pi-session-mcp 0.8.3 → 0.12.0

package/docs/evaluation/publication-2026-10-17/publication-scan.json

@@ -0,0 +1,63 @@
+{
+  "kind": "public-tree-hygiene-and-integrity-verification",
+  "status": "PASS",
+  "recorded_at": "2026-10-17T15:51:12.292517+00:00",
+  "dossier_indexes": [
+    {
+      "path": "docs/evaluation/client-reconnect-2026-10-17/integrity.json",
+      "files": 5
+    },
+    {
+      "path": "docs/evaluation/extension-audit-2026-10-17/integrity.json",
+      "files": 23
+    },
+    {
+      "path": "docs/evaluation/extension-functions-2026-10-17/bridges/integrity.json",
+      "files": 19
+    },
+    {
+      "path": "docs/evaluation/extension-functions-2026-10-17/cache/integrity.json",
+      "files": 39
+    },
+    {
+      "path": "docs/evaluation/extension-functions-2026-10-17/cursor/integrity.json",
+      "files": 49
+    },
+    {
+      "path": "docs/evaluation/extension-functions-2026-10-17/integrity.json",
+      "files": 152
+    },
+    {
+      "path": "docs/evaluation/extension-functions-2026-10-17/navigation/integrity.json",
+      "files": 37
+    },
+    {
+      "path": "docs/evaluation/live-rescreen-2026-10-17/integrity.json",
+      "files": 32
+    },
+    {
+      "path": "docs/evaluation/live-screening-2026-10-17/integrity.json",
+      "files": 35
+    },
+    {
+      "path": "docs/evaluation/node24-followup-2026-10-17/integrity.json",
+      "files": 47
+    },
+    {
+      "path": "docs/evaluation/permission-gates-2026-10-17/integrity.json",
+      "files": 9
+    },
+    {
+      "path": "docs/evaluation/plan-continuation-2026-10-17/integrity.json",
+      "files": 12
+    }
+  ],
+  "local_markdown_links_verified": 163,
+  "private_host_path_scan": "PASS",
+  "scratch_and_vendor_excluded": "PASS",
+  "derived_exports": [
+    "node24-followup-2026-10-17/publication-export.json",
+    "extension-audit-2026-10-17/publication-export.json"
+  ],
+  "historical_run_receipts_modified": false
+}

package/docs/evaluation/publication-2026-10-17/review.json

@@ -0,0 +1,21 @@
+{
+  "kind": "independent-read-only-publication-review",
+  "status": "PASS",
+  "source_digest": "sha256:922f78c2f4a2f85673606fb45a3776fa5246da47c1f7a7862fd87fe08727bbfe",
+  "initial_blocking_findings": 1,
+  "resolved_findings": [
+    "T2/T4 no longer accept exit zero without assertion completion; both premature-exit regressions and genuine fixes are covered.",
+    "Completion uses FD3 instead of a temporary file, eliminating the new worker-timeout completion-directory leak.",
+    "No production src, public MCP or direct dependency changes.",
+    "Current source checks and historical source-bound live decisions remain distinct."
+  ],
+  "node22_type_error_diagnosis": "Corrected before final validation; controller also verified Node 22.23.2 typecheck and eight oracle cases.",
+  "publication_audit": {
+    "private_interpreter_path": "Explicit derived export with old/new hashes; original locally preserved.",
+    "credentials_or_live_prompts_found": false,
+    "vendor_or_scratch_files_intended_for_git": false,
+    "route_metadata": "Names and auth-presence/type metadata intentionally retained; no secret values."
+  },
+  "reviewer_mutations": 0,
+  "reviewer_provider_calls": 0
+}

package/docs/evaluation/s5-decision-inputs-2026-10-18/README.md

@@ -0,0 +1,16 @@
+# Sprint 5 decision inputs, 2026-10-18
+
+Research and decision inputs from [Sprint 5](../../sprints/2026-10-18-s5-maintenance-orchestration.md).
+None of them changes the public MCP contract or authorizes a live run.
+
+| Issue | Note | Outcome |
+| --- | --- | --- |
+| #89 | [Claude Code projection probe](claude-projection/README.md) | Provider-free probe on a declared synthetic route (Claude Code 2.1.301, `--bare`): q1 output schema **not observed**; q2 **one** tool-result representation observed; q3 deferred tool search **unmeasurable** in bare mode, **observed** on a non-bare route (attempts 4 and 5); q4 cumulative controller input per M1 case **not measured** (needs its own approval). Before/after #88+#90 on this route: request `tools[]` 7,144 → 6,325 bytes |
+| #91 | [Bounded wait](bounded-wait.md) | Decision inputs; decision deferred until the #93 A/B |
+| #92 | [Worker usage](worker-usage.md) | Usage is per assistant response in the public SDK; no per-turn aggregate; no contract change |
+
+Claude Code 2.1.301 opens MCP with a `server/discover` request. The M1 frame proxy
+(`eval/profiles/token-live-proxy.ts`) rejected it as fatal; it now forwards exactly
+that request form (defined by the pinned MCP SDK) and counts it. A Claude Code run
+behind the proxy has not been tried end to end; the probe launches its fixture
+server directly.

