@sema-agent/core 5.45.0 → 5.46.0

package/dist/core/runner/runtask.js

@@ -1,5 +1,6 @@
 import { persistedReadDenyEntryProblem } from "../../tools/fs/read-deny.js";
 import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
+import { mintSystemReminder, openSystemReminder } from "../reminder-mint.js";
 import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNotices } from "../types.js";
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
@@ -122,12 +123,12 @@ const SNAPSHOT_TIMEOUT_MS = 30_000;
 const SNAPSHOT_TOO_LARGE_TTL_MS = 30 * 60_000;
 const LIMIT_APPROACH_DEFAULT_THRESHOLDS = [0.8, 0.95];
 const DEFAULT_PRECALL_OUTPUT_TOKENS = 4096;
-function limitApproachFrames(index, axis, percent) {
+function limitApproachFrames(index, axis, percent, mark) {
     return index === 0
-        ? `<system-reminder>[limit approach] This task has used about ${percent}% of its ${axis}. ` +
+        ? `${openSystemReminder(mark)}[limit approach] This task has used about ${percent}% of its ${axis}. ` +
             `Start converging: finish the step you are on, drop work that is not required for the deliverable, and ` +
             `avoid starting anything you cannot complete within what is left.</system-reminder>`
-        : `<system-reminder>[limit approach] About ${percent}% of the ${axis} is gone. Deliver now: ` +
+        : `${openSystemReminder(mark)}[limit approach] About ${percent}% of the ${axis} is gone. Deliver now: ` +
             `stop exploring, write up what you have — including what is incomplete and what you would do next — ` +
             `and end the task. Work that is not reported before the allowance runs out is lost.</system-reminder>`;
 }
@@ -244,16 +245,16 @@ function assertOutcomeText(value, field) {
         throw new CheckpointError("checkpoint.invalid_outcome", `resume \`${field}\` is not a plain string (got ${typeof value}) — a decide's text payload is an operator's plain data, not a live object; refusing pre-CAS, the checkpoint stays pending`);
     }
 }
-function resumeContinuation(resume) {
+function resumeContinuation(resume, mark) {
     if (resume.outcome.gate === "wake") {
         return formatHookFeedback("You were WOKEN from a parked pause by an operator. Before continuing, re-orient from the workspace: " +
             "run `git status` and review your recent changes / last commits to confirm what is already done, then " +
-            "continue the remaining work. Do NOT restart the task or re-run work that is already committed.");
+            "continue the remaining work. Do NOT restart the task or re-run work that is already committed.", mark);
     }
     if (resume.outcome.gate === "resource_limit") {
         return formatHookFeedback("You were resumed after a pause. Before continuing, re-orient from the workspace: run `git status` and " +
             "review your recent changes / last commits to confirm what is already done, then continue the " +
-            "remaining work. Do NOT restart the task or re-run work that is already committed.");
+            "remaining work. Do NOT restart the task or re-run work that is already committed.", mark);
     }
     if (resume.outcome.gate === "dry_run_review") {
         const verdict = resume.outcome.decision === "approve"
@@ -261,31 +262,31 @@ function resumeContinuation(resume) {
             : `Your predicted change was REVIEWED and REJECTED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}; it was NOT applied`;
         return formatHookFeedback(`You were resumed after a dry-run review. ${verdict}. Before continuing, re-orient from the workspace ` +
             "(run `git status` and review your recent changes) to confirm the current state, then continue the " +
-            "remaining work. Do NOT restart the task or re-run work that is already done.");
+            "remaining work. Do NOT restart the task or re-run work that is already done.", mark);
     }
     if (resume.outcome.gate === "plan_review") {
         if (resume.outcome.decision === "approve") {
             return formatHookFeedback("Your proposed PLAN was REVIEWED and APPROVED. Proceed with that plan now — begin executing it. " +
-                "This is a RESUMED task; do NOT re-plan or restart from scratch, just carry out the approved plan.");
+                "This is a RESUMED task; do NOT re-plan or restart from scratch, just carry out the approved plan.", mark);
         }
         if (resume.outcome.decision === "edit") {
             if (!resume.outcome.editedPlan) {
                 return formatHookFeedback("Your proposed PLAN was REVIEWED and EDITED, but no revised plan text was supplied — proceed with your " +
-                    "ORIGINAL plan as-is, begin executing it now. This is a RESUMED task; do NOT re-plan or restart from scratch.");
+                    "ORIGINAL plan as-is, begin executing it now. This is a RESUMED task; do NOT re-plan or restart from scratch.", mark);
             }
             return formatHookFeedback("Your proposed PLAN was REVIEWED and EDITED by a human reviewer. Proceed with the REVISED plan below " +
                 "(it supersedes your earlier plan); begin executing it now. This is a RESUMED task; do NOT re-plan " +
                 "or restart from scratch, just carry out the revised plan.\n\nThe REVISED plan to follow is:\n" +
-                delimitUntrusted("revised plan", resume.outcome.editedPlan));
+                delimitUntrusted("revised plan", resume.outcome.editedPlan), mark);
         }
         const why = resume.outcome.reason ? ` Reviewer note: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : "";
         return formatHookFeedback(`Your proposed PLAN was REVIEWED and REJECTED; it was NOT executed.${why} Produce a NEW plan that ` +
             "addresses the concern, then continue. This is a RESUMED task — re-plan from the current state; do " +
-            "NOT execute the rejected plan.");
