Unified late-bound tool contract gate with compaction-safe transcript presence

[yh928]

Summary

• Adds ContractGateMiddleware: the first call each turn to a late-bound tool — the generic composio_execute dispatcher, a per-action Composio tool, an MCP-registry remote tool, or a Workflow — is short-circuited with that target's full contract as a tool error, so the retry runs with the real schema in context.
• Fixes agents guessing argument formats and slugs before they have seen the schema — e.g. a Composio Gmail search sent without the quotes Gmail's query syntax needs, or an invented GMAIL_LIST_MESSAGES in place of GMAIL_FETCH_EMAILS.
• Presence is derived from the transcript — each delivered contract leads with a [contract-gate:<digest>:<key>] marker — so it is re-surfaced after summarization / microcompact / hard-trim, and not needlessly re-delivered when it survives a resumed durable sub-agent's initial_history.
• The marker embeds an XXH3-64 digest of the exact contract bytes, so a summarized/rewritten contract fails the digest match and is re-delivered (fail-safe integrity).
• Kill switch: OPENHUMAN_CONTRACT_GATE=0.

Relationship to #4995

#4995 (which closed #4853) gates per-action Composio tools at the tool layer (composio::contract_gate, an in-memory seen-set per ComposioActionTool). This PR unifies and extends that:

• Covers the surfaces fix(composio): gate per-action tools on their full contract (#4853) #4995 does not: the generic composio_execute dispatcher, the MCP-registry bridge, and workflows.
• Closes fix(composio): gate per-action tools on their full contract (#4853) #4995's compaction gap: its own docs note the in-memory seen-set does not reset when the surfaced schema drops out of context. This gate derives presence from the transcript + a payload digest, so a compacted/summarized/rewritten contract is re-delivered.
• No double-gating: per-action Composio is unified onto this middleware; fix(composio): gate per-action tools on their full contract (#4853) #4995's tool-layer hookup (the gate field, its init, the consult call in ComposioActionTool::execute, and its regression test) is removed. Changes to the merged code are kept minimal — composio::contract_gate itself is left in place (now unused in production, its unit tests still green, removal tracked as follow-up).

Problem

Several tool surfaces expose only a thin representation to the model while the full contract lives behind a separate discovery/describe meta-tool:

• Composio — the generic composio_execute dispatcher has an opaque arguments: {"type":"object"}, and per-action ComposioActionTools are built from a one-line list_tools description (parameters may be None), not the full fetch_live_toolkit_catalog.
• MCP registry bridge — mcp_registry_tool_call takes opaque arguments; the real input_schema only appears in mcp_registry_list_tools.
• Workflows — run_workflow takes opaque inputs; the declared inputs live behind describe_workflow.

So the model composes a call before the real schema is in its context and guesses.

Solution

ContractGateMiddleware (src/openhuman/tinyagents/contract_gate.rs) is a dual-trait middleware:

• wrap_tool (the gate): resolve the call to a GateTarget (cheap, no I/O). If its contract marker is already in the transcript → run for real. Otherwise fetch the full contract and short-circuit with it (marked) as a tool error (Found), or return a not-found + valid list (NotFound); an unreachable source falls through (Unavailable).
• before_model (presence refresh): rescans the tool-role messages of request.messages for [contract-gate:<digest>:<key>] markers and rebuilds the in-context set — correct by construction across resume, summarization, microcompact, and hard-trim. Scanning only tool-role messages means a model echoing the marker cannot spoof presence. The digest is re-hashed from the post-marker bytes and keys are credited only on a match, so a rewritten/truncated body re-delivers.

Registered in assemble_turn_harness as one shared Arc in two lists: push_middleware after the compaction/trim middlewares, and push_tool_middleware right after schema_guard and before approval/policy.

Feature-gate safe: the Composio / workflow / MCP contract sources live in domain modules gated by flows / skills / mcp. Each fetch/resolve/render path is #[cfg]-gated to match; with a domain compiled out the gate degrades to pass-through. The --no-default-features feature-gate-smoke lane (lib check + gates-off cargo test) is green.

