Tools

A tool call and its result are separate records. A tool_call says that a call was requested, and by whom. A tool_result says what came back and, in particular, what reached the model. Approval is recorded in permission records, or on the result when no request was shown. Questions to the user are input_request records. Long-running processes that outlive a call are terminal entities. Hooks the harness runs are hook records.

`tool_call`

{
  "type": "tool_call",
  "seq": 5,
  "id": "r5",
  "ts": "2026-10-26T14:02:21.254Z",
  "inferenceId": "inf_01B",
  "callId": "toolu_01A",
  "callIdSource": "native",
  "name": "Bash",
  "kind": "execute",
  "title": "Run tests",
  "requestedBy": "model",
  "input": {"command": "cargo test -p parser"}
}

{
  "type": "tool_call",
  "seq": 9,
  "id": "r9",
  "ts": "2026-10-26T14:02:29.630Z",
  "inferenceId": "inf_01C",
  "callId": "toolu_01B",
  "callIdSource": "native",
  "name": "Edit",
  "kind": "edit",
  "requestedBy": "model",
  "input": {
    "file_path": "/work/acme-app/crates/parser/src/lib.rs",
    "old_string": "return Err(Error::Empty);",
    "new_string": "return Ok(Vec::new());"
  }
}

Field	Type	Req	Meaning
`callId`	string	yes	Native call ID, or a derived one.
`callIdSource`	string	yes	`native` or `derived`.
`name`	string	depends	The exact tool name as requested. Required unless `capture.name` gives a capture state.
`kind`	string, open	no	Coarse category, using the Agent Client Protocol (ACP) ToolKind values: `read`, `edit`, `delete`, `move`, `search`, `execute`, `think`, `fetch`, `switch_mode`, `other`, `unknown`.
`title`	string	no	Display label.
`input`	any	no	The arguments as JSON.
`inputText`	string	no	The arguments as text, when they are not JSON, cannot be parsed, or contain numbers that do not meet ASR-032.
`requestedBy`	string, open	no	Who requested the call: `model`, `user`, `harness` or `code` (a program the model wrote, such as a code-mode cell). Absent means unknown.
`parentCallId`	string	no	The call that contains this one (for example the code-mode cell that ran it), when the source records the link.
`provider`	object	no	`{kind, server?, tool?, name?, identity}`: where the tool comes from (see Provider identity).
`locations`	array	no	Files the call concerns: `[{root, path, line?}]` (PathRef plus a 1-based line).

Capture state keys: name, input, inputText. ASR-250 A tool_call MUST contain callId and callIdSource, and MUST contain name unless capture.name is present. ASR-251 A tool_call records that a call was requested; requestedBy says who requested it. It MUST NOT carry an outcome. Execution, denial, cancellation and results are recorded in tool_result and permission records. ASR-252 name MUST be the exact tool name as requested, with no normalization, prefix stripping or splitting. ASR-253 kind MUST come from the source, or from a mapping of exact tool names to kinds published in the agent’s registry entry. Producers MUST NOT assign kind from the title, the input or other heuristics. ASR-254 When the source holds arguments as JSON text that meets ASR-032, input MAY hold the parsed value. When arguments are not JSON, cannot be parsed, or contain integers that do not meet ASR-032, inputText MUST hold the complete arguments without loss (ASR-035). A record MUST NOT contain both input and inputText. Paths inside input are kept as the model wrote them. Root substitution never applies to them (see Coding). kind is coarse. Tools that ask the user, delegate to another agent, set a plan or send a message all fall into other. Consumers find those facts by record type (input_request, subagent, plan, message), not by kind.

Who requested a call

Most calls come from the model. Some do not: a person runs a shell command directly (Claude Code’s ! prefix, Codex’s user shell), the harness runs a tool for its own purposes, or a program the model wrote calls tools (Codex and OpenClaw code mode, where one model call to a code cell runs many tool calls).