+            "NOT execute the rejected plan.", mark);
     }
     const { pendingAction } = resume.cp;
     if (pendingAction.kind !== "tool_approval") {
-        return formatHookFeedback("This is a RESUMED task — continue from where you left off without restarting or re-running prior work.");
+        return formatHookFeedback("This is a RESUMED task — continue from where you left off without restarting or re-running prior work.", mark);
     }
     const decided = resume.outcome.decision === "allow"
         ? "was APPROVED and has now been executed — its result is in the tool results above"
@@ -297,7 +298,7 @@ function resumeContinuation(resume) {
     return formatHookFeedback(`The pending tool call "${pendingAction.toolName}" ${decided}.${batchNote} ` +
         `This is a RESUMED task — every step before this point is already done and its results are in the ` +
         `conversation above. Do NOT restart the task or re-run any tool you already ran; continue from this ` +
-        `exact point, building on the existing results, and finish the remaining work.`);
+        `exact point, building on the existing results, and finish the remaining work.`, mark);
 }
 const ENV_DUE_GOVERNANCE_READ_BUDGET_MS = 5_000;
 const MAX_TIMER_DELAY_MS = 2_147_483_647;
@@ -514,7 +515,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             if (tightest !== undefined && tightest.ratio >= thresholds[index]) {
                 rs.counters.approachNoticesSent += 1;
                 const percent = Math.min(100, Math.round(tightest.ratio * 100));
-                const body = limitApproachFrames(index === 0 ? 0 : 1, tightest.axis, percent);
+                const body = limitApproachFrames(index === 0 ? 0 : 1, tightest.axis, percent, prepared.reminderMark);
                 void prepared.harness.steer(body, { engineMinted: true }).catch(() => undefined);
                 queue.push({ type: "steering_injected", source: "limit_approach", preview: body.slice(0, 220), ...ident() });
                 boundarySteered = true;
@@ -739,7 +740,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                 }
             }
             if (due.length > 0) {
-                attachmentsPayload = due.map((a) => `<system-reminder>\n${sanitizeUntrustedText(a.body)}\n</system-reminder>`).join("\n");
+                attachmentsPayload = due.map((a) => mintSystemReminder(sanitizeUntrustedText(a.body), prepared.reminderMark)).join("\n");
                 for (const a of due)
                     boundaryAttachmentBytes += Buffer.byteLength(a.body, "utf8");
                 rs.attach.attachmentsInjected += due.length;
@@ -766,7 +767,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                             const clipped = clipToBytes(body, budget) === body
                                 ? body
                                 : `${clipToBytes(body, budget - Buffer.byteLength(BATCH_TRUNCATION_MARKER, "utf8"))}${BATCH_TRUNCATION_MARKER}`;
-                            batchContextBlock = `<system-reminder>\n${clipped}\n</system-reminder>`;
+                            batchContextBlock = mintSystemReminder(clipped, prepared.reminderMark);
                         }
                     }
                 }
@@ -1000,8 +1001,8 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
     };
     return onTurnBoundary;
 }
-function wrapGitFrame(body) {
-    return `<system-reminder>\n${sanitizeUntrustedText(body)}\n</system-reminder>`;
+function wrapGitFrame(body, mark) {
+    return mintSystemReminder(sanitizeUntrustedText(body), mark);
 }
 async function resolveGitLegDelivery(prepared, cpMirror, report) {
     const ref = prepared.gitStatusRef;
@@ -1044,7 +1045,7 @@ async function resolveGitLegDelivery(prepared, cpMirror, report) {
     }
     if (prior !== undefined && !pending && prior.entryId !== undefined) {
         try {
-            const newest = newestEngineGitFrame(await prepared.session.getBranch());
+            const newest = newestEngineGitFrame(await prepared.session.getBranch(), prepared.reminderMark);
             if (newest === undefined || newest.entryId !== prior.entryId)
                 pending = true;
         }
@@ -1060,7 +1061,7 @@ async function resolveGitLegDelivery(prepared, cpMirror, report) {
         if (prior === undefined && !pending) {
             let mustDisown;
             try {
-                mustDisown = branchCarriesVisiblePositiveGitFrame(await prepared.session.getBranch());
+                mustDisown = branchCarriesVisiblePositiveGitFrame(await prepared.session.getBranch(), prepared.reminderMark);
             }
             catch (err) {
                 mustDisown = true;
@@ -1073,9 +1074,9 @@ async function resolveGitLegDelivery(prepared, cpMirror, report) {
         return frame.body;
     }
     if (!pending && prior !== undefined && prior.kind === frame.kind && prior.hash === frame.hash) {
-        ref.protectedText = wrapGitFrame(frame.body);
+        ref.protectedText = wrapGitFrame(frame.body, prepared.reminderMark);
         if (frame.kind === "full" && frame.shrunk !== undefined) {
-            ref.wrappedShrink = { find: ref.protectedText, replace: wrapGitFrame(frame.shrunk.body) };
+            ref.wrappedShrink = { find: ref.protectedText, replace: wrapGitFrame(frame.shrunk.body, prepared.reminderMark) };
         }
         return undefined;
     }
@@ -1759,9 +1760,9 @@ export class Runner {
                 const actorIn = options?.actor;
                 const actor = actorIn === undefined ? undefined : snapshotActorAssertion(actorIn);
                 const projected = projectHumanInput({ text, actor, source: "steer" });
-                const payload = trusted ? formatHookFeedback(projected) : projected;
-                const mintsAFrame = payload.trim().length !== 0;
-                const replay = { payload, trusted, ...(actor !== undefined ? { actor } : {}) };
+                let payload;
+                let mintsAFrame;
