The message normalizer already appends the response JSON schema when it is
forwarded via prompt metadata, so the hand-written schema block in the
Crescendo system prompts duplicated that instruction.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Routes Crescendo and TAP adversarial sends through a real PromptNormalizer and
a MockPromptTarget (which lacks native JSON_SCHEMA support) to verify the shared
adversarial_chat schema is forwarded via prompt metadata and rendered into the
prompt the adversarial chat receives.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

 into rlundeen2/unify-red-team-attack-schema

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…eam-attack-schema

# Conflicts:
#	pyrit/datasets/executors/crescendo/crescendo_variant_1.yaml
#	pyrit/datasets/executors/crescendo/escalation_crisis.yaml
#	pyrit/datasets/executors/crescendo/therapist.yaml
#	pyrit/datasets/executors/pair/attacker_system_prompt.yaml
#	pyrit/datasets/executors/tree_of_attacks/adversarial_system_prompt.yaml
#	pyrit/datasets/executors/tree_of_attacks/image_generation.yaml

Move the blocked/error/empty/score-feedback control flow out of the
per-turn Jinja template into a testable Python helper and render the
template strictly. Detect blocked/errored pieces across all message
pieces instead of only the first, fixing a bug where a blocked/errored
later piece was masked by an earlier clean one.

- adversarial_conversation_manager.py: replace the _MessageView /
  _MessageBucket template shim with _build_adversarial_feedback_text
  (+ _joined_text_value / _first_response_error); render via
  render_template_value (strict) exposing feedback_text + objective.
- attack_config.py: simplify DEFAULT_ADVERSARIAL_PROMPT_TEMPLATE to
  "{{ feedback_text }}".
- tests: relocate the template-branch coverage to
  TestBuildAdversarialFeedbackText (adding any-piece blocked/error
  cases) and update prompt assertions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… lifecycle

Address review findings microsoft#4-microsoft#6 on the adversarial conversation manager:

- microsoft#6 Schema-driven parsing (single source of truth): `_parse_adversarial_reply`
  derives its required/permitted keys from the resolved response schema (`required`,
  `properties`, `additionalProperties`) -- the same schema the manager forwards to
  constrain the target -- instead of a hard-coded copy of the adversarial_chat keys,
  so the parser cannot silently drift from adversarial_chat.yaml. Behavior is identical
  for the shared adversarial_chat schema; `next_message` is always required since the
  attack loop consumes it (enforced at parse time and, for the property, at construction).
- microsoft#5 Naming: rename the manager's `adversarial_first_prompt_template` param/attr/
  property to `first_message`, matching `AttackAdversarialConfig.first_message`.
- microsoft#4 Lifecycle: build the AdversarialConversationManager once per execution in
  RedTeamingAttack (`_build_adversarial_manager`, constructed before the turn loop
  and threaded into `_generate_next_prompt_async`) instead of rebuilding each turn.
- Drop the never-read `_adversarial_response_json_schema` field (keep the
  construction-time "declared on both" validation) and the dead `_DEFAULT_SEED_PROMPT`
  constant; refresh the stale `adversarial_prompt_template` comment.
- Thread the resolved schema through the simulated_conversation parse call.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Crescendo and TAP/PAIR each hand-rolled their own parser for the same adversarial_chat JSON schema. They now delegate to the shared _parse_adversarial_reply used by Red Teaming and Simulated Conversation, so validation and normalization stay consistent across every adversarial-chat executor.

This fixes TAP/PAIR's missing camelCase normalization (the exact gap that once broke a Crescendo CI run) and makes them enforce the schema's required keys and additionalProperties instead of only checking next_message. The schema argument is optional, so schemaless custom adversarial prompts keep the permissive next_message-only contract.

Also expands coverage: direct TAP node parser tests (camelCase accepted, strict-schema rejection of missing/extra keys, markdown stripping, schemaless-stays-lax), a manager next_message coercion test, a Red Teaming build-once test, and a Simulated Conversation invalid-JSON test. Removes the now-obsolete Crescendo _camel_to_snake test.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

rlundeen2's WIP renamed AttackAdversarialConfig.seed_prompt to first_message (field + factory internals) but left four tests in test_attack_technique_factory.py asserting the old field, causing AttributeError/TypeError. Update those tests to the new field name; the factory source was already migrated.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…describe them

When seed/reference images are provided, the crescendo, red_teaming, and tree_of_attacks image_generation adversarial system prompts now instruct the adversarial model to refer to those images by position and issue an edit/compose instruction, rather than describing their contents. Describing the contents made image-editing targets regenerate from scratch and drop the seeded subject's identity. The seed guidance is conditional, so the no-seed generation path is unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Brings in 7 upstream commits (scenario DEFAULT strategy curation, dataset parameters on dataset configuration, initializer fixes, Azure SQL memory test fix, schema migration guard).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Both attacks now build their bespoke adversarial prompt text and hand it to the shared _AdversarialConversationManager, which owns schema resolution, send/parse/json-retry, the caller-seed bypass (always duplicated with fresh ids), placeholder filling, media forwarding, and objective-message construction.

