feat(engine): eager sub-agents and goals by default, with clearer tool text

The founder-approved 0.10.3 batch from
artifacts/eager-delegation-20261107/FINAL-CHANGES.md, all ten items. This is
one declared re-pin of the session-pinned prefix (docs/CACHE.md): BASE_PROMPT
and several eager tool descriptions change on upgrade, and nothing changes
mid-session.

1. BASE_PROMPT gains "Delegation and goals". Independent parts of a request
   go to `agent` children started together in one message. Results arrive on
   their own, so never poll or sleep, and end the turn when only waiting
   remains. Each child gets a complete prompt and a disjoint file scope; the
   parent inspects a write-capable child's evidence, reviews the final diff
   and runs the checks. An independent reviewer tries to refute a
   non-trivial change before it is called done. `create_goal` is for any
   direct request, in any language, that describes a verifiable end state
   needing more than one turn. A goal is blocked only when the same concrete
   obstacle persists; difficulty is not blocked. Cost alone is not a reason
   to stop, and only limits the user or configuration sets apply. The scope
   line keeps express authorization for spending real money (purchases, paid
   providers, billing) and adds the founder-approved sentence "Sub-agents,
   workflows and goals within the current request are in scope."
   GOAL_CONTINUATION_PROMPT drops the stale tool_search sentence (update_goal
   is eager), asks for remaining independent work to be split across agent
   workers before the next verification pass, and uses the same blocked rule.
2. The engine no longer appends the Operate contract (record_mode_context).
   Its reviewer, cost and write-child-evidence lines now live in BASE_PROMPT
   for every session. Every saved wording stays recognized, so restored
   sessions replay it as internal state and compaction still keeps it.
3. The agent start receipt carries `next`: "Results arrive automatically;
   continue other work or end your turn."
4. The agent description leads with intent ("Delegate focused work and keep
   working. Start early; one agent per independent part, same message."),
   gives one trigger per role, adds a child-prompt brief with one worked
   example, names `workflow` and `Run` as the real tools, and drops the
   "In Operate" and "Legacy action=" sentences. The schema is unchanged.
5. create_goal, its token_budget property and update_goal (description and
   status property) say when to start a goal and what complete, blocked and
   yield mean, without judge jargon. The status enum and parser are
   unchanged, and the token_budget parameter stays.
6. The bundled goals skill (personal resolutions in goals.md) becomes
   personal-goals with `aliases-for: goals`, so saved references still
   resolve and the skills index no longer reads like goal mode. It keeps the
   generation-12 introduction, so a user who deleted goals does not get it
   back. On upgrade, an untouched goals copy (a shipped body by hash,
   SKILL.md its only entry, and no personal-goals directory yet) is renamed
   to personal-goals and then refreshed by the ordinary generation-20
   upgrade, because its body hash is listed under personal-goals. An edited
   or extended copy stays where it is. Known limitation: a
   `[skills.bundled]` entry that names "goals" now reports as unknown and
   does not apply to personal-goals.
   delegate no longer forbids delegating final verification and treats the
   roster as optional; best-of-n uses the general and implement roles and
   drops "In Operate mode" and the 16-worker figure. v4-best-practices is
   not changed: it is a cfg(test) v4 migration fixture, not a bundled skill,
   so editing it would falsify the fixture and reach no user.
7. The tasks schema stops advertising mode=operate; the hidden legacy alias
   schema and the free-string parser still accept it. harness no longer names
   the hidden rlm tool (description and overview), list_dir loses its
   harness meta sentence, and TOOL_SURFACE.md (and zh_hans) drop Operate.
   goal.rs's `Run action="verifiers"` names a real deferred tool, which a
   well-formed first call activates, so it stays.
8. Workflow max_concurrent defaults to 64 (was 16), matching sub-agents. The
   workflow-js per-run clamp WORKFLOW_MAX_CONCURRENT moves from 16 to 128,
   the sub-agent hard maximum; without it the clamp would have kept every run
   at 16 and explicit configs above 16 would not take effect. No spend caps
   are added, and the high-budget approval trigger is untouched because the
   default token budget is 0. Docs and config.example.toml follow.
9. Each child's task message ends with its name, its scope (read-only, or
   may edit files within its assignment) and "Your final answer is delivered
   to the parent automatically; include the result and its evidence." This
   is the child seed built by the runner in subagent/engine.rs, beside the
   role prompt that carries SUBAGENT_OUTPUT_FORMAT; the role prompts that
   children share are unchanged.
10. tool_search lists the commonly registered deferred groups (Git, Run, Web,
    tasks, github, automation, lsp, review, session_search, terminal/*,
    apply_patch, grep_files, MCP) and says a listed tool can be called by
    name. Memory tools are opt-in, so they are not listed. Generating the
    list from the live catalog is the next-patch item.

Bytes and cache:
- /preview-request before, installed 0.10.3 (7b8a634, catalog-equivalent
  to main) on macOS with an isolated offline HOME: tool schemas 40,854
  canonical JSON bytes, system 16,662, base prompt 3,336, 18 active of 59.
- /preview-request after, a debug build of this diff on Linux (Boat farm)
  with the same isolated offline HOME and prompt: tool schemas 40,173
  canonical JSON bytes (-681, eager bytes did not grow), base prompt 4,352
  bytes.
- Source delta on eager tool schemas: -681 bytes (agent 2,370 -> 1,737,
  create_goal -244, update_goal -129, tool_search 71 -> 396). BASE_PROMPT
  grows to 4,352 bytes in the system region.

Tests changed with the behavior: prompts.rs
universal_prompt_does_not_expose_control_plane_ceremony no longer forbids
"sub-agent" and "dispatch, join" (the founder reversed that decision) and
still forbids sentinel and runtime-event jargon; the deleted
agent_tool_description_states_the_operate_child_approval_rule pinned the
dropped Operate sentence; the tasks enum test, the workflow default tests,
the Operate probes (now 0 contracts) and the delegate generation-18
reconstruction chain follow; the skills fixture moves to generation 20, with
the old delegate and best-of-n bodies and the old goals body (under
personal-goals) listed by hash. The prompt and event
conformance goldens are re-recorded for the re-pin.

Verified on the Boat farm (Linux x86_64), base 4c5426f9/f0fb6adb plus only
this diff (engine.rs, subagent/mod.rs, subagent/tests.rs, tasks.rs and
config.example.toml shipped as HEAD plus this batch's hunks):
- cargo test -p codewhale-engine --lib, focused filters (prompts, goal,
  tasks, harness, canonical actions, agent description and parent surface
  ceiling, lifecycle, launch receipt, assignment prompt, limits, compaction
  last round, tool catalog, runtime handoff, registry, workflow): 533
  passed, 0 failed. The final state on base f0fb6adb, same filters
  plus core::engine::tests::operate_ and mode_notice: 539 passed, 1 failed.
  The failure, create_mode_enum_advertises_neither_operate_nor_yolo, came
  from the farm copy of tasks.rs missing this commit's third hunk; the
  first run carried exactly the committed tasks.rs, and the test passed.
- cargo test -p codewhale-skills: 182 passed, 0 failed, on the final rename
  migration; a throwaway migration check (not committed) covering untouched,
  edited, extended, deleted and fresh installs: 5 passed.
- cargo test -p codewhale-config --lib workflow_config: 3 passed;
  cargo test -p codewhale-workflow-js: 12 + 82 passed.
- cargo test -p codewhale-tui --lib conformance::prompt::
  conformance::events::, update pass then compare pass: 5 passed each; the
  re-recorded goldens come from that run on base cd7f5b32 (conformance tool
  schemas 19,840 -> 19,792 bytes, system +1,033 bytes, matching the source
  delta); nothing that landed since touches the surfaces they capture.
- cargo clippy -p codewhale-engine -p codewhale-skills -p codewhale-config
  -p codewhale-workflow-js --all-targets --all-features with the Lint job's
  flags: clean; skills clippy re-run on the final migration: clean.
Local: rustfmt clean on every touched file; scripts/preflight.sh --check
passes except the blocking-calls budget, which fails only on another
session's untracked crates/engine/src/session_image_prune.rs (4 > 0), not
part of this commit; dead-code budget 137 of 137.
Not verified: a macOS run of the after binary (the before figure is macOS,
the after figure Linux; the measured -681 equals the source delta), any
live provider turn, and DSH's sleep/poll probe on the target models.

Refs: CW-7852
Co-Authored-By: Claude Opus 5.5 <[email protected]>

config.example.toml

@@ -1758,7 +1758,7 @@ base_url = "https://integrate.api.nvidia.com/v1"
 # # Optional owner-selected total child limit. Zero leaves work uncapped.
 # max_children = 0
 # # Maximum concurrently live agents inside one run (others wait for a slot).
-# max_concurrent = 16
+# max_concurrent = 64
 # # Optional structural Workflow depth limit; zero leaves it uncapped.
 # # This is separate from Runtime child delegation below.
 # max_depth = 0

crates/config/src/service_toml.rs

@@ -25,7 +25,7 @@ pub struct WorkflowConfigToml {
     /// Operator-selected total child limit. Zero leaves total work uncapped.
     #[serde(default = "default_workflow_max_children")]
     pub max_children: u32,
-    /// Maximum concurrently live agents inside one Workflow run (product: 16).
+    /// Maximum concurrently live agents inside one Workflow run (product: 64).
     #[serde(default = "default_workflow_max_concurrent")]
     pub max_concurrent: u32,
     /// Maximum structural nesting depth accepted for Workflow IR.
@@ -56,7 +56,7 @@ pub(crate) fn default_workflow_max_children() -> u32 {
 }
 
 pub(crate) fn default_workflow_max_concurrent() -> u32 {
-    16
+    64
 }
 
 pub(crate) fn default_workflow_max_depth() -> u32 {

crates/config/src/tests.rs

@@ -8490,7 +8490,7 @@ fn workflow_config_defaults_match_product_surface() {
     assert!(defaults.auto_start_read_only);
     assert!(defaults.require_approval_for_writes);
     assert_eq!(defaults.max_children, 0);
-    assert_eq!(defaults.max_concurrent, 16);
+    assert_eq!(defaults.max_concurrent, 64);
     assert_eq!(defaults.max_depth, 0);
     // 0 = no shared cap; budgets are opt-in, matching the parent turn loop's
     // advisory policy (#6189).
@@ -8533,7 +8533,7 @@ default_token_budget = 50000
     // Unset keys keep product defaults.
     assert!(workflow.auto_start_read_only);
     assert!(workflow.require_approval_for_writes);
-    assert_eq!(workflow.max_concurrent, 16);
+    assert_eq!(workflow.max_concurrent, 64);
     assert_eq!(workflow.max_depth, 0);
 
     let serialized = toml::to_string_pretty(&workflow).expect("workflow serializes");

crates/engine/src/core/engine.rs

@@ -9689,30 +9689,14 @@ impl Engine {
     /// new one is appended whenever the mode differs from the latest. Restored
     /// Operate contracts also require a current notice after leaving Operate.
     /// Child and RLM hosts get none: their mode is fixed by their parent.
-    /// Record the mode notice and, on entering Operate, the Operate contract
-    /// (docs/MODES.md), which precedes the first Operate prompt. KV-cache
-    /// effect: append-only history, user-role runtime messages; derived from
-    /// the session log rather than a flag so a cleared, restored, or compacted
-    /// session gets the contract again exactly once and every later Operate
-    /// step does not repeat it. Runs at turn start and before every model
-    /// request, so a mode switched mid-turn reaches the next request. Known
-    /// limitation: a response already streaming is not restarted for a mode
-    /// change; it finishes under the notice it was sent with, and its tool
-    /// calls are planned under the new posture. Returns whether anything was
-    /// appended.
+    /// Runs at turn start and before every model request, so a mode switched
+    /// mid-turn reaches the next request. Known limitation: a response already
+    /// streaming is not restarted for a mode change; it finishes under the
+    /// notice it was sent with, and its tool calls are planned under the new
+    /// posture. Returns whether anything was appended.
     fn record_mode_context(&mut self, mode: AppMode) -> bool {
         let before = self.session.messages.len();
         self.record_mode_notice(mode);
-        if mode == AppMode::Operate
-            && !self
-                .session
-                .messages
-                .iter()
-                .any(crate::runtime_handoff::is_current_operate_contract_message)
-        {
-            self.session
-                .add_message(crate::runtime_handoff::operate_contract_runtime_message());
-        }
         self.session.messages.len() != before
     }
 

crates/engine/src/core/engine/tests/test_cases_04.rs

@@ -348,7 +348,7 @@ async fn operate_never_promotes_wording_to_a_goal() {
         "the host must not infer a goal from wording"
     );
     assert!(!active);
-    assert_eq!(contracts, 1, "Operate appends its contract exactly once");
+    assert_eq!(contracts, 0, "Operate appends no contract");
 
     let (objective, active, contracts) = operate_goal_probe(AppMode::Agent, prompt).await;
     assert_eq!(objective, None, "Work must not promote a prompt to a goal");
@@ -365,7 +365,7 @@ async fn operate_never_promotes_wording_to_a_goal() {
         "prose asking for a goal must not create one host-side"
     );
     assert!(!active);
-    assert_eq!(contracts, 1);
+    assert_eq!(contracts, 0);
 }
 
 #[tokio::test]
@@ -377,7 +377,7 @@ async fn operate_leaves_followup_and_long_questions_as_ordinary_turns() {
         "conversational followup must remain ordinary turn in Operate"
     );
     assert!(!active);
-    assert_eq!(contracts, 1);
+    assert_eq!(contracts, 0);
 
     let long_q =
         "why did the build fail on the last step when running under docker on macos with rust 1.80";
@@ -387,7 +387,7 @@ async fn operate_leaves_followup_and_long_questions_as_ordinary_turns() {
         "long question without punctuation must remain ordinary turn"
     );
     assert!(!active);
-    assert_eq!(contracts, 1);
+    assert_eq!(contracts, 0);
 
     let zh_followup = "那 rust 或者 docker 构建呢";
     let (objective, active, contracts) = operate_goal_probe(AppMode::Operate, zh_followup).await;
@@ -396,7 +396,7 @@ async fn operate_leaves_followup_and_long_questions_as_ordinary_turns() {
         "Chinese followup must remain ordinary turn in Operate"
     );
     assert!(!active);
-    assert_eq!(contracts, 1);
+    assert_eq!(contracts, 0);
 }
 
 #[tokio::test]
@@ -405,14 +405,11 @@ async fn operate_does_not_create_a_goal_when_the_work_request_declines_one() {
     let (objective, active, contracts) = operate_goal_probe(AppMode::Operate, prompt).await;
     assert_eq!(objective, None);
     assert!(!active);
-    assert_eq!(
-        contracts, 1,
-        "the ordinary Operate turn still reaches the model"
-    );
+    assert_eq!(contracts, 0, "Operate appends no contract");
 }
 
 #[tokio::test]
-async fn operate_contract_is_appended_once_and_an_existing_goal_is_never_replaced() {
+async fn operate_turns_append_no_contract_and_never_replace_an_existing_goal() {
     let first_entered = std::sync::Arc::new(tokio::sync::Notify::new());
     let release_first = std::sync::Arc::new(tokio::sync::Notify::new());
     let model = std::sync::Arc::new(IndexedGatedGoalModelClient {
@@ -531,10 +528,7 @@ async fn operate_contract_is_appended_once_and_an_existing_goal_is_never_replace
         .iter()
         .filter(|message| crate::runtime_handoff::is_operate_contract_message(message))
         .count();
-    assert_eq!(
-        contracts, 1,
-        "the contract must not repeat on later Operate turns"
-    );
+    assert_eq!(contracts, 0, "Operate turns append no contract");
     let goal = goal_state.lock().expect("goal lock").snapshot();
     assert_eq!(goal.objective.as_deref(), Some(first_objective));
     assert_eq!(goal.status, "paused");

crates/engine/src/core/engine/tool_catalog.rs

@@ -376,7 +376,7 @@ pub fn ensure_advanced_tooling(
         catalog.push(Tool {
             tool_type: Some(TOOL_SEARCH_TYPE.to_string()),
             name: TOOL_SEARCH_NAME.to_string(),
-            description: "Search deferred tool definitions and return matching tool references.".to_string(),
+            description: "Search deferred tool definitions and return matching tool references. Deferred tools commonly include `Git`, `Run` (tests and verifier checks), `Web`, `tasks` (background work), `github`, `automation` (scheduling), `lsp`, `review`, `session_search` (past sessions), `terminal/run` and its siblings, `apply_patch`, and `grep_files`, plus connected MCP servers. Calling one by name also loads it.".to_string(),
             input_schema: json!({
                 "type": "object",
                 "properties": {

crates/engine/src/prompts.rs

@@ -3773,10 +3773,9 @@ mod tests {
     #[test]
     fn universal_prompt_does_not_expose_control_plane_ceremony() {
         for internal in [
-            "sub-agent",
             "completion sentinels",
             "<codewhale:subagent.done>",
-            "dispatch, join",
+            "<codewhale:runtime_event",
             "busy-waiting",
         ] {
             assert!(!BASE_PROMPT.contains(internal));

crates/engine/src/prompts/text.rs

@@ -69,9 +69,11 @@ to set a fact aside or proceed despite it; no one may tell you to invent one.
 The request is the whole mandate — everything inside it is yours to do.
 Do what the user's current request asks, no more. Act on clear, reversible work;
 ask when ambiguity is costly. Report adjacent issues instead of silently
-expanding scope. Irreversible actions, external publication, spending,
+expanding scope. Irreversible actions, external publication, spending
+real money (purchases, paid providers, billing),
 credentials, and material scope expansion require express user authorization in
-the current request; otherwise name the decision and ask.
+the current request; otherwise name the decision and ask. Sub-agents, workflows
+and goals within the current request are in scope.
 
 Honor active tool, approval, sandbox, skill, role, and project gates. Skill
 prohibitions stay binding; convenience creates no exception. If a gate blocks
@@ -87,6 +89,21 @@ moving or report exactly what remains and what you are waiting on.
 Hand back what changed, what was verified, and what remains.
 Never present a partial result as the whole.
 
+### Delegation and goals
+Independent parts of a request are the normal case for `agent` children: start
+them together in one message and keep working. Their results arrive on their
+own; never poll or sleep for them, and when only waiting remains, end the turn.
+Give each child a complete prompt and a disjoint file scope. A write-capable
+child owes evidence; inspect it, review the final diff, and run the checks
+yourself. Before calling a non-trivial change done, have an independent
+reviewer try to refute it.
+
+Use `create_goal` when a direct request, in any language, describes a
+verifiable end state that will take more than one turn; not for questions or
+one-shot edits. Mark a goal `blocked` only when the same concrete obstacle
+persists; difficulty is not blocked. Cost alone is not a reason to stop. Turns,
+time and tokens are limited only where the user or configuration sets a limit.
+
 ### Put guarantees in mechanism
 Authorization, ordering, stopping, schema validity, resource limits, and
 required checks belong in code, types, tests, tool gates, and runtime policy.
@@ -176,7 +193,8 @@ pub const GOAL_CONTINUATION_PROMPT: &str = r#"## Goal Continuation
 Continue working toward the active goal. It persists across turns: ending this
 turn does not require shrinking the objective to what fits now. Keep the full
 objective intact, make concrete progress toward the real requested end state,
-and do not redefine success around a smaller or easier task.
+and do not redefine success around a smaller or easier task. Split remaining
+independent work across `agent` workers before the next verification pass.
 
