kairos-chain 3.50.0 → 3.52.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 826aabda2632b42bb5e4c688f443616faf29b9b97daba55aa02fa6834bf1629d
-  data.tar.gz: 2a743cfa76eb0d56db2220ed40c11ea0cc52f88c9b16ed8dfb84855d54b15981
+  metadata.gz: 33bc325db559dbb4c9bfbd94ea25fb3ebd783edee32cf6cf4fe4a357b0d58bf1
+  data.tar.gz: 538dc94bc2eb732cce8233161cff7e972d17bf62894bf88ffc9847fb680f1de8
 SHA512:
-  metadata.gz: 0e0ab6e95d0f527e738053fe45e9899e761820809c0f26ab37dd55eacadf13b387b22737475a8685b894d095aa9ba4529df142ab3809adf917c2ff275b46f403
-  data.tar.gz: 1272d3d2ffd8cc80615dc1990346758982cb64cb78d947965d754d3ae5d0e148524044c8197efbb836e0ecf067cfcae69f51aa90a934a71da691525c0b190da2
+  metadata.gz: 916eedc6aaa54819797ee50ca77039a77516cf85c821c71c22e410882d654e06c2f4fcc778bb92fb38631046c7d3bec02c2fee17127fe11a9a4e9a31150d525a
+  data.tar.gz: 1bfe55dad79465dc24e9d3d29556d0f6bed30d39675974b1d5833152235206fda25b31b82129a7d5e9754f33feedcbe1d7e8d455b873dabbc52f8f3c3b02a2f8

data/CHANGELOG.md

@@ -4,6 +4,81 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.51.3] - 2026-07-23
+
+### Multi-LLM Review — knowledge template sync (v3.6.1)
+
+Completes the 3.51.2 roster update: `templates/knowledge/multi_llm_review_workflow/`
+is synced to v3.6.1 (gpt-5.6-sol roster). 3.51.2 updated the skillset config
+template only, so `kairos-chain upgrade` reported a knowledge conflict against
+instances already carrying the v3.6.1 L1 locally. No code change.
+
+## [3.51.2] - 2026-07-23
+
+### Multi-LLM Review — Codex roster update (gpt-5.6-sol)
+
+Template config only, no code change. In
+`templates/skillsets/multi_llm_review/config/multi_llm_review.yml`, the Codex
+reviewer `gpt-5.4` is retired and replaced by `gpt-5.6-sol`
+(`role_label: codex_gpt5.6-sol`). `gpt-5.5` stays as the calibrated anchor
+for cross-generation comparison. 5.6-sol's reviewer bias profile is not yet
+calibrated — record (a)/(b)/(c) breakdowns per round until a profile
+accumulates. Roster size (6) and convergence rules are unchanged. The
+matching L1 knowledge `multi_llm_review_workflow` was updated to v3.6.1
+(instance-local, chain-recorded).
+
+## [3.51.1] - 2026-07-23
+
+### CLI — `skillset upgrade` transparency log
+
+`kairos-chain skillset upgrade` (both check and `--apply`) now prints a
+structured report mirroring `kairos-chain upgrade --apply`, so a no-op run is
+visibly a completed check rather than a bare `All SkillSets are up to date.`
+one-liner. Every CHECKED SkillSet (an installed one with a gem-template
+counterpart) is listed with its status, followed by a summary:
+
+- `[UPGRADE]` / `[UPGRADED]` — version/files changed (changed files listed on
+  check), and, on `--apply`, `vFROM -> vTO (N files)`.
+- `[UNCHANGED]` — checked, no difference (the case that was previously invisible).
+- `[NEW-CORE]` — a core SkillSet not yet installed, installed on `--apply`.
+- `[OPTIONAL]` — a non-core new SkillSet, never auto-installed (explicit approval).
+- `## Summary` — counts of upgraded/installed, unchanged, and optional.
+
+Display-only: the upgrade decision (`upgrade_check` / `upgrade_apply`) is
+unchanged; `core_only: true` behavior for the plain CLI form is preserved.
+
+## [3.51.0] - 2026-07-23
+
+### Agent SkillSet — interruption resilience A-1 + A-2
+
+Addresses the failure mode where the orchestrator's API stalling leaves an
+auto-mode agent loop waiting on input: the running MCP server is intact, but
+the driver stops, and auto-permission is orthogonal to driver liveness.
+Design v0.3.1 FROZEN (design-by-invariant, multi-LLM review 3R converged).
+
+- **A-1 — AdvanceGate** (`lib/agent/advance_gate.rb`): every state-advancing
+  `agent_step` call passes through a per-session serialized, atomic, anchored
+  gate. INV-A2 (serialized atomic advance via `advance.lock` + tmp-rename
+  commit), INV-A3 (anchored at-most-once with a `seq:state:cycle` anchor,
+  committed outcomes replay on retry, side-effect intent bracket with
+  no-silent-drop), INV-A4 (`next_move` derivable from persisted state),
+  INV-A5 (adjudication as a gated judgment). `adjudicate` action added.
+  Impl review 4R converged, 49 probes.
+- **A-2 — delegated step executor** (`lib/agent/step_delegation.rb`,
+  `bin/agent_step_worker.rb`): INV-A1 driver independence. `agent_step` with
+  `execution: "delegated"` returns a resumable handle while a detached
+  (setsid) worker re-enters the SAME gated `agent_step` under server-side
+  ownership — delegate → wait → collect, transplanted from the review
+  SkillSet. All correctness inherited from the A-1 gate; the delegation layer
+  is coordination/observability only. New `agent_wait` tool; `agent_status`
+  surfaces the handle. Impl review 6R converged, 81 probes total.
+- Attended real-worker run with a live LLM-bearing step validated
+  (2026-07-23, isolated harness): the detached worker bootstrapped the full
+  ToolRegistry and ran ORIENT+DECIDE via the claude CLI; liveness, collect,
+  and collector-owned teardown all held.
+- Native body path unchanged (selectable-off). All prior agent-suite tests
+  remain at the main baseline.
+
 ## [3.50.0] - 2026-07-23
 
