maf-sandbox-codeact 0.9.2__tar.gz → 0.11.0__tar.gz

{maf_sandbox_codeact-0.9.2 → maf_sandbox_codeact-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maf-sandbox-codeact
-Version: 0.9.2
+Version: 0.11.0
 Summary: CodeAct as a Microsoft Agent Framework tool — the model writes a short Python program and it runs inside a sandbox — written against maf-sandbox so it runs on any sandbox backend.
 Keywords: codeact,code-execution,sandbox,agent-framework,microsoft-agent-framework
 Author: SOKOLAI BV
@@ -15,7 +15,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Interpreters
-Requires-Dist: maf-sandbox>=0.27.0,<0.30
+Requires-Dist: maf-sandbox>=0.32.0,<0.33
 Requires-Dist: agent-framework-core>=1.13.0,<2
 Requires-Python: >=3.12, <3.15
 Project-URL: Homepage, https://www.sokol.ai
@@ -128,19 +128,21 @@ Naming a host is a real widening, and worth naming as such: this sandbox runs mo
 
 **The host authorises every way in, and initiates only one of them.** With `file_store` wired, caller-selected files are written in before the program runs — deliberately, and constrained to the caller's listing, so the model cannot widen the set. What that content *is* remains the host's to know: a file in the store may itself carry text from somewhere untrusted, and a program that parses it is running on input the sandbox did not vet. An allowlisted host is the other way, and the *program* initiates that one — whatever it fetches is input nobody chose in advance. Wire no store, no allowlist and no registry, and nothing gets in but the source the model wrote.
 
-**The tool declares no `source_integrity`.** The library's default is `"trusted"`, which is right for a workload whose result is a compiler's own diagnostics and wrong for this one: what comes back is whatever a model-written `print(...)` chose to emit. Undeclared, MAF's information-flow tracker applies its untrusted default and the result taints the conversation — the fail-safe direction, and the honest one.
+**The tool declares no `source_integrity`, in either rendering.** A `"trusted"` claim asks that the result not derive from input the framework has left unestablished, and this one does: what comes back is whatever a model-written `print(...)` chose to emit. Undeclared, MAF's information-flow tracker applies its untrusted default — the fail-safe direction, and the honest one. A declaration would not sit under that default as a floor, either: FIDES reads `source_integrity` as an override and drops the input-label join entirely.
 
-**`withhold_guest_output=True` changes that, by changing what comes back.** The result is then the exit code, the size of each stream, which of the declared outputs landed — by the name the model itself declared — and one sentence naming the route. No guest-authored *text* survives into it, so the tool declares `source_integrity="trusted"` and a host doing information-flow control gets a result it can label without either lying about it or tainting the conversation. Content still reaches the model by the road the option leaves open: the program writes it to a declared output, that lands in the sink, and the host's own already-classified file-reading path serves it back.
+**What the untrusted default costs is the model's sight of the result, not the host's sinks.** FIDES hides an untrusted result by default: the item is replaced by a variable reference the model can pass to another tool without reading, and hidden content does not taint the conversation's integrity, so later tools run ungated. Turn hiding off and the result is visible, the conversation goes untrusted, and `PolicyEnforcementFunctionMiddleware` gates every later tool that has not opted in. A host gets one or the other. Two limits on the hiding half: it lapses once anything else has tainted the conversation, and it is about integrity only — a hidden item still contributes its confidentiality. Measured, with the full conditions, in [`docs/sandbox/information-flow.md`](https://github.com/sokolaidev/maf-extensions/blob/main/docs/sandbox/information-flow.md).
+
+**`withhold_guest_output=True` changes what comes back, and not what it claims.** The result is then the exit code, the size of each stream, which of the declared outputs landed — by the name the model itself declared — and one sentence naming the route. No guest-authored *text* survives into it. What does survive is chosen by the program all the same, so the declaration stays absent: withholding removes the guest's text from the result, not the guest from the result's derivation. What it is for is the rendering itself — guest-authored text never reaches the transcript, a host's logs, or anything else downstream of the call, and that holds whether or not a host runs information-flow middleware. Content still reaches the model by the road the option leaves open: the program writes it to a declared output, that lands in the sink, and the host's own already-classified file-reading path serves it back.
+
+**Withheld, the result is two items rather than one string, and hiding can reach one without the other.** The call-derived half — the exit code, the sizes, the landed names — carries no label of its own, so it takes whatever label the call would otherwise have had; beside it sits the sentence naming the recovery route, labelled `trusted`, because nothing a call produced reaches it and it is emitted on every return path, refusals included. **Where that call resolves untrusted and the conversation is still clean** — `default_integrity` is the host's to move, and hiding is a first-taint protection that stops once anything has tainted the conversation — a FIDES host with hiding on reads the sentence while the numbers sit behind a variable reference, which is the point of the split: under one label the sentence went with the numbers it was there to explain, and a model got a hidden result and no way to act on it. Where either condition fails both items are simply readable, which is the same outcome one string had. The call-derived half stays unlabelled deliberately: a per-item label replaces the *whole* label, confidentiality included, and confidentiality values are the host's vocabulary rather than this package's to invent. A host wiring no information-flow middleware simply reads both items.
 
 The rendering follows the transport. Off the host-tool-call transport you get the exit code and a size for `stdout` and for `stderr` separately. On it, the launcher merges the program's stderr into its stdout, so there is one `output` size — and `stderr` is the host's field there, so its note about the run is surfaced whole under `note:`. Withholding that note would report a run whose output was dropped for its size as one that printed nothing.
 
-Be precise about what that buys. The prose and the shape are this package's, and the artifact names are the model's own — but what fills them is the program's to choose. An exit status is 8 bits. Each stream's size is a few more, chosen by padding. And **each declared output is one further bit**: the program decides whether to write it, and the result says of every declared name whether it landed, so a call declaring the default eight names carries eight more. So the claim is that no guest-authored *text* crosses, not that no guest-chosen *bit* does. That is a narrow, per-call channel rather than the open one a rendered `stdout` is, and it is the honest limit. A host that has to close it should not attach this workload at all.
+Be precise about what that buys. The prose and the shape are this package's, and the artifact names are the model's own — but what fills them is the program's to choose. An exit status is 8 bits. Each stream's size is a few more, chosen by padding. And **each declared output is one further bit**: the program decides whether to write it, and the result says of every declared name whether it landed, so a call declaring the default eight names carries eight more. So what stops crossing is guest-authored *text*, not every guest-chosen *bit*. That is a narrow, per-call channel rather than the open one a rendered `stdout` is, and it is the honest limit. A host that has to close it should not attach this workload at all.
 
 A "size" here is the UTF-8 length of the text the stream decoded to, not the byte count the program wrote. `ExecResult` states no decoding contract ([#465](https://github.com/sokolaidev/maf-extensions/issues/465)), so a backend replacing an undecodable byte changes the number: the same program writing four bytes, `b"ok\xff\xfe"`, reports 8 on Docker and 5 on ACA Sandboxes. Neither is 4, and nothing here can recover it — `ExecResult` carries neither the bytes nor a length.
 
-**The sink's `display` is not rendered in this mode**, and that is why the claim holds. `OutputSink.deliver` is handed an `Artifact` whose `content` is the guest's bytes, and no protocol rule keeps `display` independent of it — a sink that quoted any of that content would put guest-authored text straight into a result labelled trusted. Withheld, the saved files are named by the spelling the model itself declared, which costs the sink's own detail and needs no promise from the host to stay honest.
-
-A wired host-tool registry keeps its say. `HostToolAggregate.result_integrity` is the weakest level over every registered source — an unstamped tool has already failed safe into it — and where it says `untrusted` this tool declares nothing, withheld or not. Withholding is about this kind's own rendering; where a host tool's data came from is core's fold to make.
+**The sink's `display` is not rendered in this mode.** `OutputSink.deliver` is handed an `Artifact` whose `content` is the guest's bytes, and no protocol rule keeps `display` independent of it — a sink that quoted any of that content would put guest-authored text straight back into the result. Withheld, the saved files are named by the spelling the model itself declared, which costs the sink's own detail and needs no promise from the host to stay honest.
 
