What does this PR do?

Reference implementation of Option B from issue #25322. Fixes the bug where the background self-improvement review's freshly-spawned AIAgent generates a system prompt that bytes-differs from the parent's, busting Anthropic prompt cache + preprocessing tree-dedup.

See #25322 for the full diagnosis, reproducer, and trade-off discussion. That issue lays out three options for fixing this bug, with different safety vs cache-hit trade-offs. This PR implements Option B (the one with maximum cache hit, at the cost of moving the safety boundary from "mechanical narrow toolset" to "prompt-layer instruction"). I'm filing it for maintainer reference / evaluation — happy to rewrite as Option A (preserves mechanical safety, accepts a slightly leaky system prompt) or Option C (smaller change, partial cache hit) if maintainers prefer.

Posting this PR alongside the issue because @Teknium asked for the code to be available as a reference; treat this as the worked-out version of one of the three branches in the discussion, not as a "please merge this" PR until we've agreed on which option is right.

Related Issue

Refs #25322 (the bug + design-space discussion)

The safety motivation for the original narrow-toolset design is #15204.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

(Behavior change for the background review pass: still produces the same memory/skill side effects, but now does so with a system message that prefix-matches the parent's.)

Changes Made

• run_agent.py: _spawn_background_review now constructs the fork inheriting
  enabled_toolsets, session_start, session_id, and _cached_system_prompt
  from the parent. The narrow-toolset call (enabled_toolsets=["memory", "skills"])
  is removed; the safety boundary moves to a prompt-layer instruction baked into
  each review prompt (_MEMORY_REVIEW_PROMPT, _SKILL_REVIEW_PROMPT,
  _COMBINED_REVIEW_PROMPT).
• tests/run_agent/test_background_review.py:
  new test_background_review_inherits_parent_system_prompt_and_toolsets
  asserts that the spawned review agent gets the parent's _cached_system_prompt,
  session_start, session_id, and enabled_toolsets verbatim.
• tests/run_agent/test_background_review_toolset_restriction.py:
  inverted the existing assertions:
  • was: assert sorted(captured["enabled_toolsets"]) == ["memory", "skills"]
  • now: captured["enabled_toolsets"] == parent_toolsets
  • plus new test: review prompts contain "Only use memory/skill tools" instruction
  • this is the most reviewer-controversial diff and the part that needs careful judgment

How to Test

Run the impacted test files:

pytest tests/run_agent/test_background_review.py tests/run_agent/test_background_review_toolset_restriction.py -v

6/6 pass on this branch.

To observe the cache-hit improvement manually: configure Anthropic provider, run an interactive session, trigger a background review (memory- or skill-relevant turn), and inspect cached_tokens in the response of the review's HTTP call. Before this PR: 0. After: matches the parent's cached prefix size.

The empirical reproducer for the underlying bug (showing that parent and review system messages bytes-differ) is in #25322.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs — no duplicate
• My PR contains only changes related to this fix
• I've run the impacted test files; all pass
• I've added tests for my changes — new positive test for inheritance + inverted the existing restriction tests + new test for prompt-layer instruction
• I've tested on my platform: Ubuntu 24.04

Documentation & Housekeeping

• I've updated relevant documentation — N/A (internal behavior change; no user-facing config keys or commands added)
• cli-config.yaml.example — N/A, no config key changes
• CONTRIBUTING.md / AGENTS.md — N/A
• Cross-platform impact — N/A, internal agent logic
• Tool descriptions/schemas — N/A

Open question for maintainers

The safety relaxation is the part of this PR that I genuinely don't know is the right move. The two questions I'd want maintainer judgment on:

1. How often do background-review passes empirically try to invoke non-memory/skill tools? If literally never, prompt-layer enforcement is fine. If sometimes, mechanical lockdown (Option A) is the better fix shape.
2. Are there downstream invariants in run_agent.py that assume _cached_system_prompt content matches the agent's actual tool_schemas? I haven't found any, but a more careful audit by someone who knows the cache-control machinery would catch what I missed. Option A would put us in that "system prompt describes tools the model can't call" state, which is benign in API semantics (the model just discovers unavailability when it tries) but might break some sanity check.

If maintainers prefer either Option A or Option C from #25322, I'll close this PR and re-open with the alternative. The work to switch is small — most of the diff here is the test inversions, not the production change.