[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=arguments
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "search query",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "query",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": false
    },
    {
      "arg_type": "integer",
      "default_value": 5,
      "description": "maximum hits",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "top_k",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 1,
    "sandbox_cost_estimate": 0,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 2500,
    "token_cost_estimate": 128,
    "tool_call_cost_estimate": 1
  },
  "capability": "search",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": true,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "network"
    ],
    "required_task_statuses": [],
    "requires_worktree": false,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Search tool under runtime/network/validator discipline.",
  "invocation_mode": "read_only",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "retrieved evidence bundle",
      "evidence_backwrite": true,
      "kind": "evidence",
      "name": "results",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "search execution receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "execute",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "network",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "open_web"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Search public web sources and return evidence candidates.",
  "tool_name": "browser_search"
}
[/TOOL_SPEC]

[USER_QUERY]
Normalize the user intent into the strict argument schema expected by browser_search.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=harness_envelope
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "search query",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "query",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": false
    },
    {
      "arg_type": "integer",
      "default_value": 5,
      "description": "maximum hits",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "top_k",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 1,
    "sandbox_cost_estimate": 0,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 2500,
    "token_cost_estimate": 128,
    "tool_call_cost_estimate": 1
  },
  "capability": "search",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": true,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "network"
    ],
    "required_task_statuses": [],
    "requires_worktree": false,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Search tool under runtime/network/validator discipline.",
  "invocation_mode": "read_only",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "retrieved evidence bundle",
      "evidence_backwrite": true,
      "kind": "evidence",
      "name": "results",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "search execution receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "execute",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "network",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "open_web"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Search public web sources and return evidence candidates.",
  "tool_name": "browser_search"
}
[/TOOL_SPEC]

[USER_QUERY]
Within the full harness envelope, determine the compliant behavior of browser_search under control-plane priority.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=trigger
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "search query",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "query",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": false
    },
    {
      "arg_type": "integer",
      "default_value": 5,
      "description": "maximum hits",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "top_k",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 1,
    "sandbox_cost_estimate": 0,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 2500,
    "token_cost_estimate": 128,
    "tool_call_cost_estimate": 1
  },
  "capability": "search",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": true,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "network"
    ],
    "required_task_statuses": [],
    "requires_worktree": false,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Search tool under runtime/network/validator discipline.",
  "invocation_mode": "read_only",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "retrieved evidence bundle",
      "evidence_backwrite": true,
      "kind": "evidence",
      "name": "results",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "search execution receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "execute",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "network",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "open_web"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Search public web sources and return evidence candidates.",
  "tool_name": "browser_search"
}
[/TOOL_SPEC]

[USER_QUERY]
Under the same harness rules, judge if browser_search is the next valid tool call rather than free-form text.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=arguments
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "search query",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "query",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": false
    },
    {
      "arg_type": "integer",
      "default_value": 5,
      "description": "maximum hits",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "top_k",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 1,
    "sandbox_cost_estimate": 0,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 2500,
    "token_cost_estimate": 128,
    "tool_call_cost_estimate": 1
  },
  "capability": "search",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": true,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "network"
    ],
    "required_task_statuses": [],
    "requires_worktree": false,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Search tool under runtime/network/validator discipline.",
  "invocation_mode": "read_only",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "retrieved evidence bundle",
      "evidence_backwrite": true,
      "kind": "evidence",
      "name": "results",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "search execution receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "execute",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "network",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "open_web"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Search public web sources and return evidence candidates.",
  "tool_name": "browser_search"
}
[/TOOL_SPEC]

[USER_QUERY]
Produce arguments that fit browser_search and would fail if interpreted as repo_reverse_engineer.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=precondition_gating
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "search query",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "query",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": false
    },
    {
      "arg_type": "integer",
      "default_value": 5,
      "description": "maximum hits",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "top_k",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 1,
    "sandbox_cost_estimate": 0,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 2500,
    "token_cost_estimate": 128,
    "tool_call_cost_estimate": 1
  },
  "capability": "search",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": true,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "network"
    ],
    "required_task_statuses": [],
    "requires_worktree": false,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Search tool under runtime/network/validator discipline.",
  "invocation_mode": "read_only",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "retrieved evidence bundle",
      "evidence_backwrite": true,
      "kind": "evidence",
      "name": "results",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "search execution receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "execute",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "network",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "open_web"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Search public web sources and return evidence candidates.",
  "tool_name": "browser_search"
}
[/TOOL_SPEC]

