Tell Claude and Codex when a turn wasn't written by the user

[ImSynem]

Problem

In v2, the provider gets every user-role message as a plain user turn, whoever wrote it. To Claude and Codex these all look the same:

• me typing in the web or mobile client
• another thread's t3_thread_send
• a schedule_task prompt
• a delegate_task brief, in the child thread
• T3's own notices, such as "Delegated task ... reached a terminal state"

T3 already knows which is which. Each message carries createdBy, creationSource, scheduledTaskId and senderThreadId, and ProviderAdapterV2TurnMessage hands all four to the adapters. The adapters then send only the text. makeClaudeUserMessage builds a plain SDKUserMessage, and Codex's toCodexInput sends a plain text item.

Two things break when the agent can't tell:

1. Consent. My agent instructions say messages, purchases and account changes need my approval. "The user approved this" sent by a sibling thread reads exactly like my approval. A scheduled prompt or another thread's message carries my authority by default, and that's also how prompt injection would travel between threads.
2. Memory. A prompt hook records what I say, word for word. On 2026-10-03 a resumed thread was about to record another agent's resume message as mine. My workaround has the hook look the author up in statev2.sqlite, which breaks whenever the projection schema changes. [Bug]: Delegated-task notifications cancel queued Claude tool calls and tell the agent the user refused #15351 has the same cause. A delegated-task notice arrives as a user turn, and Claude then tells the agent "the user refused" its cancelled tool calls.

Proposal

When a turn's createdBy isn't user, mark it in what the provider receives, and name the sender: the thread, scheduled task or delegated task that wrote it, or T3 itself. Turns I type stay exactly as they are.

The format is your call. The options I can see are a text wrapper the model won't mistake for me, along the lines of Claude Code's <cross-session-message from="...">, or structured metadata where a provider supports it. Either way the adapters are the natural place, since they already have the fields. The historical context that ContextHandoffBudget renders could carry createdBy the same way, so a handed-off transcript keeps the difference.

What would count as done:

• A t3_thread_send, a scheduled prompt, a delegated brief and a T3 notice each reach Claude and Codex marked with their sender.
• A message I type reaches them unchanged.
• Each adapter has a test for both cases.

A related detail

The WebSocket dispatchCommand handler in ws.ts runs every command through withCreationProvenance with createdBy: "user", which overwrites it on message.dispatch. So a script that sends over the WebSocket can't label its messages as an agent's, although OrchestrationV2Actor allows agent. Once agent turns are marked, it would help if such a client could say so. Happy to file that separately if you'd rather keep this to one change.

Related

• [Bug]: Delegated-task notifications cancel queued Claude tool calls and tell the agent the user refused #15351: delegated-completion notices are already createdBy: "agent" and creationSource: "server", and still reach Claude as a user turn.
• [Feature]: Append attributed external-agent messages without starting a provider turn #6908 asks for attributed external-agent messages in the timeline. That's about what the UI shows. This is about what the provider sees.
• feat(web): agent-to-agent messages read like messages #15084 makes agent-to-agent messages read like messages in the UI, and leaves provider input unchanged.

I searched issues, PRs and discussions for sender or provenance marking in provider input and found nothing else. Happy for this to be folded into #6908 if you'd prefer one thread.

[joshka]

Some context on how I use this. I run a main thread that coordinates a set of smaller tasks. They have an order, but run in parallel, and some depend on each other's output. So messages go from the main thread to child threads, from children back to the main thread, and sometimes between siblings. I mostly read these threads by dropping into one partway through, not by following along from the start.

That adds a reason for this, separate from consent and memory: who reads the reply. When I open a child thread, I usually haven't read the prompt that started it. The agent writes as if the reader asked the question, so its answer covers the result and skips what was asked. That works for the agent that sent the prompt, but not for me catching up. I'd fix that in my own instructions: "if another agent sent this turn, start with a short recap of the ask". But the agent can't follow that rule until something in its input marks the turn (#17517 is the read-side gap).

The marker should also say the sender's ID is a T3 thread ID. When providers are mixed, a Claude thread may get a message from a Codex thread, and that ID means nothing to Claude's own session or subagent tools. The model will try those first unless it's told the ID belongs to t3_thread_read and t3_thread_send.

I'd rather the wording not be fixed in the harness. People set up orchestration differently. Some want the sender's title and task ID on every turn, some want one short line, and some want no injected text at all (#19790, #17205). A built-in wrapper picks one of those for everyone, and a settings toggle only picks between a few. A cleaner split:

• T3 records the facts: sender kind (thread, scheduled task, delegated task, T3 itself), T3 thread ID and title, and task ID.
• A small default marker carries them to the model, and a user hook or template can replace it.
• AGENTS.md decides how the agent acts on it, such as replying with a recap or asking before trusting it.

T3 stays responsible for what's true, and the user decides how it reads. That suits a feature people are still working out how to use.

🤖 Claude Opus 5.5