 The mode is required to be `CodeactOutputs.DECLARED` and both other pairings are refused at construction, each for its own reason. Under `NONE` there is nowhere for content to go, so no call could return anything the model can use. Under `MANIFEST` the *program* names its own files in `outputs.json`, and this kind renders those names back into the result — a guest-chosen string inside a result claiming to hold none, which is the fail-open shape the option exists to close.
 

{maf_sandbox_codeact-0.9.2 → maf_sandbox_codeact-0.11.0}/README.md

@@ -103,19 +103,21 @@ Naming a host is a real widening, and worth naming as such: this sandbox runs mo
 
 **The host authorises every way in, and initiates only one of them.** With `file_store` wired, caller-selected files are written in before the program runs — deliberately, and constrained to the caller's listing, so the model cannot widen the set. What that content *is* remains the host's to know: a file in the store may itself carry text from somewhere untrusted, and a program that parses it is running on input the sandbox did not vet. An allowlisted host is the other way, and the *program* initiates that one — whatever it fetches is input nobody chose in advance. Wire no store, no allowlist and no registry, and nothing gets in but the source the model wrote.
 
-**The tool declares no `source_integrity`.** The library's default is `"trusted"`, which is right for a workload whose result is a compiler's own diagnostics and wrong for this one: what comes back is whatever a model-written `print(...)` chose to emit. Undeclared, MAF's information-flow tracker applies its untrusted default and the result taints the conversation — the fail-safe direction, and the honest one.
+**The tool declares no `source_integrity`, in either rendering.** A `"trusted"` claim asks that the result not derive from input the framework has left unestablished, and this one does: what comes back is whatever a model-written `print(...)` chose to emit. Undeclared, MAF's information-flow tracker applies its untrusted default — the fail-safe direction, and the honest one. A declaration would not sit under that default as a floor, either: FIDES reads `source_integrity` as an override and drops the input-label join entirely.
 
-**`withhold_guest_output=True` changes that, by changing what comes back.** The result is then the exit code, the size of each stream, which of the declared outputs landed — by the name the model itself declared — and one sentence naming the route. No guest-authored *text* survives into it, so the tool declares `source_integrity="trusted"` and a host doing information-flow control gets a result it can label without either lying about it or tainting the conversation. Content still reaches the model by the road the option leaves open: the program writes it to a declared output, that lands in the sink, and the host's own already-classified file-reading path serves it back.
+**What the untrusted default costs is the model's sight of the result, not the host's sinks.** FIDES hides an untrusted result by default: the item is replaced by a variable reference the model can pass to another tool without reading, and hidden content does not taint the conversation's integrity, so later tools run ungated. Turn hiding off and the result is visible, the conversation goes untrusted, and `PolicyEnforcementFunctionMiddleware` gates every later tool that has not opted in. A host gets one or the other. Two limits on the hiding half: it lapses once anything else has tainted the conversation, and it is about integrity only — a hidden item still contributes its confidentiality. Measured, with the full conditions, in [`docs/sandbox/information-flow.md`](https://github.com/sokolaidev/maf-extensions/blob/main/docs/sandbox/information-flow.md).
+
+**`withhold_guest_output=True` changes what comes back, and not what it claims.** The result is then the exit code, the size of each stream, which of the declared outputs landed — by the name the model itself declared — and one sentence naming the route. No guest-authored *text* survives into it. What does survive is chosen by the program all the same, so the declaration stays absent: withholding removes the guest's text from the result, not the guest from the result's derivation. What it is for is the rendering itself — guest-authored text never reaches the transcript, a host's logs, or anything else downstream of the call, and that holds whether or not a host runs information-flow middleware. Content still reaches the model by the road the option leaves open: the program writes it to a declared output, that lands in the sink, and the host's own already-classified file-reading path serves it back.
+
+**Withheld, the result is two items rather than one string, and hiding can reach one without the other.** The call-derived half — the exit code, the sizes, the landed names — carries no label of its own, so it takes whatever label the call would otherwise have had; beside it sits the sentence naming the recovery route, labelled `trusted`, because nothing a call produced reaches it and it is emitted on every return path, refusals included. **Where that call resolves untrusted and the conversation is still clean** — `default_integrity` is the host's to move, and hiding is a first-taint protection that stops once anything has tainted the conversation — a FIDES host with hiding on reads the sentence while the numbers sit behind a variable reference, which is the point of the split: under one label the sentence went with the numbers it was there to explain, and a model got a hidden result and no way to act on it. Where either condition fails both items are simply readable, which is the same outcome one string had. The call-derived half stays unlabelled deliberately: a per-item label replaces the *whole* label, confidentiality included, and confidentiality values are the host's vocabulary rather than this package's to invent. A host wiring no information-flow middleware simply reads both items.
 
 The rendering follows the transport. Off the host-tool-call transport you get the exit code and a size for `stdout` and for `stderr` separately. On it, the launcher merges the program's stderr into its stdout, so there is one `output` size — and `stderr` is the host's field there, so its note about the run is surfaced whole under `note:`. Withholding that note would report a run whose output was dropped for its size as one that printed nothing.
 
-Be precise about what that buys. The prose and the shape are this package's, and the artifact names are the model's own — but what fills them is the program's to choose. An exit status is 8 bits. Each stream's size is a few more, chosen by padding. And **each declared output is one further bit**: the program decides whether to write it, and the result says of every declared name whether it landed, so a call declaring the default eight names carries eight more. So the claim is that no guest-authored *text* crosses, not that no guest-chosen *bit* does. That is a narrow, per-call channel rather than the open one a rendered `stdout` is, and it is the honest limit. A host that has to close it should not attach this workload at all.
+Be precise about what that buys. The prose and the shape are this package's, and the artifact names are the model's own — but what fills them is the program's to choose. An exit status is 8 bits. Each stream's size is a few more, chosen by padding. And **each declared output is one further bit**: the program decides whether to write it, and the result says of every declared name whether it landed, so a call declaring the default eight names carries eight more. So what stops crossing is guest-authored *text*, not every guest-chosen *bit*. That is a narrow, per-call channel rather than the open one a rendered `stdout` is, and it is the honest limit. A host that has to close it should not attach this workload at all.
 
 A "size" here is the UTF-8 length of the text the stream decoded to, not the byte count the program wrote. `ExecResult` states no decoding contract ([#465](https://github.com/sokolaidev/maf-extensions/issues/465)), so a backend replacing an undecodable byte changes the number: the same program writing four bytes, `b"ok\xff\xfe"`, reports 8 on Docker and 5 on ACA Sandboxes. Neither is 4, and nothing here can recover it — `ExecResult` carries neither the bytes nor a length.
 
