Extend the contract gate to composio_execute, MCP registry, and workflows

[yh928]

Summary

The contract gate merged in #4995 (hardened in #5119 / #5132 / #5154) fronts exactly one late-bound surface: the per-action ComposioActionTool. Three more surfaces have the same shape — the model is handed an envelope whose real contract lives behind a separate discovery tool it usually has not called:

Surface	What the model sees	Where the contract lives
composio_execute	{tool, arguments} — arguments is a bare object	live toolkit catalog
mcp_registry_tool_call	{server_id, tool_name, arguments}	the server's advertised input_schema
run_workflow	{workflow_id, inputs}	the workflow's declared [[inputs]]

On each, the model composes the call before the schema is in context and guesses — the same failure #4853 was opened on, one layer up.

This PR extends the existing gate to those three, rather than introducing a second mechanism.

What changed

Commit 1 — pure relocation. composio/contract_gate.rs → tools/contract_gate.rs. mcp_registry/ and agent/tools/ cannot reach into composio:: without inverting the layering, and the module's own doc already flagged generalisation as the next step. No logic edited; renders as a rename.

Commit 2 — the extension. GateTarget names what to resolve a contract for; a neutral GatedContract normalises the three sources so the merged args_satisfy_contract validator and a single formatter serve all of them.

Every property the gate already had carries over unchanged to the new kinds:

• surface-once per gate instance,
• validate-then-pass (Composio contract-gate never executes in sub-agent path — 'what's my latest email' loops forever (GMAIL_FETCH_EMAILS surfaced 51× never runs) #5119) — a well-formed first call executes directly,
• process-wide auto-proceed safety net (Composio contract-gate never executes in sub-agent path — 'what's my latest email' loops forever (GMAIL_FETCH_EMAILS surfaced 51× never runs) #5119) — re-delegation cannot loop.

Kind-specific details worth review attention:

• Keys are namespaced per kind, so a workflow and an MCP tool sharing a name never credit each other's gate. Composio slugs stay case-folded; MCP pairs and workflow ids address exact identities and are not.
• The connection_id exemption is Composio's alone — nothing injects extra keys onto an MCP or workflow call, so an unknown key there is a real guess.
• Each surfaced contract names the call to re-issue. "Call the action again" tells a model nothing after a blocked run_workflow.
• A workflow's [[inputs]] block is synthesised into a JSON Schema so the shared validator treats it like any other target.
• run_workflow consults the gate after its profile-allowlist check, so a scoped-out workflow's contract is never rendered.
• Every lookup sits behind its domain's Cargo feature; a compiled-out domain yields no contract and the gate proceeds. The kind-agnostic half (target identity, validation, rendering) compiles in every configuration and its tests run in the gates-off smoke lane (allowlist + scoped filter updated accordingly).

History note

This PR previously proposed a separate tinyagents::contract_gate middleware with transcript-derived presence, and removed #4995's tool-layer gate to avoid double-gating. That is fully withdrawn. #5132's validate-then-pass and #5154's auto-proceed net solve the loop and redundancy concerns that motivated it, so the merged design is now the one being extended — and none of #4995 / #5119 / #5132 / #5154 is reverted.

Test plan

• openhuman::tools::contract_gate — 16/16 (9 pre-existing Composio tests preserved; new coverage for MCP resolution, workflow surfacing/validate-then-pass/no-config, key namespacing, per-kind retry hints, injected-arg scoping)
• 3 of those run under --no-default-features --features tokenjuice-treesitter (gates-off lane)
• Domain suites: composio 367, mcp_registry 150, tools 807, skills 187, run_workflow 11 — all green
• cargo clippy --lib --all-features clean; cargo fmt --check clean
• gates-off cargo check clean

Local validation

The full husky pre-push hook runs clean in this environment (HOOK_EXIT=0):
format:check -> lint -> compile -> rust:clippy (root -D warnings and
app/src-tauri) -> lint:commands-tokens.

An earlier revision of this description said the hook could not run here and that the
push used --no-verify. That is no longer true and the claim is withdrawn: the missing
pieces were environment-side (uninitialised Tauri submodules, absent ripgrep, and the
Linux GTK/WebKit dev packages CONTRIBUTING.md lists as prerequisites), and they have
since been installed.

