Close bounded subagent possession gaps #180

Merged

lost-rob0t merged 1 commit from rage/144-fallback-closure into main

2026-08-24 16:24:18 +00:00

lost-rob0t commented

2026-08-24 16:22:00 +00:00

(Migrated from github.com)

Runtime invariant

Bounded subagent completion now executes with the spawned logical child's exact normalized capability ceiling, narrowed authority context, and trusted runtime/agent lineage. Registration fails closed when a parent-bound rlm_subagent handler would otherwise grant implicit recursive delegation without a depth-aware child binding.

The registry plan adapter accepts invocation-local trusted metadata through a new /4 form while the existing /3 facade retains its current behavior.

Important non-goals

no new scheduler, authority tier, ambient capability, or executable model data
no generic result-verifier subsystem; broader evidence acceptance remains #56
no recursive subagent-tool binding until it has an explicit depth/concurrency identity contract

Evidence

red-to-green regressions for capability widening and registry-authority substitution
focused subagent suite: 12/12
focused async architecture suites: 54/54
runner integrity: 19/19
aggregate deterministic suite: 75 suites, 783/783 passed, 0 failed/timeout/blocked/fixme
deterministic benchmark: 16/16
deep experiment: 15/15
JSON CLI demo: pass
Nix flake checks: 3/3
git diff --check: pass

Closes #144

## Runtime invariant Bounded subagent completion now executes with the spawned logical child's exact normalized capability ceiling, narrowed authority context, and trusted runtime/agent lineage. Registration fails closed when a parent-bound `rlm_subagent` handler would otherwise grant implicit recursive delegation without a depth-aware child binding. The registry plan adapter accepts invocation-local trusted metadata through a new `/4` form while the existing `/3` facade retains its current behavior. ## Important non-goals - no new scheduler, authority tier, ambient capability, or executable model data - no generic result-verifier subsystem; broader evidence acceptance remains #56 - no recursive subagent-tool binding until it has an explicit depth/concurrency identity contract ## Evidence - red-to-green regressions for capability widening and registry-authority substitution - focused subagent suite: 12/12 - focused async architecture suites: 54/54 - runner integrity: 19/19 - aggregate deterministic suite: 75 suites, 783/783 passed, 0 failed/timeout/blocked/fixme - deterministic benchmark: 16/16 - deep experiment: 15/15 - JSON CLI demo: pass - Nix flake checks: 3/3 - `git diff --check`: pass Closes #144