[USER_QUERY]
Detect that browser_search should not fire because the required runtime preconditions are still unsatisfied.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=trigger
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "patch artifact ref",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "artifact_ref",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": false
    },
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "boolean",
      "default_value": false,
      "description": "dry run flag",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "dry_run",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 4000,
    "token_cost_estimate": 64,
    "tool_call_cost_estimate": 1
  },
  "capability": "patch",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": false,
    "emits_evidence_ids": false,
    "emits_patch_ref": true,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": true,
    "plan_mode_allowed": true,
    "required_permissions": [
      "write",
      "worktree"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": true,
    "supports_resume": true
  },
  "description": "Mutating patch tool under worktree / snapshot / validator discipline.",
  "invocation_mode": "mutating",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator",
      "sandbox_rollback_bridge"
    ]
  },
  "outputs": [
    {
      "description": "workspace diff",
      "evidence_backwrite": false,
      "kind": "patch",
      "name": "workspace_diff",
      "patch_relevant": true,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": false
    },
    {
      "description": "patch receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "receipt",
      "patch_relevant": true,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "repair",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "rolled_back",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "write",
      "worktree",
      "patch",
      "session"
    ],
    "blocks_on_conflict": true,
    "requires_clean_worktree": true,
    "requires_confirmation": true,
    "requires_evidence_before_trigger": true,
    "risk_band": "high",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "partial",
    "supports_rollback": true
  },
  "summary": "Apply a validated patch bundle to the workspace.",
  "tool_name": "apply_patch_bundle"
}
[/TOOL_SPEC]

[USER_QUERY]
Under the same harness rules, judge if apply_patch_bundle is the next valid tool call rather than free-form text.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=receipt_validation
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "patch artifact ref",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "artifact_ref",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": false
    },
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "boolean",
      "default_value": false,
      "description": "dry run flag",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "dry_run",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 4000,
    "token_cost_estimate": 64,
    "tool_call_cost_estimate": 1
  },
  "capability": "patch",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": false,
    "emits_evidence_ids": false,
    "emits_patch_ref": true,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": true,
    "plan_mode_allowed": true,
    "required_permissions": [
      "write",
      "worktree"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": true,
    "supports_resume": true
  },
  "description": "Mutating patch tool under worktree / snapshot / validator discipline.",
  "invocation_mode": "mutating",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator",
      "sandbox_rollback_bridge"
    ]
  },
  "outputs": [
    {
      "description": "workspace diff",
      "evidence_backwrite": false,
      "kind": "patch",
      "name": "workspace_diff",
      "patch_relevant": true,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": false
    },
    {
      "description": "patch receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "receipt",
      "patch_relevant": true,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "repair",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "rolled_back",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "write",
      "worktree",
      "patch",
      "session"
    ],
    "blocks_on_conflict": true,
    "requires_clean_worktree": true,
    "requires_confirmation": true,
    "requires_evidence_before_trigger": true,
    "risk_band": "high",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "partial",
    "supports_rollback": true
  },
  "summary": "Apply a validated patch bundle to the workspace.",
  "tool_name": "apply_patch_bundle"
}
[/TOOL_SPEC]

[USER_QUERY]
Emit the bounded receipt bundle that proves apply_patch_bundle complied with validator and permission policy.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=trigger
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "patch artifact ref",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "artifact_ref",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": false
    },
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "boolean",
      "default_value": false,
      "description": "dry run flag",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "dry_run",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 4000,
    "token_cost_estimate": 64,
    "tool_call_cost_estimate": 1
  },
  "capability": "patch",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": false,
    "emits_evidence_ids": false,
    "emits_patch_ref": true,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": true,
    "plan_mode_allowed": true,
    "required_permissions": [
      "write",
      "worktree"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": true,
    "supports_resume": true
  },
  "description": "Mutating patch tool under worktree / snapshot / validator discipline.",
  "invocation_mode": "mutating",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator",
      "sandbox_rollback_bridge"
    ]
  },
  "outputs": [
    {
      "description": "workspace diff",
      "evidence_backwrite": false,
      "kind": "patch",
      "name": "workspace_diff",
      "patch_relevant": true,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": false
    },
    {
      "description": "patch receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "receipt",
      "patch_relevant": true,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "repair",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "rolled_back",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "write",
      "worktree",
      "patch",
      "session"
    ],
    "blocks_on_conflict": true,
    "requires_clean_worktree": true,
    "requires_confirmation": true,
    "requires_evidence_before_trigger": true,
    "risk_band": "high",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "partial",
    "supports_rollback": true
  },
  "summary": "Apply a validated patch bundle to the workspace.",
  "tool_name": "apply_patch_bundle"
}
[/TOOL_SPEC]