+                let replay;
                 const noteAccepted = (h) => {
                     if (!mintsAFrame)
                         return;
@@ -1790,6 +1791,9 @@ export class Runner {
                     const h = handle ?? (await orTimeout(ready));
                     if (!h)
                         throw steeringError("the task is not running");
+                    payload = trusted ? formatHookFeedback(projected, h.reminderMark) : projected;
+                    mintsAFrame = payload.trim().length !== 0;
+                    replay = { payload, trusted, ...(actor !== undefined ? { actor } : {}) };
                     if (typeof inputId === "string") {
                         const prior = acceptedSteerInputs.get(inputId);
                         if (prior !== undefined) {
@@ -2099,7 +2103,7 @@ export class Runner {
             }
         }
         const loopLatch = { ended: false };
-        onReady({ harness: prepared.harness, abortController: prepared.abortController, loop: loopLatch });
+        onReady({ harness: prepared.harness, abortController: prepared.abortController, loop: loopLatch, reminderMark: prepared.reminderMark });
         const stats = { turns: 0, tokens: 0, toolCalls: 0, promptTokens: 0, totalInputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, cacheWriteTokensLong: 0, outputTokens: 0, costMicroUsd: 0 };
         prepared.liveSpendRef.get = () => ({ costMicroUsd: stats.costMicroUsd, tokens: stats.tokens, turns: stats.turns, walltimeMs: Math.round(performance.now() - rs.telemetry.taskStartMonotonic) });
         if (resume &&
@@ -2313,12 +2317,12 @@ export class Runner {
                             return [];
                         const full = textOf(e.message);
                         if (m.engineMinted === true)
-                            return [stripGitStatusUnits(full)];
+                            return [stripGitStatusUnits(full, prepared.reminderMark)];
                         if (Array.isArray(m.engineSegments) && m.engineSegments.length > 0) {
-                            return m.engineSegments.map((s) => stripGitStatusUnits(full.slice(Math.max(0, s.start), Math.max(0, s.end))));
+                            return m.engineSegments.map((s) => stripGitStatusUnits(full.slice(Math.max(0, s.start), Math.max(0, s.end)), prepared.reminderMark));
                         }
                         if (typeof m.enginePrefixChars === "number" && m.enginePrefixChars > 0)
-                            return [stripGitStatusUnits(full.slice(0, m.enginePrefixChars))];
+                            return [stripGitStatusUnits(full.slice(0, m.enginePrefixChars), prepared.reminderMark)];
                         return [];
                     });
                 }
@@ -2407,7 +2411,8 @@ export class Runner {
                         const text = typeof m.content === "string"
                             ? m.content
                             : m.content.map((b) => (b !== null && typeof b === "object" && b.type === "text" ? String(b.text ?? "") : "")).join("\n");
-                        if (text.includes("<system-reminder>[final verification]") && rs.counters.finalVerifyInjections < 2)
+                        const fvMarked = m.engineMinted === true && text.includes(`<system-reminder mark="${prepared.reminderMark}">[final verification]`);
+                        if ((fvMarked || text.includes("<system-reminder>[final verification]")) && rs.counters.finalVerifyInjections < 2)
                             rs.counters.finalVerifyInjections += 1;
                     }
                     else if (m.role === "toolResult" && !rs.counters.wroteThisRun && (prepared.toolEffects.get(m.toolName) ?? "write") !== "read") {
@@ -2687,7 +2692,8 @@ export class Runner {
                     finalVerifyBudgetFill() < 0.9) {
                     rs.counters.finalVerifyInjections += 1;
                     if (rs.counters.finalVerifyInjections === 2) {
-                        const reentryBody = "<system-reminder>[final verification] Your tool calls in this run worked with raw bytes, structural parsing, " +
+                        const reentryBody = openSystemReminder(prepared.reminderMark) +
+                            "[final verification] Your tool calls in this run worked with raw bytes, structural parsing, " +
                             "or checksum/digest computation — the deliverable very likely embeds verifiable structure (structural fields, an " +
                             "embedded checksum-family value, reference data it must match, or a replayable deterministic path). You MUST " +
                             "execute the grounding check that structure supports — recompute the embedded value and compare it against the " +
@@ -2706,7 +2712,8 @@ export class Runner {
                             },
                         ];
                     }
-                    const nudgeBody = "<system-reminder>[final verification] Before finishing: re-verify the FINAL deliverable through its REAL entry point, " +
+                    const nudgeBody = openSystemReminder(prepared.reminderMark) +
+                        "[final verification] Before finishing: re-verify the FINAL deliverable through its REAL entry point, " +
                         "exactly as the acceptance criteria would exercise it — execute the binary/function/endpoint directly and read the ACTUAL " +
                         "output and exit code. Do NOT rely on earlier self-tests, shell redirections, or assumptions (a program that prints to " +
                         "stdout is not a program that writes the required file). If anything mismatches the task's requirements, fix it before " +
@@ -2770,7 +2777,7 @@ export class Runner {
                     messages.push({
                         role: "user",
                         engineMinted: true,
-                        content: formatHookFeedback(`Stop hook additional context: ${result.additionalContext}`),
