agentforge-framework 0.2.1__tar.gz → 0.2.3__tar.gz

{agentforge_framework-0.2.1 → agentforge_framework-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentforge-framework
-Version: 0.2.1
+Version: 0.2.3
 Summary: A modular framework for coordinating specialized software agents.
 Author: Yash Mhatre
 License-Expression: Apache-2.0
@@ -145,7 +145,7 @@ without notice. See
 ```console
 $ pip install agentforge-framework
 $ agentforge --version
-agentforge 0.2.1
+agentforge 0.2.3
 ```
 
 That is the whole of it. The two routes below the naming note are for a machine
@@ -169,7 +169,7 @@ from the [latest release](https://github.com/yashmhatre/AgentForge/releases/late
 and install the file:
 
 ```console
-$ pip install agentforge_framework-0.2.1-py3-none-any.whl
+$ pip install agentforge_framework-0.2.3-py3-none-any.whl
 ```
 
 Publishing a release is a wizard rather than a checklist:
@@ -200,6 +200,14 @@ What each release contains is in [CHANGELOG.md](CHANGELOG.md).
 
 AgentForge never touches a model API and handles no credentials of its own. Whatever your coding-agent CLI is already authenticated with is what a Run costs.
 
+### Editors and IDEs
+
+AgentForge is a terminal tool. It runs fine from an IDE's terminal, but the IDE is not a Provider and its assistant is not one either.
+
+**Antigravity IDE cannot be a Provider** ([#101](https://github.com/yashmhatre/AgentForge/issues/101)). Checked by running it, so nobody has to derive it again: `antigravity-ide chat` accepts a prompt and reads stdin, which is the right shape for the argument vector — but it is a window launcher. Piping a prompt to it returns exit 0 immediately with `Reading from stdin via: …\code-stdin-XXXX` on stdout and nothing else, ever; the answer goes to a GUI session. A Provider adapter has to read the Agent's result off stdout, so there is nothing for `parse_output` to parse. The same is true of any editor CLI of this shape.
+
+**Do not run another agent against a checkout while a Run is going.** A Run commits every change to a file git already tracks, however it got there ([ADR-0015](docs/adr/0015-a-run-commits-what-it-declared.md)) — so a second agent's half-finished edits are committed into the Run's branch and attributed to a Role. Files nothing in the Run claimed are listed in the pull request body ([ADR-0023](docs/adr/0023-a-commit-names-what-nothing-claimed.md)), which makes it visible at Sign-off but does not prevent it. Use a separate clone.
+
 ## Commands
 
 | Command | What it does |
@@ -331,10 +339,21 @@ code rather than the verdict about the old code.
 
 Read [`CONTEXT.md`](CONTEXT.md) before writing anything, and [`docs/adr/`](docs/adr/) for the decisions that constrain it.
 
-## Tests
+## Changing AgentForge
+
+Clone it and install that clone editable. Never patch the installed copy.
 
 ```console
+$ git clone https://github.com/yashmhatre/AgentForge.git
+$ cd AgentForge
 $ pip install -e ".[dev]"
+```
+
+Editing `site-packages/agentforge_framework/` appears to work and is the one change nothing will catch: the local install diverges from what ships, so the thing that works is not the thing anybody else gets, and the fix is lost the next time the package is upgraded. If a Run is failing badly enough that patching the install looks like the way forward, that is a bug worth filing — [#101](https://github.com/yashmhatre/AgentForge/issues/101) is what happened the last time somebody reached for it.
+
+## Tests
+
+```console
 $ pytest
 ```
 

{agentforge_framework-0.2.1 → agentforge_framework-0.2.3}/README.md

@@ -127,7 +127,7 @@ without notice. See
 ```console
 $ pip install agentforge-framework
 $ agentforge --version
-agentforge 0.2.1
+agentforge 0.2.3
 ```
 
 That is the whole of it. The two routes below the naming note are for a machine
@@ -151,7 +151,7 @@ from the [latest release](https://github.com/yashmhatre/AgentForge/releases/late
 and install the file:
 
 ```console
-$ pip install agentforge_framework-0.2.1-py3-none-any.whl
+$ pip install agentforge_framework-0.2.3-py3-none-any.whl
 ```
 
 Publishing a release is a wizard rather than a checklist:
@@ -182,6 +182,14 @@ What each release contains is in [CHANGELOG.md](CHANGELOG.md).
 
