Every tool
The full list, generated from the running system: every tool, its arguments,
and the description the agent actually reads.
The three it reaches for first
The first two answer whether a thing exists. The third answers what it does, what
it costs, and what it does not do. People often ask these as if they were one
question.
What the chat writes
The chat writes strategy cards. It does not write plan documents. When you ask for something in chat, the agent turns it into a card: a few lines of English that say where it runs, when it acts and what it may spend. The tools that write a workflow, a chain or a schedule directly are withheld from every phase of the chat. A request that has no steps and no rule, such as “swap 200 USDC for cbBTC now”, becomes a card that runs once. Some requests cannot be a card. A form the card checker refuses, such as a route to a network DeFiLoops does not serve, gets a plain answer from the server. The answer quotes the checker’s own refusal and points you to the console’s dialogs, which build those plans directly. The agent does not invent a limit and does not say it cannot save your request without saying why. The console’s dialogs, the HTTP gateway and a hired agent keep their own ways to write a plan. Only the chat is narrowed. → Strategy cardsThe five that spend
Separate “submit” and “resume” tools used to exist and are now folded into
run_workflow, because a model holding several spending tools picks the wrong
one. On one measured day it picked wrong every time it mattered.What is deliberately not on that list
Stopping a run is not withheld, and neither is cancelling an order. Both end spending rather than start it. A person who watches money move and cannot stop it from the conversation they are in is a failure in itself. That happened here: stopping was console-only, and the refusal they got told them to go there. The tools that stop spending must never be withheld along with the tools that start it. Stopping a run is still governed. The owner is fixed by the session and cannot be named by the model, an author is required, and it refuses without a run identifier rather than guessing which run to end. It just does not count as spending. Listing your orders is available for a similar reason. Withholding it would leave somebody able to start an order and unable to see it.Tools for cards and venues
These tools were added after the first set. None of them spends money, and none of them is on the list above.Two locks, not one
1
Withheld at the server, not only at the client
Over a direct pipe, a client that did not ask for a spending tool could not be
given it by anybody else, because nothing else can reach the process. On a
listening address, other clients can reach it. The client’s request is then only
a preference, so the server itself has to withhold the tool.
2
Checked again on the way through
Every spending tool is wrapped by a check that asks, before the call runs,
whether this owner may make this move right now.It is a wrapper rather than a check inside each handler because the check was
inside one handler. The model then got past it three times: twice through a
different tool, and once by writing a new task altogether.
Why a plan is stated twice
Wherever a plan is saved or checked directly, the tool takes the plan and a restatement of what each step moves, in plain units, with the symbol. A plan writes amounts as very large integers, and nothing in the document records what they were meant to be. A plan where every amount is a thousand times too small is consistent with itself and passes every other check there is. Only the restatement can catch it. The two are independent statements of the same intent, checked against each other, and a misplaced decimal point cannot survive in both.Most tools are found, not offered
The agent is shown a short list of tools. One of them isfind_tool, which
searches the rest by what you are trying to do and runs the one that fits. A last
tool is internal: the backend calls it before a turn and the model is never told
it exists.
Nearly all the research tools are in the searched group,
and they are there because of what they cost to carry rather than what they do.
A tool’s full description and argument list sit in front of the agent on every
turn, whether or not that turn is about liquidity, and the research tools have
the longest descriptions of any, because each one needs to say what its numbers
mean and how they are misread. Carrying all of them made every unrelated
conversation more expensive and less focused.
So they are described in one line each and fetched in full when the subject comes
up. Naming one costs a single turn.
Nothing that spends is ever in the searched group. A test enforces that, so a
spending tool cannot hide behind the search.
There used to be three tools for this: one to ask what existed, one to fetch a
schema, and one to run. The agent moved between them without ever running
anything. One
of them was in neither phase’s list of permitted tools, so twenty deferred tools
were reachable by nothing at all and were never called once.Now there is one.
find_tool searches and runs, and a wrong call comes back
with that tool’s whole schema, so one mistake costs one turn rather than a
conversation.