+                        content: formatHookFeedback(`Stop hook additional context: ${result.additionalContext}`, prepared.reminderMark),
                         timestamp: Date.now(),
                     });
                 }
@@ -2790,7 +2797,7 @@ export class Runner {
                     messages.push({
                         role: "user",
                         engineMinted: true,
-                        content: formatHookFeedback(`Stop hook stopped continuation: ${result.block}`),
+                        content: formatHookFeedback(`Stop hook stopped continuation: ${result.block}`, prepared.reminderMark),
                         timestamp: Date.now(),
                     });
                 }
@@ -2912,7 +2919,7 @@ export class Runner {
             const use = ref.overBudgetShrunk && frame.shrunk !== undefined
                 ? { kind: "degraded", body: frame.shrunk.body, hash: frame.shrunk.hash }
                 : { kind: frame.kind, body: frame.body, hash: frame.hash };
-            const wrapped = wrapGitFrame(use.body);
+            const wrapped = wrapGitFrame(use.body, prepared.reminderMark);
             try {
                 const entryId = await prepared.session.appendMessage({
                     role: "user",
@@ -2923,7 +2930,7 @@ export class Runner {
                 ref.announced = { kind: use.kind, hash: use.hash, entryId };
                 ref.protectedText = wrapped;
                 if (use.kind === "full" && frame.shrunk !== undefined) {
-                    ref.wrappedShrink = { find: wrapped, replace: wrapGitFrame(frame.shrunk.body) };
+                    ref.wrappedShrink = { find: wrapped, replace: wrapGitFrame(frame.shrunk.body, prepared.reminderMark) };
                 }
                 else {
                     delete ref.wrappedShrink;
@@ -3045,13 +3052,13 @@ export class Runner {
                     rs.limits.budgetAxis = "cost";
                 }
                 else {
-                    let continuation = resumeContinuation(resume);
+                    let continuation = resumeContinuation(resume, prepared.reminderMark);
                     const bgSnapshot = resume.cp.state.runningBackgroundTasks;
                     if (bgSnapshot !== undefined && bgSnapshot.length > 0) {
                         const alive = new Set(prepared.listBackgroundTasks().map((t) => t.id));
                         const orphans = bgSnapshot.filter((t) => !alive.has(t.id));
                         if (orphans.length > 0) {
-                            continuation += "\n\n" + formatHookFeedback(renderOrphanedBackgroundTasks(orphans));
+                            continuation += "\n\n" + formatHookFeedback(renderOrphanedBackgroundTasks(orphans), prepared.reminderMark);
                         }
                     }
                     let gitResumeDelivered;
@@ -3065,11 +3072,11 @@ export class Runner {
                         });
                         const gitFrame = prepared.gitStatusRef.frame;
                         if (gitBody !== undefined && gitFrame !== undefined) {
-                            const wrappedGit = wrapGitFrame(gitBody);
+                            const wrappedGit = wrapGitFrame(gitBody, prepared.reminderMark);
                             continuation += "\n\n" + wrappedGit;
                             gitResumeDelivered = { kind: gitFrame.kind, hash: gitFrame.hash, wrapped: wrappedGit };
                             if (gitFrame.kind === "full" && gitFrame.shrunk !== undefined) {
-                                prepared.gitStatusRef.wrappedShrink = { find: wrappedGit, replace: wrapGitFrame(gitFrame.shrunk.body) };
+                                prepared.gitStatusRef.wrappedShrink = { find: wrappedGit, replace: wrapGitFrame(gitFrame.shrunk.body, prepared.reminderMark) };
                             }
                         }
                     }
@@ -3083,7 +3090,7 @@ export class Runner {
                         const projected = projectHumanInput({ text: steer.text, actor: steer.actor, source });
                         continuation +=
                             "\n\n" +
-                                (steer.trusted ? formatHookFeedback(projected) : delimitUntrusted("supervisor steering message", projected));
+                                (steer.trusted ? formatHookFeedback(projected, prepared.reminderMark) : delimitUntrusted("supervisor steering message", projected));
                         if (steer.trusted)
                             engineSegments.push({ start, end: continuation.length });
                         queue.push({
@@ -3131,11 +3138,11 @@ export class Runner {
                     try {
                         const decision = await userPromptSubmit(spec.objective, { identity: prepared.hookIdentity });
                         if (decision?.block) {
-                            prepared.blockedRef.reason = formatHookFeedback(decision.block);
+                            prepared.blockedRef.reason = formatHookFeedback(decision.block, prepared.reminderMark);
                             promptBlocked = true;
                         }
                         else if (decision?.additionalContext) {
-                            effectiveObjective = `${formatHookFeedback(decision.additionalContext)}\n\n${projectedObjective}`;
+                            effectiveObjective = `${formatHookFeedback(decision.additionalContext, prepared.reminderMark)}\n\n${projectedObjective}`;
                         }
                     }
                     catch (hookErr) {
@@ -3146,7 +3153,7 @@ export class Runner {
                         catch {
                         }
                         prepared.blockedRef.reason = formatHookFeedback(`the deployment's userPromptSubmit hook crashed while screening this prompt (${err.message}); ` +
-                            `the prompt was NOT submitted (fail-closed)`);
