Struct SubagentProfile 

pub struct SubagentProfile {
    pub name: String,
    pub description: String,
    pub tools: Vec<String>,
    pub system_prompt: Option<String>,
    pub max_turns: u32,
    pub model: Option<String>,
    pub provider: Option<String>,
    pub trusted_output: bool,
    pub answer_shape: Option<AnswerShape>,
}

Fields

name: String

Tool name the parent sees. Keep it a verb the model will reach for.

description: String

Shown to the parent model. This is what decides whether delegation happens at all, so say when to use it, not just what it is.

tools: Vec<String>

Allowlist of tools the child may use. Empty means no tools, which is occasionally what you want — a pure summarizer.

system_prompt: Option<String>

max_turns: u32

model: Option<String>

Run this child on a different model. A narrow task with two tools does not need the model the parent is using, and a small fast one keeps delegation cheap enough to be worth doing.

provider: Option<String>

Run this child against a different provider entry — a second llama-server on another port, or a hosted model for one hard step.

trusted_output: bool

Treat the child’s answer as trustworthy even though its tools can reach untrusted sources — only when the answer matches answer_shape, checked per answer at runtime.

Off by default. Turning it on requires declaring the shape: a bare trusted_output = true is a construction error, because it would be a vouch nothing enforces. The old semantics — flip the flag and every answer comes back trusted, whatever it says — meant one config line silently disarmed the trifecta’s untrusted leg for prose an attacker may have written. Now the flag only offers trust; each answer earns it by parsing as the declared shape, and one that does not comes back marked untrusted, with a note saying why. Fail closed, per answer.

answer_shape: Option<AnswerShape>

The structural form a trusted answer must take. Instructions cannot hide in a number, a boolean, or one word from a closed set — which is why those are the only shapes offered. There is deliberately no bounded-string shape: “ignore previous instructions” fits in very few characters, so a length cap vouches for nothing.

In config: answer_shape = "number", "boolean", or a list of allowed answers like ["low", "medium", "high"]. Meaningless without trusted_output = true.

Trait Implementations

impl Clone for SubagentProfile

fn clone(&self) -> SubagentProfile

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SubagentProfile

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SubagentProfile

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SubagentProfile

where SubagentProfile: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SubagentProfile

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.