[bloodf]

Summary

• What changed: Validate completed nested tool_call payloads.
• Why it changed: Port fix(kiro): validate completed nested tool_call payloads decolua/9router#2681 from the docs(campaigns): re-verify the 43 open-PR correctness rows against current main #508 reverification shortlist into DurinDoor.

Type

port(upstream) — the PR template has no port: checkbox. Conventional type is port, scope upstream.

• feat:
• fix:
• refactor:
• docs:
• ci:
• chore:

Scope

Upstream #2681: validate completed nested tool_call payloads.
Head port/upstream-2681-kiro-toolcall-validate @ d6e67121c5a778660768d89772a473662565cbd0. Base main.
Independent branch off main.
Dirty primary checkout untouched.

Production files:

• open-sse/config/kiroConstants.js
• open-sse/executors/kiro.js
• open-sse/translator/schema/blocks.js
• open-sse/utils/stream.js

Test coverage

Focused specs:

• tests/unit/kiro-toolcall-wrapper.test.js

SHA-pinned local gate (lint, check:docs, check:registry-index, test:ci, build, commitlint). tests/__baseline__/known-fails.txt unchanged. Revert-proofed: focused specs went red after swapping production files back to the parent, then green after restore.

Doc coverage

Inline JSDoc / module-header comments at the port site: open-sse/config/kiroConstants.js, open-sse/executors/kiro.js, open-sse/translator/schema/blocks.js, open-sse/utils/stream.js.

Baseline impact

None.

Wire-format / migration concerns

None beyond this upstream change. Existing stored API keys, ~/.9router/, and X-Msh-Platform: 9router remain accepted.

Breaking changes

• No
• Yes — describe below:

Testing

• What was tested: the focused specs above plus one Node 20 full test:ci at d6e67121c5a778660768d89772a473662565cbd0.
• Commands run: /tmp/gate-branch-v2.sh port/upstream-2681-kiro-toolcall-validate d6e67121c5a778660768d89772a473662565cbd0; npx commitlint --from=origin/main --to=d6e67121c5a778660768d89772a473662565cbd0.
• Evidence: GATE_PASS port/upstream-2681-kiro-toolcall-validate d6e6712

Checklist

• Tests added or updated for behavioral changes
• No new dependencies without explicit justification
• Conventional commit used (port(upstream):)
• CHANGELOG updated if this change is user-facing
• No secrets, keys, credentials, or tokens committed