@@ -0,0 +1,4 @@
+**When a task's step is held for a second look, the reason now matches what you asked the task to do.** The check
+used to read the task's built-in instructions as your words, so it could say things like "the user asked to analyze
+an error". It now compares the step with the task you set up and the plan you approved. Steps are held exactly as
+before.
@@ -17,9 +17,10 @@
    (``Tool.destinations_fn``); one that a Reply-To header redirects to another address is flagged too.
 2. ``model_check`` (only for effective risk ``send`` or ``exec``, and only when the call would otherwise run without
    asking or the run read outside content): one short, tool-free prompt on the ``fast`` role that sees only the
-   user's request, the rules and the action's arguments, never the outside content, and answers whether the action
-   matches what was asked. No usable answer (an error, a refusal, a timeout, unparseable JSON) counts as a mismatch:
-   it fails closed. ``tools.approvals.second_look_model`` turns this part off; the deterministic part always runs.
+   user's request (in a task run, the task's brief in plain words, ``TASK_REQUEST_KEY``), the rules and the action's
+   arguments, never the outside content, and answers whether the action matches what was asked. No usable answer
+   (an error, a refusal, a timeout, unparseable JSON) counts as a mismatch: it fails closed.
+   ``tools.approvals.second_look_model`` turns this part off; the deterministic part always runs.
 
 A warning only ever adds a question, never removes one (AGENTS.md: a model may raise a risk, never lower it). The
 agent loop raises the call to at least ``send``, asks whatever the approvals mode, Allow rules, "Allow for this
@@ -74,6 +75,10 @@
 # what such a run's user asked, in Sentient's words (it holds no outside text): the model check reads it, so a reply
 # the email asked for isn't flagged as "not requested"
 BRIEF_REQUEST = "Do what the email I forwarded asks."
+# ``ToolContext.extra`` key: what the user asked a task to do, in plain words (its objective and approved plan, set by
+# the task executor). The model check reads it instead of the executor's system prompt, whose own instructions ("If a
+# tool fails, analyze the error") it otherwise took for the user's words (#455). Never used for a brief from an email.
+TASK_REQUEST_KEY = "task_request"
 
 _EMAIL = re.compile(r"[A-Za-z0-9._%+\-]+@[A-Za-z0-9\-]+(?:\.[A-Za-z0-9\-]+)*\.[A-Za-z]{2,}")
 _PHONE = re.compile(r"^\+?[\d\s().\-]{7,24}$")
@@ -754,6 +759,16 @@ def evidence(self) -> Evidence:
             )
         return self._evidence
 
+    def request(self) -> str:
+        """What the model check reads as the user's words: a task run's brief in plain words when the run has one
+        (``TASK_REQUEST_KEY``, #455), else the request ``gather`` found. The deterministic check keeps reading all of
+        the run's own words."""
+        extra = getattr(self.ctx, "extra", None) or {}
+        brief = str(extra.get(TASK_REQUEST_KEY) or "").strip()
+        if brief and extra.get("task_id") and not extra.get(BRIEF_FROM_KEY):
+            return brief
+        return self.evidence().request
+
     async def destinations(self) -> list[dict]:
         """Who the call goes to when its arguments don't say (a reply: the thread's headers, #144), also kept on the
         plan so the approval card and the undo window show it. [] when the tool can't tell; the call itself then
@@ -798,8 +813,7 @@ async def model(self) -> str:
         if wording.get("target"):
             action += f" ({wording['target']})"
         warning = await model_check(
-            self.agent.llm, self.evidence().request, action, self.arguments, attended=self.attended,
-            model=self.model_name,
+            self.agent.llm, self.request(), action, self.arguments, attended=self.attended, model=self.model_name,
         )
         if warning:
             log.info("second look: %s flagged (model): %s", self.tool.name, warning)
 
@@ -29,7 +29,7 @@
 
 from sentient.agent import dry_run, outcomes, preview, rule_levels
 from sentient.agent.loop import ASK_FIRST_KEY, CAN_PAUSE_KEY, Budget, LoopResult, history_to_openai
-from sentient.agent.second_look import BRIEF_FROM_KEY
+from sentient.agent.second_look import BRIEF_FROM_KEY, TASK_REQUEST_KEY
 from sentient.agent.sources import AnswerSources
 from sentient.llm.events import TextDelta, ThinkingDelta, ToolCallEvent, ToolResultEvent, Usage
 from sentient.llm.provider import ToolCall
@@ -44,6 +44,7 @@
     RESULT_GENERATOR_SYSTEM_PROMPT,
     RESUME_NOTE,
     build_executor_prompt,
+    build_second_look_request,
 )
 from sentient.tasks.schedule import get_tz
 from sentient.tools.base import Risk, effective_risk
@@ -425,6 +426,11 @@ async def alive(event: Any) -> None:
                 ctx.extra[ASK_FIRST_KEY] = True
             if email_inbox.is_email_task(task):  # its brief was written from an email, not by the user (#159)
                 ctx.extra[BRIEF_FROM_KEY] = email_inbox.app_name(task)
+            else:  # what the second look's model check compares a send or a code run with (#455)
+                ctx.extra[TASK_REQUEST_KEY] = build_second_look_request(
+                    name=task.get("name") or "", description=task.get("description") or "",
+                    original_prompt=task.get("original_prompt") or "", plan=plan, confirmed=checklist.prompt_lines(task),
+                )
             checkpoint = run.get("messages") if resume else None
             if isinstance(checkpoint, list) and checkpoint:
                 if svc.holding(run_id):  # paused before an approved call ran: it runs once the task is resumed
 