package/docs/evaluation/s5-decision-inputs-2026-10-18/bounded-wait.md

@@ -0,0 +1,78 @@
+# Decision inputs: bounded turn wait (#91)
+
+Date: 2026-10-18. Base main `612fbcb`. Decision inputs only: no `waitMs`, no
+`pi_turn_wait` and no recommendation to implement. The A/B prepared for #93 must
+run, with its own approval, before the decision. A new optional argument changes
+the public contract: minor release and its own decision (ADR 0003, Versioning).
+
+## Measured facts
+
+From the [M1 pilot, attempt 3](../token-footprint-2026-10-17/m1-pilot/README.md)
+(Codex 0.162.0 controller, one route, synthetic tasks):
+
+| Case | MCP calls | `pi_turn_get` | Cumulative input (cached subset) | Output |
+| --- | ---: | ---: | ---: | ---: |
+| L1 one read | 9 | 2 (1 running, 1 terminal) | 171,034 (153,984) | 1,074 |
+| L2 one repair | 10 | 3 (2 running, 1 terminal) | 219,683 (201,344) | 1,204 |
+| L3 two reads + follow-up | 18 | 8 (4 repeated an already terminal turn) | 396,699 (337,792) | 2,523 |
+
+- Input is cumulative over every model request of a controller run; each extra
+  tool round trip re-sends the context. Most of it was reported as cached.
+  Cached input is not the same as newly billed text; no money value, net-of-cache
+  figure or worker usage is known.
+- Of L3's four repeated terminal reads, one was the deliberate invariance re-fetch
+  of the original turn after the follow-up; three were avoidable controller
+  re-reads.
+- The number of model requests per case was not recorded; the "about 8 requests"
+  in #91 is an estimate.
+- Running polls stayed at 1–3 per turn, as in ADR 0003's evidence. Revisit
+  trigger C ("more than about five polls per turn, or client limits or approval
+  prompts make polling costly") is not met on count; the cost dimension is newly
+  measured but not compared against an alternative yet.
+
+## Options
+
+| Option | Expected effect (inference unless sourced) | Constraints |
+| --- | --- | --- |
+| (a) Skill guidance only (#86: consume a terminal turn once, cadence 10 s then 15–30 s) | Removes avoidable terminal re-reads (three in L3); does not shorten running polls | No contract change; obedience unmeasured |
+| (b) Optional bounded wait on `pi_turn_get` (`waitMs`, capped, default 0) | One call could span a wait window, so running polls could fall | Contract change. Codex `tool_timeout_sec` defaults to 60 s ([config reference](https://learn.chatgpt.com/docs/config-file/config-reference)), so a cap well below that would be needed. Claude Code applies a hard wall-clock tool timeout that progress notifications do not extend ([MCP docs](https://code.claude.com/docs/en/mcp)). MCP cancellation (`notifications/cancelled`) can race a completed response ([spec](https://modelcontextprotocol.io/specification/2025-06-18/basic/utilities/cancellation)). Server: the registry has no completion signal today (`getTurn` is a plain read, `src/session-registry.ts:87`); a pending wait would have to wake on close, abort and shutdown (`src/session-registry.ts:167,194,228`; 15 s process deadline, `src/shutdown.ts:1`) |
+| (c) Client-side waiting (shell sleep, hooks) | A sleep through a tool is itself a round trip and may save nothing | No server change; differs per client and may trigger approval prompts; unmeasured |
+
+Not verified: Codex behavior on MCP progress and cancellation; whether the
+pinned MCP SDK passes a cancellation signal to tool handlers.
+
+## What the A/B must provide
+
+Per arm and case: model request count if the client reports it; cumulative input,
+cached subset and output as reported; `pi_turn_get` split into running polls,
+first terminal reads, avoidable repeated terminal reads and labelled invariance
+re-fetches; wall-clock time; independent acceptance; cleanup; tool timeouts,
+approval prompts and cancellations. Decision criteria, fixed before any run:
+quality retained in every pair, and a repeatable difference beyond pair-to-pair
+spread before any contract change is considered. The A/B as prepared compares
+(a) against the baseline; it does not test (b).
+
+## Gate order
+
+1. #86 skill guidance (implemented in this sprint, live effect unmeasured).
+2. #93 A/B with its own current approval.
+3. #91 decision against the criteria above. If a wait is still wanted: its own
+   decision record, contract tests, documented cap and cancellation behavior and
+   a minor release. If rejected: restate trigger C with the cost dimension.
+
+## A/B outcome and decision (2026-10-18; confirmed by the maintainer the same day)
+
+The [A/B](../m1-ab-proposal-2026-10-18/results/README.md) ran four pairs on the
+Codex route. Both arms kept quality; running polls stayed at 1–3 per turn in both
+arms; the variant with the #86 skill guidance used fewer or equal calls and
+mostly lower cumulative (largely cached) controller input, with no consistent
+uncached difference.
+
+Decision: **do not add a bounded wait
+now** (no `waitMs`, no `pi_turn_wait`). Polling per turn stays below ADR 0003's
+count trigger, and the measured lever is fewer avoidable calls, which skill
+guidance already addresses without a contract change. Restate trigger C with the
+cost dimension: revisit when running polls routinely exceed about five per turn,
+or when the uncached controller input attributable to polling becomes material in
+a measurement like this one, or when a client's tool-call limits or approval
+prompts make polling costly.