 Work from evidence. Treat the current worktree and external state as
 authoritative; earlier conversation can locate relevant work, but inspect the
@@ -185,15 +203,15 @@ current state before relying on it.
 Before deciding the goal is achieved, verify it against the actual current
 state — files, command output, tests, runtime behavior, issue or PR state, or
 other authoritative evidence — then call `update_goal` with
-`status: "complete"` and concise evidence. If something genuinely prevents
-progress, call `update_goal` with `status: "blocked"` and explain it. If you
+`status: "complete"` and concise evidence. If the same concrete obstacle keeps
+preventing progress, call `update_goal` with `status: "blocked"` and explain
+it; difficulty is not blocked. If you
 finished a stage and the next step is the user's call, or you need the user's
 answer before the next pass can do anything useful, call `update_goal` with
 `status: "yield"`, ask what you need in your answer, and end there; their reply
 resumes the goal. Asking in prose without calling `update_goal` does not pause
 this goal: the next pass starts with your question still unanswered, so do not
-invent an answer to keep the loop moving. If `update_goal` is not in your tool list,
-load it with `tool_search` first.
+invent an answer to keep the loop moving.
 "#;
 /// Memory hygiene guidance — appended to the system prompt only when the
 /// session has a non-empty user-memory block. Steers the model toward

crates/engine/src/runtime_handoff.rs

@@ -102,24 +102,15 @@ const AGENT_TOPOLOGY_TURN_META: &str = concat!(
 );
 const MAX_AGENT_TOPOLOGY_ROWS: usize = 24;
 
-/// The Operate contract (docs/MODES.md, "Operate" and "Operate loop"), stated
-/// once to the model when a session first works in Operate.
+/// The last Operate contract wording, which earlier builds appended once to an
+/// Operate session as a user-role runtime message. The engine no longer appends
+/// any wording: its delegation, review and stopping lines live in `BASE_PROMPT`.
 ///
-/// KV-cache effect: append-only history. This is a user-role runtime message,
-/// never part of the pinned system prompt or tool catalog, so Plan, Work, and
-/// Operate keep one shared prefix (`every_mode_shares_one_prompt_per_host`).
-/// The engine appends it only when the session log does not already hold one.
-///
-/// The host does not create the goal, and Operate is not a quieter Work.
-/// Same tools, same authority. The difference is that a durable request is
-/// worked until verified: `create_goal` when it will outlast this turn,
-/// parallel children for separable work, evidence before a claim of done.
-/// A session that already holds an older wording gets this text once. Every
-/// wording that reached a saved session stays recognizable: the pre-0.10.0
-/// one ([`LEGACY_OPERATE_CONTRACT_EVENT`]) and the one v0.10.0 shipped
-/// ([`LEGACY_V0_10_0_OPERATE_CONTRACT_EVENT`]). Rewording this constant means
-/// moving the outgoing text into a new legacy constant in the same change, or
-/// a resumed session keeps the old contract as if the user had typed it.
+/// Every wording that reached a saved session stays recognizable, so a
+/// restored session replays it as internal runtime state rather than as text
+/// the user typed: this one, the pre-0.10.0 one
+/// ([`LEGACY_OPERATE_CONTRACT_EVENT`]) and the one v0.10.0 shipped
+/// ([`LEGACY_V0_10_0_OPERATE_CONTRACT_EVENT`]).
 const OPERATE_CONTRACT_EVENT: &str = concat!(
     "<codewhale:runtime_event kind=\"operate_contract\" visibility=\"internal\">\n",
     "This is an internal runtime event, not user input. This session is in Operate: ",
@@ -138,8 +129,7 @@ const OPERATE_CONTRACT_EVENT: &str = concat!(
     "you trust it. Report what is done, what is blocked, and what is next.\n",
     "</codewhale:runtime_event>",
 );
-// Keep old persisted runtime messages recognizable for restore/display while
-// allowing the Engine to append the current scheduling contract once. This is
+// Keep old persisted runtime messages recognizable for restore/display. This is
 // the pre-0.10.0 wording.
 const LEGACY_OPERATE_CONTRACT_EVENT: &str = concat!(
     "<codewhale:runtime_event kind=\"operate_contract\" visibility=\"internal\">\n",
@@ -154,9 +144,8 @@ const LEGACY_OPERATE_CONTRACT_EVENT: &str = concat!(
     "and stay free for the next ask.\n",
     "</codewhale:runtime_event>",
 );
-// The wording v0.10.0 shipped, byte for byte. It tells the model the host
-// creates the goal, the opposite of the current contract, so a v0.10.0 Operate
-// session resumed on a later build must have it recognized and replaced.
+// The wording v0.10.0 shipped, byte for byte, recognized so a v0.10.0 session
+// resumed on a later build replays it as internal runtime state.
 const LEGACY_V0_10_0_OPERATE_CONTRACT_EVENT: &str = concat!(
     "<codewhale:runtime_event kind=\"operate_contract\" visibility=\"internal\">\n",
     "This is an internal runtime event, not user input. This session is in Operate and you ",
@@ -183,7 +172,7 @@ const RUNTIME_TURN_META: &str = concat!(
     "</turn_meta>",
 );
 
-/// Build the one Operate contract message the engine appends to history.
+/// Build the last Operate contract message an earlier build saved to history.
 pub fn operate_contract_runtime_message() -> Message {
     runtime_handoff_message_with_meta(OPERATE_CONTRACT_EVENT.to_string(), RUNTIME_TURN_META)
 }

crates/engine/src/tools/file.rs

@@ -3370,7 +3370,7 @@ impl ToolSpec for ListDirTool {
     }
 
     fn description(&self) -> &'static str {
-        "List entries in a workspace directory. This bounded, sandbox-aware tool is searchable when the core read/write/edit/bash toolbox is not enough."
+        "List entries in a workspace directory, bounded and sandbox-aware."
     }
 
     fn input_schema(&self) -> Value {

crates/engine/src/tools/goal.rs

@@ -1035,7 +1035,7 @@ impl ToolSpec for CreateGoalTool {
     }
 
     fn description(&self) -> &'static str {
-        "Create the session's one persistent goal: a completion objective Codewhale keeps working toward across turns until it is verified complete, blocked, or the user stops it. A goal is for a durable objective that outlasts one turn: a multi-step outcome the user wants continued and verified. A question, a greeting, or a one-shot edit completes as an ordinary turn. When the user explicitly asks to use `/goal` or to make something the goal, `create_goal` is what records it; acknowledging it in prose records nothing. The objective is the user's full objective, not a shortened one-turn version. token_budget carries a budget the user stated; with none stated it stays unset. Creating a goal shows the user a one-line receipt (they can /goal pause or /goal clear), so it needs no separate confirmation. Only one unfinished goal exists at a time: an existing one is completed or cleared before another is created."
+        "Start the session's persistent goal when a request is an objective that needs more than one turn or verified completion, even if the user did not say \"goal\". Not for questions, greetings, or one-shot edits. Codewhale keeps working toward it across turns until it is verified complete, blocked, or the user stops it. When the user asks for `/goal` or to make something the goal, this call records it; prose records nothing. Keep the user's full objective, not a one-turn version. The user sees a one-line receipt (they can /goal pause or /goal clear), so no confirmation is needed. Only one unfinished goal exists at a time: complete or clear it before creating another."
     }
 
     fn input_schema(&self) -> Value {
@@ -1049,7 +1049,7 @@ impl ToolSpec for CreateGoalTool {
                 "token_budget": {
                     "type": "integer",
                     "minimum": 0,
-                    "description": "Optional soft token budget for the goal."
+                    "description": "Only set if the user gave a budget."
                 }
             },
             "required": ["objective"],
@@ -1296,11 +1296,11 @@ impl ToolSpec for UpdateGoalTool {
             .is_some_and(|gate| gate.complete || gate.blocked)
         {
             return concat!(
-                "Update the runtime goal completion gate by calling this tool; a prose status in your answer does not change the goal or stop continuation. Critical verification may seal one immutable completion contract. Advisory review is append-only context and never completes, blocks, or pauses the goal. Mark blocked when progress cannot continue at all; needing the user's answer is a yield, not a block. Mark yield when you finished a stage and the next step needs the user's decision, or when you need the user's answer before the next pass can do anything useful: the goal stays unfinished, the turn ends, and their next message resumes it.",
+                "Report goal status by calling this tool; a prose status in your answer changes nothing. Mark complete only after checking the real result, with evidence. Mark blocked only when the same concrete obstacle keeps preventing progress; difficulty is not blocked, and needing the user's answer is a yield, not a block. Mark yield when a stage is finished and the next step is the user's decision, or when the next pass needs the user's answer: the goal stays unfinished, the turn ends, and their next message resumes it.",
                 " An independent judge reviews complete and blocked claims; it may decline them and return the gaps, and the goal then stays active."
             );
         }
-        "Update the runtime goal completion gate by calling this tool; a prose status in your answer does not change the goal or stop continuation. Critical verification may seal one immutable completion contract. Advisory review is append-only context and never completes, blocks, or pauses the goal. Mark blocked when progress cannot continue at all; needing the user's answer is a yield, not a block. Mark yield when you finished a stage and the next step needs the user's decision, or when you need the user's answer before the next pass can do anything useful: the goal stays unfinished, the turn ends, and their next message resumes it."
+        "Report goal status by calling this tool; a prose status in your answer changes nothing. Mark complete only after checking the real result, with evidence. Mark blocked only when the same concrete obstacle keeps preventing progress; difficulty is not blocked, and needing the user's answer is a yield, not a block. Mark yield when a stage is finished and the next step is the user's decision, or when the next pass needs the user's answer: the goal stays unfinished, the turn ends, and their next message resumes it."
     }
 
     fn input_schema(&self) -> Value {
@@ -1310,7 +1310,7 @@ impl ToolSpec for UpdateGoalTool {
                 "status": {
                     "type": "string",
                     "enum": ["complete", "blocked", "not_achieved", "advisory", "yield"],
-                    "description": "Use complete only when a critical verifier proves the goal; not_achieved to record verifier gaps; blocked when progress cannot continue at all; a needed user answer is a yield, not a block; yield when a stage is finished and the next step is the user's call, or when you need the user's answer before the next pass can do anything useful; advisory to append best-effort context without changing lifecycle state."
+                    "description": "complete only after checking the real result, with evidence; not_achieved to record verifier gaps; blocked only when the same concrete obstacle keeps preventing progress (difficulty is not blocked; a needed user answer is a yield); yield when a stage is finished and the next step is the user's call, or the next pass needs the user's answer; advisory to add context without changing the goal's state."
                 },
                 "evidence": {
                     "type": "string",

crates/engine/src/tools/harness.rs

@@ -56,7 +56,7 @@ impl ToolSpec for HarnessTool {
     }
 
     fn description(&self) -> &'static str {
-        "Inspect or refine the durable continual harness for this workspace. Use action=overview at the start of substantial multi-turn work to recover bounded prompt notes, reusable sub-agent briefs, and skill hints. Use action=refine only after observing concrete evidence for a reusable improvement; it stores a small project-local entry that later turns receive as untrusted working guidance. Use action=remove to retire an obsolete entry. Keep large source material in rlm, compose parallel child work with workflow task(...), and use agent action=message/followup for child coordination."
+        "Inspect or refine the durable continual harness for this workspace. Use action=overview at the start of substantial multi-turn work to recover bounded prompt notes, reusable sub-agent briefs, and skill hints. Use action=refine only after observing concrete evidence for a reusable improvement; it stores a small project-local entry that later turns receive as untrusted working guidance. Use action=remove to retire an obsolete entry. Keep large source material in workspace files, compose parallel child work with workflow task(...), and use agent action=message/followup for child coordination."
     }
 
     fn input_schema(&self) -> Value {
@@ -123,7 +123,6 @@ impl ToolSpec for HarnessTool {
                     "path": state.path,
                     "entries": state.entries,
                     "runtime": {
-                        "context": "rlm keeps large context as a persistent Python variable",
                         "orchestration": "workflow composes task(...) calls and parallel fan-out",
                         "messaging": "agent action=message and action=followup coordinate active children",
                         "continuation": "goal keeps an explicit durable objective active"

crates/engine/src/tools/subagent/engine.rs

@@ -1676,6 +1676,14 @@ pub(super) async fn run_child_agent(
                 .clone()
                 .unwrap_or_else(|| agent_type.as_str().to_owned())
         });
+    let identity = format!(
+        "You are {owner_agent_name}. Scope: {}. Your final answer is delivered to the parent automatically; include the result and its evidence.",
+        if runtime.worker_profile.permissions.write {
+            "you may edit files; keep to what this task assigns"
+        } else {
+            "read-only"
+        }
+    );
     let authority = ChildAuthority::capture(
         runtime.clone(),
         agent_type.clone(),
@@ -1706,7 +1714,7 @@ pub(super) async fn run_child_agent(
         ));
     }
     let prompt = format!(
-        "{prompt}\n\n{}",
+        "{prompt}\n\n{}\n\n{identity}",
         child_runtime_budget_context(&runtime, max_steps)
     );
     let fork = if fork_context {

crates/engine/src/tools/subagent/mod.rs

@@ -14744,17 +14744,15 @@ fn start_requests_read_only_role(input: &Value) -> bool {
 /// repeat them here on every request.
 static AGENT_TOOL_DESCRIPTION: std::sync::LazyLock<String> = std::sync::LazyLock::new(|| {
     let description = concat!(
-        "Start with action=start and prompt; returns an agent_id immediately. Read-only roles need no extra fields. Healthy children continue after an ordinary parent response; detached=true also opts out of parent-turn cancellation. ",
-        "Use Workflow for dependencies; use multiple starts for independent tasks. ",
-        "type selects the Fleet role: general (full tool access for multi-step tasks), explore (fast read-only exploration), planner (grounded strategy, read-only probes), reviewer (reads and grades code), implement (lands focused code changes), test (runs tests and reports evidence), advisor (read-only design counsel), or custom (allowed_tools on the parent's posture). ",
-        "profile selects a saved member or built-in role. Saved profile and manual role pins are exact; model/strength choose unpinned routes; thinking overrides the tier. ",
-        "Use action=roster for resolved roles, models, reasoning, context and cost evidence; it makes no provider request. ",
+        "Delegate focused work and keep working. Start early; one agent per independent part, same message. ",
+        "Start with action=start and prompt; it returns an agent_id immediately and results arrive automatically, so continue other work or end your turn instead of polling. Read-only roles need no extra fields. ",
+        "Use multiple starts for independent tasks and `workflow` when steps need order or gates. ",
+        "type selects the Fleet role: general (multi-step work with full tools), explore (find and read code, read-only), planner (plan a change with read-only probes), reviewer (grade a diff or design), implement (make a scoped code change), test (run checks and report evidence), advisor (read-only design counsel), or custom (allowed_tools on the parent's posture). ",
+        "Roster, profile, model and thinking are optional. ",
         "Workers have no default turn or wall-clock budget. Only configured operator, role and inherited limits apply; legacy per-call max_steps, wall_time_secs and max_output_tokens are ignored. There is no token budget. ",
-        "Prefer type=implement for write work and type=test (or the Run tool with action=\"verifiers\") after writes settle — dispatch is not completion. ",
-        "action=claim widens your own enforced write scope: pass write_roots (and optionally exact_files, coordination_contracts) before mutating anything a fail-closed write refusal named. It records a durable claim receipt and fails on contention with a peer claim; it never touches another agent's scope. ",
-        "Action contract: start requires prompt; message/followup require targets and a message; followup accepts one id, agent_ids or all_parked=true and returns continuation mappings. peek/interrupt/cancel require a target; claim requires scope entries; status is compact and paginated unless an addressed detail is requested. ",
-        "In Operate, a child the main session starts edits files and runs the Run tool's built-in checks without a second approval; any other shell command follows the session's approval settings. ",
-        "Legacy action=status|peek|cancel remain for compatibility."
+        "Give write work to type=implement and verify it with type=test or `Run` action=\"verifiers\" after writes settle. action=claim widens your own enforced write scope when a write refusal names a path. ",
+        "Write each prompt as a complete brief: the goal, the files the child owns and must not touch, how to verify, and what to return. ",
+        "Example: \"Own only src/config/loader.rs and its tests. Make missing keys fall back to defaults; do not edit other files. Run the loader tests and return the changed paths and test output.\""
     );
     format!("{description} {}", subagent_followup_recovery("<agent_id>"))
 });
@@ -15262,6 +15260,8 @@ impl ToolSpec for AgentTool {
                 .await;
         let mut value = serde_json::to_value(&projection)
             .map_err(|e| ToolError::execution_failed(e.to_string()))?;
+        value["next"] =
+            json!("Results arrive automatically; continue other work or end your turn.");
         compact_spawn_receipt(&mut value, verbose);
         if !ignored_limits.is_empty() {
             value["ignored_limit_fields"] = json!(ignored_limits);

crates/engine/src/tools/subagent/tests.rs

@@ -27694,18 +27694,6 @@ async fn scout_activation_makes_grep_files_dispatchable() {
         .expect("grep_files must dispatch through the real tool after the taught activation");
 }
 
-#[test]
-fn agent_tool_description_states_the_operate_child_approval_rule() {
-    // `apply_session_spawn_defaults` delegates edits and the bounded Run
-    // checks to a root Operate child; other shell follows the session.
-    let text = super::AGENT_TOOL_DESCRIPTION.as_str();
-    assert!(!text.contains("arbitrary shell remains gated"), "{text}");
-    assert!(
-        text.contains("any other shell command follows the session's approval settings"),
-        "{text}"
-    );
-}
-
 #[test]
 fn agent_tool_description_names_only_schema_roles() {
     // Every `type=<token>` and every role in the "type selects the Fleet role:"

crates/engine/src/tools/tasks.rs

@@ -258,7 +258,7 @@ impl ToolSpec for TasksTool {
             );
             properties.insert(
                 "mode".to_string(),
-                json!({ "type": "string", "enum": ["agent", "plan", "operate"], "description": "(action=create)" }),
+                json!({ "type": "string", "enum": ["agent", "plan"], "description": "(action=create)" }),
             );
             properties.insert(
                 "allow_shell".to_string(),
@@ -1469,7 +1469,7 @@ mod tests {
     }
 
     #[test]
-    fn create_mode_enum_advertises_operate_not_yolo() {
+    fn create_mode_enum_advertises_neither_operate_nor_yolo() {
         let create = TasksTool::alias("task_create", "create").input_schema();
         assert_eq!(
             create["properties"]["mode"]["enum"],
@@ -1478,7 +1478,7 @@ mod tests {
         let canonical = TasksTool::new("tasks").input_schema();
         assert_eq!(
             canonical["properties"]["mode"]["enum"],
-            json!(["agent", "plan", "operate"])
+            json!(["agent", "plan"])
         );
     }
 

crates/engine/src/tools/workflow/mod.rs

@@ -4005,7 +4005,7 @@ struct SubAgentWorkflowDriver {
     gate_specs: Arc<Vec<GateSpec>>,
     /// Lane-scoped gate and handoff state keyed by run id.
     gate_board: Arc<Mutex<LaneGateBoard>>,
-    /// Caps concurrently live `task()` children for this run (product: 16).
+    /// Caps concurrently live `task()` children for this run (product: 64).
     concurrent_gate: Arc<Semaphore>,
     /// Held permits for in-flight children; released on completion/cancel.
     spawn_permits: Mutex<HashMap<String, OwnedSemaphorePermit>>,
@@ -4825,7 +4825,7 @@ impl SubAgentWorkflowDriver {
             )?;
             None
         };
-        // Take a concurrent slot (max 16 live children per run). A task that
+        // Take a concurrent slot (`max_concurrent` live children per run). A task that
         // has to wait is announced first, so a surface can show it queued
         // instead of leaving it invisible until a slot frees.
         let permit = match self.concurrent_gate.clone().try_acquire_owned() {

crates/skills/assets/skills-catalog-matrix.json

@@ -15,7 +15,7 @@
     "in_model_catalogue": "true when the skill renders as an ambient catalogue line",
     "shadowed_aliases": "aliases that collide with another canonical bundled name; the canonical skill wins resolution"
   },
-  "generation": "19",
+  "generation": "20",
   "skills": [
     {
       "name": "skill-creator",
@@ -396,10 +396,12 @@
       "shadowed_aliases": []
     },
     {
-      "name": "goals",
+      "name": "personal-goals",
       "tier": "core",
       "invocation": "model+user",
-      "aliases": [],
+      "aliases": [
+        "goals"
+      ],
       "in_model_catalogue": true,
       "shadowed_aliases": []
     },

crates/skills/assets/skills/best-of-n/SKILL.md

@@ -9,8 +9,8 @@ metadata:
 
 Use this skill when a consequential design, implementation, explanation, or
 debugging task has several plausible solutions and comparison is worth the
-extra model work. In Operate mode this is the preferred ensemble pattern for
-high-stakes or ambiguous approaches. Do not use it for a tiny change or when
+extra model work. It is the preferred ensemble pattern for high-stakes or
+ambiguous approaches. Do not use it for a tiny change or when
 the user has already chosen the approach.
 
 ## Set The Tournament
@@ -20,7 +20,7 @@ the user has already chosen the approach.
    risk, and verification.
 2. Choose `N` from 2 to 4 for a quick comparison (default 3). For an explicit
    experimental search, use the Workflow search option: 2–16 live candidates,
-   with larger validated populations queued at the Workflow host's 16-worker
+   with larger validated populations queued at the Workflow host's
    concurrency gate rather than launched at once.
 3. Give every candidate the same task and rubric. Add only a candidate number;
    do not steer candidates toward different conclusions unless diversity is an
@@ -39,7 +39,7 @@ them read-only:
   "action": "start",
   "name": "candidate_1",
   "prompt": "Produce candidate 1 for the task below. Return the proposal, evidence, risks, and rubric self-score. Do not edit files.\n\n<TASK AND RUBRIC>",
-  "type": "worker",
+  "type": "general",
   "model_strength": "same",
   "write_authority": "read_only"
 }
@@ -51,12 +51,12 @@ candidate's answer before generation finishes.
 
 When candidates must implement code, give each one:
 
-- `type: "builder"`
+- `type: "implement"`
 - `worktree: true`
 - `write_authority: "worktree_write"`
 - the same bounded `write_roots` or `exact_files`
 
-Never run parallel writers in the parent checkout. Each builder must return
+Never run parallel writers in the parent checkout. Each candidate must return
 the structured candidate contract (candidate id, hypothesis, paths, commands,
 self-verdict, risks, and artifact references). A self-verdict is evidence to
 inspect, not a hard-gate result.

crates/skills/assets/skills/delegate/SKILL.md

@@ -7,7 +7,7 @@ metadata:
 
 # Delegate
 
-Use sub-agents when they can do focused work in parallel while the parent keeps architectural judgment, integration, and final verification.
+Use sub-agents when they can do focused work in parallel while the parent keeps architectural judgment, integration, and the final review.
 
 ## Keep vs Delegate
 
@@ -26,7 +26,7 @@ Delegate to sub-agents:
 - Boilerplate generation from an explicit spec
 - Independent checks that can run while parent work continues
 
-Do not delegate tiny one-step tasks, ambiguous product decisions, destructive operations without a clear acceptance criterion, or final verification.
+Do not delegate tiny one-step tasks, ambiguous product decisions, or destructive operations without a clear acceptance criterion.
 
