Struct CompactTool 

pub struct CompactTool;

Summarise the middle of the transcript now, rather than when the threshold says so.

The one tool whose whole effect is on the harness. It rewrites nothing itself — a tool has no access to the transcript — it sets the flag the loop reads between turns, on cancel’s precedent. docs/GOAL-SYSTEM-DESIGN.md §7’s table puts the compaction threshold in the row with no adversary, where a disposition may take over from a constant outright; this is that takeover, and the model is the disposition.

Three decisions:

• It only ever adds a compaction. The loop’s condition is asked || over(...), so the structural floor is untouched and no reasoning the model does — or is steered into by something it read — can make a run compact later than it would have. §7.3’s monotonicity, and the reason handing this decision over is safe rather than merely convenient. The lever an attacker gets points at “compact too eagerly”, which is annoying and visible.
• It is not approved and not destructive. Compaction is lossy but not irreversible: the loop snapshots each pre-rewrite state onto Conversation::rewritten, the session records them, and recall searches the union of everything the transcript ever held. A confirmation on a routine reversible action is what teaches people to approve without reading, which is what the outbox’s confirmations then have to fight.
• No arguments. Nothing about how to compact is the model’s to choose — the cut point has to be legal, and compact.rs is the pure, unit-tested code that decides where. All the model contributes is when, which is the part it knows and the harness does not: how much of its own plan is left.

Trait Implementations

impl Tool for CompactTool

fn name(&self) -> &str

fn description(&self) -> &str

fn input_schema(&self) -> Value

fn read_only(&self) -> bool

Read-only tools skip the approval gate and are safe to run in parallel.

fn capabilities(&self) -> Capabilities

Declared risk surface. The default is the conservative one for a tool nobody has classified: assume it does nothing special.

fn call<'life0, 'life1, 'async_trait>( &'life0 self, _input: Value, ctx: &'life1 ToolCtx, ) -> Pin<Box<dyn Future<Output = Result<ToolOutput>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn carried_state(&self, ctx: &ToolCtx) -> Option<CarriedState>

State this tool holds that a compaction must not lose.

fn denial_remedy(&self) -> Option<String>

How the operator could make a call like the one just refused safe — one sentence appended to a trifecta denial, or None when nothing short of policy would change the answer.

fn fixed_workspace(&self) -> Option<PathBuf>

The root this tool’s relative paths actually resolve against, when the tool was constructed over a fixed directory rather than following the per-run ToolCtx workspace.

fn narrows_surface_to(&self) -> Option<Vec<String>>

Tool names this tool is currently restricting the surface to, if it is restricting it at all.

fn runs_a_fresh_conversation(&self) -> bool

Does this tool do its work in a conversation of its own?

fn forget_conversation_state(&self)

Drop state that belonged to the conversation that just ended.

fn guards_closures(&self) -> bool

Does this handle refuse task closures (status: done|dropped) on the model’s behalf?

fn spec(&self) -> ToolSpec