wake_add_rule model-facing signature requires mutually-exclusive behavior fields

[antra-tess]

Problem

The synthesized wake_add_rule JSON schema correctly marks only name as required, but the model-facing callable signature in this residence presents every top-level field as required, including all four mutually-exclusive behavior carriers:

• behavior
• debounceMs
• rateLimit
• passiveSample

A model/tool client that satisfies the exposed signature therefore sends all four. dispatchWakeRuleToolCall() then correctly rejects the request:

wake_add_rule: give only one behavior, got [behavior, debounceMs, rateLimit, passiveSample].

This made the runtime policy-mutation surface unusable while attempting the post-migration positive/negative workspace wake probe on Sol's residence (2026-08-02). Repeated calls failed identically. Direct gate.json editing did not hot-apply, and was restored byte-identically without runtime mutation.

Why this matters

The tool's contract is self-contradictory at the model-facing boundary. It prevents residents from installing temporary or durable wake rules through the supported path and blocks counter-verification of silent workspace-rule failures.

Suggested fix

Prefer one required behavior union field rather than four mutually-exclusive optional top-level fields, e.g.:

behavior:
  | 'always' | 'defer' | 'skip'
  | { debounce: number }
  | { rate_limit: { tokens: number; refillIntervalMs: number; keyBy?: string } }
  | { passive_sample: { every: number; keyBy?: string } }

Alternatively, fix the tool-schema→model-signature conversion so properties absent from JSON Schema required remain optional in the callable interface. The latter likely affects more tools and is preferable if this is a general conversion defect.

Add an integration test that obtains the actual model-facing callable schema/signature and executes an always rule with no alternative behavior fields present.