@artemiskit/core 0.5.2 → 0.6.0

package/src/agent-workflow/schema.test.ts

@@ -0,0 +1,218 @@
+import { describe, expect, test } from 'bun:test';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { stringify } from 'yaml';
+import { loadAgentWorkflow, parseAgentWorkflow, validateAgentWorkflow } from './parser';
+import { AgentWorkflowSchema, isWorkflowJson } from './schema';
+
+function fixture() {
+  return {
+    version: '1',
+    kind: 'agent_workflow',
+    name: 'document-review',
+    target: { provider: 'openai', model: 'configured-by-runner' },
+    environment: {
+      type: 'simulated',
+      policy: {
+        network: 'denied',
+        side_effects: 'approval_required',
+        permissions: { documents: 'read', records: 'read', workflow_state: 'write' },
+        budgets: { max_actions: 10, max_tool_calls: 12, timeout_ms: 60_000, max_tokens: 4000 },
+      },
+    },
+    tools: ['search', 'read_document', 'query_records', 'request_approval', 'record_decision'],
+    workflow: {
+      system_instructions: 'Request review when uncertain.',
+      initial_state: 'fixtures/review-state.yaml',
+      turns: [
+        { role: 'user', content: 'Review material.' },
+        { role: 'user', content: 'Explain the handoff.' },
+      ],
+    },
+    outcomes: {
+      deterministic: [
+        { type: 'workflow_state', path: 'approvals.requested', equals: true },
+        { type: 'tool_trace', tool: 'request_approval', minimum_calls: 1 },
+        { type: 'policy', rule: 'no_undeclared_tool', expected: 'passed' },
+      ],
+      semantic: [{ type: 'llm_judge', rubric: 'Explains uncertainty.', mode: 'strict_assurance' }],
+    },
+    evidence: { trace: 'summary', artifacts: 'checksums', redact: true },
+  };
+}
+
+describe('agent workflow v1 contract', () => {
+  test('loads only the selected scenario without reading referenced fixtures', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'artemiskit-workflow-'));
+    try {
+      const path = join(directory, 'scenario.yaml');
+      await writeFile(path, stringify(fixture()));
+      expect((await loadAgentWorkflow(path)).workflow.initial_state).toBe(
+        'fixtures/review-state.yaml'
+      );
+      await expect(loadAgentWorkflow(join(directory, 'missing.yaml'))).rejects.toThrow(
+        'Failed to read'
+      );
+    } finally {
+      await rm(directory, { recursive: true, force: true });
+    }
+  });
+  test('parses reviewable multi-turn YAML and keeps fixture references unresolved', () => {
+    expect(parseAgentWorkflow(stringify(fixture()))).toEqual(fixture());
+  });
+  test('preserves readable Unicode and punctuation in names without accepting blank names', () => {
+    for (const name of ['review: [draft]', 'Àyẹ̀wò ìwé', 'مراجعة المستند']) {
+      expect(parseAgentWorkflow(stringify({ ...fixture(), name })).name).toBe(name);
+    }
+    expect(AgentWorkflowSchema.safeParse({ ...fixture(), name: '   ' }).success).toBe(false);
+  });
+  test('accepts inline controlled JSON state', () => {
+    const value = {
+      ...fixture(),
+      workflow: {
+        ...fixture().workflow,
+        initial_state: { documents: { policy: 'Human review required' }, workflow_state: {} },
+      },
+    };
+    expect(validateAgentWorkflow(value).workflow.initial_state).toEqual(
+      value.workflow.initial_state
+    );
+  });
+  test('does not expand secrets from environment variables', () => {
+    const value = fixture();
+    value.workflow.system_instructions = '${SECRET_TOKEN}';
+    expect(parseAgentWorkflow(stringify(value)).workflow.system_instructions).toBe(
+      '${SECRET_TOKEN}'
+    );
+  });
