pub enum Origin {
Clean,
Untrusted,
Derived,
}Expand description
Where a reflection’s evidence came from, provenance-wise.
Written by classification code from the transcript’s recorded taint, never inferred from the text — prose claiming to be from the user does not make it user content. The stake: a learned rule outlives the conversation that produced it and rides in the system prompt of every future run, inside the cached prefix, where nothing will ever check it again. The interlock stops exfiltration inside a tainted conversation; this is the only guard on the longer-half-life path out of one.
Variants§
Clean
No third-party content had entered the conversation when the intervention happened.
Untrusted
Third-party content was in context. Kept as readable evidence, never consolidated into rules — excluded structurally, not scored down.
Derived
Not an interactive session: a subagent, eval case or batch item. A subagent’s steer is mecha correcting itself, not the user correcting mecha — learning from it is a feedback loop, not a lesson. (Those conversations do not record sessions today, so nothing classifies to this yet; the variant exists so the schema does not move when they do.)