 AgentForge never touches a model API and handles no credentials of its own. Whatever your coding-agent CLI is already authenticated with is what a Run costs.
 
+### Editors and IDEs
+
+AgentForge is a terminal tool. It runs fine from an IDE's terminal, but the IDE is not a Provider and its assistant is not one either.
+
+**Antigravity IDE cannot be a Provider** ([#101](https://github.com/yashmhatre/AgentForge/issues/101)). Checked by running it, so nobody has to derive it again: `antigravity-ide chat` accepts a prompt and reads stdin, which is the right shape for the argument vector — but it is a window launcher. Piping a prompt to it returns exit 0 immediately with `Reading from stdin via: …\code-stdin-XXXX` on stdout and nothing else, ever; the answer goes to a GUI session. A Provider adapter has to read the Agent's result off stdout, so there is nothing for `parse_output` to parse. The same is true of any editor CLI of this shape.
+
+**Do not run another agent against a checkout while a Run is going.** A Run commits every change to a file git already tracks, however it got there ([ADR-0015](docs/adr/0015-a-run-commits-what-it-declared.md)) — so a second agent's half-finished edits are committed into the Run's branch and attributed to a Role. Files nothing in the Run claimed are listed in the pull request body ([ADR-0023](docs/adr/0023-a-commit-names-what-nothing-claimed.md)), which makes it visible at Sign-off but does not prevent it. Use a separate clone.
+
 ## Commands
 
 | Command | What it does |
@@ -313,10 +321,21 @@ code rather than the verdict about the old code.
 
 Read [`CONTEXT.md`](CONTEXT.md) before writing anything, and [`docs/adr/`](docs/adr/) for the decisions that constrain it.
 
-## Tests
+## Changing AgentForge
+
+Clone it and install that clone editable. Never patch the installed copy.
 
 ```console
+$ git clone https://github.com/yashmhatre/AgentForge.git
+$ cd AgentForge
 $ pip install -e ".[dev]"
+```
+
+Editing `site-packages/agentforge_framework/` appears to work and is the one change nothing will catch: the local install diverges from what ships, so the thing that works is not the thing anybody else gets, and the fix is lost the next time the package is upgraded. If a Run is failing badly enough that patching the install looks like the way forward, that is a bug worth filing — [#101](https://github.com/yashmhatre/AgentForge/issues/101) is what happened the last time somebody reached for it.
+
+## Tests
+
+```console
 $ pytest
 ```
 

{agentforge_framework-0.2.1 → agentforge_framework-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentforge-framework"
-version = "0.2.1"
+version = "0.2.3"
 description = "A modular framework for coordinating specialized software agents."
 readme = "README.md"
 requires-python = ">=3.11"

{agentforge_framework-0.2.1 → agentforge_framework-0.2.3}/src/agentforge_framework/__init__.py

@@ -1,3 +1,3 @@
 """AgentForge — coordination of specialized software agents through reusable workflows."""
 
-__version__ = "0.2.1"
+__version__ = "0.2.3"

{agentforge_framework-0.2.1 → agentforge_framework-0.2.3}/src/agentforge_framework/agents/decomposer.py

@@ -45,6 +45,8 @@ from ..core.contracts import (
     Task,
 )
 from ..core.plan_format import (
+    RESULT_CLOSE,
+    RESULT_OPEN,
     SLICES_CLOSE,
     SLICES_OPEN,
     SPEC_CLOSE,
@@ -105,8 +107,9 @@ not publish the spec, do not open an issue, and do not apply a label.
 
 ## Required output
 
-End your reply with this block and nothing after it. Markdown inside it, not \
-JSON:
+End your reply with these two blocks, in this order, and nothing after them.
+
+First the spec. Markdown inside it, not JSON:
 
 {spec_open}
 ## Problem Statement
@@ -128,10 +131,22 @@ JSON:
 ...
 {spec_close}
 
+Then your own verdict:
+
+{result_open}
+```json
+{{"outcome": "completed", "summary": "one line on what the spec covers"}}
+```
+{result_close}
+
 Cover the whole source. Anything in it that reaches no user story reaches no \
 Issue and does not get built. Scale the spec to what you were given: a \
 one-sentence Task earns a short spec, and padding one out invents scope nobody \
-asked for.\
+asked for.
+
+If the source is too thin to synthesize without inventing most of it, write the \
+verdict block with `"outcome": "escalated"` and a summary naming what you need \
+the human to supply. Omit the spec block in that case.\
 """
 
 SLICES = """\
@@ -186,7 +201,9 @@ publish anything, do not open an issue, and do not apply a label.
 