 ### Chain Distillation SkillSet — slice 1 (CD-1..CD-6)

data/bin/kairos-chain

@@ -141,18 +141,43 @@ when 'skillset'
     manual = upgrades.select { |u| u[:new_skillset] && !KairosMcp::SkillSetManager::CORE_SKILLSETS.include?(u[:name]) }
     applicable = upgrades - manual
 
-    if upgrades.empty?
-      puts "All SkillSets are up to date."
-    elsif apply
+    # Diagnostic transparency: report the full set of CHECKED SkillSets — not
+    # only the ones that changed — so a no-op run is visibly a completed check
+    # rather than a bare one-liner, mirroring `kairos-chain upgrade --apply`.
+    # This is display-only; the upgrade decision itself (upgrade_check /
+    # upgrade_apply) is unchanged. "Checked" = an installed SkillSet that has a
+    # gem-template counterpart (exactly what upgrade_check compares).
+    templates_dir = File.join(KairosMcp.gem_root, 'templates', 'skillsets')
+    checkable = manager.all_skillsets
+                       .select { |ss| File.directory?(File.join(templates_dir, ss.name)) }
+                       .sort_by(&:name)
+    existing_upgrade_names = applicable.reject { |u| u[:new_skillset] }.map { |u| u[:name] }
+    new_core = applicable.select { |u| u[:new_skillset] }
+
+    if apply
       results = manager.upgrade_apply(core_only: true)
+      upgraded_names = results.map { |r| r[:name] }
+      puts "# Applying SkillSet Upgrade"
+      puts ""
+      puts "## SkillSets"
       results.each do |r|
-        puts "Updated #{r[:name]}: v#{r[:from]} -> v#{r[:to]} (#{r[:files_updated]} files)"
+        puts "  [UPGRADED]  #{r[:name].ljust(22)} v#{r[:from]} -> v#{r[:to]} (#{r[:files_updated]} files)"
+      end
+      checkable.reject { |ss| upgraded_names.include?(ss.name) }.each do |ss|
+        puts "  [UNCHANGED] #{ss.name.ljust(22)} v#{ss.version}"
       end
-      puts "Done. #{results.size} SkillSet(s) upgraded."
+      manual.each do |u|
+        puts "  [OPTIONAL]  #{u[:name].ljust(22)} v#{u[:available_version]} (not installed)"
+      end
+      puts ""
+      puts "## Summary"
+      puts "  Upgraded/installed:        #{results.size}"
+      puts "  Unchanged:                 #{checkable.reject { |ss| upgraded_names.include?(ss.name) }.size}"
+      puts "  Optional (not installed):  #{manual.size}"
 