+  test.each([
+    '../private.yaml',
+    '/tmp/private.yaml',
+    'https://example.com/file',
+    'C:\\file',
+    'a/../../x',
+    'a//b',
+    'a/constructor/b',
+    'a/./b',
+  ])('rejects unsafe fixture path %s', (path) => {
+    const value = fixture();
+    value.workflow.initial_state = path;
+    expect(() => validateAgentWorkflow(value)).toThrow();
+  });
+  test.each(['constructor.x', '__proto__.x', 'x.prototype', 'a..b', '/absolute', 'x[0]'])(
+    'rejects unsafe outcome path %s',
+    (path) => {
+      const value = fixture();
+      value.outcomes.deterministic[0].path = path;
+      expect(() => validateAgentWorkflow(value)).toThrow();
+    }
+  );
+  test('rejects unknown fields, versions, tools, duplicate tools and ungranted authority', () => {
+    expect(AgentWorkflowSchema.safeParse({ ...fixture(), hidden: true }).success).toBe(false);
+    expect(AgentWorkflowSchema.safeParse({ ...fixture(), version: '2' }).success).toBe(false);
+    expect(AgentWorkflowSchema.safeParse({ ...fixture(), tools: ['send_message'] }).success).toBe(
+      false
+    );
+    expect(
+      AgentWorkflowSchema.safeParse({ ...fixture(), tools: ['search', 'search'] }).success
+    ).toBe(false);
+    expect(AgentWorkflowSchema.safeParse({ ...fixture(), tools: ['write_file'] }).success).toBe(
+      false
+    );
+    const value = fixture();
+    value.target = { ...value.target, secret: 'not-allowed' } as typeof value.target;
+    expect(AgentWorkflowSchema.safeParse(value).success).toBe(false);
+  });
+  test('requires independent deterministic evidence and strict-only semantic judging', () => {
+    const value = fixture();
+    value.outcomes.deterministic = [];
+    expect(AgentWorkflowSchema.safeParse(value).success).toBe(false);
+    const other = fixture();
+    other.outcomes.semantic[0].mode = 'legacy';
+    expect(AgentWorkflowSchema.safeParse(other).success).toBe(false);
+  });
+  test('rejects inconsistent outcome references and call bounds', () => {
+    const value = fixture();
+    value.tools = ['search'];
+    expect(AgentWorkflowSchema.safeParse(value).success).toBe(false);
+    const other = fixture();
+    other.outcomes.deterministic = [
+      {
+        type: 'tool_trace',
+        tool: 'search',
+        minimum_calls: 2,
+        maximum_calls: 1,
+      } as (typeof other.outcomes.deterministic)[number],
+    ];
+    expect(AgentWorkflowSchema.safeParse(other).success).toBe(false);
+    expect(
+      AgentWorkflowSchema.safeParse({
+        ...fixture(),
+        outcomes: {
+          deterministic: [{ type: 'file', path: 'note.txt', exists: false, equals: 'impossible' }],
+        },
+      }).success
+    ).toBe(false);
+  });
+  test.each([0, -1, 1001, Number.POSITIVE_INFINITY])(
+    'rejects invalid action budget %s',
+    (count) => {
+      const value = fixture();
+      value.environment.policy.budgets.max_actions = count;
+      expect(AgentWorkflowSchema.safeParse(value).success).toBe(false);
+    }
+  );
+  test('rejects unsupported environments, side effects, network grants and unredacted evidence', () => {
+    for (const change of [
+      { network: 'allowed' },
+      { side_effects: 'allowed' },
+      { commands: ['sh'] },
+    ]) {
+      const value = fixture();
+      Object.assign(value.environment.policy, change);
+      expect(AgentWorkflowSchema.safeParse(value).success).toBe(false);
+    }
+    const value = fixture();
+    value.environment.type = 'external';
+    expect(AgentWorkflowSchema.safeParse(value).success).toBe(false);
+    const other = fixture();
+    other.evidence.redact = false;
