refactor(tools): compose session execution pipeline

IMPLEMENTATION_PLAN.md

@@ -125,7 +125,7 @@ working state with gated asynchronous Git enrichment.
 
 Done when:
 
-- [ ] Stage 1 lands required run scopes, per-call isolation, and non-null
+- [x] Stage 1 lands required run scopes, per-call isolation, and non-null
   security/authority dependencies without compatibility shims.
 - [ ] Stage 2 lands the composed pipeline without changing existing background,
   fallback, authorization, approval, MCP, or model-visible behavior.

docs/spec/SPEC-002-session-lifecycle-and-protocol.md

@@ -41,6 +41,21 @@ This enables:
 5. Actor emits typed `SessionOutput` events to subscribers.
 6. Actor checks compaction threshold.
 
+### Tool Execution Pipeline
+
+Tool-enabled sessions compose one `SessionToolExecutionPipeline` from required
+execution, audit, time, and logging services. Each admitted tool-call response
+is submitted as one `SessionToolBatch`; the batch derives its immutable tool
+authority from the admitted `TurnContext` and carries environment and
+per-batch capabilities separately. Callers cannot supply a second authority
+object that disagrees with the admitted turn.
+
+The pipeline executes calls concurrently with fresh invocation state per call.
+Unavailable background-job infrastructure is an explicit capability state and
+retains synchronous execution behavior. This internal composition does not
+change MCP schemas, persisted actor messages, approval outcomes, or model-facing
+tool results.
+
 ## Subscriber Model
 
 Subscribers join via `JoinSession` with an `OutputFilter` bitmask controlling

openspec/changes/simplify-tool-execution-context/specs/netclaw-session/spec.md

@@ -0,0 +1,51 @@
+## MODIFIED Requirements
+
+### Requirement: Tool execution encapsulation
+
+Tool execution SHALL be encapsulated in a composed `SessionToolExecutionPipeline`
+whose unconditional production services are required constructor dependencies.
+The session actor SHALL submit one cohesive batch command whose tool authority is
+derived from the admitted `TurnContext`; callers SHALL NOT be able to supply a
+second, conflicting authority source. Genuinely unavailable runtime capabilities,
+including background-job dispatch, SHALL be represented explicitly while retaining
+their existing behavior. The pipeline SHALL execute tool calls in parallel, track
+sub-agent activity, and send completion or failure messages back to the actor.
+
+The pipeline SHALL NOT itself bound or clamp tool-result size. Bounding to the
+inline budget and spilling overflow remains centralized in
+`DispatchingToolExecutor`, so the pipeline stores the result already bounded by
+the dispatcher. `SessionTuning.MaxInlineToolResultChars` remains the session
+content budget used for tools without a smaller per-tool override.
+
+#### Scenario: Parallel tool execution
+
+- **GIVEN** an admitted turn whose LLM response contains three tool calls
+- **WHEN** the session submits its `SessionToolBatch`
+- **THEN** all three tool calls execute in parallel with fresh call-local state
+- **AND** results are collected and returned through the existing actor protocol
+
+#### Scenario: Conflicting authority cannot be supplied
+
+- **GIVEN** a session constructs a tool batch from an admitted `TurnContext`
+- **WHEN** the batch derives its tool run scope
+- **THEN** session, audience, boundary, channel, delivery, and interactive-approval authority come from that turn context
+- **AND** the caller has no initializer or alternate constructor for replacing the derived authority
+
+#### Scenario: Background manager is unavailable
+
+- **GIVEN** a valid background-capable shell request and no registered background-job manager
+- **WHEN** the batch executes
+- **THEN** the request executes synchronously as it did before the composition refactor
+- **AND** manager absence is not inferred from a nullable security dependency
+
+#### Scenario: Tool execution timeout
+
+- **GIVEN** tool execution is in progress
+- **WHEN** the configured `ToolExecutionTimeout` elapses
+- **THEN** the pipeline sends `ToolExecutionFailed` with a `TimeoutException`
+
+#### Scenario: Oversized result already bounded by the dispatcher
+
+- **GIVEN** a tool returns an oversized result
+- **WHEN** it reaches the pipeline
+- **THEN** the pipeline stores it as-is without re-clamping

