Feat/mcp structured tool results by Asaf-prog · Pull Request #135 · extra-org/extra

Asaf-prog · 2026-09-01T21:11:12Z

Summary

Preserve structured MCP tool results throughout Extra's execution pipeline instead of collapsing every successful tool result into plain text.

This builds on #133, which fixed MCP text extraction, and adds a provider-agnostic normalized tool-result model that keeps:

model-facing text;
machine-readable structured data;
bounded artifact metadata.

The structured result now survives hooks, persistence, idempotent replay, and HITL resume without leaking provider-specific LangChain objects into the core runtime.

What changed

Added an immutable normalized tool-result abstraction owned by Extra.
Preserve MCP structuredContent instead of dropping it.
Preserve local structured dict / list tool results where applicable.
Use deterministic canonical JSON for structured-only model-facing fallback.
Keep only text in the model conversation; structured/artifact data is not automatically exposed through ToolMessage.
Added versioned serialization with backwards compatibility for legacy text-only execution records.
Preserve structured results through idempotent replay and HITL resume.
Added atomic claim/wait semantics so concurrent duplicate calls do not execute the same tool side effect more than once.
Keep existing text-based transform_tool_result hooks compatible while preserving structured data.
Added bounded artifact normalization and safer handling of malformed/non-serializable provider values.
Avoid logging raw structured tool results or provider-supplied values.

Runtime flow

Provider / LangChain result
↓
Tool-result normalization
↓
NormalizedToolResult
├── text
├── structured
└── bounded artifact metadata
↓
Hooks
↓
Execution ledger
↓
Replay / HITL resume

text only
↓
Model conversation

Backwards compatibility

Existing local string tools behave as before.
MCP text-only results keep the behavior introduced by fix(engine): extract clean text from MCP tool results instead of stri… #133.
Legacy text-only execution records can still be restored.
Existing text transformation hooks remain supported.

Tests

Added/updated coverage for:

MCP text-only and multi-block results;
MCP structuredContent;
structured-only results;
deterministic JSON fallback;
local structured and string tool results;
malformed/non-serializable provider values;
artifact size and nesting limits;
sequential and concurrent idempotent replay;
terminal execution-state protection;
legacy ledger compatibility;
structured result preservation through hooks;
HITL suspend/resume;
prevention of structured data leaking into logs/callback metadata.

Validation

Ruff format/lint passed.
Mypy passed.
Pytest: 965 passed.
git diff --check passed.

Out of scope

Full multimodal MCP support.
Binary artifact persistence.
Widget rendering for structured/artifact results.
Universal output-schema validation.
Provider-specific model serialization strategies.

Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

AmitAvital1

Requesting changes for correctness and contract issues found in the structured-result execution path; details are inline.

AmitAvital1 · 2026-09-02T17:55:02Z

+ await self._publish_processing_failure(call, "Tool error processing failed")
+ raise
+ result = NormalizedToolResult.text_only(model_text or f"Tool error: {exc}")
+ await self._execution_manager.finish_execution(call.exec_id, status="failed", result=result)


Cancellation while awaiting this write leaves the claim at started: _record_error() is outside the recovery wrapper used by _record_success().
Please shield/finalize it and add a cancellation test; otherwise duplicate callers can wait forever.

AmitAvital1 · 2026-09-02T17:55:02Z

+ try:
+ if isinstance(result, ToolMessage):
+ model_text, content_structured = _tool_message_content(result.content)
+ artifact_structured, artifact = _split_artifact(result.artifact)


This branch relies on the artifact contract introduced by langchain-mcp-adapters 0.2.0, but pyproject.toml still permits 0.1.x.
Could we bump the minimum version? Otherwise valid installations silently lose structuredContent, and older artifact shapes can fail normalization.

AmitAvital1 · 2026-09-02T17:55:02Z

+ object.__setattr__(
+ self,
+ "_structured_json",
+ _canonical_json(structured, field_name="structured result")


structured is canonicalized and later decoded, copied, and persisted with only a depth check; unlike artifact, there is no item or byte budget.
A large MCP response can multiply memory use across normalization, hooks, and replay—please reuse a bounded-JSON policy here.

AmitAvital1 · 2026-09-02T17:55:02Z

 from agent_engine.runtime.tool_models import ToolProviderName
+from agent_engine.runtime.tool_results import PersistedToolResult
+
+ToolExecutionStatus = Literal["started", "succeeded", "failed"]


Could this be a StrEnum, consistent with RunStatus and ApprovalStatus below?
The raw values are repeated in the repository, manager, and invoker; enum members would remove these magic state strings.

Make terminal execution writes cancellation-safe, model execution states with a StrEnum, bound structured JSON payloads, and require the MCP adapter version that provides the structured-content artifact contract. Add regressions for cancellation with duplicate waiters and oversized MCP structured results.

Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog · 2026-09-02T18:19:45Z

Thanks for the detailed review — I addressed all four findings:

Made terminal execution writes cancellation-safe. Failed results are persisted before secondary usage/hook processing, and cancellation waits for the shielded ledger write to finish. Added a regression proving concurrent duplicate callers do not hang or re-execute the provider.
Raised the langchain-mcp-adapters minimum version to >=0.2, matching the structured-content artifact contract used by the normalizer.
Added bounded JSON validation for structured results: depth, total values, string/key bytes, integer size, and final encoded size are limited. Oversized MCP structured results now produce controlled tool errors.
Replaced repeated execution-state strings with the wire-compatible ToolExecutionStatus StrEnum.
Documentation and ADR 0004 were updated accordingly. The full repository gate passes: 969 tests, Ruff, formatting, and mypy

Asaf-prog · 2026-09-01T21:11:12Z

Summary

Preserve structured MCP tool results throughout Extra's execution pipeline instead of collapsing every successful tool result into plain text.

This builds on #133, which fixed MCP text extraction, and adds a provider-agnostic normalized tool-result model that keeps:

model-facing text;
machine-readable structured data;
bounded artifact metadata.

The structured result now survives hooks, persistence, idempotent replay, and HITL resume without leaking provider-specific LangChain objects into the core runtime.