[USER_QUERY]
Reject run_ci_validation and prefer apply_patch_bundle only when the contract and capability truly align with this request.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=arguments
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "patch artifact ref",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "artifact_ref",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": false
    },
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "boolean",
      "default_value": false,
      "description": "dry run flag",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "dry_run",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 4000,
    "token_cost_estimate": 64,
    "tool_call_cost_estimate": 1
  },
  "capability": "patch",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": false,
    "emits_evidence_ids": false,
    "emits_patch_ref": true,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": true,
    "plan_mode_allowed": true,
    "required_permissions": [
      "write",
      "worktree"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": true,
    "supports_resume": true
  },
  "description": "Mutating patch tool under worktree / snapshot / validator discipline.",
  "invocation_mode": "mutating",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator",
      "sandbox_rollback_bridge"
    ]
  },
  "outputs": [
    {
      "description": "workspace diff",
      "evidence_backwrite": false,
      "kind": "patch",
      "name": "workspace_diff",
      "patch_relevant": true,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": false
    },
    {
      "description": "patch receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "receipt",
      "patch_relevant": true,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "repair",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "rolled_back",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "write",
      "worktree",
      "patch",
      "session"
    ],
    "blocks_on_conflict": true,
    "requires_clean_worktree": true,
    "requires_confirmation": true,
    "requires_evidence_before_trigger": true,
    "risk_band": "high",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "partial",
    "supports_rollback": true
  },
  "summary": "Apply a validated patch bundle to the workspace.",
  "tool_name": "apply_patch_bundle"
}
[/TOOL_SPEC]

[USER_QUERY]
Normalize the user intent into the strict argument schema expected by apply_patch_bundle.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=precondition_gating
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "patch artifact ref",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "artifact_ref",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": false
    },
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "boolean",
      "default_value": false,
      "description": "dry run flag",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "dry_run",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 4000,
    "token_cost_estimate": 64,
    "tool_call_cost_estimate": 1
  },
  "capability": "patch",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": false,
    "emits_evidence_ids": false,
    "emits_patch_ref": true,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": true,
    "plan_mode_allowed": true,
    "required_permissions": [
      "write",
      "worktree"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": true,
    "supports_resume": true
  },
  "description": "Mutating patch tool under worktree / snapshot / validator discipline.",
  "invocation_mode": "mutating",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator",
      "sandbox_rollback_bridge"
    ]
  },
  "outputs": [
    {
      "description": "workspace diff",
      "evidence_backwrite": false,
      "kind": "patch",
      "name": "workspace_diff",
      "patch_relevant": true,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": false
    },
    {
      "description": "patch receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "receipt",
      "patch_relevant": true,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "repair",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "rolled_back",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "write",
      "worktree",
      "patch",
      "session"
    ],
    "blocks_on_conflict": true,
    "requires_clean_worktree": true,
    "requires_confirmation": true,
    "requires_evidence_before_trigger": true,
    "risk_band": "high",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "partial",
    "supports_rollback": true
  },
  "summary": "Apply a validated patch bundle to the workspace.",
  "tool_name": "apply_patch_bundle"
}
[/TOOL_SPEC]

[USER_QUERY]
Detect that apply_patch_bundle should not fire because the required runtime preconditions are still unsatisfied.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=precondition_gating
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "string",
      "default_value": "pytest -q",
      "description": "test selector",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "test_selector",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 8000,
    "token_cost_estimate": 96,
    "tool_call_cost_estimate": 1
  },
  "capability": "validator",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": false,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "execute",
      "validate"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Read-only validation tool under workspace / session discipline.",
  "invocation_mode": "executing",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "validator receipt",
      "evidence_backwrite": false,
      "kind": "validation_receipt",
      "name": "validator_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "execution receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "execution_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "validate",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "execute",
      "worktree",
      "validate",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Run bounded CI/test validation and emit validator-compatible receipts.",
  "tool_name": "run_ci_validation"
}
[/TOOL_SPEC]

