Tooling + closure services on the shared engine

Goal

• Run tooling/review/commit/status through the shared invocation protocol.
• Direct invocation creates a root; auto-triggered invocation becomes a child.
• Child tooling returns local acceptance + root obligations without terminal closeout.

Implementation sketch

• Adapt improve_tooling_runtime phases to root/child entry and typed returns without a skip-closeout boolean.
• Adapt add-bug, review-plan, and review-section as capability-bound workflows with typed returns; no child-authored resume commands.
• Keep gap/design/implementation/tests/self-test/lint/harness activation safety local; delegate aggregate review, final version publication, commit/push, and terminal status when folded.
• Represent harness compatibility changes as version intents aggregated once by the root.
• Run review-work, tpr-review, impl-hygiene-review, and sync as durable engine invocations over the frozen union with frames, task tokens, typed results, finding/cure children, and symbolic returns.
• Make commit-push and status-report root finalizers with idempotent receipts; publication must succeed before the sole terminal report and seal.
• Compose status/reporting from two labeled sources: authoritative plan/tracker workflow state via its API and root invocation/finalizer protocol facts via the execution store. Neither status-report nor an LLM may synthesize the done verdict; only engine closeout emits TerminalReceipt.
• Permit recursive tooling/bug children while preserving root authority and engine epoch.

Test strategy / acceptance

Test direct-root and folded-child tooling/review/add-bug, recursive chains, parent activation safety, one aggregate version bump, stale review invalidation/reactivation, publication-pending retry, source-labeled root reporting, engine-only TerminalReceipt, self-upgrade bundle resolution, and return after crash.

Work Items

• Adapt improve-tooling to direct-root and folded-child entry with the generic invocation/return protocol
• Split improve-tooling gates into local acceptance/activation safety versus root-delegated aggregate review, version publication, commit, and status obligations
• Aggregate child harness compatibility intents into one root fingerprint/version/changelog/migration decision
• Name the legacy-skill-as-child adapter contract: wrap an un-migrated skill dispatch (e.g. /tpr-review, /tp-help pre-migration) as an engine invocation with task token, typed result contract, fold receipt, and symbolic return; pin review.json scope explicitly as the closure-service wrapper only (typed findings in / cure children out) with reviewer-dispatch internals remaining legacy per the tpr-review-multi-agent-dispatch locked design until the future /tpr-review migration plan
• Run review-work, TPR, implementation-hygiene, and sync as durable root-scoped invocations with task tokens, typed findings/cures, fold receipts, and symbolic returns; keep commit-push/status as idempotent finalizers
• Implement semantic-closed/publication-pending/published/sealed transitions with idempotent commit/push retry and no premature terminal report
• Support recursive improve-tooling, add-bug, and fix-bug children with root engine-epoch inheritance and stale-return fencing
• Render source-labeled root status for domain and virtual roots: plan/tracker API supplies workflow state, root store supplies invocation/obligation/generation facts, and only engine closeout supplies the sealed TerminalReceipt; suppress child, client, status-report, and LLM-authored terminal claims
• Migrate add-bug, review-plan, and review-section to engine-issued child capabilities, typed local acceptance, result ingestion, and symbolic return targets
• Run end-to-end thirty-bug acceptance across canonical batch selection, bug-domain adaptation, root aggregate review, finalization, publication, and terminal status

Intel dossier — pointer and tier disposition

Dossier: tooling-closure-services-on-the-shared-engine--s-ec3fa023.intel.md (this section’s content/intel/ sidecar)

Read that dossier from line 1 through EOF before acting on this section. This block is a pointer and an audit record, never a substitute: not the BLUF, not a summary, not selected tiers.