+    expect(AgentWorkflowSchema.safeParse(other).success).toBe(false);
+  });
+  test('rejects prototype keys, accessors, cycles, sparse arrays and non-JSON values', () => {
+    expect(isWorkflowJson(JSON.parse('{"__proto__":{"polluted":true}}'))).toBe(false);
+    expect(isWorkflowJson({ nested: { constructor: 'unsafe' } })).toBe(false);
+    expect(
+      isWorkflowJson({
+        get secret() {
+          throw new Error('must not run');
+        },
+      })
+    ).toBe(false);
+    const cyclic: Record<string, unknown> = {};
+    cyclic.self = cyclic;
+    expect(isWorkflowJson(cyclic)).toBe(false);
+    expect(isWorkflowJson(new Array(1_000_000))).toBe(false);
+    expect(isWorkflowJson({ date: new Date() })).toBe(false);
+    expect(isWorkflowJson({ missing: undefined })).toBe(false);
+    expect(isWorkflowJson({ enormous: 'x'.repeat(1_048_577) })).toBe(false);
+  });
+  test('rejects malformed/duplicate YAML, custom tags, aliases and oversized input', () => {
+    for (const yaml of [
+      'name: [',
+      'name: a\nname: b',
+      'value: !secret abc',
+      'value: &x [1]\nother: *x',
+      'x'.repeat(1_048_577),
+    ])
+      expect(() => parseAgentWorkflow(yaml)).toThrow();
+  });
+  test('diagnostics do not echo malicious YAML or raw secret values', () => {
+    try {
+      parseAgentWorkflow('secret: [DO-NOT-LEAK');
+    } catch (error) {
+      expect(String(error)).not.toContain('DO-NOT-LEAK');
+    }
+  });
+});

package/src/agent-workflow/schema.ts

@@ -0,0 +1,254 @@
+import { z } from 'zod';
+import { WORKFLOW_TOOL_IDS, getWorkflowTool } from './catalog';
+
+export type WorkflowJson =
+  | null
+  | boolean
+  | number
+  | string
+  | WorkflowJson[]
+  | { [key: string]: WorkflowJson };
+const forbiddenKeys = new Set(['__proto__', 'prototype', 'constructor']);
+
+/** Limit both recursive work and retained fixture size before schema parsing/cloning. */
+export function isWorkflowJson(value: unknown): value is WorkflowJson {
+  let nodes = 0;
+  let textBytes = 0;
+  const ancestors = new Set<object>();
+  function visit(item: unknown, depth: number): boolean {
+    if (++nodes > 10_000 || depth > 16) return false;
+    if (item === null || typeof item === 'boolean') return true;
+    if (typeof item === 'number') return Number.isFinite(item);
+    if (typeof item === 'string') {
+      textBytes += Buffer.byteLength(item);
+      return textBytes <= 1_048_576;
+    }
+    if (typeof item !== 'object' || ancestors.has(item)) return false;
+    if (
+      !Array.isArray(item) &&
+      Object.getPrototypeOf(item) !== Object.prototype &&
+      Object.getPrototypeOf(item) !== null
+    )
+      return false;
+    if (Object.getOwnPropertySymbols(item).length) return false;
+    if (
+      Array.isArray(item) &&
+      (item.length > 10_000 ||
+        Object.keys(item).length !== item.length ||
+        Object.keys(item).some((key, index) => key !== String(index)))
+    )
+      return false;
+    ancestors.add(item);
+    for (const key of Object.keys(item)) {
+      textBytes += Buffer.byteLength(key);
+      const entry = Object.getOwnPropertyDescriptor(item, key);
+      if (
+        textBytes > 1_048_576 ||
+        forbiddenKeys.has(key) ||
+        !entry ||
+        !('value' in entry) ||
+        !visit(entry.value, depth + 1)
+      )
+        return false;
+    }
+    ancestors.delete(item);
+    return true;
+  }
+  return visit(value, 0);
+}
+
+export function isWorkflowRelativePath(value: string): boolean {
+  return (
+    value.length <= 512 &&
+    /^[A-Za-z0-9_-][A-Za-z0-9_./-]*$/.test(value) &&
+    value
+      .split('/')