       if manual.any?
         puts ""
-        puts "Not installed (optional, requires explicit approval):"
+        puts "Optional SkillSets require explicit approval:"
         manual.each { |u| puts "  kairos-chain skillset install #{u[:name]}" }
       end
 
@@ -174,24 +199,39 @@ when 'skillset'
         end
       end
     else
-      if applicable.any?
-        puts "SkillSet upgrades available:"
-        puts ""
-        applicable.each do |u|
+      upgrade_by_name = applicable.reject { |u| u[:new_skillset] }.each_with_object({}) { |u, h| h[u[:name]] = u }
+      puts "# SkillSet Upgrade Check"
+      puts ""
+      puts "## SkillSets"
+      checkable.each do |ss|
+        if (u = upgrade_by_name[ss.name])
           label = u[:version_bump] ? "v#{u[:installed_version]} -> v#{u[:available_version]}" : "files changed"
-          puts "  #{u[:name]}: #{label}"
-          u[:changed_files].each { |f| puts "    Modified: #{f}" }
-          puts ""
+          puts "  [UPGRADE]   #{ss.name.ljust(22)} #{label}"
+          u[:changed_files].each { |f| puts "                #{f}" }
+        else
+          puts "  [UNCHANGED] #{ss.name.ljust(22)} v#{ss.version}"
         end
-        puts "Run 'kairos-chain skillset upgrade --apply' to apply updates."
       end
+      new_core.each do |u|
+        puts "  [NEW-CORE]  #{u[:name].ljust(22)} v#{u[:available_version]} (will install on --apply)"
+      end
+      manual.each do |u|
+        puts "  [OPTIONAL]  #{u[:name].ljust(22)} v#{u[:available_version]} (not installed)"
+      end
+      puts ""
+      puts "## Summary"
+      puts "  Available upgrades:        #{applicable.size}"
+      puts "  Unchanged:                 #{checkable.size - existing_upgrade_names.size}"
+      puts "  Optional (not installed):  #{manual.size}"
 
+      if applicable.any?
+        puts ""
+        puts "Run 'kairos-chain skillset upgrade --apply' to apply updates."
+      end
       if manual.any?
-        puts "" if applicable.any?
-        puts "Optional SkillSets available (not auto-installed; require explicit approval):"
-        manual.each { |u| puts "  #{u[:name]} v#{u[:available_version]} — #{u[:description]}" }
         puts ""
-        puts "Install with: kairos-chain skillset install <name>"
+        puts "Optional SkillSets (require explicit approval):"
+        manual.each { |u| puts "  kairos-chain skillset install #{u[:name]}  # #{u[:description]}" }
       end
     end
 

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.50.0"
+  VERSION = "3.52.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/knowledge/multi_llm_review_workflow/multi_llm_review_workflow.md

