aziel-runtime

Advanced: raw session exec

runtime_session_exec

Execute a raw, gated operation on an already-open session by supplying session_id, slug, and op. Use confirm=true for mutations or dry_run=true to preview.

Instructions

[advanced/internal] Raw session exec on an already-open session_id (FragGate-admitted). Not fraggate_call and not runtime_run auto-open. Use this when you already have a session_id and were asked for raw session exec. Do not use it for the default agent exec path or opening a session; use fraggate_call or runtime_session_open instead. Side effects are operation-dependent (read, write, or refuse). Does not mint a session_id — missing id fails before admit. Sealed sessions refuse session_closed (409); TTL 6h refuses session_expired (410); receipt cap 64 refuses receipt_cap (409). Rate-limited (exec). Binding-only ops stay per-op proxy_fallback. Prefer fraggate_call. session_id or id, plus slug and op, are required. payload is optional and engine-specific; leftover keys are not auto-payload the way fraggate_call leftover keys are. Unknown slugs refuse FG-HALLUC-TOOL; stubs refuse FG-STUB. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns exec result with engine_slug, engine_op, engine_digest, ran_in, receipt, and refusal when gated.

Input Schema

TableJSON Schema

Name	Required	Description
`id`	No	Alias of session_id. The door accepts either key; do not send two different values.
`op`	Yes	Required allowlisted op. Stubs refuse FG-STUB. UI aliases still forward only after FragGate admit.
`slug`	Yes	Required catalog slug to exec. Alias: product. Unknown slugs refuse FG-HALLUC-TOOL. This tool does not auto-open.
`confirm`	No	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
`dry_run`	No	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.
`outcome`	No	Optional sealed status. completed marks the attempt that finished the action. retry and failed are earlier attempts. Defaults from HTTP status when omitted.
`payload`	No	Optional op payload object. Engine-specific. Unlike fraggate_call, leftover top-level keys are not used as payload.
`product`	No	Alias of slug. Do not send two different values.
`attempt_n`	No	Optional 1-based attempt number. Omitted increments from the prior session receipt with the same request_id, or 1.
`request_id`	No	Optional logical request id shared by retries of one action. Same value across attempts. Omitted mints a new id for this exec.
`session_id`	Yes	Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.
`correlation_id`	No	Optional client correlation id. Sealed on the session receipt. Null when omitted.
`parent_receipt_id`	No	Optional prior attempt receipt hash. Null on the first attempt. Omitted links to the prior session receipt with the same request_id. Not FragGate ledger prev.

Output Schema

TableJSON Schema

Name	Required	Description
`code`	No	FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
`door`	No	Door name. The public door is fraggate.
`ran_in`	No	Execution locale (for example aziel-runtime) when present.
`result`	No	Exec body: session, receipt, engine_slug, engine_op, engine_digest, ran_in, refusal when gated. Errors: session_id required, session_closed, session_expired, receipt_cap, FG-HALLUC-TOOL, FG-STUB.
`status`	No	HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
`display`	No	Human-facing envelope. Show title and summary, then take the next input.
`receipt`	No	Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
`refusal`	No	Explicit refuse object, code, or message when the door or engine refused.
`engine_op`	No	Resolved engine op when present (often inside result).
`ledger_tip`	No	Ask/refuse ledger tip when the door stamped one.
`provenance`	No	Provenance / input packet when the pipeline attached one.
`session_id`	No	Raw session id when session plumbing was used. Hidden unless the user asked for the chain.
`engine_slug`	No	Resolved engine slug when present (often inside result).
`limitations`	No	Capability limitations or Remain-OFF notes when present.
`engine_digest`	No	64-hex engine_digest when a true in-process engine ran (often inside result).

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv2.0.8Sep 27, 2026

changedInput schema / properties / confirm / description

Previous value: -"Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write)."New value: +"Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."

changedInput schema / properties / dry_run / description

Previous value: -"Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate."New value: +"Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."