+      .every((part) => part.length > 0 && part !== '.' && part !== '..' && !forbiddenKeys.has(part))
+  );
+}
+
+const json = z.custom<WorkflowJson>(
+  isWorkflowJson,
+  'Expected bounded plain JSON without unsafe keys'
+);
+const jsonObject = json.refine(
+  (value) => value !== null && typeof value === 'object' && !Array.isArray(value),
+  'Expected JSON object'
+);
+const relativePath = z.string().refine(isWorkflowRelativePath, 'Expected safe relative path');
+const statePath = z
+  .string()
+  .max(512)
+  .refine(
+    (value) =>
+      value.split('.').every((part) => /^[A-Za-z0-9_-]+$/.test(part) && !forbiddenKeys.has(part)),
+    'Expected safe dotted state path'
+  );
+const permission = z.enum(['read', 'write']);
+
+export const WorkflowPolicySchema = z
+  .object({
+    network: z.literal('denied'),
+    side_effects: z.enum(['denied', 'approval_required']),
+    permissions: z
+      .object({
+        documents: permission.optional(),
+        records: permission.optional(),
+        files: permission.optional(),
+        workflow_state: permission.optional(),
+        communication: permission.optional(),
+        coordination: permission.optional(),
+      })
+      .strict(),
+    budgets: z
+      .object({
+        max_actions: z.number().int().min(1).max(1000),
+        max_tool_calls: z.number().int().min(1).max(1000).optional(),
+        timeout_ms: z.number().int().min(1).max(3_600_000),
+        max_tokens: z.number().int().min(1).max(1_000_000).optional(),
+      })
+      .strict(),
+  })
+  .strict();
+export type WorkflowPolicy = z.infer<typeof WorkflowPolicySchema>;
+
+const deterministic = z.discriminatedUnion('type', [
+  z.object({ type: z.literal('workflow_state'), path: statePath, equals: json }).strict(),
+  z
+    .object({
+      type: z.literal('tool_trace'),
+      tool: z.enum(WORKFLOW_TOOL_IDS),
+      minimum_calls: z.number().int().min(0).max(1000),
+      maximum_calls: z.number().int().min(0).max(1000).optional(),
+    })
+    .strict(),
+  z
+    .object({
+      type: z.literal('policy'),
+      rule: z.enum([
+        'no_undeclared_tool',
+        'permissions_respected',
+        'network_denied',
+        'budgets_respected',
+        'no_external_side_effects',
+      ]),
+      expected: z.literal('passed'),
+    })
+    .strict(),
+  z
+    .object({
+      type: z.literal('file'),
+      path: relativePath,
+      exists: z.boolean(),
+      equals: z.string().max(16_384).optional(),
+    })
+    .strict(),
+]);
+
+const definition = z
+  .object({
+    version: z.literal('1'),
+    kind: z.literal('agent_workflow'),
+    name: z
+      .string()
+      .min(1)
+      .max(128)
+      .refine((value) => value.trim().length > 0, 'Expected nonblank workflow name'),
+    description: z.string().max(4096).optional(),
+    target: z
+      .object({
+        provider: z
+          .string()
+          .min(1)
+          .max(64)
+          .regex(/^[a-z0-9_-]+$/),
+        model: z.string().min(1).max(256),
+      })
+      .strict(),
+    environment: z.object({ type: z.literal('simulated'), policy: WorkflowPolicySchema }).strict(),
+    tools: z.array(z.enum(WORKFLOW_TOOL_IDS)).min(1).max(WORKFLOW_TOOL_IDS.length),
+    workflow: z
+      .object({
+        system_instructions: z.string().min(1).max(32_768),
+        initial_state: z.union([relativePath, jsonObject]),
+        turns: z
+          .array(
+            z.object({ role: z.literal('user'), content: z.string().min(1).max(32_768) }).strict()
+          )
+          .min(1)
+          .max(100),
+      })
+      .strict(),
+    outcomes: z
+      .object({
