Gemini native grep_search omits required metadata, then exits SUCCESS without a review

[sumitake]

Failure and impact

An ordinary managed Gemini review.repository call produced no substantive review. The native agent attempted grep_search without required toolSummary and toolAction; its tool validator rejected the call, then Agy emitted terminal SUCCESS with an empty response. The installed plugin correctly preserved the raw events as opaque recovered content, but the caller could not complete the required independent review and held the production change.

This is not a request to turn harmless tool errors into hard semantic failures or to strip native tools. The actionable failure is that the native agent did not recover from a correctable tool argument error and returned no assessment.

Exact environment and request

• Observed 2026-09-14 UTC on macOS arm64.
• Installed plugin agent-collab 7.0.6; signed provider runtime 5.0.7.
• Manifest digest: a11571908933c48fc301838d1cdb5d5f71433924af5b4b8419fd7b658695f440.
• Runtime artifact digest: 0d1897e08fc7ad13621681a60f9242d759adc04b4433eac93f53f196dd53d2f3.
• Wire contract: a675807e0ff5f0544d7cc9d659914ce2dadac9be8efd0fb56635815e5c3e842a; schema 12, protocol 5.
• Request ID e3232d2a-1682-40ab-9db9-af2bc0cbf8cd, work unit plan.
• review.repository, explicit target gemini, frontier/maximum, max_parallel 1, dispatch_requested true; no outer timeout.
• Caller used installed python3 <plugin-root>/coordinator.py, EOF-delimited JSON through subprocess.run(input=...), pipes, no PTY. native_restrictions.cwd, device and inode were derived from the real current worktree.
• Bounded read-only configuration-plan review; repository head was sealed and the payload supplied the live configuration findings, change sequence, rollback and acceptance checks. No instruction supplied a grep_search call or omitted its fields.
• Native init.permission_mode: proceed-in-sandbox; regular built-in tools present. No custom persona, tool allowlist, disabled sandbox, raw provider invocation or automatic replay.
• Native model identity was null in diagnostics; Google-family route name is not accepted as proof of actual model lineage. Native CLI version was not established by this bounded investigation.

Native evidence (only local path redacted)

Conversation ID: 1c4e6e52-4e14-49a2-a1d5-f92460b10207.

{"event":"step_update","step_update":{"conversation_id":"1c4e6e52-4e14-49a2-a1d5-f92460b10207","step_index":1,"state":"DONE","step_type":"agent_response","duration_seconds":1.622851,"usage":{"input_tokens":29785,"output_tokens":1939,"thinking_tokens":1884,"cache_read_tokens":0,"total_tokens":31724}}}
{"event":"step_update","step_update":{"conversation_id":"1c4e6e52-4e14-49a2-a1d5-f92460b10207","step_index":2,"state":"ACTIVE","step_type":"tool","tool_name":"grep_search","tool_info":{"name":"grep_search","parameters":{"Query":"contact","SearchPath":"<site-worktree>"}}}}
{"event":"step_update","step_update":{"conversation_id":"1c4e6e52-4e14-49a2-a1d5-f92460b10207","step_index":2,"state":"DONE","step_type":"tool","tool_name":"grep_search","duration_seconds":0.033386,"tool_info":{"name":"grep_search","parameters":{"Query":"contact","SearchPath":"<site-worktree>"},"error":{"type":"TOOL_ERROR","message":"invalid arguments:\n- missing properties 'toolSummary', 'toolAction'"}}}}
{"event":"result","result":{"conversation_id":"1c4e6e52-4e14-49a2-a1d5-f92460b10207","status":"SUCCESS","response":"","duration_seconds":9.680554,"num_turns":1,"usage":{"input_tokens":29785,"output_tokens":1939,"thinking_tokens":1884,"cache_read_tokens":0,"total_tokens":31724}}}

Public wrapper: status=ok, one recovered deltas content frame, content_truncated=false, execution_status=ok, native_model_identity=null, returncode=0, cleanup_confirmed=true; 1 observed provider attempt, replay_count 0, observed wall clock 14456ms. Complete preserved stream has no text_delta assessment and its final response is empty. Usage/output-token counts are not evidence that review text was delivered. Stderr was empty.

Bounded root-cause analysis

Proven proximate cause: native tool-call arguments violate the native tool's required schema. The agent issued only Query/SearchPath. The failure was explicit and available to the native runtime, but no corrected call or substantive final followed in the retained stream.

Likely upstream problem, not yet proven: disagreement between the schema/model-facing tool description and validator requirements, or model omission of the required metadata followed by defective native recovery/turn termination. The validator's error establishes required fields; it does not prove the model was shown the same schema. Need an upstream native schema snapshot and tool-loop trace to distinguish these.

Plugin behavior explained by source: inspected current workspace main 47d73dd8058b6e8a54647f66f71e4636f7a6fd33. agy_launch.build_argv builds the normal native sandboxed stream-json invocation, not the agent's tool arguments. native_carriers._agy_stream first extracts final response or agent text deltas, then preserves raw stdout when neither exists. That fallback explains the raw event stream labeled recovered content. This is source-level corroboration, not proof that every current source byte equals the installed signed artifact.

• Native invocation source
• Native carrier/recovery source

No evidence of a caller timeout, missing executable, source drift, permission denial, truncated output, or tool-capability removal in this attempt. Unknown whether a transient model error or deterministic native schema mismatch. Do not infer governance approval from SUCCESS/ok.