-**The sink's `display` is not rendered in this mode**, and that is why the claim holds. `OutputSink.deliver` is handed an `Artifact` whose `content` is the guest's bytes, and no protocol rule keeps `display` independent of it — a sink that quoted any of that content would put guest-authored text straight into a result labelled trusted. Withheld, the saved files are named by the spelling the model itself declared, which costs the sink's own detail and needs no promise from the host to stay honest.
-
-A wired host-tool registry keeps its say. `HostToolAggregate.result_integrity` is the weakest level over every registered source — an unstamped tool has already failed safe into it — and where it says `untrusted` this tool declares nothing, withheld or not. Withholding is about this kind's own rendering; where a host tool's data came from is core's fold to make.
+**The sink's `display` is not rendered in this mode.** `OutputSink.deliver` is handed an `Artifact` whose `content` is the guest's bytes, and no protocol rule keeps `display` independent of it — a sink that quoted any of that content would put guest-authored text straight back into the result. Withheld, the saved files are named by the spelling the model itself declared, which costs the sink's own detail and needs no promise from the host to stay honest.
 
 The mode is required to be `CodeactOutputs.DECLARED` and both other pairings are refused at construction, each for its own reason. Under `NONE` there is nowhere for content to go, so no call could return anything the model can use. Under `MANIFEST` the *program* names its own files in `outputs.json`, and this kind renders those names back into the result — a guest-chosen string inside a result claiming to hold none, which is the fail-open shape the option exists to close.
 

{maf_sandbox_codeact-0.9.2 → maf_sandbox_codeact-0.11.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "maf-sandbox-codeact"
-version = "0.9.2"
+version = "0.11.0"
 description = "CodeAct as a Microsoft Agent Framework tool — the model writes a short Python program and it runs inside a sandbox — written against maf-sandbox so it runs on any sandbox backend."
 readme = "README.md"
 requires-python = ">=3.12,<3.15"
@@ -24,7 +24,7 @@ classifiers = [
     "Topic :: Software Development :: Interpreters",
 ]
 dependencies = [
-    "maf-sandbox>=0.27.0,<0.30",
+    "maf-sandbox>=0.32.0,<0.33",
     "agent-framework-core>=1.13.0,<2",
 ]
 

{maf_sandbox_codeact-0.9.2 → maf_sandbox_codeact-0.11.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "maf-sandbox-codeact"
-version = "0.9.2"
+version = "0.11.0"
 description = "CodeAct as a Microsoft Agent Framework tool — the model writes a short Python program and it runs inside a sandbox — written against maf-sandbox so it runs on any sandbox backend."
 readme = "README.md"
 requires-python = ">=3.12,<3.15"
@@ -35,7 +35,7 @@ dependencies = [
     # import, and that one fails at the call, where no import check is looking. The number
     # itself is below, and `scripts/set_dependents_range.py` moves it — so this says which
     # release the floor is for, never which release that is.
-    "maf-sandbox>=0.27.0,<0.30",
+    "maf-sandbox>=0.32.0,<0.33",
     # The `@tool` decorator. MAF is a genuine dependency of the tool itself, not of the host
     # application.
     "agent-framework-core>=1.13.0,<2",

{maf_sandbox_codeact-0.9.2 → maf_sandbox_codeact-0.11.0}/src/maf_sandbox_codeact/_tool.py

@@ -33,6 +33,7 @@ from dataclasses import dataclass, replace
 from enum import StrEnum
 from typing import TYPE_CHECKING, Any, cast
 
+from agent_framework import Content
 from maf_sandbox import (
     DEFAULT_TRANSFER_LIMITS,
     SHIM_MODULE,
@@ -43,6 +44,7 @@ from maf_sandbox import (
     Egress,
     ExecResult,
     HostToolRun,
+    ListedFile,
     NameNormalization,
     OutputSink,
     SandboxArtifactNameInvalid,
@@ -53,13 +55,20 @@ from maf_sandbox import (
     SourceIntegrity,
     TransferLimits,
     collect_outputs,
+    echoed_name,
     error_detail,
     guest_run_layout,
     host_tool_calls_over_exec,
     host_tool_shim,
     validate_artifact_name,
 )
-from maf_sandbox.maf import SandboxToolSession, sandboxed_tool
+from maf_sandbox.maf import (
+    SandboxToolSession,
+    hidden_content_candidates,
+    labelled_result_item,
+    positions_holding_hidden_content,
+    sandboxed_tool,
+)
 
 if TYPE_CHECKING:
     from collections.abc import Awaitable, Callable, Mapping, Sequence
@@ -82,10 +91,10 @@ EXECUTE_CODE_TOOL_NAME = "execute_code"
 #: The sandbox kind this workload asks for.
 CODEACT_KIND = "codeact"
 
-#: Where every run's directory is created — a dedicated root rather than the image's own tree.
+#: Where every call's directory is created — a dedicated root rather than the image's own tree.
 _WORK_DIR = "/maf-sandbox/work"
 
-#: One fixed name inside each run's own directory.
+#: One fixed name inside each call's own directory.
 _PROGRAM_FILENAME = "program.py"
 
 #: What this kind needs to reach for ``execute_code`` to work at all — nothing, because the
@@ -93,6 +102,11 @@ _PROGRAM_FILENAME = "program.py"
 #: rather than an omission; :func:`codeact_sandbox_spec` has why it is fixed here.
 _KIND_EGRESS: tuple[str, ...] = ()
 
+#: The arguments a caller names files in, which is what a refusal about one of them points
+#: at and what provenance is asked about.
+_FILES_ARGUMENT = "files"
+_OUTPUTS_ARGUMENT = "outputs"
+
 #: Where a ``MANIFEST``-mode program says what it produced.
 _MANIFEST_FILENAME = "outputs.json"
 _MANIFEST_OUTPUTS_KEY = "outputs"
@@ -125,9 +139,11 @@ _NO_OUTPUT = (
     "program with print(...) of what you need to see."
 )
 
-#: Closes every result a withholding host returns. A sentence rather than a silence, because
-#: the exit code alone leaves a model nothing to act on; it names the route without promising a
-#: reader, which is the host's wiring rather than this kind's to claim.
+#: Closes every result a withholding host returns, as an item of its own labelled trusted. A
+#: sentence rather than a silence, because the exit code alone leaves a model nothing to act on;
+#: it names the route without promising a reader, which is the host's wiring rather than this
+#: kind's to claim. The label holds only while nothing a call produced reaches it and it stays
+#: on every return path, refusals included.
 _WITHHELD_ROUTE = (
     "What the program printed is not read back as text. To surface a value, write it into a "
     "declared output rather than printing it."
@@ -250,11 +266,11 @@ def make_codeact_tools(
         outputs: How a program's output files are named. See :class:`CodeactOutputs`.
         withhold_guest_output: Keep what the program printed out of the tool result, and answer
             with sizes and the model's own declared names instead. No guest-authored text
-            survives into the result, so this tool declares
-            :data:`~maf_sandbox.SourceIntegrity.TRUSTED` — unless a wired registry's
-            ``result_integrity`` says otherwise, which is core's fold to make and is honoured
-            here. Requires :data:`CodeactOutputs.DECLARED`: the one mode where content can still
-            reach the model and no guest-chosen name reaches the result.
+            survives into the result — but the values that replace it were still chosen by a
+            program the model wrote, so this changes what the result *holds* and not where it
+            came from: the tool declares no ``source_integrity`` either way. Requires
+            :data:`CodeactOutputs.DECLARED`: the one mode where content can still reach the
+            model and no guest-chosen name reaches the result.
 
             A size here is the UTF-8 length of the text the stream came back as, not the count
             of bytes the program wrote: ``ExecResult`` states no decoding contract, so a
@@ -268,17 +284,28 @@ def make_codeact_tools(
             ``note:``, since withholding it would report a dropped output as a program that
             printed nothing.
 