Contract sources reuse existing code: fetch_live_toolkit_catalog (Composio), all_connected_tools (MCP registry), get_workflow (Workflows).

Deliberately scoped out (follow-up): the MCP config/legacy bridge (mcp_call_tool) — its registry handle is held privately with no ambient accessor.

Submission Checklist

• Tests added or updated — unit tests (target extraction, case-insensitive keys, transcript-marker presence incl. resume-survives / compacted-away / anti-spoof, the deliver→retry transition, Composio/MCP resolvers, deliver-body ordering, digest integrity, list capping, rendering) plus a harness integration test (contract_gate_delivers_the_contract_then_the_retry_executes) driving a gated composio_execute call through the real assemble_turn_harness middleware ordering via run_turn_via_tinyagents_shared — the single assertion executed == 1 proves both halves of deliver→retry end to end.
• Diff coverage ≥ 80% — the gate decision, target extraction, resolvers, rendering, marker scan + digest, deliver-body, and the deliver→retry transition are unit- and integration-covered.
• Coverage matrix updated — N/A: internal agent-harness middleware; no user-facing feature row.
• No new external network dependencies — reuses existing contract sources; adds the xxhash-rust (XXH3) crate for the digest only.
• Linked issue closed via Closes #5038 in ## Related.

Impact

• Runtime: adds one middleware. First call to a gated target per turn does one (cached) contract lookup and returns the contract instead of executing; the retry executes. Net cost: one extra model round-trip on first use of each late-bound target. Disabled via OPENHUMAN_CONTRACT_GATE=0 → byte-identical behavior.
• Security: no new external effects; all returns are model-visible tool errors.

Related

• Closes Unified late-bound tool contract gate with compaction-safe transcript presence #5038
• Extends fix(composio): gate per-action tools on their full contract (#4853) #4995 (per-action Composio contract gate) — unifies it onto this middleware and closes its documented compaction follow-up.
• Original bug Composio Gmail search returns no results because agents call actions before seeing the full parameter schema #4853 (closed by fix(composio): gate per-action tools on their full contract (#4853) #4995).
• Follow-up: gate the MCP config/legacy bridge (mcp_call_tool); remove the now-unused composio::contract_gate module.

---

Validation Run

• Branch: feat/tool-contract-gate — Commit SHA: 3e376622c (rebased onto latest upstream/main).
• Focused: cargo test --lib -- openhuman::tinyagents::contract_gate → green; the deliver→retry harness integration test green.
• Feature-gate smoke (gates off): cargo check --no-default-features --features tokenjuice-treesitter + gates-off cargo test --lib compile — green; the lane's gated-test allowlist matches.
• cargo fmt clean; default cargo clippy --lib warning-free (satisfies the chore(rust): enforce warning-free clippy #4872 warning-free-clippy gate).
• Tauri shell — N/A: core-only change; CI validates the Tauri world.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds ContractGateMiddleware to require full contracts before executing late-bound Composio, MCP registry, and workflow tools. It tracks transcript markers, injects missing contracts through tool errors, supports retries, resets after compaction, and supports an environment-variable kill switch.

Changes

Contract gate

Layer / File(s)	Summary
Contract targeting and rendering src/openhuman/tinyagents/contract_gate.rs, Cargo.toml	Detects gated targets, resolves Composio, MCP, and workflow contracts, renders schemas, formats bounded valid alternatives, and parses transcript markers.
Middleware enforcement and harness wiring src/openhuman/tinyagents/contract_gate.rs, src/openhuman/tinyagents/mod.rs, src/openhuman/tinyagents/tests.rs	Tracks delivered contracts across model calls, returns missing contracts before execution, permits retries, handles unavailable lookups, registers the middleware, and updates inventory expectations.
Gate behavior and rendering tests src/openhuman/tinyagents/contract_gate_tests.rs	Covers target extraction, marker handling, retries, compaction, unknown targets, bounded lists, and Composio/MCP rendering.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Model
  participant ContractGateMiddleware
  participant ContractResolver
  participant LateBoundTool
  Model->>ContractGateMiddleware: issue gated tool call
  ContractGateMiddleware->>ContractResolver: fetch full contract
  ContractResolver-->>ContractGateMiddleware: return contract or lookup result
  ContractGateMiddleware-->>Model: return contract in tool error
  Model->>ContractGateMiddleware: retry call with marker present
  ContractGateMiddleware->>LateBoundTool: execute tool
  LateBoundTool-->>Model: return tool result

