feat(agent): tool plugins and effects integration

[fffonion]

Scope

Draft tools-plugin/effects plan on master. Production PR #6 is merged; PRs #4/#5 remain closed unmerged, with original source 9296eff preserved. This PR remains Draft and unmerged.

Current accepted implementation

Head: 77653d574ebd4f0c451e443b5899fb5970f14cb6; base: master. Original-cancellation recheck after provider request persistence, on top of SDK intake and test/documentation corrections. SDK intake pins official Core b5066dd92fcd7c07df57e3ec2c29dbcf8c19c390. In addition to bounded resolver backtracking and the test-only native HTTPS/persistence-gate lifecycle fixes, this head includes the T08/T10 managed synchronous effect transaction and restart path:

• Opt-in persistent managed workspace, current Native workspace grant and per-call private view for original file tools and foreground terminal; direct mode retained.
• Synced immutable objects and full canonical result; formal RSS/SQLite intent/prepared/final receipt, head CAS, events and message publication. Read-only observations do not advance the head; failures do not publish the parent tree.
• Exact committed replay independent of event pruning and bounded message projection; conservative staged/indeterminate restart states, no automatic process respawn or old-authority renewal.
• Secure descriptor/object identity, retained references/leases and quotas; nested directory namespace fsync, original live cancellation/deadline through queue/SDK, quota-bound startup census.
• YAML/canonical schema producer and real Native/RSS consumers aligned; storage schema v6, checkpoint v1 contracts unchanged.

Feature review and scoped correction review are accepted, with M1–M3 closed. Final integration review is accepted with carried advisories, no new blockers. Six feature advisories and two TLS advisories remain recorded; no OS sandbox, 32-bit support or arbitrary third-party process-isolation guarantee is claimed.

Current-head validation

Normal cherry-pick without conflicts or manual source edits. Exactly 48 of 49 feature paths equal the reviewed feature bytes; store.rs equals the ordinary automatic merge with the accepted instance gate. TLS, original gateway/lifecycle tests and manifests match the Draft predecessor.

54 runtime batches, 1446 feature/profile-specific executions passed: Debug 723, Release 723. Actual Cargo JSON, official d938 SDK, features/profile, ELF listing, selected test names and inner/wrapper return codes are bound to this head. Coverage includes managed/default/fault paths, gateway, full native HTTPS, PersistBlock, resolver/manifest/schema and original lifecycle. Lifecycle is 40/40 in all four groups. Schema drift, fmt, strict all-feature Clippy including lib unit cfg, and committed-range whitespace passed. (Evidence belongs to integration baseline 2b3d80be53b538e76115751aa3cd21f2d7a061f0; not counted as new eb92 runtime qualification.)

Previous-head CI run 39180074454 failed lib 440 / 2 / 6 before integration targets. Controlled tests establish ambient-umask-dependent fixtures and the AuthStore private-home rejection; actual GHA umask remains unobserved. The published test-only fix eb92d8cfb59d3a937381413655102941b80dde55 explicitly sets parent/home0700 and config0600 in two fixtures, preserving real Native authorization/default selector and all original assertions. Independent Grok review is CLEAN (no blocking or advisory). Full all-feature lib Debug and Release each pass 442 / 0 / 6 at umask022 with default concurrency; both exact tests pass at022 and077; 41 Native/managed neighbors, fmt and strict all-feature Clippy including unitcfg pass.

Previous-head CI run 39183301675 failed documentation consistency 6 passed / 3 failed after actual CI lib 442 passed / 0 failed / 6 ignored, including both repaired Native workspace fixtures. Published documentation-only fix ce9ad25c95aa02092243f9959b51e7cea7345575 adds the real managed_workspace Native-field contract and primary-only RUSTSCRIPT_AGENT_MANAGED_WORKSPACE path setting (no invented alias). Only docs/configuration.md changed; production and test guards remain unchanged. Actual documentation RED reproduced 6 / 3, then Debug/Release x default/all-features each passed all9 tests with independent inner/wrapper0. Parent source/doc review, fmt, docs-target strictClippy and actual remote-PR-base whitespace gates accepted.

