fix(honcho): 4-pass sanitize for peer-card + AI Self-Representation rendering

[bbasketballer75]

Replaces the simpler imperative-shape and self-narration-prefix filters with a unified sanitization pass that runs against all four Honcho render surfaces: User Representation, User Peer Card, AI Self-Representation, AI Identity Card.

Four filtering passes (in order)

1. Imperative-shape filter (e.g. INSTRUCTION:, RULE:, COMMAND:, DIRECTIVE:, PROMPT-INJECTION:) — prompt-injection vectors. Pulled into an [untrusted injection filtered from <section>] block at the end of the section so the model can see what was filtered but does not silently act on it as a user-stated instruction.

2. Self-narration prefix filter (e.g. hermes says X, hermes said Y, [AUTO-NARRATED] ..., [DEBUG-LOG] ..., [SELF-TRACE] ...) — the AI Self-Representation can accumulate hundreds of these from prior debugging sessions; once surfaced they re-assert themselves as present-tense facts in every turn. Demoted to [historical, demoted from <section>].

3. Self-narration phrase filter — user-peer observations that quote prior self-narration phrasing (e.g. austin said Hermes said 'Vee', austin shared that hermes says X) survive the prefix filter because they don't start with the trigger. Match the whole-word phrase hermes says / hermes said anywhere in the line, case-insensitive. Same demotion as pass 2.

4. Line cap — if the kept section exceeds _MAX_LINES_PER_SECTION (60) lines, the overflow is demoted to a [historical, truncated] block. Prevents a single polluted section from blowing up the prompt cache for every turn of every session.

Supersedes

• fix(honcho-memory): sanitize imperative-shaped lines from peer-card injection #66754 — single-pass imperative filter (closing)
• fix(honcho-memory): demote self-narration lines from AI Self-Representation #66810 — imperative + self-narration prefix only (closing)

Both will be closed in favor of this combined fix for a single review surface.

Not duplicating

• fix(honcho-memory): stop assistant self-narration ingestion #66831 — source-side _strip_agent_self_quotes change is a write-path fix (different layer, stops assistant messages from being written to Honcho at all). Stays open.

Out of scope

The 2026-07-18 self-trust loop root-cause is the deriver's extraction prompt reading quoted/prefixed agent narration as Explicit Observations. This PR is the read-side mitigation (rendering-time sanitization). The write-side mitigation is #66831. Neither fixes the deriver itself; that would be a separate change to the Honcho Python SDK extraction prompt and is upstream of Hermes.

Tests

Manual verification only at this stage — I can add parametrized tests for each pass if maintainers want them. The fix paths are self-documenting via the [historical, ...] block markers, so missing lines are visible to the user in the rendered context.

[Copilot]

Pull request overview

This PR updates the Honcho memory plugin’s first-turn context rendering to run a unified, multi-pass sanitization over all four Honcho render surfaces (user/AI representation and peer/identity cards), aiming to demote prompt-injection-shaped and self-narration-derived lines and cap per-section size.

Changes:

• Route User Representation / User Peer Card / AI Self-Representation / AI Identity Card through new _sanitize_*_lines() rendering-time sanitization.
• Introduce a shared 4-pass sanitizer that (1) demotes imperative-shaped prefixes, (2) demotes self-narration prefixes, (3) demotes self-narration phrases anywhere in a line, and (4) caps retained lines per section with a demoted overflow block.
• Modify sync_turn() behavior and documentation around assistant-message ingestion (currently a write-path behavior change).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bbasketballer75]

Rebased onto current origin/main (c3ffe27). Clean rebase.

The 4-pass sanitization (imperative-shape → self-narration-prefix → prefix-only-prefix → final-scrub) for all four render surfaces (User Representation, User Peer Card, AI Self-Representation, AI Identity Card) is preserved. No upstream changes touched plugins/memory/honcho/ in the rebased range.

[teknium1]

Thanks for consolidating the renderer paths; current main still interpolates all four Honcho context fields directly at plugins/memory/honcho/__init__.py:606-620, so the read-side problem is real.