Loading

Possibly related PRs

• tinyhumansai/openhuman#4625: Modifies TinyAgents harness assembly and related middleware inventory tests.

Suggested labels: feature, agent, bug

Suggested reviewers: senamakel, oxoxdev

Poem

A rabbit brings schemas, crisp and bright,
So tools hop forward with insight.
First comes the contract, then calls run,
Markers guide each retry spun.
No guessed slug hides in the hay—
The right tool finds its way!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes address the issue's core needs: contract-first gating, retries, unknown-target handling, and Composio/MCP/workflow coverage.
Out of Scope Changes check	✅ Passed	The diff appears focused on the contract-gating feature and related tests, with no obvious unrelated functional changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the main change: a late-bound tool contract gate that tracks transcript presence across compaction.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6236939f1f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

src/openhuman/tinyagents/contract_gate.rs (1)

174-184: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Avoid bulk allocation of tool message texts.

Collecting m.text() for all tool messages into an intermediate Vec<String> forces a peak memory allocation proportional to the total size of all tool messages in the transcript (which can reach megabytes).

You can avoid this O(N) memory spike by streaming the iterator directly into collect_present_keys using AsRef<str>, evaluating and dropping each message's text one at a time.

♻️ Proposed refactor to stream texts without an intermediate `Vec`

Update refresh_present to remove the .collect():

-    fn refresh_present(&self, messages: &[TaMessage]) {
-        let tool_texts: Vec<String> = messages
-            .iter()
-            .filter(|m| matches!(m, TaMessage::Tool(_)))
-            .map(|m| m.text())
-            .collect();
-        let keys = collect_present_keys(tool_texts.iter().map(String::as_str));
-        if let Ok(mut set) = self.present.lock() {
-            *set = keys;
-        }
-    }
+    fn refresh_present(&self, messages: &[TaMessage]) {
+        let keys = collect_present_keys(
+            messages
+                .iter()
+                .filter(|m| matches!(m, TaMessage::Tool(_)))
+                .map(|m| m.text()),
+        );
+        if let Ok(mut set) = self.present.lock() {
+            *set = keys;
+        }
+    }

Then generalize the helper's signature further down the file so it accepts the owned String iterator:

-fn collect_present_keys<'a>(texts: impl Iterator<Item = &'a str>) -> HashSet<String> {
+fn collect_present_keys(texts: impl Iterator<Item = impl AsRef<str>>) -> HashSet<String> {
     let mut set = HashSet::new();
     for text in texts {
-        if let Some(rest) = text.strip_prefix(MARKER_OPEN) {
+        if let Some(rest) = text.as_ref().strip_prefix(MARKER_OPEN) {
             if let Some(j) = rest.find(']') {
                 set.insert(rest[..j].to_string());
             }
         }
     }
     set
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/openhuman/tinyagents/contract_gate.rs` around lines 174 - 184, Update
refresh_present to pass the filtered tool-message text iterator directly to
collect_present_keys, removing the intermediate Vec<String> allocation.
Generalize collect_present_keys to accept an iterator of items implementing
AsRef<str>, while preserving key collection behavior and allowing each generated
text value to be dropped after processing.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/openhuman/tinyagents/contract_gate.rs`:
- Around line 478-480: Add a verbose, grep-friendly diagnostic log in the
ContractResult::Unavailable arm of the fetch_contract match before delegating to
next.run(ctx, state, call). Include enough context to identify the target and
transient contract-fetch failure, while preserving the existing execution flow.