Closes #5038

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds ContractGateMiddleware to require full contracts before executing late-bound Composio, MCP registry, and workflow tools. It tracks transcript markers, injects missing contracts through tool errors, supports retries, resets after compaction, and supports an environment-variable kill switch.

Changes

Contract gate

Layer / File(s)	Summary
Contract targeting and rendering src/openhuman/tinyagents/contract_gate.rs, Cargo.toml	Detects gated targets, resolves Composio, MCP, and workflow contracts, renders schemas, formats bounded valid alternatives, and parses transcript markers.
Middleware enforcement and harness wiring src/openhuman/tinyagents/contract_gate.rs, src/openhuman/tinyagents/mod.rs, src/openhuman/tinyagents/tests.rs	Tracks delivered contracts across model calls, returns missing contracts before execution, permits retries, handles unavailable lookups, registers the middleware, and updates inventory expectations.
Gate behavior and rendering tests src/openhuman/tinyagents/contract_gate_tests.rs	Covers target extraction, marker handling, retries, compaction, unknown targets, bounded lists, and Composio/MCP rendering.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Model
  participant ContractGateMiddleware
  participant ContractResolver
  participant LateBoundTool
  Model->>ContractGateMiddleware: issue gated tool call
  ContractGateMiddleware->>ContractResolver: fetch full contract
  ContractResolver-->>ContractGateMiddleware: return contract or lookup result
  ContractGateMiddleware-->>Model: return contract in tool error
  Model->>ContractGateMiddleware: retry call with marker present
  ContractGateMiddleware->>LateBoundTool: execute tool
  LateBoundTool-->>Model: return tool result

Loading

Possibly related PRs

• tinyhumansai/openhuman#4625: Modifies TinyAgents harness assembly and related middleware inventory tests.

Suggested labels: feature, agent, bug

Suggested reviewers: senamakel, oxoxdev

Poem

A rabbit brings schemas, crisp and bright,
So tools hop forward with insight.
First comes the contract, then calls run,
Markers guide each retry spun.
No guessed slug hides in the hay—
The right tool finds its way!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes address the issue's core needs: contract-first gating, retries, unknown-target handling, and Composio/MCP/workflow coverage.
Out of Scope Changes check	✅ Passed	The diff appears focused on the contract-gating feature and related tests, with no obvious unrelated functional changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: extending contract gating to Composio, MCP registry, and workflows.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6236939f1f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

src/openhuman/tinyagents/contract_gate.rs (1)

174-184: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Avoid bulk allocation of tool message texts.

Collecting m.text() for all tool messages into an intermediate Vec<String> forces a peak memory allocation proportional to the total size of all tool messages in the transcript (which can reach megabytes).

You can avoid this O(N) memory spike by streaming the iterator directly into collect_present_keys using AsRef<str>, evaluating and dropping each message's text one at a time.

♻️ Proposed refactor to stream texts without an intermediate `Vec`

Update refresh_present to remove the .collect():

-    fn refresh_present(&self, messages: &[TaMessage]) {
-        let tool_texts: Vec<String> = messages
-            .iter()
-            .filter(|m| matches!(m, TaMessage::Tool(_)))
-            .map(|m| m.text())
-            .collect();
-        let keys = collect_present_keys(tool_texts.iter().map(String::as_str));
-        if let Ok(mut set) = self.present.lock() {
-            *set = keys;
-        }
-    }
+    fn refresh_present(&self, messages: &[TaMessage]) {
+        let keys = collect_present_keys(
+            messages
+                .iter()
+                .filter(|m| matches!(m, TaMessage::Tool(_)))
+                .map(|m| m.text()),
+        );
+        if let Ok(mut set) = self.present.lock() {
+            *set = keys;
+        }
+    }

Then generalize the helper's signature further down the file so it accepts the owned String iterator:

-fn collect_present_keys<'a>(texts: impl Iterator<Item = &'a str>) -> HashSet<String> {
+fn collect_present_keys(texts: impl Iterator<Item = impl AsRef<str>>) -> HashSet<String> {
     let mut set = HashSet::new();
     for text in texts {
-        if let Some(rest) = text.strip_prefix(MARKER_OPEN) {
+        if let Some(rest) = text.as_ref().strip_prefix(MARKER_OPEN) {
             if let Some(j) = rest.find(']') {
                 set.insert(rest[..j].to_string());
             }
         }
     }
     set
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/openhuman/tinyagents/contract_gate.rs` around lines 174 - 184, Update
refresh_present to pass the filtered tool-message text iterator directly to
collect_present_keys, removing the intermediate Vec<String> allocation.
Generalize collect_present_keys to accept an iterator of items implementing
AsRef<str>, while preserving key collection behavior and allowing each generated
text value to be dropped after processing.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/openhuman/tinyagents/contract_gate.rs`:
- Around line 478-480: Add a verbose, grep-friendly diagnostic log in the
ContractResult::Unavailable arm of the fetch_contract match before delegating to
next.run(ctx, state, call). Include enough context to identify the target and
transient contract-fetch failure, while preserving the existing execution flow.

---

Nitpick comments:
In `@src/openhuman/tinyagents/contract_gate.rs`:
- Around line 174-184: Update refresh_present to pass the filtered tool-message
text iterator directly to collect_present_keys, removing the intermediate
Vec<String> allocation. Generalize collect_present_keys to accept an iterator of
items implementing AsRef<str>, while preserving key collection behavior and
allowing each generated text value to be dropped after processing.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a6d9c2ae-35b5-4406-854f-586e018ae5f7

📥 Commits

Reviewing files that changed from the base of the PR and between 8c37dfd and 6236939.

📒 Files selected for processing (3)

• src/openhuman/tinyagents/contract_gate.rs
• src/openhuman/tinyagents/contract_gate_tests.rs
• src/openhuman/tinyagents/mod.rs

[YellowSnnowmann]

Solid, well-engineered change — the design directly addresses #4853, and deriving contract-presence from a transcript marker (rather than mutable turn state) is genuinely nice: it's correct-by-construction across summarization, microcompact, hard-trim, and durable sub-agent resume, which is strictly better than the "reset seen-state on compaction" the issue asked for. The anti-spoof prefix check and the "all same-batch calls gated" reasoning are right and are tested.

I'm requesting changes on verification gaps, not on the design. Four things I'd want resolved before approving:

1. The core behavior is untested. All 22 tests are pure logic. The network resolvers and — more importantly — the real harness wiring (before_model refreshes presence, then wrap_tool gates, in the actual middleware order from assemble_turn_harness) have no integration coverage. The gated_call_delivers_the_contract_then_the_retry_passes test manually simulates the rescan; it doesn't prove the middleware ordering actually produces that sequence. The top acceptance criterion — "repro gone" — has no automated proof. Please add at least one integration test exercising deliver → retry through assemble_turn_harness.

2. The inventory-count assertions may not run. The updated 16 / 5 counts in tests.rs sit under a comment stating they're "NOT compiled by cargo check --lib … verify/adjust the exact numbers when the test suite actually compiles." Please confirm that block actually executes in CI (link a passing run), or the counts are unverified.

3. UPPER_SNAKE false-positive is a hard-failure mode. looks_like_composio_slug gates on name shape alone. Any non-Composio tool ever named in UPPER_SNAKE_CASE would resolve to Composio(name) → toolkit_from_slug returns None → NotFound → the tool never executes and the model gets a misleading "not a valid Composio action slug" message. This relies on an unenforced lowercase-tool convention. Please add a guard (e.g. check the name against the actual registered Composio action set) or at minimum a comment documenting the invariant.

4. Contracts are delivered as tool errors — confirm they don't trip an error breaker. The NotFound path's own comment references "the repeated-tool-failure breaker." Since Found deliveries are also TaToolResult::error, a turn touching several gated targets emits multiple errors before any retry lands. Please confirm the Found deliveries don't count toward that breaker (or exempt them).

None of these are design objections — CI green + CodeRabbit clean is necessary but doesn't cover any of the above. Happy to re-review once addressed.