@@ -1,7 +1,7 @@
 ---
 name: multi_llm_review_workflow
 description: "Multi-LLM review methodology and execution — workflow pattern, CLI tooling, consensus analysis, Persona Assembly. Applicable to design, implementation, documentation, or any artifact."
-version: "3.6"
+version: "3.6.1"
 tags:
   - workflow
   - review
@@ -345,7 +345,7 @@ starting** and verify each against `config/multi_llm_review.yml`:
 - [ ] Your model (orchestrator): ___
 - [ ] Agent Team Personas model: = orchestrator model (NOT a different model)
 - [ ] Subprocess CLI models: Opus 4.6 AND Opus 4.8 (both, not either/or)
-- [ ] Codex models: gpt-5.5 (default) AND gpt-5.4 (both, not either/or)
+- [ ] Codex models: gpt-5.6-sol (default) AND gpt-5.5 (both, not either/or)
 - [ ] Cursor model: default (composer-2.5, no --model flag)
 - [ ] Total reviewer count: 6 (or 5 after orchestrator exclusion from subprocess)
 - [ ] Convergence rule: 4/6 APPROVE (full) or 3/5 APPROVE (after exclusion)
@@ -356,7 +356,7 @@ starting** and verify each against `config/multi_llm_review.yml`:
 | Mistake | Correct behavior | Why it happens |
 |---------|-----------------|----------------|
 | Exclude orchestrator model from Agent Team Personas | Agent Team uses orchestrator model — they provide persona diversity, not epistemic diversity | LLM misreads "do not assign yourself as a reviewer" as applying to Agent Team; it applies only to subprocess CLI |
-| Run only Codex GPT-5.4, skip 5.5 | Run both — they catch different things (5.5 found §5 schema contradiction in Phase 2 Case A that no other reviewer caught) | Cost-saving heuristic; roster has both for a reason |
+| Run only Codex GPT-5.6-sol, skip 5.5 | Run both — cross-generation entries catch different things (5.5 found §5 schema contradiction in Phase 2 Case A that no other reviewer caught) | Cost-saving heuristic; roster has both for a reason |
 | Use a smaller/cheaper model as Agent Team substitute | Use the orchestrator's own model with different personas | Confusing "model diversity" with "persona diversity" — Agent Team is the latter |
 | Run 3 reviewers instead of 6 (or 5 after exclusion) | Use the full roster from config | Ad-hoc "3 is enough" reasoning; config specifies 6 for empirical reasons |
 
@@ -580,7 +580,7 @@ which claude 2>/dev/null && echo "claude: available" || echo "claude: NOT FOUND"
 
 | Tool | Command | Prompt Input | Output Collection | Model |
 |------|---------|-------------|-------------------|-------|
-| **Codex** | `codex exec -m <model>` | stdin pipe: `cat prompt.md \| codex exec -` | `-o /path/output.md` | GPT-5.5 + GPT-5.4 (both roster entries, `-m` per entry) |
+| **Codex** | `codex exec -m <model>` | stdin pipe: `cat prompt.md \| codex exec -` | `-o /path/output.md` | GPT-5.6-sol + GPT-5.5 (both roster entries, `-m` per entry) |
 | **Cursor Agent** | `agent -p` | File reference (stdin NOT supported) | stdout redirect: `> output.md` | Composer-2.5 (default) |
 | **Claude Code** | Agent tool (internal) | Direct prompt string | Write to workspace file | Fable 5 (session) |
 | **Claude CLI (4.6)** | `claude -p --model claude-opus-4-6 --bare` | stdin pipe: `cat prompt.md \| claude -p --model claude-opus-4-6 --bare` | stdout redirect: `> output.md` | Opus 4.6 |
@@ -597,7 +597,7 @@ Based on cross-evaluation experiment (7 models × 4 tasks + Nomic, 518 CLI calls
 | **Reviewer: Claude CLI** | Opus 4.6 / Opus 4.8 | (default; config `effort: medium`) | Evaluator quality is effort-independent (low≈high: 8.35 vs 8.16) — per 2026-04-29 policy reviewers stay at default |
 | **Coding sub-agent** | Opus 4.7 | `--effort medium` | Cost-effective default; use `high` for complex tasks |
 | **Design sub-agent** | Opus 4.7 | `--effort medium` | Cost-effective default; use `high` for complex tasks |
-| **Codex** | GPT-5.5 (default) | (no flag) | Fixed effort |
+| **Codex** | GPT-5.6-sol / GPT-5.5 | (no flag) | Fixed effort |
 | **Cursor Agent** | Composer-2.5 | (no flag) | Fixed effort |
 