Previous-head CI run 39184901364 failed in managed commit/recovery startup fixtures: 34 passed / 2 failed. Actual CI lib passed 442 / 0 / 6 and docs consistency passed all9, confirming the preceding repairs. Both new failures panic on var_os(key).unwrap() before spawning the normal gateway binary: fixtures require all seven scratch aliases plus optional CEF_PATH, while the workflow explicitly supplies three scratch aliases. The first missing remote key is unobserved. Published test-only fix 3250ef5928a571b6ae1687923e3d7aa9af691b4b derives seven child scratch aliases from the required assigned root and forwards optional CEF only when present. Controlled CEF-absent exact cases each transition RC101 to RC0 and execute real binary health/store/owned shutdown or all three startup denials; the first missing GHA key remains unobserved. Full related target passes Debug/Release with default features (21 each) and all-features (38 each, including two new helper regressions). Original assertions and deadline are unchanged; independent Grok review is CLEAN for this startup-fixture scope, with no blockers or advisories. Later targets are not run; no unchanged-head rerun or full-project success is claimed.

Previous-head CI run 39187950532 failed RSS tool architecture: 8 passed / 1 failed (production_rust_does_not_match_public_tool_names_for_execution). Actual CI lib passed 442 / 0 / 6, docs all9, and managed commit/recovery all38, confirming the earlier repairs. The text guard matches public-name branches in src/effects/broker.rs:1239-1245 selecting required Native effect kinds. Source audit confirms RSS still selects the six tool executions, while Native public-name policy affects permission admission, reservation and publication; an additional terminal-name gate exists before native process spawn. The recommended direction is captured RSS closed declarations -> sealed Native per-call policy -> actual primitive checks. The same-head source closure and full implementation specification are complete and parent-approved. The local candidate implements captured RSS declarations, sealed Native per-call policy and real primitive checks, including the necessary Native-only builtin revision coexistence/non-executable historical isolation and startup separation needed to keep retained Final receipts queryable. Historical activation/pins are not automatically replaced or granted current catalog authority; original architecture checks remain unchanged. Published implementation 07e8f22a6233788d82e96d84be6a833cf58c3cc4 has independent Grok CLEAN review, with no blocking or advisory findings for this scope. The 17-file candidate includes the captured RSS catalog, sealed Native policies/primitive checks and historical builtin initialization/replay compatibility; the original architecture guard is unchanged. Parent verification of raw source/Cargo JSON/actual test terminals and independent exit codes confirms scoped Debug322/0/0 and Release322/0/0, with architecture9/0 in both. A01-A11 named runtime mappings are verified; decisive assertion semantics and security review are accepted for this scope. Authentic cross-binary old Final replay has separate local Debug/Release probe evidence, alongside portable committed historical store/startup regressions. The failed3250 CI is retained as first-failure evidence; this revision has its own workflow. Cosmetic string rewrites and broad guard exclusions are not accepted. Later lifecycle targets were not reached, and the unchanged failed head has not been rerun.

