Marker words whose delimiters a delivered body must not be able to write:
the jekt block, the Swarm broadcast header (broadcast_turn_message), and
the [AgentMux] that begins srv’s own system notes
(muxbus::delivery_status::notes::NOTE_MARKER; only srv writes one, and
delivers it without a jekt block). Each is quoted as [<WORD>-QUOTED....
Keywords that are matched as substrings (they are distinctive enough that
substring matches are always sensitive — no common English words contain them).
Keywords that must appear as whole words (surrounded by non-alphanumeric
characters or at string boundaries) to trigger SENSITIVE escalation, paired
with whether a simple trailing “s” (plural) should also match.
This prevents false positives from substrings like “patch”, “dispatch”,
“pattern”, “tokenize”, “compatibility”, etc.
Returns true if haystack contains needle as a whole word, or — when
allow_plural is true — as a whole word plus a simple trailing “s” (so
“tokens”/“secrets”/“credentials”/etc. match the same as their singular
form; see doc comment on SENSITIVE_WHOLE_WORD_KEYWORDS for why plurals
were previously missed, and why some keywords opt out).
Characters a reader can’t see but a model may still read: zero-width and
word-joiner characters, BOM, soft hyphen, bidi controls, and the Unicode
tag block. ZWJ/ZWNJ (U+200C/U+200D) are kept — emoji and several
scripts need them — and are skipped when matching delimiters instead.
A value rendered into the marker as one KEY=value field. Only
printable ASCII survives (agent ids are ASCII); =, [, ], spaces and
everything else — including invisible and bidi-control characters —
become _, so a sender-controlled value can’t add or disguise fields.
If chars[i..] starts a marker delimiter — [, optional /, word,
then : or ], with whitespace/ZWJ/ZWNJ allowed between the parts and
fullwidth forms accepted — returns its length and whether it closes.
The message body as it goes inside the block: marker delimiters quoted,
so the body can’t close the real block or open one of its own. The body
has already been through sanitize_message, which dropped invisible
characters and carriage returns; this only replaces delimiters, so it
can’t create text a content check didn’t see.
Text that goes inside one of srv’s own [AgentMux] system notes but was
not written by srv: another agent’s claim note or topic, a file path, a
branch or agent name. Sanitized like a delivered body, flattened to one
line (every control character and line break becomes a space, runs of
whitespace collapse), and with marker delimiters quoted, so it can neither
start a line of its own nor open an [AgentMux] note, a jekt block or a
broadcast header.
The id a name registers under: its route name, when that is a valid id.
A name with ‘@’ keeps it (it is kept for forwarding a target across
tiers), and no message could reach it here, so it doesn’t register (#4744).
The route name of a name arriving at the registry (a registration, an
unregistration, a message’s target), None for a blank one. A fork’s
display name “Loap #3” is “Loap-3” (REPORT_FORK_AGENT_ISOLATION_2026_10_12.md F3).