 ## Required output
 
-End your reply with this block and nothing after it:
+End your reply with these two blocks, in this order, and nothing after them.
+
+First the cut:
 
 {slices_open}
 ```json
@@ -202,7 +219,19 @@ End your reply with this block and nothing after it:
   ]
 }}
 ```
-{slices_close}\
+{slices_close}
+
+Then your own verdict:
+
+{result_open}
+```json
+{{"outcome": "completed", "summary": "one line on how you cut it and why"}}
+```
+{result_close}
+
+If the spec cannot be cut without guessing at something it left open, write the \
+verdict block with `"outcome": "escalated"` and a summary naming what has to be \
+settled first. Omit the slices block in that case.\
 """
 
 #: What one approved Slice looks like when it is handed to a planning pass. The
@@ -298,6 +327,8 @@ class Decomposer:
                 cwd=cwd,
                 spec_open=SPEC_OPEN,
                 spec_close=SPEC_CLOSE,
+                result_open=RESULT_OPEN,
+                result_close=RESULT_CLOSE,
             ),
             cwd,
         )
@@ -311,6 +342,8 @@ class Decomposer:
                 cap=MAX_SLICES,
                 slices_open=SLICES_OPEN,
                 slices_close=SLICES_CLOSE,
+                result_open=RESULT_OPEN,
+                result_close=RESULT_CLOSE,
             ),
             cwd,
         )

{agentforge_framework-0.2.1 → agentforge_framework-0.2.3}/src/agentforge_framework/core/config.py

@@ -41,6 +41,13 @@ class Config:
     #: Command in the glossary's sense: nothing infers anything from it.
     test_suite: tuple[str, ...] = DEFAULT_TEST_SUITE
 
+    #: Whether the Context Pack comment publishes the symbols and import graph
+    #: it resolved, or only their counts. Off by default: the Issue already
+    #: carries the pack's file paths in the frozen Plan, and nothing else on it
+    #: carries private symbol names. A tracker whose audience matches the
+    #: code's turns this on. See ADR-0024.
+    publish_pack_inventory: bool = False
+
     def capability_for(self, provider: str) -> CapabilityTier:
         return self.provider_capabilities.get(provider, CapabilityTier.FRAGMENT)
 
@@ -55,7 +62,13 @@ def load_config(root: Path | str) -> Config:
     capabilities = dict(DEFAULT_CAPABILITIES)
     for name, provider in (data.get("providers") or {}).items():
         capabilities[str(name)] = CapabilityTier(provider["capability_tier"])
-    return Config(provider_capabilities=capabilities, test_suite=_test_suite(data))
+    return Config(
+        provider_capabilities=capabilities,
+        test_suite=_test_suite(data),
+        publish_pack_inventory=bool(
+            (data.get("context") or {}).get("publish_inventory", False)
+        ),
+    )
 
 
 def _test_suite(data: dict) -> tuple[str, ...]:

{agentforge_framework-0.2.1 → agentforge_framework-0.2.3}/src/agentforge_framework/core/issues.py

@@ -381,6 +381,7 @@ def render_context_comment(
     context: ContextPack,
     plugins: Sequence[tuple[str, str]] = (),
     skipped: Sequence[str] = (),
+    publish_inventory: bool = False,
 ) -> str:
     """The pack this Run's Agents were handed, recorded before the first one ran.
 
@@ -390,6 +391,14 @@ def render_context_comment(
     invocation (ADR-0010), so this is a record of a Run rather than a contract
     the next one reads back.
 
