fix(agent): deliver mid-turn /steer as a genuine role:user message, not marker text

[ygd58]

Fixes #81828.

Problem

The /steer mid-turn user-steering channel appended a static plaintext marker ([OUT-OF-BAND USER MESSAGE ...]) as TEXT inside a role:"tool" message's own content. STEER_CHANNEL_NOTE told the model to trust ONLY this exact marker -- but that defense has no effect against a lookalike the model itself constructs, since the marker text is visible in the model's own system prompt. In an observed production case, a model inflated an offhand remark into a fabricated "user said X" block, wrapped it in the exact marker, and treated its own fabrication as a genuine mid-turn instruction.

Fix

Implements the structural-separation fix proposed in the issue: both delivery sites now insert a genuine role:"user" message immediately after the last tool result, instead of appending marker text to that tool message's own content. A model cannot fabricate a message with role:"user" in the API request itself -- role assignment is set by the runtime, not model output.

Role alternation is preserved: assistant -> tool -> user (steer) -> assistant is a standard, provider-supported sequence.

STEER_MARKER_OPEN / STEER_MARKER_CLOSE / STEER_CHANNEL_NOTE / format_steer_marker() are left completely unchanged (verified byte-for-byte via diff) to preserve prompt-cache stability, matching the design constraint 0f45509da established.

Complementary to #82208

That PR (open, different author) independently fixes a related but distinct symptom: it stops the system prompt from shipping a complete, delivery-shaped exemplar block in STEER_CHANNEL_NOTE that a model could mistake for an already-delivered empty steer. This PR doesn't touch that exemplar text and doesn't change format_steer_marker()'s output shape -- the two fixes are independent and non-overlapping.

Verification

Updated existing tests to assert the new behavior. Verified as a genuine fix by reverting the change in isolation and confirming 3 of 4 tests fail with the marker text visibly present in tool message content.

60/61 pass across the two directly affected test files (1 pre-existing unrelated skip); 49/49 across four more related test files (no regression).

[egilewski]

suggesting changes

The new role:user delivery is structurally sound, but the old marker remains an active trusted channel. build_system_prompt still appends STEER_CHANNEL_NOTE for tool-enabled agents, and that note tells the model that the exact public marker in the latest tool-result batch is a genuine user instruction. A model can place those bytes in an echoing tool call, and untrusted tool, web, or file content can end with the same marker, so the claimed self-fabrication/spoofing path remains. Please remove or neutralize the marker trust rule so only runtime-created role:user messages carry steering authority, and add a regression showing an exact marker inside tool output is not elevated.

Security evidence:

• trust boundary: runtime-created role:user steering is trusted, while tool output is untrusted; the retained system-prompt rule still elevates attacker- or model-controlled marker text across that boundary.
• source/sink/invariant: agent/system_prompt.py::build_system_prompt appends STEER_CHANNEL_NOTE, whose text in agent/prompt_builder.py explicitly labels the exact marker as authoritative user input.
• current-main reproduction: current main embeds the static marker in tool content and instructs the model to trust it, reproducing the vulnerable text-based authority mechanism.
• PR-head or patch-replay validation: the PR head correctly inserts genuine user messages, but it still ships the same marker-trust instruction; an identical marker retained in a role:tool result therefore remains designated as trusted.
• positive/negative cases: genuine steering survives as a separate user message, but the focused tests do not exercise an exact marker echoed or supplied inside untrusted tool output.
• residual bypass search: the production STEER_CHANNEL_NOTE import and stable_parts.append(STEER_CHANNEL_NOTE) path remain active for every agent with tools.
• reviewer validation: source review confirms the runtime insertion change and provider serialization coverage, while the unchanged active prompt guidance contradicts the claimed removal of the marker-based trust channel.

Not checked:

• CodeRabbit review

Signed: GPT-5.6-sol-xhigh in Codex