# Runtime-Injected State Contract

Some of the agent's effective operating environment must remain live rather
than be copied into a durable reference file. This is not optional context;
without it, a model follows correct general rules against the wrong task or
wrong filesystem state.

## State that must be injected per task

```text
current user message
working directory/repository root
applicable repository instructions
available tools and exact input schemas
current model/backend/runtime capabilities
current date/time when relevant
git/working-tree state when editing is in scope
current task epoch and active steering
current source evidence with path/version/range/visibility
recent mutations and current verification results
external process/service/hardware observations when relevant
```

The durable contracts tell the model how to use this state. They do not replace
it.

## Placement in a model request

Use this order:

1. stable agent core and applicable phase procedure;
2. repository-local instructions;
3. compact current environment/root facts;
4. active task objective and user request;
5. current source/tool evidence;
6. active steering and current verification frame;
7. tool definitions.

The most current user intent and evidence should be late enough to remain
salient. Generic process must not crowd out the current task.

## State freshness

| State type | When it is stale |
| --- | --- |
| File content | content/hash/mtime changed or only partial body was seen |
| Test result | relevant source/config changed after it ran |
| Git status | filesystem mutation or external work may have occurred |
| Service identity | process restarted, package changed, or health source is mutable |
| Hardware placement | model process/device allocation changed |
| User steering | newer steering supersedes it or reconciliation completed |
| Tool availability/schema | runtime surface changed |

## Retention and privacy

Keep only decision-relevant runtime state in ordinary model context. Put large
raw outputs, complete compaction audits, verbose logs, and historical
transcripts in durable inspectable artifacts. Rehydrate exact content only when
the next decision genuinely needs it.

Do not silently inject old controller summaries, old tool failures, or retired
task state as if they were current truth.

## Runtime-state failure modes

| Bad representation | Consequence | Correct representation |
| --- | --- | --- |
| Generic goal, no current user wording | Agent solves old/imagined task | Current user objective late in request |
| Hash without source body | Agent thinks it can edit unseen text | Explicit visibility=false, allow read |
| Old pass after edit | Agent claims stale verification | Mark proof stale by affected paths |
| Mutable disk package version | Old daemon appears upgraded | Immutable boot identity |
| Tool transcript treated as instructions | Prompt-injection confusion | Tool provenance plus evidence-only semantics |