+                            `the prompt was NOT submitted (fail-closed)`, prepared.reminderMark);
                         promptBlocked = true;
                     }
                 }
@@ -3161,13 +3168,13 @@ export class Runner {
                     });
                     const gitFrame = prepared.gitStatusRef.frame;
                     if (gitBody !== undefined && gitFrame !== undefined) {
-                        const wrappedGit = wrapGitFrame(gitBody);
+                        const wrappedGit = wrapGitFrame(gitBody, prepared.reminderMark);
                         const standalone = spec.images !== undefined && spec.images.length > 0;
                         if (!standalone)
                             effectiveObjective = `${wrappedGit}\n${effectiveObjective}`;
                         gitLegDelivered = { kind: gitFrame.kind, hash: gitFrame.hash, standalone, wrapped: wrappedGit };
                         if (gitFrame.kind === "full" && gitFrame.shrunk !== undefined) {
-                            prepared.gitStatusRef.wrappedShrink = { find: wrappedGit, replace: wrapGitFrame(gitFrame.shrunk.body) };
+                            prepared.gitStatusRef.wrappedShrink = { find: wrappedGit, replace: wrapGitFrame(gitFrame.shrunk.body, prepared.reminderMark) };
                         }
                     }
                 }
@@ -3205,7 +3212,7 @@ export class Runner {
                         }
                     }
                     if (firstFrames.length > 0) {
-                        effectiveObjective = `${firstFrames.map((f) => `<system-reminder>\n${sanitizeUntrustedText(f.body)}\n</system-reminder>`).join("\n")}\n${effectiveObjective}`;
+                        effectiveObjective = `${firstFrames.map((f) => mintSystemReminder(sanitizeUntrustedText(f.body), prepared.reminderMark)).join("\n")}\n${effectiveObjective}`;
                     }
                 }
                 const gitQueuedChars = gitLegDelivered !== undefined && gitLegDelivered.standalone ? gitLegDelivered.wrapped.length : 0;
@@ -4385,8 +4392,8 @@ export class Runner {
                     return l !== undefined && l !== name ? { label: l } : {};
                 })();
                 emit({ type: "tool_start", toolCallId: id, toolName: name, ...displayLabel, args: deferredArgs.get(id) ?? {} });
-                emit({ type: "tool_end", toolCallId: id, toolName: name, ...displayLabel, isError: true, ...toolEndBodyFrom({ content: formatHookFeedback(DEFERRED_REISSUE) }, true) });
-                const eid = await prepared.session.appendMessage(toolResultMsg(id, name, formatHookFeedback(DEFERRED_REISSUE), true));
+                emit({ type: "tool_end", toolCallId: id, toolName: name, ...displayLabel, isError: true, ...toolEndBodyFrom({ content: formatHookFeedback(DEFERRED_REISSUE, prepared.reminderMark) }, true) });
+                const eid = await prepared.session.appendMessage(toolResultMsg(id, name, formatHookFeedback(DEFERRED_REISSUE, prepared.reminderMark), true));
                 emitCommitted(eid, "toolResult", id);
             }
         }
@@ -4407,8 +4414,8 @@ export class Runner {
                     ? `The approval for the pending tool call "${pendingAction.toolName}" ended without anyone deciding it (it was cancelled or could not be delivered), so it was not executed.`
                     : `The pending tool call "${pendingAction.toolName}" was denied by an approver.`;
             const reason = outcome.reason ? delimitUntrusted("reviewer note", outcome.reason, REVIEWER_NOTE_MAX_BODY) : defaultDenial;
-            emitEnd(true, { content: formatHookFeedback(reason) });
-            const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(reason), true));
+            emitEnd(true, { content: formatHookFeedback(reason, prepared.reminderMark) });
+            const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(reason, prepared.reminderMark), true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
             return;
         }
@@ -4431,7 +4438,7 @@ export class Runner {
             const beltUnsafe = rechecked.action === "deny" ||
                 (rechecked.updatedInput !== undefined && !deepJsonEqual(rechecked.updatedInput, resolvedArgs));
             if (beltUnsafe) {
-                const editedDenial = formatHookFeedback(`The approver EDITED this call's input; the edited call is refused by the deployment's tool policy and was not executed${rechecked.action === "deny" && rechecked.message ? `: ${rechecked.message}` : " (the policy rewrote the edit to a value that was not approved)"}.`);
+                const editedDenial = formatHookFeedback(`The approver EDITED this call's input; the edited call is refused by the deployment's tool policy and was not executed${rechecked.action === "deny" && rechecked.message ? `: ${rechecked.message}` : " (the policy rewrote the edit to a value that was not approved)"}.`, prepared.reminderMark);
                 emitEnd(true, { content: editedDenial });
                 const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, editedDenial, true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);
@@ -4441,7 +4448,7 @@ export class Runner {
         const gateRealApproval = resume.cp.gate.kind === "irreversible_ask" ? resume.cp.gate.realApproval : undefined;
         const gateOrgGoverned = gateRealApproval?.origin === "org_rule" || gateRealApproval?.origin === "org_unavailable";
         if (gateOrgGoverned && prepared.permissionRuleOrg === undefined) {
-            const unwiredDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: its approval was minted under organization governance (${gateRealApproval.origin}), and this worker has no org adjudication wiring — a governed approval may only be redeemed where governance can be enforced. This approval is spent; re-issue the call on an org-wired worker.`);
