Execute closed prompt commands through canonical tool runtime #207

Merged

lost-rob0t merged 4 commits from rage/206-prompt-command-runtime into main

2026-08-25 11:19:54 +00:00

lost-rob0t commented

2026-08-25 11:11:34 +00:00

(Migrated from github.com)

Closes #206.

Parent: #172.

RAGE state

TDD-first from starting main 8054606971ffbbb6aa9484b4e915caa4c655929b. Full audit record: rage/206-prompt-command-runtime.org.

The first test-only head 01dc568c3e7f7c88e758c74bf2628d0159363612 produced the intended deterministic red: 875/877 passed and the only two failures were the deliberately absent prompt_command_execute/6. Credential-backed REAL OpenRouter remained green on that same head.

The test contract was then hardened before realization to cover a real canonical rlm_subagent child returning through the parent mailbox, unsupported target substitution, and allowed-target payload tampering via compiler-fingerprint mismatch.

Design / invariant

Compiled KB prompt commands remain closed inert data. rlm_prompt_command authenticates command shape, the fixed current tool(rlm_subagent) target, and compiler fingerprint, then projects only json{query:Text} into canonical rlm_tool:tool_invoke/7. No command/model term is meta-called and no arbitrary KB tool dispatcher exists.

The compiler fingerprint proves command integrity only; it never grants execution authority. Tool capabilities, authority, effects, approval, limits, cancellation, and async scheduling remain owned by the canonical typed tool/subagent runtime.

Exact-head verification

Final candidate head: 67e8adc43fa3ec134051e2e3f1a05969e4daab8a.

All required exact-head lanes are successful:

CI deterministic unit/load + benchmark/conformance + deep recursion + CLI + persistence gates;
credential-backed REAL OpenRouter core, structured repair, benchmark, depth 0/1/2, and CLI smoke;
Paid OpenRouter;
Nix flake;
Tree-sitter FFI;
Clean SWI pack install.

Current review submissions and unresolved review threads are empty, issue discussion is empty, the PR is mergeable, and main remains the exact starting base at the pre-promotion race check.

Non-goals

No second selector, no arbitrary KB tool vocabulary, no #175 timeout/deadline redesign, no downstream Agent Zero/AgentProlog product logic, and no full automatic recursion-policy selection in this slice.

Closes #206. Parent: #172. ## RAGE state TDD-first from starting `main` `8054606971ffbbb6aa9484b4e915caa4c655929b`. Full audit record: `rage/206-prompt-command-runtime.org`. The first test-only head `01dc568c3e7f7c88e758c74bf2628d0159363612` produced the intended deterministic red: 875/877 passed and the only two failures were the deliberately absent `prompt_command_execute/6`. Credential-backed REAL OpenRouter remained green on that same head. The test contract was then hardened before realization to cover a real canonical `rlm_subagent` child returning through the parent mailbox, unsupported target substitution, and allowed-target payload tampering via compiler-fingerprint mismatch. ## Design / invariant Compiled KB prompt commands remain closed inert data. `rlm_prompt_command` authenticates command shape, the fixed current `tool(rlm_subagent)` target, and compiler fingerprint, then projects only `json{query:Text}` into canonical `rlm_tool:tool_invoke/7`. No command/model term is meta-called and no arbitrary KB tool dispatcher exists. The compiler fingerprint proves command integrity only; it never grants execution authority. Tool capabilities, authority, effects, approval, limits, cancellation, and async scheduling remain owned by the canonical typed tool/subagent runtime. ## Exact-head verification Final candidate head: `67e8adc43fa3ec134051e2e3f1a05969e4daab8a`. All required exact-head lanes are successful: - CI deterministic unit/load + benchmark/conformance + deep recursion + CLI + persistence gates; - credential-backed REAL OpenRouter core, structured repair, benchmark, depth 0/1/2, and CLI smoke; - Paid OpenRouter; - Nix flake; - Tree-sitter FFI; - Clean SWI pack install. Current review submissions and unresolved review threads are empty, issue discussion is empty, the PR is mergeable, and `main` remains the exact starting base at the pre-promotion race check. ## Non-goals No second selector, no arbitrary KB tool vocabulary, no #175 timeout/deadline redesign, no downstream Agent Zero/AgentProlog product logic, and no full automatic recursion-policy selection in this slice.