# Shared output agent guide
Parent: [source guide](../AGENTS.md). Paths below are relative to `src/output/`.
## Ownership
`../output.rs` exposes shared output modules. This layer provides events, redaction and safe display facts to execution, storage projections and UI consumers; it does not own those consumers' policies.
| Private Control input projection | `control.rs` |
| Worker/UI event vocabulary | `events.rs` |
| Streaming and final redaction | `redaction.rs` |
| Shared child-agent results/status | `subagent_result.rs` |
| Terminal warning text | `terminal_warnings.rs` |
| Shared safe tool meaning and typed facts | `tool_card.rs`, `tool_card/` |
| Normalized display text and bounded previews | `tool_display.rs`, `tool_display/` |
| Tool result/display fields and serialization | `tool_result.rs` |
| Tool status labels | `tool_summary.rs` |
## Contracts
- `OutputEvent` is neither a session record nor a provider request. Keep durable history and provider projection with their owners.
- Streaming redaction spans deltas. Flush at hard boundaries before unrelated rows; terminal-control sanitization is separate and precedes styling.
- Tool status labels belong in `tool_summary.rs`. Cards derive `ToolOutcome` from observed activity status; absent status yields `Unknown`, never success.
- Tool cards are shared, safe tool meaning, not terminal/history/wire DTOs. Keep the projection pure and display-only; do not move execution, persistence or UI layout into it.
- Code Mode execution and task facts live in `tool_card/{execution_facts,task_telemetry}.rs`. Preserve explicit nulls, bounded safe activity and aggregate counts independent of previews. Contract: [execution/task card facts](../../docs/features/execution-task-card-facts.md).
- Web/Image/Control public facts live in `tool_card/public_facts.rs`. Preserve fixed labels/nulls from [public card facts](../../docs/features/web-image-control-card-facts.md). Never reconstruct Control facts from output text.
- Private Control input stays excluded. `control.rs` selects public action, counts and protection outcomes without private compaction context; `tool_display/` must not recover or reveal it.
- Normalize display text and bound previews in `tool_display/`. Append host facts and omission information without treating preview content as authoritative metadata.
- `ToolResultDisplay` is display-only. Preserve serde skips that keep local display metadata out of stored/provider-facing data; runtime validation and projection stay with execution owners.
## Dependencies
- Tools and subagents consume shared `ToolResult`, `ToolResultDisplay`, `SubagentsOutput`, `SubagentStatus` and `MAX_SUBAGENT_TASKS` here. Keep result fields/serde contracts in `tool_result.rs` and `subagent_result.rs`.
- Use `tool_contract` for argument/metadata names. Remaining tools access is pure capability classification and read-only hash-edit summaries; no output → subagents dependency.
- Existing provider/protection links serve fast observations and protected replay, not permission to add execution dependencies.