Previous-head CI run 39208310609 failed lifecycle: 39 passed / 1 failed (deadline_terminates_child_process_without_residue, original PID assertion at1634:5). Actual CI lib passed453 / 0 / 6, managed38 / 0 and RSSarchitecture9 / 0, confirming the authority repair. The existing shipped failure trace reports202.866552ms remaining at admission, two provider calls, zero observed owned PID and zero Native before/after-spawn markers. Root remains UNKNOWN; recurrence at the historical assertion does not establish identical cause or waive regression investigation. Existing-evidence/source-only analysis runs without a new timing sample or deadline/assertion changes. T11 implementation on branch feat/managed-checkpoint-restore has returned an incomplete, uncommitted checkpoint: 17 changed files are preserved, not a qualified candidate. A genuine configured RSS write/Native terminal read reached the checkpoint RED; v7 migration then failed because the pinned official SQLite SDK rejects a legal single CREATE TRIGGER at its internal semicolon (execute and transaction both actual inner/wrapper RC101). Independent frozen-source review completed: bounded final equality is not equivalent to the required monotonic history revisions and does not enforce immutable checkpoint rows or raw ref-deletion guards; the pinned SDK has no supported trigger path. The user explicitly authorized a narrow SDK single-statement/parser-and-trigger-authorization correction plus the Agent pin update. The user then requested all current task slot targets/tmp/shared be cleared and baselines rebuilt first: Core and Agent cleanup is read-back verified, all 17 T11 WIP source files and necessary evidence are preserved, and exact d938/07e8 focused Debug/Release baselines have completed with zero failures: Core SQLite named18/0 plus lifecycle12/0 in each profile; Agent architecture9/0 plus managed38/0 in each profile. Authorized SDK implementation produced local-only candidate b5066dd92fcd7c07df57e3ec2c29dbcf8c19c390 (three files, branch fix/sqlite-single-statement-triggers). Muse Spark completed the full frozen-source review without a concrete functional/security code blocker; three advisories remain recorded. Grok4.7 completed committed-source qualification: 13 groups,207 unique actual passes with per-run before/after byte equality and independent inner/wrapperRC0 (old207 not added). Unsuppressed strict Clippy fails identically on d938 and b506; all20 observed diagnostics are inherited, candidate-only0. Parent retains that whole-project strict-lint failure as OPEN and does not count waivers or warning-modeRC0 as strict PASS; it does not expand this narrow SDK fix into unrelated compiler/VM lint cleanup. Scoped SDK dependency intake is accepted with advisories. Exact b506 is now published only on rustscript-lang/rustscript:fix/sqlite-single-statement-triggers, remote-ref and ls-remote readback verified. Grok4.7 produced local Agent intake candidate 2461971324d312fc5824758b718c9f3afb7993a0 on integrate/managed-sdk-intake: exact pin/lock changes only for the three SDK Git packages plus a permanent six-case AgentRunner SQLite contract. Parent verified204 actual runtime passes across14committed-source configurations, including normal managedv6 write/foregroundread/reopen; this is not v7/R15. Raw Agent strict Clippy fails at unchanged journal.rs:368: the map_err logging closure becomes identity when workspace-io-fault is off. Local 7be6454d41c72003297fe15a742c759e1ca5ad33 fixes that journal cfg issue, preserves fault-only logging and error rejection, and has actual204 original runtime passes plus4 separately recorded document-gate passes; production library and SDK contract strict Clippy pass in default/all-feature configurations. The remaining default unit-harness lint is an unused test helper compiled under a wider cfg than its sole consumer. Parent applied only that helper cfg alignment (no production behavior/test/assertion removal). Grok is committing and checking the exact five-file final source with focused SDK/Native/document-gate/managed-reopen and actual unit-harness strict gates; the204 matrix is not being repeated for this test-only guard. Muse Spark became unavailable under Meta geographic-use policy (not HTTP429); no provider-routing bypass was attempted. The user explicitly selected GPT-6.1-Sol for this one-off full frozen-source intake review. Sol completed the whole five-file source review: no functional/security blocker, one low nonblocking advisory (document-gate positive proves real worker reachability rather than independent named-record persistence/readback). Parent retained the advisory without expanding scope. Grok final verification completed at exact 299d60f1c25bdff71efceb03863842ffab021bf2: all five frozen files match the committed source; new-head focused runtime32/0 and actual default/all-feature unit-harness strict compilation0/0 are parent-verified. Historical7be204+document4 and production/SDK Clippy results remain labeled predecessor evidence, not rerun on299 or summed into its32. The complete source review is bound to299 and accepted with the one advisory. Exact299 is now published to this Draft PR; new-head CI39245232327 failed after8m47s at dependency_pin_tests (0passed/4failed): its independent reviewed-SDK constant still expects d938 while the authorized manifests/lock use b506. Fmt and warnings-denied Clippy passed, and outerlib454/0/6 passed; the expected nested fifo-error child is not the outer failure. This run did not reach the historical lifecycle case. First-failure logs are preserved; no unchanged CI rerun. Test-only correction d37c8e0e0cf940793f1af83399d0dfabff71008c is now published and parent-reviewed line by line: independently fixed reviewed literalb506, canonicalHTTPS/exact40hex/three locksource/path/stale/abbreviation safeguards preserved, and explicit priord938 rejection added. Cargo.toml/lock and all production source remain byte-identical to299. Actual std-only rustc-direct Debug and optimized harnesses each passed4/0; authored prior/stale/abbreviated fixture runs each still fail as intended. No Cargo qualification is claimed for this direct driver. Parent verified exactbranch+PRheadreadback. The slot1 T11 implementation continues without shared writes; exact d37 is queued for its later integration. T11 full v7/checkpoint/newbranch-session-run restore implementation has resumed on isolated branch feat/managed-checkpoint-restore-v7 from the accepted299 foundation, reconciling the preserved17WIP files rather than overwriting journal/retention fixes; no v7/R15 or full-project shipping pass is claimed. An overwritten earlier partial receipt-test log is recorded as an evidence gap, not fabricated or counted as a pass. T11 WIP remains preserved; later restoration must reconcile this journal fix rather than blindly copying old source. No R15/full-project shipping qualification is claimed. Revision fences remain unchanged; no merge or release is authorized. The lifecycle source chain is now complete, but the concrete timing cause remains UNKNOWN and no runtime fix is established. Full-project CI remains RED and no shipping gate is waived.