+    `publish_inventory` decides whether the resolved symbols and import graph
+    are named or only counted. Off by default: the Issue already carries this
+    pack's file paths in the frozen Plan, so the file list discloses nothing
+    new, while private symbol names and the graph between modules appear
+    nowhere else on the tracker (ADR-0024). The counts stay either way, because
+    a pack that resolved more or less than a reader expected is most of what
+    this comment is read for.
+
     `plugins` and `skipped` are the Plugins that answered for this Run and the
     ones that raised while being asked. Both are named for the same reason the
     pack is: a prompt that grew, or one that did not grow when a reader expected
@@ -418,16 +427,29 @@ def render_context_comment(
     lines += [f"**Files ({len(context.files)}):**", ""]
     lines += [f"- `{path}`" for path in context.files]
 
-    for label, values in (("Symbols", context.symbols), ("Reaches for", context.references)):
-        if values:
-            lines += [
-                "",
-                f"<details><summary>{label} ({len(values)})</summary>",
-                "",
-                ", ".join(f"`{value}`" for value in values),
-                "",
-                "</details>",
-            ]
+    inventory = (("Symbols", context.symbols), ("Reaches for", context.references))
+    if publish_inventory:
+        for label, values in inventory:
+            if values:
+                lines += [
+                    "",
+                    f"<details><summary>{label} ({len(values)})</summary>",
+                    "",
+                    ", ".join(f"`{value}`" for value in values),
+                    "",
+                    "</details>",
+                ]
+    elif any(values for _, values in inventory):
+        lines += [
+            "",
+            (
+                "Symbol and reference counts are in the heading; the names are not "
+                "published. The Issue already carries this pack's file paths in the "
+                "frozen Plan, and a reader diagnosing a Run reads them against the "
+                "repository. Set `context.publish_inventory: true` where the tracker's "
+                "audience is the code's audience (ADR-0024)."
+            ),
+        ]
 
     if context.conventions:
         lines += ["", "**Conventions:**", ""]

{agentforge_framework-0.2.1 → agentforge_framework-0.2.3}/src/agentforge_framework/core/project.py

@@ -142,6 +142,14 @@ gates:
     # The argument vector the `tests` Gate runs, in this repository.
     # {because}
     suite: [{suite}]
+
+context:
+  # Whether the Context Pack comment names the symbols and imports it resolved,
+  # or only counts them (ADR-0024). A Run posts that comment to the Issue, and
+  # a tracker can have a wider audience than the code — so the names are off
+  # unless this repository says otherwise. The file list is published either
+  # way: the frozen Plan on the Issue already carries it.
+  publish_inventory: false
 """
 
 

{agentforge_framework-0.2.1 → agentforge_framework-0.2.3}/src/agentforge_framework/core/repo.py

@@ -145,6 +145,21 @@ class Repository:
         self._git("push", "--set-upstream", "origin", branch)
 
 
+def unclaimed(committed: Iterable[str], declared: Iterable[str]) -> tuple[str, ...]:
+    """Of the paths committed, the ones nothing in the Run said it would touch.
+
+    ADR-0015 commits every change to a tracked file however it arrived, and its
+    reasoning holds as long as the only writers are the Agents and the commands
+    they were allowed to run. A second agent editing the same checkout breaks
+    that — its half-finished work is committed into the Run's branch and
+    attributed to a Role, and nothing about the file on disk says otherwise
+    (#101). This does not change what is committed; it names what nothing
+    claimed, so the disclosure reaches the human at Sign-off.
+    """
+    named = {_normalize(path) for path in declared}
+    return tuple(path for path in committed if _normalize(path) not in named)
+
+
 def _normalize(path: str) -> str:
     r"""A declared path in the spelling `git status` uses.
 

{agentforge_framework-0.2.1 → agentforge_framework-0.2.3}/src/agentforge_framework/core/runtime.py

@@ -24,7 +24,7 @@ from ..agents.decomposer import Approver, Decomposed, Decomposer, slice_task
 from ..agents.orchestrator import Exchange, Interviewer, Orchestrator, Planned
 from ..context.resolver import resolve_pack
 from ..providers import DEFAULT_PROVIDER, get_provider
-from .config import load_config
+from .config import Config, load_config
 from .contracts import (
     AgentResult,
     ContextPack,
@@ -64,7 +64,13 @@ from .registry import (
     fragments_for,
     gates_for,
 )
-from .repo import PreconditionFailed, Repository, branch_for_issue, open_repository
+from .repo import (
+    PreconditionFailed,
+    Repository,
+    branch_for_issue,
+    open_repository,
+    unclaimed,
+)
 from .workflow import Workflow, WorkflowError, load_workflow
 
 
@@ -144,7 +150,9 @@ class Forge:
 
     # --- preconditions -----------------------------------------------------
 
-    def _prepare(self, allow_commands: bool = False) -> tuple[Repository, GitHub, object]:
+    def _prepare(
+        self, allow_commands: bool = False
+    ) -> tuple[Repository, GitHub, object, Config]:
         """Every check that can fail for free, before anything is spent.
 