 ## Launch Focused Work
 
@@ -62,7 +62,7 @@ Use `fork_context: true` only when the child genuinely needs the current convers
 
 ## Route the Work
 
-Choose the route per child from `agent(action:"roster")` (no provider request), not from memory. It lists each role's resolved route and the models you may pick.
+Routes are optional: a child inherits a working route by default. To choose one, `agent(action:"roster")` (no provider request) lists each role's resolved route and the models you may pick.
 
 - `thinking` overrides a saved tier on any role. Dial: `off low medium high xhigh max ultra`, plus `inherit` (role default, then session effort) and `auto`.
 - `model` and `model_strength` apply to unpinned routes only. A pinned profile refuses a conflicting model; to choose a model, start an unpinned role such as `general`. `model_strength: "faster"` is the same-family faster sibling, `"same"` the session model.

crates/skills/assets/skills/personal-goals/SKILL.md

@@ -1,10 +1,11 @@
 ---
-name: goals
-description: Set, review, and update the user's goals. Use when: goals, resolutions, track progress, what am I working toward, or holding me accountable.
+name: personal-goals
+description: The user's personal goals and resolutions in goals.md: set, review, track progress. Not the session goal (create_goal).
 invocation: model+user
+aliases-for: goals
 ---
 
-# Goals
+# Personal goals
 
 ## When to use
 Recording what the user is working toward, reviewing progress, and updating

crates/skills/src/system.rs

@@ -42,7 +42,7 @@ use sha2::{Digest, Sha256};
 /// person; the exact generation-16 body allows a safe upgrade.
 /// Generation 18 recognizes previously shipped bodies by SHA-256 as well as by
 /// retained bytes, so an untouched copy from any earlier generation upgrades.
-const BUNDLED_SKILL_VERSION: &str = "19";
+const BUNDLED_SKILL_VERSION: &str = "20";
 
 // ── system & extension (meta) ───────────────────────────────────────────────
 const SKILL_CREATOR_BODY: &str = include_str!("../assets/skills/skill-creator/SKILL.md");
@@ -90,7 +90,7 @@ const SHOPPING_BODY: &str = include_str!("../assets/skills/shopping/SKILL.md");
 const FLIGHTS_BODY: &str = include_str!("../assets/skills/flights/SKILL.md");
 const PHOTOS_BODY: &str = include_str!("../assets/skills/photos/SKILL.md");
 const IMAGE_SEARCH_BODY: &str = include_str!("../assets/skills/image-search/SKILL.md");
-const GOALS_BODY: &str = include_str!("../assets/skills/goals/SKILL.md");
+const PERSONAL_GOALS_BODY: &str = include_str!("../assets/skills/personal-goals/SKILL.md");
 const FORGET_BODY: &str = include_str!("../assets/skills/forget/SKILL.md");
 const FEEDBACK_BODY: &str = include_str!("../assets/skills/feedback/SKILL.md");
 
@@ -461,8 +461,8 @@ const BUNDLED_SKILLS: &[BundledSkill] = &[
         introduced_in: 12,
     },
     BundledSkill {
-        name: "goals",
-        body: GOALS_BODY,
+        name: "personal-goals",
+        body: PERSONAL_GOALS_BODY,
         introduced_in: 12,
     },
     BundledSkill {
@@ -665,6 +665,18 @@ pub fn install_system_skills(
             Err(error) => return Err(error),
         };
 
+    let renamed = skills_dir.join("goals");
+    let renamed_file = renamed.join("SKILL.md");
+    if fs::symlink_metadata(&renamed).is_ok_and(|meta| meta.is_dir())
+        && fs::symlink_metadata(skills_dir.join("personal-goals")).is_err()
+        && fs::symlink_metadata(&renamed_file).is_ok_and(|meta| meta.is_file())
+        && fs::read_dir(&renamed).is_ok_and(|entries| entries.count() == 1)
+        && codewhale_util::fs_confined::read_to_string(skills_dir, &renamed_file)
+            .is_ok_and(|body| hash_is_listed(SHIPPED_BODY_HASHES, "personal-goals", &body))
+    {
+        fs::rename(&renamed, skills_dir.join("personal-goals"))?;
+    }
+
     let mut changed = false;
     for skill in BUNDLED_SKILLS {
         changed |= install_one(skills_dir, skill, installed_version.as_deref(), policy)?;

crates/skills/src/system/shipped_hashes.txt

@@ -8,6 +8,7 @@ best-of-n 8449e209cf2c67c57caf0665b0a0cf0583d01f07944d845b802f9395fb5e90f1
 best-of-n 886c1690adaf42d39a0f06d57cd5692d83b337921f5800468a59dc0e846da093
 best-of-n b72d093fcbcf4e35185a2a6880cad24af03f764e279ba34ae47f7b449688213f
 best-of-n dc90f575c66ae050fc8a90570b344f68a9103e93cb8bff25bf69956f3a18987b
+best-of-n e5e5faeeb9cb8c5dcdb0bcd33bc28ca0565e93277af47c4745bfbbc2897611ea
 best-of-n f125443d839fc34a55d50452c14212ba7d7d3004c8a9a87c94a48e132c180262
 delegate 169640cc236cf9eaae852843eb0f06c4f093f20e8fceb6b7a780ebf8f805d302
 delegate 17761c11d839a0397c06d007611a997cc9dddea6b9432f04352c200d6d916d79
@@ -22,6 +23,7 @@ delegate 754eadf37d769b43a01be1fac8aa79d5ce5d21f4a987cfc68e1c8cd9fafccfb6
 delegate a4042f751e6e77edd191a3c9ab9a6a224a89de07728e65852d10c8324eca9658
 delegate c9cd48fbc33d7571513f0cdf0c8719b3df1e83d76fbb9666912adb2745cc6a58
 delegate e42413bd3ee2ddc15bc8ae890c84701d8d8641aed77bcb8f64b2b87248e80945
+delegate ea3e7f55d29ce5273456635312df65ac4efba04c98c0323962b7032594a2ee96
 documents 5480dac20230127a42ee36e1984dcafbab005c47c02e50b1720522342f293076
 documents ad64624fcb3680a8fd511fe80df6d7cf8cc62b61894b3a0d3ea8d79db2aa7841
 fleet-manager 312937981cd038cf27b0159eee3d7cf7c98da0b791e78f14b55422b59b44cd5d
@@ -54,6 +56,7 @@ pdf 57dee378d7312a5d9b2fef1cd705d776ad3acde8c2d7c0086d0dd23c9d7a041e
 pdf b871a144384d32705ec6b80f4e97d98c140a65bd47053cb2c676c127b35286c8
 pdf bb9de2cd925e79d06e785086770bafb39514fb6f628db69a3eed8cd859fea6ce
 pdf d41ae8935b60a7df17617fa7969b5d95f72fd667e511164d6e83aa1d4d82fdc3
+personal-goals 0e1ed84c9a29c33481c9ba6b1cd5a4a1482398c04c75b7cfff76f371fcb95a91
 photos 5f565864b2b42fadcb02e73647fdd086b36bd86e6705894b74b5ed17beafa5e5
 plan eee2189316230e7c6c05516aea1e4f5b21f7cf8da1966ba19556a494c8f06eee
 plugin-creator 09521548e0d752cc35f630765eaadc4910760bdaf73fd654699ae547a29cac58

crates/skills/src/system/tests.rs

@@ -449,6 +449,18 @@ fn outdated_marker_triggers_reinstall_of_existing_skills() {
     assert_eq!(ver.trim(), BUNDLED_SKILL_VERSION);
 
     let old = DELEGATE_BODY
+        .replace(
+            "integration, and the final review.",
+            "integration, and final verification.",
+        )
+        .replace(
+            "ambiguous product decisions, or destructive operations without a clear acceptance criterion.",
+            "ambiguous product decisions, destructive operations without a clear acceptance criterion, or final verification.",
+        )
+        .replace(
+            "Routes are optional: a child inherits a working route by default. To choose one, `agent(action:\"roster\")` (no provider request) lists each role's resolved route and the models you may pick.",
+            "Choose the route per child from `agent(action:\"roster\")` (no provider request), not from memory. It lists each role's resolved route and the models you may pick.",
+        )
         .replace("Give each child a concrete outcome and acceptance criteria. Let it continue until the work is complete or it needs input. Do not invent time, turn or token budgets, or tell it to stop early because a percentage of a budget has elapsed. The runtime carries any limits explicitly configured by the owner.\n\n", "")
         .replace(
             "Verify with the existing checks that provider-specific API key changes do not restart provider onboarding.",

crates/tui/tests/fixtures/conformance/events/approval_denied.golden.jsonl

@@ -1,26 +1,26 @@
 {"connecting":[],"event":"mcp_session_boot","finished":true,"generation":1,"snapshot":{"config_exists":false,"config_path":"mcp.json","reload_required":false,"servers":[]}}
 {"created_at":"<masked>","event":"turn_started","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":498,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":166}],"project_tokens":166,"retained_block_tokens":188,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Create denied.txt with touch.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3004 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":498,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":166}],"project_tokens":166,"retained_block_tokens":188,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Create denied.txt with touch.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3343 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"changed":false,"context_updates":0,"description":"frozen: d18774b83800","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
+{"changed":false,"context_updates":0,"description":"frozen: 3a775c301855","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
 {"event":"route_dispatched","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing":{"billing_mode":"metered","dispatched_at":"<timestamp>"},"billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"event":"provider_request_receipt","receipt":{"accounting_error":null,"cache_attribution":"Local prefix changes and wire schema measurements are context for reported usage, not proof that eviction caused a miss or that unreported retries were free.","coverage":"reported","elapsed_ms":"<masked>","outcome":"completed","physical_requests":[],"physical_requests_dropped":0,"prefix_check":{"outcome":"stable"},"primary":true,"request_id":"<masked>","request_index":1,"reused_preparation":false,"route":{"billing_mode":"unknown","billing_surface":"unclassified","dispatched_at":"<timestamp>","endpoint_fingerprint":null,"model":"deepseek-v4-pro","provider":"custom","provider_identity":"conformance","provider_live_pricing":null},"session_id":"conformance-session","source_accounting":true,"source_id":"<masked>","transmission":"outcome_unknown","transport_retries":0,"turn_id":"<uuid:1>","usage":{"input_tokens":150,"output_tokens":15},"usage_reported":true,"wire_observations":[],"wire_observations_dropped":0}}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":150,"output_tokens":15}}
 {"event":"tool_call_started","input":{"command":"touch denied.txt"},"tool_call_id":"<uuid:2>","tool_name":"Bash"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":498,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":166}],"project_tokens":166,"retained_block_tokens":188,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Create denied.txt with touch.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3004 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_touch","input":{"command":"touch denied.txt"},"name":"Bash","type":"tool_use"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":498,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":166}],"project_tokens":166,"retained_block_tokens":188,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Create denied.txt with touch.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3343 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_touch","input":{"command":"touch denied.txt"},"name":"Bash","type":"tool_use"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"approval_force_prompt":false,"approval_grouping_key":"shell:cmd:touch denied.txt","approval_key":"shell:exec_shell:8a74218e7d238695","description":"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \"$path\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\n' 'sample'. Execute in the workspace. Action \"run\" (default) executes a command; \"wait\" blocks for a background task until completion or timeout; \"interact\" sends stdin to a background task; \"cancel\" kills a background task. Pass wait=false for a nonblocking task snapshot. Foreground mode is for bounded commands; use background=true for work expected to take >5 seconds. Before a final answer, collect every still-relevant background task with task_shell_wait (wait only when genuinely blocked) and cancel any that no longer matter.","event":"approval_required","id":"<uuid:2>","input":{"command":"touch denied.txt"},"tool_name":"Bash"}
 {"event":"tool_call_complete","result":{"error":{"kind":"permission_denied","message":"Tool 'Bash' denied by user — the call was not approved. Do not retry the same call; present what you intended and wait for the user's approval or new instructions."},"outcome":"err"},"tool_call_id":"<uuid:2>","tool_name":"Bash"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":498,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":166}],"project_tokens":166,"retained_block_tokens":188,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Create denied.txt with touch.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3004 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_touch","input":{"command":"touch denied.txt"},"name":"Bash","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"Error: Tool 'Bash' denied by user — the call was not approved. Do not retry the same call; present what you intended and wait for the user's approval or new instructions.","execution_id":"<uuid:2>","is_error":true,"tool_use_id":"call_touch","type":"tool_result"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":498,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":166}],"project_tokens":166,"retained_block_tokens":188,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Create denied.txt with touch.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3343 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_touch","input":{"command":"touch denied.txt"},"name":"Bash","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"Error: Tool 'Bash' denied by user — the call was not approved. Do not retry the same call; present what you intended and wait for the user's approval or new instructions.","execution_id":"<uuid:2>","is_error":true,"tool_use_id":"call_touch","type":"tool_result"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"event":"status","message":"Continuing — tool results"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":1,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":1,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
 {"event":"message_started","index":0}
 {"delta":"Understood, I did not create it.","event":"response_delta","index":0}
 {"event":"provider_request_receipt","receipt":{"accounting_error":null,"cache_attribution":"Local prefix changes and wire schema measurements are context for reported usage, not proof that eviction caused a miss or that unreported retries were free.","coverage":"reported","elapsed_ms":"<masked>","outcome":"completed","physical_requests":[],"physical_requests_dropped":0,"prefix_check":{"outcome":"stable"},"primary":true,"request_id":"<masked>","request_index":2,"reused_preparation":false,"route":{"billing_mode":"unknown","billing_surface":"unclassified","dispatched_at":"<timestamp>","endpoint_fingerprint":null,"model":"deepseek-v4-pro","provider":"custom","provider_identity":"conformance","provider_live_pricing":null},"session_id":"conformance-session","source_accounting":true,"source_id":"<masked>","transmission":"outcome_unknown","transport_retries":0,"turn_id":"<uuid:1>","usage":{"input_tokens":200,"output_tokens":6},"usage_reported":true,"wire_observations":[],"wire_observations_dropped":0}}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":200,"output_tokens":6}}
 {"event":"message_complete","index":0}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":498,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":166}],"project_tokens":166,"retained_block_tokens":188,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Create denied.txt with touch.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3004 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_touch","input":{"command":"touch denied.txt"},"name":"Bash","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"Error: Tool 'Bash' denied by user — the call was not approved. Do not retry the same call; present what you intended and wait for the user's approval or new instructions.","execution_id":"<uuid:2>","is_error":true,"tool_use_id":"call_touch","type":"tool_result"}],"role":"user"},{"content":[{"text":"Understood, I did not create it.","type":"text"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":1,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":200,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":2,"model_step_index":1,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolationLine truncated
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":498,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":166}],"project_tokens":166,"retained_block_tokens":188,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Create denied.txt with touch.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3343 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_touch","input":{"command":"touch denied.txt"},"name":"Bash","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"Error: Tool 'Bash' denied by user — the call was not approved. Do not retry the same call; present what you intended and wait for the user's approval or new instructions.","execution_id":"<uuid:2>","is_error":true,"tool_use_id":"call_touch","type":"tool_result"}],"role":"user"},{"content":[{"text":"Understood, I did not create it.","type":"text"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":1,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":200,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":2,"model_step_index":1,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolationLine truncated
 {"event":"turn_complete","parent_route_usage":{"input_tokens":350,"output_tokens":21},"routed_usage_dropped_records":0,"status":"completed","tool_catalog":"<pinned by the prompt family>","turn_id":"<uuid:1>","usage":{"input_tokens":350,"output_tokens":21}}
 {"harness_summary":{"model_requests":2,"non_streaming_requests":0,"workspace_after":{".codewhale/state/.gitignore":"cdbcae15105d6b78",".codewhale/state/subagents.v1.json/legacy.json":"9064f16acf90984c",".codewhale/state/subagents.v1.lock":"e3b0c44298fc1c14",".codewhale/state/subagents.v3.json":"e874da2951e53d2b",".codewhale/state/subagents.v3.transaction.lock":"e3b0c44298fc1c14","README.md":"41f49bffb38de5ba"}}}

crates/tui/tests/fixtures/conformance/events/cancel_midstream.golden.jsonl

@@ -1,17 +1,17 @@
 {"connecting":[],"event":"mcp_session_boot","finished":true,"generation":1,"snapshot":{"config_exists":false,"config_path":"mcp.json","reload_required":false,"servers":[]}}
 {"created_at":"<masked>","event":"turn_started","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Tell me a long story.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3007 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Tell me a long story.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3346 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"changed":false,"context_updates":0,"description":"frozen: 0b8925554786","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
+{"changed":false,"context_updates":0,"description":"frozen: b41b375dbe66","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
 {"event":"route_dispatched","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing":{"billing_mode":"metered","dispatched_at":"<timestamp>"},"billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"event":"message_started","index":0}
 {"delta":"Here is a partial","event":"response_delta","index":0}
 {"event":"provider_request_receipt","receipt":{"accounting_error":null,"cache_attribution":"Local prefix changes and wire schema measurements are context for reported usage, not proof that eviction caused a miss or that unreported retries were free.","coverage":"incomplete","elapsed_ms":"<masked>","outcome":"cancelled","physical_requests":[],"physical_requests_dropped":0,"prefix_check":{"outcome":"stable"},"primary":true,"request_id":"<masked>","request_index":1,"reused_preparation":false,"route":{"billing_mode":"unknown","billing_surface":"unclassified","dispatched_at":"<timestamp>","endpoint_fingerprint":null,"model":"deepseek-v4-pro","provider":"custom","provider_identity":"conformance","provider_live_pricing":null},"session_id":"conformance-session","source_accounting":true,"source_id":"<masked>","transmission":"outcome_unknown","transport_retries":0,"turn_id":"<uuid:1>","usage":{"input_tokens":120,"output_tokens":0},"usage_reported":true,"wire_observations":[],"wire_observations_dropped":0}}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":120,"output_tokens":0}}
 {"event":"status","message":"Request cancelled"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Tell me a long story.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3007 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"text":"Here is a partial","type":"text"}],"role":"assistant_interrupted"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":null,"last_reported_input_tokens":120,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":null,"model_requests_started":1,"model_step_index":0,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"interrupted","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"status":"interrupted","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full ALine truncated
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Tell me a long story.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3346 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"text":"Here is a partial","type":"text"}],"role":"assistant_interrupted"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":null,"last_reported_input_tokens":120,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":null,"model_requests_started":1,"model_step_index":0,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"interrupted","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"status":"interrupted","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full ALine truncated
 {"event":"turn_complete","parent_route_usage":{"input_tokens":120,"output_tokens":0},"routed_usage_dropped_records":0,"status":"interrupted","tool_catalog":"<pinned by the prompt family>","turn_id":"<uuid:1>","usage":{"input_tokens":120,"output_tokens":0}}
 {"event":"status","message":"Turn interrupted."}
 {"harness_summary":{"model_requests":1,"non_streaming_requests":0,"workspace_after":{".codewhale/state/.gitignore":"cdbcae15105d6b78",".codewhale/state/subagents.v1.json/legacy.json":"9064f16acf90984c",".codewhale/state/subagents.v1.lock":"e3b0c44298fc1c14",".codewhale/state/subagents.v3.json":"e874da2951e53d2b",".codewhale/state/subagents.v3.transaction.lock":"e3b0c44298fc1c14","NOTES.md":"f957b19529906961","README.md":"41f49bffb38de5ba"}}}