+            const unwiredDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: its approval was minted under organization governance (${gateRealApproval.origin}), and this worker has no org adjudication wiring — a governed approval may only be redeemed where governance can be enforced. This approval is spent; re-issue the call on an org-wired worker.`, prepared.reminderMark);
             emitEnd(true, { content: unwiredDenial });
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, unwiredDenial, true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
@@ -4472,7 +4479,7 @@ export class Runner {
                 const orgDisclosures = org.status === "unavailable" && org.disclosures.length > 0
                     ? ` Governance disclosures: ${inlineUntrusted(org.disclosures.join("; "), ORG_DISCLOSURE_MAX_CHARS)}.`
                     : "";
-                const orgDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${blocked}.${orgDisclosures} This approval is spent — the call has to be re-issued and approved again once organization policy permits it.`);
+                const orgDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${blocked}.${orgDisclosures} This approval is spent — the call has to be re-issued and approved again once organization policy permits it.`, prepared.reminderMark);
                 emitEnd(true, { content: orgDenial });
                 const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, orgDenial, true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);
@@ -4488,7 +4495,7 @@ export class Runner {
                 ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
             }, prepared.abortController.signal));
             if (narrowed.action === "deny") {
-                const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`);
+                const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`, prepared.reminderMark);
                 emitEnd(true, { content: narrowedDenial });
                 const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, narrowedDenial, true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);

package/dist/core/side-query.d.ts

@@ -1,5 +1,5 @@
 import type { AssistantMessage, StopReason, Tool, ToolResultMessage, Usage, UserMessage } from "../internal/llm.js";
-import type { Brain, Model, ModelRef, ModelRole, ModelRoles, ThinkingLevel } from "./types.js";
+import type { Brain, Model, ModelRef, ModelRole, ModelRoles, TaskSpec, ThinkingLevel } from "./types.js";
 import { type DegradationInfo } from "../brain/degrading.js";
 /** A tool DEFINITION exposed to the model in a side query (never executed by the engine). */
 export interface SideQueryToolDef {
@@ -54,6 +54,16 @@ export interface SideQuerySpec {
     tools?: SideQueryToolDef[];
     /** Per-request output cap (provider max_tokens). */
     maxOutputTokens?: number;
+    /**
+     * Per-model auth — MIRRORS {@link TaskSpec.getApiKeyAndHeaders} (same signature, resolved per
+     * call against the RESOLVED model, exactly like the task path's per-call hook). The brain
+     * contract is `options.apiKey ?? config.apiKey`, and a model's own `baseUrl` outranks the
+     * brain's — so before this seat existed, a side query routed to a model carrying its own
+     * `baseUrl` + per-model key fell back to the brain's construction-time credential and sent the
+     * GATEWAY key to the per-model (possibly external) URL: a credential leak the task path already
+     * prevents. Absent ⇒ construction-time credentials apply, options byte-identical to before.
+     */
+    getApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
     signal?: AbortSignal;
 }
 export interface SideQueryResult {

package/dist/core/side-query.js

@@ -44,10 +44,13 @@ export async function runSideQuery(spec, deps) {
             : {}),
     };
     const thinking = resolved.thinking ?? resolved.model.defaultThinking;
+    const auth = await spec.getApiKeyAndHeaders?.(resolved.model);
     const options = {
         ...(spec.signal !== undefined ? { signal: spec.signal } : {}),
         ...(spec.maxOutputTokens !== undefined ? { maxTokens: spec.maxOutputTokens } : {}),
         ...(thinking !== undefined ? { reasoning: thinking } : {}),
+        ...(auth?.apiKey !== undefined ? { apiKey: auth.apiKey } : {}),
+        ...(auth?.headers !== undefined ? { headers: auth.headers } : {}),
     };
     const stream = await Promise.resolve(deps.brain.stream(resolved.model, context, options));
     const msg = (await stream.result());

package/dist/core/types.d.ts

@@ -311,8 +311,11 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * behavior reads it, and on a task without an engine-memory session it is fully inert:
      *  - `"external"` — the tool takes content from outside the deployment's trust boundary (network
      *    fetch/search families, external protocol channels). Invoking it marks the session's memory
-     *    POLLUTED (one-way, durable): the session's harvest quarantines instead of committing, so
-     *    third-party text cannot ride the automatic path into long-term memory.
+     *    EXTERNALLY EXPOSED (one-way, durable). What the mark does at harvest is the deployment's
+     *    {@link RunnerDeps.memoryProvenance} mode's question (design/336): under `"carry"` (default)
+     *    ordinary entries commit WITH an engine-minted `origin` marker and instruction-form files are
+     *    withheld; under `"off"` the harvest quarantines instead of committing — either way,
+     *    third-party text never rides the automatic path into long-term memory UNMARKED.
      *  - `"execution"` — general execution (shell/exec families). NOT polluting by default — an
      *    execution tool CAN reach external content indirectly, but excluding every shell session from
      *    memory would disable memory for the main coding scenario; the write-side scans/fences remain
@@ -631,6 +634,15 @@ export interface ToolExecuteContext {
      * the tool runs outside a Runner task.
