Brief P1: fix the tools array per epoch, reach other tools through call_tool

Approved 2026-09-17. Evidence is in docs/decisions.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/decisions.md

@@ -19,13 +19,20 @@ Newest first. A decision that changes `docs/design.md` lands in the same commit
 | Secret store backend, and where the v0 file's key lives. straylight has no secrets manager today. | M3 |
 | Whether cloud-led sessions are ever allowed, and for which data classes. | M6 |
 
+## Applied to the design brief
+
+Approved by the owner on 2026-09-17. One commit each.
+
+| # | Change | Evidence |
+|---|---|---|
+| P1 | Inference contract 6: the `tools` array is fixed per epoch. `find_tool` returns schemas as a tool result and the model calls them through a `call_tool(name, arguments)` meta-tool. Never instruct the model to call an undeclared tool. | M0 (h): adding a tool re-read the whole prompt; undeclared calls were coerced into `write_file`. |
+
 ## Proposed changes to the design brief
 
 From M0 and the kickoff review. None is applied yet. Each lands as its own commit once the owner agrees.
 
 | # | Change | Evidence |
 |---|---|---|
-| P1 | Inference contract 6: the `tools` array is fixed per epoch. `find_tool` returns schemas as a tool result and the model calls them through a `call_tool(name, arguments)` meta-tool. Never instruct the model to call an undeclared tool. | M0 (h): adding a tool re-read the whole prompt; undeclared calls were coerced into `write_file`. |
 | P2 | Inference contract 2: the session log stores assistant messages exactly as returned, including `reasoning_content`, and replays them unchanged. Remove the "known risk" about dropped thinking blocks. | M0 (e): Ornith's template keeps every think block. |
 | P3 | Inference contract 7: requests set `return_progress: true`; progress events count as liveness. | M0 (i): otherwise the stream is silent during prefill. |
 | P4 | Inference contract 8: the thinking cap uses `reasoning_control` and the control endpoint. | README b10809. Not yet exercised. |

docs/design.md

@@ -90,8 +90,13 @@ ordinary outbound networking can reach the whole tailnet and the internet as the
    and starts a new epoch whose prefix is the baseline plus the summary. The old log is kept.
 5. **Pinned slots.** Main session, subagents, and scheduled runs each use their own server slot so
    they do not evict each other's cache. Verify the pinning mechanism on the deployed build.
-6. **Progressive disclosure.** Only a small core tool set has schemas in the baseline. Everything
+6. **Progressive disclosure.** The `tools` array is fixed for the whole epoch. The template renders
-   else is found through one `find_tool` call that appends the schema when needed.
+   it at the top of the prompt, so any change re-reads everything. Only a small core tool set has
+   schemas in it. Everything else is found through `find_tool`, which returns schemas as an
+   ordinary tool result, and is called through one fixed `call_tool(name, arguments)` meta-tool.
+   `brokerd` applies grants to the target tool, not to `call_tool`. Never prompt the model to call
+   a tool that is not in the `tools` array: the server's grammar forces such a call into a
+   declared tool.
 7. **Liveness, not deadlines.** Streaming always. The timeout is "no bytes for N seconds", never a
    total-request deadline.
 8. **Runaway control.** Per-turn thinking-token cap, per-turn tool-iteration cap, detection of