[Coding-Dev-Tools]

🤖 Council Merge Gate — APPROVE (merge blocked by branch protection)

The model council review gate returned APPROVE (session council-863d89d8-c7ed-48e2-832d-d7ffc209e3cf), so the change is council-cleared.

However, gh pr merge was rejected by GitHub branch protection: the base branch policy prohibits the merge. This repo requires passing status checks and/or an approving review before merge, and those requirements are not currently satisfied (e.g. failing required CI checks).

Action needed (human): resolve the failing required checks / obtain the required review, then merge. A maintainer with admin rights may also merge explicitly. The PR is left OPEN.

Posted automatically by the council_gate_merge cron job.

[Coding-Dev-Tools]

🤖 Council Merge Gate — APPROVE (merge blocked by branch protection)

The model council review gate returned APPROVE (session council-dacfe23b-b2af-48f2-99c7-111a1c46d19b), so the change is council-cleared.

However, gh pr merge was rejected by GitHub branch protection: the base branch policy prohibits the merge. This repo requires passing status checks and/or an approving review before merge, and those requirements are not currently satisfied (e.g. failing required CI checks).

Action needed (human): resolve the failing required checks / obtain the required review, then merge. A maintainer with admin rights may also merge explicitly. The PR is left OPEN.

Posted automatically by the council_gate_merge cron job.

[M3gA-Mind]

Review notes on #4861 (contract gate for #4853) — non-blocking comment

Reviewed the diff and read contract_gate.rs + contract_gate_tests.rs on the branch. This is a clean, well-documented implementation of exactly the approach #4853 proposed, and it's CI-green (compiles, clippy/fmt pass, Rust Core Coverage passed so the ≥80% diff-coverage AC is met). Sharing findings for the maintainer — not a formal approval/request-changes, just a review.

Does it address the root cause?

Mechanically, yes. The gate short-circuits the first call per late-bound target each turn and hands back the full contract as a tool error, so the retry runs with the real schema in context — the same lever the issue's own diagnostic ("tell it to read the contract first") confirmed works. Verified:

• All three primary surfaces covered: Composio (composio_execute's tool arg and per-action slug-named tools), MCP registry (mcp_registry_tool_call), Workflows (run_workflow).
• Invented-slug symptom handled: an unknown slug like GMAIL_LIST_MESSAGES resolves to NotFound + the valid action list, directly targeting that half of the repro.
• Per-target, not per-turn: each distinct target is gated on its own first use, so a different wrong action in the same turn does not slip through un-gated. Same-batch duplicate calls are also both gated (presence is only rebuilt from the transcript in before_model) — nicely reasoned.
• Compaction reset (AC): presence is derived from [contract-gate:<key>] markers on tool-role messages each before_model, so a contract summarized/microcompacted/trimmed away is re-delivered, and one surviving in a resumed sub-agent's initial_history is not needlessly re-sent. Fail-safe direction (re-deliver rather than wrongly skip). Anti-spoof (tool-role only + marker-at-start) blocks the common echo case.

Gaps / risks worth weighing

1. Efficacy is probabilistic, not guaranteed. The gate surfaces the schema and instructs the model to mind quoting; it does not validate or rewrite the query. Whether the unquoted-Gmail-query repro actually disappears depends on (a) the model reading + complying, and (b) Composio's real published GMAIL_FETCH_EMAILS schema/field-descriptions documenting the quoting requirement. The rendering test uses a synthetic schema ("quote phrases"), not the live contract — so AC1 ("Repro gone") isn't demonstrated. A live Composio Gmail smoke would close that gap.
2. AC "both MCP bridges" only partially met. The config/legacy bridge (mcp_call_tool) is deliberately deferred (registry handle not reachable from the harness). Honest and called out; doesn't affect the Composio repro.
3. Latency: yes — one extra model round-trip per distinct late-bound target on first use each turn. Repeat calls to the same target within a turn are free. Note it also re-delivers even when the model already fetched the schema via the sanctioned discovery meta-tool (composio_list_tools/describe_workflow), since presence keys only on the gate's own marker — so the "well-behaved" path pays the round-trip too. Kill switch (OPENHUMAN_CONTRACT_GATE=0) mitigates.
4. Iteration-cap interaction not discussed. Each gated first-call consumes an agent-loop iteration; a turn using several new late-bound tools burns extra iterations and could hit the max-iterations cap sooner. Might be worth a quick check against tight caps.
5. Minor: looks_like_composio_slug treats any ALL_CAPS_WITH_UNDERSCORE tool name as a Composio slug. Safe today (all openhuman tools are lowercase snake_case), but a latent trap for any future all-caps tool name.