package/docs/evaluation/s5-decision-inputs-2026-10-18/claude-projection/README.md

@@ -0,0 +1,151 @@
+# Claude Code projection probe (issue #89), 2026-10-18
+
+Provider-free probe of what Claude Code 2.1.301 sends on a **declared synthetic
+route**: a loopback Messages-API fake (`/v1/messages`, SSE), a disposable client
+home, and the existing MCP fixture server (`eval/profiles/token-projection-server.ts`,
+fake Pi adapter). No real credentials, provider, TLS interception or undocumented
+API. Source: `eval/profiles/token-claude-projection.ts`, CLI mode
+`--footprint-claude-offline`, unit test `test/token-claude-projection.test.ts`.
+
+Command shape (every run; temp paths omitted):
+
+```
+claude --bare -p --strict-mcp-config --mcp-config <owned json: fixture server> \
+  --output-format stream-json --verbose --model claude-sonnet-5-5 \
+  --allowedTools mcp__pi-projection__<tool> --no-session-persistence --max-turns 3 "<fixed synthetic prompt>"
+Harness invocation: node scripts/profile-evaluation.mjs --footprint-claude-offline --output <fresh dir>
+Non-bare variant (attempts 4 and 5): the same command line without --bare, invoked with
+  node scripts/profile-evaluation.mjs --footprint-claude-nonbare-offline --output <fresh dir>
+```
+
+The environment is built from scratch (PATH only inherited): fresh `HOME`,
+`CLAUDE_CONFIG_DIR`, `XDG_*` and `TMPDIR` inside an owned temp root, a fixed dummy
+`ANTHROPIC_API_KEY`, `ANTHROPIC_BASE_URL=http://127.0.0.1:<ephemeral>`,
+`CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1`, `DISABLE_TELEMETRY=1`,
+`DISABLE_ERROR_REPORTING=1`, `DISABLE_AUTOUPDATER=1`,
+`CLAUDE_CODE_DISABLE_TERMINAL_TITLE=1`, `ENABLE_TOOL_SEARCH=false|true`.
+Plain http loopback was accepted; a fresh config dir did not force onboarding or login.
+
+Files hold only byte sizes, counts, marker hit counts, booleans, safe labels and
+hashes; no request body, prompt, header or tool data.
+
+The probe runs on Linux only: its leftover-process check scans `/proc`, so it
+refuses other platforms up front rather than report cleanup it cannot show.
+
+## Attempts (all preserved)
+
+- [attempt-1](attempt-1/claude-projection.json): **INCONCLUSIVE, 1 run (pilot only).**
+  The pilot routed the MCP server through the existing byte-transparent frame
+  proxy (`token-live-proxy`). Claude Code 2.1.301 opens MCP with a
+  `server/discover` request, which the proxy's strict method allowlist treats as a
+  fatal frame, so the server stayed `pending` until the client's 30 s connect
+  timeout; the first model request then carried no fixture tool. (Method name and
+  the 30 s timeout were confirmed in two local diagnostic runs with `--debug-file`
+  and a logging stub server in scratch space; those logs are not kept.) This file
+  comes from the first harness version and is not reproducible from the committed
+  code. The proxy was not changed (it guards approved live runs); the committed
+  probe launches the fixture server directly, so server-side frame metrics are
+  not collected on this route.
+  Later update: the proxy now forwards exactly `server/discover` (a method defined by
+  the pinned MCP SDK 2.3.1, protocol revision 2026-07-28) and counts it in
+  `discover_requests`, with a provider-free test; this probe still launches the fixture
+  server directly and was not re-run behind the proxy.
+- [attempt-2](attempt-2/claude-projection.json): **PASS, 10 runs** (1 pilot, then
+  3 repetitions each for normal/tool-search off, normal/tool-search on,
+  domain-error/tool-search off). All runs: exit 0, 2 model requests (both
+  `/v1/messages?beta=true`, both main class), 0 auxiliary model requests, 0
+  `count_tokens`/`HEAD /api/hello` requests, dummy key matched, no `Authorization`
+  header, no leftover process, temp root removed, source and build digests