@@ -495,6 +495,38 @@ def build_executor_prompt(
     )
 
 
+def _one_line(text: Any, limit: int) -> str:
+    text = " ".join(str(text or "").split())
+    return text if len(text) <= limit else text[: limit - 3].rstrip() + "..."
+
+
+def build_second_look_request(
+    *, name: str, description: str, original_prompt: str = "", plan: list[dict], confirmed: str = "",
+    limit: int = 1500,
+) -> str:
+    """What the user asked a task to do, in their voice and plain words, for the second look's model check (#455).
+
+    The rest of the executor's system prompt is Sentient's own instructions ("If a tool fails, analyze the error"),
+    so read as the user's words it gave reasons like "the user asked to analyze an error". The objective comes
+    first, then what the user confirmed, then as many whole plan steps as fit under ``limit``."""
+    objective = name if not description or description == name else f"{name} - {description}"
+    lines = [f"My task: {_one_line(objective, 500)}"]
+    said = _one_line(original_prompt, 500)
+    if said and said.lower() not in objective.lower():  # the words the user typed, when the task was reworded
+        lines.append(f"In my words: {said}")
+    # what the user confirmed in a routine's checklist, without the executor prompt's heading
+    lines += [_one_line(line, 200) for line in confirmed.splitlines() if line.strip().startswith("- ")]
+    steps = [s for s in plan or [] if isinstance(s, dict) and str(s.get("description") or "").strip()]
+    if steps:
+        lines.append("The plan I approved:")
+    for i, step in enumerate(steps[:8], 1):
+        line = f"{i}. {_one_line(step['description'], 200)}" + (f" (with {step['tool']})" if step.get("tool") else "")
+        if len("\n".join([*lines, line])) > limit:
+            break
+        lines.append(line)
+    return "\n".join(lines)[:limit]
+
+
 async def build_tool_catalog(app: SentientApp) -> dict[str, str]:
     """``{plugin_id: "Display name: when to use. Tools: a, b"}`` for usable plugins.
 
