File: agents/protocol/src/index.ts

seedAssistantSystemPrompt({currentTime?, contextLines?}) (line 14) holds the shared Seed instructions: HM resource types, hm:// link formatting, the exact-block-ID rule, profile and :profile reads, :attributes, reading the activity feed with read activity:, and directory-then-children exploration.

It takes no tool-specific options. There is no title-tool instruction. A separate model call generates session titles, and the agent holds no tool for it.

File: agents/src/api-service.ts, Service.#agentSystemPrompt() (line 4169). In order:

the user-configured AgentDefinition.systemPrompt, stored as Seed blocks and converted to resolved markdown;

seedAssistantSystemPrompt(). The agents server passes no currentTime: the clock reaches the model as a per-turn block (below), so the system prompt stays byte for byte the same between turns and the provider's prompt cache holds;

the memory prompt (line 4184). It is always included, because memory is a read and write address and belongs to no tool group. It describes ~/memory/, the check-memory-first habit, whole-file rewrites, {fromUrl} downloads, read ipfs://, write ipfs:// publishing, and that chat attachments are session-private and read with read attachment:<id>;

the user-actions prompt (line 4190): "Your user holds the same verbs you do… entries tagged <user_action>/<user_action_result> are actions the user ran themselves — read their results as shared ground truth";

<available_signing_identities> JSON plus signing and publishing instructions, only when the agent has signing keys. This includes the publish recipe and the parent-must-exist rule.

Nothing in this prompt depends on what the session has done or on the state of the agent's Space, so every request of a session starts with the same bytes. GetSession returns the assembled prompt followed by the current Space index as systemPromptMarkdown (line 5042) for UI inspection. That dialog is the ground truth for what the agent is being told.

File: agents/src/api-service.ts, buildSpaceIndex() (line 5900).

Every turn's input is followed by a <space> block, the Space index. It is one of the per-turn state blocks, not part of the system prompt: it changes whenever the agent writes a memory file or gains a tool, and a system prompt that changed with it would lose the provider's prompt cache for the whole conversation. It has one line per enabled tool document (- name — summary, with authored tools tagged (authored)), a one-line summary of the memory top level, and the names of active triggers. It is cached per (account, agent, callable set), invalidated on memory and tool writes, and collapsed to counts above 2048 bytes.

For review, this matters: an agent's own authored tool text lands in its prompt. A lambda's summary reaches the system prompt through this index. Its description (bounded at 16 KiB) reaches the model in full whenever the tool is expanded or promoted. Both are model-authored text that comes back as instruction-shaped context. This is intended, because the agent configures itself. It is also the one prompt source the agent writes.

None of these are stored as events. The first six are also not stored in the session's durable store: a hook adds them to every provider request of the turn, right behind the turn's input (turnStateMessages in #runPiAgent).

<space>: buildSpaceIndex(), the Space index described above, as it stands when the turn starts.

<delegation_budget>: delegationBudgetBlock(), how many children the run may still start. Absent until it has started one.

<plan_state>: planStateBlock() (line 414), rendered once per turn. The plan verb writes no transcript event, so this block is how a resumed model sees the checklist it published. Step ids and labels pass through escapeActionFraming(). A checklist that fully settled under an earlier run is not injected. The new turn retires it to the run that owned it (#retireSettledSessionPlan) and starts with no plan, so a new request never brings back a finished list.

<context_usage>: contextUsageBlock(), how full the model's context was on the last turn, only where the run may continue the session.

<session_status>: sessionStatusBlock(), the session's current title and description.

<current_time>: the time the turn started.

<background_work_update> (#importSessionLog): the turn's input when a park-resume has no new user message to answer. The children's results are already in place of their placeholders. It tells the model its children finished and to act on their results. A turn resumed after a restart with nothing else to answer gets <turn_resumed> in its place. Both are stored in the durable conversation and never in the log.

<window_context> (line 4914): the desktop's current window. It arrives as context content parts and is formatted by formatWindowContextLines() (frontend/packages/ui/src/agents/assistant-window-context.ts). It stays out of the durable message content, so transcripts stay clean.

<attachments>: formatAttachmentMetadata() (line 5970) lists name, MIME type, size, and id for each attached file, and never the bytes. Its guidance uses the verbs: read attachment:<id> to see an image or read a text file, write ~/memory/<path> with {fromAttachment} to keep one across sessions, and write ipfs:// with {fromAttachment} to publish one. It ends with "Only read what you need." Until 21a492a51 it named the deleted view_attachment, attachment_to_memory, and attachment_to_ipfs tools. This section exists to catch that kind of drift.

These are written as real events with actor: 'system' (see actor), so they are part of the log record. They are not per-turn nudges:

continuationPrompt() (line 447): every open obligation at once, when a turn ends still owing something;

unmetObligationsNotice() (line 457): the closing notice when the continuation budget is spent.

File: agents/src/api-service.ts, triggerPromptMessage() (line 6138). The first user message of a triggered session carries three things. The first is the trigger prompt as resolved markdown. The second is a <trigger_context> JSON block with trigger, firing, and activity details. The third is a <trigger_instructions> block. It tells the agent to reply as a threaded comment with the write verb, and names where in the context to find the target document id and replyTo.

This is not a system prompt. It is model-facing prompt text built from activity that other people wrote, so review it together with system-prompt changes.

File: agents/protocol/src/tool-registry.ts

A tool's description and its JSON-schema field descriptions are model-facing instructions. For the five verbs they are long. The delegate description alone carries the parallelism rules and the whole ctx surface. The registry is shared with the desktop assistant runtime where the runtimes overlap. Contracts also reach the model at runtime through read ~/tools/<name> and through touch-expand misses on call.

contractMarkdownForThisServer() (line 7641) narrows the execute contract to the runtimes this server can run. The model is never told about a capability that would fail.

#generateSessionTitle() (line 2966) runs one small model call with no tools. It has its own fixed system prompt ("You are a session-titling assistant…") and reads a digest of the conversation. It uses the shared provider runtime, so subscription-auth providers produce titles correctly.

The harness of a turn is built from an empty registry. #runPiAgent installs one extension in it, holding the assembled prompt as its only system prompt section, the turn's verbs as its only tools, and one hook. Pi Durable discovers nothing by itself: it reads no AGENTS.md, prompt templates, skills, or settings files, and its coding tools (read, write, edit, bash) are a separate extension that Seed never installs.