[kortiene]

Summary

• Add create_codemode_tool() with an explicit immutable capability set instead of discovering all harness tools.
• Validate capability names, schemas, arguments, outputs, result projections, and exactly-once output(...) behavior.
• Add nested capability event ancestry and explicit child-tool inheritance policy.
• Keep the existing exported codemode tool and sandbox behavior unchanged for compatibility.

Testing

• uv run --python 3.12 pytest tests/harness_sdk -q (104 passed, 1 skipped)
• make lint
• git diff --check

Stack

This is the minimal foundation extracted from #119. The independently reviewable hardening follow-up is kortiene#2; it targets this foundation branch in the contributor fork until the foundation can merge.

[kortiene]

Internal-branch replacement for #137. Both PRs point to the exact same reviewed commit, d75f099787ea3d9da2c604fd1ab301fd0985f63d; this replacement allows secret-dependent checks to run from a trusted repository ref.

[arnaugrispg]

Approved!!