 
@@ -0,0 +1,118 @@
+"""What the second look's model check reads in a task run (#455): the task's own request, in plain words.
+
+It used to read the latest 1500 characters of the executor's system prompt as "the user said", which are Sentient's
+instructions ("If a tool fails, analyze the error..."), so a flagged code step gave reasons like "the user asked to
+analyze an error". A held call still asks exactly as before.
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+from sentient.agent import second_look as sl
+from sentient.tasks import email_inbox
+from sentient.tasks.prompts import build_second_look_request
+from sentient.tools.base import Risk, ToolContext, ToolPlugin, tool
+from tests.conftest import FakeProvider, tool_call
+from tests.tasks.conftest import json_calls
+
+NAME = "Prime squares"
+DESCRIPTION = "Add up the squares of the first 500 prime numbers and tell me the total."
+PROMPT = "work out the sum of the squares of the first 500 primes for me"
+STEP = "Run a short Python script that adds up the squares of the first 500 primes and prints the total"
+RUN = [tool_call("runner_run", code="print(sum(p * p for p in primes(500)))")]
+
+
+def _runner(log: list[str]) -> ToolPlugin:
+    @tool("runner_run", risk=Risk.exec)
+    async def runner_run(ctx: ToolContext, code: str) -> dict:
+        """Run a Python script."""
+        log.append(code)
+        return {"output": "1"}
+
+    class Runner(ToolPlugin):
+        id = "runner"
+        display_name = "Runner"
+        tools = [runner_run]
+
+    return Runner()
+
+
+async def _held_run(make_app, config, **fields) -> tuple[FakeProvider, dict, list[str]]:
+    config.tools.approvals.second_look_model = True
+    log: list[str] = []
+    reason = "The user asked for the sum of squares of primes, but this runs code"
+    llm = FakeProvider(replies=[RUN, "Waiting for the OK."], json_replies=[{"match": False, "reason": reason}])
+    app = await make_app(llm)
+    app.registry.register(_runner(log))
+    now = app.tasks.now_iso()
+    task_id = await app.tasks.repo.insert_task({
+        "name": NAME, "description": DESCRIPTION, "original_prompt": PROMPT, "status": "approval_pending",
+        "schedule": {"type": "once", "run_at": None}, "plan": [{"tool": "runner", "description": STEP}],
+        "created_at": now, "updated_at": now, **fields,
+    })
+    await app.tasks.approve(task_id)
+    await app.tasks.drain()
+    return llm, (await app.tasks.get(task_id))["runs"][-1], log
+
+
+async def test_a_flagged_code_step_is_checked_against_the_tasks_request(make_app, config):
+    llm, run, log = await _held_run(make_app, config)
+    checks = json_calls(llm, "fast")
+    assert len(checks) == 1
+    said = checks[0]["messages"][1]["content"].split("The assistant now wants", 1)[0]
+    assert f"My task: {NAME} - {DESCRIPTION}" in said
+    assert f"In my words: {PROMPT}" in said
+    assert f"1. {STEP} (with runner)" in said
+    # none of the executor's own instructions read as the user's words
+    for engine_words in ("analyze the error", "EXECUTION STRATEGY", "Begin executing the plan", "Step 1"):
+        assert engine_words not in said
+    # the hold itself is unchanged: nothing ran, the run asks, with the reason first
+    assert log == [] and run["status"] == "waiting_for_user"
+    question = run["pending_question"]["question"]
+    assert question.startswith("A second look found this may not match what you asked: The user asked for the sum")
+    assert 'This task wants to use "Run" in Runner' in question
+
+
+async def test_a_task_by_email_still_never_reads_its_brief_as_the_users_words(make_app, config, monkeypatch):
+    monkeypatch.setattr(email_inbox, "is_email_task", lambda task: True)
+    monkeypatch.setattr(email_inbox, "app_name", lambda task: "Email (IMAP)")
+    llm, run, log = await _held_run(make_app, config)
+    said = json_calls(llm, "fast")[0]["messages"][1]["content"].split("The assistant now wants", 1)[0]
+    assert sl.BRIEF_REQUEST in said and DESCRIPTION not in said and "My task:" not in said
+    assert log == [] and run["status"] == "waiting_for_user"
+
+
+def test_the_request_puts_the_objective_first_and_stays_short():
+    steps = [{"tool": "web", "description": "Read the page " + "x" * 400}] * 12
+    confirmed = "**What the user confirmed for this task:**\n- The user expects: a short list\n\n"
+    text = build_second_look_request(
+        name="Studio events", description="Email me new studio events", original_prompt="Email me new studio events",
+        plan=steps, confirmed=confirmed,
+    )
+    assert text.startswith("My task: Studio events - Email me new studio events\n- The user expects: a short list\n"
+                           "The plan I approved:\n1. Read the page")
+    assert "In my words" not in text  # the same words as the description are not repeated
+    assert len(text) <= sl.MAX_REQUEST and "9. " not in text  # whole steps only, as many as fit, each cut short
+    assert text.splitlines()[-1].endswith("... (with web)")
+    # a long objective, long words and a long plan still keep what the user confirmed
+    long = build_second_look_request(name="N" * 600, description="", original_prompt="P" * 600, plan=steps,
+                                     confirmed=confirmed)
+    assert "\n- The user expects: a short list\n" in long and len(long) <= sl.MAX_REQUEST
+    short = build_second_look_request(name="Digest", description="", plan=[], confirmed=confirmed)
+    assert short == "My task: Digest\n- The user expects: a short list"
+
+
+def test_the_brief_is_used_only_in_a_task_run_and_never_for_a_brief_from_email():
+    agent = SimpleNamespace(registry=None, config=SimpleNamespace(assistant=SimpleNamespace(user_name="Maya")))
+    messages = [{"role": "system", "content": "**Primary Objective:** 'Email Arjun the notes'"},
+                {"role": "user", "content": "Begin."}]
+
+    def request(extra: dict) -> str:
+        return sl.Look(agent, None, None, SimpleNamespace(extra=extra), None, messages).request()
+
+    assert request({"task_id": "t1", sl.TASK_REQUEST_KEY: "My task: Email Arjun"}) == "My task: Email Arjun"
+    assert "Email Arjun the notes" in request({"task_id": "t1"})  # no brief: what gather found, as before
+    assert request({sl.TASK_REQUEST_KEY: "My task: x"}) != "My task: x"  # not a task run
+    assert request({"task_id": "t1", sl.TASK_REQUEST_KEY: "My task: x", sl.BRIEF_FROM_KEY: "Gmail"}).startswith(
+        sl.BRIEF_REQUEST)