pub enum Origin {
Clean,
Untrusted,
Derived,
}Expand description
Where a reflection’s evidence came from, provenance-wise.
Written by classification code from the transcript’s recorded taint, never inferred from the text — prose claiming to be from the user does not make it user content. The stake: a learned rule outlives the conversation that produced it and rides in the system prompt of every future run, inside the cached prefix, where nothing will ever check it again. The interlock stops exfiltration inside a tainted conversation; this is the only guard on the longer-half-life path out of one.
Variants§
Clean
No third-party content had entered the conversation when the intervention happened.
Untrusted
Third-party content was in context. Kept as readable evidence, never consolidated into rules — excluded structurally, not scored down.
Derived
Not the user correcting mecha. A subagent’s steer, and — since 2026-08-27 — mecha’s own words landing in the user role: the empty-turn and final-answer nudges, and boredom’s notice.
Learning from it is a feedback loop rather than a lesson, and the sharp
reason is mechanical rather than philosophical. A self-observed failure
is real evidence; what it lacks is a way to be graded.
counterfactual.rs validates an intervention by replaying the
transcript without it and asking whether the trajectory changed, and
that test means something only because the user steered it there — for
a self-authored one, what follows is the model recovering, and there is
no ground truth in it. GOAL-SYSTEM-DESIGN.md §5.3 states the same gap.
So this is a label, not an exclusion: the reflection is kept, is visible, and is one gate away from being usable the day something can grade it. Subagent and batch conversations still do not record sessions, so that half of the variant classifies nothing yet.