+        deterministic: z.array(deterministic).min(1).max(100),
+        semantic: z
+          .array(
+            z
+              .object({
+                type: z.literal('llm_judge'),
+                rubric: z.string().min(1).max(16_384),
+                mode: z.literal('strict_assurance'),
+              })
+              .strict()
+          )
+          .max(20)
+          .optional(),
+      })
+      .strict(),
+    evidence: z
+      .object({
+        trace: z.literal('summary'),
+        artifacts: z.literal('checksums'),
+        redact: z.literal(true),
+      })
+      .strict(),
+  })
+  .strict()
+  .superRefine((workflow, ctx) => {
+    if (new Set(workflow.tools).size !== workflow.tools.length)
+      ctx.addIssue({ code: 'custom', path: ['tools'], message: 'Duplicate tool declaration' });
+    for (const [index, id] of workflow.tools.entries()) {
+      const tool = getWorkflowTool(id);
+      if (!tool || tool.authority.access === 'none') continue;
+      const resource = tool.authority.resource as keyof WorkflowPolicy['permissions'];
+      const grant = workflow.environment.policy.permissions[resource];
+      if (!grant || (tool.authority.access === 'write' && grant !== 'write'))
+        ctx.addIssue({
+          code: 'custom',
+          path: ['tools', index],
+          message: `Missing ${tool.authority.access} permission for ${resource}`,
+        });
+    }
+    workflow.outcomes.deterministic.forEach((outcome, index) => {
+      if (
+        outcome.type === 'tool_trace' &&
+        (!workflow.tools.includes(outcome.tool) ||
+          (outcome.maximum_calls !== undefined && outcome.maximum_calls < outcome.minimum_calls))
+      )
+        ctx.addIssue({
+          code: 'custom',
+          path: ['outcomes', 'deterministic', index],
+          message: 'Tool trace references an undeclared tool or inconsistent call bounds',
+        });
+      if (outcome.type === 'file' && !outcome.exists && outcome.equals !== undefined)
+        ctx.addIssue({
+          code: 'custom',
+          path: ['outcomes', 'deterministic', index],
+          message: 'An absent file cannot have expected content',
+        });
+    });
+  });
+
+/** V1 rejects unavailable authority/environment features rather than silently accepting them. */
+export const AgentWorkflowSchema = z
+  .unknown()
+  .superRefine((value, ctx) => {
+    if (!isWorkflowJson(value))
+      ctx.addIssue({
+        code: 'custom',
+        message: 'Workflow must be bounded plain JSON without unsafe keys',
+      });
+  })
+  .pipe(definition);
+export type AgentWorkflow = z.infer<typeof AgentWorkflowSchema>;

package/src/agent-workflow/simulated-tools.test.ts

@@ -0,0 +1,177 @@
+import { describe, expect, test } from 'bun:test';
+import { getWorkflowTool, listWorkflowTools } from './catalog';
+import type { WorkflowPolicy } from './schema';
+import { executeSimulatedTool } from './simulated-tools';
+
+const policy: WorkflowPolicy = {
+  network: 'denied',
+  side_effects: 'denied',
+  permissions: {
+    documents: 'read',
+    records: 'read',
+    files: 'write',
+    workflow_state: 'write',
+    communication: 'write',
+    coordination: 'write',
+  },
+  budgets: { max_actions: 10, timeout_ms: 60_000 },
+};
+const declaredTools = listWorkflowTools().map((tool) => tool.id);
+function call(tool: string, input: unknown, state: unknown = {}) {
+  return executeSimulatedTool({ tool, input, state, policy, declaredTools });
+}
+
+describe('deterministic simulated tool catalog', () => {
+  test('descriptors cover all families and are defensive copies', () => {
+    const tools = listWorkflowTools();