Manager gains two capabilities the attacks need: set_adversarial_system_prompt now accepts **extra_render_values so attacks inject bespoke system-prompt inputs (Crescendo's conversation_context, TAP's desired_prefix/conversation_context) without rendering the prompt themselves; and a new generate_adversarial_reply_async send/parse entry point returns the parsed AdversarialReply without building an objective message, for TAP which scores next_message and may re-prompt before deciding what to send.

Removes Crescendo's _get_attack_prompt_async/_send_prompt_to_adversarial_chat_async/_parse_adversarial_response and TAP's _parse_red_teaming_response plus the per-node inline send/parse, eliminating three hand-rolled adversarial parsers so every adversarial reply is validated against the canonical adversarial_chat schema (camelCase-normalized, markdown-stripped, required-keys enforced). Adds regression tests covering the schema-everywhere contract and the new manager entry point.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Crescendo's _send_prompt_to_adversarial_chat_async and TAP's inline send were replaced by the shared manager, which parses every adversarial reply against the adversarial_chat schema. Drive Crescendo's assertion through _build_adversarial_manager(...).generate_adversarial_reply_async and back both attacks with a JSON-returning mock target so the real send/parse cycle completes while still asserting the schema reaches the adversarial target.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Drives RedTeaming, Crescendo, and TAP end-to-end with a schema-aware adversarial reply that emits camelCase keys (nextMessage/lastResponseSummary) and asserts the normalized next_message reaches the objective target. This is the exact reply shape that once broke a Crescendo CI run under a hand-rolled parser; asserting it across every consuming executor guards against any of them regressing away from the shared schema-aware parser.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove the is_adversarial_placeholder branch from the TreeOfAttacks node's
seed-handling path so the node no longer decides between bypass and
placeholder-fill itself. The seed message is handed to the manager's
get_next_message_async, which owns that decision, forwards seed media, and
fills placeholder slots. Drop the now-dead seed_message threading through the
red-teaming prompt helpers and split a merge-artifact test that had two bodies
concatenated. Add a bypass (no-placeholder) node test.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…anager

Route the simulated-conversation final user message through the shared
_AdversarialConversationManager so schema resolution, system-prompt setting,
the adversarial send, JSON parsing, and pyrit_json_retry all live in one place.

- direct_next_message.yaml now declares response_json_schema_name: adversarial_chat
  and emits the matched JSON Response Format (schema + prompt are a pair), dropping
  the old raw-text output path.
- _generate_next_message_async delegates to the manager instead of calling
  set_system_prompt / send_prompt_async directly and branching on whether a schema
  was declared. It takes a prompt_normalizer the manager sends through.
- Tests exercise the manager path: JSON reply is parsed, a malformed reply is
  retried then raises InvalidJsonException (regression guard for the removed
  raw-text swallow), and a missing response raises a clear ValueError.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The AdversarialConversationManager now owns the full adversarial contract: a new resolve_config classmethod resolves the system prompt, coerces the first/next-message templates (applying canonical defaults in template mode), and fails fast on a duplicate response-schema declaration. Red Teaming (template mode), Crescendo, and TAP (override mode) call it once at construction and store the resolved bundle instead of coercing prompts themselves.

Removes the per-attack _set_adversarial_chat_first_message / _set_adversarial_prompt_template / _set_adversarial_chat_system_prompt_template helpers and prunes the now-unused imports, and adds resolve_config unit tests covering both modes, defaults, system-prompt resolution, schema-conflict fail-fast, and invalid-type handling.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… TAP

RedTeaming already asserts that objective-response media is forwarded to a
capable adversarial chat (and dropped for a text-only adversarial chat), but
Crescendo and TAP thread last_response media through the same
_send_and_parse_async path without asserting it. Add matching
TestModalityRouterIntegration cases so all three manager-based attacks cover
the adversarial-input direction identically.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>