What changed

Added an immutable normalized tool-result abstraction owned by Extra.
Preserve MCP structuredContent instead of dropping it.
Preserve local structured dict / list tool results where applicable.
Use deterministic canonical JSON for structured-only model-facing fallback.
Keep only text in the model conversation; structured/artifact data is not automatically exposed through ToolMessage.
Added versioned serialization with backwards compatibility for legacy text-only execution records.
Preserve structured results through idempotent replay and HITL resume.
Added atomic claim/wait semantics so concurrent duplicate calls do not execute the same tool side effect more than once.
Keep existing text-based transform_tool_result hooks compatible while preserving structured data.
Added bounded artifact normalization and safer handling of malformed/non-serializable provider values.
Avoid logging raw structured tool results or provider-supplied values.

Runtime flow

Provider / LangChain result
↓
Tool-result normalization
↓
NormalizedToolResult
├── text
├── structured
└── bounded artifact metadata
↓
Hooks
↓
Execution ledger
↓
Replay / HITL resume

text only
↓
Model conversation

Backwards compatibility

Existing local string tools behave as before.
MCP text-only results keep the behavior introduced by fix(engine): extract clean text from MCP tool results instead of stri… #133.
Legacy text-only execution records can still be restored.
Existing text transformation hooks remain supported.

Tests

Added/updated coverage for:

MCP text-only and multi-block results;
MCP structuredContent;
structured-only results;
deterministic JSON fallback;
local structured and string tool results;
malformed/non-serializable provider values;
artifact size and nesting limits;
sequential and concurrent idempotent replay;
terminal execution-state protection;
legacy ledger compatibility;
structured result preservation through hooks;
HITL suspend/resume;
prevention of structured data leaking into logs/callback metadata.

Validation

Ruff format/lint passed.
Mypy passed.
Pytest: 965 passed.
git diff --check passed.

Out of scope

Full multimodal MCP support.
Binary artifact persistence.
Widget rendering for structured/artifact results.
Universal output-schema validation.
Provider-specific model serialization strategies.

Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

AmitAvital1

Requesting changes for correctness and contract issues found in the structured-result execution path; details are inline.

AmitAvital1 · 2026-09-02T17:55:02Z

+ await self._publish_processing_failure(call, "Tool error processing failed")
+ raise
+ result = NormalizedToolResult.text_only(model_text or f"Tool error: {exc}")
+ await self._execution_manager.finish_execution(call.exec_id, status="failed", result=result)


Cancellation while awaiting this write leaves the claim at started: _record_error() is outside the recovery wrapper used by _record_success().
Please shield/finalize it and add a cancellation test; otherwise duplicate callers can wait forever.

AmitAvital1 · 2026-09-02T17:55:02Z

+ try:
+ if isinstance(result, ToolMessage):
+ model_text, content_structured = _tool_message_content(result.content)
+ artifact_structured, artifact = _split_artifact(result.artifact)


This branch relies on the artifact contract introduced by langchain-mcp-adapters 0.2.0, but pyproject.toml still permits 0.1.x.
Could we bump the minimum version? Otherwise valid installations silently lose structuredContent, and older artifact shapes can fail normalization.

AmitAvital1 · 2026-09-02T17:55:02Z

+ object.__setattr__(
+ self,
+ "_structured_json",
+ _canonical_json(structured, field_name="structured result")


structured is canonicalized and later decoded, copied, and persisted with only a depth check; unlike artifact, there is no item or byte budget.
A large MCP response can multiply memory use across normalization, hooks, and replay—please reuse a bounded-JSON policy here.

AmitAvital1 · 2026-09-02T17:55:02Z

 from agent_engine.runtime.tool_models import ToolProviderName
+from agent_engine.runtime.tool_results import PersistedToolResult
+
+ToolExecutionStatus = Literal["started", "succeeded", "failed"]


Could this be a StrEnum, consistent with RunStatus and ApprovalStatus below?
The raw values are repeated in the repository, manager, and invoker; enum members would remove these magic state strings.

Make terminal execution writes cancellation-safe, model execution states with a StrEnum, bound structured JSON payloads, and require the MCP adapter version that provides the structured-content artifact contract. Add regressions for cancellation with duplicate waiters and oversized MCP structured results.

Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog · 2026-09-02T18:19:45Z

Thanks for the detailed review — I addressed all four findings:

Made terminal execution writes cancellation-safe. Failed results are persisted before secondary usage/hook processing, and cancellation waits for the shielded ledger write to finish. Added a regression proving concurrent duplicate callers do not hang or re-execute the provider.
Raised the langchain-mcp-adapters minimum version to >=0.2, matching the structured-content artifact contract used by the normalizer.
Added bounded JSON validation for structured results: depth, total values, string/key bytes, integer size, and final encoded size are limited. Oversized MCP structured results now produce controlled tool errors.
Replaced repeated execution-state strings with the wire-compatible ToolExecutionStatus StrEnum.
Documentation and ADR 0004 were updated accordingly. The full repository gate passes: 969 tests, Ruff, formatting, and mypy

Asaf-prog · 2026-09-01T21:11:12Z

Summary

Preserve structured MCP tool results throughout Extra's execution pipeline instead of collapsing every successful tool result into plain text.

This builds on #133, which fixed MCP text extraction, and adds a provider-agnostic normalized tool-result model that keeps:

model-facing text;
machine-readable structured data;
bounded artifact metadata.

The structured result now survives hooks, persistence, idempotent replay, and HITL resume without leaking provider-specific LangChain objects into the core runtime.

What changed

Added an immutable normalized tool-result abstraction owned by Extra.
Preserve MCP structuredContent instead of dropping it.
Preserve local structured dict / list tool results where applicable.
Use deterministic canonical JSON for structured-only model-facing fallback.
Keep only text in the model conversation; structured/artifact data is not automatically exposed through ToolMessage.
Added versioned serialization with backwards compatibility for legacy text-only execution records.
Preserve structured results through idempotent replay and HITL resume.
Added atomic claim/wait semantics so concurrent duplicate calls do not execute the same tool side effect more than once.
Keep existing text-based transform_tool_result hooks compatible while preserving structured data.
Added bounded artifact normalization and safer handling of malformed/non-serializable provider values.
Avoid logging raw structured tool results or provider-supplied values.

