The planner proposes. The runtime disposes.

A verified tool-using coding agent: a deterministic state machine validates every tool call against a schema, checks permission policies, jails every path inside the workspace, and trusts nothing except a green test suite. Below: real executions from the committed deterministic benchmark, replayed step by step, and the jail's actual rejection messages.

Deterministic benchmark: 4/4 tasks, zero failed tool calls Live Gemini planner: 2/2 on the same runtime (2 rate-limit errors absorbed) Completion requires exit=0 test evidence - never a model's claim

Replay a verified run

These are committed execution traces from the deterministic benchmark (ScriptedPlanner; no network, byte-stable). Watch each proposed call pass through the runtime's gates - or stop at the one that rejects it. measured result

speed

Proposed action & gates

Observation (runtime record)

Files changed (proposed paths)

Benchmark record

Deterministic (reproducible)

Live LLM planner (recorded 2026-09-16)

Attack the jail (real rejections)

Each card replays a hostile tool call against the real ToolRegistry; the rejection text is captured output, not a mock. Open a card to see which gate stops it. captured output