+  unchanged. Repetitions were identical in every measured size.
+
+- [attempt-3](attempt-3/claude-projection.json): **PASS, 10 runs**, same schedule,
+  run by the integrator after review fixes to the probe (decoded-body cap,
+  termination of leftover processes, Linux-only guard), on the Sprint 5 head
+  that includes #88 and #90. Attempt 2 ran on the base `612fbcb`, so the two
+  attempts are a before/after pair for the server's tool definitions on this
+  route. Every measured field is identical except: `pi_capabilities_get`
+  description 126 → 159 bytes and entry 328 → 361 bytes (#88); whole `tools[]`
+  7,144 → 6,325 bytes (−819, the same net change as the server's `tools/list`);
+  first request body 11,608 → 9,004 bytes (normal) and 11,605 → 9,001 bytes
+  (domain error). The body shrank by 1,785 bytes more than `tools[]`; that
+  remainder is observed, not explained. No leftover process, temp roots removed.
+
+- [attempt-4](attempt-4/claude-projection.json): **PASS, 7 runs, non-bare** (opt-in
+  mode `--footprint-claude-nonbare-offline`): the same probe without `--bare`, normal
+  scenario only, in the identical scrubbed environment (fresh owned `HOME` and
+  `CLAUDE_CONFIG_DIR`, PATH only, dummy key, loopback base URL, non-essential traffic
+  off, `--strict-mcp-config`, `--no-session-persistence`). Schedule: 1 pilot
+  (`ENABLE_TOOL_SEARCH=true`), then 3 repetitions each for `false` and `true`. The pilot
+  gates the repetitions on isolation facts only (not on the tool-search flow completing).
+  Isolation check, all 7 runs: exit 0; no request outside the loopback fake that the fake
+  could see (0 `count_tokens`, 0 `HEAD /api/hello`, 0 unexpected HTTP); every request on
+  `/v1/messages?beta=true`, class header absent, dummy key matched, **no `Authorization`
+  header**; the owned config dir held 2 files and the owned home 3 files after the run
+  (no credential file was needed; a fresh config dir did not force onboarding or login);
+  a per-run socket sampler (5 samples per run, a 380 ms client) saw 0 non-loopback
+  connections and 1 loopback connection in 5 of 7 runs; no leftover process, temp roots
+  removed. The sampler can miss short-lived sockets, so it is a sanity check only; see
+  attempt-5 for containment. The recorded binding digest predates one later test-only
+  edit (`test/token-claude-projection.test.ts`); the probe code in `eval/profiles` is
+  identical to the committed code.
+- [attempt-5](attempt-5/claude-projection.json): **PASS, 7 runs**, the same non-bare
+  schedule repeated once inside a loopback-only network namespace
+  (`unshare -rn`, `lo` up; an HTTPS request to a public host failed there), so that any
+  non-loopback attempt would have failed instead of leaving the machine. Every measured
+  size is identical to attempt-4 (all 7 summaries equal), exit 0 in every run. This is an
+  isolation confirmation, not a second measurement series.
+
+## Findings (attempt-2, this route only)
+
+| Question | Result |
+|---|---|
+| q1 output schema in `tools[]` | **Not observed.** The fixture tool entry has exactly the keys `name`, `description`, `input_schema`; no `outputSchema`/`output_schema` key at any depth, and the schema-only marker (`reloadPolicy`; `createdAt` for the error tool) occurs 0 times in the entry and in the whole `tools[]`. `pi_capabilities_get`: name 39 B, description 126 B, input_schema 119 B, entry 328 B. `pi_session_start`: 36 / 69 / 282 / 431 B. |
+| q2 result projection | **Observed.** In the request after the call, the fixture result is one `tool_result` whose content is a single string (not a block array) of 493 B (normal) / 93 B (domain error, `is_error: true`). The content-text marker occurs **1** time and no `structuredContent` key is present, although the server returned two equal representations (content text and `structuredContent`; verified for this fixture by the earlier Codex probe, not re-measured here). Domain error: error marker 1 hit. So only the text representation reaches the request, as in the Codex probe. |