 Note (2026-06-10): the effort experiment data is from the Opus 4.6/4.7
@@ -898,11 +898,11 @@ Step 1: Generate review prompt
 Step 2: Detect environment and models
   - Run: which codex && which agent && which claude
   - Detect default models
-  - Report: "Auto mode: Codex (gpt-5.5, gpt-5.4), Agent (composer-2.5), Claude Team (claude-fable-5), Claude CLI (opus-4.6, opus-4.8)"
+  - Report: "Auto mode: Codex (gpt-5.6-sol, gpt-5.5), Agent (composer-2.5), Claude Team (claude-fable-5), Claude CLI (opus-4.6, opus-4.8)"
 
 Step 3: Execute N reviews in parallel (default 6 reviewers)
   - Bash(background): cat prompt.md | codex exec -m gpt-5.5 -C workspace -o log/review_codex_gpt5.5.md -
-  - Bash(background): cat prompt.md | codex exec -m gpt-5.4 -C workspace -o log/review_codex_gpt5.4.md -
+  - Bash(background): cat prompt.md | codex exec -m gpt-5.6-sol -C workspace -o log/review_codex_gpt5.6-sol.md -
   - Bash(background): agent -p --trust "Read prompt and review..." > log/review_cursor.md
   - Agent(background): Claude Team (orchestrator model, Fable 5) → write to log/review_claude_team_fable5.md
   - Bash(background): cat prompt.md | claude -p --model claude-opus-4-6 --bare > log/review_claude_opus4.6.md 2>log/review_claude_opus4.6.stderr.log
@@ -944,10 +944,10 @@ log/{artifact}_review{N}_consensus_{date}.md       # Consensus analysis
 ```
 
 LLM identifiers: `claude_team_fable5`, `claude_cli_opus4.6`, `claude_cli_opus4.8`,
-`codex_gpt5.5`, `codex_gpt5.4`, `cursor_composer2.5`, `cursor_gpt5.4`,
+`codex_gpt5.6-sol`, `codex_gpt5.5`, `cursor_composer2.5`, `cursor_gpt5.4`,
 `cursor_premium`
 (legacy, pre-2026-06-10: `claude_opus4.6`, `claude_team_opus4.6`, `claude_team_opus4.7`,
-`claude_cli_opus4.7`, `cursor_composer2`)
+`claude_cli_opus4.7`, `cursor_composer2`; retired 2026-07-23: `codex_gpt5.4`)
 
 ## Internal Agent Team Review
 
@@ -997,6 +997,13 @@ Compression ratio: parallel agent raw → Assembly ≈ 2:1
   epistemic diversity — the personas that authored R1 findings all approved
   their own fixes in R2, while subprocess reviewers caught the seams.
   Design record: `docs/drafts/multi_llm_review_unknowns_pass_v0.3.1_FROZEN.md`
+- Roster update (v3.6.1, 2026-07-23): Codex gpt-5.6-sol replaces gpt-5.4
+  (retired — its "everyday coding" register is covered by the frontier
+  entries). gpt-5.5 retained as the calibrated anchor for cross-generation
+  comparison. 5.6-sol's reviewer bias profile is uncalibrated — record
+  (a)/(b)/(c) breakdowns per round until a profile accumulates in
+  `multi_llm_reviewer_evaluation`; watch for agentic-coding drift into
+  implementation detail during design-phase reviews ((c) inflation)
 
 **Key insight**: Design reviews and implementation reviews find
-**categorically different bugs**. Both phases are necessary.
+**categorically different bugs**. Both phases are necessary.

data/templates/skillsets/agent/bin/agent_step_worker.rb

@@ -0,0 +1,183 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+#
+# Interruption resilience Slice A-2 — detached agent step worker (INV-A1).
+#
+# Spawned by StepDelegation#spawn_worker after agent_step was called with
+# execution: "delegated". This worker is deliberately thin: it bootstraps a
+# ToolRegistry (the same construction the MCP server uses) and re-enters the
+# SAME gated agent_step path with the recorded arguments (the delegation-start
+# anchor is already injected into those arguments). Every correctness property
+# — per-session serialization, anchored at-most-once, side-effect intent
+# bracket — is enforced by the AdvanceGate inside that call (Slice A-1), not by