{
  "type": "tool_call",
  "seq": 203,
  "id": "r203",
  "ts": "2026-10-26T09:20:14.388Z",
  "callId": "exec-6c2f1a9e-4b7d-4e30-8a15-d2c9f0b3e471",
  "callIdSource": "native",
  "kind": "execute",
  "requestedBy": "code",
  "parentCallId": "call_Cx91rT",
  "capture": {"name": {"state": "absent"}},
  "input": {"command": ["cargo", "test", "-p", "parser"]}
}

This record comes from a Codex session in which a code cell (call_Cx91rT) ran a command. Codex records the cell that ran it in this case; when a source does not, parentCallId is absent. ASR-274 requestedBy MUST come from the source. A producer sets model when the source records the call as part of a model response, code when it records the call as made by a program the model wrote, user when it records a person’s direct command, and harness when it records the agent software making the call. Readers MUST NOT read an absent requestedBy as model. ASR-275 parentCallId MUST come from a link the source records. Producers MUST NOT infer it from position or timing.

Provider identity

provider says where a tool comes from: a Model Context Protocol (MCP) server, a plugin, a connector (a hosted app integration), or the harness itself. Many harnesses name MCP tools with a composite string (mcp__server__tool, mcp_<server>_<tool>, sanitized or truncated forms) that cannot be split reliably: server and tool names may themselves contain the separator. Some record the server and tool separately, on the call or on the result.

{
  "type": "tool_call",
  "seq": 118,
  "id": "r118",
  "callId": "call_Mc7q2Lk",
  "callIdSource": "native",
  "name": "mcp__github__get_pull_request",
  "requestedBy": "model",
  "provider": {
    "kind": "mcp",
    "server": "github",
    "tool": "get_pull_request",
    "identity": "exact"
  },
  "input": {"owner": "acme", "repo": "app", "number": 482}
}

Field	Type	Req	Meaning
`kind`	string, open	yes	`mcp`, `plugin`, `connector` or `builtin`.
`server`	string	no	The MCP server’s name.
`tool`	string	no	The tool’s name on that server.
`name`	string	no	The plugin’s or connector’s name.
`identity`	string	yes	How the producer knows the server, tool or name (below).

`identity`	Meaning
`exact`	The source recorded the identity in separate fields.
`parsed`	The producer established the identity by a rule that the agent’s registry entry documents as unambiguous for that source: splitting a composite name, or reading identity the source records on a related record.
`unknown`	The kind is known, but the server, tool or name cannot be established.

ASR-255 A provider MUST contain kind and identity. exact MUST be used only when the source recorded the identity in separate fields; parsed only under a registry-documented rule. ASR-256 Consumers MUST NOT split composite tool names themselves to recover an MCP server or tool. They use provider, or treat the server as unknown. ASR-276 A tool_result MAY carry provider when the source records the identity on the result. A consumer that needs a call’s provider uses the call’s provider, or, when the call has none, the provider of its paired result (ASR-263).

`tool_result`

{
  "type": "tool_result",
  "seq": 6,
  "id": "r6",
  "ts": "2026-10-26T14:02:26.470Z",
  "callId": "toolu_01A",
  "linkage": "exact",
  "status": "failed",
  "content": [{"type": "text", "text": "test parse_empty ... FAILED"}],
  "capture": {
    "content": {
      "state": "truncated",
      "originalBytes": 48213,
      "blob": {
        "blob": "sha256:9b1f3c0e8a7d6b5c4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d",
        "size": 48213,
        "mimeType": "text/plain"
      }
    }
  },
  "exec": {
    "command": "cargo test -p parser",
    "cwd": {"root": "app", "path": "."}
  },
  "startedAt": "2026-10-26T14:02:21.260Z",
  "completedAt": "2026-10-26T14:02:26.470Z",
  "durationMs": 5210
}

{
  "type": "tool_result",
  "seq": 11,
  "id": "r11",
  "ts": "2026-10-26T14:02:31.012Z",
  "callId": "toolu_01B",
  "linkage": "exact",
  "status": "completed",
  "content": [
    {
      "type": "text",
      "text": "The file crates/parser/src/lib.rs has been updated."
    }
  ]
}

The first result has no exitCode: this source does not record a numeric exit code, so none is written (ASR-267). The model saw a truncated copy of the output; the full output is in a blob.

