[P1] Execute closed KB prompt commands through canonical typed tool runtime #206

New issue

Closed

opened 2026-08-25 11:10:13 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-25 11:10:13 +00:00

(Migrated from github.com)

Parent: #172
Related: #144, #203/#204, #175
Starting main: 8054606971ffbbb6aa9484b4e915caa4c655929b

Observed gap

Current rlm_prompt_command already compiles closed KB bindings such as prompt_action(..., delegate_subagent) into tool(rlm_subagent). Current rlm_subagent already provides bounded child execution, structured return envelopes, child-owned capability/authority, cancellation, usage/trace, and parent child_result propagation. Current adaptive recursion already has a delegated_subagent route.

However, repository search on the starting SHA finds no production consumer of prompt_command_compile/*; the end-to-end test manually destructures Command.command = tool(Tool) and calls tool_invoke/7 itself. That host glue is the missing symbolic-control-plane seam.

Goal

Add the smallest generic runtime executor for an already-compiled prompt command so a closed KB binding can reach the canonical typed tool runtime without letting command data become an arbitrary callable or arbitrary tool target.

First supported adapter remains delegate_subagent -> tool(rlm_subagent) and derives the invocation payload from trusted compiled command data as {query: Command.text}. Execution must reuse rlm_tool and the registered canonical rlm_subagent; it must not create another scheduler, tool path, authority tier, or child runtime.

TDD contract

compiling an unknown KB trigger and executing the compiled command invokes the registered canonical rlm_subagent without manual Command.command/tool_invoke glue;
the completed child envelope is returned intact, including correlation/usage/delegation provenance;
the existing parent agent receives the canonical child_result and can consume it through agent_pump;
a forged/unsupported command target fails structurally before tool invocation and creates no child;
capability denial remains the canonical tool-runtime denial and creates no child;
command execution does not meta-call command/model data and does not grant authority/capabilities;
latency-bearing execution remains on the existing async-first tool runtime path.

Non-goals

no second prompt selector or skill selector;
no model-selected role/skill/model/capability;
no generic arbitrary tool name in KB commands;
no #175 timeout/deadline redesign;
no product-specific Agent Zero or AgentProlog glue;
no full automatic recursion-policy selection in this slice.

RAGE decision input

This slice closes the concrete missing executor seam first. After it lands, #172 can wire unresolved/unknown policy selection to this typed command path and make parent resume/replan explicit without duplicating command/tool semantics.

Parent: #172 Related: #144, #203/#204, #175 Starting main: `8054606971ffbbb6aa9484b4e915caa4c655929b` ## Observed gap Current `rlm_prompt_command` already compiles closed KB bindings such as `prompt_action(..., delegate_subagent)` into `tool(rlm_subagent)`. Current `rlm_subagent` already provides bounded child execution, structured return envelopes, child-owned capability/authority, cancellation, usage/trace, and parent `child_result` propagation. Current adaptive recursion already has a `delegated_subagent` route. However, repository search on the starting SHA finds no production consumer of `prompt_command_compile/*`; the end-to-end test manually destructures `Command.command = tool(Tool)` and calls `tool_invoke/7` itself. That host glue is the missing symbolic-control-plane seam. ## Goal Add the smallest generic runtime executor for an already-compiled prompt command so a closed KB binding can reach the canonical typed tool runtime without letting command data become an arbitrary callable or arbitrary tool target. First supported adapter remains `delegate_subagent -> tool(rlm_subagent)` and derives the invocation payload from trusted compiled command data as `{query: Command.text}`. Execution must reuse `rlm_tool` and the registered canonical `rlm_subagent`; it must not create another scheduler, tool path, authority tier, or child runtime. ## TDD contract 1. compiling an `unknown` KB trigger and executing the compiled command invokes the registered canonical `rlm_subagent` without manual `Command.command`/`tool_invoke` glue; 2. the completed child envelope is returned intact, including correlation/usage/delegation provenance; 3. the existing parent agent receives the canonical `child_result` and can consume it through `agent_pump`; 4. a forged/unsupported command target fails structurally before tool invocation and creates no child; 5. capability denial remains the canonical tool-runtime denial and creates no child; 6. command execution does not meta-call command/model data and does not grant authority/capabilities; 7. latency-bearing execution remains on the existing async-first tool runtime path. ## Non-goals - no second prompt selector or skill selector; - no model-selected role/skill/model/capability; - no generic arbitrary tool name in KB commands; - no #175 timeout/deadline redesign; - no product-specific Agent Zero or AgentProlog glue; - no full automatic recursion-policy selection in this slice. ## RAGE decision input This slice closes the concrete missing executor seam first. After it lands, #172 can wire unresolved/unknown policy selection to this typed command path and make parent resume/replan explicit without duplicating command/tool semantics.