[liugddx]

Summary

The proactive discovery Session runs open-ended investigation in the background. At origin/main@59f61cf7d it could do more than investigate and report:

• create a Matter the conversation cannot see (MatterDelegate, bug(assistant): MatterDelegate from the discovery session creates a Matter the conversation cannot see #6249);
• adopt an unassigned conversation Matter (MatterAdopt);
• write, edit, checkpoint, control or create conversation memory indexes (MemoryIndex*, bug(assistant): discovery session can mutate conversation memory indexes and adopt unassigned Matters #6250);
• call Bot-only and initiative-configuration tools that were rejected only at execution.

This PR gives the discovery Session its own exclusion list. The same visibility policy now governs the model-facing catalog and execution, so a tool hidden from a Session cannot run in it either. Read tools, DiscoveryReport and DiscoveryContext stay available. The conversation, the Bot and index workers are unchanged.

Fixes #6249. Refs #6250 (open: the allowlist decision for MemorySourceQuery and MemoryExtract; native shell and edit tools in the discovery Session were not verified). Refs #6247 (RFC).

Behavior change

• A discovery Session no longer lists or runs the tools in DISCOVERY_EXCLUDED_TOOLS (index-initiative/discovery-capabilities.ts).
• A discovery Session that tries to create a Matter gets an error instead of an invisible Matter. Discovery reports the need through DiscoveryReport.
• No change for ordinary conversations, the Bot, or index workers.

Verification

Regression tests were written first and run against the unfixed code: 4 of 6 failed, and the 2 that passed are guards for behavior that was already correct (conversation-delegated tasks cannot be controlled from discovery; discovery can still read conversation memory).

Check	Result
npm run typecheck (runtime-host, Node 24.21.0)	pass
discovery-boundary.test.ts, 6 tests	6 of 6 pass (4 of 6 fail on the unfixed code)
npm run test:assistant (memory-network, index-initiative, proactive-matters)	195 of 195 pass
npm run test:dist (runtime-host)	see the note below
biome check and asf-license-headers check on changed files	pass

Note on test:dist: the full run exposed one pre-existing failure and several load-sensitive timeouts.

• assistant Host fallback registers a task workspace … fails on origin/main@59f61cf7d as well. I checked this by stashing this change and rebuilding the clean baseline. It is unrelated to the discovery boundary and is not fixed here.
• Four timeout-style failures (interrupt atomically …, two Clients share one execution …, invocation-owned detached Host retires …, non-serving Runtime Host kernel) pass when run in isolation. They failed only under the full concurrent run.
• Two failures in assistant-initiative-boundary.test.ts came from this change: the test harness did not provide tools.filter, and the new fail-closed check rejected it. The harness now provides it.

Review focus

• Classification of each excluded tool. MatterRead, MatterReadFile, InboxList and InboxRead are excluded because they are worker-only or Bot-only. Please confirm none is needed by discovery.
• Not covered yet. MemorySourceQuery and MemoryExtract remain available. Native shell and edit tools were not exercised because the test fixture exposes plugin tools only.

AI use

• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code (Anthropic) investigated the code paths, wrote the regression tests and the change, and drafted this description. The checks above were run locally by the tool. Human review is pending; the contributor of record owns the change's accuracy and licensing. Commits carry Generated-by: Claude Code.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally (see the note on test:dist)

Does this PR entail a change in behavior?

• Yes — described under Summary above

🤖 Generated with Claude Code

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

Reviewed the six-file change at 149a79ca18c6cf56e20a7d889514b2191a898391 (+289/−8). I found no confirmed P0–P2 issue in the scoped assistant-tool restriction.

The discovery-session filter in index-initiative/host.ts excludes the listed Matter, memory-index mutation, initiative-control and Bot-only tools. AssistantRuntime.visibleTools is shared by catalog filtering and the public assistant-tool execution wrapper, so directly invoking an excluded assistant tool is also rejected. The filter follows the persisted discovery-session identity and leaves owner conversations, Bot workers and index workers on their existing paths. The six new tests exercise delegation, adoption, memory mutation, catalog visibility, existing task isolation and retained read access.

Fresh dependencies/patches, the normal root build, all 195 assistant tests and 56 focused Host tests passed. Rebuilding the real test bundle with only the base service and initiative modules makes four of the six new tests fail; the two existing-behavior guards still pass. Changed-file Biome, ASF headers, diff checks, the epoch guard (227; no wire change) and static merge against main passed.

This is not a complete read-only sandbox: core shell/edit tools and arbitrary external tool effects are outside this exclusion list, and MemorySourceQuery / MemoryExtract remain allowed as documented. I did not validate hostile model behavior or real external plugins. #6253 overlaps this work and currently conflicts in index-initiative/host.ts; reconcile their policies if both are retained.

CI failed while the unchanged ShellRun crash-recovery test parsed a partially written JSON fixture. Its test, shell manager, npm dependency files and workflow match the base, and the focused test passes locally; I have not independently reproduced that failure on main. I reran the failed job once; the new result is pending. This review is not a green-CI merge recommendation.

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

CI attempt 2 has also failed: the same unchanged ShellRun crash-recovery fixture parsed incomplete JSON, this time in its terminal phase. The first attempt failed in its running phase. The focused running case passed locally, and the relevant test/implementation/dependency/workflow files match the base, but I have not independently reproduced this on main. Current-head CI remains red; I have not established that this PR causes the failure and will not keep rerunning it.

[liugddx]

@me2seeks @jackwener @xxhZs could one of you review this? It is the follow-up to the discovery-boundary RFC (#6247) and its bug reports (#6249, #6250).

What changed: the proactive discovery Session can no longer create or adopt conversation Matters, mutate conversation memory indexes, or change initiative settings. The catalog and execution share one visibility policy, and read tools stay available. The conversation, the Bot and index workers are unchanged.

The test check passed on attempt 4. Earlier attempts failed on two unrelated flaky tests (ShellRun process crash recovery, Maka Pi TUI runner), which pass when run alone.

中文版（点击展开）

请 @me2seeks @jackwener @xxhZs 帮忙评审一下。这是 RFC #6247 及其两个 bug（#6249、#6250）的修复。

改动内容：主动探索会话不能再创建或接管对话的事项，不能修改对话的记忆索引，也不能改动主动发现的配置。目录与执行共用同一套可见性策略，读取类工具保留。对话、Bot 和索引 worker 不受影响。

test 检查在第 4 次尝试时通过。前几次失败的是两个与本改动无关的不稳定测试（ShellRun process crash recovery、Maka Pi TUI runner），单独运行时都能通过。

[me2seeks]

Automated review performed with Codex; this does not represent an independent human review.

Reviewed current head 149a79c against the scope of #6247, #6249 and #6250. No blocking issue found in the scoped assistant-tool restriction. Discovery identity comes from the persisted Host binding, and the shared visibility policy rejects excluded assistant tools both in the catalog and when cached handles are invoked. Conversation, Bot and Matter/index-worker paths retain their existing roles.

Locally verified in an isolated exact-head worktree with Node 24.18.1: all 195 assistant tests, including the six discovery-boundary tests, passed; 56 related Host tests passed when bundled from this head with source aliases. The dependency manifests and lockfile match the existing installation. Current-head CI is green and there are no unresolved review threads.

Scope note: the discovery-specific exclusion list is an incremental restriction, not the complete allowlist discussed in the RFC or a read-only sandbox. Native shell/edit and arbitrary external effects are outside this review's validation; MemorySourceQuery/MemoryExtract policy and the broader RFC product decisions remain open. These documented follow-ups do not block this targeted fix.