openspec/changes/simplify-tool-execution-context/tasks.md

@@ -6,15 +6,15 @@
 - [x] 1.4 Split mutable tool outputs into a per-invocation append-only sink and approval retry/match state into a pipeline-owned attempt object while sharing only immutable run authority across a batch.
 - [x] 1.5 Add focused tests proving invalid scope values fail before dispatch, missing authority has no dispatch path, and parallel calls cannot observe each other's mutable state.
 - [x] 1.6 Update affected engineering documentation; review the mapped `netclaw-operations` system skill and leave it unchanged because the internal refactor must not alter model-visible guidance.
-- [ ] 1.7 Run targeted tests, tool-related evals/full eval suite as required, `dotnet test`, Slopwatch, file-header verification, and `git diff --check`; open and babysit Stage 1 through review, CI, merge, and post-merge `dev` verification.
+- [x] 1.7 Run targeted tests, tool-related evals/full eval suite as required, `dotnet test`, Slopwatch, file-header verification, and `git diff --check`; open and babysit Stage 1 through review, CI, merge, and post-merge `dev` verification.
 
 ## 2. Stage 2 — Composed Session Pipeline
 
-- [ ] 2.1 Replace the broad session tool-call parameter list with a cohesive batch command and a composed `SessionToolExecutionPipeline` whose production dependencies are required.
-- [ ] 2.2 Trace each nullable pipeline service through every intended production composition path; make proven-unconditional services required, model genuinely production-reachable absence explicitly with unchanged behavior, and keep test-only fixture states out of the production API.
-- [ ] 2.3 Preserve existing `_background` behavior for shell, non-shell, missing-manager, and dispatch-failure paths while removing redundant parameter plumbing.
-- [ ] 2.4 Add characterization tests for audit/logging/approval/background infrastructure, malformed metadata, ACL and approval denial, supported background routing, missing-manager fallback, dispatch failure, and non-shell fallback.
-- [ ] 2.5 Verify MCP request/response schemas and persisted actor contracts remain compatible; update affected engineering docs, specs, and the versioned `netclaw-operations` system skill.
+- [x] 2.1 Replace the broad session tool-call parameter list with a cohesive batch command and a composed `SessionToolExecutionPipeline` whose production dependencies are required.
+- [x] 2.2 Trace each nullable pipeline service through every intended production composition path; make proven-unconditional services required, model genuinely production-reachable absence explicitly with unchanged behavior, and keep test-only fixture states out of the production API.
+- [x] 2.3 Preserve existing `_background` behavior for shell, non-shell, missing-manager, and dispatch-failure paths while removing redundant parameter plumbing.
+- [x] 2.4 Add characterization tests for audit/logging/approval/background infrastructure, malformed metadata, ACL and approval denial, supported background routing, missing-manager fallback, dispatch failure, and non-shell fallback.
+- [x] 2.5 Verify MCP request/response schemas and persisted actor contracts remain compatible; update affected engineering docs and specs, and review the versioned `netclaw-operations` system skill without changing model-visible guidance for an internal behavior-preserving refactor.
 - [ ] 2.6 Run targeted tests, the tool-definition eval suite, `dotnet test`, Slopwatch, file-header verification, and `git diff --check`; open and babysit Stage 2 through review, CI, merge, and post-merge `dev` verification.
 
 ## 3. Stage 3 — Child Context and Async Git

src/Netclaw.Actors.Tests/Sessions/LlmSessionTestExtensions.cs

@@ -42,9 +42,10 @@ public static IServiceCollection AddLlmSessionCompositeRecords(this IServiceColl
 
         if (services.Any(d => d.ServiceType == typeof(IToolExecutor)))
         {
+            services.TryAddSingleton<IToolAuditLogger>(NullToolAuditLogger.Instance);
             services.TryAddSingleton(sp => new SessionToolServices(
                 sp.GetRequiredService<IToolExecutor>(),
-                sp.GetService<IToolAuditLogger>(),
+                sp.GetRequiredService<IToolAuditLogger>(),
                 sp.GetRequiredService<ToolRegistry>(),
                 sp.GetService<ToolAccessPolicy>(),
                 sp.GetService<TrustContextDeriver>(),