Changed5 schema fields changedv2.0.3Sep 23, 2026

addedInput schema / properties / attempt_n

Added value: +{
+  "description": "Optional 1-based attempt number. Omitted increments from the prior session receipt with the same request_id, or 1.",
+  "minimum": 1,
+  "type": "integer"
+}

addedInput schema / properties / correlation_id

Added value: +{
+  "description": "Optional client correlation id. Sealed on the session receipt. Null when omitted.",
+  "nullable": true,
+  "type": "string"
+}

addedInput schema / properties / outcome

Added value: +{
+  "description": "Optional sealed status. completed marks the attempt that finished the action. retry and failed are earlier attempts. Defaults from HTTP status when omitted.",
+  "enum": [
+    "retry",
+    "failed",
+    "completed"
+  ],
+  "type": "string"
+}

addedInput schema / properties / parent_receipt_id

Added value: +{
+  "description": "Optional prior attempt receipt hash. Null on the first attempt. Omitted links to the prior session receipt with the same request_id. Not FragGate ledger prev.",
+  "nullable": true,
+  "type": "string"
+}

addedInput schema / properties / request_id

Added value: +{
+  "description": "Optional logical request id shared by retries of one action. Same value across attempts. Omitted mints a new id for this exec.",
+  "type": "string"
+}

Changed3 schema fields changedv2.0.2Sep 18, 2026

changedInput schema / description

Previous value: -"session_id (or id), slug, and op are required. Extra keys besides payload are not treated as the op payload."New value: +"session_id (or id), slug, and op are required. Extra keys besides payload are not treated as the op payload. Mutation requires confirm=true or dry_run=true."

addedInput schema / properties / confirm

Added value: +{
+  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
+  "type": "boolean"
+}

addedInput schema / properties / dry_run

Added value: +{
+  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
+  "type": "boolean"
+}

Changed9 schema fields changedv2.0.1Sep 14, 2026

changedInput schema / description

Previous value: -"session_id, slug, and op are required."New value: +"session_id (or id), slug, and op are required. Extra keys besides payload are not treated as the op payload."

addedInput schema / properties / id

Added value: +{
+  "description": "Alias of session_id. The door accepts either key; do not send two different values.",
+  "pattern": "^sess_[a-f0-9]{32}$",
+  "type": "string"
+}

changedInput schema / properties / op / description

Previous value: -"Required allowlisted op. Stubs refuse FG-STUB."New value: +"Required allowlisted op. Stubs refuse FG-STUB. UI aliases still forward only after FragGate admit."

changedInput schema / properties / payload / description

Previous value: -"Optional op payload object. Engine-specific."New value: +"Optional op payload object. Engine-specific. Unlike fraggate_call, leftover top-level keys are not used as payload."

addedInput schema / properties / product

Added value: +{
+  "description": "Alias of slug. Do not send two different values.",
+  "type": "string"
+}

changedInput schema / properties / session_id / description

Previous value: -"Required open session id. Alias: id."New value: +"Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found."

addedInput schema / properties / session_id / pattern
```
Added value: +"^sess_[a-f0-9]{32}$"
```

changedInput schema / properties / slug / description

Previous value: -"Required catalog slug to exec. Unknown slugs refuse FG-HALLUC-TOOL."New value: +"Required catalog slug to exec. Alias: product. Unknown slugs refuse FG-HALLUC-TOOL. This tool does not auto-open."

changedOutput schema / properties / result / description

Previous value: -"Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."New value: +"Exec body: session, receipt, engine_slug, engine_op, engine_digest, ran_in, refusal when gated. Errors: session_id required, session_closed, session_expired, receipt_cap, FG-HALLUC-TOOL, FG-STUB."