crates/tui/tests/fixtures/conformance/events/one_tool_call.golden.jsonl

@@ -1,27 +1,27 @@
 {"connecting":[],"event":"mcp_session_boot","finished":true,"generation":1,"snapshot":{"config_exists":false,"config_path":"mcp.json","reload_required":false,"servers":[]}}
 {"created_at":"<masked>","event":"turn_started","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"What does README.md say?","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3008 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"What does README.md say?","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3347 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"changed":false,"context_updates":0,"description":"frozen: 0b8925554786","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
+{"changed":false,"context_updates":0,"description":"frozen: b41b375dbe66","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
 {"event":"route_dispatched","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing":{"billing_mode":"metered","dispatched_at":"<timestamp>"},"billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"event":"provider_request_receipt","receipt":{"accounting_error":null,"cache_attribution":"Local prefix changes and wire schema measurements are context for reported usage, not proof that eviction caused a miss or that unreported retries were free.","coverage":"reported","elapsed_ms":"<masked>","outcome":"completed","physical_requests":[],"physical_requests_dropped":0,"prefix_check":{"outcome":"stable"},"primary":true,"request_id":"<masked>","request_index":1,"reused_preparation":false,"route":{"billing_mode":"unknown","billing_surface":"unclassified","dispatched_at":"<timestamp>","endpoint_fingerprint":null,"model":"deepseek-v4-pro","provider":"custom","provider_identity":"conformance","provider_live_pricing":null},"session_id":"conformance-session","source_accounting":true,"source_id":"<masked>","transmission":"outcome_unknown","transport_retries":0,"turn_id":"<uuid:1>","usage":{"input_tokens":150,"output_tokens":20},"usage_reported":true,"wire_observations":[],"wire_observations_dropped":0}}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":150,"output_tokens":20}}
 {"event":"tool_call_started","input":{"action":"read","path":"README.md"},"tool_call_id":"<uuid:2>","tool_name":"File"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"What does README.md say?","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3008 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_readme","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"What does README.md say?","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3347 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_readme","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"action_id":"read_file","activity_kind":"reading","event":"operation_activity_started","span_id":"<uuid:2>#1"}
 {"action_id":"read_file","activity_kind":"reading","event":"operation_activity_completed","outcome":"succeeded","span_id":"<uuid:2>#1"}
 {"event":"tool_call_complete","result":{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture\n","metadata":{"content_hash":"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61","evidence_routing":"inline"},"outcome":"ok","success":true},"tool_call_id":"<uuid:2>","tool_name":"File"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"What does README.md say?","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3008 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_readme","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_readme","type":"tool_result"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"What does README.md say?","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3347 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_readme","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_readme","type":"tool_result"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"event":"status","message":"Continuing — tool results"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":1,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":1,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
 {"event":"message_started","index":0}
 {"delta":"It says: conformance fixture.","event":"response_delta","index":0}
 {"event":"provider_request_receipt","receipt":{"accounting_error":null,"cache_attribution":"Local prefix changes and wire schema measurements are context for reported usage, not proof that eviction caused a miss or that unreported retries were free.","coverage":"reported","elapsed_ms":"<masked>","outcome":"completed","physical_requests":[],"physical_requests_dropped":0,"prefix_check":{"outcome":"stable"},"primary":true,"request_id":"<masked>","request_index":2,"reused_preparation":false,"route":{"billing_mode":"unknown","billing_surface":"unclassified","dispatched_at":"<timestamp>","endpoint_fingerprint":null,"model":"deepseek-v4-pro","provider":"custom","provider_identity":"conformance","provider_live_pricing":null},"session_id":"conformance-session","source_accounting":true,"source_id":"<masked>","transmission":"outcome_unknown","transport_retries":0,"turn_id":"<uuid:1>","usage":{"input_tokens":200,"output_tokens":6},"usage_reported":true,"wire_observations":[],"wire_observations_dropped":0}}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":200,"output_tokens":6}}
 {"event":"message_complete","index":0}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"What does README.md say?","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3008 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_readme","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_readme","type":"tool_result"}],"role":"user"},{"content":[{"text":"It says: conformance fixture.","type":"text"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":1,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":200,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":2,"model_step_index":1,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolationLine truncated
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"What does README.md say?","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3347 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_readme","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_readme","type":"tool_result"}],"role":"user"},{"content":[{"text":"It says: conformance fixture.","type":"text"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":1,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":200,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":2,"model_step_index":1,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolationLine truncated
 {"event":"turn_complete","parent_route_usage":{"input_tokens":350,"output_tokens":26},"routed_usage_dropped_records":0,"status":"completed","tool_catalog":"<pinned by the prompt family>","turn_id":"<uuid:1>","usage":{"input_tokens":350,"output_tokens":26}}
 {"harness_summary":{"model_requests":2,"non_streaming_requests":0,"workspace_after":{".codewhale/state/.gitignore":"cdbcae15105d6b78",".codewhale/state/subagents.v1.json/legacy.json":"9064f16acf90984c",".codewhale/state/subagents.v1.lock":"e3b0c44298fc1c14",".codewhale/state/subagents.v3.json":"e874da2951e53d2b",".codewhale/state/subagents.v3.transaction.lock":"e3b0c44298fc1c14","NOTES.md":"f957b19529906961","README.md":"41f49bffb38de5ba"}}}

crates/tui/tests/fixtures/conformance/events/parallel_tool_calls.golden.jsonl

@@ -1,15 +1,15 @@
 {"connecting":[],"event":"mcp_session_boot","finished":true,"generation":1,"snapshot":{"config_exists":false,"config_path":"mcp.json","reload_required":false,"servers":[]}}
 {"created_at":"<masked>","event":"turn_started","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Read README.md and NOTES.md.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3009 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- NOTES.md (file)\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Read README.md and NOTES.md.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3348 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- NOTES.md (file)\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"changed":false,"context_updates":0,"description":"frozen: 0b8925554786","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
+{"changed":false,"context_updates":0,"description":"frozen: b41b375dbe66","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
 {"event":"route_dispatched","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing":{"billing_mode":"metered","dispatched_at":"<timestamp>"},"billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"event":"provider_request_receipt","receipt":{"accounting_error":null,"cache_attribution":"Local prefix changes and wire schema measurements are context for reported usage, not proof that eviction caused a miss or that unreported retries were free.","coverage":"reported","elapsed_ms":"<masked>","outcome":"completed","physical_requests":[],"physical_requests_dropped":0,"prefix_check":{"outcome":"stable"},"primary":true,"request_id":"<masked>","request_index":1,"reused_preparation":false,"route":{"billing_mode":"unknown","billing_surface":"unclassified","dispatched_at":"<timestamp>","endpoint_fingerprint":null,"model":"deepseek-v4-pro","provider":"custom","provider_identity":"conformance","provider_live_pricing":null},"session_id":"conformance-session","source_accounting":true,"source_id":"<masked>","transmission":"outcome_unknown","transport_retries":0,"turn_id":"<uuid:1>","usage":{"input_tokens":160,"output_tokens":40},"usage_reported":true,"wire_observations":[],"wire_observations_dropped":0}}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":160,"output_tokens":40}}
 {"event":"tool_call_started","input":{"action":"read","path":"README.md"},"tool_call_id":"<uuid:2>","tool_name":"File"}
 {"event":"tool_call_started","input":{"action":"read","path":"NOTES.md"},"tool_call_id":"<uuid:3>","tool_name":"File"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Read README.md and NOTES.md.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3009 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- NOTES.md (file)\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_a","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"},{"execution_id":"<uuid:3>","id":"call_read_b","input":{"action":"read","path":"NOTES.md"},"name":"File","type":"tool_use"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Read README.md and NOTES.md.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3348 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- NOTES.md (file)\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_a","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"},{"execution_id":"<uuid:3>","id":"call_read_b","input":{"action":"read","path":"NOTES.md"},"name":"File","type":"tool_use"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"event":"status","message":"Executing 2 read-only tools in 1 parallel chunk(s)"}
 {"action_id":"read_file","activity_kind":"reading","event":"operation_activity_started","span_id":"<uuid:2>#2"}
 {"action_id":"read_file","activity_kind":"reading","event":"operation_activity_started","span_id":"<uuid:3>#3"}
@@ -17,17 +17,17 @@
 {"action_id":"read_file","activity_kind":"reading","event":"operation_activity_completed","outcome":"succeeded","span_id":"<uuid:3>#3"}
 {"event":"tool_call_complete","result":{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture\n","metadata":{"content_hash":"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61","evidence_routing":"inline"},"outcome":"ok","success":true},"tool_call_id":"<uuid:2>","tool_name":"File"}
 {"event":"tool_call_complete","result":{"content":"content_hash=\"sha256:f957b19529906961933c5c30f8713c500a9bb5d9d0695c40d48c97a26a3594ec\"\nsecond file\n","metadata":{"content_hash":"sha256:f957b19529906961933c5c30f8713c500a9bb5d9d0695c40d48c97a26a3594ec","evidence_routing":"inline"},"outcome":"ok","success":true},"tool_call_id":"<uuid:3>","tool_name":"File"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Read README.md and NOTES.md.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3009 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- NOTES.md (file)\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_a","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"},{"execution_id":"<uuid:3>","id":"call_read_b","input":{"action":"read","path":"NOTES.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_a","type":"tool_result"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Read README.md and NOTES.md.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3009 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- NOTES.md (file)\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_a","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"},{"execution_id":"<uuid:3>","id":"call_read_b","input":{"action":"read","path":"NOTES.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_a","type":"tool_result"}],"role":"user"},{"content":[{"content":"content_hash=\"sha256:f957b19529906961933c5c30f8713c500a9bb5d9d0695c40d48c97a26a3594ec\"\nsecond file","execution_id":"<uuid:3>","tool_use_id":"call_read_b","type":"tool_result"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Read README.md and NOTES.md.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3348 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- NOTES.md (file)\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_a","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"},{"execution_id":"<uuid:3>","id":"call_read_b","input":{"action":"read","path":"NOTES.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_a","type":"tool_result"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Read README.md and NOTES.md.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3348 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- NOTES.md (file)\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_a","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"},{"execution_id":"<uuid:3>","id":"call_read_b","input":{"action":"read","path":"NOTES.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_a","type":"tool_result"}],"role":"user"},{"content":[{"content":"content_hash=\"sha256:f957b19529906961933c5c30f8713c500a9bb5d9d0695c40d48c97a26a3594ec\"\nsecond file","execution_id":"<uuid:3>","tool_use_id":"call_read_b","type":"tool_result"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"event":"status","message":"Continuing — tool results"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":1,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":1,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
 {"event":"message_started","index":0}
 {"delta":"Both files read.","event":"response_delta","index":0}
 {"event":"provider_request_receipt","receipt":{"accounting_error":null,"cache_attribution":"Local prefix changes and wire schema measurements are context for reported usage, not proof that eviction caused a miss or that unreported retries were free.","coverage":"reported","elapsed_ms":"<masked>","outcome":"completed","physical_requests":[],"physical_requests_dropped":0,"prefix_check":{"outcome":"stable"},"primary":true,"request_id":"<masked>","request_index":2,"reused_preparation":false,"route":{"billing_mode":"unknown","billing_surface":"unclassified","dispatched_at":"<timestamp>","endpoint_fingerprint":null,"model":"deepseek-v4-pro","provider":"custom","provider_identity":"conformance","provider_live_pricing":null},"session_id":"conformance-session","source_accounting":true,"source_id":"<masked>","transmission":"outcome_unknown","transport_retries":0,"turn_id":"<uuid:1>","usage":{"input_tokens":200,"output_tokens":6},"usage_reported":true,"wire_observations":[],"wire_observations_dropped":0}}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":200,"output_tokens":6}}
 {"event":"message_complete","index":0}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Read README.md and NOTES.md.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3009 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- NOTES.md (file)\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_a","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"},{"execution_id":"<uuid:3>","id":"call_read_b","input":{"action":"read","path":"NOTES.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_a","type":"tool_result"}],"role":"user"},{"content":[{"content":"content_hash=\"sha256:f957b19529906961933c5c30f8713c500a9bb5d9d0695c40d48c97a26a3594ec\"\nsecond file","execution_id":"<uuid:3>","tool_use_id":"call_read_b","type":"tool_result"}],"role":"user"},{"content":[{"text":"Both files read.","type":"text"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":1,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":200,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":2,"model_step_index":1,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolationLine truncated
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Read README.md and NOTES.md.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3348 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- NOTES.md (file)\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_a","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"},{"execution_id":"<uuid:3>","id":"call_read_b","input":{"action":"read","path":"NOTES.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_a","type":"tool_result"}],"role":"user"},{"content":[{"content":"content_hash=\"sha256:f957b19529906961933c5c30f8713c500a9bb5d9d0695c40d48c97a26a3594ec\"\nsecond file","execution_id":"<uuid:3>","tool_use_id":"call_read_b","type":"tool_result"}],"role":"user"},{"content":[{"text":"Both files read.","type":"text"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":1,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":200,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":2,"model_step_index":1,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolationLine truncated
 {"event":"turn_complete","parent_route_usage":{"input_tokens":360,"output_tokens":46},"routed_usage_dropped_records":0,"status":"completed","tool_catalog":"<pinned by the prompt family>","turn_id":"<uuid:1>","usage":{"input_tokens":360,"output_tokens":46}}
 {"harness_summary":{"model_requests":2,"non_streaming_requests":0,"workspace_after":{".codewhale/state/.gitignore":"cdbcae15105d6b78",".codewhale/state/subagents.v1.json/legacy.json":"9064f16acf90984c",".codewhale/state/subagents.v1.lock":"e3b0c44298fc1c14",".codewhale/state/subagents.v3.json":"e874da2951e53d2b",".codewhale/state/subagents.v3.transaction.lock":"e3b0c44298fc1c14","NOTES.md":"f957b19529906961","README.md":"41f49bffb38de5ba"}}}

crates/tui/tests/fixtures/conformance/events/plain_answer.golden.jsonl

@@ -1,9 +1,9 @@
 {"connecting":[],"event":"mcp_session_boot","finished":true,"generation":1,"snapshot":{"config_exists":false,"config_path":"mcp.json","reload_required":false,"servers":[]}}
 {"created_at":"<masked>","event":"turn_started","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Say hello.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3004 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Say hello.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3343 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"changed":false,"context_updates":0,"description":"frozen: 0b8925554786","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
+{"changed":false,"context_updates":0,"description":"frozen: b41b375dbe66","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
 {"event":"route_dispatched","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing":{"billing_mode":"metered","dispatched_at":"<timestamp>"},"billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"event":"message_started","index":0}
 {"delta":"Hello","event":"response_delta","index":0}
@@ -11,7 +11,7 @@
 {"event":"provider_request_receipt","receipt":{"accounting_error":null,"cache_attribution":"Local prefix changes and wire schema measurements are context for reported usage, not proof that eviction caused a miss or that unreported retries were free.","coverage":"reported","elapsed_ms":"<masked>","outcome":"completed","physical_requests":[],"physical_requests_dropped":0,"prefix_check":{"outcome":"stable"},"primary":true,"request_id":"<masked>","request_index":1,"reused_preparation":false,"route":{"billing_mode":"unknown","billing_surface":"unclassified","dispatched_at":"<timestamp>","endpoint_fingerprint":null,"model":"deepseek-v4-pro","provider":"custom","provider_identity":"conformance","provider_live_pricing":null},"session_id":"conformance-session","source_accounting":true,"source_id":"<masked>","transmission":"outcome_unknown","transport_retries":0,"turn_id":"<uuid:1>","usage":{"input_tokens":120,"output_tokens":4},"usage_reported":true,"wire_observations":[],"wire_observations_dropped":0}}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":120,"output_tokens":4}}
 {"event":"message_complete","index":0}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Say hello.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3004 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"text":"Hello there.","type":"text"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":120,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":1,"model_step_index":0,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolationLine truncated
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Say hello.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\nEstimated conversation input: 3343 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"text":"Hello there.","type":"text"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":120,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":1,"model_step_index":0,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolationLine truncated
 {"event":"turn_complete","parent_route_usage":{"input_tokens":120,"output_tokens":4},"routed_usage_dropped_records":0,"status":"completed","tool_catalog":"<pinned by the prompt family>","turn_id":"<uuid:1>","usage":{"input_tokens":120,"output_tokens":4}}
 {"harness_summary":{"model_requests":1,"non_streaming_requests":0,"workspace_after":{".codewhale/state/.gitignore":"cdbcae15105d6b78",".codewhale/state/subagents.v1.json/legacy.json":"9064f16acf90984c",".codewhale/state/subagents.v1.lock":"e3b0c44298fc1c14",".codewhale/state/subagents.v3.json":"e874da2951e53d2b",".codewhale/state/subagents.v3.transaction.lock":"e3b0c44298fc1c14","NOTES.md":"f957b19529906961","README.md":"41f49bffb38de5ba"}}}

crates/tui/tests/fixtures/conformance/events/provider_error_after_tool_call.golden.jsonl

@@ -1,15 +1,15 @@
 {"connecting":[],"event":"mcp_session_boot","finished":true,"generation":1,"snapshot":{"config_exists":false,"config_path":"mcp.json","reload_required":false,"servers":[]}}
 {"created_at":"<masked>","event":"turn_started","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
-{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Write c0205.txt.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Full Access\nCurrent sandbox posture: full access (sandbox disabled)\nEstimated conversation input: 3006 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
+{"engine_session_id":"conformance-session","event":"session_updated","instruction_assembly":{"budgets":{"claude_fallback":false,"file_max_bytes":8388608,"global_tokens":100000,"policy":"trim","project_tokens":100000,"static_guard_tokens":667571,"usable_window_tokens":834464},"constitution_source_path":null,"constitution_tokens":0,"global_tokens":0,"notices":[{"action":"Kept","bytes_dropped":0,"bytes_kept":514,"detail":null,"fallback_selected":null,"limit":"None","origin":"Instructions","path":null,"scope":"Project","tokens_dropped":0,"tokens_kept":172}],"project_tokens":172,"retained_block_tokens":193,"source_path":null,"warnings":[]},"messages":[{"content":[{"text":"Write c0205.txt.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Full Access\nCurrent sandbox posture: full access (sandbox disabled)\nEstimated conversation input: 3345 / 1000000 context tokens (0.3%). Automatic compaction is enabled.\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"changed":false,"context_updates":0,"description":"frozen: 0b8925554786","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
+{"changed":false,"context_updates":0,"description":"frozen: b41b375dbe66","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when the session sandbox, the network policy and your network grant allow it. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 30 seconds). A command still running then is not killed: it moves to the background byLine truncated
 {"event":"route_dispatched","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing":{"billing_mode":"metered","dispatched_at":"<timestamp>"},"billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"category":"invalid_input","code":"invalid_input","event":"error","message":"Model not exist.","recoverable":false,"severity":"error"}
 {"event":"provider_request_receipt","receipt":{"accounting_error":null,"cache_attribution":"Local prefix changes and wire schema measurements are context for reported usage, not proof that eviction caused a miss or that unreported retries were free.","coverage":"incomplete","elapsed_ms":"<masked>","outcome":"incomplete","physical_requests":[],"physical_requests_dropped":0,"prefix_check":{"outcome":"stable"},"primary":true,"request_id":"<masked>","request_index":1,"reused_preparation":false,"route":{"billing_mode":"unknown","billing_surface":"unclassified","dispatched_at":"<timestamp>","endpoint_fingerprint":null,"model":"deepseek-v4-pro","provider":"custom","provider_identity":"conformance","provider_live_pricing":null},"session_id":"conformance-session","source_accounting":true,"source_id":"<masked>","transmission":"outcome_unknown","transport_retries":0,"turn_id":"<uuid:1>","usage":{"input_tokens":120,"output_tokens":0},"usage_reported":true,"wire_observations":[],"wire_observations_dropped":0}}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":120,"output_tokens":0}}
 {"event":"tool_call_started","input":{"action":"write","content":"side effect\n","path":"c0205.txt"},"tool_call_id":"<uuid:2>","tool_name":"File"}
 {"event":"tool_call_complete","result":{"content":"Not executed: the provider stream failed before the model response completed (Model not exist.).","metadata":{"error_category":"model_stream_failed","model_output_incomplete":true,"side_effect_status":"not_started"},"outcome":"ok","success":false},"tool_call_id":"<uuid:2>","tool_name":"File"}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"93536005288ccf929ad4737024690ab32376365841eec74ba7942ec6e6ddbe3b","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19840,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":null,"last_reported_input_tokens":120,"last_response_tool_calls":1,"last_response_tool_calls_suppressed":1,"model_requests_started":1,"model_step_index":0,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"failed","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"status":"failed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when thLine truncated
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"d398b83d7ab43685929587d8b79f21a54a624235197bcd41c9d60bb87bdd1803","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":19792,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":39,"omitted":7,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"tasks"},{"truncated":false,"value":"terminal/cancel"},{"truncated":false,"value":"terminal/reset"}]}},"registry_tool_count":{"status":"known","value":65},"rendered_tool_count":16,"schema_version":1,"step":0,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":null,"last_reported_input_tokens":120,"last_response_tool_calls":1,"last_response_tool_calls_suppressed":1,"model_requests_started":1,"model_step_index":0,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"failed","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"status":"failed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":16,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 30 seconds); a command still running then is never killed for time: it moves to the background by itself and you get its output so far, how long ago it last printed, its build phase, and a task_id, so long builds and tests need no special timeout. Call task_shell_wait directly with that task_id to read more or wait for it; do n"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"description\":{\"description\":\"Optional few-word summary shown to the user beside the command.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) or a network fetch (curl) with mandatory native filesystem read-only isolation. Outbound network is on only in Full Access when thLine truncated
 {"error":"Model not exist.","event":"turn_complete","parent_route_usage":{"input_tokens":120,"output_tokens":0},"routed_usage_dropped_records":0,"status":"failed","tool_catalog":"<pinned by the prompt family>","turn_id":"<uuid:1>","usage":{"input_tokens":120,"output_tokens":0}}
 {"harness_summary":{"model_requests":1,"non_streaming_requests":0,"workspace_after":{".codewhale/state/.gitignore":"cdbcae15105d6b78",".codewhale/state/subagents.v1.json/legacy.json":"9064f16acf90984c",".codewhale/state/subagents.v1.lock":"e3b0c44298fc1c14",".codewhale/state/subagents.v3.json":"e874da2951e53d2b",".codewhale/state/subagents.v3.transaction.lock":"e3b0c44298fc1c14","NOTES.md":"f957b19529906961","README.md":"41f49bffb38de5ba"}}}

crates/tui/tests/fixtures/conformance/prompt/agent_suggest.golden.json

@@ -1,9 +1,9 @@
 {
-  "system_sha256": "8ff744b8ed90564a8c4754ac79cdbaf05df69ed024cc2ec154abfe581ed72d7f",
-  "system_bytes": 9183,
+  "system_sha256": "b25aafbd2be2e5904cfdf81e54ebafe8ebb948b9a0863ff8edb53eb32ec6c088",
+  "system_bytes": 10216,
   "system_blocks": 5,
-  "tools_sha256": "52b3ff15230ed03aa771df2ae37660775ae7c040aa954c45f143357f2da65fca",
-  "tools_bytes": 19840,
+  "tools_sha256": "528fa9245bc93147bbafe5c5fe76d300973e092202a82525f1c80f313bfe3020",
+  "tools_bytes": 19792,
   "tool_count": 16,
   "tool_names": [
     "bash",
@@ -23,7 +23,7 @@
     "execute_tools",
     "tool_search"
   ],
-  "prefix_sha256": "bb554821470f01eac5e3b7167f0a58dc74fb7d3a7fdd1f39db22058352e3634d",
+  "prefix_sha256": "60bd97fc27fac1bcfa9f28c42ba263467736f51a43a6093bce4af2954a6d3c12",
   "masks": [
     "<WORKSPACE>",
     "<HOME>",

crates/tui/tests/fixtures/conformance/prompt/agent_suggest.system.golden.txt

@@ -27,9 +27,11 @@ to set a fact aside or proceed despite it; no one may tell you to invent one.
 The request is the whole mandate — everything inside it is yours to do.
 Do what the user's current request asks, no more. Act on clear, reversible work;
 ask when ambiguity is costly. Report adjacent issues instead of silently
-expanding scope. Irreversible actions, external publication, spending,
+expanding scope. Irreversible actions, external publication, spending
+real money (purchases, paid providers, billing),
 credentials, and material scope expansion require express user authorization in
-the current request; otherwise name the decision and ask.
+the current request; otherwise name the decision and ask. Sub-agents, workflows
+and goals within the current request are in scope.
 