+| q3 tool search off vs on | **Unmeasurable on this route.** `ENABLE_TOOL_SEARCH=false` and `=true` give identical requests: first body 11608 B (normal) / 11605 B (error), `tools[]` 11 entries / 7144 B, 0 `defer_loading`, no tool-search tool. A diagnostic debug run showed the client recognizes `ENABLE_TOOL_SEARCH=true` but logs "Tool search disabled: ToolSearchTool is not available" (bare mode); `--tools=default` did not change this. No workaround outside the documented bare route was tried. |
+
+Other observed values: the second (post-tool) request is smaller than the first
+(9011 B vs 11608 B normal, 8680 B domain error) while `tools[]` is unchanged; this
+was not investigated.
+
+## Findings (attempts 4 and 5, non-bare route, q3 only)
+
+| Question | Result |
+|---|---|
+| q3 tool search off vs on | **Observed**, on this synthetic route with `ENABLE_TOOL_SEARCH` forced by environment. All 3 repetitions per setting were identical, and attempt-5 matched attempt-4. |
+
+| Non-bare, normal scenario | `ENABLE_TOOL_SEARCH=false` | `ENABLE_TOOL_SEARCH=true` |
+|---|---|---|
+| model requests (all main class) | 2 | 3 (scripted: tool search, tool call, text) |
+| first request body | 68,067 B | 45,853 B (-22,214 B) |
+| whole `tools[]` in the first request | 28 entries, 50,363 B | 12 entries, 27,472 B (-22,891 B) |
+| `defer_loading` entries in the first `tools[]` | 0 | 1 |
+| tool-search tool in the first `tools[]` | no | yes |
+| fixture tool in the first `tools[]` | yes, 361 B entry, not deferred | **no** |
+| `tools[]` in the second request | 28 entries, 50,363 B (no search step) | 13 entries, 27,855 B; fixture entry present, 382 B, `defer_loading: true` |
+| later request bodies | 67,255 B (after the tool call) | 45,093 B (after the search), 45,896 B (after the tool call) |
+
+The first-request body shrinks by 677 B less than `tools[]` does, so other request
+content grows by 677 B with tool search on (`system` is 6,049 B in both). That remainder
+is observed, not explained, as is which single entry in the first `tools[]` carries
+`defer_loading` with tool search on.
+
+## Limits
+
+- Attempts 4 and 5 use a client without `--bare` but still in a scrubbed, empty
+  `HOME`/`CLAUDE_CONFIG_DIR` with `--strict-mcp-config`: no user settings, hooks, skills,
+  plugins, memory files or other MCP servers, so it is not a default user configuration
+  either. The byte differences above are bytes of this fixture server and this client
+  version, not tokens, cost or cache behavior; the SSE fake is the only model, and the
+  scripted tool-search call is synthetic. Isolation in attempt-4 rests on the scrubbed
+  environment and the loopback base URL; only attempt-5 is network-contained.
+- `--bare` is a minimal client (no hooks, skills, plugins sync, auto-discovered MCP,
+  keychain/OAuth), not a default user configuration. A default-configuration client
+  may send different `tools[]`, system text and auxiliary requests.
+- Whole-HTTP-body bytes are not token counts. No model, token, billing, cache or
+  real-route (Anthropic, Bedrock, Vertex, gateway) behavior is measured; the SSE
+  fake is the only model.
+- `ENABLE_TOOL_SEARCH` was forced by environment on a non-first-party base URL; the
+  result says nothing about default tool-search behavior.
+- Outbound traffic is not OS-contained; containment rests on the scrubbed
+  environment, loopback base URL and disabled non-essential traffic only.
+- Client version pinned to `2.1.301 (Claude Code)`; any other version is rejected.