Retained failure and diagnostic evidence

Run 39143398262 at predecessor 2b39448 failed the original 250ms native-PID assertion (lifecycle 39/1); its gateway target completed 68/68. Historical cause remains UNKNOWN. Current-head local lifecycle evidence is separately 40/40 in each of four feature/profile groups, without changing test source or budgets.

Run 39134836379 at predecessor 5c0fbe7 was cancelled after the test step remained unfinished beyond 62 minutes: outer lib 410 passed / 0 failed / 6 ignored; gateway 67 cases passed, with terminal_retry_gate_drop_retires_an_unentered_waiter unfinished and no target summary. No remote native stack was retained. The local watcher exit 124 is separate from remote cancellation. The current repair addresses a statically reachable lost-notification defect without claiming the exact historical blocked instruction.

Pre-merge bb0 run 39127359466 failed the original 250ms lifecycle PID assertion (39/1). C5 run 39128370347 failed the native HTTPS notification receive with Disconnected, not a proved 3-second timeout (lib 404/1/6). Those historical causes remain UNKNOWN.

One separately approved Agent-only phase sample at C5 completed the original 40-case target, 39 passed / 1 failed, Cargo 101. It observed the deadline crossing the second durable provider completion/storage span, followed by ApprovalResolve=Deadline, before pinned/retained-child/lifecycle start. This identifies the new sample's phase, not its storage/VM/SQL internal cause and not the historical ordering. Temporary Agent source was fully restored and the official d938 Debug artifact rebound; no second sample or qualification credit.

Continuing plan

The managed synchronous T08/T10 implementation is included in this head. Checkpoint/branch restore, versioned plugin state, subsequent harness/API work and final end-to-end gates remain separate plan milestones. Existing checkpoint library tests do not by themselves establish a persistent managed restore path. This PR stays Draft and unmerged.

Latest CI / deployment-reference repair

• Exactd37 CI39248989509 failed after9m14s: dependency provenance tests now4/0; documentation_consistency_tests14/1 at deployment_documents_the_manifest_pinned_core_revision (line96). Fmt and warnings-denied Clippy passed. The deployment guide still quoted prior d938, while actual manifest/lock use approved b506. First failure is preserved; no unchanged rerun.
• 836a415420e1e341ac1c57bd1c3e4b443610b5e4 changes only three deployment-guide lines: approved full SDK revision in manifest/lock examples and its displayed abbreviation. Production source, dependencies and original tests are unchanged. The exact original std-only failing test/helpers were copied without assertion edits and executed on the actual worktree: RED0/1, then Debug1/0 and optimized1/0. This is rustc-direct extracted-case evidence, not a full15case Cargo-suite claim.
• Exact remote ref and PRhead verified. T11 continues independently; queued integration order d37 then836 after its writer returns. New-head CI pending observation.

T11 continuation checkpoint

• Previous implementation returned partial without committing: vertical path reported, but complete positive settlement and the44-requirement/Q01-Q17/17-restart-cut qualification are not complete. No full-T11 acceptance is claimed.
• Parent preserved all18 dirty/new source files, patch/status and existing raw records. While that worker was stopped, its local feature branch was fast-forwarded to published836 without a merge commit; all18 WIP bytes/modes and staging/untracked status remained identical. The dependency-guard/deployment-doc fixes are now present in this T11 baseline.
• Fresh Grok4.7 continuation runs in the same valid slot1/target, starting with registration-before-spawn, genuine owned Join or exact parked-generation evidence, ordered delivery and storage FIFO acknowledgment, then completing the original full matrix. No shared-worktree writer, new SDK change or extra performance capture. Source remains private/uncommitted until real completion and subsequent review.

