Struct SpawnPayload 

pub struct SpawnPayload {

    pub instruction: String,
    pub output_contract: Option<String>,
    pub context_seed: Vec<SeedMessage>,
    pub intelligence: IntelConfig,
    pub mcp_servers: Vec<McpServerSpec>,
    pub a2a_peers: Vec<A2aPeerSpec>,
    pub tls_ca: Option<String>,
    pub aauth: Option<AAuthSettings>,
    pub gated_tools: Vec<String>,
    pub limits: Limits,
    pub telemetry: Telemetry,
    pub depth: u32,
    pub warm: bool,
    pub role: Role,
    pub turn: Option<Box<TurnSpec>>,
}

Everything a subagent needs to run, minted by the supervisor. The child takes none of these fields from its own request — depth in particular is derived by the supervisor from the caller’s handle, so a child cannot claim a shallower depth to buy itself more levels of delegation.

Fields

instruction: String

The task. For a delegated child this is the parent’s instruction argument; see also output_contract.

output_contract: Option<String>

Objective, required output format, and boundaries — a real delegation contract rather than a bare string, so the child’s result can be checked against something.

context_seed: Vec<SeedMessage>

The narrowed context the parent chose to share — never the parent’s full transcript. Passing only what the child needs keeps its context clean and stops a prompt injection landed in the parent from riding down the tree.

intelligence: IntelConfig

How to reach the LLM (env/flag-sourced; never logged).

mcp_servers: Vec<McpServerSpec>

The child’s scoped MCP server subset. Always a subset of the parent’s, because scope narrows monotonically down the tree: no child may reach a server its parent could not.

a2a_peers: Vec<A2aPeerSpec>

Declared remote-A2A delegation peers. Inherited by children like mcp_servers so a subagent can also delegate over A2A; the a2a.delegate self-tool dials these. #[serde(default)] so a frame that omits the field — the common case, with no peers configured — parses to an empty list.

tls_ca: Option<String>

Extra PEM CA file path for outbound TLS trust (--tls-ca, the private/in-cluster PKI anchor). PUBLIC material — a path to a CA certificate, never key bytes — so it may ride the payload. The child installs it process-wide before its first dial, so no dial can escape the anchor, and passes it on to its own children. #[serde(default)] so a frame that omits it parses as “no extra anchor”.

aauth: Option<AAuthSettings>

AAuth agent-identity settings, inherited by every subagent so the whole process tree signs MCP requests under ONE identity — a peer sees the tree as a single agent rather than a crowd of anonymous processes. The key file is a shared-fs path, like tls_ca, and no secret rides here: the enrollment token stays a {{secret:…}} template resolved in the child. #[serde(default)] so a frame that omits it parses as “no identity”.

gated_tools: Vec<String>

Tool names this child must NOT call directly, routing them up to the supervisor instead.

A subagent connects to its granted MCP servers itself and calls their tools without the supervisor ever seeing the call, which would put every security.policies rule out of reach for exactly the caller the operator is most likely to be narrowing. A policy table that covered root turns but not subagent turns would be worse than none, because the operator would believe they were covered — so the supervisor names the tools a rule might touch and the child round-trips those through the existing ToolRequest channel. Everything else keeps its direct connection.

This is a grant the supervisor makes, not a promise the child keeps: a gated tool is still refused parent-side if the child ignores the list, because the parent evaluates the policy when the request arrives.

limits: Limits

telemetry: Telemetry

depth: u32

Supervisor-minted tree depth (0 = root).

warm: bool

Run as a warm continue-session: after each turn, stay alive and wait for the next injected event (ControlMsg::Inject) instead of exiting, continuing the same transcript so the agent keeps its memory of earlier events. Default (false) is a one-shot run per event, which starts each event from a clean context. #[serde(default)] so a frame that omits it parses as one-shot.

role: Role

The child’s role. agent (default) runs the ReAct loop on instruction or drives a workflow; turn is a turn worker driven by turn below. #[serde(default)] so a frame that omits it parses as agent.

turn: Option<Box<TurnSpec>>

The turn worker’s input (role: turn).

Implementations

impl SpawnPayload

pub fn narrow_tools(&mut self, allow: &[String])

Narrow this child’s tool grant to allow. Any allow-list entry already in the seed is dropped first, so the SUPERVISOR’s mint is the only grant the child sees — a caller-supplied context array cannot forge or widen one. An empty allow is a real narrowing to nothing, not “no narrowing”; leave the marker off entirely for the unnarrowed case.

pub fn allowed_tools(&self) -> Option<Vec<String>>

The narrowed grant this payload carries (None = unnarrowed: the full catalogue the granted servers publish). Reads back what SpawnPayload::narrow_tools minted — including after a restore, which re-spawns from the stored payload.

Trait Implementations

impl Clone for SpawnPayload

fn clone(&self) -> SpawnPayload

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SpawnPayload

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SpawnPayload

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SpawnPayload

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.