      */
     parentCwd?: string;
+    /**
+     * design/319 (A ticket) — the RUNNING task's reminder provenance mark, Runner-filled, read-only,
+     * NEVER a model/tool argument. The Agent tool's FORK route threads it into the forked child's
+     * trusted internals (`RunInternals.reminderMark` — the fork runs under the parent's byte-identical
+     * system-prompt declaration, so its engine mints must carry the PARENT's mark); spawn routes
+     * deliberately do NOT copy it (a spawned context mints its own — "one declaration, one mark").
+     * Undefined when the tool runs outside a Runner task.
+     */
+    reminderMark?: string;
     /**
      * Report usage spent in a nested run this tool spawned (e.g. a sub-agent). The Runner accumulates
      * it into the parent task's `TaskResult.stats.nested`, so delegated cost — the multi-agent "~15×"
@@ -666,7 +678,11 @@ export interface ToolExecuteContext {
      *
      * A delegation tool (`createSubagentTool`) forwards it into every child it spawns (sync / background /
      * fork), wrapped so the approver learns which delegation raised the ask ({@link
-     * import("./tool-policy.js").AskDelegationProvenance}). Without this seat, a deployment that wires its
+     * import("./tool-policy.js").AskDelegationProvenance}); the workflow lane forwards the SAME frozen
+     * value into every workflow-spawned agent (backlog #342: `RunWorkflowToolDeps.parentOnAsk`, folded
+     * onto the governed baseline's base slot with the same provenance wrapper — the auto-mounted tool's
+     * execute ctx is minimal, so the value rides a mount dep there; a deployment-pinned `base.onAsk`
+     * wins). Without this seat, a deployment that wires its
      * approver per TASK (one closure per attached connection — the common shape) had it reach the host run
      * only: the child's own asks resolved at `deps.onAsk`, i.e. the headless auto-deny, while a live
      * operator sat attached to the parent. The ancestor-constraint chain
@@ -4708,10 +4724,13 @@ export interface EngineNotice {
      *    `detail: { steer, taskId? }` / `{ followUp, taskId? }`. Per-run, at most once per family
      *    (the terminal sweep is a single site).
      *
-     *  - `"memory.session_polluted"` (design/178 §3, #324a) — this session's memory crossed into the
-     *    one-way POLLUTED state (a tool classified as an external content source was invoked, directly
-     *    or through a delegated child): its memory writes are no longer eligible for the long-term
-     *    library. The notice states that VERDICT plus what a harvest does when it collects — it does
+     *  - `"memory.session_polluted"` (design/178 §3, #324a; message mode-aware since design/336) —
+     *    this session's memory crossed into the one-way externally-exposed state (a tool classified
+     *    as an external content source was invoked, directly or through a delegated child). Under
+     *    `memoryProvenance: "carry"` (default) the message states the tag-admit semantics (ordinary
+     *    writes commit with an origin marker; instruction-form files are withheld); under `"off"` it
+     *    keeps the pre-336 sentence — writes no longer eligible for the long-term library. The
+     *    notice states that VERDICT plus what a harvest does when it collects — it does
      *    not promise quarantine, because a `writeScope`-null layering and a declared-unavailable
      *    session both reach the zero-admission harvest arm (nothing collected ⇒ nothing captured), and
      *    a mark landing after the pre-commit pollution read leaves already-committed rows to the
@@ -4929,6 +4948,27 @@ export interface RunnerDeps {
      * never truthiness).
      */
     memoryDelegationEvidence?: "static-face" | "attested-only";
+    /**
+     * design/336 §13-3 — the memory-provenance master switch (F-020 深修):
+     *  - `"carry"` (absent ≡ this; the default) — an externally exposed session's ORDINARY memory
+     *    writes are committed WITH an engine-minted `origin` marker that travels with the entry
+     *    (backend/sync/bundle); instruction-form files (type: feedback / pinned/triggers/applies-when
+     *    hints) from exposed sessions are withheld and quarantined; the derived index's session prose
+     *    still rolls back; the content scan gates run unchanged (a marker is not an exemption).
+     *  - `"off"` — the pre-336 behavior: no origin marker is minted and an exposed session's harvest
+     *    admits nothing (full containment, quarantined for host review). Standing committed markers
+     *    still carry forward on edits — "off" stops minting, it never strips facts already recorded.
+     * ORTHOGONAL to {@link memoryDelegationEvidence} on purpose: that key decides WHEN a delegation
+     * marks the session exposed (the evidence standard); this key decides WHAT the mark does to the
+     * session's writes (tag-admit vs containment). All four combinations are legal and pinned.
+     * DEPLOYMENT seat ONLY (same posture as {@link memoryDelegationEvidence}): no TaskSpec twin and
+     * not in the governed workflow whitelist — a task author or governed script gets no channel to
+     * change the provenance posture below its deployment; an org administers it through this seat.
+     * Not frozen into checkpoints: a resumed leg follows the CURRENT deployment configuration. Any
+     * other value refuses loudly at prepare (`config.memory_provenance`, #123 — exact spellings,
+     * never truthiness).