Changed7 schema fields changedv1.6.2Sep 12, 2026

addedInput schema / description

Added value: +"session_id, slug, and op are required."

addedInput schema / properties / op / description

Added value: +"Required allowlisted op. Stubs refuse FG-STUB."

addedInput schema / properties / payload / additionalProperties
```
Added value: +true
```

addedInput schema / properties / payload / description

Added value: +"Optional op payload object. Engine-specific."

addedInput schema / properties / session_id / description
```
Added value: +"Required open session id. Alias: id."
```

addedInput schema / properties / slug / description

Added value: +"Required catalog slug to exec. Unknown slugs refuse FG-HALLUC-TOOL."

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "additionalProperties": true,
+  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
+  "properties": {
+    "code": {
+      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
+      "type": "string"
+    },
+    "display": {
+      "additionalProperties": true,
+      "description": "Human-facing envelope. Show title and summary, then take the next input.",
+      "properties": {
+        "fields": {
+          "description": "Optional labeled scalars copied from the result for display.",
+          "items": {
+            "additionalProperties": true,
+            "properties": {
+              "label": {
+                "description": "Field label.",
+                "type": "string"
+              },
+              "value": {
+                "description": "Field value as text.",
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "next": {
+          "description": "What the agent should do after showing this output.",
+          "type": "string"
+        },
+        "summary": {
+          "description": "One-line outcome or refuse reason.",
+          "type": "string"
+        },
+        "title": {
+          "description": "Short result title for the AI client.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "door": {
+      "description": "Door name. The public door is fraggate.",
+      "type": "string"
+    },
+    "engine_digest": {
+      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
+      "type": "string"
+    },
+    "engine_op": {
+      "description": "Resolved engine op when present (often inside result).",
+      "type": "string"
+    },
+    "engine_slug": {
+      "description": "Resolved engine slug when present (often inside result).",
+      "type": "string"
+    },
+    "ledger_tip": {
+      "description": "Ask/refuse ledger tip when the door stamped one."
+    },
+    "limitations": {
+      "description": "Capability limitations or Remain-OFF notes when present."
+    },
+    "provenance": {
+      "description": "Provenance / input packet when the pipeline attached one."
+    },
+    "ran_in": {
+      "description": "Execution locale (for example aziel-runtime) when present.",
+      "type": "string"
+    },
+    "receipt": {
+      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
+    },
+    "refusal": {
+      "description": "Explicit refuse object, code, or message when the door or engine refused."
+    },
+    "result": {
+      "description": "Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."
+    },
+    "session_id": {
+      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
+      "type": "string"
+    },
+    "status": {
+      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
+      "type": "integer"
+    }
+  },
+  "type": "object"
+}

First observedv1.5.0Sep 5, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds rich behavioral context beyond the annotations: side-effect variability, sealed/TTL/receipt-cap refusal codes, rate limiting, mutation gated by confirm or dry_run, and refusal behavior for unknown slugs/stubs. This substantially informs the agent about operational outcomes without contradicting the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense and front-loaded with purpose and usage, and nearly every sentence provides operational value. It loses a point because it is lengthy and somewhat repetitive—for example, the 'confirm is consent, not tenant auth' clarification appears both in the description and in the input schema, and several error-code details are listed in a compressed run-on style.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 13-parameter, high-complexity tool, the description covers required fields, alias behavior, failure modes, mutation requirements, and preview semantics. An output schema exists, so return-value details need not be spelled out. The description plus schema leaves little ambiguity about how to invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaningful semantic clarifications not fully carried by the schema, such as 'leftover keys are not auto-payload the way fraggate_call leftover keys are' and the precise meaning of confirm versus dry_run. This lifts it above baseline, though the schema already carries much of the burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: 'Raw session exec on an already-open session_id (FragGate-admitted).' It immediately distinguishes itself from siblings by noting it is 'Not fraggate_call and not runtime_run auto-open.' This gives the agent a precise concept of the tool's purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use and when-not-to-use guidance: 'Use this when you already have a session_id and were asked for raw session exec' and 'Do not use it for the default agent exec path or opening a session; use fraggate_call or runtime_session_open instead.' It also recommends 'Prefer fraggate_call,' which further disambiguates alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.