-            **What "trusted" claims, exactly.** The prose and the shape are this package's, and
-            the artifact names are the model's own — but what fills them is the program's to
-            choose, and it is a channel rather than a leak-free boundary. The exit status is 8
-            bits; each stream's size is a few more, chosen by padding; and **each declared
+            **The result is two items, not one string.**  The call-derived half — the exit
+            code, the sizes, the landed names — carries no label of its own, so it takes
+            whatever the call's label is; beside it sits the standing sentence naming the recovery
+            route, labelled ``trusted``, because nothing a call produced reaches it and it is
+            emitted on every return path including the refusals.  **Where that call resolves
+            untrusted and the conversation is still clean** — hiding is a first-taint
+            protection, and ``default_integrity`` is the host's to move — a framework hiding
+            untrusted content hides the first and leaves the second readable, which is the
+            point: under one label the sentence went with the numbers it was there to explain.
+            Neither condition is this kind's to promise; both are measured in
+            ``docs/sandbox/information-flow.md``.
+
+            **What withholding gets you, exactly.** The prose and the shape are this package's,
+            and the artifact names are the model's own — but what fills them is the program's
+            to choose, and it is a channel rather than a leak-free boundary. The exit status is
+            8 bits; each stream's size is a few more, chosen by padding; and **each declared
             output is one further bit**, since the program decides whether to write it and the
             result says of every declared name whether it landed — up to ``files_out.max_files``
-            of them. So the claim is that no guest-authored *text* crosses, not that no
-            guest-chosen *bit* does. That is a narrow per-call channel rather than the open one
-            a rendered ``stdout`` is, and a host that must close it should not attach this
-            workload at all. The sink's ``display`` is deliberately *not* rendered here — see
-            :func:`_format_landed`.
+            of them. So what stops crossing is guest-authored *text*, not every guest-chosen
+            *bit* — a narrow per-call channel rather than the open one a rendered ``stdout`` is,
+            and a host that must close it should not attach this workload at all. The sink's
+            ``display`` is deliberately *not* rendered here — see :func:`_format_landed`.
         outbound_max_confidentiality: The host's cap for tools that carry something out, in the
             host's own vocabulary. Off by default and written only when something can actually
             leave: an artifact landing in the sink, a host tool that carries something out, or
@@ -457,31 +484,18 @@ def make_codeact_tools(
         name=EXECUTE_CODE_TOOL_NAME,
         approval_mode="always_require" if approval_gated else "never_require",
         also_carries_out=registry_carries_out,
-        # The library's "trusted" default is right for a compiler's diagnostics and wrong here:
-        # what comes back is whatever a model-written `print(...)` chose to emit. Undeclared,
-        # the tracker's untrusted default applies and the result taints the conversation.
-        # Withholding removes that premise — no guest-authored text survives into the result —
-        # so the declaration becomes available, subject to the registry's own fold below.
-        source_integrity=_withheld_integrity(surface) if withhold_guest_output else None,
+        # Never declared, withheld or not. What comes back is whatever a model-written
+        # `print(...)` chose to emit; withheld it is an exit status, two sizes and a presence
+        # bit per declared output, every one of them chosen by a program the model wrote. A
+        # declaration replaces the framework's input-label join rather than flooring it, so
+        # declaring anything here would tell a host's middleware to disregard the input side.
+        source_integrity=None,
         outbound_max_confidentiality=outbound_max_confidentiality,
         output_sink=output_sink,
         logger=logger,
     )
 
 
-def _withheld_integrity(surface: HostToolAggregate | None) -> SourceIntegrity | None:
-    """What a withholding tool may declare, once the registry has had its say.
-
-    Withholding is about this kind's own rendering, and a registry's sources are core's fold to
-    make: ``result_integrity`` is the weakest level over every registered source, and an
-    unstamped tool has already failed safe into it. A registry with no opinion leaves the
-    workload's own, which withholding has earned; one that says untrusted keeps it.
-    """
-    if surface is not None and surface.result_integrity is SourceIntegrity.UNTRUSTED:
-        return None
-    return SourceIntegrity.TRUSTED
-
-
 def _effective_egress(extra: Sequence[str]) -> tuple[str, ...]:
     """The union of what this kind needs and what the deployment added, in that order.
 
@@ -613,6 +627,10 @@ _DESCRIPTION_HEAD = """Run a short Python program inside a sandbox and return wh
 #: reads, so a withheld tool built on it argues with its own `Returns:` section. This one stays
 #: transport-neutral about the shape and says "how large" rather than a count of bytes written:
 #: `Returns:` is where one merged size is told from two, and neither is what the program wrote.
+#: The claim sits on the streams rather than on `print`, because the withholding does: `logging`
+#: defaults to stderr and a traceback goes there too, so a model told about `print` alone reads
+#: those as a channel that comes back. And it offers the streams no use at all — naming one,
+#: debugging included, licenses the writing this mode exists to redirect.
 _DESCRIPTION_HEAD_WITHHELD = """Run a short Python program inside a sandbox and report what it
         did.
 
@@ -620,9 +638,13 @@ _DESCRIPTION_HEAD_WITHHELD = """Run a short Python program inside a sandbox and
         anything where running the code beats predicting what it would do.  The program runs
         as ``python3 program.py`` in a sandbox with {network}
 
-        **What you print is not read back.**  You get the exit code and how large the output
-        was, never what was in it — so ``print(...)`` is for your own debugging and never a way
-        to return a value.  Write anything you need to see into a declared output instead.
+        **Nothing your program writes to stdout or stderr comes back — not as a value, not to
+        debug with.**  You get the exit code and how large the output was, never what was in it,
+        so nothing you write there can show you anything, even when the program fails.  That
+        covers every route to those streams: ``print``, writes to ``sys.stdout`` or
+        ``sys.stderr``, the ``logging`` and ``warnings`` modules, tracebacks, and whatever a
+        subprocess you start prints.  Write everything you need to see — results and diagnostics
+        alike — into a declared output instead.
 
         Write a complete, self-contained program every time.  Each call gets a fresh working
         directory: nothing you did not pass in to *this* call is in it."""
@@ -825,15 +847,17 @@ def _execute_code_tool(
     host_tool_call: _HostToolCall | None,
     *,
     withhold: bool,
-) -> Callable[..., Awaitable[str]]:
+) -> Callable[..., Awaitable[str | list[Content]]]:
     """Build the ``execute_code`` body for one attached tool.
 
     Four signatures over one implementation, because MAF derives the tool's schema from the
     function's parameters: a host that wired no file store must not be shown ``files``.
     """
 
-    async def run(code: str, files: list[str] | None, declared: list[str] | None) -> str:
-        return await _execute(
+    async def run(
+        code: str, files: list[str] | None, declared: list[str] | None
+    ) -> str | list[Content]:
+        answer = await _execute(
             session,
             store,
             outputs,
@@ -844,19 +868,27 @@ def _execute_code_tool(
             declared or [],
             withhold=withhold,
         )
+        if not withhold:
+            return answer
+        # At the funnel rather than at each `return` inside `_execute`: the trusted label is
+        # honest only where the sentence is on every path, refusals included.
+        return [
+            Content.from_text(answer),
+            labelled_result_item(_WITHHELD_ROUTE, SourceIntegrity.TRUSTED),
+        ]
 
     async def with_files_and_outputs(
         code: str, files: list[str] | None = None, outputs: list[str] | None = None
-    ) -> str:
+    ) -> str | list[Content]:
         return await run(code, files, outputs)
 
-    async def with_files(code: str, files: list[str] | None = None) -> str:
+    async def with_files(code: str, files: list[str] | None = None) -> str | list[Content]:
         return await run(code, files, None)
 
-    async def with_outputs(code: str, outputs: list[str] | None = None) -> str:
+    async def with_outputs(code: str, outputs: list[str] | None = None) -> str | list[Content]:
         return await run(code, None, outputs)
 
