The static/dynamic split in src/core/transform.ts is organised by volatility, not by authority. Volatile environment text is correctly kept in the native system field, which closed the earlier problem. What remains is that static system text and tool reference material are rendered into images spliced into the first user message.
Security rules, standing behavioural instructions, authorization constraints and required provider identity therefore arrive with user-role provenance, and become hard to distinguish from content a user pasted. #97 documents the resulting session friction.
Suggested direction
Classify system material by authority as well as volatility. Keep native: security and safety rules, standing behaviour, authorization constraints, provider identity. Image only bulky non-authoritative reference material, and only where the profitability gate says it pays.
A negative test where user content imitates the slab banner belongs with it: authority must not be inferable from tag-shaped text inside a user message.
Not sent as a PR. The wire shape is easy to assert, but the part that decides whether this is worth its token cost is a per-model behavioural A/B on current provider deployments, and a contributor guessing the classification boundary for your prompt would be worse than leaving it to you.
The static/dynamic split in
src/core/transform.tsis organised by volatility, not by authority. Volatile environment text is correctly kept in the nativesystemfield, which closed the earlier problem. What remains is that static system text and tool reference material are rendered into images spliced into the first user message.Security rules, standing behavioural instructions, authorization constraints and required provider identity therefore arrive with user-role provenance, and become hard to distinguish from content a user pasted. #97 documents the resulting session friction.
Suggested direction
Classify system material by authority as well as volatility. Keep native: security and safety rules, standing behaviour, authorization constraints, provider identity. Image only bulky non-authoritative reference material, and only where the profitability gate says it pays.
A negative test where user content imitates the slab banner belongs with it: authority must not be inferable from tag-shaped text inside a user message.
Not sent as a PR. The wire shape is easy to assert, but the part that decides whether this is worth its token cost is a per-model behavioural A/B on current provider deployments, and a contributor guessing the classification boundary for your prompt would be worse than leaving it to you.