+     */
+    memoryProvenance?: "off" | "carry";
     /**
      * design/199 件A — the DEPLOYMENT's read-face declaration
      * ({@link import("../tools/fs/read-face.js").ReadFace}; see {@link TaskSpec.readFace} for the

package/dist/engine/harness/types.d.ts

@@ -498,6 +498,41 @@ export interface WorkspaceState {
 export interface WorkspaceStateEntry extends SessionTreeEntryBase, WorkspaceState {
     type: "workspace_state";
 }
+/** Bounded cap for {@link normalizeReminderMark}: the current scheme's value is 22 chars; the bound
+ *  is deliberately looser (an opaque bounded token) so the STORE never learns the scheme — the real
+ *  value-shape verify lives in the mint home (core/reminder-mint.ts `isValidReminderMark`), applied
+ *  by the consumer, which RE-MINTS on failure. Oversize/off-alphabet ⇒ structurally invalid
+ *  (forgery signal, same posture as the sibling caps). */
+export declare const REMINDER_MARK_MAX_CHARS = 64;
+/**
+ * design/319 (A ticket): the session's reminder provenance mark as a FIRST-CLASS typed entry —
+ * which mark value this session's engine-minted `<system-reminder>` open tags and system-prompt
+ * declaration carry ("one declaration, one mark"). Ordinary continuation turns (a new task on the
+ * same `spec.sessionId`) have NO checkpoint seed, so without this entry every leg would re-mint:
+ * the system prompt's declaration bytes would churn per leg (a cross-leg prefix-cache break) and
+ * every PRIOR leg's engine reminders — including standing frames the model consults later (the
+ * skills/agents listing, the git status frame) — would demote to data under the new declaration.
+ * Restore ladder (the design/150/155 rung doctrine): the checkpoint seed stays FIRST on a durable
+ * resume (cut atomically with the leaf); the trusted spawn channel (`RunInternals.reminderMark`,
+ * the fork lane) is SECOND; the branch-nearest entry of this type is THIRD (plain continuations —
+ * and fork children, whose forked session copies the parent's entry); a fresh mint last. SNAPSHOT
+ * semantics — nearest wins. A session store's fork copies committed history, so a fork inherits
+ * the parent's mark BY CONSTRUCTION through this entry (matching its byte-identical inherited
+ * prompt declaration).
+ */
+export interface ReminderMarkEntry extends SessionTreeEntryBase {
+    type: "reminder_mark";
+    /** The opaque mark token (bounded; scheme-verified by the consumer, never by the store). */
+    mark: string;
+}
+/**
+ * design/319: strict shape gate for the reminder-mark entry — the SINGLE normalization the read
+ * walk, the public append, and the import-validate door all use (the {@link normalizeAnnouncedListing}
+ * posture). SCHEME-AGNOSTIC on purpose: a bounded url-safe token, not the current 22-char shape —
+ * the store carries the value opaquely; the mint home's verify port decides adoption (and a value
+ * it does not recognize is re-minted, never trusted loosely).
+ */
+export declare function normalizeReminderMark(v: unknown): string | undefined;
 /** The closed kind set of a git-status announcement (the availability half of the `(kind, hash)`
  *  comparison tuple): `full` = five-segment snapshot frame; `degraded` = branch+dirty two-line frame
  *  (the snapshot round-trip failed while the basic probe succeeded); `unavailable` / `non-repo` =
@@ -591,7 +626,7 @@ export declare function normalizeAnnouncedListing(v: unknown): {
     models?: string[];
 } | undefined;
 /** All persisted session tree entry variants. */
-export type SessionTreeEntry = MessageEntry | ThinkingLevelChangeEntry | ModelChangeEntry | CompactionEntry | CustomEntry | CustomMessageEntry | LabelEntry | SessionInfoEntry | LeafEntry | PromptEpochEntry | AnnouncedListingEntry | GitAnnouncementEntry | WorkspaceStateEntry;
+export type SessionTreeEntry = MessageEntry | ThinkingLevelChangeEntry | ModelChangeEntry | CompactionEntry | CustomEntry | CustomMessageEntry | LabelEntry | SessionInfoEntry | LeafEntry | PromptEpochEntry | AnnouncedListingEntry | GitAnnouncementEntry | WorkspaceStateEntry | ReminderMarkEntry;
 export interface SessionContext {
     messages: AgentMessage[];
     thinkingLevel: string;
@@ -725,6 +760,16 @@ export interface Session<TMetadata extends SessionMetadata = SessionMetadata> {
     /** design/155: nearest workspace-state snapshot on the active branch (the continuation rung of the
      *  cwd/worktree restore ladder — the checkpoint seed stays first); undefined ⇒ no snapshot visible. */
     getWorkspaceState(): Promise<WorkspaceState | undefined>;
+    /** design/319: persist the session's reminder provenance mark as a first-class
+     *  {@link ReminderMarkEntry} (see `Session.appendReminderMark`). OPTIONAL on the interface — same
+     *  external-implementer posture as `getPromptEpoch`; consumers call it with `?.()` and an
+     *  implementer without it degrades to a per-leg re-mint under the strict declaration (fail-safe),
+     *  never a crash. */
+    appendReminderMark?(mark: string): Promise<string>;
+    /** design/319: nearest reminder-mark entry on the active branch (the continuation rung of the
+     *  mark restore ladder — the checkpoint seed stays first, the trusted fork channel second).
+     *  Undefined ⇒ no entry visible. OPTIONAL, same posture as `appendReminderMark`. */
+    getReminderMark?(): Promise<string | undefined>;
     /** The branch's current prompt-epoch descriptor (semantics: `Session.getPromptEpoch`). OPTIONAL on
      *  the interface (typecheck 车 2026-07-24): the built-in `Session` class always implements it;
      *  optionality keeps external `Session` implementers compatible. The consumer (`maybeCompact`'s