Runtime flow

Provider / LangChain result
↓
Tool-result normalization
↓
NormalizedToolResult
├── text
├── structured
└── bounded artifact metadata
↓
Hooks
↓
Execution ledger
↓
Replay / HITL resume

text only
↓
Model conversation

Backwards compatibility

Existing local string tools behave as before.
MCP text-only results keep the behavior introduced by fix(engine): extract clean text from MCP tool results instead of stri… #133.
Legacy text-only execution records can still be restored.
Existing text transformation hooks remain supported.

Tests

Added/updated coverage for:

MCP text-only and multi-block results;
MCP structuredContent;
structured-only results;
deterministic JSON fallback;
local structured and string tool results;
malformed/non-serializable provider values;
artifact size and nesting limits;
sequential and concurrent idempotent replay;
terminal execution-state protection;
legacy ledger compatibility;
structured result preservation through hooks;
HITL suspend/resume;
prevention of structured data leaking into logs/callback metadata.

Validation

Ruff format/lint passed.
Mypy passed.
Pytest: 965 passed.
git diff --check passed.

Out of scope

Full multimodal MCP support.
Binary artifact persistence.
Widget rendering for structured/artifact results.
Universal output-schema validation.
Provider-specific model serialization strategies.

Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

AmitAvital1

Requesting changes for correctness and contract issues found in the structured-result execution path; details are inline.

AmitAvital1 · 2026-09-02T17:55:02Z

+ await self._publish_processing_failure(call, "Tool error processing failed")
+ raise
+ result = NormalizedToolResult.text_only(model_text or f"Tool error: {exc}")
+ await self._execution_manager.finish_execution(call.exec_id, status="failed", result=result)


Cancellation while awaiting this write leaves the claim at started: _record_error() is outside the recovery wrapper used by _record_success().
Please shield/finalize it and add a cancellation test; otherwise duplicate callers can wait forever.

AmitAvital1 · 2026-09-02T17:55:02Z

+ try:
+ if isinstance(result, ToolMessage):
+ model_text, content_structured = _tool_message_content(result.content)
+ artifact_structured, artifact = _split_artifact(result.artifact)


This branch relies on the artifact contract introduced by langchain-mcp-adapters 0.2.0, but pyproject.toml still permits 0.1.x.
Could we bump the minimum version? Otherwise valid installations silently lose structuredContent, and older artifact shapes can fail normalization.

AmitAvital1 · 2026-09-02T17:55:02Z

+ object.__setattr__(
+ self,
+ "_structured_json",
+ _canonical_json(structured, field_name="structured result")


structured is canonicalized and later decoded, copied, and persisted with only a depth check; unlike artifact, there is no item or byte budget.
A large MCP response can multiply memory use across normalization, hooks, and replay—please reuse a bounded-JSON policy here.

AmitAvital1 · 2026-09-02T17:55:02Z

 from agent_engine.runtime.tool_models import ToolProviderName
+from agent_engine.runtime.tool_results import PersistedToolResult
+
+ToolExecutionStatus = Literal["started", "succeeded", "failed"]


Could this be a StrEnum, consistent with RunStatus and ApprovalStatus below?
The raw values are repeated in the repository, manager, and invoker; enum members would remove these magic state strings.

Make terminal execution writes cancellation-safe, model execution states with a StrEnum, bound structured JSON payloads, and require the MCP adapter version that provides the structured-content artifact contract. Add regressions for cancellation with duplicate waiters and oversized MCP structured results.

Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog · 2026-09-02T18:19:45Z

Thanks for the detailed review — I addressed all four findings:

Made terminal execution writes cancellation-safe. Failed results are persisted before secondary usage/hook processing, and cancellation waits for the shielded ledger write to finish. Added a regression proving concurrent duplicate callers do not hang or re-execute the provider.
Raised the langchain-mcp-adapters minimum version to >=0.2, matching the structured-content artifact contract used by the normalizer.
Added bounded JSON validation for structured results: depth, total values, string/key bytes, integer size, and final encoded size are limited. Oversized MCP structured results now produce controlled tool errors.
Replaced repeated execution-state strings with the wire-compatible ToolExecutionStatus StrEnum.
Documentation and ADR 0004 were updated accordingly. The full repository gate passes: 969 tests, Ruff, formatting, and mypy

Asaf-prog · 2026-09-01T21:11:12Z

Summary

Preserve structured MCP tool results throughout Extra's execution pipeline instead of collapsing every successful tool result into plain text.

This builds on #133, which fixed MCP text extraction, and adds a provider-agnostic normalized tool-result model that keeps:

model-facing text;
machine-readable structured data;
bounded artifact metadata.

The structured result now survives hooks, persistence, idempotent replay, and HITL resume without leaking provider-specific LangChain objects into the core runtime.

What changed

Added an immutable normalized tool-result abstraction owned by Extra.
Preserve MCP structuredContent instead of dropping it.
Preserve local structured dict / list tool results where applicable.
Use deterministic canonical JSON for structured-only model-facing fallback.
Keep only text in the model conversation; structured/artifact data is not automatically exposed through ToolMessage.
Added versioned serialization with backwards compatibility for legacy text-only execution records.
Preserve structured results through idempotent replay and HITL resume.
Added atomic claim/wait semantics so concurrent duplicate calls do not execute the same tool side effect more than once.
Keep existing text-based transform_tool_result hooks compatible while preserving structured data.
Added bounded artifact normalization and safer handling of malformed/non-serializable provider values.
Avoid logging raw structured tool results or provider-supplied values.

Runtime flow

Provider / LangChain result
↓
Tool-result normalization
↓
NormalizedToolResult
├── text
├── structured
└── bounded artifact metadata
↓
Hooks
↓
Execution ledger
↓
Replay / HITL resume

text only
↓
Model conversation

Backwards compatibility

Existing local string tools behave as before.
MCP text-only results keep the behavior introduced by fix(engine): extract clean text from MCP tool results instead of stri… #133.
Legacy text-only execution records can still be restored.
Existing text transformation hooks remain supported.

Tests

Added/updated coverage for:

MCP text-only and multi-block results;
MCP structuredContent;
structured-only results;
deterministic JSON fallback;
local structured and string tool results;
malformed/non-serializable provider values;
artifact size and nesting limits;
sequential and concurrent idempotent replay;
terminal execution-state protection;
legacy ledger compatibility;
structured result preservation through hooks;
HITL suspend/resume;
prevention of structured data leaking into logs/callback metadata.

