Prompt Library: keep field provenance visible
Provenance and version checks support review; factual confirmation stays with the reader.
A plausible value becomes harder to question once it is embedded in a polished prompt. Prompt Library makes that intermediate step visible: the host proposes named field values, the service validates and stores them, and the app presents the draft for review before copying. The interesting engineering choice is preserving enough context to inspect a value without importing the whole conversation into the template service.
A label is a claim to inspect
The field schema accepts provided or inferred as its source label. An inferred value requires nonempty evidence, which may be supporting context or an explicit assumption. Missing fields remain visible in the interface. There is no third confirmed provenance type in this version. User review is an action in the workflow; it does not turn a supplied source label into independently verified truth. Both the label and its evidence arrive as metadata from the caller.
That boundary shapes context selection. The server has no independent chat-history access and makes no model API call. The host is asked to use relevant conversation context for the selected fields, preserve unrelated reviewed values when revising, and leave unknown facts missing. Selecting a template alone does not authorize filling or saving. A deliberate fill action sends a host message; unsupported message capability has a copyable-request fallback. These mechanisms reduce accidental context transfer, but service validation cannot establish whether a host chose the right fact or followed the context instructions.
Review the same draft that gets copied
A prepared draft stores an immutable template snapshot alongside values and a version. Updating values checks the expected version, including in the owner-scoped database update. The update replaces the entire value list: callers must retain unchanged entries because omitted fields become missing. This is a concrete tradeoff. Replacement makes the resulting state explicit, while requiring the caller to preserve the complete intended set rather than treating an update as a patch.
For saved drafts, the UI fetches the rendered result again before copying and compares identity, version, values, missing fields, and text with the reviewed draft. Changed content returns the reader to review. Required missing values and unsaved edits block the UI copy action; a fixed template without fields can be copied directly. This guards against copying a different revision from the one inspected. It remains a UI workflow gate: other MCP clients can obtain incomplete rendered text for review. No prompt-execution or submission tool follows the clipboard step.
The transferable insight is to preserve separate answers to three questions: where did this value come from, what did the reader inspect, and which saved revision is being used? Provenance helps direct attention; snapshots and version checks preserve identity over time. Neither mechanism confirms the underlying fact. Adding these controls costs another visible review step and more explicit state, which is useful when a fluent draft would otherwise conceal assumptions.
A suggested ten-minute reader check
Inspect the pinned schema with a synthetic field in mind: an inferred deadline with an empty evidence string should be rejected; supplied evidence should satisfy the schema without proving the deadline. Trace update_draft and note what happens to omitted values and stale versions. Then read the copy comparison contract. Expect a changed saved draft to require another UI review. This source check does not establish clipboard permission, host message routing, model accuracy, or public installation availability.
Pinned validation, snapshots, and versioned updates