[Manohar Paturi (ManoharPaturi)]

Description

Fixes #4003

CreateAttackRequest takes source_conversation_id and cutoff_index as two independent optional fields, and create_attack_async only copied history when both were set. A request carrying exactly one of the two fell through to the plain new conversation branch, so the attack was created with an empty conversation, the supplied field was silently dropped, and a client bug stayed invisible. The conversation endpoint on the same resource validates the same pair and rejects a half provided spec, so the two entry points disagreed on identical input.

The pair is now validated up front in create_attack_async with the same message the conversation path uses, and the create route maps that rejection to 400 like its sibling, while target lookups keep answering 404 as before.

Tests and Documentation

Added a service regression rejecting both half shapes and confirming the both and neither shapes still work, plus a route regression asserting the half pair answers 400 with the validation detail. Both fail without the change, and the pinned target-not-found 404 test still passes. The attack service suite passes at 201 tests and the create_attack route tests at 7, ruff clean.

No documentation change needed, so I did not run JupyText.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.