Claim unprocessed events from the proactive triage queue and take a time-boxed lease on each. Events whose lease lapses return to the queue automatically, so a crashed agent does not strand work.

Settle a claimed event with an outcome and an optional note. Use this once triage of an event has finished.

Return a claimed event to the unprocessed pool without settling it, so another worker can pick it up immediately instead of waiting for the lease to lapse.

Record an observation the agent made onto the triage queue so it becomes visible to other workers. Rejected when the queue is full.

Check an extracted document against a declared schema. Reports missing required fields, pattern violations, a confidence score, and a triage verdict. This is deterministic field validation over regex rules, not document understanding.

Rank the built-in knowledge corpus against a query using sparse TF-IDF vectors and cosine similarity. Lexical rather than semantic: it matches vocabulary, so paraphrased queries retrieve poorly. Returns measured retrieval latency and an explicit grounding verdict.

Park a sensitive action behind a human decision and return an authorization ticket. The confirmation code is never returned here: it must be supplied by an authorized human over an authenticated out-of-band channel, otherwise the gate proves nothing.

Verify a supervisor's confirmation code against a ticket and consume the ticket on success. The code is bound to the action name, a digest of the action parameters, and the expiry, and each ticket is single-use.

Book token spend against a session budget. Once a session exceeds its budget the server refuses further tool calls for it until the budget is raised; enforcement is server-side, not advisory.

Select which session the server's budget guard charges. The server refuses non-guardrail tool calls for any session that has exhausted its budget.