         Absent git, absent remote, absent `gh`, absent coding-agent CLI. A Run
@@ -157,11 +165,12 @@ class Forge:
             raise RunFailed(str(exc)) from exc
 
         github = GitHub(self.runner, repo.root)
+        config = load_config(repo.root)
         provider = get_provider(
             self.provider_name,
             self.runner,
             allow_commands=allow_commands,
-            config=load_config(repo.root),
+            config=config,
         )
         try:
             github.preflight()
@@ -169,7 +178,7 @@ class Forge:
         except (IssueError, RuntimeError) as exc:
             raise RunFailed(str(exc)) from exc
 
-        return repo, github, provider
+        return repo, github, provider, config
 
     # --- agentforge plan ---------------------------------------------------
 
@@ -208,7 +217,7 @@ class Forge:
         the caller supplies an approver that always says yes when the human
         asked for exactly that.
         """
-        repo, github, provider = self._prepare()
+        repo, github, provider, _config = self._prepare()
 
         # Only when interviewing: every stage is told to change nothing, and two
         # extra `git status` calls on an unattended pass buy nothing.
@@ -368,7 +377,7 @@ class Forge:
         off already suppresses them, and a Run with neither cannot say which of
         the two moved the total. See ADR-0016 for the three conditions.
         """
-        repo, github, provider = self._prepare(allow_commands=allow_commands)
+        repo, github, provider, config = self._prepare(allow_commands=allow_commands)
 
         if repo.is_dirty():
             raise RunFailed(
@@ -466,7 +475,10 @@ class Forge:
                     github.post_comment(
                         number,
                         render_context_comment(
-                            state.context, contributions(activation), activation.skipped
+                            state.context,
+                            contributions(activation),
+                            activation.skipped,
+                            publish_inventory=config.publish_pack_inventory,
                         ),
                     )
                 role = resolve_role(step.role)
@@ -535,14 +547,22 @@ class Forge:
             )
 
         changed = repo.changed_files()
+        declared = _declared_surface(state, results)
         committed = repo.commit_declared(
             f"{issue.title}\n\nImplements #{number} via AgentForge.",
-            _declared_surface(state, results),
+            declared,
         )
         # Left in the working tree on purpose (ADR-0015), and named rather
         # than dropped: the human at Sign-off is the only one who can say
         # whether an undeclared file was an Agent's work or its suite's.
         left = tuple(path for path in changed if path not in committed)
+        # The other half of the same disclosure. A tracked file is committed
+        # however it changed (ADR-0015), which is right when the only writers
+        # are the Agents and their commands, and is how a second agent sharing
+        # the checkout gets its work committed and attributed to a Role (#101).
+        # Naming these is the difference between a data-loss bug and a line at
+        # Sign-off.
+        unclaimed_paths = unclaimed(committed, declared)
         base = github.default_branch()
         # An empty working tree is only a failure when the branch has nothing on
         # it either. Plenty of Runs legitimately write nothing here: an audit
@@ -573,7 +593,7 @@ class Forge:
         repo.push(branch)
         url = github.open_draft_pr(
             title=issue.title,
-            body=_pr_body(number, state, results, committed, left),
+            body=_pr_body(number, state, results, committed, left, unclaimed_paths),
             head=branch,
             base=base,
         )
@@ -761,7 +781,7 @@ def _end(github: GitHub, issue: Issue, state: RunState) -> RunState:
     return state
 
 
-def _pr_body(number: int, state: RunState, results, committed, left=()) -> str:
+def _pr_body(number: int, state: RunState, results, committed, left=(), unclaimed=()) -> str:
     lines = [
         f"Closes #{number}.",
         "",
@@ -791,6 +811,21 @@ def _pr_body(number: int, state: RunState, results, committed, left=()) -> str:
             "",
         ]
         lines += [f"- `{path}`" for path in left]
+    if unclaimed:
+        lines += [
+            "",
+            "## Committed, but no Agent claimed them",
+            "",
+            (
+                "These are in the diff. Git already tracked them, so AgentForge committed "
+                "them however they changed (ADR-0015) — but neither the Plan nor any Agent "
+                "Result named them, so nothing in this Run says they are its work. Read "
+                "them before you sign off. Another agent or a person editing this checkout "
+                "while the Run was going is the reason worth ruling out."
+            ),
+            "",
+        ]
+        lines += [f"- `{path}`" for path in unclaimed]
     lines += [
         "",
         "---",

