Subagent/coding tools agent integration c77be280

Cargo.toml

@@ -25,9 +25,12 @@ hyper = { version = "1", features = ["client", "http1"] }
 hyper-util = { version = "0.1", features = ["client-legacy", "http1", "tokio"] }
 parking_lot = "0.12"
 rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
-rustscript-vm = { package = "pd-vm", git = "https://github.com/rustscript-lang/rustscript.git", rev = "5c328b8d5c374b365a2560925204e588b575a30a", default-features = false, features = ["runtime", "http-client", "sqlite"] }
+rustscript-vm = { package = "pd-vm", git = "https://github.com/rustscript-lang/rustscript.git", rev = "f9ca4143f8ba2f486e270347504c49f5ea846097", default-features = false, features = ["runtime", "http-client", "sqlite"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+# Meta-schema validation only; resolver features stay disabled.
+jsonschema = { version = "0.52.1", default-features = false }
+libc = "0.2.189"
 tokio = { version = "1", features = ["full"] }
 tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }
 tower = { version = "0.5", features = ["util"] }

README.md

@@ -57,13 +57,16 @@ placeholder route is advertised.
 | API hardening (A7): bounded per-peer-IP/per-account rate limiting, client-disconnect policy | Implemented (disabled by default; see [docs/configuration.md](docs/configuration.md)) |
 | Observability (A9): bounded metrics registry, `GET /metrics`, structured terminal tracing | Implemented (see [docs/deployment.md](docs/deployment.md)) |
 | Provider protocol adapters (OpenAI Chat/Responses, Anthropic Messages, provider profiles) | **Partial — blocked by core (A3)**. Wire building, standard-shape guard, marker-preservation, and structured provider errors are green; buffered response parsing, streaming, and the Responses/Anthropic adapters stay typed `not_implemented` stubs until core compiler defects are fixed. See [plans/2026-08-13_a3-provider-core-blocker.md](plans/2026-08-13_a3-provider-core-blocker.md). |
-| RSS serial loop + durable compaction policies (A5) | **Policies implemented and tested** (`rss/agent/main.rss`, `rss/agent/compact.rss` with executable suites); the production entry is **not wired** into the gateway/service yet (blocked by A3/A4). See [plans/2026-08-13_a5-scope-split.md](plans/2026-08-13_a5-scope-split.md). |
+| RSS serial loop + durable compaction policies (A5) | Serial loop is wired into the library `AgentService` worker via bundled `rss/agent/main.rss`. Compaction policies remain implemented and tested (`rss/agent/compact.rss`). OpenAI-compatible buffered/streaming adapters stay A3-blocked; the gateway binary still runs `RUSTSCRIPT_AGENT_SCRIPT` and does not add an OpenAI-compatible inference path. See [plans/2026-08-13_a5-scope-split.md](plans/2026-08-13_a5-scope-split.md). |
+| Native coding tools + workspace-confined loop | Implemented for the library worker: `read_file`, `search_files`, `write_file`, `patch`, `terminal`, `process` run serially through the native registry. Local E2E: `cargo test --test coding_agent_e2e_tests` and `cargo test --test coding_agent_edge_e2e_tests`. See [docs/configuration.md](docs/configuration.md). Parallel tools remain excluded (A6). |
 | Harness and approval machinery (A4) | Not implemented (excluded from the current milestone scope); approval **repository** CRUD exists, there is no approval flow driving runs |
 | Parallel tools and subagents (A6) | Not implemented (excluded from the current milestone scope) |
 | Scheduled / durable job execution | **Not implemented (explicitly excluded)**. Job CRUD, pause/resume, and latest-output routes exist, but there is no scheduler; `POST /api/jobs/{id}/run` is intentionally absent and answers `404`. |
 | Telegram gateway (A8) | **Implemented**: native Bot API transport (https/rustls), deny-by-default account/chat/user allowlists, durable delivery cursors (at-least-once), bounded 429/5xx/401 retries, fail-closed first-boot drain, bounded shutdown drain. See [docs/deployment.md](docs/deployment.md). |
 
 Current lifecycle/reliability behavior is covered by the integration
 suites in `tests/` (admission, bounded delivery, terminal-commit retries,
-restart recovery, storage stalls); CI runs them with
-`cargo test --locked --all-features --all-targets`.
+restart recovery, storage stalls, coding-agent E2E). CI runs them with
+`cargo test --locked --all-features --all-targets`. The main coding
+workflow E2E is `cargo test --test coding_agent_e2e_tests`. Cancellation
+and output-limit edges are `cargo test --test coding_agent_edge_e2e_tests`.

docs/configuration.md

@@ -190,6 +190,130 @@ page bounds.
 | `RUN_EPOCH_DEADLINE_TICKS` | 1 000 000 000 | Epoch budget granted to one cancellable run; the cancellation watcher jumps the epoch past it. |
 | `RUN_EPOCH_CHECK_INTERVAL` | 1 000 | Interpreter operations between epoch checks on cancellable runs. |
 
