{"version":"2.1.236","anchor":"host-supplied-context-lines-in-the-safety-classifier-with-li","canonical_anchor":"host-supplied-context-lines-in-the-safety-classifier-with-li","heading":"Host-supplied context lines in the safety classifier, with live and restored trust levels","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.236\/e\/host-supplied-context-lines-in-the-safety-classifier-with-li","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.236","markdown":"### Host-supplied context lines in the safety classifier, with live and restored trust levels\n\nThe safety classifier now sees notes from the hosting app, treating live ones as possible user consent.\n\n**What**\n\nThe application hosting the agent can attach a note after a tool result, and the safety classifier now sees it as its own transcript line. Two kinds exist: `host_context_live`, attached during this session, which may relay real user input and can satisfy a soft block's consent requirement, and `host_context`, restored from saved session state, which never establishes user intent. The classifier prompt describes both. Emission of the live variant has a kill switch, `tengu_disable_live_host_context`.\n\n**Details**\n\n- Notes reach the transcript from a post-tool hook or an in-process tool return.\n- Entries are fed to the classifier as `{ type: \"host_context\", ..., context, live }`.\n- The prompt text, both keys, and the entry shape are all absent from 2.1.235.\n\n**Evidence**\n\n`tengu_disable_live_host_context`, `EVa = \"host_context_live\"`\n\n- Flag `tengu_disable_live_host_context`: Off in both readings (read for one account on one subscription tier against v2.1.236; this account: off, anonymous baseline: off, compiled default: off)\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 5\/5"}