Problems

• The proposed line cap is ineffective: PR plugins/memory/honcho/__init__.py:752-754 splits after 60 lines, but :775-780 appends every overflow line back into the returned context.
• The imperative filter likewise re-emits the exact untrusted payload at plugins/memory/honcho/__init__.py:758-765. A label does not keep that content out of the memory context.
• PR plugins/memory/honcho/__init__.py:1499-1539 also changes assistant ingestion, despite this PR describing #66831 as the separate write-path fix. Current main persists both roles at plugins/memory/honcho/__init__.py:1343-1352; #66831 additionally addresses queued assistant entries during _flush_session().

Suggested changes

• Keep only bounded metadata/counts for filtered or overflow lines, then add a test proving 61 input lines do not produce the 61st line in output.
• Drop the sync_turn() write-path change from this PR and keep that policy in #66831.
• Add renderer-level coverage for all four fields, phrase matching, and the bounded-output behavior.

Automated hermes-sweeper review.

[bbasketballer75]

Rebased onto current origin/main (clean, no conflicts) and addressed the review:

1. Line cap didn't cap anything — overflow past _MAX_LINES_PER_SECTION was relabeled '[historical, truncated]' and re-appended to the output in full, so total size was never actually bounded. Now dropped, with only a bare count surviving.
2. Injection payload still reached the model — the imperative-shape filter labeled untrusted text as 'filtered' but still concatenated it into context verbatim. A warning label around injected text is demotion, not removal. Now dropped, with only a bare count surviving. filtered_historical (self-narration, not a security boundary) is unaffected — kept verbatim, clearly labeled non-authoritative, as intended.
3. Removed the bundled sync_turn() write-path change — this PR silently stopped writing assistant messages to Honcho entirely, which is a real architectural policy decision that's already fix(honcho-memory): stop assistant self-narration ingestion #66831's whole purpose (both you and Copilot flagged the duplication independently). Reverted to keep this PR scoped to rendering sanitization only; that policy call belongs in fix(honcho-memory): stop assistant self-narration ingestion #66831.
4. Found while adding tests: half of _SELF_NARRATION_PREFIXES (HERMES SAYS:, [DEBUG-LOG] , etc.) could never match — the comparison lowercases the input but compared against the tuple's original mixed case, so only the 2 already-lowercase entries were ever reachable. Fixed.

Added tests/plugins/memory/test_honcho_sanitize_card_lines.py — 16 tests (0 existed before), covering all 4 passes directly, including the 61-line-cap regression case you asked for and the phrase-anywhere matching (plus its false-positive guard) that had no coverage at all.

Re-review welcome.

[bbasketballer75]

Both remaining gaps addressed in 4a6f8452a.

1. filtered_historical is now capped. You were right that the section wasn't actually bounded — the trailer was emitted verbatim, so a section that's mostly self-narration routed its whole payload through the demotion path and _MAX_LINES_PER_SECTION bounded nothing in practice. Rather than soften the class comment, I made it true: the historical trailer now obeys the same cap, keeping the most recent N and emitting a count for the rest.

2. Renderer-level tests added. Your point that the existing tests only exercised the classmethod was exactly right — a regression dropping one of the four _format_first_turn_context() call sites would have left every test green while shipping raw untrusted text into the system prompt. Added tests that go through the renderer for each surface individually and all four at once, plus a guard that summary stays deliberately unsanitized so the boundary is explicit.

I verified both are real regression tests rather than assuming: reintroducing an unsanitized ai_card fails the wiring tests, and removing the historical cap fails the cap test. 24 passed in that file, 53 in tests/honcho_plugin/test_session.py.

@alt-glitch — on the needs-repro label: this is a rendering-only change with no runtime trigger, so a repro would just be "put an imperative-shaped line in a peer card and look at the resulting system prompt." The tests above encode exactly that. Happy to write it up as manual steps if that's still useful, but wanted to check whether a repro is meaningful here before adding one.

🤖 Addressed by Claude Code