Field	Type	Req	Meaning
`callId`	string	depends	The call this result answers. Required unless `linkage` is `none` or `ambiguous`.
`nativeCallId`	string	no	The native call ID, kept as written; never used as a fallback for pairing.
`linkage`	string	yes	How `callId` was established: `exact`, `derived`, `ambiguous` or `none` (below).
`status`	string, open	yes	`completed`, `failed`, `denied`, `cancelled`, `interrupted` or `unknown`.
`content`	ContentPart[]	no	What reached the model.
`displayContent`	ContentPart[]	no	What the user saw, when different.
`raw`	any	no	Tool-specific raw output (for example ACP `rawOutput` or a harness’s separately stored structured result).
`error`	object	no	`{message?, code?}` as the source recorded it.
`exec`	object	no	Process details for shell-like tools (below).
`startedAt`	Timestamp	no	When execution started.
`completedAt`	Timestamp	no	When execution finished.
`durationMs`	number	no	Execution duration.
`provider`	object	no	Provider identity recorded on the result (ASR-276).
`permission`	object	no	`{decision, decidedBy?, rule?}`: an approval decision the source recorded without a request (see Decisions without a request).

Capture state keys: content, displayContent, raw, exec.stdout, exec.stderr, exec.output. ASR-257 A tool_result MUST contain linkage and status, and MUST contain callId unless linkage is none or ambiguous.

Status

Value	Meaning
`completed`	The tool ran and the source reports it returned normally.
`failed`	The tool ran and the source reports failure.
`denied`	The tool did not run because permission was refused, and the source records the refusal.
`cancelled`	The call was cancelled before it completed.
`interrupted`	The tool started and was interrupted.
`unknown`	The source has a result but no outcome.

ASR-258 status MUST reflect the source’s own outcome. A producer MUST NOT derive completed or failed from an exit code or from output text unless the source itself does, and MUST use denied only when the source records a refusal.

What reached the model

ASR-259 content MUST hold what the model received as the tool’s result, as far as the source records it. When the source does not record what reached the model, content MUST be absent and capture.content MUST give the state (for example absent). Display text and raw output belong in displayContent and raw. Stored output is raw unless evidence establishes the form in which it reached the model, for the relevant source version and use. Evidence for one code path does not establish this for other renderers, retries or backends.

`exec`

Field	Type	Req	Meaning
`command`	string or string[]	no	The command, as recorded (a string or an array of command-line arguments).
`cwd`	PathRef	no	Working directory as `{root, path}` (see Coding).
`exitCode`	integer	no	Numeric exit status, between −2³¹ and 2³²−1.
`signal`	string	no	Terminating signal name (for example `SIGKILL`).
`timedOut`	boolean	no	The source reports that the process timed out.
`stdout`	string	no	Standard output.
`stderr`	string	no	Standard error.
`output`	string	no	Combined output, when the source does not separate the streams.
`terminalId`	string	no	Reference to a recorded `terminal` entity, by its `terminalId`.
`processId`	string or safe integer	no	Native process identifier, kept verbatim as provenance. It is never a reference.

{
  "type": "tool_result",
  "seq": 96,
  "id": "r96",
  "ts": "2026-10-26T09:14:52.880Z",
  "callId": "call_Xq81vB",
  "linkage": "exact",
  "status": "failed",
  "capture": {"content": {"state": "absent"}},
  "exec": {
    "command": ["bash", "-lc", "cargo test -p parser"],
    "cwd": {"root": "repo", "path": "."},
    "exitCode": 101,
    "stdout": "test parse_empty ... FAILED\n",
    "stderr": ""
  },
  "durationMs": 4870
}