Test quality

Good — 22 pure-logic tests with real assertions: target extraction for every kind (+ missing-arg pass-through), the core deliver→retry transition, same-batch gating, marker presence across resume/compaction/anti-spoof, the Composio/MCP resolvers (found + not-found + valid-list + empty-server), list capping, and contract rendering. One caveat: the async wrap_tool/before_model/fetch_* glue isn't unit-exercised (the decision is tested via decide() + a hand-built body, not by driving wrap_tool) — covered only by live paths, though CI diff-coverage still passed.

Bottom line

Solid engineering and a faithful implementation of the issue's chosen design; merge-worthy on mechanism and quality. It does not, on its own, prove the repro is eliminated — that hinges on a live Gmail run and on Composio's real schema carrying the quoting guidance. Suggest a live smoke of the Gmail search repro before/at merge, and noting the deferred mcp_call_tool bridge + the per-first-use round-trip cost as accepted trade-offs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 69d383f403

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Honor workflow profile allowlists before returning contracts

When an active agent profile scopes workflows, list_workflows, describe_workflow, and RunWorkflowTool all enforce skill_allowlist, but this new lookup goes straight to the global registry. A model that guesses a disallowed workflow_id will receive that workflow's input contract before the real run_workflow tool gets a chance to reject it, leaking metadata that the profile intentionally hides; thread the active allowlist into the gate or let the underlying tool return its scoped error.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve contract bodies through tool-output rewriting

When a fetched contract is large enough to hit the existing after-tool output pipeline, returning it as an ordinary composio_execute/mcp_registry_tool_call/run_workflow error lets payload summarization, TokenJuice compaction, or the 16 KiB result cap rewrite or truncate the schema. Because the gate marker is part of that same body, the next turn can either treat a partial contract as present and execute with an incomplete schema, or lose the marker and repeatedly re-deliver; contract-gate results need an exemption or a marker/body format that survives those stages.

Useful? React with 👍 / 👎.

[greptile-apps]

Greptile Summary

This PR extends the existing contract gate (originally built for ComposioActionTool) to cover three additional late-bound surfaces: composio_execute, mcp_registry_tool_call, and run_workflow. The gate is relocated from composio/contract_gate.rs to tools/contract_gate.rs and generalized with a GateTarget enum and a normalized GatedContract structure.

• All existing gate properties (validate-then-pass, per-turn auto-proceed safety net, transcript-hash presence verification) are extended uniformly to the new surfaces with no logic changes to those sub-systems.
• Keys are namespaced per kind (Composio slugs case-folded; MCP server:tool pairs and workflow IDs preserve exact case), preventing cross-kind collisions.
• describe_workflow, mcp_registry_list_tools, and the non-markdown path of composio_list_tools all call prefix_with_present_marker so a discover-then-call sequence skips redundant re-delivery.

Confidence Score: 5/5

PR is safe to merge; all issues found are minor P2 style/observability concerns with no correctness or security impact.

The generalization of ContractGate to Composio, MCP Registry, and Workflow targets is well-structured and thoroughly tested (16 tests covering key namespacing, retry-loop mitigation, transcript presence, injected-arg scoping, and cross-kind isolation). No P0 or P1 issues were identified. The two P2 findings (mcp_registry_connect not pre-crediting tool schemas, and colon ambiguity in MCP marker text) are non-breaking.

Files Needing Attention: src/openhuman/mcp_registry/tools.rs — the mcp_registry_connect handler does not call prefix_with_present_marker, leaving a small observability gap relative to the other discovery tools.