 Honor active tool, approval, sandbox, skill, role, and project gates. Skill
 prohibitions stay binding; convenience creates no exception. If a gate blocks
@@ -45,6 +47,21 @@ moving or report exactly what remains and what you are waiting on.
 Hand back what changed, what was verified, and what remains.
 Never present a partial result as the whole.
 
+### Delegation and goals
+Independent parts of a request are the normal case for `agent` children: start
+them together in one message and keep working. Their results arrive on their
+own; never poll or sleep for them, and when only waiting remains, end the turn.
+Give each child a complete prompt and a disjoint file scope. A write-capable
+child owes evidence; inspect it, review the final diff, and run the checks
+yourself. Before calling a non-trivial change done, have an independent
+reviewer try to refute it.
+
+Use `create_goal` when a direct request, in any language, describes a
+verifiable end state that will take more than one turn; not for questions or
+one-shot edits. Mark a goal `blocked` only when the same concrete obstacle
+persists; difficulty is not blocked. Cost alone is not a reason to stop. Turns,
+time and tokens are limited only where the user or configuration sets a limit.
+
 ### Put guarantees in mechanism
 Authorization, ordering, stopping, schema validity, resource limits, and
 required checks belong in code, types, tests, tool gates, and runtime policy.

crates/tui/tests/fixtures/conformance/prompt/agent_suggest.tools.golden.json

@@ -108,7 +108,7 @@
   },
   {
     "name": "create_goal",
-    "description": "Create the session's one persistent goal: a completion objective Codewhale keeps working toward across turns until it is verified complete, blocked, or the user stops it. A goal is for a durable objective that outlasts one turn: a multi-step outcome the user wants continued and verified. A question, a greeting, or a one-shot edit completes as an ordinary turn. When the user explicitly asks to use `/goal` or to make something the goal, `create_goal` is what records it; acknowledging it in prose records nothing. The objective is the user's full objective, not a shortened one-turn version. token_budget carries a budget the user stated; with none stated it stays unset. Creating a goal shows the user a one-line receipt (they can /goal pause or /goal clear), so it needs no separate confirmation. Only one unfinished goal exists at a time: an existing one is completed or cleared before another is created.",
+    "description": "Start the session's persistent goal when a request is an objective that needs more than one turn or verified completion, even if the user did not say \"goal\". Not for questions, greetings, or one-shot edits. Codewhale keeps working toward it across turns until it is verified complete, blocked, or the user stops it. When the user asks for `/goal` or to make something the goal, this call records it; prose records nothing. Keep the user's full objective, not a one-turn version. The user sees a one-line receipt (they can /goal pause or /goal clear), so no confirmation is needed. Only one unfinished goal exists at a time: complete or clear it before creating another.",
     "input_schema": {
       "additionalProperties": false,
       "properties": {
@@ -117,7 +117,7 @@
           "type": "string"
         },
         "token_budget": {
-          "description": "Optional soft token budget for the goal.",
+          "description": "Only set if the user gave a budget.",
           "minimum": 0,
           "type": "integer"
         }
@@ -409,7 +409,7 @@
   },
   {
     "name": "update_goal",
-    "description": "Update the runtime goal completion gate by calling this tool; a prose status in your answer does not change the goal or stop continuation. Critical verification may seal one immutable completion contract. Advisory review is append-only context and never completes, blocks, or pauses the goal. Mark blocked when progress cannot continue at all; needing the user's answer is a yield, not a block. Mark yield when you finished a stage and the next step needs the user's decision, or when you need the user's answer before the next pass can do anything useful: the goal stays unfinished, the turn ends, and their next message resumes it.",
+    "description": "Report goal status by calling this tool; a prose status in your answer changes nothing. Mark complete only after checking the real result, with evidence. Mark blocked only when the same concrete obstacle keeps preventing progress; difficulty is not blocked, and needing the user's answer is a yield, not a block. Mark yield when a stage is finished and the next step is the user's decision, or when the next pass needs the user's answer: the goal stays unfinished, the turn ends, and their next message resumes it.",
     "input_schema": {
       "additionalProperties": false,
       "properties": {
@@ -450,7 +450,7 @@
           "type": "object"
         },
         "status": {
-          "description": "Use complete only when a critical verifier proves the goal; not_achieved to record verifier gaps; blocked when progress cannot continue at all; a needed user answer is a yield, not a block; yield when a stage is finished and the next step is the user's call, or when you need the user's answer before the next pass can do anything useful; advisory to append best-effort context without changing lifecycle state.",
+          "description": "complete only after checking the real result, with evidence; not_achieved to record verifier gaps; blocked only when the same concrete obstacle keeps preventing progress (difficulty is not blocked; a needed user answer is a yield); yield when a stage is finished and the next step is the user's call, or the next pass needs the user's answer; advisory to add context without changing the goal's state.",
           "enum": [
             "complete",
             "blocked",
@@ -577,7 +577,7 @@
   {
     "type": "tool_search_20251119",
     "name": "tool_search",
-    "description": "Search deferred tool definitions and return matching tool references.",
+    "description": "Search deferred tool definitions and return matching tool references. Deferred tools commonly include `Git`, `Run` (tests and verifier checks), `Web`, `tasks` (background work), `github`, `automation` (scheduling), `lsp`, `review`, `session_search` (past sessions), `terminal/run` and its siblings, `apply_patch`, and `grep_files`, plus connected MCP servers. Calling one by name also loads it.",
     "input_schema": {
       "type": "object",
       "properties": {

crates/tui/tests/fixtures/conformance/prompt/plan_mode.golden.json

@@ -1,9 +1,9 @@
 {
-  "system_sha256": "8ff744b8ed90564a8c4754ac79cdbaf05df69ed024cc2ec154abfe581ed72d7f",
-  "system_bytes": 9183,
+  "system_sha256": "b25aafbd2be2e5904cfdf81e54ebafe8ebb948b9a0863ff8edb53eb32ec6c088",
+  "system_bytes": 10216,
   "system_blocks": 5,
-  "tools_sha256": "becad1d1e060fba25f12a1cf41c413aae9ee3e174d9edf9916b9af7084210f9f",
-  "tools_bytes": 17071,
+  "tools_sha256": "381396536209ee2edf4b11d6bb22996e5c4679671ca40af028ca9a63f5073e40",
+  "tools_bytes": 17023,
   "tool_count": 14,
   "tool_names": [
     "bash",
@@ -21,7 +21,7 @@
     "write",
     "tool_search"
   ],
-  "prefix_sha256": "2ef3f8cd0818d35d5ffe170db24598e3d94d9dbd1e44b25c327eadde18af5f9b",
+  "prefix_sha256": "aea23c2b885f5c007f9d423b8912f85e93b404f02b0e8dbe390f1aeb75ec2321",
   "masks": [
     "<WORKSPACE>",
     "<HOME>",

crates/tui/tests/fixtures/conformance/prompt/plan_mode.system.golden.txt

@@ -27,9 +27,11 @@ to set a fact aside or proceed despite it; no one may tell you to invent one.
 The request is the whole mandate — everything inside it is yours to do.
 Do what the user's current request asks, no more. Act on clear, reversible work;
 ask when ambiguity is costly. Report adjacent issues instead of silently
-expanding scope. Irreversible actions, external publication, spending,
+expanding scope. Irreversible actions, external publication, spending
+real money (purchases, paid providers, billing),
 credentials, and material scope expansion require express user authorization in
-the current request; otherwise name the decision and ask.
+the current request; otherwise name the decision and ask. Sub-agents, workflows
+and goals within the current request are in scope.
 
 Honor active tool, approval, sandbox, skill, role, and project gates. Skill
 prohibitions stay binding; convenience creates no exception. If a gate blocks
@@ -45,6 +47,21 @@ moving or report exactly what remains and what you are waiting on.
 Hand back what changed, what was verified, and what remains.
 Never present a partial result as the whole.
 
+### Delegation and goals
+Independent parts of a request are the normal case for `agent` children: start
+them together in one message and keep working. Their results arrive on their
+own; never poll or sleep for them, and when only waiting remains, end the turn.
+Give each child a complete prompt and a disjoint file scope. A write-capable
+child owes evidence; inspect it, review the final diff, and run the checks
+yourself. Before calling a non-trivial change done, have an independent
+reviewer try to refute it.
+
+Use `create_goal` when a direct request, in any language, describes a
+verifiable end state that will take more than one turn; not for questions or
+one-shot edits. Mark a goal `blocked` only when the same concrete obstacle
+persists; difficulty is not blocked. Cost alone is not a reason to stop. Turns,
+time and tokens are limited only where the user or configuration sets a limit.
+
 ### Put guarantees in mechanism
 Authorization, ordering, stopping, schema validity, resource limits, and
 required checks belong in code, types, tests, tool gates, and runtime policy.

crates/tui/tests/fixtures/conformance/prompt/plan_mode.tools.golden.json

@@ -108,7 +108,7 @@
   },
   {
     "name": "create_goal",
-    "description": "Create the session's one persistent goal: a completion objective Codewhale keeps working toward across turns until it is verified complete, blocked, or the user stops it. A goal is for a durable objective that outlasts one turn: a multi-step outcome the user wants continued and verified. A question, a greeting, or a one-shot edit completes as an ordinary turn. When the user explicitly asks to use `/goal` or to make something the goal, `create_goal` is what records it; acknowledging it in prose records nothing. The objective is the user's full objective, not a shortened one-turn version. token_budget carries a budget the user stated; with none stated it stays unset. Creating a goal shows the user a one-line receipt (they can /goal pause or /goal clear), so it needs no separate confirmation. Only one unfinished goal exists at a time: an existing one is completed or cleared before another is created.",
+    "description": "Start the session's persistent goal when a request is an objective that needs more than one turn or verified completion, even if the user did not say \"goal\". Not for questions, greetings, or one-shot edits. Codewhale keeps working toward it across turns until it is verified complete, blocked, or the user stops it. When the user asks for `/goal` or to make something the goal, this call records it; prose records nothing. Keep the user's full objective, not a one-turn version. The user sees a one-line receipt (they can /goal pause or /goal clear), so no confirmation is needed. Only one unfinished goal exists at a time: complete or clear it before creating another.",
     "input_schema": {
       "additionalProperties": false,
       "properties": {
@@ -117,7 +117,7 @@
           "type": "string"
         },
         "token_budget": {
-          "description": "Optional soft token budget for the goal.",
+          "description": "Only set if the user gave a budget.",
           "minimum": 0,
           "type": "integer"
         }
@@ -361,7 +361,7 @@
   },
   {
     "name": "update_goal",
-    "description": "Update the runtime goal completion gate by calling this tool; a prose status in your answer does not change the goal or stop continuation. Critical verification may seal one immutable completion contract. Advisory review is append-only context and never completes, blocks, or pauses the goal. Mark blocked when progress cannot continue at all; needing the user's answer is a yield, not a block. Mark yield when you finished a stage and the next step needs the user's decision, or when you need the user's answer before the next pass can do anything useful: the goal stays unfinished, the turn ends, and their next message resumes it.",
+    "description": "Report goal status by calling this tool; a prose status in your answer changes nothing. Mark complete only after checking the real result, with evidence. Mark blocked only when the same concrete obstacle keeps preventing progress; difficulty is not blocked, and needing the user's answer is a yield, not a block. Mark yield when a stage is finished and the next step is the user's decision, or when the next pass needs the user's answer: the goal stays unfinished, the turn ends, and their next message resumes it.",
     "input_schema": {
       "additionalProperties": false,
       "properties": {
@@ -402,7 +402,7 @@
           "type": "object"
         },
         "status": {
-          "description": "Use complete only when a critical verifier proves the goal; not_achieved to record verifier gaps; blocked when progress cannot continue at all; a needed user answer is a yield, not a block; yield when a stage is finished and the next step is the user's call, or when you need the user's answer before the next pass can do anything useful; advisory to append best-effort context without changing lifecycle state.",
+          "description": "complete only after checking the real result, with evidence; not_achieved to record verifier gaps; blocked only when the same concrete obstacle keeps preventing progress (difficulty is not blocked; a needed user answer is a yield); yield when a stage is finished and the next step is the user's call, or the next pass needs the user's answer; advisory to add context without changing the goal's state.",
           "enum": [
             "complete",
             "blocked",
@@ -508,7 +508,7 @@
   {
     "type": "tool_search_20251119",
     "name": "tool_search",
-    "description": "Search deferred tool definitions and return matching tool references.",
+    "description": "Search deferred tool definitions and return matching tool references. Deferred tools commonly include `Git`, `Run` (tests and verifier checks), `Web`, `tasks` (background work), `github`, `automation` (scheduling), `lsp`, `review`, `session_search` (past sessions), `terminal/run` and its siblings, `apply_patch`, and `grep_files`, plus connected MCP servers. Calling one by name also loads it.",
     "input_schema": {
       "type": "object",
       "properties": {

crates/tui/tests/fixtures/conformance/prompt/trusted_project_instructions.golden.json

@@ -1,9 +1,9 @@
 {
-  "system_sha256": "cd367daa552060c0b30a60263a509fdd25a0d92c89f24aa9f69c174d52076f3d",
-  "system_bytes": 8757,
+  "system_sha256": "d7879b781e50811d0ad331a4fb81f253b14a71b58eaf3ad822b978dcbd1cb0a9",
+  "system_bytes": 9790,
   "system_blocks": 5,
-  "tools_sha256": "52b3ff15230ed03aa771df2ae37660775ae7c040aa954c45f143357f2da65fca",
-  "tools_bytes": 19840,
+  "tools_sha256": "528fa9245bc93147bbafe5c5fe76d300973e092202a82525f1c80f313bfe3020",
+  "tools_bytes": 19792,
   "tool_count": 16,
   "tool_names": [
     "bash",
@@ -23,7 +23,7 @@
     "execute_tools",
     "tool_search"
   ],
-  "prefix_sha256": "7623ed8caaaf6ebe9183c42bc1d40a79d61b03618b18684820ac6b4457f09c90",
+  "prefix_sha256": "52540a921a733d17a813f4f02e70d1394ba749d768721bd013f5559f8daf7e62",
   "masks": [
     "<WORKSPACE>",
     "<HOME>",

crates/tui/tests/fixtures/conformance/prompt/trusted_project_instructions.system.golden.txt

@@ -27,9 +27,11 @@ to set a fact aside or proceed despite it; no one may tell you to invent one.
 The request is the whole mandate — everything inside it is yours to do.
 Do what the user's current request asks, no more. Act on clear, reversible work;
 ask when ambiguity is costly. Report adjacent issues instead of silently
-expanding scope. Irreversible actions, external publication, spending,
+expanding scope. Irreversible actions, external publication, spending
+real money (purchases, paid providers, billing),
 credentials, and material scope expansion require express user authorization in
-the current request; otherwise name the decision and ask.
+the current request; otherwise name the decision and ask. Sub-agents, workflows
+and goals within the current request are in scope.
 
 Honor active tool, approval, sandbox, skill, role, and project gates. Skill
 prohibitions stay binding; convenience creates no exception. If a gate blocks
@@ -45,6 +47,21 @@ moving or report exactly what remains and what you are waiting on.
 Hand back what changed, what was verified, and what remains.
 Never present a partial result as the whole.
 
+### Delegation and goals
+Independent parts of a request are the normal case for `agent` children: start
+them together in one message and keep working. Their results arrive on their
+own; never poll or sleep for them, and when only waiting remains, end the turn.
+Give each child a complete prompt and a disjoint file scope. A write-capable
+child owes evidence; inspect it, review the final diff, and run the checks
+yourself. Before calling a non-trivial change done, have an independent
+reviewer try to refute it.
+
+Use `create_goal` when a direct request, in any language, describes a
+verifiable end state that will take more than one turn; not for questions or
+one-shot edits. Mark a goal `blocked` only when the same concrete obstacle
+persists; difficulty is not blocked. Cost alone is not a reason to stop. Turns,
+time and tokens are limited only where the user or configuration sets a limit.
+
 ### Put guarantees in mechanism
 Authorization, ordering, stopping, schema validity, resource limits, and
 required checks belong in code, types, tests, tool gates, and runtime policy.

crates/tui/tests/fixtures/conformance/prompt/trusted_project_instructions.tools.golden.json

@@ -108,7 +108,7 @@
   },
   {
     "name": "create_goal",
-    "description": "Create the session's one persistent goal: a completion objective Codewhale keeps working toward across turns until it is verified complete, blocked, or the user stops it. A goal is for a durable objective that outlasts one turn: a multi-step outcome the user wants continued and verified. A question, a greeting, or a one-shot edit completes as an ordinary turn. When the user explicitly asks to use `/goal` or to make something the goal, `create_goal` is what records it; acknowledging it in prose records nothing. The objective is the user's full objective, not a shortened one-turn version. token_budget carries a budget the user stated; with none stated it stays unset. Creating a goal shows the user a one-line receipt (they can /goal pause or /goal clear), so it needs no separate confirmation. Only one unfinished goal exists at a time: an existing one is completed or cleared before another is created.",
+    "description": "Start the session's persistent goal when a request is an objective that needs more than one turn or verified completion, even if the user did not say \"goal\". Not for questions, greetings, or one-shot edits. Codewhale keeps working toward it across turns until it is verified complete, blocked, or the user stops it. When the user asks for `/goal` or to make something the goal, this call records it; prose records nothing. Keep the user's full objective, not a one-turn version. The user sees a one-line receipt (they can /goal pause or /goal clear), so no confirmation is needed. Only one unfinished goal exists at a time: complete or clear it before creating another.",
     "input_schema": {
       "additionalProperties": false,
       "properties": {
@@ -117,7 +117,7 @@
           "type": "string"
         },
         "token_budget": {
-          "description": "Optional soft token budget for the goal.",
+          "description": "Only set if the user gave a budget.",
           "minimum": 0,
           "type": "integer"
         }
@@ -409,7 +409,7 @@
   },
   {
     "name": "update_goal",
-    "description": "Update the runtime goal completion gate by calling this tool; a prose status in your answer does not change the goal or stop continuation. Critical verification may seal one immutable completion contract. Advisory review is append-only context and never completes, blocks, or pauses the goal. Mark blocked when progress cannot continue at all; needing the user's answer is a yield, not a block. Mark yield when you finished a stage and the next step needs the user's decision, or when you need the user's answer before the next pass can do anything useful: the goal stays unfinished, the turn ends, and their next message resumes it.",
+    "description": "Report goal status by calling this tool; a prose status in your answer changes nothing. Mark complete only after checking the real result, with evidence. Mark blocked only when the same concrete obstacle keeps preventing progress; difficulty is not blocked, and needing the user's answer is a yield, not a block. Mark yield when a stage is finished and the next step is the user's decision, or when the next pass needs the user's answer: the goal stays unfinished, the turn ends, and their next message resumes it.",
     "input_schema": {
       "additionalProperties": false,
       "properties": {
@@ -450,7 +450,7 @@
           "type": "object"
         },
         "status": {
-          "description": "Use complete only when a critical verifier proves the goal; not_achieved to record verifier gaps; blocked when progress cannot continue at all; a needed user answer is a yield, not a block; yield when a stage is finished and the next step is the user's call, or when you need the user's answer before the next pass can do anything useful; advisory to append best-effort context without changing lifecycle state.",
+          "description": "complete only after checking the real result, with evidence; not_achieved to record verifier gaps; blocked only when the same concrete obstacle keeps preventing progress (difficulty is not blocked; a needed user answer is a yield); yield when a stage is finished and the next step is the user's call, or the next pass needs the user's answer; advisory to add context without changing the goal's state.",
           "enum": [
             "complete",
             "blocked",
@@ -577,7 +577,7 @@
   {
     "type": "tool_search_20251119",
     "name": "tool_search",
-    "description": "Search deferred tool definitions and return matching tool references.",
+    "description": "Search deferred tool definitions and return matching tool references. Deferred tools commonly include `Git`, `Run` (tests and verifier checks), `Web`, `tasks` (background work), `github`, `automation` (scheduling), `lsp`, `review`, `session_search` (past sessions), `terminal/run` and its siblings, `apply_patch`, and `grep_files`, plus connected MCP servers. Calling one by name also loads it.",
     "input_schema": {
       "type": "object",
       "properties": {

crates/workflow-js/src/lib.rs

@@ -79,7 +79,7 @@ pub use vm::{VmLimits, WorkflowRunCancel, WorkflowVm, normalize_task_cwd, normal
 /// Fan-out may *declare* more work via `parallel()` / `pipeline()`, but the
 /// host admits at most this many live `task()` children at once; additional
 /// spawns wait for a slot.
-pub const WORKFLOW_MAX_CONCURRENT: usize = 16;
+pub const WORKFLOW_MAX_CONCURRENT: usize = 128;
 
 /// Maximum items per `parallel()` or `pipeline()` call (design §4.2).
 /// Bounds one materialized fan-out array; it does not limit total work.

docs/AUTOMATIC_WORKFLOWS.md

@@ -49,7 +49,7 @@ request orchestration explicitly.
 | `automatic` | `true` | Legacy compatibility field; currently not a launch switch. The model chooses orchestration under the active tool and approval policy. |
 | `auto_start_read_only` | `true` | Read-only plans may start without a write-approval card |
 | `require_approval_for_writes` | `true` | Gates the plan-approval card for writes / elevated starts |
-| `max_children` / `max_concurrent` / `max_depth` | `0` / `16` / `0` | Total children and structural plan depth are uncapped at zero; positive values are owner limits. Concurrency queues excess work. Runtime delegation has no default product depth cap and remains a separate authority setting. |
+| `max_children` / `max_concurrent` / `max_depth` | `0` / `64` / `0` | Total children and structural plan depth are uncapped at zero; positive values are owner limits. Concurrency queues excess work. Runtime delegation has no default product depth cap and remains a separate authority setting. |
 | `default_token_budget` | `0` | Declared token hint retained in receipts; `0` = no hint. It does not cap spend, child lifetime, or admission. |
 
 Elevated work (writes, shell beyond read-only, network, secrets, worktrees, high

docs/FLEET.md

@@ -469,7 +469,7 @@ Runtime policy.
 Default Workflow-to-fleet validation is intentionally bounded:
 
 - 1,000 total worker agents per Workflow run;
-- 16 live worker agents at once; larger populations queue (block) on the host's
+- 64 live worker agents at once by default (`[workflow] max_concurrent`, at most 128); larger populations queue (block) on the host's
   per-run concurrency gate until a live slot frees, then route through fleet;
 - Workflow IR structural nesting no deeper than 5;
 - Runtime child delegation defaults to 3 levels and has an opt-in hard ceiling

docs/TOOL_SURFACE.md

@@ -66,10 +66,10 @@ The direct schemas deliberately stay small:
 | `load_skill` | optional `name`, `query` | Load a named skill's `SKILL.md` body and companion-file list; omit `name` or use `name="list"` to list eligible skills, or use `query` to search names and descriptions. |
 | `tool_search` | `query`, optional matching controls | Discover policy-allowed deferred tools and add selected schemas to this conversation's toolbox. |
 
-Mode is an authority decision, not a synonym system. Plan, Work, and Operate
-use the same primitive identities. Plan centrally refuses `write`, `edit`, and
-`bash`; Work and Operate still pass those calls through approval, sandbox,
-trusted-path, repository-law, and managed-policy gates. Full Access changes
+Mode is an authority decision, not a synonym system. Plan and Work use the
+same primitive identities. Plan centrally refuses `write`, `edit`, and `bash`;
+Work still passes those calls through approval, sandbox, trusted-path,
+repository-law, and managed-policy gates. Full Access changes
 ordinary approval behavior but does not bypass hard safety or repository law.
 