This example is from a source that records exit codes and separate output streams, but not what reached the model, so content is absent and its capture state says so (ASR-259). ASR-260 exec.exitCode MUST be written only when the source records a numeric exit code. Producers MUST NOT parse it from output text or from descriptive fields such as “return code interpretation”. ASR-288 Producers MUST omit an execution field that is null in the source only when null means unavailable. This rule does not change nulls in arbitrary native JSON. signal remains a native string; a numeric signal MUST stay numeric in raw, not be stringified or mapped to a guessed signal name. ASR-289 tool_result.exec.processId, when present, MUST be a string or an integer between −(2⁵³−1) and 2⁵³−1 inclusive. ASR-290 exec.terminalId refers to a terminal entity. Producers MUST NOT emit it unless the stream or bundle contains a terminal record with that terminalId. Resolve it in the same stream first; if no such record is there, it MUST identify exactly one terminal entity in the bundle. Missing-session entries and gaps do not satisfy this requirement. ASR-291 Producers MUST keep exec.processId verbatim, including its string or integer type. Readers MUST treat it as uninterpreted provenance and MUST NOT resolve it as a reference or use it as a fallback for exec.terminalId. A native process ID without a recorded terminal lifecycle goes in exec.processId; producers MUST NOT invent terminal records to hold it. Native numbers outside the safe range follow ASR-035 instead of being rounded or converted to strings. ASR-261 startedAt, completedAt and durationMs MUST come from the source. A producer MAY compute durationMs from the same result’s startedAt and completedAt, and MUST NOT compute timing from other records’ timestamps.

Linkage and pairing

`linkage`	Meaning
`exact`	`callId` is the call identifier the source attached to this result, or the source stores the result inside the call’s own native item.
`derived`	The producer assigned `callId` by a deterministic rule, documented in the registry, based on the source’s structure (for example the only call and the only result inside one native turn). The call then has `callIdSource: "derived"`.
`ambiguous`	The source’s evidence is consistent with more than one call. The duplicated native value is kept in `native` or `_meta`; `callId` is absent when it cannot identify the call (ASR-262).
`none`	There is no evidence linking the result to a call. `callId` is absent.

ASR-262 Duplicate native call IDs MUST be preserved on each call. When no identifier recorded by the source shows which call a result answers, the producer MUST leave the result unpaired with linkage: "ambiguous" and callId absent, keeping the literal native ID in nativeCallId. Positional or “latest call” pairing is fabrication and MUST NOT be used. Readers MUST distinguish ambiguous identity from an absent target (ASR-064). tool_result.nativeCallId is an optional string holding the native ID as recorded, without interpretation. Readers MUST NOT use it as an automatic fallback for pairing the result with a call. ASR-263 A reader MUST pair a tool_result with a tool_call only when linkage is exact or derived and exactly one tool_call entity in the stream has that callId. Otherwise the result is unpaired. ASR-264 When more than one result entity has the callId of one call, and none supersedes another, readers MUST treat the pairing as ambiguous and MUST NOT choose by position. ASR-265 A tool_call with no paired result is dangling: its outcome is unknown. Readers MUST NOT present a dangling call as having succeeded. Producers MUST NOT synthesize a result for it. ASR-266 A result with no paired call is an orphan. Producers MUST keep orphan results, and readers MUST show them as unpaired rather than dropping them. A result’s later revision (for example a status that changed after completion, or output masked afterwards) is a new tool_result record that supersedes the earlier one (see Missing data and revisions). It is the same result entity. ASR-267 Producers MUST NOT fabricate execution details: exit codes, durations, working directories and output appear only when the source records them.

`permission`

A permission records a request for approval and, when known, its status and decision. It follows ACP v2’s permission requests: a request has its own identity, a title, an optional subject (a tool call or a command) and options.

{
  "type": "permission",
  "seq": 10,
  "id": "r10",
  "ts": "2026-10-26T14:02:29.700Z",
  "requestId": "perm_01",
  "idSource": "derived",
  "subject": {"callId": "toolu_01B"},
  "status": "resolved",
  "decision": "allow_once",
  "decidedBy": "user"
}

A request that was first seen pending and decided later is recorded either as one record written after the decision, or as a pending record followed by a revision:

{
  "type": "permission",
  "seq": 71,
  "id": "r71",
  "ts": "2026-10-26T14:20:03.114Z",
  "requestId": "7",
  "subject": {"callId": "call_44"},
  "title": "Run git push?",
  "options": [
    {"optionId": "allow", "name": "Allow once", "kind": "allow_once"},
    {"optionId": "reject", "name": "Reject", "kind": "reject_once"}
  ],
  "status": "pending"
}

