Harness-owned state for the latest user interaction. Long-running work is
represented independently by the RTDL forest; it must not keep older user
text welded into the current goal forever.
Metadata for one in-flight RTDL tree in the forest. Trees are keyed by
pilot-assigned plan_id; this carries what the supervisor and the LLM need
to reason about a running tree (and, later, what the chat UI renders).
Compact contract reminder for rounds after the first. The complete frozen
protocol is sent on round zero; later requests keep only the wire grammar
and harness invariants that are required to parse and admit the next plan.
Process-wide monotonic source of node op_ids. The LLM-emitted RTDL does
not carry a usable op_id (it defaults to 0), so pilot assigns one itself
while parsing: a globally-unique, auto-incrementing id starting at 1.
“Global” = across every plan/round in this pilot process, so each node in
the live task-graph forest is uniquely addressable for steering and result
correlation — not merely unique within one plan.
Apply only progress fields from the model. The user-owned goal is immutable
within the standing task; steering is appended by the harness above. The
model may refine the default success criterion once, but cannot erase or
replace an established criterion. Completion is accepted only at a harness
safe point with no new or in-flight execution.
Assemble one request while emitting a bounded, machine-readable breakdown
of every prompt section. Section token counts are explicit four-byte
estimates; the provider-reported total is logged separately when available.
Cancel every real task tree owned by this turn before reporting the Pilot
session interrupted. Dropping the Execute stream alone only detaches Pilot;
Executor continues the plan (and synchronous tools such as run_command)
unless its PlanRuntime receives an explicit cancel_plan request.
Claude-Code-style rolling compaction. When the running history grows past
HISTORY_COMPACT_TRIGGER_CHARS, summarize everything except the most recent
HISTORY_KEEP_RECENT messages into a single summary note (preserving goal,
decisions, observations, and current state) and keep the recent turns
verbatim. This shrinks the per-round prompt for the rest of the turn instead
of re-shipping the full transcript every round.
Bound a tool result without turning structured JSON into an invalid prefix.
Scene list contracts keep the identifiers needed for a targeted follow-up
while explicitly reporting whether any records were omitted.
Drive one dispatched plan’s Execute stream to completion, forwarding node
states for visualisation and collecting terminal results. Sends exactly one
PlanDone when the stream ends. Runs as its own task so the supervisor loop
never blocks on a single tree — concurrent trees form the forest.
A single empty-sequence root plan, used as the no-op plan when a turn ends in
RTDL recovery. Carries non-empty op_id/description so executor’s
validate_plan accepts it.
Render the in-flight forest as a system-prompt block so the LLM can see what
is still running and reference a plan_id to cancel it. Empty when no tree
is running. Trees are ordered by numeric plan id for stable output.
True when every do node is a plan-control builtin and there is at least
one. Plan-control trees are not themselves cancellable task work; advertising
them makes the model inspect or cancel its own control actions.
Tolerates a prose preamble or trailing commentary around the JSON object
(a common model habit, e.g. a narration line then the JSON on the next
line) by extracting the first balanced {...} before parsing; the raw
string is used unchanged when no object is found, so a genuinely
JSON-less reply still surfaces the original parse error.
Render the complete capability catalog in a compact, deterministic shape.
Names remain on their own line for the CI fake VLM and descriptions are
JSON-escaped so embedded whitespace cannot inflate or corrupt the catalog.