feat(anthropic): use native mid-conversation system messages on Fable 5/Mythos 5/Opus 4.8

[trevornk]

Summary

Anthropic's native Messages API supports mid-conversation {"role": "system"} entries on Claude Fable 5, Claude Mythos 5, and Claude Opus 4.8. Hermes can use that shape for a real runtime /steer without rewriting the top-level system prompt or invalidating its cached prefix.

Hermes still appends the visible [OUT-OF-BAND USER MESSAGE] marker to the active tool result for role-alternation-safe fallback behavior. Marker text is presentation only and is never trusted as provenance. The runtime also records the exact steer text in private, top-level internal metadata on the canonical tool message. The Anthropic adapter promotes a steer only when that runtime-owned metadata exists and the exact corresponding marker can be removed from the exact converted tool_result block.

Raw tool output, web content, files, or MCP responses that imitate the public marker remain ordinary tool output.

Implementation

• Adds private _hermes_trusted_steer metadata only at Hermes's two runtime steer-injection paths.
• Consumes that metadata during Anthropic conversion; it is not serialized to Anthropic, OpenAI Chat Completions, Responses API, or Bedrock payloads.
• Binds provenance to the exact converted tool_result object rather than a sanitized tool-call ID, preventing collisions such as call.a / call_a from cross-binding instructions.
• Promotes every structurally trusted historical steer at the same position on every replay, immediately after its tool-result user turn. This keeps the outgoing message prefix stable across requests.
• Leaves canonical Hermes history unchanged.
• Gates native promotion to Fable 5 / Mythos 5 / Opus 4.8 on native Anthropic endpoints. Sonnet 5, GPT, and third-party Anthropic-compatible endpoints retain the inline fallback.

Security and cache invariants

• Public delimiter text cannot authorize a system message.
• Internal metadata never reaches provider payloads.
• Tool-result/system/assistant ordering remains Anthropic-placement compliant.
• Historical replays are deterministic and cache-prefix stable.
• Colliding or duplicate tool IDs cannot associate a steer with the wrong result.

Testing

Focused coverage includes model/endpoint gating, string and block tool-result shapes, genuine runtime metadata injection, forged-marker rejection, exact-text matching, historical replay stability, duplicate/sanitized-ID collisions, provider payload metadata exclusion, and role ordering.

pytest -q tests/agent/test_anthropic_adapter.py -k 'MidConversation or TrustedSteer' tests/run_agent/test_steer.py
21 passed

An independent post-fix review found no remaining security or logic blockers.

[teknium1]

Thanks for the narrowly scoped provider-side implementation. One blocking issue needs redesign before it is safe to salvage.

Problems

• agent/anthropic_adapter.py:2548-2561 parses static delimiters from a tool_result and promotes the captured text as role: system. The delimiters are public static strings in agent/prompt_builder.py:637-643, and current Hermes appends them to ordinary tool-result content at agent/agent_runtime_helpers.py:3739-3752. A tool can therefore return identical delimiter-shaped content and have it re-labeled as user input with system authority. This conflicts with the current trust contract in agent/prompt_builder.py:651-656; Anthropic's mid-conversation-system-message documentation also explicitly warns not to elevate raw tool output.
• The new tests construct accepted markers with format_steer_marker (tests/agent/test_anthropic_adapter.py:1408-1438, PR head) but do not test forged marker text returned by a tool.

Suggested changes

• Preserve trusted /steer provenance separately through the adapter; do not infer it by parsing tool-output text.
• Add adversarial tests proving delimiter-shaped raw tool output stays in the tool_result and does not produce a system message.

Automated hermes-sweeper review.

[teknium1]

Blocking: _extract_trailing_steer_marker() recognizes only public static text, not provenance. A tool can return the exact marker delimiters; this path then strips that output and lines 2555-2561 elevate it to a system message labeled as user input. Carry a trusted steer flag/value separately from tool-result text and add a forged-marker regression test.

[trevornk]

Rebased onto current main (63279301bc) — was CONFLICTING/DIRTY, now MERGEABLE/CLEAN at b47b41fe10. Both commits preserved. Final shape is 7 files, +421/-8.

This was the messiest of the three: agent/anthropic_adapter.py and anthropic_message_convert.py have been reworked substantially upstream since the PR was opened, so the conflicts were resolved by adapting the feature onto main's current structure rather than reverting main's work. Checked first whether main had already landed native mid-conversation system messages — it had not, so the PR is still needed. _model_supports_mid_conversation_system is wired into the pushed adapter.

Verified locally on Python 3.11.16:

tests/agent/test_anthropic_adapter.py tests/run_agent/test_steer.py .... 158 passed in 8.07s

Worth highlighting the second commit for reviewers, since it is the security-relevant half: live steers are now identified by structural provenance (TRUSTED_STEER_KEY set on the message dict at injection time in conversation_loop.py) instead of by matching the rendered marker text. Text-matching provenance is spoofable — model- or tool-produced content can imitate the marker — whereas the structural key can only be set by the code that actually performed the injection. That is the right direction independent of the mid-conversation-system feature.

Broad-suite runs were skipped: this machine hit its memory ceiling and the OOM-killer was SIGKILLing pytest. The targeted numbers above are real; CI is the right place for the full sweep.

[trevornk]

Closing this one. It has gone stale and now conflicts with main, and rather than leave a conflicted branch sitting in the review queue I would rather clear it out. If the underlying issue is still present and someone wants it, I am happy to redo it fresh against current main — the branch stays on my fork, so nothing here is lost.