{
  "type": "permission",
  "seq": 74,
  "id": "r74",
  "ts": "2026-10-26T14:20:09.870Z",
  "supersedes": "r71",
  "requestId": "7",
  "subject": {"callId": "call_44"},
  "title": "Run git push?",
  "options": [
    {"optionId": "allow", "name": "Allow once", "kind": "allow_once"},
    {"optionId": "reject", "name": "Reject", "kind": "reject_once"}
  ],
  "status": "resolved",
  "decision": "reject_once",
  "selectedOptionId": "reject"
}

A recorded decision need not identify who resolved the request. T3 Code’s opaque request receipt does not establish who resolved the approval request. In the OpenClaw example, a model reviews the command and a person on a paired device decides:

{
  "type": "permission",
  "seq": 53,
  "id": "r53",
  "ts": "2026-10-26T18:12:44.091Z",
  "requestId": "runtime-request:provider:codex:provider-turn:9d1e",
  "subject": {"command": "git push origin fix/parser-empty"},
  "status": "resolved",
  "reason": "ask_rule",
  "decision": "reject_once",
  "feedback": "Do not push yet. Open a draft pull request instead."
}

{
  "type": "permission",
  "seq": 48,
  "id": "r48",
  "ts": "2026-10-26T07:52:40.118Z",
  "requestId": "apr_6b1e9c",
  "subject": {"callId": "call_x7Rk2"},
  "title": "Run: rm -rf ./build",
  "status": "resolved",
  "reviews": [
    {
      "by": {"address": "exec-auto-review"},
      "verdict": "denied",
      "rationale": "Deletes a directory outside the task."
    }
  ],
  "decision": "allow_once",
  "decidedBy": "user",
  "decider": {"device": "dev_8f2c41"},
  "decidedAt": "2026-10-26T07:53:02.557Z"
}

Field	Type	Req	Meaning
`requestId`	string	yes	Native request ID, or a derived one.
`subject`	object	no	`{callId}` or `{command}`: what the request is about.
`title`	string	no	The request’s title.
`description`	string	no	Longer description.
`options`	array	no	`[{optionId, name, kind}]`; `kind` is `allow_once`, `allow_session`, `allow_always`, `reject_once`, `reject_always` or `cancel` (open).
`status`	string, open	no	Where the request stands: `pending`, `held` (waiting for someone other than the first resolver), `expired` or `resolved`, or a vendor value for another end state the source records. Absent means not recorded.
`decision`	string, open	no	`allow_once`, `allow_session`, `allow_always`, `reject_once`, `reject_always`, `cancelled` or `timeout`. Absent means unresolved.
`selectedOptionId`	string	no	The option chosen.
`decidedBy`	string, open	no	`user`, `policy`, `hook`, `auto_mode`, `agent` or `classifier` (below).
`decider`	Actor	no	Who resolved the request, when the source records it: a parent agent’s session, a device, a chat participant.
`reviews`	array	no	`[{by, verdict?, rationale?}]`: reviews that were separate from the resolution (below).
`rule`	string	no	The configured rule or policy that decided it, as the source names it.
`reason`	string	no	Why approval was required, as the source records it.
`rationale`	string	no	The resolver’s stated reason for its decision.
`feedback`	string	no	Free text sent back to the agent with the decision.
`decidedAt`	Timestamp	no	When the decision was made.

allow_session allows the request for the rest of the session (T3 Code’s acceptForSession). decidedBy values: user (a person), policy (configuration or a rule), hook, auto_mode (an automatic mode with no reviewer), agent (another agent, such as a parent session answering for its child), classifier (a model that reviews actions, such as Codex’s reviewer, Claude Code’s auto-mode classifier or OpenClaw’s automatic review). A review is separate from the resolution when the source records both: a model reviewer’s verdict, then a person’s decision. reviews[].by is an actor reference, verdict is the reviewer’s verdict as the source names it, and rationale is the reviewer’s stated reason. Capture state keys: title, description, feedback, rationale. ASR-268 A permission MUST contain requestId. subject, when present, MUST contain exactly one of callId or command. ASR-269 A permission whose latest revision has no decision is unresolved: its outcome is unknown, like a dangling call. Readers MUST NOT present it as granted or refused. ASR-270 decidedBy, decider, rule and reviews MUST be recorded only from the source. A producer MUST NOT infer that a user decided because no policy is recorded. ASR-280 decidedBy: "classifier" or "agent" MUST be used only when that reviewing model or agent resolved the request. A review that came before another resolver’s decision goes in reviews and does not set decision or decidedBy. ASR-281 When status is resolved, decision MUST be present. When status is pending or held, decision MUST be absent. Each entry of reviews MUST contain by, an actor reference.

