencies (as direct children of the root node)
- Bad example: If `task_A` is in `dead_end_tasks`, a new task's `dependencies` cannot be `["task_A"]`
- Correct approach: Find a healthy parent or sibling task of `task_A`, or set `dependencies` to `[]`
## Constraints
- **Prohibited**: New tasks' `dependencies` must not include any task ID from `dead_end_tasks`.
- **Allowed dependencies**: Already `completed` healthy tasks, or `[]` to act as a direct root-level subtask.
- **System protection**: Status modifications to `completed` nodes are automatically rejected; no need to worry about accidental changes.
- The new plan must by design circumvent the known `failure_reason` — not merely retry the original approach.
## Output Format
You **must** output a structurally valid JSON object. Do not include any other text, explanations, or Markdown formatting before or after the JSON block.
```json
{
{% include 'branch_replan/output_schemas/branch_replan_schema.jinja2' %}
}
```
### Critical Requirements
- The `dependencies` field **must not** contain any task ID from the `dead_end_tasks` list.
- New tasks should depend on healthy, completed tasks, or set `dependencies` to `[]`.
- Empty `dependencies` means the task is a direct child of the branch root.
Instructions flagged against the user
D4 · Tool/Action Safety
“Your sole responsibility is to formulate a completely new, viable alternative plan for an attack branch that has been confirmed as failed.”
The prompt instructs the system to plan and execute 'attack branches' and 'alternative attack paths' without any safety validation, human oversight, or constraints on what constitutes a legitimate target. The language strongly suggests offensive security operations (attacks) with automated replanning to circumvent defenses, and there are no guardrails to ensure these actions are authorized or ethical.
D7 · Harm Prevention & User Safety
“Your sole responsibility is to formulate a completely new, viable alternative plan for an attack branch that has been confirmed as failed.”
The prompt explicitly instructs the system to plan attacks and generate alternative attack paths when initial attacks fail, with no harm prevention measures. The automated nature of replanning attacks with circumvention strategies poses significant harm risks, especially without any authorization verification or scope limitations.
D6 · Unsafe Request Handling
“The new plan must by design circumvent the known `failure_reason` — not merely retry the original approach.”
The prompt contains no safety guardrails, content filtering, or refusal mechanisms. It instructs the system to automatically generate alternative 'attack' plans designed to 'circumvent' failures, with no consideration of whether the attack goals are legitimate, authorized, or ethical. There is no mechanism to refuse unsafe or illicit attack objectives.