Validation

Ruff format/lint passed.
Mypy passed.
Pytest: 965 passed.
git diff --check passed.

Out of scope

Full multimodal MCP support.
Binary artifact persistence.
Widget rendering for structured/artifact results.
Universal output-schema validation.
Provider-specific model serialization strategies.

Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

AmitAvital1

Requesting changes for correctness and contract issues found in the structured-result execution path; details are inline.

AmitAvital1 · 2026-09-02T17:55:02Z

+ await self._publish_processing_failure(call, "Tool error processing failed")
+ raise
+ result = NormalizedToolResult.text_only(model_text or f"Tool error: {exc}")
+ await self._execution_manager.finish_execution(call.exec_id, status="failed", result=result)


Cancellation while awaiting this write leaves the claim at started: _record_error() is outside the recovery wrapper used by _record_success().
Please shield/finalize it and add a cancellation test; otherwise duplicate callers can wait forever.

AmitAvital1 · 2026-09-02T17:55:02Z

+ try:
+ if isinstance(result, ToolMessage):
+ model_text, content_structured = _tool_message_content(result.content)
+ artifact_structured, artifact = _split_artifact(result.artifact)


This branch relies on the artifact contract introduced by langchain-mcp-adapters 0.2.0, but pyproject.toml still permits 0.1.x.
Could we bump the minimum version? Otherwise valid installations silently lose structuredContent, and older artifact shapes can fail normalization.

AmitAvital1 · 2026-09-02T17:55:02Z

+ object.__setattr__(
+ self,
+ "_structured_json",
+ _canonical_json(structured, field_name="structured result")


structured is canonicalized and later decoded, copied, and persisted with only a depth check; unlike artifact, there is no item or byte budget.
A large MCP response can multiply memory use across normalization, hooks, and replay—please reuse a bounded-JSON policy here.

AmitAvital1 · 2026-09-02T17:55:02Z

 from agent_engine.runtime.tool_models import ToolProviderName
+from agent_engine.runtime.tool_results import PersistedToolResult
+
+ToolExecutionStatus = Literal["started", "succeeded", "failed"]


Could this be a StrEnum, consistent with RunStatus and ApprovalStatus below?
The raw values are repeated in the repository, manager, and invoker; enum members would remove these magic state strings.

Make terminal execution writes cancellation-safe, model execution states with a StrEnum, bound structured JSON payloads, and require the MCP adapter version that provides the structured-content artifact contract. Add regressions for cancellation with duplicate waiters and oversized MCP structured results.

Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog · 2026-09-02T18:19:45Z

Thanks for the detailed review — I addressed all four findings:

Made terminal execution writes cancellation-safe. Failed results are persisted before secondary usage/hook processing, and cancellation waits for the shielded ledger write to finish. Added a regression proving concurrent duplicate callers do not hang or re-execute the provider.
Raised the langchain-mcp-adapters minimum version to >=0.2, matching the structured-content artifact contract used by the normalizer.
Added bounded JSON validation for structured results: depth, total values, string/key bytes, integer size, and final encoded size are limited. Oversized MCP structured results now produce controlled tool errors.
Replaced repeated execution-state strings with the wire-compatible ToolExecutionStatus StrEnum.
Documentation and ADR 0004 were updated accordingly. The full repository gate passes: 969 tests, Ruff, formatting, and mypy

Asaf-prog · 2026-09-01T21:11:12Z

Summary

Preserve structured MCP tool results throughout Extra's execution pipeline instead of collapsing every successful tool result into plain text.

This builds on #133, which fixed MCP text extraction, and adds a provider-agnostic normalized tool-result model that keeps:

model-facing text;
machine-readable structured data;
bounded artifact metadata.

The structured result now survives hooks, persistence, idempotent replay, and HITL resume without leaking provider-specific LangChain objects into the core runtime.

What changed

Added an immutable normalized tool-result abstraction owned by Extra.
Preserve MCP structuredContent instead of dropping it.
Preserve local structured dict / list tool results where applicable.
Use deterministic canonical JSON for structured-only model-facing fallback.
Keep only text in the model conversation; structured/artifact data is not automatically exposed through ToolMessage.
Added versioned serialization with backwards compatibility for legacy text-only execution records.
Preserve structured results through idempotent replay and HITL resume.
Added atomic claim/wait semantics so concurrent duplicate calls do not execute the same tool side effect more than once.
Keep existing text-based transform_tool_result hooks compatible while preserving structured data.
Added bounded artifact normalization and safer handling of malformed/non-serializable provider values.
Avoid logging raw structured tool results or provider-supplied values.

Runtime flow

Provider / LangChain result
↓
Tool-result normalization
↓
NormalizedToolResult
├── text
├── structured
└── bounded artifact metadata
↓
Hooks
↓
Execution ledger
↓
Replay / HITL resume

text only
↓
Model conversation

Backwards compatibility

Existing local string tools behave as before.
MCP text-only results keep the behavior introduced by fix(engine): extract clean text from MCP tool results instead of stri… #133.
Legacy text-only execution records can still be restored.
Existing text transformation hooks remain supported.

Tests

Added/updated coverage for:

MCP text-only and multi-block results;
MCP structuredContent;
structured-only results;
deterministic JSON fallback;
local structured and string tool results;
malformed/non-serializable provider values;
artifact size and nesting limits;
sequential and concurrent idempotent replay;
terminal execution-state protection;
legacy ledger compatibility;
structured result preservation through hooks;
HITL suspend/resume;
prevention of structured data leaking into logs/callback metadata.

Validation

Ruff format/lint passed.
Mypy passed.
Pytest: 965 passed.
git diff --check passed.

Out of scope

Full multimodal MCP support.
Binary artifact persistence.
Widget rendering for structured/artifact results.
Universal output-schema validation.
Provider-specific model serialization strategies.

Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

AmitAvital1

Requesting changes for correctness and contract issues found in the structured-result execution path; details are inline.

