Lookout notes carry task replies with no origin, so the approver reads them as the person's #317

Since #310, each lookout note quotes every ended task turn's final reply, with each line prefixed by > to mark it as the task's own words. The note is sent without an origin, as Sonny's notes have been since the lookout began, so that it counts as the person's permission. As a result, approver::by_origin labels the whole note person. In auto mode, a task whose reply was prompt-injected could put wording into the lead's prompt that the approver judges as the person's authorization for a risky unsandboxed call. The > marking does not stop that.

This tradeoff was chosen knowingly. Without the reply, the lead has to spend an extra wait round at very large context for every ended turn, and that cost more than this risk. Under the project's safety stance (personal harness; log edges like this rather than over-engineer them), it is recorded here and not fixed in #310.

Possible fixes, if it ever matters:

• The daemon keeps origin per segment of a prompt, so the approver sees the quoted reply as bot:TASK and the rest as person.
• The note is sent with an untrusted origin. This loses "notes count as the person's permission" for the person's own quoted words, so they would need their own segment.

Raised by Codex's security review on #310.