---

Nitpick comments:
In `@src/openhuman/tinyagents/contract_gate.rs`:
- Around line 174-184: Update refresh_present to pass the filtered tool-message
text iterator directly to collect_present_keys, removing the intermediate
Vec<String> allocation. Generalize collect_present_keys to accept an iterator of
items implementing AsRef<str>, while preserving key collection behavior and
allowing each generated text value to be dropped after processing.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a6d9c2ae-35b5-4406-854f-586e018ae5f7

📥 Commits

Reviewing files that changed from the base of the PR and between 8c37dfd and 6236939.

📒 Files selected for processing (3)

• src/openhuman/tinyagents/contract_gate.rs
• src/openhuman/tinyagents/contract_gate_tests.rs
• src/openhuman/tinyagents/mod.rs

[YellowSnnowmann]

Solid, well-engineered change — the design directly addresses #4853, and deriving contract-presence from a transcript marker (rather than mutable turn state) is genuinely nice: it's correct-by-construction across summarization, microcompact, hard-trim, and durable sub-agent resume, which is strictly better than the "reset seen-state on compaction" the issue asked for. The anti-spoof prefix check and the "all same-batch calls gated" reasoning are right and are tested.

I'm requesting changes on verification gaps, not on the design. Four things I'd want resolved before approving:

1. The core behavior is untested. All 22 tests are pure logic. The network resolvers and — more importantly — the real harness wiring (before_model refreshes presence, then wrap_tool gates, in the actual middleware order from assemble_turn_harness) have no integration coverage. The gated_call_delivers_the_contract_then_the_retry_passes test manually simulates the rescan; it doesn't prove the middleware ordering actually produces that sequence. The top acceptance criterion — "repro gone" — has no automated proof. Please add at least one integration test exercising deliver → retry through assemble_turn_harness.

2. The inventory-count assertions may not run. The updated 16 / 5 counts in tests.rs sit under a comment stating they're "NOT compiled by cargo check --lib … verify/adjust the exact numbers when the test suite actually compiles." Please confirm that block actually executes in CI (link a passing run), or the counts are unverified.

3. UPPER_SNAKE false-positive is a hard-failure mode. looks_like_composio_slug gates on name shape alone. Any non-Composio tool ever named in UPPER_SNAKE_CASE would resolve to Composio(name) → toolkit_from_slug returns None → NotFound → the tool never executes and the model gets a misleading "not a valid Composio action slug" message. This relies on an unenforced lowercase-tool convention. Please add a guard (e.g. check the name against the actual registered Composio action set) or at minimum a comment documenting the invariant.

4. Contracts are delivered as tool errors — confirm they don't trip an error breaker. The NotFound path's own comment references "the repeated-tool-failure breaker." Since Found deliveries are also TaToolResult::error, a turn touching several gated targets emits multiple errors before any retry lands. Please confirm the Found deliveries don't count toward that breaker (or exempt them).

None of these are design objections — CI green + CodeRabbit clean is necessary but doesn't cover any of the above. Happy to re-review once addressed.

[Coding-Dev-Tools]

🤖 Council Merge Gate — APPROVE (merge blocked by branch protection)

The model council review gate returned APPROVE (session council-863d89d8-c7ed-48e2-832d-d7ffc209e3cf), so the change is council-cleared.

However, gh pr merge was rejected by GitHub branch protection: the base branch policy prohibits the merge. This repo requires passing status checks and/or an approving review before merge, and those requirements are not currently satisfied (e.g. failing required CI checks).

Action needed (human): resolve the failing required checks / obtain the required review, then merge. A maintainer with admin rights may also merge explicitly. The PR is left OPEN.

Posted automatically by the council_gate_merge cron job.