{agentforge_framework-0.2.1 → agentforge_framework-0.2.3}/src/agentforge_framework/core/skills.py

@@ -14,6 +14,13 @@ one task. `COMPOSED` says what each expands to, because a composite has to
 survive both Capability Tiers — natively it fans out through the Skill tool, and
 as a Fragment there is no tool to fan out with, so the delivery path inlines what
 it names.
+
+A skill's author can also forbid autonomous invocation outright, by marking
+`disable-model-invocation` in the frontmatter. ADR-0005 chose delivery from one
+input — what the Provider can do — and had none for what the skill permits, so a
+marked skill offered natively is refused by the Skill tool and the Role escalates
+instead of working. `fragment_only` reads the mark from the bundle as shipped, so
+the rule survives a refresh that marks a skill we have never heard of.
 """
 
 from __future__ import annotations
@@ -22,8 +29,11 @@ import json
 import sys
 from collections.abc import Sequence
 from dataclasses import dataclass, field
+from functools import lru_cache
 from pathlib import Path
 
+import yaml
+
 from .process import CommandRunner, SubprocessRunner
 
 SKILLS_ROOT = Path(__file__).resolve().parent.parent / "skills"
@@ -69,6 +79,74 @@ def expand(names: Sequence[str]) -> tuple[str, ...]:
     return tuple(ordered)
 
 
+#: The frontmatter key by which a skill's author says a model may not invoke it
+#: autonomously — only a human typing the command may.
+MODEL_INVOCATION_KEY = "disable-model-invocation"
+
+
+def _frontmatter(text: str) -> dict:
+    """The YAML block a SKILL.md opens with, or nothing if it has none."""
+    if not text.startswith("---"):
+        return {}
+    parts = text.split("---", 2)
+    if len(parts) < 3:
+        return {}
+    data = yaml.safe_load(parts[1])
+    return data if isinstance(data, dict) else {}
+
+
+@lru_cache(maxsize=1)
+def fragment_only() -> frozenset[str]:
+    """Skills the bundle forbids a model to invoke, read from the bundle itself.
+
+    Hand-listing these would have exactly the problem vendoring exists to
+    prevent: a refresh that marks a third skill would be picked up by nobody,
+    and the failure arrives as an escalation from a planning pass rather than as
+    anything a reader would connect to a bundle bump.
+
+    Frontmatter that will not parse counts as marked. Fragment delivery costs
+    tokens; getting this wrong the other way costs the Run.
+    """
+    marked = set()
+    for path in sorted(SKILLS_ROOT.iterdir()):
+        source = path / "SKILL.md"
+        if not source.is_file():
+            continue
+        try:
+            data = _frontmatter(source.read_text(encoding="utf-8"))
+        except yaml.YAMLError:
+            marked.add(path.name)
+            continue
+        if data.get(MODEL_INVOCATION_KEY):
+            marked.add(path.name)
+    return frozenset(marked)
+
+
+def forbids_model_invocation(name: str) -> bool:
+    """Whether a skill, or anything it composes, may not be model-invoked.
+
+    A composite is checked through its parts as well: natively it fans out
+    through the Skill tool, so a composite naming a marked skill would reach the
+    same refusal one indirection later.
+    """
+    marked = fragment_only()
+    return any(part in marked for part in expand((name,)))
+
+
+def split_delivery(names: Sequence[str]) -> tuple[tuple[str, ...], tuple[str, ...]]:
+    """Partition declared skills into the natively deliverable and the rest.
+
+    This is consulted before the Capability Tier, not after it. A marked skill
+    has no native delivery at any tier, so the Fragment is not the degraded form
+    here — it is the only one.
+    """
+    native: list[str] = []
+    fragment: list[str] = []
+    for name in names:
+        (fragment if forbids_model_invocation(name) else native).append(name)
+    return tuple(native), tuple(fragment)
+
+
 class SkillNotFound(LookupError):
     """A skill was requested that is not in the vendored bundle."""