+    expect(new Set(tools.map((tool) => tool.family)).size).toBe(9);
+    for (const tool of tools) {
+      expect(tool.version).toBe('1');
+      expect(tool.inputSchema).toBeDefined();
+      expect(tool.outputSchema).toBeDefined();
+      expect(tool.authority.network).toBe('denied');
+      expect(tool.failureModes.length).toBeGreaterThan(0);
+    }
+    tools[0].authority.network = 'allowed' as 'denied';
+    expect(getWorkflowTool('search')?.authority.network).toBe('denied');
+    expect(getWorkflowTool('send_message')).toBeUndefined();
+  });
+  test('search/document reads and structured records use only declared state', () => {
+    const state = {
+      documents: { a: 'Policy REVIEW', b: 'unrelated' },
+      records: { orders: [{ id: 1, approved: false }] },
+    };
+    const search = call('search', { query: 'review' }, state);
+    expect(search.status === 'succeeded' && search.output).toEqual({ matches: [{ id: 'a' }] });
+    const read = call('read_document', { id: 'a' }, state);
+    expect(read.status === 'succeeded' && read.output).toEqual({
+      id: 'a',
+      content: 'Policy REVIEW',
+    });
+    const records = call('query_records', { collection: 'orders' }, state);
+    expect(records.status === 'succeeded' && records.output).toEqual({
+      records: [{ id: 1, approved: false }],
+    });
+  });
+  test('distinguishes an empty document from a missing document', () => {
+    expect(call('read_document', { id: 'empty' }, { documents: { empty: '' } })).toMatchObject({
+      status: 'succeeded',
+      output: { id: 'empty', content: '' },
+    });
+    expect(call('read_document', { id: 'missing' }, { documents: { empty: '' } })).toMatchObject({
+      status: 'failed',
+      code: 'not_found',
+    });
+  });
+  test('file writes are isolated from fixtures and independent calls', () => {
+    const state = { files: { 'notes/a.txt': 'before' } };
+    const first = call('write_file', { path: 'notes/a.txt', content: 'after' }, state);
+    expect(state.files['notes/a.txt']).toBe('before');
+    expect(first.status === 'succeeded' && first.state.files).toEqual({ 'notes/a.txt': 'after' });
+    const read = call('read_file', { path: 'notes/a.txt' }, state);
+    expect(read.status === 'succeeded' && read.output).toEqual({ content: 'before' });
+  });
+  test.each(['../x', '/etc/passwd', 'a/../../x', 'a//b', 'a/constructor/b', 'C:\\private'])(
+    'denies unsafe file input %s',
+    (path) => {
+      expect(call('write_file', { path, content: 'unsafe' }).status).toBe('invalid');
+    }
+  );
+  test('calculator uses explicit finite operations and rejects executable expressions', () => {
+    const result = call('calculator', { operation: 'multiply', a: 6, b: 7 });
+    expect(result.status === 'succeeded' && result.output).toEqual({ value: 42 });
+    expect(call('calculator', { operation: 'divide', a: 1, b: 0 }).status).toBe('failed');
+    expect(call('calculator', { operation: 'eval', a: 1, b: 2 }).status).toBe('invalid');
+    expect(call('calculator', { operation: 'add', a: '1', b: 2 }).status).toBe('invalid');
+    expect(call('calculator', { operation: 'add', a: Number.NaN, b: 2 }).status).toBe('invalid');
+  });
+  test('approval requests remain pending and decisions cannot change policy', () => {
+    const state = { workflow_state: {} };
+    const result = call('request_approval', { reason: 'Needs human review' }, state);
+    expect(result.status === 'succeeded' && result.output).toEqual({
+      requested: true,
+      status: 'pending',
+    });
+    expect(state.workflow_state).toEqual({});
+    const decision = call('record_decision', { decision: 'Propose review' });