-    async def plain(code: str) -> str:
+    async def plain(code: str) -> str | list[Content]:
         return await run(code, None, None)
 
     takes_files = store is not None
@@ -898,6 +930,10 @@ async def _execute(
     withhold: bool,
 ) -> str:
     """One ``execute_code`` call: share, run, and collect."""
+    # Taken before anything here awaits, and carried to every name check in this call: the
+    # framework's accessor is not scoped to the call, so a lookup made after the run — the
+    # manifest's, above all — may find nothing left to answer with.
+    rewritten = hidden_content_candidates()
     # Scope and thread come from the host's request context, never from model input.
     key = session.key()
     if isinstance(key, str):
@@ -922,16 +958,17 @@ async def _execute(
         )
 
     # Chosen here rather than after `acquire`, so that a declared name can be judged against
-    # the guest path it will actually become — the prefix is 13 bytes of the 255 a name gets.
+    # the guest path it will actually become — the prefix is the id core allocates for the
+    # call, derived below rather than counted.
     call_directory = session.guest_call_path()
-    run_id = call_directory.rsplit("/", 1)[-1]
-    # Where the model's own files live, relative to `work_dir`: the run directory itself, or
+    call_id = call_directory.rsplit("/", 1)[-1]
+    # Where the model's own files live, relative to `work_dir`: the call directory itself, or
     # the work subdirectory of it when the transport owns the run. Everything addressed by a
     # name a model chose is built from this — what is shared in, what the manifest is read
-    # from, and what is collected out — so the three cannot disagree about one run's layout.
+    # from, and what is collected out — so the three cannot disagree about one call's layout.
     # It is longer when calling a host tool, which is why the name checks below take it rather than
-    # `run_id`: five more bytes of the 255 a guest path gets, spent before the name is.
-    guest_prefix = f"{run_id}/{WORK_DIRECTORY}" if host_tool_call is not None else run_id
+    # `call_id`: five more bytes of the 255 a guest path gets, spent before the name is.
+    guest_prefix = f"{call_id}/{WORK_DIRECTORY}" if host_tool_call is not None else call_id
 
     names: list[str] = []
     if outputs is CodeactOutputs.DECLARED:
@@ -941,6 +978,9 @@ async def _execute(
             reserved=reserved,
             guest_prefix=guest_prefix,
             normalization=_normalization(session),
+            named_by=_OUTPUTS_ARGUMENT,
+            argument=_OUTPUTS_ARGUMENT,
+            candidates=rewritten,
         )
         if isinstance(checked, str):
             return checked
@@ -956,7 +996,7 @@ async def _execute(
     # host-tool call under the registry's `response_limits`.
     limits = session.spec.files_in
     tally = _InboundTally(limits)
-    shared: list[tuple[str, str]] = []
+    shared: list[tuple[str, str, str]] = []
     inbound = len(files) + (2 if host_tool_call is not None else 1)
     over_cap = _over_file_count(
         inbound, limits, calls_host_tool=host_tool_call is not None
@@ -966,12 +1006,13 @@ async def _execute(
     if over_cap is not None:
         return over_cap
     if store is not None:
-        resolved = await _resolve_listed_files(
-            session, store, files, reserved=reserved, withhold=withhold
+        resolution = await _resolve_listed_files(
+            session, store, files, reserved=reserved, withhold=withhold, candidates=rewritten
         )
-        if isinstance(resolved, str):
-            return resolved
-        read = await _read_listed_files(store, resolved, tally)
+        if isinstance(resolution, str):
+            return resolution
+        resolved, resolved_hidden = resolution
+        read = await _read_listed_files(session, store, resolved, tally, rewritten=resolved_hidden)
         if isinstance(read, str):
             return read
         shared = read
@@ -981,9 +1022,9 @@ async def _execute(
         return sandbox
 
     # The session owns this path, and `sandboxed_tool` reclaims it when the call returns.
-    # Built before anything is written, because it decides where everything goes. A run that
+    # Built before anything is written, because it decides where everything goes. A call that
     # calls a host tool is two directories — the model's files in `work`, the program and the shim
-    # in the transport's — and one that does not is the run directory flat, which is what a kind
+    # in the transport's — and one that does not is the call directory flat, which is what a kind
     # writing no shim has always been. The program name and the interpreter are passed rather
     # than defaulted, so this kind's constants and the transport's cannot drift apart.
     layout = (
@@ -993,9 +1034,9 @@ async def _execute(
     )
     shared_dir = layout.work if layout is not None else call_directory
 
-    for name, content in shared:
+    for name, named, content in shared:
         refusal = await _write_shared(
-            sandbox, name, f"{shared_dir}/{name}", content, working_directory=shared_dir
+            sandbox, name, named, f"{shared_dir}/{name}", content, working_directory=shared_dir
         )
         if refusal is not None:
             return refusal
@@ -1037,9 +1078,7 @@ async def _execute(
         # The transport's own bound — but *which* of its bounds is something only its message
         # knows. The run can expire before the program is started at all, and that message
         # says so where a reconstructed "the program timed out" would blame code that never
-        # ran. The message also carries the output clause, which is the program's stdout or
-        # the host's reason for having none; `output` is empty in the second case, so
-        # rebuilding the sentence from that attribute drops the reason silently.
+        # ran.
         #
         # It says what was *attempted* on the program too — its process group signalled, the
         # program signalled alone, or nothing signalled. None of the three is a claim that the
@@ -1051,24 +1090,28 @@ async def _execute(
         # a backend's own text kept to the log, which is the same rule this kind follows.
         logger.warning("execute_code: %s", expired)
         if withhold:
-            # The output clause is in the message rather than fenced off in `output`, so the
-            # sentence is rebuilt from the attributes instead — and it names no bound, because
-            # *whose* expired is not knowable here. A backend may raise this public type from a
-            # call of its own, the transport propagates that untranslated, and the subtype that
-            # tells the two apart is core's private one. `signal` is the discriminator the
-            # exception does carry, and `"absent"` is its one value asserting nothing started.
-            if expired.signal == "absent":
-                return f"Error: the time ran out before the program was started. {_WITHHELD_ROUTE}"
-            return f"Error: the program did not finish in the time it was given. {_WITHHELD_ROUTE}"
+            # The message quotes the program, so the sentence is rebuilt from the attributes
+            # instead — and it names no bound, because *whose* expired is not knowable here. A
+            # backend may raise this public type from a call of its own, the transport
+            # propagates that untranslated, and the subtype that tells the two apart is core's
+            # private one. `signal` is the discriminator the exception does carry, and
+            # `"absent"` is its one value asserting nothing started.
+            what_happened = (
+                "the time ran out before the program was started"
+                if expired.signal == "absent"
+                else "the program did not finish in the time it was given"
+            )
+            # The host's own words for why it read no output, surfaced whole like the note on
+            # the success path: it is the half of the message the guest did not write.
+            reason = f" {expired.output_reason}." if expired.output_reason else ""
+            return f"Error: {what_happened}.{reason}"
         return f"Error: {expired}"
     except TimeoutError as unfinished:
         if host_tool_call is None:
             # One `exec`, one bound: a timeout here is that bound and nothing else, so unlike
-            # the branch above this one may name it. The route still belongs on the end —
-            # every shipped backend reaches this line rather than that one.
+            # the branch above this one may name it.
             logger.warning("execute_code: the program timed out after %ss", timeout)
-            expiry = f"Error: the program timed out after {timeout}s"
-            return f"{expiry}. {_WITHHELD_ROUTE}" if withhold else expiry
+            return f"Error: the program timed out after {timeout}s"
         # A backend bounding one of its own control-plane calls, which the transport re-raises
         # untranslated. Blaming the program would be a guess about code the model is about to
         # rewrite — and the wrong one, since the run may have had most of its time left.
@@ -1080,11 +1123,7 @@ async def _execute(
         return "Error: could not run the program in the sandbox"
 
     logger.info("execute_code: ran exit_code=%d shared=%d", result.exit_code, len(shared))
-    report = (
-        _format_withheld(result, over_transport=host_tool_call is not None)
-        if withhold
-        else _format_result(result)
-    )
+    report = _format_withheld(result) if withhold else _format_result(result)
     nothing_to_collect = outputs is CodeactOutputs.NONE or (
         outputs is CodeactOutputs.DECLARED and not names
     )
@@ -1095,7 +1134,14 @@ async def _execute(
         # a program that caught its own error and wrote the diagnosis into one.
         return report
     collected = await _collect(
-        session, sandbox, guest_prefix, outputs, names, reserved, withhold=withhold
+        session,
+        sandbox,
+        guest_prefix,
+        outputs,
+        names,
+        reserved,
+        withhold=withhold,
+        candidates=rewritten,
     )
     return f"{report}\n\n{collected}" if collected else report
 