+## Coding tools and serial loop
+
+The library `AgentService` worker compiles bundled `rss/agent/main.rss` and
+drives a **serial** native tool loop. RSS builds canonical provider requests
+and dispatches tools only through the native host bridges
+(`agent::provider_call`, `agent::tool_dispatch`). This is not an
+OpenAI-compatible inference path.
+
+Built-in native tools, in registry order:
+
+| Name | Toolset | Risk | Notes |
+| --- | --- | --- | --- |
+| `read_file` | coding | read | Bounded workspace file read. |
+| `search_files` | coding | read | Bounded workspace search. |
+| `write_file` | coding | write | Write complete workspace file contents. |
+| `patch` | coding | write | Minimal unique-string replacement. |
+| `terminal` | process | process | Direct `argv` execution; no shell command string. |
+| `process` | process | process | Background/control sibling of `terminal`. |
+
+Parallel tool calls are rejected (`unsupported_parallel`). Subagents and A6
+parallel fan-out are out of scope.
+
+## Workspace guidance, priority, and budgets
+
+Admission freezes one coding system prompt from the run workspace. Root-level
+guidance files are read in this priority, highest first: `AGENTS.md`,
+`CLAUDE.md`, `.cursorrules`. Default `CodingPromptBudgets` are 16 KiB total
+prompt, 8 KiB combined guidance, and 4 KiB per guidance file. Each admitted
+file is length-prefixed as untrusted content so project bytes cannot forge
+later contract sections. The frozen prompt is reused as the sole system
+message on every subsequent provider request for that run.
+
+## Provider profiles
+
+`ProviderProfile` is a validated, secret-safe snapshot retained on
+`AgentService`. Built-in names map protocol labels only (`local-agent` →
+`local-agent`, `openai` / `openai-compatible` → `openai-chat-completions`).
+Options are request-shaping controls (`profile`, `protocol`,
+`reasoning_effort`, `base_url`, sampling numbers). Credential-bearing keys,
+headers, and unsafe URLs are rejected rather than redacted. Profiles do not
+grant network access; HTTP remains deny-by-default unless hosts **and** ports
+are allowlisted.
+
+## Run limits, deadline, and cancellation
+
+`RunLimits` (`max_turns`, `max_tool_calls`, `max_tool_output_bytes`,
+`workspace_root`) are captured at admission. `workspace_root` must be an
+absolute existing directory and is canonicalized. `AgentGatewayConfig.run_timeout`
+is the per-run wall-clock deadline; it is not reset per provider or tool
+call. `stop` requests cooperative cancellation once: the provider call, RSS
+run, and native process/terminal children share the run token.
+`cancellation_grace` bounds how long the worker waits after a deadline before
+the thread is abandoned. Client-disconnect policy is independent
+(`keep-running` by default).
+
+## Durable replay
+
+`DurableProviderHost` is the production provider seam. Before each fresh inner
+call it commits a sanitized `model.requested` boundary (`retry_safe` plus a
+`sha256:` fingerprint; never `request`/`messages`/`prompt`/`provider_options`/
+`api_key`/`headers`/`body`). Completed canonical provider steps
+(`model.completed` plus the assistant message) replay on restart without an
+inner call or a second `turns` increment. Pending retry-safe requests retry the
+same logical turn and do not synthesize an assistant/tool parent. Pending
+requests that are not retry-safe, lack a fingerprint, leak secret keys, or
+already have a later tool effect fail closed (`interrupted_provider`) with no
+provider or tool effect.
+
+Native dispatch is durable-first. Assistant `tool_call` parents and user
+`tool_result` messages carry `parent_message_id` and monotonic `ordinal`
+values. A missing or name-mismatched parent fails closed (`missing_tool_parent`)
+and does not run the executor. Replaying an already durable `ToolResult` does
+not re-account metrics.
+
+Exactly-once delivery to an external receiver is impossible: event delivery is
+at-least-once. Durable replay guarantees the agent does not duplicate tool
+effects or provider-step rows; subscribers may observe the same durable event
+more than once.
+
+## Coding metrics
+
+Five saturating coding-agent counters are recorded without prompts, paths, or
+raw outputs:
+
+| Metric | Prometheus name | Counted when |
+| --- | --- | --- |
+| `model_calls` | `agent_model_calls_total` | Each actual `AgentProviderHost::call` |
+| `tool_calls` | `agent_tool_calls_total` | Each freshly executed or failed tool dispatch |
+| `tool_failures` | `agent_tool_failures_total` | Canonical `ToolResult.ok == false` |
+| `turns` | `agent_turns_total` | Successful `ok: true` provider envelopes |
+| `truncations` | `agent_truncations_total` | Typed `truncated` on a model envelope or tool result |
+
+## Security confinement
+
+Coding file tools and `terminal`/`process` are confined to the admitted
+`workspace_root`. `terminal` executes `argv` directly; a `command` shell
+string is rejected (`invalid_argv`). Default HTTP policy denies all hosts and
+ports. The coding loop E2E uses `ScriptedProvider` as model transport and the
+`local-agent` profile so it cannot fall through to an OpenAI-compatible
+network adapter.
+
+## Local coding-agent E2E
+
+The main real coding workflow is covered by:
+
+```bash
+cargo test --test coding_agent_e2e_tests
+```
+
+Stop-during-terminal cancellation and bounded output-limit overflow are
+covered by:
+
+```bash
+cargo test --test coding_agent_edge_e2e_tests
+```
+
+The main suite generates a temporary git workspace, drives the production
+`AgentService` worker and bundled RSS loop, and asserts a real `read_file` →
+`patch` → `terminal` argv test run. The edge suite asserts stop-during-terminal
+child cleanup, exact tool lifecycle, durable parent/name/ordinal chaining,
+truncated overflow artifacts, that reopening a completed run is a no-op, and
+pending provider-turn restart: retry-safe replay/retry, completed-step replay
+fidelity, unsafe fail-closed, and no duplicate tool effect or metric count.
+
 ## Secrets
 
 - `RUSTSCRIPT_AGENT_BEARER_TOKEN` and `RUSTSCRIPT_AGENT_TELEGRAM_BOT_TOKEN`