AmitAvital1 · 2026-09-02T17:55:02Z

+ await self._publish_processing_failure(call, "Tool error processing failed")
+ raise
+ result = NormalizedToolResult.text_only(model_text or f"Tool error: {exc}")
+ await self._execution_manager.finish_execution(call.exec_id, status="failed", result=result)


Cancellation while awaiting this write leaves the claim at started: _record_error() is outside the recovery wrapper used by _record_success().
Please shield/finalize it and add a cancellation test; otherwise duplicate callers can wait forever.

AmitAvital1 · 2026-09-02T17:55:02Z

+ try:
+ if isinstance(result, ToolMessage):
+ model_text, content_structured = _tool_message_content(result.content)
+ artifact_structured, artifact = _split_artifact(result.artifact)


This branch relies on the artifact contract introduced by langchain-mcp-adapters 0.2.0, but pyproject.toml still permits 0.1.x.
Could we bump the minimum version? Otherwise valid installations silently lose structuredContent, and older artifact shapes can fail normalization.

AmitAvital1 · 2026-09-02T17:55:02Z

+ object.__setattr__(
+ self,
+ "_structured_json",
+ _canonical_json(structured, field_name="structured result")


structured is canonicalized and later decoded, copied, and persisted with only a depth check; unlike artifact, there is no item or byte budget.
A large MCP response can multiply memory use across normalization, hooks, and replay—please reuse a bounded-JSON policy here.

AmitAvital1 · 2026-09-02T17:55:02Z

 from agent_engine.runtime.tool_models import ToolProviderName
+from agent_engine.runtime.tool_results import PersistedToolResult
+
+ToolExecutionStatus = Literal["started", "succeeded", "failed"]


Could this be a StrEnum, consistent with RunStatus and ApprovalStatus below?
The raw values are repeated in the repository, manager, and invoker; enum members would remove these magic state strings.

Make terminal execution writes cancellation-safe, model execution states with a StrEnum, bound structured JSON payloads, and require the MCP adapter version that provides the structured-content artifact contract. Add regressions for cancellation with duplicate waiters and oversized MCP structured results.

Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog · 2026-09-02T18:19:45Z

Thanks for the detailed review — I addressed all four findings:

Made terminal execution writes cancellation-safe. Failed results are persisted before secondary usage/hook processing, and cancellation waits for the shielded ledger write to finish. Added a regression proving concurrent duplicate callers do not hang or re-execute the provider.
Raised the langchain-mcp-adapters minimum version to >=0.2, matching the structured-content artifact contract used by the normalizer.
Added bounded JSON validation for structured results: depth, total values, string/key bytes, integer size, and final encoded size are limited. Oversized MCP structured results now produce controlled tool errors.
Replaced repeated execution-state strings with the wire-compatible ToolExecutionStatus StrEnum.
Documentation and ADR 0004 were updated accordingly. The full repository gate passes: 969 tests, Ruff, formatting, and mypy

Asaf-prog · 2026-09-01T21:11:12Z

Summary

Preserve structured MCP tool results throughout Extra's execution pipeline instead of collapsing every successful tool result into plain text.

This builds on #133, which fixed MCP text extraction, and adds a provider-agnostic normalized tool-result model that keeps:

model-facing text;
machine-readable structured data;
bounded artifact metadata.

The structured result now survives hooks, persistence, idempotent replay, and HITL resume without leaking provider-specific LangChain objects into the core runtime.

What changed

Added an immutable normalized tool-result abstraction owned by Extra.
Preserve MCP structuredContent instead of dropping it.
Preserve local structured dict / list tool results where applicable.
Use deterministic canonical JSON for structured-only model-facing fallback.
Keep only text in the model conversation; structured/artifact data is not automatically exposed through ToolMessage.
Added versioned serialization with backwards compatibility for legacy text-only execution records.
Preserve structured results through idempotent replay and HITL resume.
Added atomic claim/wait semantics so concurrent duplicate calls do not execute the same tool side effect more than once.
Keep existing text-based transform_tool_result hooks compatible while preserving structured data.
Added bounded artifact normalization and safer handling of malformed/non-serializable provider values.
Avoid logging raw structured tool results or provider-supplied values.

Runtime flow

Provider / LangChain result
↓
Tool-result normalization
↓
NormalizedToolResult
├── text
├── structured
└── bounded artifact metadata
↓
Hooks
↓
Execution ledger
↓
Replay / HITL resume

text only
↓
Model conversation

Backwards compatibility

Existing local string tools behave as before.
MCP text-only results keep the behavior introduced by fix(engine): extract clean text from MCP tool results instead of stri… #133.
Legacy text-only execution records can still be restored.
Existing text transformation hooks remain supported.

Tests

Added/updated coverage for:

MCP text-only and multi-block results;
MCP structuredContent;
structured-only results;
deterministic JSON fallback;
local structured and string tool results;
malformed/non-serializable provider values;
artifact size and nesting limits;
sequential and concurrent idempotent replay;
terminal execution-state protection;
legacy ledger compatibility;
structured result preservation through hooks;
HITL suspend/resume;
prevention of structured data leaking into logs/callback metadata.

Validation

Ruff format/lint passed.
Mypy passed.
Pytest: 965 passed.
git diff --check passed.

Out of scope

Full multimodal MCP support.
Binary artifact persistence.
Widget rendering for structured/artifact results.
Universal output-schema validation.
Provider-specific model serialization strategies.

Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

AmitAvital1

Requesting changes for correctness and contract issues found in the structured-result execution path; details are inline.

AmitAvital1 · 2026-09-02T17:55:02Z

+ await self._publish_processing_failure(call, "Tool error processing failed")
+ raise
+ result = NormalizedToolResult.text_only(model_text or f"Tool error: {exc}")
+ await self._execution_manager.finish_execution(call.exec_id, status="failed", result=result)


Cancellation while awaiting this write leaves the claim at started: _record_error() is outside the recovery wrapper used by _record_success().
Please shield/finalize it and add a cancellation test; otherwise duplicate callers can wait forever.

AmitAvital1 · 2026-09-02T17:55:02Z

+ try:
+ if isinstance(result, ToolMessage):
+ model_text, content_structured = _tool_message_content(result.content)
+ artifact_structured, artifact = _split_artifact(result.artifact)


This branch relies on the artifact contract introduced by langchain-mcp-adapters 0.2.0, but pyproject.toml still permits 0.1.x.
Could we bump the minimum version? Otherwise valid installations silently lose structuredContent, and older artifact shapes can fail normalization.