Decisions without a request

Some sources record an approval decision on each tool result without recording any request: Claude Code stores a decision on every result, almost all of them made by configuration without a prompt. A full permission record per call would double the stream for no added fact. For these decisions, the result carries a compact permission member:

{
  "type": "tool_result",
  "seq": 22,
  "id": "r22",
  "ts": "2026-10-26T14:02:51.330Z",
  "callId": "toolu_01E",
  "linkage": "exact",
  "status": "completed",
  "content": [
    {"type": "text", "text": "test result: ok. 42 passed; 0 failed"}
  ],
  "permission": {"decision": "allow_once", "decidedBy": "policy"}
}

The compact form has the same decision, decidedBy and rule values as the full record. It is an audit fact on a context-participating record, and it does not change the context view. This exception to the record model is listed in Extensibility. ASR-277 A tool_result.permission MUST contain decision. ASR-278 A tool_result MUST NOT carry permission when a permission record in the stream has subject.callId equal to the result’s callId. ASR-279 A producer MUST use a permission record, not tool_result.permission, when the source records that a request was shown or records the request itself (a title, options, a pending state). Consumers that count approval decisions MUST count each compact decision once.

`input_request`

An input_request records a question the agent or a tool asked the user, and the answer when known: a set of structured questions with options (Claude Code AskUserQuestion, Codex request_user_input, T3 Code question cards, OpenClaw ask_user), a form a tool server asked for (MCP and ACP elicitation in form mode), or a URL the user was asked to open (URL mode). It is audit-only: the question and the answer reach the model only through the records the source keeps for them (a tool call and its result, or messages).

{
  "type": "input_request",
  "seq": 15,
  "id": "r15",
  "ts": "2026-10-26T14:02:30.402Z",
  "requestId": "toolu_01Q",
  "idSource": "derived",
  "callId": "toolu_01Q",
  "mode": "questions",
  "questions": [
    {
      "id": "0",
      "header": "Empty input",
      "text": "What should parse return for empty input?",
      "options": [
        {"label": "An empty list", "description": "Return Ok(vec![])."},
        {
          "label": "An error",
          "description": "Keep Err(Error::Empty) and change the test."
        }
      ],
      "multiSelect": false,
      "allowOther": true
    }
  ],
  "blocking": true,
  "status": "answered",
  "answers": [{"questionId": "0", "selected": ["An empty list"]}]
}

In the example session the agent asked one question with a tool call, and the user picked an option. Claude Code’s questions have no IDs of their own, so the registry derives them from each question’s position. A request for a secret records that it was asked and how it ended, never the value:

{
  "type": "input_request",
  "seq": 66,
  "id": "r66",
  "ts": "2026-10-26T18:20:07.415Z",
  "requestId": "runtime-request:secret:4a7e",
  "mode": "questions",
  "questions": [
    {
      "id": "secret",
      "text": "GitHub token with repo scope",
      "secret": true
    }
  ],
  "status": "answered",
  "_meta": {
    "codes.t3/secretRequest": {"label": "GITHUB_TOKEN", "delivery": "file"}
  }
}

