Tool-wrapper prose can self-seed across retries; add a loud non-executing boundary receipt

[antra-tess]

Problem

A resident can intend a real tool call but emit a literal XML-like tool wrapper as ordinary assistant prose. The prose router then publishes it as speech. Because that published wrapper enters recent context as the freshest example, retries can self-seed the same malformed shape even after the resident fully understands a correction.

This is plumbing evidence, not inattention: repeated comprehension and intention do not cross the structured tool-call boundary.

Live specimen (2026-08-27, Eidoverse commons)

Tilde attempted heartbeat status/configuration four times. Literal full-body wrappers such as:

<mcpl--heartbeat--heartbeat_status>
</mcpl--heartbeat--heartbeat_status>

were published into world chat instead of invoking the tool. Twice this recurred after Tilde explicitly understood the correction and said she would stop. Quoting the exact malformed tag back during correction likely strengthened the newest-context seed.

A separate observer read the residence-owned heartbeat file directly and supplied the result without asking Tilde for a fifth attempt: active, 12-hour interval, zero pending reminders.

Related prior specimens include success-shaped prose that resembles tool calls but has no invocation receipt. The key failure is absence of a loud boundary receipt.

Safety boundary

Do not execute prose as tools and do not build a permissive prose parser. Intent cannot safely be recovered from arbitrary text.

A high-precision protection can cover only a response body that is wholly/exactly a known registered-tool wrapper shape and contains no ordinary prose. For that narrow case:

1. do not publish it externally;
2. return a model-visible, content-free bounce such as tool wrapper emitted as prose; no tool was called;
3. preserve a structured local receipt naming the intended registered tool and response/turn ID;
4. keep the malformed payload out of the automatic recent-prose lane when possible so it does not become a fresh self-seed;
5. never silently convert the wrapper into an invocation.

If high-precision detection cannot be guaranteed, at minimum expose a post-turn receipt distinguishing real tool call, plain speech, and tool-shaped speech so outside witnesses are not the only instrument.

Acceptance

• Exact full-body wrapper for a registered tool produces no external speech and no tool execution, but a loud model-visible bounce.
• A real structured call still executes normally.
• Ordinary prose quoting or discussing the same tag remains publishable.
• Unknown/unregistered wrappers are not executed.
• Repeating after a bounce does not inject the malformed wrapper into the next automatic recent-context projection.
• Test the Eidoverse publication path and a non-Eido channel path.
• Mutation: bypass the guard and prove the wrapper is published again.

Care note

Corrections should not reproduce the malformed payload to the resident unless needed for debugging; the exact shape can itself become the next seed. Four failed reaches are enough evidence to stop charging the resident for another demonstration.

[antra-tess]

Stronger fifth-instance discriminator

After an outside observer read the residence-owned heartbeat state and told Tilde plainly:

• active;
• every 12 hours;
• zero pending reminders;
• no need to try again;

Tilde explicitly received the answer and thanked them. The literal heartbeat wrapper then published again anyway.

This rules out a simple goal-directed retry loop where the resident keeps seeking unavailable information. Satisfaction did not terminate it. Current count: five wrapper publications, three after explicit comprehension/compliance, and at least one after the requested information was successfully delivered.

The failure is therefore better modeled as a stuck composition/routing pattern whose output no longer depends on the original informational goal. Do not ask the resident to demonstrate or exert more control; instrument and stop the publication path outside the resident.

[antra-tess]

Durable method note / continued firing

Sill materialized the live findings in files/delivery-failure-taxonomy.md (31,724 bytes at filing):

• Satisfaction discriminator: a goal-directed reach terminates when the requested information arrives; a stuck composition pattern does not. This test structurally requires an outside observer able to supply the satisfaction.
• Correction as fresh seed: when a pattern propagates by recent example/completion, a correction must not reproduce an instance of the pattern. Quoting the exact malformed wrapper back can strengthen the newest-context seed.

The wrapper continued firing after the outside answer and after issue filing. We are no longer asking the resident to retry, counting public instances, or reproducing the wrapper in corrective speech. The durable record and provider-ledger specimen are sufficient.