@@ -1110,15 +1156,29 @@ async def _resolve_listed_files(
     *,
     reserved: Mapping[str, str],
     withhold: bool = False,
-) -> list[str] | str:
+    candidates: frozenset[str] | None = None,
+) -> tuple[list[tuple[ListedFile, str]], frozenset[int]] | str:
     """Match each requested name against the caller's listing, or answer with the refusal.
 
     The listing is the injection-pinning boundary: a name the model invented, or read out of a
     poisoned file, has nowhere to go.  Which is why a listing that cannot be read is a refusal
     rather than an empty one — every name would then be refused for the wrong reason.
+
+    Answers with each entry **and the spelling a refusal about it may use**, plus the positions
+    among them the framework expanded.  The rendering is made here because this is the only place
+    that holds both spellings: the model's, and the listing key it resolved to.  Rendering later
+    from :attr:`ListedFile.name` would report the length of the host's key while claiming to
+    stand in for the value at the model's position, and the two differ whenever the listing
+    normalised anything.
     """
     if not files:
-        return []
+        return [], frozenset()
+    # Asked before the first await, not beside the loop that uses it: the framework's accessor
+    # is not scoped to the call, so every suspension before asking is a chance for the answer
+    # to come back empty. See `positions_holding_hidden_content`.
+    rewritten = positions_holding_hidden_content(
+        files, argument=_FILES_ARGUMENT, candidates=candidates
+    )
     listing = await session.list_files(store)
     if isinstance(listing, str):
         # The host's own sentence about its store. Withheld it is dropped for the reason the
@@ -1127,26 +1187,32 @@ async def _resolve_listed_files(
             logger.warning("execute_code: the file listing could not be read: %s", listing)
             return "Error: this tool's file listing could not be read, so nothing was shared."
         return listing
-    known = set(listing)
-    resolved: list[str] = []
-    for name in files:
+    listed_by_name = {entry.name: entry for entry in listing}
+    known = set(listed_by_name)
+    resolved: list[tuple[ListedFile, str]] = []
+    resolved_hidden: set[int] = set()
+    seen: set[str] = set()
+    for position, name in enumerate(files):
+        at = f"files[{position}]"
+        hidden = position in rewritten
+        named = echoed_name(name, at=at, hidden=hidden)
         try:
-            validate_artifact_name(name)
+            validate_artifact_name(name, at=at, hidden=hidden)
         except SandboxArtifactNameInvalid as exc:
             # The validator's own sentence, which names the rule that was broken: a fixed
             # message listing two of its rules tells a caller refused for a backslash or a
             # control character that its name satisfies everything the tool asked for. The
             # listing is still not echoed — that would invite a retry with another spelling.
-            return f"Error: {name!r} cannot be shared — {exc}"
+            return f"Error: {named} cannot be shared — {exc}"
         if name in reserved:
-            return f"Error: {name!r} cannot be shared — {reserved[name]}."
-        refusal = _inside_a_reserved_file(name, reserved, action="shared")
+            return f"Error: {named} cannot be shared — {reserved[name]}."
+        refusal = _inside_a_reserved_file(name, reserved, action="shared", at=at, hidden=hidden)
         if refusal is not None:
             return refusal
-        if name in resolved:
+        if name in seen:
             # One read and one write per name. Repeating one buys the caller nothing and
             # multiplies both, which is the cheapest way to amplify against the byte ceilings.
-            return f"Error: {name!r} was listed twice."
+            return f"Error: {named} was listed twice."
         if name not in known:
             logger.warning(
                 "execute_code: %r is not in this tool's file store listing (%d file(s) visible) "
@@ -1155,11 +1221,14 @@ async def _resolve_listed_files(
                 len(listing),
             )
             return (
-                f"Error: {name!r} is not in this tool's file listing, so it was not shared. "
-                f"{_listing_hint(name, listing, withhold=withhold)}"
+                f"Error: {named} is not in this tool's file listing, so it was not shared. "
+                f"{_listing_hint(name, sorted(known), withhold=withhold)}"
             )
-        resolved.append(name)
-    return resolved
+        if hidden:
+            resolved_hidden.add(len(resolved))
+        resolved.append((listed_by_name[name], named))
+        seen.add(name)
+    return resolved, frozenset(resolved_hidden)
 
 
 #: Capped so a large file store cannot flood the model's context.
@@ -1172,8 +1241,8 @@ def _listing_hint(name: str, listing: list[str], *, withhold: bool = False) -> s
     ``withhold`` names none of them. A store's filenames are the host's to supply through
     ``list_files`` and carry no integrity contract of their own — an agent that saved something
     it fetched may have named it from that content — so echoing up to
-    :data:`_LISTING_HINT_MAX` of them would put unclassified text into a result declared
-    :data:`~maf_sandbox.SourceIntegrity.TRUSTED`, for a name the model never asked about.
+    :data:`_LISTING_HINT_MAX` of them would put unclassified text into a result whose whole
+    point is to hold none, for a name the model never asked about.
     """
     if not listing:
         return "This tool's listing is empty — no files were shared with it."
@@ -1188,40 +1257,55 @@ def _listing_hint(name: str, listing: list[str], *, withhold: bool = False) -> s
 
 
 async def _read_listed_files(
-    store: AgentFileStore, names: list[str], tally: _InboundTally
-) -> list[tuple[str, str]] | str:
+    session: SandboxToolSession,
+    store: AgentFileStore,
+    files: list[tuple[ListedFile, str]],
+    tally: _InboundTally,
+    *,
+    rewritten: frozenset[int] = frozenset(),
+) -> list[tuple[str, str, str]] | str:
     """Read every requested file into memory, or answer with the refusal.
 
     Each file is counted **as it arrives**, so a breach stops the next read rather than the
     write: a tally applied to the finished set bounds what crosses into the sandbox and nothing
     about what this process spent getting there.
 