 `update_plan` remains registered only for saved-artifact compatibility and is
@@ -266,11 +266,6 @@ Modes and permission postures are separate controls:
 - **Plan** keeps the stable primitive vocabulary but centrally refuses shell
   execution and file mutation.
 - **Work** is ordinary interactive execution.
-- **Operate** uses the same direct-tool authority as Work. Small work stays
-  direct; multi-step delegation uses a compact Workflow plan with dependencies,
-  bounded scopes, and completion evidence. Fleet manages the same sub-agents
-  and roles. One bounded, independent task can use a direct agent; `followup`
-  reuses that agent for continued work.
 - **Ask**, **Auto-Review**, and **Full Access** control approval behavior within
   an action-capable mode. They never widen Plan into write or shell access.
 

docs/WORKFLOW_AUTHORING.md

@@ -48,7 +48,7 @@ its own. Real work happens in sub-agents the script launches.
 
 ### Scale
 
-- Up to **16 concurrent** live agents in one run (additional spawns wait for a slot).
+- Up to **64 concurrent** live agents in one run by default (`[workflow] max_concurrent`, at most 128); additional spawns wait for a slot.
 - No default cumulative child limit; `[workflow] max_children = 0` leaves total work uncapped.
 - Owners can set a positive `max_children` limit and configure `max_concurrent`.
 - Automatic launch is model-judged on scope; the host enforces configured owner limits and plan validation.
@@ -182,7 +182,7 @@ Workflow-to-Runtime launch validation applies a conservative default shape
 before any Workflow IR is lowered to selected workers:
 
 - no default total worker limit; a positive owner-configured `max_children` still applies;
-- up to 16 live worker agents at once; larger populations queue (block) on the
+- up to 64 live worker agents at once by default (at most 128); larger populations queue (block) on the
   host's per-run concurrency gate until a live slot frees, then select through
   fleet and execute through Runtime;
 - no default structural nesting cap; positive owner `workflow.max_depth` values apply;

docs/WORKFLOW_EXPERIMENTAL_SEARCH.md

@@ -13,9 +13,10 @@ order), Lane (one running Workflow), Runtime (where/how/authority), and Operate
 
 ## Current foundation
 
-- The imperative Workflow VM admits at most 1,000 tasks per run and 16 live
-  tasks at once. The host's per-run concurrency gate is a semaphore sized
-  `WORKFLOW_MAX_CONCURRENT = 16` (`codewhale-workflow-js`); additional
+- The imperative Workflow VM admits at most 1,000 tasks per run and 64 live
+  tasks at once by default. The host's per-run concurrency gate is a semaphore
+  sized from `[workflow] max_concurrent` (default 64) and clamped to
+  `WORKFLOW_MAX_CONCURRENT = 128` (`codewhale-workflow-js`); additional
   `task()` spawns block on that gate until a live slot frees, then route
   through fleet. A larger declared population therefore queues at the gate,
   not through fleet itself.

docs/design/WORKFLOWS_GOAL_PARITY.md

@@ -122,7 +122,7 @@ Arena Mode) — official docs at x.ai/cli returned 404 for the deep pages.
 | Receipts / history | run manifests | session log | `.codewhale/workflow-runs.jsonl`, `/workflow status` lists journaled runs, trophy cards | parity |
 | Failure handling / retry | pause kinds; strategist restructure | model judgment; ralph rounds | verifier gates, no-progress pause, blocked, `[goal] max_continuations` | parity; auto-restructure (strategist) deliberately absent |
 | Cancellation | `/workflow stop <name>` native | cancel via signal | `/workflow cancel [id]` native (this lane); Esc cancels children | parity |
-| Fan-out inside a workflow | `parallel()`, agent budget 128 | `parallel()/pipeline()`, no budget vocabulary | `parallel()/pipeline()`, 16 live / 1000 total, token budget | parity |
+| Fan-out inside a workflow | `parallel()`, agent budget 128 | `parallel()/pipeline()`, no budget vocabulary | `parallel()/pipeline()`, 64 live by default (128 max) / 1000 total, token budget | parity |
 | Interrupt semantics | Ctrl+C pauses the goal | cancellation pauses the goal | Esc keeps goal active, cancels the timer, `/goal` now says how to continue | deliberately different (2026-07-24 dogfood decision) |
 | Docs accuracy | — | — | fixed: `/workflow run`, `[workflow]` honored, `/goal` verbs | fixed |
 

docs/zh_hans/AUTOMATIC_WORKFLOWS.md

@@ -44,7 +44,7 @@
 | `automatic` | `true` | 保留的兼容字段，目前不是启动开关；模型在当前工具和审批策略内选择编排。 |
 | `auto_start_read_only` | `true` | 只读计划可以不带写入审批卡片直接启动 |
 | `require_approval_for_writes` | `true` | 写入／提权启动前必须经过的计划审批卡片 |
-| `max_children` / `max_concurrent` / `max_depth` | `0` / `16` / `0` | 总任务数及计划结构深度为 0 时不设上限；正值为操作者上限。超出并发额度的工作排队。Runtime 委派默认无产品深度限制，仍是独立的权限设置。 |
+| `max_children` / `max_concurrent` / `max_depth` | `0` / `64` / `0` | 总任务数及计划结构深度为 0 时不设上限；正值为操作者上限。超出并发额度的工作排队。Runtime 委派默认无产品深度限制，仍是独立的权限设置。 |
 | `default_token_budget` | `0` | 回执保留的 token 提示；`0` 表示无提示。它不限制开销、子项运行时间或准入。 |
 
 提权（elevated）工作（写入、只读之外的 shell、网络、机密、worktree、高预算）

docs/zh_hans/FLEET.md

@@ -208,7 +208,7 @@ fleet 仍然是子智能体名册与成员选择表面。它拥有成员身份
 默认的 Workflow 到 fleet 的校验刻意有界：
 
 - 每次 Workflow 运行最多 1,000 个 worker 智能体；
-- 同时最多 16 个存活的 worker 智能体；更大的群体在宿主的每次运行并发门控上排队（阻塞），直到有存活槽释放，然后经 fleet 路由；
+- 默认同时最多 64 个存活的 worker 智能体（上限 128）；更大的群体在宿主的每次运行并发门控上排队（阻塞），直到有存活槽释放，然后经 fleet 路由；
 - Workflow IR 的结构嵌套不超过 5 层；
 - Runtime 子级委派默认 3 层，并有选择加入的硬上限 8 层，与 Workflow 文档的结构深度相互独立；
 - 只允许有界循环（必须提供 `max_iterations`）；

docs/zh_hans/TOOL_SURFACE.md

@@ -65,8 +65,8 @@ Plan 只注册前台 shell 表面（因此没有 `task_shell_wait`），但仅
 | `load_skill` | 可选的 `name`、`query` | 加载命名技能的 `SKILL.md` 正文及配套文件列表；省略 `name` 或使用 `name="list"` 列出可调用技能，也可用 `query` 搜索名称与描述。 |
 | `tool_search` | `query`、可选的匹配控制项 | 发现策略允许的延迟工具，并把选中的 schema 加入本次对话的工具箱。 |
 
-模式是一项权威决定，而不是同义词体系。Plan、Work 和 Operate 使用同一套原语身份。
-Plan 在中心位置拒绝 `write`、`edit` 和 `bash`；Work 与 Operate 仍会让这些调用通过
+模式是一项权威决定，而不是同义词体系。Plan 和 Work 使用同一套原语身份。
+Plan 在中心位置拒绝 `write`、`edit` 和 `bash`；Work 仍会让这些调用通过
 审批（approval）、沙箱（sandbox）、受信任路径、仓库规则（repository law）和托管策略等闸门。
 Full Access（完全访问）会改变常规审批行为，但不会绕过硬性安全限制或仓库规则。
 
@@ -210,10 +210,6 @@ SHA-256 摘要；更大的载荷保持不可用。提供商（provider）适配
 
 - **Plan** 保持稳定的原语词汇，但在中心位置拒绝 shell 执行和文件改动。
 - **Work** 是常规的交互式执行。
-- **Operate** 使用与 Work 相同的直接工具权威。小规模工作保持直接进行；
-  多步委派使用一个紧凑的 Workflow 计划，带依赖关系、有界范围和完成证据。
-  Fleet（智能体团队）管理同一批智能体和角色。一个独立的有界任务可以直接使用 `agent`；
-  `followup` 会复用该智能体继续工作。
 - **Ask**、**Auto-Review** 和 **Full Access** 控制在具备行动能力的模式内的审批行为。
   它们绝不会把 Plan 放宽为写入或 shell 访问。
 

docs/zh_hans/WORKFLOW_AUTHORING.md

@@ -46,7 +46,7 @@ Workflow 脚本**只是协调者**。它自己没有文件系统，也没有 she
 
 ### 规模
 
-- 单次运行中最多 **16 个并发**活跃智能体（额外的启动请求会排队等空位）。
+- 单次运行默认最多 **64 个并发**活跃智能体（`[workflow] max_concurrent`，上限 128；额外的启动请求会排队等空位）。
 - 默认不限制单次运行的累计子智能体数量；`[workflow] max_children = 0` 表示不设总量上限。
 - 配置的 `max_children` 和 `max_concurrent` 可以进一步收紧这些上限。
 - 自动启动由模型按范围判断；主机只强制 `max_children` / `max_depth` 这两个硬上限。
@@ -145,7 +145,7 @@ Workflow 负责计划本身：阶段、分支、循环、归约器和中间结
 一个保守的默认形态：
 
 - 单次 Workflow 默认不设 worker 总量上限；所有者配置的正数 `max_children` 仍然生效；
-- 同时最多 16 个活跃 worker 智能体；数量更多时会在主机按运行设立的并发门禁上排队（阻塞），
+- 默认同时最多 64 个活跃 worker 智能体（上限 128）；数量更多时会在主机按运行设立的并发门禁上排队（阻塞），
   等空出位置后，再经 Fleet 选择、由 Runtime 执行；
 - Workflow IR 默认不设置结构嵌套上限；正数 `workflow.max_depth` 配置仍生效；
 - Runtime 子级委派默认不设置产品深度上限；显式所有者权限仍生效，与 Workflow IR 形态分开；

