Module validate 

JSON Schema validation of what an agent sends, before it reaches a component (ACT-SPEC.md §6.4, ACT-SESSIONS.md §2.1).

Two call sites: call-tool arguments against the tool’s parameters-schema, and open-session args against get-open-session-args-schema. Both spell the failure the same way — an std:invalid-args error that never reaches the guest — so a component cannot tell a host that rejected the call from one that never received it.

Who this protects

The component. Arguments are composed by an agent, which is a language model reading a schema and guessing; the schema is the component’s own statement of what it accepts. Checking it here means a component’s tool body starts from arguments that match its declaration, rather than from whatever a model produced.

That is why an unusable schema is not fatal (see Validator::compile): a component that ships one it cannot compile has opted out of a protection that exists for its benefit, and nothing else is harmed.

No remote $ref

A schema arrives from the component, so a $ref in it is guest-controlled text. boon resolves only resources registered with the compiler, and this module registers none — so an external $ref fails to compile rather than becoming an outbound request the component did not have to declare wasi:http for. That is the whole reason for the choice of validator.

Structs

Validator

A compiled schema, or the reason there is none.

Functions

arguments_as_json

Decode CBOR arguments into the shape a schema is written against.

invalid_args

The error a rejected call answers with.

session_args_as_json

Session args arrive as named CBOR values rather than one document.