+# this script. If this worker dies, the driver re-issues the recorded call
+# safely; if it double-runs, the gate serializes and replays.
+#
+# argv: <session_id> <session_dir>
+# env:  KAIROS_PROJECT_ROOT (chdir target)
+#       KAIROS_SERVER_LIB   (lib dir to load kairos_mcp from)
+#       KAIROS_DATA_DIR     (the server's effective data dir; makes the
+#                            worker resolve the SAME .kairos)
+#
+# Exit codes: 0 success; 1 exception; 125 setsid failed; 130 signal.
+#
+# NB: bootstrap failures (LoadError/ScriptError from require) are caught too,
+# so the driver always sees a result rather than a silently hung handle.
+
+require 'json'
+require 'time'
+require 'fileutils'
+
+session_id  = ARGV[0] or abort 'usage: agent_step_worker.rb <session_id> <session_dir>'
+session_dir = ARGV[1] or abort 'usage: agent_step_worker.rb <session_id> <session_dir>'
+
+# Read the handle identity from the raw file first, so even a bootstrap
+# failure can tag its error result with the delegation it belongs to.
+def read_handle_identity(session_dir)
+  raw = JSON.parse(File.read(File.join(session_dir, 'delegation.json')))
+  { 'issue_anchor' => raw['issue_anchor'], 'action_key' => raw['action_key'],
+    'step_token' => raw['step_token'] }
+rescue StandardError
+  {}
+end
+
+def write_raw_result(session_dir, identity, outcome)
+  payload = identity.merge('outcome' => outcome)
+  tmp = File.join(session_dir, "delegation_result.json.tmp.#{Process.pid}")
+  File.write(tmp, JSON.generate(payload))
+  File.rename(tmp, File.join(session_dir, 'delegation_result.json'))
+rescue StandardError
+  # nothing more we can do
+end
+
+boot_identity = read_handle_identity(session_dir)
+
+$LOAD_PATH.unshift(File.expand_path('../lib', __dir__))
+begin
+  require 'agent/step_delegation'
+rescue ScriptError, StandardError => e
+  # The delegation lib is co-located with this script; if even it cannot load
+  # we tag a raw result with the handle identity so status can surface it as
+  # 'ready' (an error outcome) rather than the driver waiting out the grace.
+  write_raw_result(session_dir, boot_identity,
+                   { 'status' => 'error',
+                     'error' => "worker bootstrap failed: #{e.class}: #{e.message}" })
+  exit 1
+end
+
+delegation = KairosMcp::SkillSets::Agent::StepDelegation.new(session_dir)
+my_token = boot_identity['step_token']
+
+shutdown = { requested: false }
+%w[TERM INT HUP].each do |sig|
+  Signal.trap(sig) { shutdown[:requested] = true }
+end
+
+begin
+  Process.setsid
+rescue Errno::EPERM
+  # Already a session leader — acceptable; continue.
+rescue StandardError => e
+  delegation.write_result({ 'status' => 'error',
+                            'error' => "worker setsid failed: #{e.message}" },
+                          identity: boot_identity)
+  exit 125
+end
+
+heartbeat_thread = Thread.new do
+  loop do
+    begin
+      delegation.touch_heartbeat(my_token)
+    rescue StandardError
+      # A transient touch failure must not kill the heartbeat thread and
+      # make a live worker look crashed; retry on the next tick.
+    end
+    sleep KairosMcp::SkillSets::Agent::StepDelegation::HEARTBEAT_INTERVAL_SECONDS
+  end
+end
+
+# Self-timeout watchdog: a hung gated call would otherwise hold the advance
+# lock forever. Exiting the process releases its flock; the driver then sees
+# 'crashed' and re-issues safely. We deliberately write NO result here so the
+# collector takes the crash path — if the gated advance had already committed,
+# crashed_response recovers its outcome from the gate log; an error result
+# would instead mask that committed advance.