web/data/agent-docs.generated.json

@@ -107,8 +107,8 @@
     "sources": [
       {
         "path": "docs/TOOL_SURFACE.md",
-        "sha256": "949991cc3ca1b4281507fade514ea5a6fd7dac66706ea1e2859a2ce28b5e30ac",
-        "content": "# Tool surface\n\n> 阅读简体中文版：[zh_hans/TOOL_SURFACE.md](zh_hans/TOOL_SURFACE.md)。\n\nThis document describes the current model-facing tool contract. The v0.9.1\ncutover that produced it is recorded in `docs/RUNTIME_SIMPLIFICATION_DESIGN.md`;\nread the workspace version from `Cargo.toml`, not from this line. The registry\nremains larger than the first-turn catalog so\nsaved transcripts can replay and uncommon capabilities can be loaded on demand.\nThe model should learn one canonical name for each common operation.\n\nImplementation sources:\n\n- `crates/engine/src/core/engine/tool_catalog.rs` owns the eager/deferred catalog.\n- `crates/engine/src/tools/registry.rs` registers canonical tools and hidden aliases.\n- `crates/engine/src/tools/{file,file_tool,shell}.rs` own the small foreground\n  primitive behavior and schemas; the other native tools remain searchable.\n- `docs/RUNTIME_SIMPLIFICATION_DESIGN.md` records the v0.9.1 cutover and receipt.\n\n## Default-active contract\n\nNew turns start with sixteen eager native names plus synthetic `tool_search`:\n\n1. `read`\n2. `write`\n3. `edit`\n4. `file_search`\n5. `bash`\n6. `agent`\n7. `workflow`\n8. `todo_write`\n9. `create_goal`\n10. `get_goal`\n11. `update_goal`\n12. `task_shell_wait`\n13. `present`\n14. `load_skill`\n15. `context_archive_get`\n16. `context_archive_search`\n17. `tool_search` (synthetic, always active)\n\nThe sixteen native names are `DEFAULT_ACTIVE_NATIVE_TOOLS` in\n`crates/engine/src/core/engine/tool_catalog.rs`, pinned by\n`default_active_contract_keeps_discovery_and_core_tools_eager`. An authority\nboundary may remove `agent` at the maximum child depth, and Plan registers only\nthe foreground shell surface (so no `task_shell_wait`), but route size alone\nmust not change this core vocabulary.\n\nThe direct schemas deliberately stay small:\n\n| Tool | Input | Purpose |\n|---|---|---|\n| `read` | `path`, optional `offset`, optional `limit` | Read a bounded file window with explicit continuation or truncation notices. |\n| `write` | `path`, `content` | Create or replace a file. |\n| `edit` | `path`, `edits` | Apply one or more unambiguous text replacements against one original snapshot. |\n| `file_search` | `query`, optional `path`, `limit`, `extensions`, `exclude` | Find files by name, path fragment or glob and return bounded, ranked matches. Respects ignore files; `exclude` replaces default exclusions. |\n| `bash` | `command`, optional `timeout`, optional `description` | Run one cancellable foreground shell command and return a bounded tail. The optional description is display-only. |\n| `agent` | delegated task and optional scope/context controls | Start or inspect focused child work. |\n| `workflow` | plan/script/source_path plus run controls | Coordinate multi-agent phases with dependencies and completion checks. |\n| `todo_write` | complete replacement list of `{content, status}` items | Keep optional, agent-owned progress notes for genuinely multi-step work. |\n| `create_goal` | objective plus optional budget | Start the session goal the turn works toward. |\n| `get_goal` | none | Read the active goal and its progress. |\n| `update_goal` | terminal status | Mark the goal complete or blocked. |\n| `task_shell_wait` | `task_id`, optional `wait`, `timeout_ms`, `cancel`, `gate` | Poll or stop a background shell task. Completion still arrives as a runtime event, so use it for early output, true barriers, or gate evidence. |\n| `present` | `files`, optional `note` | Declare 1–32 existing workspace files as final deliverables with a read-only SHA-256 handoff receipt; nothing is copied or moved. |\n| `load_skill` | optional `name`, `query` | Load a named skill's `SKILL.md` body and companion-file list; omit `name` or use `name=\"list\"` to list eligible skills, or use `query` to search names and descriptions. |\n| `tool_search` | `query`, optional matching controls | Discover policy-allowed deferred tools and add selected schemas to this conversation's toolbox. |\n\nMode is an authority decision, not a synonym system. Plan, Work, and Operate\nuse the same primitive identities. Plan centrally refuses `write`, `edit`, and\n`bash`; Work and Operate still pass those calls through approval, sandbox,\ntrusted-path, repository-law, and managed-policy gates. Full Access changes\nordinary approval behavior but does not bypass hard safety or repository law.\n\n`update_plan` remains registered only for saved-artifact compatibility and is\nnot model-visible. `tasks`, `Git`, `Run`, `Web`, `remember`, and other\nspecialized capabilities are searchable rather than first-turn ceremony.\n\nOn the TUI's default (calm) shell card the Bash description is the headline,\nshown as written apart from stripped terminal escapes, collapsed whitespace and\na length bound, and the command sits on its own `$` row directly under it in\nevery state and at every width, including automatic runs. A card without a\ndescription leads with Line truncated
+        "sha256": "338ba7e4aa1ca97d496264e81f53b1f2ff3543292e2a6b2cae91a44b01a21366",
+        "content": "# Tool surface\n\n> 阅读简体中文版：[zh_hans/TOOL_SURFACE.md](zh_hans/TOOL_SURFACE.md)。\n\nThis document describes the current model-facing tool contract. The v0.9.1\ncutover that produced it is recorded in `docs/RUNTIME_SIMPLIFICATION_DESIGN.md`;\nread the workspace version from `Cargo.toml`, not from this line. The registry\nremains larger than the first-turn catalog so\nsaved transcripts can replay and uncommon capabilities can be loaded on demand.\nThe model should learn one canonical name for each common operation.\n\nImplementation sources:\n\n- `crates/engine/src/core/engine/tool_catalog.rs` owns the eager/deferred catalog.\n- `crates/engine/src/tools/registry.rs` registers canonical tools and hidden aliases.\n- `crates/engine/src/tools/{file,file_tool,shell}.rs` own the small foreground\n  primitive behavior and schemas; the other native tools remain searchable.\n- `docs/RUNTIME_SIMPLIFICATION_DESIGN.md` records the v0.9.1 cutover and receipt.\n\n## Default-active contract\n\nNew turns start with sixteen eager native names plus synthetic `tool_search`:\n\n1. `read`\n2. `write`\n3. `edit`\n4. `file_search`\n5. `bash`\n6. `agent`\n7. `workflow`\n8. `todo_write`\n9. `create_goal`\n10. `get_goal`\n11. `update_goal`\n12. `task_shell_wait`\n13. `present`\n14. `load_skill`\n15. `context_archive_get`\n16. `context_archive_search`\n17. `tool_search` (synthetic, always active)\n\nThe sixteen native names are `DEFAULT_ACTIVE_NATIVE_TOOLS` in\n`crates/engine/src/core/engine/tool_catalog.rs`, pinned by\n`default_active_contract_keeps_discovery_and_core_tools_eager`. An authority\nboundary may remove `agent` at the maximum child depth, and Plan registers only\nthe foreground shell surface (so no `task_shell_wait`), but route size alone\nmust not change this core vocabulary.\n\nThe direct schemas deliberately stay small:\n\n| Tool | Input | Purpose |\n|---|---|---|\n| `read` | `path`, optional `offset`, optional `limit` | Read a bounded file window with explicit continuation or truncation notices. |\n| `write` | `path`, `content` | Create or replace a file. |\n| `edit` | `path`, `edits` | Apply one or more unambiguous text replacements against one original snapshot. |\n| `file_search` | `query`, optional `path`, `limit`, `extensions`, `exclude` | Find files by name, path fragment or glob and return bounded, ranked matches. Respects ignore files; `exclude` replaces default exclusions. |\n| `bash` | `command`, optional `timeout`, optional `description` | Run one cancellable foreground shell command and return a bounded tail. The optional description is display-only. |\n| `agent` | delegated task and optional scope/context controls | Start or inspect focused child work. |\n| `workflow` | plan/script/source_path plus run controls | Coordinate multi-agent phases with dependencies and completion checks. |\n| `todo_write` | complete replacement list of `{content, status}` items | Keep optional, agent-owned progress notes for genuinely multi-step work. |\n| `create_goal` | objective plus optional budget | Start the session goal the turn works toward. |\n| `get_goal` | none | Read the active goal and its progress. |\n| `update_goal` | terminal status | Mark the goal complete or blocked. |\n| `task_shell_wait` | `task_id`, optional `wait`, `timeout_ms`, `cancel`, `gate` | Poll or stop a background shell task. Completion still arrives as a runtime event, so use it for early output, true barriers, or gate evidence. |\n| `present` | `files`, optional `note` | Declare 1–32 existing workspace files as final deliverables with a read-only SHA-256 handoff receipt; nothing is copied or moved. |\n| `load_skill` | optional `name`, `query` | Load a named skill's `SKILL.md` body and companion-file list; omit `name` or use `name=\"list\"` to list eligible skills, or use `query` to search names and descriptions. |\n| `tool_search` | `query`, optional matching controls | Discover policy-allowed deferred tools and add selected schemas to this conversation's toolbox. |\n\nMode is an authority decision, not a synonym system. Plan and Work use the\nsame primitive identities. Plan centrally refuses `write`, `edit`, and `bash`;\nWork still passes those calls through approval, sandbox, trusted-path,\nrepository-law, and managed-policy gates. Full Access changes\nordinary approval behavior but does not bypass hard safety or repository law.\n\n`update_plan` remains registered only for saved-artifact compatibility and is\nnot model-visible. `tasks`, `Git`, `Run`, `Web`, `remember`, and other\nspecialized capabilities are searchable rather than first-turn ceremony.\n\nOn the TUI's default (calm) shell card the Bash description is the headline,\nshown as written apart from stripped terminal escapes, collapsed whitespace and\na length bound, and the command sits on its own `$` row directly under it in\nevery state and at every width, including automatic runs. A card without a\ndescription leads with the `$` command instLine truncated
       },
       {
         "path": "docs/TOOL_LIFECYCLE.md",
@@ -145,13 +145,13 @@
     "sources": [
       {
         "path": "docs/FLEET.md",
-        "sha256": "10a8c50860305920357042c95fb1c471696a68cc8fd219e571157563e8494654",
-        "content": "# Agent fleet\n\n> Baca terjemahan bahasa Indonesia: [id/FLEET.md](id/FLEET.md)\n\nAgent fleet is the local-first roster and member-selection layer for durable\nmulti-worker runs. It does not execute or authorize work. After fleet resolves\nwho should participate, the delegated coordinator launches a headless\n`codewhale exec` run and the Runtime tracks it durably. See\n[AGENT_RUNTIME.md](AGENT_RUNTIME.md) for how sub-agents, `exec`, and\nfleet-backed workers converge on one runtime. In product language, a user may\nstill \"open a sub-agent\"; in architecture language, durable nested work uses a\nfleet member identity with delegated runtime execution.\n\n## Naming and compatibility boundary\n\n**Fleet** is the public product noun. The durable ledger, saved rosters, config\ntables, and `--fleet` flag share that name:\n\n| Surface | Canonical |\n| --- | --- |\n| CLI | `codewhale fleet …` |\n| Slash command | `/fleet …` |\n\nThese shared names are load-bearing wherever changing them would break\nexisting workspaces, receipts, or scripts:\n\n- the durable ledger `.codewhale/fleet.jsonl` and the log directories\n  `.codewhale/fleet/` and `.codewhale/fleet-host/`;\n- saved rosters `fleets/<name>.toml` and their `schema = \"fleet\"` header, under\n  `$CODEWHALE_HOME/` or the workspace's `.codewhale/` (checked-in rosters at the\n  workspace root's `fleets/` are still read);\n- the `[fleet]` config table (inline `[fleets.*]` tables were removed in 0.9.14; named fleets live in `fleets/<name>.toml` files);\n- the `codewhale workflow run --fleet <name>` flag;\n- wire, receipt, and control-plane operation ids such as `fleet.status`.\n\nThe rest of this document uses fleet as the public product noun and retains\nthese literal paths, keys, flags, and ids.\n\nUse a fleet roster rather than anonymous short-lived `agent` fanout whenever a\ndelegated run needs stable member identities across retries, sleep/restart,\nremote execution, receipts, or a ledgered audit trail. The initial CLI surface\nis:\n\nFor a guided start-to-monitor walkthrough that combines fleet task specs with\nWorkflow authoring, see [fleet + Workflow Tutorial](FLEET_WORKFLOW_TUTORIAL.md).\n\n```sh\ncodewhale fleet init\ncodewhale fleet run tasks.json --check   # validate only; nothing is created or launched\ncodewhale fleet run tasks.json --max-workers 4\ncodewhale fleet status\ncodewhale fleet inspect <worker-id>\ncodewhale fleet logs <worker-id>\ncodewhale fleet artifacts <worker-id>\ncodewhale fleet interrupt <worker-id>\ncodewhale fleet restart <worker-id>\ncodewhale fleet resume <run-id>\ncodewhale fleet stop --all\n```\n\n`codewhale fleet resume <run-id>` is the restart-recovery verb: it replays the\nledger, reconciles any in-flight lease whose worker stopped heartbeating\n(retrying within the task's budget, else failing and escalating per the alert\npolicy), and prints the post-resume status. It launches no new work and is\nidempotent, so it is safe to run after a manager exit, laptop sleep, or runtime\nrestart.\n\nCoordinator state for fleet-backed runs is stored under the workspace in\n`.codewhale/fleet.jsonl`. Worker logs and adapter logs are stored under\n`.codewhale/fleet/` and `.codewhale/fleet-host/`.\n\n## Public contract: identity, membership, and selection\n\n**Fleet** = the user's model inventory: who is in the roster and which member is selected.\n\nA public fleet identity consists only of:\n\n- a stable member id and an optional user-facing name;\n- a semantic role, such as `explore`, `implement`, or `reviewer` (the legacy\n  spellings `worker`, `scout`, `builder`, `verifier`, `consultant`, and `oracle`\n  are still accepted on input and map to `general`, `explore`, `implement`,\n  `test`, and `advisor`);\n- an exact provider/model identity, or an explicit inherited route;\n- visible roster state or origin.\n\nProject or workspace trust, filesystem and network reach, secret access,\napproval mode, sandboxing, tool authorization, and every other form of runtime\nauthority are separate delegated-coordination and Runtime policy inputs. They\nare never fleet identity fields, and they never select or reroute a fleet\nmember. The Runtime applies and clamps those policies only after member\nselection; if the selected member cannot run inside the effective envelope,\nlaunch fails closed instead of choosing somebody else.\n\nNatural-language member selection is deterministic. A caller may name:\n\n- an exact member id, optionally as `member:<id>` or `id:<id>`;\n- a unique user-facing member name, optionally as `name:<name>`;\n- a unique semantic role, for example `explore` or `role:explore`;\n- an exact pinned model id, for example `deepseek-v4-flash`, or its offline\n  display name, for example `DeepSeek V4 Flash`; or\n- an exact `route:<provider>/<model>`.\n\nAn unqualified exact member id wins. Every other match succeeds only when it\nidentifies one distinct roster member. Multiple matches produce an ambiguity\nerror Line truncated
+        "sha256": "d0ef73ac4566845d3906cff4d325613909485f34197a4b042efe9a078029bea6",
+        "content": "# Agent fleet\n\n> Baca terjemahan bahasa Indonesia: [id/FLEET.md](id/FLEET.md)\n\nAgent fleet is the local-first roster and member-selection layer for durable\nmulti-worker runs. It does not execute or authorize work. After fleet resolves\nwho should participate, the delegated coordinator launches a headless\n`codewhale exec` run and the Runtime tracks it durably. See\n[AGENT_RUNTIME.md](AGENT_RUNTIME.md) for how sub-agents, `exec`, and\nfleet-backed workers converge on one runtime. In product language, a user may\nstill \"open a sub-agent\"; in architecture language, durable nested work uses a\nfleet member identity with delegated runtime execution.\n\n## Naming and compatibility boundary\n\n**Fleet** is the public product noun. The durable ledger, saved rosters, config\ntables, and `--fleet` flag share that name:\n\n| Surface | Canonical |\n| --- | --- |\n| CLI | `codewhale fleet …` |\n| Slash command | `/fleet …` |\n\nThese shared names are load-bearing wherever changing them would break\nexisting workspaces, receipts, or scripts:\n\n- the durable ledger `.codewhale/fleet.jsonl` and the log directories\n  `.codewhale/fleet/` and `.codewhale/fleet-host/`;\n- saved rosters `fleets/<name>.toml` and their `schema = \"fleet\"` header, under\n  `$CODEWHALE_HOME/` or the workspace's `.codewhale/` (checked-in rosters at the\n  workspace root's `fleets/` are still read);\n- the `[fleet]` config table (inline `[fleets.*]` tables were removed in 0.9.14; named fleets live in `fleets/<name>.toml` files);\n- the `codewhale workflow run --fleet <name>` flag;\n- wire, receipt, and control-plane operation ids such as `fleet.status`.\n\nThe rest of this document uses fleet as the public product noun and retains\nthese literal paths, keys, flags, and ids.\n\nUse a fleet roster rather than anonymous short-lived `agent` fanout whenever a\ndelegated run needs stable member identities across retries, sleep/restart,\nremote execution, receipts, or a ledgered audit trail. The initial CLI surface\nis:\n\nFor a guided start-to-monitor walkthrough that combines fleet task specs with\nWorkflow authoring, see [fleet + Workflow Tutorial](FLEET_WORKFLOW_TUTORIAL.md).\n\n```sh\ncodewhale fleet init\ncodewhale fleet run tasks.json --check   # validate only; nothing is created or launched\ncodewhale fleet run tasks.json --max-workers 4\ncodewhale fleet status\ncodewhale fleet inspect <worker-id>\ncodewhale fleet logs <worker-id>\ncodewhale fleet artifacts <worker-id>\ncodewhale fleet interrupt <worker-id>\ncodewhale fleet restart <worker-id>\ncodewhale fleet resume <run-id>\ncodewhale fleet stop --all\n```\n\n`codewhale fleet resume <run-id>` is the restart-recovery verb: it replays the\nledger, reconciles any in-flight lease whose worker stopped heartbeating\n(retrying within the task's budget, else failing and escalating per the alert\npolicy), and prints the post-resume status. It launches no new work and is\nidempotent, so it is safe to run after a manager exit, laptop sleep, or runtime\nrestart.\n\nCoordinator state for fleet-backed runs is stored under the workspace in\n`.codewhale/fleet.jsonl`. Worker logs and adapter logs are stored under\n`.codewhale/fleet/` and `.codewhale/fleet-host/`.\n\n## Public contract: identity, membership, and selection\n\n**Fleet** = the user's model inventory: who is in the roster and which member is selected.\n\nA public fleet identity consists only of:\n\n- a stable member id and an optional user-facing name;\n- a semantic role, such as `explore`, `implement`, or `reviewer` (the legacy\n  spellings `worker`, `scout`, `builder`, `verifier`, `consultant`, and `oracle`\n  are still accepted on input and map to `general`, `explore`, `implement`,\n  `test`, and `advisor`);\n- an exact provider/model identity, or an explicit inherited route;\n- visible roster state or origin.\n\nProject or workspace trust, filesystem and network reach, secret access,\napproval mode, sandboxing, tool authorization, and every other form of runtime\nauthority are separate delegated-coordination and Runtime policy inputs. They\nare never fleet identity fields, and they never select or reroute a fleet\nmember. The Runtime applies and clamps those policies only after member\nselection; if the selected member cannot run inside the effective envelope,\nlaunch fails closed instead of choosing somebody else.\n\nNatural-language member selection is deterministic. A caller may name:\n\n- an exact member id, optionally as `member:<id>` or `id:<id>`;\n- a unique user-facing member name, optionally as `name:<name>`;\n- a unique semantic role, for example `explore` or `role:explore`;\n- an exact pinned model id, for example `deepseek-v4-flash`, or its offline\n  display name, for example `DeepSeek V4 Flash`; or\n- an exact `route:<provider>/<model>`.\n\nAn unqualified exact member id wins. Every other match succeeds only when it\nidentifies one distinct roster member. Multiple matches produce an ambiguity\nerror Line truncated
       },
       {
         "path": "docs/WORKFLOW_AUTHORING.md",
-        "sha256": "8a2433da7a3d025c01de1a98224719ef1351e72a039fcc7c55801243fcd2bd90",
-        "content": "# Workflow Authoring\n\n> 阅读简体中文版：[zh_hans/WORKFLOW_AUTHORING.md](zh_hans/WORKFLOW_AUTHORING.md)。\n\n> **Ordinary multi-agent work does not require this file.** In Operate, send\n> normal messages. Small work stays direct; multiple delegated steps use a\n> compact Workflow plan with dependencies, bounded scopes, and completion\n> evidence. Fleet manages the same sub-agents and roles. One bounded,\n> independent task can use a direct agent, with `followup` for continued work.\n> Act/Agent may also use optional soft-auto launch. See\n> [Automatic Workflows](AUTOMATIC_WORKFLOWS.md).\n\nWorkflow has one runtime boundary: authored source lowers to typed\nRust `WorkflowSpec`, Rust validates the IR, and the scheduler/headless worker\nruntime executes leaves. Authoring languages do not get hidden authority to own\nfiles, shell, network, providers, cancellation, or TUI state.\n\nCompatibility launch paths on the `workflow` tool:\n\n| Input | When to use |\n|-------|-------------|\n| `plan` | Structured goal / phases / children (preferred agent path) |\n| `script` | Short inline JS the model owns |\n| `source_path` | Checked-in `.workflow.js` / `.workflow.ts` in the workspace |\n\nUse `agent(action=\"roster\")` to inspect the saved Fleet models and roles before\nassigning children. Native plan children accept `model` for a saved shortlist\nselector, or `role`/`profile` for a saved assignment. Named Exact Fleets keep\ntheir member routes fixed and reject per-step model overrides. Plan children\nalso accept `cwd`, a repository-relative working directory — required in\nmulti-repository workspaces so the child (and worktree isolation) resolves the\nright repository, mirroring `task({cwd})`.\n\nFor a guided walkthrough from fleet task specs to Workflow authoring and\nmonitoring, see [fleet + Workflow Tutorial](FLEET_WORKFLOW_TUTORIAL.md).\n\n\n## Access model\n\nThe Workflow script is a **coordinator only**. It has no filesystem or shell of\nits own. Real work happens in sub-agents the script launches.\n\n| Layer | What it can access |\n|-------|--------------------|\n| Workflow script (JS VM) | Script variables, branching/loops, `task()` / `parallel()` / `pipeline()`, `phase` / `log`, `budget` / `args`. **No** direct FS, shell, network, env, imports, clock, or randomness. |\n| Workflow-spawned sub-agents | Normal tool surface (read/search/edit/write, shell, web, MCP) subject to role posture, allowlists, and parent policy. File edits for write-capable roles auto-accept under Workflow; shell / web / MCP still require parent auto-approve or fail closed. |\n| Parent session | Working directory, configured tools/MCP, permission mode, sandbox/network rules. |\n\n### Scale\n\n- Up to **16 concurrent** live agents in one run (additional spawns wait for a slot).\n- No default cumulative child limit; `[workflow] max_children = 0` leaves total work uncapped.\n- Owners can set a positive `max_children` limit and configure `max_concurrent`.\n- Automatic launch is model-judged on scope; the host enforces configured owner limits and plan validation.\n- Plan the population the work needs and let the host queue and clamp it.\n  These ceilings are enforcement, not a reason to pre-shrink a valid plan.\n\nSee the Workflow JS sandbox tests for the fail-closed host surface inventory.\n\n## Language Choice\n\n| Surface | Strength | Tradeoff | Stance |\n|---|---|---|---|\n| YAML / JSON IR | Simple, reviewable, no runtime | Verbose for generated workflows | Keep as interchange/debug format |\n| JavaScript | Familiar object syntax and easy agent generation | Unsafe if executed as a general runtime | First-class authoring through declarative compile-only subset |\n| TypeScript | Best editor/types story for workflow SDK | Needs stripping/typechecking if full TS is supported | Same compile-only subset for now; richer SDK later |\n\nThe default high-capability path is TypeScript/JavaScript authoring, but only as\na compile step. The compiler accepts a JSON-compatible object inside\n`workflow({...})` from `.workflow.js` or `.workflow.ts`, lowers it to\n`WorkflowSpec`, and runs the Rust validation gate. (Starlark authoring was a\nbootstrap reference and has been removed; Workflow authoring is JS-only.)\n\n## Contract\n\nAccepted source shape:\n\n```js\nexport default workflow({\n  \"id\": \"issue-audit-js\",\n  \"goal\": \"Audit an issue fix with parallel agents\",\n  \"nodes\": [\n    {\n      \"branch\": {\n        \"id\": \"parallel-audit\",\n        \"children\": [\n          { \"agent\": { \"id\": \"code-audit\", \"prompt\": \"Review code\", \"agent_type\": \"review\" } },\n          { \"agent\": { \"id\": \"test-audit\", \"prompt\": \"Review tests\", \"agent_type\": \"verifier\" } }\n        ]\n      }\n    },\n    { \"reduce\": { \"id\": \"summary\", \"inputs\": [\"code-audit\", \"test-audit\"], \"prompt\": \"Summarize\" } }\n  ]\n});\n```\n\nSupported node wrappers: `agent`, `branch`, `sequence`, `reduceLine truncated
