Add protected typed tool media and fenced native task continuation

[first-assist]

Summary

Registered tool results can deliver owner-verified protected JPEG/PNG bytes as real provider image content. The SDK retains completed effects and original/effect/current provenance, checks current source authorization on every disclosure, and reserves image capacity atomically. Unsupported or unguarded adapters refuse before protected effects.

Retained native runs can change only their original fingerprint-bound static tool subset after confirmed old-thread deletion and a fenced fresh-thread transition. The same original task/event/status context is freshly priced and authorized. One proved unstarted image reduction can finish through tool-free withholding without renewing consent, repeating effects, or redisclosing unavailable history.

AI 0.107.0, profiles 0.16.0, AI schema 0.72.0. These are documented pre-1.0 source-breaking package releases. Consumer integration: GEMA PR450.

Reviewed PR head 2255dab3c29f5fe2e8233b53a42edc1bf79733e4 merged as 2e8cb79941a41ce1a1ae2a6138b18f2fdb08562b. Its Rust/manifests/lock are byte-identical to qualified runtime source 881cb8a6144d43d377e099fdc4c2e9f18b9a6403; final intervening changes affect six Markdown files.

Verification

• Rust 1.90.0, normal test stack, SQLite plus eight provider features: 626 AI unit tests passed, zero failures, seven existing opt-in live tests ignored; 151 integration cases passed across 33 targets. Five focused owning cases cover direct cleanup modes 0–7, retry/source modes 8–14, cancellation and later-message/deleted-session handling. Unchanged profiles library: 45 tests passed on the qualified core source.
• Both affected packages passed 1.90 scoped all-target Clippy --no-deps -Dwarnings, 1.97.1 all-target Clippy including dependencies -Dwarnings, and warnings/missing-docs-denied Rustdoc on both compilers. The doctest command executed 0 cases with 40 existing ignored snippets; ignored snippets are not reported as executed tests.
• Required local release acceptance passed PostgreSQL and MSSQL compile-only checks, PascalCase naming (1 executed case), and test-owned PostgreSQL parity (1 executed case, no skip). All eight isolated SQLite/provider lanes below passed tests, all-target strict Clippy and warnings/missing-docs-denied Rustdoc on pinned 1.97.1. Each lane executed zero doctests and retained the 40 ignored snippets. Counts across lanes include repeated cases.

Isolated feature	Unit passed	Integration passed	Opt-in live ignored
provider-openai	447	140	1
provider-anthropic	389	140	0
provider-xai	388	140	0
provider-ollama	391	140	0
provider-openai-compatible	387	140	0
local-harness	385	146	0
provider-codex-app-server	503	140	3
provider-grok-acp	436	140	3

• Final documentation, nine-package release state, inventory, package/schema release policy, dependency boundaries, manifest tests, router notice tests, formatting and diff checks passed locally. All 12 canonical hosted CI checks passed at exact final PR head 2255dab. Local acceptance output is retained separately from hosted CI.
• Explicit package-selected conservative SemVer audits against clean baseline 3dcb51231a69ad40158af74f250be133747eacd5: AI 196 checks / 192 passed / 4 failed / 49 skipped; profiles 196 / 195 / 1 / 49. The failures identify documented pre-1.0 source-breaking changes: request-context unwind auto traits, generated session input/aggregate-enum changes, and the descriptor media field. These negative compatibility results remain visible. Selected default release-version classification passed for both packages, detecting a major compatibility boundary (0 checks / 245 skipped). That validates version policy, not backward compatibility. Initial implicit SemVer commands made no API comparison and are not compatibility evidence.
• Installed Codex 0.159.1 generated schemas confirm typed dynamic-tool image output and initial/history image input. Owning SQLite lifecycle and correlated protocol actor tests are separate structural evidence. No physical endpoint/model-vision acceptance or GEMA dependency adoption is claimed.

Publication

Published immutable workspace-2026.10.13.1 at merged source 2e8cb79941a41ce1a1ae2a6138b18f2fdb08562b. The protected canonical Workspace release run completed all 20 jobs successfully after the required Dastari human review. Independent readback verified all nine annotated package tag/tree bindings and the three exact source-only assets, SHA256SUMS/API digests and cryptographic attestations bound to this workflow, main and source commit. Published manifest SHA-256: c26fdb21aa37661c7b98e3fd1cf30605e998d20b50e32fdcd6b522c0ba5241af. The release contains source metadata; GEMA adoption and physical model/endpoint acceptance remain separate.

Documentation impact

• Documentation updated
• No documentation impact

Owning README, migration guide, dated changelog and indexed media reference document source custody, original/effect/current fencing, budgets, final transport guards, schema/restore, static offerings, cleanup and original-task continuation. Migration notes enumerate every reported source-breaking change and consumer remediation. Historical release entries are preserved.