Module maxer 

TokenMaxer orchestrator (RFC-031 §5).

The drain → rotate → wait → resume loop. Activated by a time window or a manual toggle. Each tick: pick the most-available eligible provider, ask the WorkPlanner for a bounded task, execute it with the provider’s model pinned (ExecEnv.model_override) under a restricted capability set (ExecEnv.cspace_hint = "standard"), credit the self-tracked counter, and record the outcome in the session.

§6.4 — fail-closed, structurally

The maxer’s agents run through the AgentRuntime gated registration path (register_tools_from_cspace_gated), which: (a) scopes capabilities to standard() so high-risk tools (rm/osascript/wildcard/ManageRBAC/SystemConfig) DENY at the AccessGate, and (b) does not register ask_user (that lives in register_all_kernel_tools / the bridge path, not this one) — so an unattended agent cannot pend on a clarification. As defense-in-depth, each task is wrapped in a hard per-task timeout so any tool that blocks is bounded (execute_directive also enforces max_execution_time).

Structs

TokenMaxer

The token-maxing orchestrator. Constructed once at boot with a clone of the AgentLifecycleManager, the shared QuotaTracker, a WorkPlanner, and the StateStore for session persistence.