AmitAvital1 · 2026-09-02T17:55:02Z

+ object.__setattr__(
+ self,
+ "_structured_json",
+ _canonical_json(structured, field_name="structured result")


structured is canonicalized and later decoded, copied, and persisted with only a depth check; unlike artifact, there is no item or byte budget.
A large MCP response can multiply memory use across normalization, hooks, and replay—please reuse a bounded-JSON policy here.

AmitAvital1 · 2026-09-02T17:55:02Z

 from agent_engine.runtime.tool_models import ToolProviderName
+from agent_engine.runtime.tool_results import PersistedToolResult
+
+ToolExecutionStatus = Literal["started", "succeeded", "failed"]


Could this be a StrEnum, consistent with RunStatus and ApprovalStatus below?
The raw values are repeated in the repository, manager, and invoker; enum members would remove these magic state strings.

Make terminal execution writes cancellation-safe, model execution states with a StrEnum, bound structured JSON payloads, and require the MCP adapter version that provides the structured-content artifact contract. Add regressions for cancellation with duplicate waiters and oversized MCP structured results.

Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog · 2026-09-02T18:19:45Z

Thanks for the detailed review — I addressed all four findings:

Made terminal execution writes cancellation-safe. Failed results are persisted before secondary usage/hook processing, and cancellation waits for the shielded ledger write to finish. Added a regression proving concurrent duplicate callers do not hang or re-execute the provider.
Raised the langchain-mcp-adapters minimum version to >=0.2, matching the structured-content artifact contract used by the normalizer.
Added bounded JSON validation for structured results: depth, total values, string/key bytes, integer size, and final encoded size are limited. Oversized MCP structured results now produce controlled tool errors.
Replaced repeated execution-state strings with the wire-compatible ToolExecutionStatus StrEnum.
Documentation and ADR 0004 were updated accordingly. The full repository gate passes: 969 tests, Ruff, formatting, and mypy

Asaf-prog · 2026-09-01T21:11:12Z

Summary

Preserve structured MCP tool results throughout Extra's execution pipeline instead of collapsing every successful tool result into plain text.

This builds on #133, which fixed MCP text extraction, and adds a provider-agnostic normalized tool-result model that keeps:

model-facing text;
machine-readable structured data;
bounded artifact metadata.

The structured result now survives hooks, persistence, idempotent replay, and HITL resume without leaking provider-specific LangChain objects into the core runtime.

What changed

Added an immutable normalized tool-result abstraction owned by Extra.
Preserve MCP structuredContent instead of dropping it.
Preserve local structured dict / list tool results where applicable.
Use deterministic canonical JSON for structured-only model-facing fallback.
Keep only text in the model conversation; structured/artifact data is not automatically exposed through ToolMessage.
Added versioned serialization with backwards compatibility for legacy text-only execution records.
Preserve structured results through idempotent replay and HITL resume.
Added atomic claim/wait semantics so concurrent duplicate calls do not execute the same tool side effect more than once.
Keep existing text-based transform_tool_result hooks compatible while preserving structured data.
Added bounded artifact normalization and safer handling of malformed/non-serializable provider values.
Avoid logging raw structured tool results or provider-supplied values.

Runtime flow

Provider / LangChain result
↓
Tool-result normalization
↓
NormalizedToolResult
├── text
├── structured
└── bounded artifact metadata
↓
Hooks
↓
Execution ledger
↓
Replay / HITL resume

text only
↓
Model conversation

Backwards compatibility

Existing local string tools behave as before.
MCP text-only results keep the behavior introduced by fix(engine): extract clean text from MCP tool results instead of stri… #133.
Legacy text-only execution records can still be restored.
Existing text transformation hooks remain supported.

Tests

Added/updated coverage for:

MCP text-only and multi-block results;
MCP structuredContent;
structured-only results;
deterministic JSON fallback;
local structured and string tool results;
malformed/non-serializable provider values;
artifact size and nesting limits;
sequential and concurrent idempotent replay;
terminal execution-state protection;
legacy ledger compatibility;
structured result preservation through hooks;
HITL suspend/resume;
prevention of structured data leaking into logs/callback metadata.

Validation

Ruff format/lint passed.
Mypy passed.
Pytest: 965 passed.
git diff --check passed.

Out of scope

Full multimodal MCP support.
Binary artifact persistence.
Widget rendering for structured/artifact results.
Universal output-schema validation.
Provider-specific model serialization strategies.

Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

AmitAvital1

Requesting changes for correctness and contract issues found in the structured-result execution path; details are inline.

AmitAvital1 · 2026-09-02T17:55:02Z

+ await self._publish_processing_failure(call, "Tool error processing failed")
+ raise
+ result = NormalizedToolResult.text_only(model_text or f"Tool error: {exc}")
+ await self._execution_manager.finish_execution(call.exec_id, status="failed", result=result)


Cancellation while awaiting this write leaves the claim at started: _record_error() is outside the recovery wrapper used by _record_success().
Please shield/finalize it and add a cancellation test; otherwise duplicate callers can wait forever.

AmitAvital1 · 2026-09-02T17:55:02Z

+ try:
+ if isinstance(result, ToolMessage):
+ model_text, content_structured = _tool_message_content(result.content)
+ artifact_structured, artifact = _split_artifact(result.artifact)


This branch relies on the artifact contract introduced by langchain-mcp-adapters 0.2.0, but pyproject.toml still permits 0.1.x.
Could we bump the minimum version? Otherwise valid installations silently lose structuredContent, and older artifact shapes can fail normalization.

AmitAvital1 · 2026-09-02T17:55:02Z

+ object.__setattr__(
+ self,
+ "_structured_json",
+ _canonical_json(structured, field_name="structured result")


structured is canonicalized and later decoded, copied, and persisted with only a depth check; unlike artifact, there is no item or byte budget.
A large MCP response can multiply memory use across normalization, hooks, and replay—please reuse a bounded-JSON policy here.

AmitAvital1 · 2026-09-02T17:55:02Z

 from agent_engine.runtime.tool_models import ToolProviderName
+from agent_engine.runtime.tool_results import PersistedToolResult
+
+ToolExecutionStatus = Literal["started", "succeeded", "failed"]


Could this be a StrEnum, consistent with RunStatus and ApprovalStatus below?
The raw values are repeated in the repository, manager, and invoker; enum members would remove these magic state strings.

