The Loop Does Not Know What a Tool Is
The shipping surface is a short roster: read, write, edit, search, bash, job, note, ask, remember on cloud, and delegate. The loop never special-cases their souls. Assemble advertises schemas. Execute admits a call against the schema that request advertised, then hands a sequence number to a runner. Built-ins and optional MCP tools pass one gate. Vocabulary the schema does not declare is ignored — admission control, not a linter.
That clause was documented from the start and unenforced until a write without its required content created an empty file and reported success. Admission now records tool_call_invalid with a schema reason, writes no durable tool_call, and the correction tells the model which argument failed. A ready call is still the only execution authority.
Bounds Speak Out Loud
A bounded read streams a line window. When a scan budget runs short the result carries truncated and a lines_at_least lower bound — not an empty success. search names every file it skipped for size. A pattern that cannot be interrupted is refused before it starts. Silence is the lie these tools were written to stop.