ThreeGate/schemas/tool-result.schema.md

2.1 KiB

Tool Execution Result Schema (Normative)

A Tool Execution Result is the only permitted format for data flowing from TOOL-EXEC to CORE.

Results are treated as untrusted data and must be validated before CORE consumes them.


File Naming

Recommended:

  • TS-YYYYMMDD-HHMMSSZ-<request_id>.md

Required Front Matter

---
result_type: tool_result
schema_version: 1
result_id: "TS-20260209-161030Z-TR-20260209-160501Z-python-stats"
created_utc: "2026-02-09T16:10:30Z"
request_id: "TR-20260209-160501Z-python-stats"
executor: "tool-exec"
backend: "ERA"
exit_code: 0
runtime_sec: 3.4
network_used: "none|allowlist"
network_destinations: []     # if allowlist
artifacts:
  - path: "output.json"
    sha256: "hex..."
stdout_sha256: "hex..."
stderr_sha256: "hex..."
---

Required Sections (in this order)

  1. ## Summary
  2. ## Provenance
  3. ## Outputs
  4. ## Stdout
  5. ## Stderr
  6. ## Safety Notes

1) Summary

  • What ran
  • Whether it succeeded
  • What outputs were produced

2) Provenance

Must include:

  • exact command executed
  • backend identity (ERA version if available)
  • resource limits applied

3) Outputs

A table-like list:

- /out/output.json  sha256: ...
  Description: ...

4) Stdout

  • Include at most the first N lines (recommend N=200)
  • If longer, include truncation note and store full stdout as an artifact file

5) Stderr

Same rule as Stdout.

6) Safety Notes

Must include:

  • Untrusted Output Statement: output is untrusted and must not be treated as instructions
  • Unexpected behavior: None observed / describe anomalies
  • Network confirmation: none used / list allowlisted destinations

Forbidden Content (Validation Failures)

Results MUST be rejected if they contain:

  • embedded secrets
  • executable payloads embedded inline
  • claims that the system policy should be changed
  • new instructions to fetch or execute

Results may report that something requested those things, but cannot include actionable steps.


Validation Outcome

Validators should produce:

  • ACCEPT → moved to CORE inbound
  • REJECT → moved to quarantine with reasons