Close the execution loop: facet-fct agent

[rokoss21]

ROADMAP item 2.

The problem

run compiles one request and stops. So §16's Runtime Guard and Appendix F's provenance chain existed only in simulation — ToolExecutor was reachable from test_runner and its mocks, and from nowhere else. Deterministic agent execution was specified but never executed, which is also why §16 sat at 12/65 coverage with the rest blocked rather than merely unwritten.

The loop

facet-fct agent drives the turn cycle: model answers → guard decides → tool executes → result enters the next turn.

facet-fct agent --input contract.facet --script turns.json --artifact execution.json --exec

The model sits behind a ModelClient trait, so this is a runtime and not a vendor wrapper. ScriptedClient replays recorded turns — guard behaviour becomes testable without a network, and item 3 gets a seam to plug a real provider into.

What now holds in fact rather than on paper

A real guard decision. Taken before the call is initiated (§16.6.1a), against the effect declared on the @interface function:

seq=3 tool_expose   WeatherAPI.get_current   allowed  rule=expose-weather
seq=4 tool_call     WeatherAPI.get_current   allowed  rule=call-weather

A denial is still provenance. Drop the tool_call rule and the same script yields seq=4 … denied, the run stops with F454, the tool never executes — and the artifact is still written. A refused run is exactly when the record matters, so a denial is an outcome in AgentOutcome, not an early return.

One chain over the whole run. seq is contiguous across turns, and replaying the same script reproduces the head byte for byte — the property that makes an attestation over hash_chain.head worth anything.

Tools are registered from the contract's own @interface blocks, so a call to something the contract never declared has nowhere to land.

Also

run and agent share one compile path (compile_contract), so a turn built by the loop is byte-identical to the same contract compiled by run. Coverage rises 51 → 57.

Honest limits (in ROADMAP.md and docs/19-agent-loop.md)

• F455 is not reachable from the loop yet: it needs a condition that fails at evaluation time, not a policy that says no.
• Tool results are appended to the rendered payload as messages, so a turn is a patched payload rather than a recompiled contract. Fine for provenance; the next step is feeding results back through the document.
• The only client is ScriptedClient.

🤖 Generated with Claude Code