[USER_QUERY]
Detect that run_ci_validation should not fire because the required runtime preconditions are still unsatisfied.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=worktree_permission
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "string",
      "default_value": "pytest -q",
      "description": "test selector",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "test_selector",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 8000,
    "token_cost_estimate": 96,
    "tool_call_cost_estimate": 1
  },
  "capability": "validator",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": false,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "execute",
      "validate"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Read-only validation tool under workspace / session discipline.",
  "invocation_mode": "executing",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "validator receipt",
      "evidence_backwrite": false,
      "kind": "validation_receipt",
      "name": "validator_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "execution receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "execution_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "validate",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "execute",
      "worktree",
      "validate",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Run bounded CI/test validation and emit validator-compatible receipts.",
  "tool_name": "run_ci_validation"
}
[/TOOL_SPEC]

[USER_QUERY]
Judge run_ci_validation under strict worktree and permission discipline, including when it should defer instead of acting.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=trigger
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "string",
      "default_value": "pytest -q",
      "description": "test selector",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "test_selector",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 8000,
    "token_cost_estimate": 96,
    "tool_call_cost_estimate": 1
  },
  "capability": "validator",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": false,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "execute",
      "validate"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Read-only validation tool under workspace / session discipline.",
  "invocation_mode": "executing",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "validator receipt",
      "evidence_backwrite": false,
      "kind": "validation_receipt",
      "name": "validator_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "execution receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "execution_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "validate",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "execute",
      "worktree",
      "validate",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Run bounded CI/test validation and emit validator-compatible receipts.",
  "tool_name": "run_ci_validation"
}
[/TOOL_SPEC]

[USER_QUERY]
Under the same harness rules, judge if run_ci_validation is the next valid tool call rather than free-form text.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=arguments
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "string",
      "default_value": "pytest -q",
      "description": "test selector",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "test_selector",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 8000,
    "token_cost_estimate": 96,
    "tool_call_cost_estimate": 1
  },
  "capability": "validator",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": false,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "execute",
      "validate"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Read-only validation tool under workspace / session discipline.",
  "invocation_mode": "executing",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "validator receipt",
      "evidence_backwrite": false,
      "kind": "validation_receipt",
      "name": "validator_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "execution receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "execution_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "validate",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "execute",
      "worktree",
      "validate",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Run bounded CI/test validation and emit validator-compatible receipts.",
  "tool_name": "run_ci_validation"
}
[/TOOL_SPEC]

[USER_QUERY]
Normalize the user intent into the strict argument schema expected by run_ci_validation.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=precondition_gating
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "string",
      "default_value": "pytest -q",
      "description": "test selector",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "test_selector",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 8000,
    "token_cost_estimate": 96,
    "tool_call_cost_estimate": 1
  },
  "capability": "validator",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": false,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "execute",
      "validate"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Read-only validation tool under workspace / session discipline.",
  "invocation_mode": "executing",
  "metadata": {
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "validator receipt",
      "evidence_backwrite": false,
      "kind": "validation_receipt",
      "name": "validator_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "execution receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "execution_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "validate",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "execute",
      "worktree",
      "validate",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Run bounded CI/test validation and emit validator-compatible receipts.",
  "tool_name": "run_ci_validation"
}
[/TOOL_SPEC]

[USER_QUERY]
Even if apply_patch_bundle looks tempting, keep run_ci_validation gated until the permission and worktree envelope is valid.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=self_check_loop
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "array",
      "default_value": [],
      "description": "paths to validate",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "entry_paths",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 6000,
    "token_cost_estimate": 96,
    "tool_call_cost_estimate": 1
  },
  "capability": "validator",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": false,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "execute",
      "validate"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Self-check loop tool for code-after-generation verification and bounded repair routing.",
  "invocation_mode": "executing",
  "metadata": {
    "self_check_loop": true,
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "validator receipt",
      "evidence_backwrite": false,
      "kind": "validation_receipt",
      "name": "validator_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "bounded failure explanation",
      "evidence_backwrite": false,
      "kind": "text",
      "name": "failure_report",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "repair",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "execute",
      "validate",
      "worktree",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Run bounded self-check, diagnose the failed constraint, and prepare the next repair step.",
  "tool_name": "self_check_repair_loop"
}
[/TOOL_SPEC]