package/docs/evaluation/s5-decision-inputs-2026-10-18/claude-projection/attempt-1/claude-projection.json

@@ -0,0 +1,126 @@
+{
+  "schema_version": "token-claude-projection-1",
+  "binding": {
+    "commit": "612fbcb976d4563ea597e87be56123055b782c1a",
+    "digest": "sha256:6bf167ff613c808f086db72b594cbe842218271eb1cffbb1d2af1c6ca800d197"
+  },
+  "build_digest": "sha256:b6c55172c69957bacd20b4c7a4beb457a4239fe7b52cbd3a1f822ccfe3b988bc",
+  "node": "26.11.1",
+  "fixture_digest": "sha256:89d7046116226de6fc138d56660c08c0a1225c1801d8a0fbb7b3b8895fe88314",
+  "route": "synthetic-loopback-messages",
+  "authentication": "fixed-dummy-api-key-disposable-client-home",
+  "client_version": "2.1.301 (Claude Code)",
+  "client_mode": "bare",
+  "started_at": "2026-10-18T12:03:55.626Z",
+  "ended_at": "2026-10-18T12:04:25.862Z",
+  "source_unchanged": true,
+  "build_unchanged": true,
+  "rows": [
+    {
+      "scenario": "normal",
+      "tool_search": "false",
+      "repetition": 0,
+      "pilot": true,
+      "exit_code": 0,
+      "timed_out": false,
+      "process_cleanup": true,
+      "line_integrity": true,
+      "server_cleanup": false,
+      "registered_server_cleanup": true,
+      "temp_removed": true,
+      "stdout_bytes": 5204,
+      "duration_ms": 30205.6341,
+      "stream": {
+        "lines": 5,
+        "json_errors": 0,
+        "event_types": {
+          "system": 3,
+          "assistant": 1,
+          "result": 1
+        },
+        "result_subtype": "success",
+        "result_is_error": false,
+        "num_turns": 1
+      },
+      "proxy_integrity": false,
+      "call_schedule_matched": false,
+      "server_frame": null,
+      "request_count": 1,
+      "main_request_count": 1,
+      "auxiliary_request_count": 0,
+      "auxiliary_http": {
+        "count_tokens": 0,
+        "hello_head": 0,
+        "unexpected": 0
+      },
+      "requests": [
+        {
+          "path": "messages_beta",
+          "wire_bytes": 7816,
+          "body_bytes": 7816,
+          "role": "main",
+          "request_class": null,
+          "model_matches": true,
+          "messages_count": 2,
+          "system_bytes": 454,
+          "stream": true,
+          "max_tokens_present": true,
+          "tool_results": [],
+          "projection": {
+            "tools_count": 3,
+            "tools_bytes": 3352,
+            "defer_loading_count": 0,
+            "tool_search_tool_present": false,
+            "schema_marker_hits_whole_tools": 0,
+            "fixture_present": false
+          },
+          "credential_header_present": true,
+          "credential_matches_dummy": true,
+          "authorization_header_present": false,
+          "beta_header_present": true,
+          "scripted_response": "text"
+        }
+      ],
+      "first_main_request_index": 0,
+      "post_tool_request_index": null,
+      "fake_invalid": false,
+      "invalid": false,
+      "passed": false
+    }
+  ],
+  "summaries": [
+    {
+      "scenario": "normal",
+      "tool_search": "false",
+      "repetition": 0,
+      "pilot": true,
+      "technical_pass": false,
+      "q1": {
+        "fixture_tool_present": false
+      },
+      "q2": null,
+      "q3": {
+        "first_request_body_bytes": 7816,
+        "tools_count": 3,
+        "tools_bytes": 3352,
+        "defer_loading_count": 0,
+        "tool_search_tool_present": false,
+        "fixture_in_first_tools": false,
+        "fixture_defer_loading": null
+      }
+    }
+  ],
+  "model_usage": null,
+  "money": null,
+  "real_cloud_projection": null,
+  "os_egress_containment": null,
+  "metric_semantics": {
+    "bytes": "direct-observation-of-serialized-utf8",
+    "marker_hits": "occurrences-in-tool_result-content-serialization",
+    "request_bytes": "whole-http-json-body-not-token-usage",
+    "model_usage": "unknown-no-model-executed",
+    "money": "unknown-no-meter-or-tariff",
+    "tool_search": "ENABLE_TOOL_SEARCH-env-forced-on-synthetic-route"
+  },
+  "harness_status": "INCONCLUSIVE"
+}