[P1] Carry trusted skill and role provenance through rlm_subagent #203

New issue

Closed

opened 2026-08-25 10:30:18 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-25 10:30:18 +00:00

(Migrated from github.com)

Parent: #172
Related: #183, #200/#201
Starting main: a79e9c862b74449d73bcadc729d2a38b5163e10d

Goal

Implement the smallest first #172 runtime slice: make the existing canonical rlm_subagent carry host-selected skill identity and generic role metadata as explicit delegation provenance, while preserving the existing child completion/capability/authority path.

This slice does not add a second selector or automatically decide when to delegate. Current rlm_subagent already forwards trusted completion options into the child, so existing explicit_skills(...) can drive the child rlm_prompt_compiler. The missing behavior is typed observability and role provenance.

Design

Use trusted registration/completion options as the only source of delegation metadata:

explicit_skills([...]) remains the canonical selected-skill input already understood by rlm_completion;
add one bounded host-only subagent_role(Role) option for generic role metadata;
normalize/validate the role as inert bounded data;
strip subagent_role/1 before calling rlm_completion, so the generic completion runtime does not gain a product-specific role option;
attach delegation{role:Role, skills:Skills, source:trusted_host} to the spawned child metadata and returned subagent_result envelope;
model-visible rlm_subagent arguments remain exactly {query: string} for this slice, so model output cannot choose role, skills, model, capabilities, or authority.

No skill or role value grants capabilities or authority. Child capability/authority replacement remains canonical and narrowing-only.

TDD / adversarial contract

host-selected role + explicit skills appear in the completed child envelope;
the spawned child metadata records the same delegation provenance;
model tool args cannot supply role, skills, or arbitrary extra fields because schema remains closed with only query;
child capabilities remain exactly the configured narrowed ceiling;
invalid role data fails structurally before child creation;
failure envelopes preserve delegation provenance when a child exists;
no subagent_role/1 option leaks into generic rlm_completion execution;
existing cancellation, usage, trace, and authority tests remain green.

Non-goals

no automatic unresolved -> delegate decision yet;
no compiler-owned role ranking yet;
no new subagent tool/API;
no model-selected role/model/agent metadata;
no skill-based authority grants;
no #175 timeout work;
no product-specific reviewer persona.

Decision

GO as the next user-requested #172 implementation slice. It stays within #172's existing architecture: trusted host/compiler policy owns role/skill selection, canonical rlm_subagent owns bounded execution, and capability/authority ceilings do not widen.

Parent: #172 Related: #183, #200/#201 Starting main: `a79e9c862b74449d73bcadc729d2a38b5163e10d` ## Goal Implement the smallest first #172 runtime slice: make the existing canonical `rlm_subagent` carry host-selected skill identity and generic role metadata as explicit delegation provenance, while preserving the existing child completion/capability/authority path. This slice does **not** add a second selector or automatically decide when to delegate. Current `rlm_subagent` already forwards trusted completion options into the child, so existing `explicit_skills(...)` can drive the child `rlm_prompt_compiler`. The missing behavior is typed observability and role provenance. ## Design Use trusted registration/completion options as the only source of delegation metadata: - `explicit_skills([...])` remains the canonical selected-skill input already understood by `rlm_completion`; - add one bounded host-only `subagent_role(Role)` option for generic role metadata; - normalize/validate the role as inert bounded data; - strip `subagent_role/1` before calling `rlm_completion`, so the generic completion runtime does not gain a product-specific role option; - attach `delegation{role:Role, skills:Skills, source:trusted_host}` to the spawned child metadata and returned `subagent_result` envelope; - model-visible `rlm_subagent` arguments remain exactly `{query: string}` for this slice, so model output cannot choose role, skills, model, capabilities, or authority. No skill or role value grants capabilities or authority. Child capability/authority replacement remains canonical and narrowing-only. ## TDD / adversarial contract 1. host-selected role + explicit skills appear in the completed child envelope; 2. the spawned child metadata records the same delegation provenance; 3. model tool args cannot supply `role`, `skills`, or arbitrary extra fields because schema remains closed with only `query`; 4. child capabilities remain exactly the configured narrowed ceiling; 5. invalid role data fails structurally before child creation; 6. failure envelopes preserve delegation provenance when a child exists; 7. no `subagent_role/1` option leaks into generic `rlm_completion` execution; 8. existing cancellation, usage, trace, and authority tests remain green. ## Non-goals - no automatic unresolved -> delegate decision yet; - no compiler-owned role ranking yet; - no new subagent tool/API; - no model-selected role/model/agent metadata; - no skill-based authority grants; - no #175 timeout work; - no product-specific reviewer persona. ## Decision GO as the next user-requested #172 implementation slice. It stays within #172's existing architecture: trusted host/compiler policy owns role/skill selection, canonical `rlm_subagent` owns bounded execution, and capability/authority ceilings do not widen.