Repair tool rollout contracts

[Aaronontheweb]

Summary

• keep spill files internal and expose only an opaque call id through tool_output_read
• describe load_tool as schema exposure while retaining normal dispatch authorization
• direct agents to load a known exact tool name without a redundant search
• replay the catalog fixture through a real child actor and inspect its model-visible tools
• preserve the reduced 12-tool core footprint

Validation

• Release build: 0 warnings, 0 errors
• focused dispatcher, replay, schema, prompt, and skill tests: 153 passed
• strict OpenSpec: passed
• deterministic eval harness checks: passed
• headers: passed
• Slopwatch: 0 findings
• diff check: passed

Evaluation scope

This PR changes model-visible guidance and spill behavior. The final-head hosted behavioral rerun is still required; only PII-free aggregate evidence will be posted here.

Stack

This is PR 3 of 3. Its base is PR #2045, now refreshed at c19edbde. No merge or auto-merge is enabled.

[Aaronontheweb]

Final-head behavioral eval summary (five hosted trials per case; aggregate only):

• Composed bounded reads: 5/5. Both requested values were recovered through two file_read calls, with no shell fallback.
• Deferred specialty use: 5/5 task completion. Four trials used load_tool → list_reminders directly; one used search_tools → load_tool → list_reminders.
• Opaque spill continuation: 3/5 contract compliance. All five trials recovered the correct value. Three used tool_output_read without rerunning shell; one recomputed with a second shell call, and one paged before rerunning shell.

The initial spill run exposed an eval defect: the model could add a filter that prevented spilling, while the headless harness denied the modified command. The final harness now requires the exact producer command, verifies its structured arguments, and grants that synthetic producer only inside the isolated eval configuration.

Deterministic replay/evidence checks: 190 passed, 2 platform-specific skips, 0 failed. Full solution validation on the final product code: 7,749 passed, 17 expected skips, 0 failed. Strict OpenSpec, headers, diff check, and Slopwatch passed.

No raw transcripts, prompts, endpoints, credentials, host paths, session identifiers, or model/provider details are included here.

[Aaronontheweb]

Focused review of the rollout and eval contracts.

[Aaronontheweb]

This grant applies to every eval case, and awk can execute arbitrary programs. That can mask approval behavior outside the spill scenario. Please prefer the existing deterministic large fixture with a reviewed-safe producer such as cat, or scope this grant to the one case.

[Aaronontheweb]

Important semantic boundary: loading controls schema exposure only. A recalled deferred name may still dispatch, and normal authorization remains authoritative. Please keep the direct-dispatch authorization regression and avoid describing this as an execution grant or lease.

[Aaronontheweb]

This production hunk renames the local value; it does not remove the inline head/tail window. Please keep the PR claim scoped to opaque call-id/path contract alignment rather than implying that no inline spill content is returned.

[Aaronontheweb]

LGTM - mostly tool hints and guidance