Advanced: raw session exec
runtime_session_exec[advanced/internal] Raw session exec on an already-open session_id (FragGate-admitted). Not fraggate_call and not runtime_run auto-open. Use this when you already have a session_id and were asked for raw session exec. Do not use it for the default agent exec path or opening a session; use fraggate_call or runtime_session_open instead. Side effects are operation-dependent (read, write, or refuse). Does not mint a session_id — missing id fails before admit. Sealed sessions refuse session_closed (409); TTL 6h refuses session_expired (410); receipt cap 64 refuses receipt_cap (409). Rate-limited (exec). Binding-only ops stay per-op proxy_fallback. Prefer fraggate_call. session_id or id, plus slug and op, are required. payload is optional and engine-specific; leftover keys are not auto-payload the way fraggate_call leftover keys are. Unknown slugs refuse FG-HALLUC-TOOL; stubs refuse FG-STUB. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns exec result with engine_slug, engine_op, engine_digest, ran_in, receipt, and refusal when gated.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | Alias of session_id. The door accepts either key; do not send two different values. | |
| op | Yes | Required allowlisted op. Stubs refuse FG-STUB. UI aliases still forward only after FragGate admit. | |
| slug | Yes | Required catalog slug to exec. Alias: product. Unknown slugs refuse FG-HALLUC-TOOL. This tool does not auto-open. | |
| confirm | No | Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write). | |
| dry_run | No | Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate. | |
| outcome | No | Optional sealed status. completed marks the attempt that finished the action. retry and failed are earlier attempts. Defaults from HTTP status when omitted. | |
| payload | No | Optional op payload object. Engine-specific. Unlike fraggate_call, leftover top-level keys are not used as payload. | |
| product | No | Alias of slug. Do not send two different values. | |
| attempt_n | No | Optional 1-based attempt number. Omitted increments from the prior session receipt with the same request_id, or 1. | |
| request_id | No | Optional logical request id shared by retries of one action. Same value across attempts. Omitted mints a new id for this exec. | |
| session_id | Yes | Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found. | |
| correlation_id | No | Optional client correlation id. Sealed on the session receipt. Null when omitted. | |
| parent_receipt_id | No | Optional prior attempt receipt hash. Null on the first attempt. Omitted links to the prior session receipt with the same request_id. Not FragGate ledger prev. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| code | No | FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*. | |
| door | No | Door name. The public door is fraggate. | |
| ran_in | No | Execution locale (for example aziel-runtime) when present. | |
| result | No | Exec body: session, receipt, engine_slug, engine_op, engine_digest, ran_in, refusal when gated. Errors: session_id required, session_closed, session_expired, receipt_cap, FG-HALLUC-TOOL, FG-STUB. | |
| status | No | HTTP-like status when present on wrappers (200 ok; 400+ error / refuse). | |
| display | No | Human-facing envelope. Show title and summary, then take the next input. | |
| receipt | No | Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one. | |
| refusal | No | Explicit refuse object, code, or message when the door or engine refused. | |
| engine_op | No | Resolved engine op when present (often inside result). | |
| ledger_tip | No | Ask/refuse ledger tip when the door stamped one. | |
| provenance | No | Provenance / input packet when the pipeline attached one. | |
| session_id | No | Raw session id when session plumbing was used. Hidden unless the user asked for the chain. | |
| engine_slug | No | Resolved engine slug when present (often inside result). | |
| limitations | No | Capability limitations or Remain-OFF notes when present. | |
| engine_digest | No | 64-hex engine_digest when a true in-process engine ran (often inside result). |