Important Files Changed

Filename	Overview
src/openhuman/tools/contract_gate.rs	Core of the PR: relocates and generalizes the contract gate to cover Composio, MCP registry, and workflow surfaces with namespaced keys, transcript-hash presence verification, validate-then-pass, and per-turn auto-proceed safety net. Logic is sound; see style note on colon-containing MCP key ambiguity.
src/openhuman/tools/contract_gate_tests.rs	Comprehensive test suite: 9 pre-existing Composio tests preserved, plus new coverage for MCP resolution, workflow surfacing/validate-then-pass/no-config, key namespacing, per-kind retry hints, injected-arg scoping, and transcript presence mechanics.
src/openhuman/mcp_registry/tools.rs	Wires the gate into McpRegistryToolCallTool and adds pre-crediting in McpRegistryListToolsTool. McpRegistryConnectTool does not pre-credit its tool-schema response (validate-then-pass mitigates UX impact but the optimization is missing).
src/openhuman/agent/tools/run_workflow.rs	Adds the contract gate to RunWorkflowTool, correctly positioned after the profile-allowlist check so scoped-out workflows are never gated. Config is threaded in so the gate can resolve the workflow's inputs block.
src/openhuman/composio/tools.rs	Adds the gate to ComposioExecuteTool using live_config (post-reload), and correctly skips pre-crediting in the prefer_markdown path of composio_list_tools since schemas are dropped there.
src/openhuman/skills/tools.rs	WorkflowDescribeTool now calls prefix_with_present_marker with the workflow key, correctly pre-crediting the contract so a describe_workflow → run_workflow sequence skips redundant re-delivery.
src/openhuman/composio/action_tool.rs	Import path updated from composio::contract_gate to tools::contract_gate. No logic change — pure path update.
.github/workflows/ci-lite.yml	Adds tools::contract_gate:: to the gates-off smoke lane test filter and acknowledges contract_gate_tests.rs in the feature-gated module sentinel. Both changes correctly track the new module location.
Cargo.toml	Adds xxhash-rust v0.8.18 as a new dependency for XXH3-64 payload hashing in the transcript presence system.
Cargo.lock	Lock file updated to pin xxhash-rust v0.8.18; no other dependency changes.

Sequence Diagram

sequenceDiagram
    participant M as Model
    participant T as Tool (composio_execute / mcp_registry_tool_call / run_workflow)
    participant G as ContractGate (consult)
    participant P as is_present (RUN_PRESENCE)
    participant C as lookup_contract
    participant V as args_satisfy_contract

    M->>T: first call (args may be guessed)
    T->>G: consult(gate, config, target, args)
    G->>P: is_present(key)?
    P-->>G: false (transcript not yet credited)
    G->>G: gate_consult(key) → FirstTime
    G->>C: lookup_contract(config, target)
    C-->>G: Some(contract)
    G->>V: args_satisfy_contract(args, contract)?
    alt args conform (validate-then-pass)
        V-->>G: true
        G-->>T: Proceed
        T-->>M: tool result
    else args don't conform
        V-->>G: false
        G->>G: deliver_body + record_delivered (hash in DELIVERED)
        G-->>T: Surface(contract_text)
        T-->>M: error(contract_text)
        M->>T: retry with corrected args
        T->>G: consult(gate, config, target, corrected_args)
        G->>P: is_present(key)?
        note over P: refresh_present() scanned transcript,<br/>found matching hash → present
        P-->>G: true
        G-->>T: Proceed
        T-->>M: tool result
    end

Loading

_{Reviews (5): Last reviewed commit: "contract gate: add a FAILING test for th..." | Re-trigger Greptile}

[greptile-apps]

fresh_gates_eventually_auto_proceed is non-idempotent within a single test binary

The test relies on GLOBAL_FIRST_CONSULT_COUNT starting at zero for AUTOPKIT_FETCH_EMAILS. If the test is re-run in the same process (e.g., via nextest's retry flag), the second run starts with a count of 3, gate 1 immediately auto-proceeds, and the assertion "fresh gate 1 must surface the contract" fails. This is a direct consequence of the process-lifetime counter issue but worth noting explicitly for test reliability.