Field	Type	Req	Meaning
`requestId`	string	yes	Native request ID, or a derived one. Shares the entity key with `permission` (ASR-064).
`callId`	string	no	The tool call that asked, when a tool asked.
`mode`	string, open	yes	`questions`, `form` or `url`.
`message`	string	no	The request’s text apart from its questions (the `message` of an MCP or ACP elicitation).
`questions`	array	depends	Required for `questions` mode: `[{id, header?, text, options?, multiSelect?, allowOther?, secret?}]` (below).
`requestedSchema`	object	no	For `form` mode: the JSON Schema of the requested form.
`url`	string	no	For `url` mode: the URL the user was asked to open. Never fetched automatically (ASR-562).
`secret`	boolean	no	`true`: the whole request asks for a secret.
`blocking`	boolean	no	Whether the agent waited for the answer. `false`: it kept working and the answer could come later.
`status`	string, open	no	`pending`, `answered`, `declined`, `cancelled` or `timed_out`. Absent means unknown.
`answers`	array	no	`[{questionId, selected?, text?}]`: answers to individual questions (below).
`response`	string or object	no	A free-text reply that is not an answer to one question, or the submitted content of a form.
`answerRef`	Ref	no	The message that answered, when the answer came later as an ordinary message.
`answeredBy`	Actor	no	Who answered, when the source records it (a person, a parent agent).

Question fields: id (required, unique in the record), header (a short label), text (required, the question), options ([{label, value?, description?}]), multiSelect (more than one option may be chosen), allowOther (a typed answer is allowed), secret (the answer is a secret). Answer fields: questionId (required); selected, the chosen options, each as the option’s value or, when the option has no value, its label; text, a typed answer. For url mode, answered means the user agreed to open the URL. It does not mean that whatever happens at the URL finished. Capture state keys: questions, answers, response. ASR-282 An input_request MUST contain requestId and mode. When mode is questions it MUST contain questions. Each question MUST contain id and text, each option MUST contain label, and each answer MUST contain questionId. ASR-283 A producer MUST NOT record the value given for a secret (a request or question marked secret, or one the source marks as asking for a secret) anywhere in the stream or bundle: not in answers or response, not in native payloads, blobs or _meta. It records only that the secret was asked and the request’s status. ASR-284 Question IDs MUST be unique within an input_request. Each answers[].questionId MUST name a question in the same record, and answerRef, when present, MUST resolve to a message record. ASR-285 status, answers, response and answeredBy MUST come from the source. A producer MUST NOT set answered because a later message exists, unless the source links that message to the request (then answerRef names it).

`terminal`

A terminal is a process entity for long-running and background processes and monitors: ACP v2’s agent-owned terminals, background shell commands, monitors that watch a command’s output, terminal transcripts kept beside a session. A terminal can outlive the call that created it and be read by later calls.

{
  "type": "terminal",
  "seq": 140,
  "id": "r140",
  "terminalId": "term_3",
  "kind": "shell",
  "callId": "toolu_02K",
  "command": "npm run dev",
  "description": "Start the web dev server",
  "cwd": {"root": "app", "path": "web"},
  "status": "running",
  "awaited": false,
  "startedAt": "2026-10-26T14:40:11.020Z"
}

{
  "type": "terminal",
  "seq": 171,
  "id": "r171",
  "supersedes": "r140",
  "terminalId": "term_3",
  "kind": "shell",
  "callId": "toolu_02K",
  "command": "npm run dev",
  "description": "Start the web dev server",
  "cwd": {"root": "app", "path": "web"},
  "status": "stopped",
  "awaited": false,
  "startedAt": "2026-10-26T14:40:11.020Z",
  "completedAt": "2026-10-26T14:52:30.441Z",
  "output": {
    "blob": {
      "blob": "sha256:0d7c3f2b9a1e8d6c4b2a0f9e7d5c3b1a9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c",
      "size": 183344,
      "mimeType": "text/plain"
    }
  }
}

Field	Type	Req	Meaning
`terminalId`	string	yes	Native terminal ID, or a derived one.
`kind`	string, open	no	`shell` (a command running in the background) or `monitor` (a watcher over a command’s output).
`callId`	string	no	The call that created the terminal.
`command`	string or string[]	no	The command.
`description`	string	no	The description the source records for the process.
`cwd`	PathRef	no	Working directory.
`status`	string, open	no	`running`, `exited`, `killed` (ended by a signal), `stopped` (stopped on request by the agent or the user) or `unknown`.
`awaited`	boolean	no	Whether the turn waited for the process to finish.
`exitCode`	integer	no	As in `exec`.
`signal`	string	no	As in `exec`.
`output`	object	no	`{text?, blob?}`: output so far (a snapshot), as text or a blob.
`startedAt`, `completedAt`	Timestamp	no	Process times.

