[P0] Add capability-gated tool registry and one real tool #8

New issue

Closed

opened 2026-08-12 01:18:15 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-12 01:18:15 +00:00

(Migrated from github.com)

Goal

Add external actions without giving model-generated plans ambient authority.

Scope

define capability terms and inheritance/narrowing rules;
define canonical tool schemas, arguments, results, and errors;
implement tool registration/discovery;
validate plan-requested tools against capabilities before invocation;
add one non-trivial real tool suitable for an end-to-end demo (for example bounded HTTP GET or a read-only project file tool);
trace authorization decisions and tool outcomes;
ensure recursive/subagent contexts can receive a strict subset of parent capabilities.

Acceptance criteria

allowed tool call succeeds from a validated plan;
denied tool call fails before invocation;
child capability sets cannot silently widen parent authority;
tool output is bounded and normalized;
tool invocation is visible in the run trace;
tests cover allow, deny, malformed args, timeout, and oversized output.

Dependencies

#7
parent #3

Research

See RLM-RESEARCH-002-agentic-harness.org and the capability model in the merged TODO/README.

## Goal Add external actions without giving model-generated plans ambient authority. ## Scope - define capability terms and inheritance/narrowing rules; - define canonical tool schemas, arguments, results, and errors; - implement tool registration/discovery; - validate plan-requested tools against capabilities before invocation; - add one non-trivial real tool suitable for an end-to-end demo (for example bounded HTTP GET or a read-only project file tool); - trace authorization decisions and tool outcomes; - ensure recursive/subagent contexts can receive a strict subset of parent capabilities. ## Acceptance criteria - allowed tool call succeeds from a validated plan; - denied tool call fails before invocation; - child capability sets cannot silently widen parent authority; - tool output is bounded and normalized; - tool invocation is visible in the run trace; - tests cover allow, deny, malformed args, timeout, and oversized output. ## Dependencies - #7 - parent #3 ## Research See `RLM-RESEARCH-002-agentic-harness.org` and the capability model in the merged TODO/README.