[USER_QUERY]
After code generation, run the strict one-cycle self-check path and only escalate to the next bounded repair step if validation fails.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=trigger
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "array",
      "default_value": [],
      "description": "paths to validate",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "entry_paths",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 6000,
    "token_cost_estimate": 96,
    "tool_call_cost_estimate": 1
  },
  "capability": "validator",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": false,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "execute",
      "validate"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Self-check loop tool for code-after-generation verification and bounded repair routing.",
  "invocation_mode": "executing",
  "metadata": {
    "self_check_loop": true,
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "validator receipt",
      "evidence_backwrite": false,
      "kind": "validation_receipt",
      "name": "validator_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "bounded failure explanation",
      "evidence_backwrite": false,
      "kind": "text",
      "name": "failure_report",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "repair",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "execute",
      "validate",
      "worktree",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Run bounded self-check, diagnose the failed constraint, and prepare the next repair step.",
  "tool_name": "self_check_repair_loop"
}
[/TOOL_SPEC]

[USER_QUERY]
Under the same harness rules, judge if self_check_repair_loop is the next valid tool call rather than free-form text.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=arguments
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "array",
      "default_value": [],
      "description": "paths to validate",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "entry_paths",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 6000,
    "token_cost_estimate": 96,
    "tool_call_cost_estimate": 1
  },
  "capability": "validator",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": false,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "execute",
      "validate"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Self-check loop tool for code-after-generation verification and bounded repair routing.",
  "invocation_mode": "executing",
  "metadata": {
    "self_check_loop": true,
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "validator receipt",
      "evidence_backwrite": false,
      "kind": "validation_receipt",
      "name": "validator_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "bounded failure explanation",
      "evidence_backwrite": false,
      "kind": "text",
      "name": "failure_report",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "repair",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "execute",
      "validate",
      "worktree",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Run bounded self-check, diagnose the failed constraint, and prepare the next repair step.",
  "tool_name": "self_check_repair_loop"
}
[/TOOL_SPEC]

[USER_QUERY]
Normalize the user intent into the strict argument schema expected by self_check_repair_loop.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=precondition_gating
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "array",
      "default_value": [],
      "description": "paths to validate",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "entry_paths",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 6000,
    "token_cost_estimate": 96,
    "tool_call_cost_estimate": 1
  },
  "capability": "validator",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": false,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "execute",
      "validate"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Self-check loop tool for code-after-generation verification and bounded repair routing.",
  "invocation_mode": "executing",
  "metadata": {
    "self_check_loop": true,
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "validator receipt",
      "evidence_backwrite": false,
      "kind": "validation_receipt",
      "name": "validator_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "bounded failure explanation",
      "evidence_backwrite": false,
      "kind": "text",
      "name": "failure_report",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "repair",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "execute",
      "validate",
      "worktree",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Run bounded self-check, diagnose the failed constraint, and prepare the next repair step.",
  "tool_name": "self_check_repair_loop"
}
[/TOOL_SPEC]

[USER_QUERY]
Detect that self_check_repair_loop should not fire because the required runtime preconditions are still unsatisfied.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=receipt_validation
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "array",
      "default_value": [],
      "description": "paths to validate",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "entry_paths",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 6000,
    "token_cost_estimate": 96,
    "tool_call_cost_estimate": 1
  },
  "capability": "validator",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": false,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": true,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "execute",
      "validate"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Self-check loop tool for code-after-generation verification and bounded repair routing.",
  "invocation_mode": "executing",
  "metadata": {
    "self_check_loop": true,
    "validator_names": [
      "sandbox_result_validator"
    ]
  },
  "outputs": [
    {
      "description": "validator receipt",
      "evidence_backwrite": false,
      "kind": "validation_receipt",
      "name": "validator_receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    },
    {
      "description": "bounded failure explanation",
      "evidence_backwrite": false,
      "kind": "text",
      "name": "failure_report",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "repair",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "execute",
      "validate",
      "worktree",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "medium",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Run bounded self-check, diagnose the failed constraint, and prepare the next repair step.",
  "tool_name": "self_check_repair_loop"
}
[/TOOL_SPEC]

[USER_QUERY]
Emit the bounded receipt bundle that proves self_check_repair_loop complied with validator and permission policy.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=reverse_engineering
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "array",
      "default_value": [],
      "description": "paths to inspect",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "focus_paths",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 3500,
    "token_cost_estimate": 128,
    "tool_call_cost_estimate": 1
  },
  "capability": "search",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": true,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": false,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "worktree"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Repository reverse-engineering tool for code understanding, dependency tracing, and intent recovery.",
  "invocation_mode": "read_only",
  "metadata": {
    "reverse_engineering": true
  },
  "outputs": [
    {
      "description": "bounded repository map",
      "evidence_backwrite": true,
      "kind": "evidence",
      "name": "repo_map",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": false
    },
    {
      "description": "inspection receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "execute",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "worktree",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "low",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Inspect repository structure, infer missing intent, and reconstruct bounded architecture facts.",
  "tool_name": "repo_reverse_engineer"
}
[/TOOL_SPEC]