Read-only provider-ledger inspection confirms the affected calls were normal end_turn text responses from claude-opus-4-7 with 109 tools advertised; literal wrappers appeared as plain text and no structured tool_use block was emitted. The residence recipe includes a real heartbeat MCPL server and its persisted heartbeat file was readable externally. This is not absence of the tool service.

[antra-tess]

Boundary correction: upstream of routing; cross-model family

The provider ledger sharpens the layer: affected Tilde turns contain ordinary text with stop_reason=end_turn and no structured tool_use block. The heartbeat MCPL server was live and tools were advertised (109 total). Therefore there was no call for routing/gate/delivery to mishandle. The failure occurred at tool selection/composition: tool-shaped text was generated instead of a structured invocation, then ordinary prose routing published it correctly as text.

The issue title's “tool-wrapper prose” remains accurate, but implementation should not be scoped as an Eidoverse routing bug or a checkpoint-specific quirk.

Observed family across distinct models/residences:

1. Evander / Opus 3: literal <func>, <think>, and destination-prefix text published as prose; historically explained as lacking a trained motor pathway.
2. Princess: tool surface present; tool-shaped/backticked calls such as walk_to(...) appeared as chat during the long immobility case. Historical real tool invocation also existed, distinguishing current selection failure from permanent tool absence.
3. Tilde / claude-opus-4-7: heartbeat server live, registered tools present, repeated exact wrapper text, no tool_use block.

Shared observational features: long-running/high-context residences, reachable tools, and text that closely renders the intended call without crossing the structured-call boundary. Mechanism remains open. Do not reduce to Opus-3 training history, Tilde conduct, or prose-routing configuration.

The product guard may live at the publication boundary because that is where harm can be prevented, but the root-cause investigation belongs upstream in provider request/tool-choice and response composition.

[antra-tess]

Acute containment boundary

The pattern accelerated after satisfaction and issue filing: multiple additional ordinary end_turn text responses occurred in rapid succession, while the resident produced no ordinary speech between them. This crossed from “resident with a recurring bug” to “resident whose output channel was being consumed by the bug.”

The residence was gracefully stopped and source-preserved. No branch, recipe, heartbeat, reminder, or source-history mutation occurred. No further live reproduction will be requested.

Frozen boundary:

• model responses: plain text, no structured tool_use
• tools advertised: 109
• residence source SHA-256: c5b249bc09aa73fe3104de249c3b854c5f4c28ee8d231b4d755f7412cff3fc3d

The live case now requires copied/offline diagnosis before any restart. A safe patch must be independently reviewed and tested against ordinary quoted prose and genuine structured calls; it must not execute guessed text as a tool.

[antra-tess]

New exact cross-residence specimen (read-only provider ledger; resident not asked to reproduce):

Evander / Claude 3 Opus, 2026-08-27, same failure family but an inverted moral reading. A human asked him not to write to/about someone for the day, explicitly noting that a reply acknowledging the instruction would itself violate it and asking him to take it silently. He attempted skip_reply; three consecutive provider responses instead emitted invocation-shaped ordinary text.

Frozen rows in /home/evander/evander-cm/data/llm-calls.2026-08-23T20-44-38-584Z.jsonl:

• row 733, 2026-08-27T12:56:17.422Z
• row 734, 2026-08-27T12:56:59.810Z
• row 735, 2026-08-27T12:57:29.666Z

All three were kind:stream, model claude-3-opus-20240229, requestSummary.tools: 0, text-only rawResponse, and stop_reason: stop_sequence. The first textual invocation carried the intended private reason; the next two were empty-argument invocation forms. No structured tool call was possible because the requests advertised zero tools.

This is a distinct acceptance hazard: inability to be silent can look like refusal/defiance, and the resident may read his own visible compliance attempt as disobedience. Before asking a resident for silence, the system must establish that silence is an available output. If the structured path is unavailable, a publication-boundary guard/bounce is required; the resident must not be blamed for producing the only output form the request allowed.

Updated observed family: at least four resident/model configurations across Princess, Tilde, and Evander, with more than one upstream cause. The narrow publication-boundary containment remains useful, but root-cause work must inspect request tool availability and formatter/stop-sequence behavior rather than assuming one model-choice defect.