-    Text only: ``AgentFileStore.read`` answers with ``str``, and this path encodes what it
-    is given.  The protocol's ``write_file`` takes ``bytes``, so the boundary below is not what
-    stands in the way of a binary input — but this function and the tally would both have to
-    learn about it.
+    Read through the session rather than the store, so each file arrives as a labelled item
+    saying what the host knows about its bytes (:class:`~maf_sandbox.ListedFile`).
+
+    ``rewritten`` carries the argument positions the framework expanded, and every refusal below
+    renders those by position: a name that came out of hidden content is the one value a refusal
+    must not repeat.  Each file is answered with that rendering beside its real name, because the
+    write that follows this read is where the verdict would otherwise be lost — matching the
+    listing is not what makes a name safe to echo.
     """
-    read: list[tuple[str, str]] = []
-    for name in names:
-        try:
-            content = await store.read(name)
-        except Exception as exc:  # noqa: BLE001
-            logger.warning("execute_code: could not read %r from the file store: %s", name, exc)
-            return f"Error: could not read {name!r} from the file store"
-        if content is None:
+    read: list[tuple[str, str, str]] = []
+    for position, (listed, named) in enumerate(files):
+        at = f"files[{position}]"
+        hidden = position in rewritten
+        item = await session.read_file(store, listed, at=at, hidden=hidden, named=named)
+        if isinstance(item, str):
+            return item
+        if item is None:
             # A store read can miss without raising (the file was listed, then removed). Writing
             # `None` through would put the string "None" into the sandbox for the program to
             # parse.
-            logger.warning("execute_code: %r is listed but has no content", name)
-            return f"Error: {name!r} is listed in the file store but has no content"
-        over_cap = tally.add(name, content)
+            logger.warning("execute_code: a listed file has no content")
+            return f"Error: {named} is listed in the file store but has no content"
+        content = item.text
+        if content is None:
+            logger.warning("execute_code: a listed file read back with no text")
+            return f"Error: {named} is listed in the file store but has no content"
+        over_cap = tally.add(listed.name, content, named=named)
         if over_cap is not None:
             return over_cap
-        read.append((name, content))
+        read.append((listed.name, named, content))
     return read
 
 
-def _inside_a_reserved_file(name: str, reserved: Mapping[str, str], *, action: str) -> str | None:
+def _inside_a_reserved_file(
+    name: str, reserved: Mapping[str, str], *, action: str, at: str, hidden: bool
+) -> str | None:
     """Refuse a name that would have to live inside a reserved file, naming which one.
 
     Every shipped backend creates parent directories for a nested write, so
@@ -1235,8 +1319,8 @@ def _inside_a_reserved_file(name: str, reserved: Mapping[str, str], *, action: s
     if above is None:
         return None
     return (
-        f"Error: {name!r} cannot be {action} — {above!r} is a file name this tool reserves in "
-        f"every run's directory, so nothing can live inside it."
+        f"Error: {echoed_name(name, at=at, hidden=hidden)} cannot be {action} — {above!r} is a "
+        f"file name this tool reserves in every run's directory, so nothing can live inside it."
     )
 
 
@@ -1272,8 +1356,15 @@ class _InboundTally:
         self._limits = limits
         self._total = 0
 
-    def add(self, name: str, content: str) -> str | None:
-        """Count one file, or answer with the refusal that should stop the next read."""
+    def add(self, name: str, content: str, *, named: str | None = None) -> str | None:
+        """Count one file, or answer with the refusal that should stop the next read.
+
+        ``named`` is how the file may be spelled in a refusal, and defaults to ``repr(name)`` —
+        which is what a caller naming a constant wants.  A caller counting a file the model
+        named passes the position-safe rendering instead: these two refusals reach the model,
+        and a name the framework expanded out of hidden content is not the caller's to echo.
+        """
+        shown = named if named is not None else repr(name)
         try:
             size = len(content.encode())
         except UnicodeEncodeError:
@@ -1281,12 +1372,12 @@ class _InboundTally:
             # encoded. This tally runs outside the guarded write, so without this the turn
             # dies here rather than the model being told what to fix.
             return (
-                f"Error: {name!r} is not valid UTF-8 and cannot be written into the sandbox. "
+                f"Error: {shown} is not valid UTF-8 and cannot be written into the sandbox. "
                 f"Nothing was shared."
             )
         if size > self._limits.max_bytes_per_file:
             return (
-                f"Error: {name!r} is {size} bytes and this tool writes at most "
+                f"Error: {shown} is {size} bytes and this tool writes at most "
                 f"{self._limits.max_bytes_per_file} bytes per file. Nothing was shared."
             )
         self._total += size
@@ -1302,19 +1393,25 @@ class _InboundTally:
 async def _write_shared(
     sandbox: Sandbox,
     name: str,
+    named: str,
     guest_path: str,
     content: str,
     *,
     working_directory: str,
 ) -> str | None:
-    """Put one already-read file store file into the run's directory, or answer with the refusal."""
+    """Put one already-read file store file into the run's directory, or answer with the refusal.
+
+    ``name`` is the real store path — the guest path is built from it and the host's log records
+    it — while ``named`` is the only spelling that may appear in the refusal.  They differ where
+    the framework expanded hidden content into the argument this file was named by.
+    """
     try:
         await sandbox.write_file(guest_path, content, working_directory=working_directory)
     except Exception as exc:  # noqa: BLE001
         logger.warning(
             "execute_code: could not write %r into the sandbox: %s", name, error_detail(exc)
         )
-        return f"Error: could not share {name!r} into the sandbox"
+        return f"Error: could not share {named} into the sandbox"
     return None
 
 
@@ -1334,6 +1431,9 @@ def _validated_output_names(
     reserved: Mapping[str, str],
     guest_prefix: str,
     normalization: NameNormalization,
+    named_by: str,
+    argument: str | None = None,
+    candidates: frozenset[str] | None = None,
 ) -> list[str] | str:
     """Settle every output name before the program runs, or answer with the refusal.
 
@@ -1341,6 +1441,9 @@ def _validated_output_names(
     with its run prefix, and the delivered name after normalization — so that a refusal cannot
     arrive a whole run late.  That function stays the authority: if the two disagree, this one
     is wrong, and the cost is the late refusal rather than a name reaching a host.
+
+    ``named_by`` says where the names came from — the ``outputs`` argument or the manifest —
+    so a refusal can point at the one it means without quoting a value it should not.
     """
     if len(names) > max_files:
         return (
@@ -1348,8 +1451,15 @@ def _validated_output_names(
             f"{max_files} per call."
         )
     prefix = f"{guest_prefix}/"
-    seen: dict[str, str] = {}
-    for name in names:
+    seen: dict[str, tuple[str, str]] = {}
+    # Asked of manifest names as well as of the model's own `outputs`, and that is not
+    # belt-and-braces: `code` is a rewritten argument too, so a payload can reach the guest
+    # in the program's own source and come back as a name the program chose to write.
+    rewritten = positions_holding_hidden_content(names, argument=argument, candidates=candidates)
+    for position, name in enumerate(names):
+        at = f"{named_by}[{position}]"
+        hidden = position in rewritten
+        named = echoed_name(name, at=at, hidden=hidden)
         # NFC is not length-non-increasing — 43 × U+0958 is 129 bytes declared and 258
         # delivered — so the name to hold to the invariant is the one the sink will receive.
         delivered = (
@@ -1357,25 +1467,25 @@ def _validated_output_names(
         )
         for spelling in (name, delivered, prefix + name):
             try:
-                validate_artifact_name(spelling)
+                validate_artifact_name(spelling, at=at, hidden=hidden)
             except SandboxArtifactNameInvalid as exc:
-                return f"Error: {name!r} cannot be saved — {exc}"
+                return f"Error: {named} cannot be saved — {exc}"
         if name in reserved:
-            return f"Error: {name!r} cannot be saved — {reserved[name]}."
-        refusal = _inside_a_reserved_file(name, reserved, action="saved")
+            return f"Error: {named} cannot be saved — {reserved[name]}."
+        refusal = _inside_a_reserved_file(name, reserved, action="saved", at=at, hidden=hidden)
         if refusal is not None:
             return refusal
         # `collect_outputs`' own key: NFC and case-folded, always, whatever the sink does
         # about rewriting.
         key = unicodedata.normalize("NFC", name).lower()
         if key in seen:
-            earlier = seen[key]
+            earlier, earlier_named = seen[key]
             return (
-                f"Error: {name!r} and {earlier!r} are one file once saved"
+                f"Error: {named} and {earlier_named} are one file once saved"
                 if earlier != name
-                else f"Error: {name!r} was declared twice."
+                else f"Error: {named} was declared twice."
             )
-        seen[key] = name
+        seen[key] = (name, named)
     return list(names)
 