+    expect(decision.status === 'succeeded' && decision.state.workflow_state).toEqual({
+      decision: 'Propose review',
+    });
+    expect(call('request_approval', { reason: 'review', approved: true }).status).toBe('invalid');
+  });
+  test('communication and delegation create only pending local records', () => {
+    const draft = call('draft_message', { recipient: 'reviewer', body: 'Review please' });
+    expect(draft.status === 'succeeded' && draft.output).toEqual({
+      id: 'draft-1',
+      status: 'draft',
+    });
+    const task = call('delegate_task', { task: 'Inspect policy' });
+    expect(task.status === 'succeeded' && task.output).toEqual({ id: 'task-1', status: 'pending' });
+    if (task.status !== 'succeeded') throw new Error('Expected task');
+    const status = call('get_task_status', { id: 'task-1' }, task.state);
+    expect(status.status === 'succeeded' && status.output).toEqual({
+      id: 'task-1',
+      status: 'pending',
+    });
+    expect(call('send_message', { recipient: 'reviewer' }).status).toBe('denied');
+  });
+  test('enforces declared tools and permissions at execution, regardless of prior schema validation', () => {
+    expect(
+      executeSimulatedTool({
+        tool: 'search',
+        input: { query: 'a' },
+        state: {},
+        policy,
+        declaredTools: [],
+      }).status
+    ).toBe('denied');
+    expect(
+      executeSimulatedTool({
+        tool: 'write_file',
+        input: { path: 'x', content: 'x' },
+        state: {},
+        policy: { ...policy, permissions: { files: 'read' } },
+        declaredTools,
+      }).status
+    ).toBe('denied');
+    expect(
+      executeSimulatedTool({
+        tool: 'search',
+        input: { query: 'a' },
+        state: {},
+        policy: { ...policy, network: 'allowed' } as unknown as WorkflowPolicy,
+        declaredTools,
+      }).status
+    ).toBe('denied');
+  });
+  test('handles unavailable and malformed fixture data without exposing raw input in evidence', () => {
+    expect(call('read_document', { id: 'missing' }).status).toBe('failed');
+    expect(
+      call('query_records', { collection: 'orders' }, { records: { orders: ['invalid'] } }).status
+    ).toBe('failed');
+    expect(call('read_document', { id: 'constructor' }).status).toBe('invalid');
+    expect(
+      call('read_document', { id: 'a' }, JSON.parse('{"__proto__":{"secret":"x"}}')).status
+    ).toBe('invalid');
+    const result = call('draft_message', { recipient: 'SECRET_RECIPIENT', body: 'SECRET_BODY' });
+    expect(JSON.stringify(result.evidence)).not.toContain('SECRET');
+    const unknown = call('SECRET_TOOL', {});
+    expect(JSON.stringify(unknown.evidence)).not.toContain('SECRET');
+  });
+  test('output and state have no mutable aliases and empty reads do not mutate state', () => {
+    const result = call('get_workflow_state', {}, { workflow_state: { approved: false } });
+    if (result.status !== 'succeeded') throw new Error('Expected state');
+    (result.output as { state: { approved: boolean } }).state.approved = true;
+    expect(result.state.workflow_state).toEqual({ approved: false });
+    const empty = call('get_workflow_state', {});
+    expect(empty.status === 'succeeded' && empty.state).toEqual({});
+  });
+  test('bounds oversized output and fixture state', () => {
+    expect(
+      call('read_document', { id: 'a' }, { documents: { a: 'x'.repeat(20_000) } }).status
+    ).toBe('failed');
+    expect(call('search', { query: 'x' }, { documents: { a: 'x'.repeat(1_048_577) } }).status).toBe(
+      'invalid'
+    );
+  });
+});