Make terminal execution writes cancellation-safe, model execution states with a StrEnum, bound structured JSON payloads, and require the MCP adapter version that provides the structured-content artifact contract. Add regressions for cancellation with duplicate waiters and oversized MCP structured results.

Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog · 2026-09-02T18:19:45Z

Thanks for the detailed review — I addressed all four findings:

Made terminal execution writes cancellation-safe. Failed results are persisted before secondary usage/hook processing, and cancellation waits for the shielded ledger write to finish. Added a regression proving concurrent duplicate callers do not hang or re-execute the provider.
Raised the langchain-mcp-adapters minimum version to >=0.2, matching the structured-content artifact contract used by the normalizer.
Added bounded JSON validation for structured results: depth, total values, string/key bytes, integer size, and final encoded size are limited. Oversized MCP structured results now produce controlled tool errors.
Replaced repeated execution-state strings with the wire-compatible ToolExecutionStatus StrEnum.
Documentation and ADR 0004 were updated accordingly. The full repository gate passes: 969 tests, Ruff, formatting, and mypy

Asaf-prog · 2026-09-01T21:11:12Z

Summary

Preserve structured MCP tool results throughout Extra's execution pipeline instead of collapsing every successful tool result into plain text.

This builds on #133, which fixed MCP text extraction, and adds a provider-agnostic normalized tool-result model that keeps:

model-facing text;
machine-readable structured data;
bounded artifact metadata.

The structured result now survives hooks, persistence, idempotent replay, and HITL resume without leaking provider-specific LangChain objects into the core runtime.

What changed

Added an immutable normalized tool-result abstraction owned by Extra.
Preserve MCP structuredContent instead of dropping it.
Preserve local structured dict / list tool results where applicable.
Use deterministic canonical JSON for structured-only model-facing fallback.
Keep only text in the model conversation; structured/artifact data is not automatically exposed through ToolMessage.
Added versioned serialization with backwards compatibility for legacy text-only execution records.
Preserve structured results through idempotent replay and HITL resume.
Added atomic claim/wait semantics so concurrent duplicate calls do not execute the same tool side effect more than once.
Keep existing text-based transform_tool_result hooks compatible while preserving structured data.
Added bounded artifact normalization and safer handling of malformed/non-serializable provider values.
Avoid logging raw structured tool results or provider-supplied values.

Runtime flow

Provider / LangChain result
↓
Tool-result normalization
↓
NormalizedToolResult
├── text
├── structured
└── bounded artifact metadata
↓
Hooks
↓
Execution ledger
↓
Replay / HITL resume

text only
↓
Model conversation

Backwards compatibility

Existing local string tools behave as before.
MCP text-only results keep the behavior introduced by fix(engine): extract clean text from MCP tool results instead of stri… #133.
Legacy text-only execution records can still be restored.
Existing text transformation hooks remain supported.

Tests

Added/updated coverage for:

MCP text-only and multi-block results;
MCP structuredContent;
structured-only results;
deterministic JSON fallback;
local structured and string tool results;
malformed/non-serializable provider values;
artifact size and nesting limits;
sequential and concurrent idempotent replay;
terminal execution-state protection;
legacy ledger compatibility;
structured result preservation through hooks;
HITL suspend/resume;
prevention of structured data leaking into logs/callback metadata.

Validation

Ruff format/lint passed.
Mypy passed.
Pytest: 965 passed.
git diff --check passed.

Out of scope

Full multimodal MCP support.
Binary artifact persistence.
Widget rendering for structured/artifact results.
Universal output-schema validation.
Provider-specific model serialization strategies.

Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

AmitAvital1

Requesting changes for correctness and contract issues found in the structured-result execution path; details are inline.

AmitAvital1 · 2026-09-02T17:55:02Z

+ await self._publish_processing_failure(call, "Tool error processing failed")
+ raise
+ result = NormalizedToolResult.text_only(model_text or f"Tool error: {exc}")
+ await self._execution_manager.finish_execution(call.exec_id, status="failed", result=result)


Cancellation while awaiting this write leaves the claim at started: _record_error() is outside the recovery wrapper used by _record_success().
Please shield/finalize it and add a cancellation test; otherwise duplicate callers can wait forever.

AmitAvital1 · 2026-09-02T17:55:02Z

+ try:
+ if isinstance(result, ToolMessage):
+ model_text, content_structured = _tool_message_content(result.content)
+ artifact_structured, artifact = _split_artifact(result.artifact)


This branch relies on the artifact contract introduced by langchain-mcp-adapters 0.2.0, but pyproject.toml still permits 0.1.x.
Could we bump the minimum version? Otherwise valid installations silently lose structuredContent, and older artifact shapes can fail normalization.

AmitAvital1 · 2026-09-02T17:55:02Z

+ object.__setattr__(
+ self,
+ "_structured_json",
+ _canonical_json(structured, field_name="structured result")


structured is canonicalized and later decoded, copied, and persisted with only a depth check; unlike artifact, there is no item or byte budget.
A large MCP response can multiply memory use across normalization, hooks, and replay—please reuse a bounded-JSON policy here.

AmitAvital1 · 2026-09-02T17:55:02Z

 from agent_engine.runtime.tool_models import ToolProviderName
+from agent_engine.runtime.tool_results import PersistedToolResult
+
+ToolExecutionStatus = Literal["started", "succeeded", "failed"]


Could this be a StrEnum, consistent with RunStatus and ApprovalStatus below?
The raw values are repeated in the repository, manager, and invoker; enum members would remove these magic state strings.

Make terminal execution writes cancellation-safe, model execution states with a StrEnum, bound structured JSON payloads, and require the MCP adapter version that provides the structured-content artifact contract. Add regressions for cancellation with duplicate waiters and oversized MCP structured results.

Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog · 2026-09-02T18:19:45Z

Thanks for the detailed review — I addressed all four findings:

Made terminal execution writes cancellation-safe. Failed results are persisted before secondary usage/hook processing, and cancellation waits for the shielded ledger write to finish. Added a regression proving concurrent duplicate callers do not hang or re-execute the provider.
Raised the langchain-mcp-adapters minimum version to >=0.2, matching the structured-content artifact contract used by the normalizer.
Added bounded JSON validation for structured results: depth, total values, string/key bytes, integer size, and final encoded size are limited. Oversized MCP structured results now produce controlled tool errors.
Replaced repeated execution-state strings with the wire-compatible ToolExecutionStatus StrEnum.
Documentation and ADR 0004 were updated accordingly. The full repository gate passes: 969 tests, Ruff, formatting, and mypy

Asaf-prog added 3 commits September 2, 2026 00:05

feat(runtime): persist normalized tool execution results
e1d0427
Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

feat(engine): preserve structured tool results
dfedaac
Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

docs(runtime): define structured tool result contract
6206ec1
Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

Asaf-prog requested a review from AmitAvital1 September 1, 2026 21:11

Asaf-prog self-assigned this Sep 1, 2026

AmitAvital1 requested changes Sep 2, 2026
View reviewed changes

Asaf-prog added 2 commits September 2, 2026 21:15

docs(runtime): document review-driven result safeguards
91f90c3
Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog added 3 commits September 2, 2026 00:05

feat(runtime): persist normalized tool execution results
e1d0427
Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

feat(engine): preserve structured tool results
dfedaac
Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

docs(runtime): define structured tool result contract
6206ec1
Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

Asaf-prog requested a review from AmitAvital1 September 1, 2026 21:11

Asaf-prog self-assigned this Sep 1, 2026

AmitAvital1 requested changes Sep 2, 2026
View reviewed changes

Asaf-prog added 2 commits September 2, 2026 21:15

docs(runtime): document review-driven result safeguards
91f90c3
Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog added 3 commits September 2, 2026 00:05

feat(runtime): persist normalized tool execution results
e1d0427
Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

feat(engine): preserve structured tool results
dfedaac
Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

docs(runtime): define structured tool result contract
6206ec1
Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

Asaf-prog requested a review from AmitAvital1 September 1, 2026 21:11

Asaf-prog self-assigned this Sep 1, 2026

AmitAvital1 requested changes Sep 2, 2026
View reviewed changes

Asaf-prog added 2 commits September 2, 2026 21:15

docs(runtime): document review-driven result safeguards
91f90c3
Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog added 3 commits September 2, 2026 00:05

feat(runtime): persist normalized tool execution results
e1d0427
Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

feat(engine): preserve structured tool results
dfedaac
Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

docs(runtime): define structured tool result contract
6206ec1
Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

Asaf-prog requested a review from AmitAvital1 September 1, 2026 21:11

Asaf-prog self-assigned this Sep 1, 2026

AmitAvital1 requested changes Sep 2, 2026
View reviewed changes

Asaf-prog added 2 commits September 2, 2026 21:15

docs(runtime): document review-driven result safeguards
91f90c3
Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog added 3 commits September 2, 2026 00:05

feat(runtime): persist normalized tool execution results
e1d0427
Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

feat(engine): preserve structured tool results
dfedaac
Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

docs(runtime): define structured tool result contract
6206ec1
Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

Asaf-prog requested a review from AmitAvital1 September 1, 2026 21:11

Asaf-prog self-assigned this Sep 1, 2026

AmitAvital1 requested changes Sep 2, 2026
View reviewed changes

Asaf-prog added 2 commits September 2, 2026 21:15

docs(runtime): document review-driven result safeguards
91f90c3
Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog added 3 commits September 2, 2026 00:05

feat(runtime): persist normalized tool execution results
e1d0427
Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

feat(engine): preserve structured tool results
dfedaac
Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

docs(runtime): define structured tool result contract
6206ec1
Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

Asaf-prog requested a review from AmitAvital1 September 1, 2026 21:11

Asaf-prog self-assigned this Sep 1, 2026

AmitAvital1 requested changes Sep 2, 2026
View reviewed changes

Asaf-prog added 2 commits September 2, 2026 21:15

docs(runtime): document review-driven result safeguards
91f90c3
Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog added 3 commits September 2, 2026 00:05

feat(runtime): persist normalized tool execution results
e1d0427
Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

feat(engine): preserve structured tool results
dfedaac
Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

docs(runtime): define structured tool result contract
6206ec1
Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

Asaf-prog requested a review from AmitAvital1 September 1, 2026 21:11

Asaf-prog self-assigned this Sep 1, 2026

AmitAvital1 requested changes Sep 2, 2026
View reviewed changes

Asaf-prog added 2 commits September 2, 2026 21:15

docs(runtime): document review-driven result safeguards
91f90c3
Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Asaf-prog added 3 commits September 2, 2026 00:05

feat(runtime): persist normalized tool execution results
e1d0427
Add an immutable, versioned tool-result contract and make execution claims safe for concurrent replay. Preserve legacy text records while preventing terminal ledger overwrites.

feat(engine): preserve structured tool results
dfedaac
Normalize MCP and local tool outputs once at the provider boundary, expose structured values to trusted hooks, and keep model messages and logs text-only. Cover structured-only, malformed, replay, concurrency, and HITL behavior.

docs(runtime): define structured tool result contract
6206ec1
Document normalization ownership, model visibility, artifact bounds, hook compatibility, and concurrency-safe persisted replay in ADR 0004 and runtime guides.

Asaf-prog requested a review from AmitAvital1 September 1, 2026 21:11

Asaf-prog self-assigned this Sep 1, 2026

AmitAvital1 requested changes Sep 2, 2026
View reviewed changes

Asaf-prog added 2 commits September 2, 2026 21:15

docs(runtime): document review-driven result safeguards
91f90c3
Record the structured JSON budgets, execution status enum, cancellation-safe ledger expectations, and langchain-mcp-adapters 0.2 minimum.

Uh oh!

Conversation

Asaf-prog commented Sep 1, 2026

Summary

What changed

Runtime flow

Backwards compatibility

Tests

Validation

Out of scope

Uh oh!

AmitAvital1 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Asaf-prog commented Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Asaf-prog commented Sep 1, 2026

Summary

What changed

Runtime flow

Backwards compatibility

Tests

Validation

Out of scope

Uh oh!

AmitAvital1 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Asaf-prog commented Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Asaf-prog commented Sep 1, 2026

Summary

What changed

Runtime flow

Backwards compatibility

Tests

Validation

Out of scope

Uh oh!

AmitAvital1 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!