 
@@ -1388,6 +1498,7 @@ async def _collect(
     reserved: Mapping[str, str],
     *,
     withhold: bool = False,
+    candidates: frozenset[str] | None = None,
 ) -> str:
     """Land whatever this run produced, and say what happened — never raising into the model."""
     sink = session.output_sink
@@ -1419,6 +1530,8 @@ async def _collect(
             reserved=reserved,
             guest_prefix=guest_prefix,
             normalization=_normalization(session),
+            named_by=_MANIFEST_FILENAME,
+            candidates=candidates,
         )
         if isinstance(checked, str):
             return checked
@@ -1447,7 +1560,14 @@ async def _collect(
     except Exception as exc:  # noqa: BLE001
         logger.warning("execute_code: saving this run's files failed: %s", error_detail(exc))
         return f"Error: the program ran but its files could not be saved. {_MAY_HAVE_LANDED}"
-    return _format_landed(landed, declared, withhold=withhold)
+    return _format_landed(
+        landed,
+        declared,
+        withhold=withhold,
+        named_by=_MANIFEST_FILENAME if outputs is CodeactOutputs.MANIFEST else _OUTPUTS_ARGUMENT,
+        argument=None if outputs is CodeactOutputs.MANIFEST else _OUTPUTS_ARGUMENT,
+        candidates=candidates,
+    )
 
 
 async def _read_manifest(
@@ -1531,7 +1651,13 @@ async def _read_manifest(
 
 
 def _format_landed(
-    landed: Sequence[LandedArtifact], declared: Sequence[str], *, withhold: bool = False
+    landed: Sequence[LandedArtifact],
+    declared: Sequence[str],
+    *,
+    withhold: bool = False,
+    named_by: str = _OUTPUTS_ARGUMENT,
+    argument: str | None = None,
+    candidates: frozenset[str] | None = None,
 ) -> str:
     """What the model is told about the files: what landed, and what is absent.
 
@@ -1541,24 +1667,59 @@ def _format_landed(
     Normalizing **both** sides is right whichever normalization the sink chose — under
     ``NameNormalization.NONE`` the two are already the same string.
 
+    ``argument`` names the parameter ``declared`` came from, where it came from one — the
+    ``outputs`` argument, never the manifest, which no caller spelled.  It is what makes the
+    provenance answer exact here rather than inferred, and it matters as much after the run as
+    before it: without it a declared name equal to hidden content renders as a position, and a
+    caller watching which way its own spelling comes back learns that the guess was right.
+
     ``withhold`` drops ``display`` in favour of the name the model itself declared. The sink
     composes ``display`` from an :class:`~maf_sandbox.Artifact` whose ``content`` is the guest's
     bytes, and nothing in the protocol requires the two to be independent — so a sink that puts
-    any of that content in the string would be putting guest-authored text into a result this
-    kind has declared :data:`~maf_sandbox.SourceIntegrity.TRUSTED`. Naming the declared spelling
-    costs the sink's own detail and needs no promise from the host to stay honest.
+    any of that content in the string would be putting guest-authored text back into a result
+    rendered to hold none. Naming the declared spelling costs the sink's own detail and needs no
+    promise from the host to stay honest.
     """
     delivered = {unicodedata.normalize("NFC", item.name) for item in landed}
     lines: list[str] = []
+    # Answered once, above the two renderings that need it: a name that landed is reported as
+    # surely as one that did not, and a name the framework substituted must not be repeated
+    # either way. `withhold` makes no difference to that — it is the mode that renders least.
+    rewritten = positions_holding_hidden_content(
+        list(declared), argument=argument, candidates=candidates
+    )
+    position_of = {
+        unicodedata.normalize("NFC", name): position for position, name in enumerate(declared)
+    }
+
     if landed:
         lines.append("Saved:")
         if withhold:
-            lines.extend(
-                f"- {name}" for name in declared if unicodedata.normalize("NFC", name) in delivered
-            )
+            for position, name in enumerate(declared):
+                if unicodedata.normalize("NFC", name) in delivered:
+                    # The name itself unless the framework put it there: this is a list of
+                    # files, not a refusal, so a name of the model's own is what it wants back.
+                    lines.append(
+                        f"- {named_by}[{position}]" if position in rewritten else f"- {name}"
+                    )
         else:
-            lines.extend(f"- {item.display}" for item in landed)
-    missing = [name for name in declared if unicodedata.normalize("NFC", name) not in delivered]
+            for item in landed:
+                # The display carries the name inside it, so a substituted one is reported by
+                # position instead. A name of the model's own keeps the size and the rest of it.
+                position = position_of.get(unicodedata.normalize("NFC", item.name))
+                lines.append(
+                    f"- {named_by}[{position}]"
+                    if position is not None and position in rewritten
+                    else f"- {item.display}"
+                )
+    # A name that produced no file is reported the way a refusal reports one: the caller's
+    # spelling where it is the caller's, and the position where the framework put something
+    # else there. It is the one line here that names a file which does not exist.
+    missing = [
+        echoed_name(name, at=f"{named_by}[{position}]", hidden=position in rewritten)
+        for position, name in enumerate(declared)
+        if unicodedata.normalize("NFC", name) not in delivered
+    ]
     if missing:
         lines.append(
             f"Not written by the program, so not saved: {', '.join(sorted(missing))}. Write "
@@ -1597,31 +1758,31 @@ def _stream_bytes(text: str | None) -> int:
     return len((text or "").encode("utf-8", errors="surrogatepass"))
 
 
-def _format_withheld(result: ExecResult, *, over_transport: bool) -> str:
+def _format_withheld(result: ExecResult) -> str:
     """Render one run for a host that withholds guest text: sizes, not content.
 
     Fixed shape and fixed order, empty streams included, and the exit code named on every run
     unlike :func:`_format_result`'s — with the content gone it is the only thing left that says
     whether the program worked.
 
-    ``over_transport`` decides who owns ``stderr``. On the host-tool-call transport the
-    launcher merges the guest's stderr into its output file, so that field is the *host's* and
-    holds its note about the run — the one that tells a dropped output apart from a program
-    that printed nothing. Withholding it would report the first as the second, so it is
-    surfaced whole there and only the merged stream is reduced to a size.
+    The route sentence is not here: it closes every result a withholding tool returns, this
+    one included, and is attached where that is true of all of them.
+
+    ``ExecResult.producer_owns_stderr`` decides who owns ``stderr``. Where it is set that
+    field is the producer's, not the guest's, and holds its note about the run — the one that
+    tells a dropped output apart from a program that printed nothing. Withholding it would
+    report the first as the second, so it is surfaced whole and only ``stdout`` is sized.
     """
-    if over_transport:
+    if result.producer_owns_stderr:
         note = (result.stderr or "").rstrip("\n")
         lines = [f"exit code: {result.exit_code}", f"output: {_stream_bytes(result.stdout)} bytes"]
         if note:
             lines.append(f"note: {note}")
-        lines.append(_WITHHELD_ROUTE)
         return "\n".join(lines)
     return "\n".join(
         (
             f"exit code: {result.exit_code}",
             f"stdout: {_stream_bytes(result.stdout)} bytes",
             f"stderr: {_stream_bytes(result.stderr)} bytes",
-            _WITHHELD_ROUTE,
         )
     )