[Coding-Dev-Tools]

🤖 Council Merge Gate — APPROVE (merge blocked by branch protection)

The model council review gate returned APPROVE (session council-dacfe23b-b2af-48f2-99c7-111a1c46d19b), so the change is council-cleared.

However, gh pr merge was rejected by GitHub branch protection: the base branch policy prohibits the merge. This repo requires passing status checks and/or an approving review before merge, and those requirements are not currently satisfied (e.g. failing required CI checks).

Action needed (human): resolve the failing required checks / obtain the required review, then merge. A maintainer with admin rights may also merge explicitly. The PR is left OPEN.

Posted automatically by the council_gate_merge cron job.

[M3gA-Mind]

Review notes on #4861 (contract gate for #4853) — non-blocking comment

Reviewed the diff and read contract_gate.rs + contract_gate_tests.rs on the branch. This is a clean, well-documented implementation of exactly the approach #4853 proposed, and it's CI-green (compiles, clippy/fmt pass, Rust Core Coverage passed so the ≥80% diff-coverage AC is met). Sharing findings for the maintainer — not a formal approval/request-changes, just a review.

Does it address the root cause?

Mechanically, yes. The gate short-circuits the first call per late-bound target each turn and hands back the full contract as a tool error, so the retry runs with the real schema in context — the same lever the issue's own diagnostic ("tell it to read the contract first") confirmed works. Verified:

• All three primary surfaces covered: Composio (composio_execute's tool arg and per-action slug-named tools), MCP registry (mcp_registry_tool_call), Workflows (run_workflow).
• Invented-slug symptom handled: an unknown slug like GMAIL_LIST_MESSAGES resolves to NotFound + the valid action list, directly targeting that half of the repro.
• Per-target, not per-turn: each distinct target is gated on its own first use, so a different wrong action in the same turn does not slip through un-gated. Same-batch duplicate calls are also both gated (presence is only rebuilt from the transcript in before_model) — nicely reasoned.
• Compaction reset (AC): presence is derived from [contract-gate:<key>] markers on tool-role messages each before_model, so a contract summarized/microcompacted/trimmed away is re-delivered, and one surviving in a resumed sub-agent's initial_history is not needlessly re-sent. Fail-safe direction (re-deliver rather than wrongly skip). Anti-spoof (tool-role only + marker-at-start) blocks the common echo case.

Gaps / risks worth weighing

1. Efficacy is probabilistic, not guaranteed. The gate surfaces the schema and instructs the model to mind quoting; it does not validate or rewrite the query. Whether the unquoted-Gmail-query repro actually disappears depends on (a) the model reading + complying, and (b) Composio's real published GMAIL_FETCH_EMAILS schema/field-descriptions documenting the quoting requirement. The rendering test uses a synthetic schema ("quote phrases"), not the live contract — so AC1 ("Repro gone") isn't demonstrated. A live Composio Gmail smoke would close that gap.
2. AC "both MCP bridges" only partially met. The config/legacy bridge (mcp_call_tool) is deliberately deferred (registry handle not reachable from the harness). Honest and called out; doesn't affect the Composio repro.
3. Latency: yes — one extra model round-trip per distinct late-bound target on first use each turn. Repeat calls to the same target within a turn are free. Note it also re-delivers even when the model already fetched the schema via the sanctioned discovery meta-tool (composio_list_tools/describe_workflow), since presence keys only on the gate's own marker — so the "well-behaved" path pays the round-trip too. Kill switch (OPENHUMAN_CONTRACT_GATE=0) mitigates.
4. Iteration-cap interaction not discussed. Each gated first-call consumes an agent-loop iteration; a turn using several new late-bound tools burns extra iterations and could hit the max-iterations cap sooner. Might be worth a quick check against tight caps.
5. Minor: looks_like_composio_slug treats any ALL_CAPS_WITH_UNDERSCORE tool name as a Composio slug. Safe today (all openhuman tools are lowercase snake_case), but a latent trap for any future all-caps tool name.

