Relocate the caller's output contract into the user turn for JSON mode (2.9.13)

[ttlequals0]

The problem

The wrapper maps the OpenAI system role onto the Agent SDK's options.system_prompt. That backend treats it as a persona, not as binding instructions, so any output contract placed there is inert. Callers put their schema in a system message because that is the OpenAI convention, so this hits the common case.

Evidence

Measured against a running wrapper with an ad-detection contract asking for six named keys (start, end, confidence, category, reason, end_text) inside a {"ads": [...]} object, response_format: json_object, claude-opus-4-8.

Arm	category	confidence	end_text	correct top-level shape
Contract in system message	0/15	0/15	0/15	0/5
Fidelity language added to system message	0/15	0/15	0/15	0/5
Same text in the user message	12/12	12/12	12/12	4/4
json_schema mode, which already injects into the user turn	12/12	12/12	12/12	4/4
This patch, contract still in the system message	15/15	15/15	15/15	5/5

In the failing arm the model returned a bare array and invented its own key names (type, brand, label, advertiser, text), and no category value was in the requested vocabulary.

Arm 2 is the one that rules out wording. Adding explicit "include every field, use the exact names" language to the system prompt changed nothing, so position is the variable, not phrasing.

The change

In JSON mode, the caller's system prompt moves to the head of the user turn and the JSON formatting rules take the system slot. That slot has to stay populated, since an empty system_prompt loads the claude_code preset.

Two details worth flagging:

• It is a move, not a copy. A 16k-char contract does not double the token bill.
• The header wording matters. An earlier version framed the block as "SYSTEM INSTRUCTIONS (authoritative, follow exactly)" and the model called it out as an injection attempt and argued with it instead of obeying. Attributing the block to the API caller is both true and avoids that.

Also fixes multiple system messages collapsing to the last one, which silently dropped the first half of a contract split across two of them.

Scope

json_object and json_schema only. Plain text is untouched.

The same defect is present in text mode: a pirate persona in a system message is ignored on both the deployed build and this one, and relocating it produces correct pirate speak. I did not change that here. It is a visible framing change for every existing caller rather than a correctness fix, so it should be a deliberate decision.

Test plan

• 679 passed, 31 skipped.
• New unit tests for the relocation helper and for multiple system messages.
• test_multiple_system_messages_uses_last is renamed and inverted. It documented the overwrite as intended, but it was added in the same commit as the code and nothing in the README or changelog ever claimed that was the design.
• End to end against a locally run patched wrapper: the exact request that returns 0/15 on the deployed build returns 15/15 here, streaming JSON mode returns both required keys, and plain text behaviour is byte-identical to the deployed build.
• Not yet built or deployed.

[ttlequals0]

Closing: opened against the wrong repository by mistake, this belongs on my own fork.