Valid JSON is only the first boundary. The shape can be correct while the requested tool is unauthorized, its arguments are unsafe, or the tool returns data the rest of the application should not trust.

This runtime puts schemas on both sides of the model/tool boundary. It uses Pydantic validation, a hard attempt budget, typed failures, and an explicit registry that validates tool arguments and results around application-owned code. Plain prose never becomes a tool call, and provider failures stop rather than entering a blind retry loop.

The evidence is intentionally modest. Hermetic tests with scripted models and deterministic tools cover malformed output, recovery budgets, authorization, and result validation. There is not yet a frozen provider-response corpus or enough provider-specific integration evidence to claim broad runtime reliability.

Read the design

• Architecture and attempt semantics
• Test coverage and evidence limits
• Explicit tool-authority decision
• Experiment status