Test quality

Good — 22 pure-logic tests with real assertions: target extraction for every kind (+ missing-arg pass-through), the core deliver→retry transition, same-batch gating, marker presence across resume/compaction/anti-spoof, the Composio/MCP resolvers (found + not-found + valid-list + empty-server), list capping, and contract rendering. One caveat: the async wrap_tool/before_model/fetch_* glue isn't unit-exercised (the decision is tested via decide() + a hand-built body, not by driving wrap_tool) — covered only by live paths, though CI diff-coverage still passed.

Bottom line

Solid engineering and a faithful implementation of the issue's chosen design; merge-worthy on mechanism and quality. It does not, on its own, prove the repro is eliminated — that hinges on a live Gmail run and on Composio's real schema carrying the quoting guidance. Suggest a live smoke of the Gmail search repro before/at merge, and noting the deferred mcp_call_tool bridge + the per-first-use round-trip cost as accepted trade-offs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 69d383f403

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Honor workflow profile allowlists before returning contracts

When an active agent profile scopes workflows, list_workflows, describe_workflow, and RunWorkflowTool all enforce skill_allowlist, but this new lookup goes straight to the global registry. A model that guesses a disallowed workflow_id will receive that workflow's input contract before the real run_workflow tool gets a chance to reject it, leaking metadata that the profile intentionally hides; thread the active allowlist into the gate or let the underlying tool return its scoped error.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve contract bodies through tool-output rewriting

When a fetched contract is large enough to hit the existing after-tool output pipeline, returning it as an ordinary composio_execute/mcp_registry_tool_call/run_workflow error lets payload summarization, TokenJuice compaction, or the 16 KiB result cap rewrite or truncate the schema. Because the gate marker is part of that same body, the next turn can either treat a partial contract as present and execute with an incomplete schema, or lose the marker and repeatedly re-deliver; contract-gate results need an exemption or a marker/body format that survives those stages.

Useful? React with 👍 / 👎.

[yh928]

Heads-up: the red Rust Core Coverage is an unrelated learning::startup test-isolation flake, not this PR

This branch does not touch learning/, channels/, or the email-signature path (empty diff there), so the failure is not introduced here.

Failing test: learning::startup::tests::learning_subscriber_fires_with_no_channel_configured (startup.rs:291, #5003). It asserts a "no channel configured anywhere" precondition, but the learning::startup tests register subscribers into a process-global event bus (init_global + register_learning_subscribers) with no reset between tests. When several run in the same test binary they double-register and the candidate count no longer matches expected.

Order-dependent victim: it fails on learning_subscriber_fires_... in CI here, but on composio::... / register_learning_subscribers_is_idempotent in local full-suite runs — classic shared-global-state pollution where the victim shifts with test order. A re-run reproduced the same CI failure deterministically, so it is not a transient network/infra flake.

Why it only shows on PRs: Rust Core Coverage (like Rust Feature-Gate Smoke) is skipped on main pushes, so main never runs the full coverage suite that exposes it; a rust-core PR is the first place it runs.

This PR's own checks are green:

• Rust Feature-Gate Smoke (gates off) ✅ — the Composio/MCP/workflow fetch+resolve+render paths and their tests are #[cfg]-gated behind flows/skills/mcp (gate degrades to pass-through when a domain is compiled out), and the lane's gated-test allowlist is updated.
• Rust Quality (fmt, clippy) ✅

Happy to send a separate PR adding a global-state reset / serial guard to the learning::startup tests if that's useful — it seemed out of scope for the contract gate, and the pollution spans more than one domain (a learning-only fix would likely just move the victim).

[yh928]

Follow-up (37efade): keep the delivered contract byte-for-byte so the digest presence survives sub-agent handoff cleaning

Validating the gate under a real sub-agent (the integrations agent) surfaced an infinite re-delivery loop: the gate delivered a contract, then re-delivered the same contract on every subsequent turn and never let the tool run.