Capture state key: output. ASR-271 A terminal MUST contain terminalId. Each terminal record is a complete snapshot; a later state is a revision with the same terminalId that supersedes the previous record. ASR-272 Terminal output MUST NOT be copied into a tool_result’s content unless the source records that it was delivered to the model. A result that read a recorded terminal sets exec.terminalId under ASR-290. ASR-286 A background agent is a subagent, and its lifecycle is recorded in subagent revisions (see Lineage). A producer MUST NOT also record that agent’s lifecycle as a terminal. A process that an agent runs is a different entity and is a terminal when the source records it.

`hook`

A hook records the execution of a hook: a command, prompt, agent, HTTP call or MCP tool that the harness runs in response to an event, as configured by the user, the project or the harness itself. Setup scripts that the harness runs for a workspace are hooks too.

{
  "type": "hook",
  "seq": 16,
  "id": "r16",
  "ts": "2026-10-26T14:02:45.330Z",
  "event": "post_tool_use",
  "handlerKind": "command",
  "name": "cargo fmt --check",
  "command": "cargo fmt --check",
  "callId": "toolu_01C",
  "status": "completed",
  "exitCode": 0,
  "stdout": "",
  "stderr": "",
  "durationMs": 412
}

{
  "type": "hook",
  "seq": 4,
  "id": "r4",
  "ts": "2026-10-26T18:01:04.772Z",
  "event": "workspace_setup",
  "handlerKind": "command",
  "name": "Workspace ready",
  "command": "pnpm install",
  "status": "completed",
  "output": [{"type": "text", "text": "Done in 4.1s\n"}]
}

The second record comes from a T3 Code thread: T3 Code ran the project’s setup script in a new worktree before the first turn.

Field	Type	Req	Meaning
`event`	string, open	yes	`pre_tool_use`, `post_tool_use`, `user_prompt_submit`, `stop`, `session_start`, `session_end`, `pre_compact`, `notification` or `workspace_setup`.
`hookId`	string	no	Native hook execution ID.
`name`	string	no	The hook’s name or command line.
`handlerKind`	string, open	no	What ran: `command`, `prompt`, `agent`, `http` or `mcp_tool`.
`command`	string or string[]	no	The command run.
`callId`	string	no	The tool call the hook ran for.
`status`	string, open	no	`completed`, `failed`, `blocked`, `cancelled` or `unknown`.
`decision`	string, open	no	`allow`, `deny` or `ask`, when the hook decided something.
`exitCode`	integer	no	As in `exec`.
`timedOut`	boolean	no	The source reports that the hook timed out.
`stdout`	string	no	Standard output.
`stderr`	string	no	Standard error.
`output`	ContentPart[]	no	The hook’s output, when the source does not separate the streams or keeps structured output.
`durationMs`	number	no	Duration.

Capture state keys: stdout, stderr, output. ASR-273 A hook MUST contain event. Content a hook injected into the conversation is a message with author: "hook", not part of the hook record. ASR-287 Hook execution details (exitCode, timedOut, stdout, stderr, output, durationMs) MUST appear only when the source records them. A command the harness runs for its own setup, not at the model’s request, is a hook, not a tool_call.

Introduction

Format

Records

Trust

Extending and conforming

Agent registry

`tool_call`

Who requested a call

Provider identity

`tool_result`

Status

What reached the model

`exec`

Linkage and pairing

`permission`

Decisions without a request

`input_request`

`terminal`

`hook`

​tool_call

​Who requested a call

​Provider identity

​tool_result

​Status

​What reached the model

​exec

​Linkage and pairing

​permission

​Decisions without a request

​input_request

​terminal

​hook

`tool_call`

Who requested a call

Provider identity

`tool_result`

Status

What reached the model

`exec`

Linkage and pairing

`permission`

Decisions without a request

`input_request`

`terminal`

`hook`