Files

T

kami 238d353653 feat(qa): remote NIM provider + headless-QA robustness

Enable autonomous QA through a remote OpenAI-compatible provider (NVIDIA NIM)
and harden the tool/approval path so unattended multi-stage runs complete.

- inference: add openai_compat provider (Bearer chat-completions for NIM/OpenAI),
  dispatched by provider type "nim"/"openai"; key via api_key/api_key_env.
- server: bind configured [server] host/port instead of a hardcoded 8080;
  POST /sessions accepts an optional `intent` (WS parity) for intent-driven workflows.
- kernel: thread the bound operator profile's approval_mode into per-tool gating so
  auto/yolo enable unattended approval (engine still consulted; policy/plane-2 BLOCK
  stays terminal); on a recoverable tool failure feed the tool's arg-schema back into
  context so the model self-corrects instead of repeating a malformed call.
- tools: split deletion out of file_write into a separate, explicitly-named file_delete
  tool — a model can no longer delete a file by getting a write-mode parameter wrong.
- server: add GET /metrics/tool-reliability — per-model tool-call validity from the
  event log (measurement groundwork for capability-aware routing).
- docs: update AGENTS.md across kernel, tools, server, inference.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-29 10:50:16 +00:00

2.3 KiB

Raw Blame History

infrastructure/tools/

Purpose

Tool implementations and execution infrastructure. Provides DefaultToolRegistry, DispatchingToolExecutor, and SandboxedToolExecutor. Implements concrete tools: shell execution (ShellTool), web search (WebSearchTool, requires SearXNG), web fetch + HTML→Markdown extraction (WebFetchTool, jsoup), task management tools, and filesystem tools (in filesystem/).

Ownership

Adapter for core:tools. Depends on core:tools, core:events, core:approvals, core:sessions, core:tasks, core:artifacts, core:artifacts-store. The filesystem/ submodule is a dependency of this module.

Local Contracts

DefaultToolRegistry implements ToolRegistry from core:tools.
SandboxedToolExecutor wraps DispatchingToolExecutor; it enforces approval gates and records all tool side effects as events before returning (invariant #5).
No tool may execute a side effect without emitting an event — silent execution is not allowed.
Web search and web fetch results are environment observations; they must be recorded as events by callers to preserve replay determinism (invariant #9).
ToolConfig is the only configuration surface; pass via InfrastructureModule.createToolExecutor().
buildTools() extension on ToolConfig assembles the full tool list; add new tools there, not in the registry directly.
Filesystem mutation is split by intent: file_write only writes ({path, content}), file_edit edits, and file_delete only deletes ({path}) — deletion is a separately-named capability so a model can never delete by getting a write-mode parameter wrong. file_delete shares file_write's path jail and fileWrite.enabled toggle and carries ToolCapability.FILE_WRITE.

Work Guidance

Standard adapter rules apply (see parent AGENTS.md). Network calls (web tools) use Ktor CIO client with withContext(Dispatchers.IO). Shell tool executes OS processes — never suppress CancellationException in process wait loops.

Verification

./gradlew :infrastructure:tools:test --rerun-tasks
./gradlew :infrastructure:tools:filesystem:test --rerun-tasks

Child DOX Index

filesystem/ — filesystem tools implementing core:tools contracts: FileReadTool, FileWriteTool (write-only), FileDeleteTool, FileEditTool, list; no separate AGENTS.md (sub-leaf, covered by this doc)

2.3 KiB Raw Blame History