+        "sha256": "e6ed35fa3995c7cd226e5e22af9c551c3f557b7a73bd5c624c25d1cf139564d9",
+        "content": "# Workflow Authoring\n\n> 阅读简体中文版：[zh_hans/WORKFLOW_AUTHORING.md](zh_hans/WORKFLOW_AUTHORING.md)。\n\n> **Ordinary multi-agent work does not require this file.** In Operate, send\n> normal messages. Small work stays direct; multiple delegated steps use a\n> compact Workflow plan with dependencies, bounded scopes, and completion\n> evidence. Fleet manages the same sub-agents and roles. One bounded,\n> independent task can use a direct agent, with `followup` for continued work.\n> Act/Agent may also use optional soft-auto launch. See\n> [Automatic Workflows](AUTOMATIC_WORKFLOWS.md).\n\nWorkflow has one runtime boundary: authored source lowers to typed\nRust `WorkflowSpec`, Rust validates the IR, and the scheduler/headless worker\nruntime executes leaves. Authoring languages do not get hidden authority to own\nfiles, shell, network, providers, cancellation, or TUI state.\n\nCompatibility launch paths on the `workflow` tool:\n\n| Input | When to use |\n|-------|-------------|\n| `plan` | Structured goal / phases / children (preferred agent path) |\n| `script` | Short inline JS the model owns |\n| `source_path` | Checked-in `.workflow.js` / `.workflow.ts` in the workspace |\n\nUse `agent(action=\"roster\")` to inspect the saved Fleet models and roles before\nassigning children. Native plan children accept `model` for a saved shortlist\nselector, or `role`/`profile` for a saved assignment. Named Exact Fleets keep\ntheir member routes fixed and reject per-step model overrides. Plan children\nalso accept `cwd`, a repository-relative working directory — required in\nmulti-repository workspaces so the child (and worktree isolation) resolves the\nright repository, mirroring `task({cwd})`.\n\nFor a guided walkthrough from fleet task specs to Workflow authoring and\nmonitoring, see [fleet + Workflow Tutorial](FLEET_WORKFLOW_TUTORIAL.md).\n\n\n## Access model\n\nThe Workflow script is a **coordinator only**. It has no filesystem or shell of\nits own. Real work happens in sub-agents the script launches.\n\n| Layer | What it can access |\n|-------|--------------------|\n| Workflow script (JS VM) | Script variables, branching/loops, `task()` / `parallel()` / `pipeline()`, `phase` / `log`, `budget` / `args`. **No** direct FS, shell, network, env, imports, clock, or randomness. |\n| Workflow-spawned sub-agents | Normal tool surface (read/search/edit/write, shell, web, MCP) subject to role posture, allowlists, and parent policy. File edits for write-capable roles auto-accept under Workflow; shell / web / MCP still require parent auto-approve or fail closed. |\n| Parent session | Working directory, configured tools/MCP, permission mode, sandbox/network rules. |\n\n### Scale\n\n- Up to **64 concurrent** live agents in one run by default (`[workflow] max_concurrent`, at most 128); additional spawns wait for a slot.\n- No default cumulative child limit; `[workflow] max_children = 0` leaves total work uncapped.\n- Owners can set a positive `max_children` limit and configure `max_concurrent`.\n- Automatic launch is model-judged on scope; the host enforces configured owner limits and plan validation.\n- Plan the population the work needs and let the host queue and clamp it.\n  These ceilings are enforcement, not a reason to pre-shrink a valid plan.\n\nSee the Workflow JS sandbox tests for the fail-closed host surface inventory.\n\n## Language Choice\n\n| Surface | Strength | Tradeoff | Stance |\n|---|---|---|---|\n| YAML / JSON IR | Simple, reviewable, no runtime | Verbose for generated workflows | Keep as interchange/debug format |\n| JavaScript | Familiar object syntax and easy agent generation | Unsafe if executed as a general runtime | First-class authoring through declarative compile-only subset |\n| TypeScript | Best editor/types story for workflow SDK | Needs stripping/typechecking if full TS is supported | Same compile-only subset for now; richer SDK later |\n\nThe default high-capability path is TypeScript/JavaScript authoring, but only as\na compile step. The compiler accepts a JSON-compatible object inside\n`workflow({...})` from `.workflow.js` or `.workflow.ts`, lowers it to\n`WorkflowSpec`, and runs the Rust validation gate. (Starlark authoring was a\nbootstrap reference and has been removed; Workflow authoring is JS-only.)\n\n## Contract\n\nAccepted source shape:\n\n```js\nexport default workflow({\n  \"id\": \"issue-audit-js\",\n  \"goal\": \"Audit an issue fix with parallel agents\",\n  \"nodes\": [\n    {\n      \"branch\": {\n        \"id\": \"parallel-audit\",\n        \"children\": [\n          { \"agent\": { \"id\": \"code-audit\", \"prompt\": \"Review code\", \"agent_type\": \"review\" } },\n          { \"agent\": { \"id\": \"test-audit\", \"prompt\": \"Review tests\", \"agent_type\": \"verifier\" } }\n        ]\n      }\n    },\n    { \"reduce\": { \"id\": \"summary\", \"inputs\": [\"code-audit\", \"test-audit\"], \"prompt\": \"Summarize\" } }\n  ]\n});\n```\n\nSupported Line truncated
       }
     ]
   },
@@ -357,8 +357,8 @@
     "sources": [
       {
         "path": "docs/FLEET.md",
-        "sha256": "10a8c50860305920357042c95fb1c471696a68cc8fd219e571157563e8494654",
-        "content": "# Agent fleet\n\n> Baca terjemahan bahasa Indonesia: [id/FLEET.md](id/FLEET.md)\n\nAgent fleet is the local-first roster and member-selection layer for durable\nmulti-worker runs. It does not execute or authorize work. After fleet resolves\nwho should participate, the delegated coordinator launches a headless\n`codewhale exec` run and the Runtime tracks it durably. See\n[AGENT_RUNTIME.md](AGENT_RUNTIME.md) for how sub-agents, `exec`, and\nfleet-backed workers converge on one runtime. In product language, a user may\nstill \"open a sub-agent\"; in architecture language, durable nested work uses a\nfleet member identity with delegated runtime execution.\n\n## Naming and compatibility boundary\n\n**Fleet** is the public product noun. The durable ledger, saved rosters, config\ntables, and `--fleet` flag share that name:\n\n| Surface | Canonical |\n| --- | --- |\n| CLI | `codewhale fleet …` |\n| Slash command | `/fleet …` |\n\nThese shared names are load-bearing wherever changing them would break\nexisting workspaces, receipts, or scripts:\n\n- the durable ledger `.codewhale/fleet.jsonl` and the log directories\n  `.codewhale/fleet/` and `.codewhale/fleet-host/`;\n- saved rosters `fleets/<name>.toml` and their `schema = \"fleet\"` header, under\n  `$CODEWHALE_HOME/` or the workspace's `.codewhale/` (checked-in rosters at the\n  workspace root's `fleets/` are still read);\n- the `[fleet]` config table (inline `[fleets.*]` tables were removed in 0.9.14; named fleets live in `fleets/<name>.toml` files);\n- the `codewhale workflow run --fleet <name>` flag;\n- wire, receipt, and control-plane operation ids such as `fleet.status`.\n\nThe rest of this document uses fleet as the public product noun and retains\nthese literal paths, keys, flags, and ids.\n\nUse a fleet roster rather than anonymous short-lived `agent` fanout whenever a\ndelegated run needs stable member identities across retries, sleep/restart,\nremote execution, receipts, or a ledgered audit trail. The initial CLI surface\nis:\n\nFor a guided start-to-monitor walkthrough that combines fleet task specs with\nWorkflow authoring, see [fleet + Workflow Tutorial](FLEET_WORKFLOW_TUTORIAL.md).\n\n```sh\ncodewhale fleet init\ncodewhale fleet run tasks.json --check   # validate only; nothing is created or launched\ncodewhale fleet run tasks.json --max-workers 4\ncodewhale fleet status\ncodewhale fleet inspect <worker-id>\ncodewhale fleet logs <worker-id>\ncodewhale fleet artifacts <worker-id>\ncodewhale fleet interrupt <worker-id>\ncodewhale fleet restart <worker-id>\ncodewhale fleet resume <run-id>\ncodewhale fleet stop --all\n```\n\n`codewhale fleet resume <run-id>` is the restart-recovery verb: it replays the\nledger, reconciles any in-flight lease whose worker stopped heartbeating\n(retrying within the task's budget, else failing and escalating per the alert\npolicy), and prints the post-resume status. It launches no new work and is\nidempotent, so it is safe to run after a manager exit, laptop sleep, or runtime\nrestart.\n\nCoordinator state for fleet-backed runs is stored under the workspace in\n`.codewhale/fleet.jsonl`. Worker logs and adapter logs are stored under\n`.codewhale/fleet/` and `.codewhale/fleet-host/`.\n\n## Public contract: identity, membership, and selection\n\n**Fleet** = the user's model inventory: who is in the roster and which member is selected.\n\nA public fleet identity consists only of:\n\n- a stable member id and an optional user-facing name;\n- a semantic role, such as `explore`, `implement`, or `reviewer` (the legacy\n  spellings `worker`, `scout`, `builder`, `verifier`, `consultant`, and `oracle`\n  are still accepted on input and map to `general`, `explore`, `implement`,\n  `test`, and `advisor`);\n- an exact provider/model identity, or an explicit inherited route;\n- visible roster state or origin.\n\nProject or workspace trust, filesystem and network reach, secret access,\napproval mode, sandboxing, tool authorization, and every other form of runtime\nauthority are separate delegated-coordination and Runtime policy inputs. They\nare never fleet identity fields, and they never select or reroute a fleet\nmember. The Runtime applies and clamps those policies only after member\nselection; if the selected member cannot run inside the effective envelope,\nlaunch fails closed instead of choosing somebody else.\n\nNatural-language member selection is deterministic. A caller may name:\n\n- an exact member id, optionally as `member:<id>` or `id:<id>`;\n- a unique user-facing member name, optionally as `name:<name>`;\n- a unique semantic role, for example `explore` or `role:explore`;\n- an exact pinned model id, for example `deepseek-v4-flash`, or its offline\n  display name, for example `DeepSeek V4 Flash`; or\n- an exact `route:<provider>/<model>`.\n\nAn unqualified exact member id wins. Every other match succeeds only when it\nidentifies one distinct roster member. Multiple matches produce an ambiguity\nerror Line truncated
+        "sha256": "d0ef73ac4566845d3906cff4d325613909485f34197a4b042efe9a078029bea6",
+        "content": "# Agent fleet\n\n> Baca terjemahan bahasa Indonesia: [id/FLEET.md](id/FLEET.md)\n\nAgent fleet is the local-first roster and member-selection layer for durable\nmulti-worker runs. It does not execute or authorize work. After fleet resolves\nwho should participate, the delegated coordinator launches a headless\n`codewhale exec` run and the Runtime tracks it durably. See\n[AGENT_RUNTIME.md](AGENT_RUNTIME.md) for how sub-agents, `exec`, and\nfleet-backed workers converge on one runtime. In product language, a user may\nstill \"open a sub-agent\"; in architecture language, durable nested work uses a\nfleet member identity with delegated runtime execution.\n\n## Naming and compatibility boundary\n\n**Fleet** is the public product noun. The durable ledger, saved rosters, config\ntables, and `--fleet` flag share that name:\n\n| Surface | Canonical |\n| --- | --- |\n| CLI | `codewhale fleet …` |\n| Slash command | `/fleet …` |\n\nThese shared names are load-bearing wherever changing them would break\nexisting workspaces, receipts, or scripts:\n\n- the durable ledger `.codewhale/fleet.jsonl` and the log directories\n  `.codewhale/fleet/` and `.codewhale/fleet-host/`;\n- saved rosters `fleets/<name>.toml` and their `schema = \"fleet\"` header, under\n  `$CODEWHALE_HOME/` or the workspace's `.codewhale/` (checked-in rosters at the\n  workspace root's `fleets/` are still read);\n- the `[fleet]` config table (inline `[fleets.*]` tables were removed in 0.9.14; named fleets live in `fleets/<name>.toml` files);\n- the `codewhale workflow run --fleet <name>` flag;\n- wire, receipt, and control-plane operation ids such as `fleet.status`.\n\nThe rest of this document uses fleet as the public product noun and retains\nthese literal paths, keys, flags, and ids.\n\nUse a fleet roster rather than anonymous short-lived `agent` fanout whenever a\ndelegated run needs stable member identities across retries, sleep/restart,\nremote execution, receipts, or a ledgered audit trail. The initial CLI surface\nis:\n\nFor a guided start-to-monitor walkthrough that combines fleet task specs with\nWorkflow authoring, see [fleet + Workflow Tutorial](FLEET_WORKFLOW_TUTORIAL.md).\n\n```sh\ncodewhale fleet init\ncodewhale fleet run tasks.json --check   # validate only; nothing is created or launched\ncodewhale fleet run tasks.json --max-workers 4\ncodewhale fleet status\ncodewhale fleet inspect <worker-id>\ncodewhale fleet logs <worker-id>\ncodewhale fleet artifacts <worker-id>\ncodewhale fleet interrupt <worker-id>\ncodewhale fleet restart <worker-id>\ncodewhale fleet resume <run-id>\ncodewhale fleet stop --all\n```\n\n`codewhale fleet resume <run-id>` is the restart-recovery verb: it replays the\nledger, reconciles any in-flight lease whose worker stopped heartbeating\n(retrying within the task's budget, else failing and escalating per the alert\npolicy), and prints the post-resume status. It launches no new work and is\nidempotent, so it is safe to run after a manager exit, laptop sleep, or runtime\nrestart.\n\nCoordinator state for fleet-backed runs is stored under the workspace in\n`.codewhale/fleet.jsonl`. Worker logs and adapter logs are stored under\n`.codewhale/fleet/` and `.codewhale/fleet-host/`.\n\n## Public contract: identity, membership, and selection\n\n**Fleet** = the user's model inventory: who is in the roster and which member is selected.\n\nA public fleet identity consists only of:\n\n- a stable member id and an optional user-facing name;\n- a semantic role, such as `explore`, `implement`, or `reviewer` (the legacy\n  spellings `worker`, `scout`, `builder`, `verifier`, `consultant`, and `oracle`\n  are still accepted on input and map to `general`, `explore`, `implement`,\n  `test`, and `advisor`);\n- an exact provider/model identity, or an explicit inherited route;\n- visible roster state or origin.\n\nProject or workspace trust, filesystem and network reach, secret access,\napproval mode, sandboxing, tool authorization, and every other form of runtime\nauthority are separate delegated-coordination and Runtime policy inputs. They\nare never fleet identity fields, and they never select or reroute a fleet\nmember. The Runtime applies and clamps those policies only after member\nselection; if the selected member cannot run inside the effective envelope,\nlaunch fails closed instead of choosing somebody else.\n\nNatural-language member selection is deterministic. A caller may name:\n\n- an exact member id, optionally as `member:<id>` or `id:<id>`;\n- a unique user-facing member name, optionally as `name:<name>`;\n- a unique semantic role, for example `explore` or `role:explore`;\n- an exact pinned model id, for example `deepseek-v4-flash`, or its offline\n  display name, for example `DeepSeek V4 Flash`; or\n- an exact `route:<provider>/<model>`.\n\nAn unqualified exact member id wins. Every other match succeeds only when it\nidentifies one distinct roster member. Multiple matches produce an ambiguity\nerror Line truncated
       },
       {
         "path": "docs/MODES.md",
@@ -389,8 +389,8 @@
     "sources": [
       {
         "path": "docs/TOOL_SURFACE.md",
-        "sha256": "949991cc3ca1b4281507fade514ea5a6fd7dac66706ea1e2859a2ce28b5e30ac",
-        "content": "# Tool surface\n\n> 阅读简体中文版：[zh_hans/TOOL_SURFACE.md](zh_hans/TOOL_SURFACE.md)。\n\nThis document describes the current model-facing tool contract. The v0.9.1\ncutover that produced it is recorded in `docs/RUNTIME_SIMPLIFICATION_DESIGN.md`;\nread the workspace version from `Cargo.toml`, not from this line. The registry\nremains larger than the first-turn catalog so\nsaved transcripts can replay and uncommon capabilities can be loaded on demand.\nThe model should learn one canonical name for each common operation.\n\nImplementation sources:\n\n- `crates/engine/src/core/engine/tool_catalog.rs` owns the eager/deferred catalog.\n- `crates/engine/src/tools/registry.rs` registers canonical tools and hidden aliases.\n- `crates/engine/src/tools/{file,file_tool,shell}.rs` own the small foreground\n  primitive behavior and schemas; the other native tools remain searchable.\n- `docs/RUNTIME_SIMPLIFICATION_DESIGN.md` records the v0.9.1 cutover and receipt.\n\n## Default-active contract\n\nNew turns start with sixteen eager native names plus synthetic `tool_search`:\n\n1. `read`\n2. `write`\n3. `edit`\n4. `file_search`\n5. `bash`\n6. `agent`\n7. `workflow`\n8. `todo_write`\n9. `create_goal`\n10. `get_goal`\n11. `update_goal`\n12. `task_shell_wait`\n13. `present`\n14. `load_skill`\n15. `context_archive_get`\n16. `context_archive_search`\n17. `tool_search` (synthetic, always active)\n\nThe sixteen native names are `DEFAULT_ACTIVE_NATIVE_TOOLS` in\n`crates/engine/src/core/engine/tool_catalog.rs`, pinned by\n`default_active_contract_keeps_discovery_and_core_tools_eager`. An authority\nboundary may remove `agent` at the maximum child depth, and Plan registers only\nthe foreground shell surface (so no `task_shell_wait`), but route size alone\nmust not change this core vocabulary.\n\nThe direct schemas deliberately stay small:\n\n| Tool | Input | Purpose |\n|---|---|---|\n| `read` | `path`, optional `offset`, optional `limit` | Read a bounded file window with explicit continuation or truncation notices. |\n| `write` | `path`, `content` | Create or replace a file. |\n| `edit` | `path`, `edits` | Apply one or more unambiguous text replacements against one original snapshot. |\n| `file_search` | `query`, optional `path`, `limit`, `extensions`, `exclude` | Find files by name, path fragment or glob and return bounded, ranked matches. Respects ignore files; `exclude` replaces default exclusions. |\n| `bash` | `command`, optional `timeout`, optional `description` | Run one cancellable foreground shell command and return a bounded tail. The optional description is display-only. |\n| `agent` | delegated task and optional scope/context controls | Start or inspect focused child work. |\n| `workflow` | plan/script/source_path plus run controls | Coordinate multi-agent phases with dependencies and completion checks. |\n| `todo_write` | complete replacement list of `{content, status}` items | Keep optional, agent-owned progress notes for genuinely multi-step work. |\n| `create_goal` | objective plus optional budget | Start the session goal the turn works toward. |\n| `get_goal` | none | Read the active goal and its progress. |\n| `update_goal` | terminal status | Mark the goal complete or blocked. |\n| `task_shell_wait` | `task_id`, optional `wait`, `timeout_ms`, `cancel`, `gate` | Poll or stop a background shell task. Completion still arrives as a runtime event, so use it for early output, true barriers, or gate evidence. |\n| `present` | `files`, optional `note` | Declare 1–32 existing workspace files as final deliverables with a read-only SHA-256 handoff receipt; nothing is copied or moved. |\n| `load_skill` | optional `name`, `query` | Load a named skill's `SKILL.md` body and companion-file list; omit `name` or use `name=\"list\"` to list eligible skills, or use `query` to search names and descriptions. |\n| `tool_search` | `query`, optional matching controls | Discover policy-allowed deferred tools and add selected schemas to this conversation's toolbox. |\n\nMode is an authority decision, not a synonym system. Plan, Work, and Operate\nuse the same primitive identities. Plan centrally refuses `write`, `edit`, and\n`bash`; Work and Operate still pass those calls through approval, sandbox,\ntrusted-path, repository-law, and managed-policy gates. Full Access changes\nordinary approval behavior but does not bypass hard safety or repository law.\n\n`update_plan` remains registered only for saved-artifact compatibility and is\nnot model-visible. `tasks`, `Git`, `Run`, `Web`, `remember`, and other\nspecialized capabilities are searchable rather than first-turn ceremony.\n\nOn the TUI's default (calm) shell card the Bash description is the headline,\nshown as written apart from stripped terminal escapes, collapsed whitespace and\na length bound, and the command sits on its own `$` row directly under it in\nevery state and at every width, including automatic runs. A card without a\ndescription leads with Line truncated
+        "sha256": "338ba7e4aa1ca97d496264e81f53b1f2ff3543292e2a6b2cae91a44b01a21366",
+        "content": "# Tool surface\n\n> 阅读简体中文版：[zh_hans/TOOL_SURFACE.md](zh_hans/TOOL_SURFACE.md)。\n\nThis document describes the current model-facing tool contract. The v0.9.1\ncutover that produced it is recorded in `docs/RUNTIME_SIMPLIFICATION_DESIGN.md`;\nread the workspace version from `Cargo.toml`, not from this line. The registry\nremains larger than the first-turn catalog so\nsaved transcripts can replay and uncommon capabilities can be loaded on demand.\nThe model should learn one canonical name for each common operation.\n\nImplementation sources:\n\n- `crates/engine/src/core/engine/tool_catalog.rs` owns the eager/deferred catalog.\n- `crates/engine/src/tools/registry.rs` registers canonical tools and hidden aliases.\n- `crates/engine/src/tools/{file,file_tool,shell}.rs` own the small foreground\n  primitive behavior and schemas; the other native tools remain searchable.\n- `docs/RUNTIME_SIMPLIFICATION_DESIGN.md` records the v0.9.1 cutover and receipt.\n\n## Default-active contract\n\nNew turns start with sixteen eager native names plus synthetic `tool_search`:\n\n1. `read`\n2. `write`\n3. `edit`\n4. `file_search`\n5. `bash`\n6. `agent`\n7. `workflow`\n8. `todo_write`\n9. `create_goal`\n10. `get_goal`\n11. `update_goal`\n12. `task_shell_wait`\n13. `present`\n14. `load_skill`\n15. `context_archive_get`\n16. `context_archive_search`\n17. `tool_search` (synthetic, always active)\n\nThe sixteen native names are `DEFAULT_ACTIVE_NATIVE_TOOLS` in\n`crates/engine/src/core/engine/tool_catalog.rs`, pinned by\n`default_active_contract_keeps_discovery_and_core_tools_eager`. An authority\nboundary may remove `agent` at the maximum child depth, and Plan registers only\nthe foreground shell surface (so no `task_shell_wait`), but route size alone\nmust not change this core vocabulary.\n\nThe direct schemas deliberately stay small:\n\n| Tool | Input | Purpose |\n|---|---|---|\n| `read` | `path`, optional `offset`, optional `limit` | Read a bounded file window with explicit continuation or truncation notices. |\n| `write` | `path`, `content` | Create or replace a file. |\n| `edit` | `path`, `edits` | Apply one or more unambiguous text replacements against one original snapshot. |\n| `file_search` | `query`, optional `path`, `limit`, `extensions`, `exclude` | Find files by name, path fragment or glob and return bounded, ranked matches. Respects ignore files; `exclude` replaces default exclusions. |\n| `bash` | `command`, optional `timeout`, optional `description` | Run one cancellable foreground shell command and return a bounded tail. The optional description is display-only. |\n| `agent` | delegated task and optional scope/context controls | Start or inspect focused child work. |\n| `workflow` | plan/script/source_path plus run controls | Coordinate multi-agent phases with dependencies and completion checks. |\n| `todo_write` | complete replacement list of `{content, status}` items | Keep optional, agent-owned progress notes for genuinely multi-step work. |\n| `create_goal` | objective plus optional budget | Start the session goal the turn works toward. |\n| `get_goal` | none | Read the active goal and its progress. |\n| `update_goal` | terminal status | Mark the goal complete or blocked. |\n| `task_shell_wait` | `task_id`, optional `wait`, `timeout_ms`, `cancel`, `gate` | Poll or stop a background shell task. Completion still arrives as a runtime event, so use it for early output, true barriers, or gate evidence. |\n| `present` | `files`, optional `note` | Declare 1–32 existing workspace files as final deliverables with a read-only SHA-256 handoff receipt; nothing is copied or moved. |\n| `load_skill` | optional `name`, `query` | Load a named skill's `SKILL.md` body and companion-file list; omit `name` or use `name=\"list\"` to list eligible skills, or use `query` to search names and descriptions. |\n| `tool_search` | `query`, optional matching controls | Discover policy-allowed deferred tools and add selected schemas to this conversation's toolbox. |\n\nMode is an authority decision, not a synonym system. Plan and Work use the\nsame primitive identities. Plan centrally refuses `write`, `edit`, and `bash`;\nWork still passes those calls through approval, sandbox, trusted-path,\nrepository-law, and managed-policy gates. Full Access changes\nordinary approval behavior but does not bypass hard safety or repository law.\n\n`update_plan` remains registered only for saved-artifact compatibility and is\nnot model-visible. `tasks`, `Git`, `Run`, `Web`, `remember`, and other\nspecialized capabilities are searchable rather than first-turn ceremony.\n\nOn the TUI's default (calm) shell card the Bash description is the headline,\nshown as written apart from stripped terminal escapes, collapsed whitespace and\na length bound, and the command sits on its own `$` row directly under it in\nevery state and at every width, including automatic runs. A card without a\ndescription leads with the `$` command instLine truncated
       },
       {
         "path": "docs/RUNTIME_SIMPLIFICATION_DESIGN.md",