Root cause. A sub-agent installs HandoffMiddleware, whose after_tool runs apply_handoff → clean_tool_output. That cleaner collapses every run of whitespace to a single space (WS_RE = [ \t\f\v]+ → " "), which flattens the delivered contract's pretty-printed JSON-schema indentation (2/4/6-space nesting → 1 space). That changes the bytes after the [contract-gate:<digest>:<key>] marker, so on the next before_model rescan collect_present_keys re-hashes those bytes and the digest no longer matches the one baked into the marker → the key is never credited → re-deliver, forever. It runs first in the reverse-order after_tool chain, so the existing tool-output-budget guard couldn't protect it.

The chain-of-custody diff (delivered vs. a fresh fetch) made it unambiguous — every schema line differed only by leading whitespace:

--- delivered            +++ fetched
- "properties": {        +  "properties": {
- "max_results": {       +    "max_results": {
- "default": 10,         +      "default": 10,

Fix (openhuman-only, no vendored change). A general trusted_verbatim flag on ToolResult.raw. The gate marks a Found delivery with it, and the two content-rewriting after_tool hooks (HandoffMiddleware, ToolOutputMiddleware) skip a flagged result — so the delivery reaches the transcript byte-for-byte and the digest matches on the retry. NotFound deliveries are not flagged (they carry no digest, and a looping bad slug should still trip the repeated-tool-failure breaker).

Tests: clean_tool_output_collapses_indentation_whitespace (documents the hazard) and trusted_verbatim_flag_round_trips_and_survives_credential_scrubbing.

Verified locally: cargo check --lib (default and --no-default-features --features tokenjuice-treesitter), the gate/middleware/handoff unit suites, openhuman::tinyagents::tests (adapter inventory unchanged), and the gates-off test-compile — all green.

[yh928]

Note on discovery pre-crediting under sub-agent handoff cleaning (re: @M3gA-Mind's latency point #3)

Two related clarifications on the "well-behaved path pays the round-trip" observation and on the trusted_verbatim follow-up (37efade).

1. The discovery pre-credit path already avoids the round-trip in native mode. The full-schema discovery tools — describe_workflow, mcp_registry_list_tools, and composio_list_tools (full-JSON rendering only, never the thin prefer_markdown listing) — prepend a [contract-gate:<digest>:<keys>] marker to their output via prefix_with_present_marker. before_model's collect_present_keys credits those keys, so a model that already read the full contract through the sanctioned discovery tool pays no re-delivery. So the round-trip only remains for the thin-listing path, where the model has not actually seen the full contract and re-delivery is correct by design.

2. That pre-credit is verified by the same digest as the gate's own delivery, i.e. collect_present_keys re-hashes the bytes after the marker and only credits the keys on a match — so it requires the discovery output to reach before_model byte-for-byte.

3. Known limitation (best-effort, not a loop): discovery outputs are not flagged trusted_verbatim, so inside a sub-agent (where HandoffMiddleware runs) clean_tool_output collapses whitespace in the discovery body → the re-hash misses → the keys aren't pre-credited. This is deliberately left as-is and is safe:

• Unlike the gate's own delivery (which, if reformatted, would re-deliver forever — the loop fixed in 37efade by flagging the delivery trusted_verbatim), a broken discovery pre-credit only forgoes the optimization.
• The first real call then re-delivers once, and that delivery is trusted_verbatim, so its bytes survive clean_tool_output, the digest matches on the retry, and the tool runs. No loop, correctness preserved.
• Net: the round-trip is fully avoided in native mode and reduced to at most one extra round-trip per target in sub-agent mode.

Why not just flag discovery outputs trusted_verbatim too? Because that flag also exempts a result from the oversize→extract_from_result stash, and *_list_tools output can be large; keeping the stash for discovery is the better trade-off. A tighter fix (a flag that skips the whitespace-clean but still allows stashing, or a size-gated flag) is noted as follow-up rather than bundled here.