+timeout_s = KairosMcp::SkillSets::Agent::StepDelegation.worker_self_timeout_seconds
+watchdog = Thread.new do
+  sleep timeout_s
+  exit!(124)
+end
+
+begin
+  Dir.chdir(ENV['KAIROS_PROJECT_ROOT']) if ENV['KAIROS_PROJECT_ROOT'] &&
+                                           Dir.exist?(ENV['KAIROS_PROJECT_ROOT'])
+  $LOAD_PATH.unshift(ENV['KAIROS_SERVER_LIB']) if ENV['KAIROS_SERVER_LIB']
+  # KAIROS_DATA_DIR was set in the worker env by spawn_worker so ToolRegistry
+  # / Session resolve the server's effective .kairos even under --data-dir.
+  require 'kairos_mcp/tool_registry'
+
+  pending = delegation.pending
+  raise "no pending delegation in #{session_dir}" unless pending
+
+  # Supersession guard: run ONLY if the live handle is still ours. If a fresh
+  # open_handle replaced it while we were starting up (e.g. we were declared
+  # 'crashed' on a stale heartbeat and the driver re-delegated), or we could
+  # not read our own identity at boot (my_token nil), do NOT run: the new
+  # worker owns this delegation, and the gate would replay/serialize our stale
+  # call anyway. Exiting leaves the current handle to its rightful worker.
+  if my_token.nil? || pending['step_token'] != my_token
+    exit 0
+  end
+
+  # Past the guard, boot_identity is non-empty and is our own handle identity
+  # (also driving the per-token heartbeat); write_result tags with it.
+  identity = boot_identity
+
+  args = (pending['arguments'] || {}).merge('session_id' => session_id)
+  args.delete('execution') # never recurse into another delegation
+
+  exit 130 if shutdown[:requested]
+
+  registry = KairosMcp::ToolRegistry.new
+  raw = registry.call_tool('agent_step', args)
+
+  # Normalize the MCP content shape to the response hash the inline call
+  # would have returned.
+  text = if raw.is_a?(Array) && raw.first.is_a?(Hash)
+           raw.first[:text] || raw.first['text']
+         end
+  response = begin
+    text ? JSON.parse(text) : { 'status' => 'error', 'error' => 'unrecognized tool result shape' }
+  rescue JSON::ParserError
+    { 'status' => 'error', 'error' => 'unparseable tool result', 'raw' => text.to_s[0, 500] }
+  end
+
+  # Write the result (tagged with our OWN startup identity) and leave the
+  # pending handle in place: teardown is the collector's job (agent_wait#collect
+  # clears result+handle atomically under delegation.lock), so the worker never
+  # races a concurrently-opened fresh delegation by clearing state it may no
+  # longer own or by mislabeling its result as a newer delegation's.
+  delegation.write_result(response, identity: identity)
+  exit 0
+rescue SystemExit, SignalException
+  # A deliberate exit (including our own `exit 0`) or a signal is not a
+  # failure to report — let it propagate.
+  raise
+rescue Exception => e # rubocop:disable Lint/RescueException
+  # Catch Exception, not just StandardError: LoadError/ScriptError from the
+  # bootstrap require are exactly the failure class the driver must see as a
+  # result rather than a silently hung handle. Leave teardown to the collector.
+  # Tag with our OWN startup identity (boot_identity is always our handle;
+  # the in-block `identity` local may be unassigned if we failed early, and
+  # a re-read of pending could belong to a superseding delegation).
+  begin
+    delegation.write_result({ 'status' => 'error', 'error' => "worker: #{e.class}: #{e.message}" },
+                            identity: (boot_identity.empty? ? nil : boot_identity))
+  rescue StandardError
+    # best effort
+  end
+  exit 1
+ensure
+  watchdog&.kill
+  heartbeat_thread&.kill
+end