Exact836 CI result

• CI39250940281, job118054276586, failed after19m15s. Fmt/strictClippy passed; dependency-pin4/0 and documentation15/0 now pass in actual Cargo CI. Lifecycle39/1 fails deadline_terminates_child_process_without_residue at tests/run_lifecycle_tests.rs:1634:5 (no alive owned Native PID observed before the original admission deadline).
• Existing bounded trace has two provider entries/returns, attached native hook, zero Native spawn frontiers, zero observed PIDs. Cancellation/host close/owners0/fixture cleanup assertions passed; subsequent Guardian binding/PID assertions were not executed. This does not establish successful child termination or a specific latency root cause. Test source equals07e8 bytes, which does not prove equal cause.
• First failure/raw log and sanitized evidence preserved. A separate Grok source-only diagnosis reads immutable published836 snapshots and prior audits; no new execution/capture/deadline changes or unchanged CI retry. Full CI remains failed. T11 implementation continues independently in its own slot1.

Closed deadline diagnostic / independent gate fix

• Source-only follow-up closes the post-entry-check/pre-raw-provider slice. Existing trace proves late raw entry; the missing-PID latency cause remains UNKNOWN. Correct SDK identity is rustscript-vm/packagepd-vm and pd-host-function at b5066dd92fcd7c07df57e3ec2c29dbcf8c19c390; an earlier diagnostic label was corrected, with the first record retained.
• VM-scoped SQLite ownership prevents the proposed cross-fresh-VM connection cache through current formal APIs. No cache, SDK scope change, SQLite5000ms change or clock adjustment is authorized.
• A separate Grok slot2 now implements only an original-cancellation/deadline recheck after successful model.requested persistence and the existing crash seam, before inner.call. Deterministic real-persistence regressions preserve the committed request, event/attempt/replay/recovery semantics and deny raw calls on Requested/ResourceClosed/Deadline or already-passed original deadline. Candidate remains private until tests and review. This is an independent safety fix, not a claim that lifecycle39/1 is solved. T11 continues in slot1.

Provider post-persist gate accepted and published

• 77653d574ebd4f0c451e443b5899fb5970f14cb6 changes only src/durable_provider.rs: preserve the committed request and existing attempt/replay/recovery/crash behavior, but recheck the same cancellation/deadline immediately before transport preparation/inner.call. No SDK/store protocol/cache/budget changes.
• Muse independently completed the whole scope and final source review: no blocking findings, five advisories retained (including unrelated defaultalltargets writer_pid failure, single-recheck residual window and optional lint evidence refinements). Review does not grant runtime.
• Parent verified actual committed776 before/after each Debug/Release x default/allfeatures run: each25/0/0, deduped100 cells/25 unique cases, inner+outer0, exactsource/Cargo manifest/lock/executable bound. Prior precommit100 and six-case subset are not added. CIallfeaturesalltargets strict Clippy raw0; defaultalltargets failure remains FAIL and is not waived.
• Exact remote branch and PRhead read back, Draft retained. Lifecycle39/1 latency/PID cause remains open; this safety fix does not claim it resolved. New-head CI pending observation. T11 stays private and its active worktree is untouched; exact776 is queued for later integration after its writer returns.

Exact776 first CI result

• CI39268616603, job118114695753: fmt and strictClippy passed; lifecycle39/1 still fails the original alive-owned-PID witness at tests/run_lifecycle_tests.rs:1634:5. First raw failure and sanitized trace are preserved; no unchanged rerun.
• This run differs from836: both raw provider returns occurred before the original deadline; second return leads it by strictly11.35697–13.35697ms. Attach succeeded, but no Native spawn frontier or live PID was observed. This does not identify where the remaining budget went, nor prove child termination. The post-persist gate remains an independently reviewed/qualified safety fix; latency cause remains UNKNOWN.
• Current T11 dirtycandidate stays unchanged at its836 base while the user-requested CommandCodeMuse source review runs. No new implementation overlaps that review. Full44/Q01-Q17/17cut acceptance remains required.