[USER_QUERY]
Use bounded repository inspection to reconstruct missing intent and architecture facts before any tool fantasy appears.
[/USER_QUERY]


[HARNESS_ENVELOPE]
role=generator
runtime_protocol=true
typed_tool_contracts=true
validator_alignment=true
session_continuity=true
permission_alignment=true
worktree_discipline=true
repair_after_self_check=true
reverse_engineering_ready=true
rule=Do not emit free-form tool fantasies. Follow the typed tool contract exactly.
rule=If preconditions are not satisfied, defer, repair, or ask for the next bounded step.
rule=Validator receipts and runtime permissions outrank narration.
rule=If code is produced, the harness may still call a bounded self-check loop before final submit.
rule=When repository intent is unclear, reverse-engineering and repository inspection are valid bounded actions.
contract_focus=runtime_session
[/HARNESS_ENVELOPE]

[TOOL_SPEC]
{
  "arguments": [
    {
      "arg_type": "string",
      "default_value": null,
      "description": "workspace root",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "workspace_root",
      "nullable": false,
      "path_like": true,
      "repeated": false,
      "required": true,
      "sensitive": false,
      "workspace_scoped": true
    },
    {
      "arg_type": "array",
      "default_value": [],
      "description": "paths to inspect",
      "enum_values": [],
      "examples": [],
      "location": "body",
      "name": "focus_paths",
      "nullable": false,
      "path_like": false,
      "repeated": false,
      "required": false,
      "sensitive": false,
      "workspace_scoped": false
    }
  ],
  "budget_hint": {
    "network_cost_estimate": 0,
    "sandbox_cost_estimate": 1,
    "step_cost_estimate": 1,
    "time_cost_estimate_ms": 3500,
    "token_cost_estimate": 128,
    "tool_call_cost_estimate": 1
  },
  "capability": "search",
  "constraints": {
    "allowed_isolation_modes": [],
    "allowed_path_prefixes": [],
    "approval_modes": [],
    "auto_mode_allowed": true,
    "emits_evidence_ids": true,
    "emits_patch_ref": false,
    "emits_receipt": true,
    "emits_validation_receipt": false,
    "forbidden_path_prefixes": [],
    "mutates_workspace": false,
    "plan_mode_allowed": true,
    "required_permissions": [
      "worktree"
    ],
    "required_task_statuses": [],
    "requires_worktree": true,
    "supports_compact_boundary": false,
    "supports_resume": true
  },
  "description": "Repository reverse-engineering tool for code understanding, dependency tracing, and intent recovery.",
  "invocation_mode": "read_only",
  "metadata": {
    "reverse_engineering": true
  },
  "outputs": [
    {
      "description": "bounded repository map",
      "evidence_backwrite": true,
      "kind": "evidence",
      "name": "repo_map",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": false
    },
    {
      "description": "inspection receipt",
      "evidence_backwrite": false,
      "kind": "execution_receipt",
      "name": "receipt",
      "patch_relevant": false,
      "reproducible": true,
      "required": true,
      "task_output_relevant": false,
      "validator_relevant": true
    }
  ],
  "phase": "execute",
  "receipt_policy": {
    "include_artifact_refs": true,
    "include_budget_charge": true,
    "include_evidence_ids": true,
    "include_patch_refs": true,
    "include_permission_decision": true,
    "include_raw_value": false,
    "include_task_output_refs": true,
    "include_validator_refs": true,
    "include_worktree_ref": true,
    "receipt_statuses": [
      "succeeded",
      "failed",
      "blocked"
    ]
  },
  "risk_profile": {
    "allowed_permissions": [
      "worktree",
      "session"
    ],
    "blocks_on_conflict": false,
    "requires_clean_worktree": false,
    "requires_confirmation": false,
    "requires_evidence_before_trigger": false,
    "risk_band": "low",
    "sensitive_domains": [
      "workspace"
    ],
    "side_effect_level": "none",
    "supports_rollback": false
  },
  "summary": "Inspect repository structure, infer missing intent, and reconstruct bounded architecture facts.",
  "tool_name": "repo_reverse_engineer"
}
[/TOOL_SPEC]

[USER_QUERY]
Identify the session continuity obligations that surround repo_reverse_engineer in a multi-step harness turn.
[/USER_QUERY]