Recovery experiment and requested follow-up

Operator explicitly authorized exactly one Gemini recovery attempt, then Grok if that second attempt fails. Recovery keeps the installed plugin and native tool access unchanged, provides the tiny actual site diff inline alongside the complete plan, and identifies the missing native fields with instructions to consult the actual schema and recover from validation errors. The result will be appended here; this is a diagnostic experiment, not a demonstrated fix.

Please reproduce through the installed managed entrypoint with a synthetic repository; inspect the native model-facing grep_search schema versus the validator, and determine why a correctable tool error ends the turn without a final. Retain these producer events as a regression fixture. Preserve normal native capabilities and opaque evidence; avoid custom restrictive personas, blanket failed-tool rejection, invented authority, or automatic retries. Changes to signed runtime behavior must go through workspace source and a signed release.

Related prior incidents (similar symptoms, not proven identical causes)

• runtime: classify failed tools in salvaged protocol errors #131: failed-tool diagnostic visibility (closed in 6.2.2); this occurrence preserves the exact tool error, but loses substantive review entirely.
• runtime: ordinary governance reviews fail closed across adapters #144: ordinary reviews failing across native adapters.
• Grok single-turn review can exit 0 after DeadFailed without final verdict #166: Grok exits cleanly without a final after native failure.
• Workspace PR #3148: normal Agy invocation and opaque output preservation, merged 2026-09-07; do not regress to removed capability-stripping workarounds.

[sumitake]

Authorized recovery result

The single operator-authorized Gemini retry recovered substantive output, without changing the installed plugin, native permissions, tools, or runtime:

• Request 8035f43a-711b-4609-a91c-db57de52b63e, work unit plan-recovery.
• Same explicit Gemini route and frontier/maximum settings, 1 provider attempt, no automatic replay.
• Prompt added the actual 30-line prepared diff and identified the missing required tool fields, instructing the agent to consult the actual schema and recover normally.
• Returned explicit final, not truncated, APPROVE with concrete correctness, DNS, ordering, rollback, SEO and browser-cache analysis; 29,777ms wall time.
• Provider-reported input 30,848, output 6,862, thinking 6,335; cleanup confirmed and returncode 0.
• native_model_identity remains null. Substantive recovery and independently attributable governance evidence remain separate. Caller is using the explicitly authorized Grok fallback to close the latter gap.

This disproves deterministic inability to produce an assessment for this request class. It does not prove the schema defect is fixed, or that the metadata hint alone caused recovery: inline-diff context changed too, the recovered output does not include the retry's tool stream, and model sampling may differ. Do not close from one successful retry. A factorial/minimal native reproduction is needed to distinguish schema omission, model behavior and tool-loop recovery.

Full local request/result artifacts were retained; this public issue intentionally excludes the local absolute paths and the unrelated production configuration payload.

[sumitake]

A source recovery candidate is now in draft https://github.com/sumitake/agent-collab-workspace/pull/3171 (signed head ac062fa7ada12c96e389bc87065f335d8f1bfd2b); paired caller/environment guidance is in #215.

The reduced producer-shaped fixture confirms that the original stream contains a tool validation error and no assessment. The candidate uses the vendor-documented streaming-input conversation, retaining one native process. For read-only actions only, one correlated empty successful turn can receive a bounded completion message that preserves scope and asks the native agent to use its own current tool schema. A substantive answer, ambiguity, non-success status, another conversation, or a second empty turn does not trigger another completion. Tools and native permissions remain available; the caller does not resubmit or change providers.

Supervised protocol fixtures prove one process, retained native evidence, cumulative usage handling and cleanup. They do not prove that the native model-facing schema mismatch is repaired or that the actual model will self-correct. Native synthetic qualification and independent review remain pending, and the installed signed runtime has not changed. The issue remains open. Optional native model observations now carry source/scope, but the default Agy stream still does not establish executed model identity when no such metadata is emitted.

[sumitake]

Resolved for the reported adapter recovery failure in agent-collab 7.0.7 / runtime 5.0.8, through workspace PR #3171 and plugin PR #215.

The retained controlled native qualification goes beyond a fixture or a fresh successful retry:

• Request 6f1045fe-4bc0-4f32-9430-a284418b0209 actually produced the native grep_search validator error for missing toolSummary / toolAction, followed by SUCCESS with an empty response.
• One bounded completion in the same native process then returned the actual repository marker and a substantive plan assessment. The original tool error and both native results remain preserved in the returned evidence.
• One process attempt, zero replay, one continuation, confirmed cleanup, no content truncation, and unchanged fixture source. Normal native tools and sandbox remained enabled.
• Native response identity was gemini-3.8-flash, conversation 7c5e0ac2-f49c-4025-991b-04f0d8e42846, step 9. Recomputed trimmed final-response SHA-256 matches the response-bound identity: f286ac38d003c400f18e5b8ba495b608e0585af2285fb829c70b70853daa69f8.

The qualified candidate's native carrier and generation-evidence source files are byte-identical to the released runtime build source. All 103 focused recovery, routing and provenance tests passed again during this closeout.

Correction to the later release-closeout summary: controlled native tool-error/empty-turn recovery was qualified; the retained raw stream and PR #3171 qualification record establish this. The earlier summary's blanket statement that this case remained unqualified was too broad.

Closing the actionable failure to recover and deliver an assessment. This controlled induction does not prove why the upstream model originally omitted metadata, guarantee that it will never do so again, or qualify every historical native failure. Those broader denied-input, interpreter, broken-pipe and other empty-output variants remain open in https://github.com/sumitake/agent-collab-workspace/issues/3166. No unavailable result is converted into approval and no uncertain mutation is replayed.