symfonic.agent.cutover.bundle

bundle

What the composition root authorised, and what it can actually serve.

KernelDelegate must not take a raw list of capabilities. A list is a request; this is a decision already made — folded in the composition root, where the host knows which capabilities it trusts, and transported unchanged through the delegate. The delegate carries it; it does not compose it.

The bundle exists because :data:~.policy.BASELINE_OVERRIDES pins auto_hydrate=False, and lifting that pin needs evidence rather than a flag. Legacy's auto_hydrate does two separable things, and both have to travel:

• ranked retrieval — a MemoryRetrievalPort;
• the conversation window — a ConversationSource.

Half of that is the dangerous shape. An agent admitted with retrieval and no conversation source serves a prompt missing the block that goes first, the most recent thing the user said, and the model answers plausibly regardless. Nothing raises; the only symptom is an assistant that appears to have stopped listening. So :meth:RetrievalBundle.serves_hydration requires both, and the envelope asks it rather than trusting the caller.

RetrievalBundle dataclass

RetrievalBundle(retrieval: Any = None, conversation: Any = None, onboarding: Any = None, router: Any = None, identity: Any = None, writes: Any = None, lifecycle: Any = None, system_prompt: Any = None, stages: tuple[Any, ...] = (), stage_handlers: Mapping[str, Any] = dict(), authorized_effects: frozenset[str] = frozenset(), capability_names: tuple[str, ...] = (), tools: tuple[tuple[str, Any], ...] = (), delegation: Any = None, extensions: Any = None, human: Any = None)

The memory sources an authorised composition root handed to the kernel.

Both fields default to None so an incomplete bundle is constructible and refusable. Making them required would move the failure to construction, which sounds stricter and is worse: the composition root would raise at startup with no way to say "this deployment serves recall but not the window", and the envelope would never get to explain which half is missing.

missing

missing() -> tuple[str, ...]

The segments that cannot be served, named for the refusal message.

Named rather than counted: "the bundle is incomplete" sends a reader to re-derive which half, and the two halves fail in different ways.

Source code in src/symfonic/agent/cutover/authorised.py

def missing(self) -> tuple[str, ...]:
    """The segments that cannot be served, named for the refusal message.

    Named rather than counted: "the bundle is incomplete" sends a reader to
    re-derive which half, and the two halves fail in different ways.
    """
    absent: list[str] = []
    if not _answers(self.retrieval, "retrieve"):
        absent.append("retrieval")
    elif not _answers(self.retrieval, "scan_candidates"):
        # Named apart from a missing port, because the fixes differ: one
        # deployment forgot to wire a store, the other wired a store that
        # can only be asked for a capped result.
        absent.append("retrieval scan (CandidateScan.scan_candidates)")
    if not self.serves_conversation():
        absent.append("conversation")
    return tuple(absent)

serves_consolidation

serves_consolidation() -> bool

Both halves, because staging without committing recalls nothing.

write alone is not evidence, for the reason :meth:serves_retrieval gives about retrieve: the write port's own contract says "Pending memories are not retrievable until MemoryLifecyclePort.flush". A bundle that stages and cannot commit would be admitted, would run the write stage, and would leave a store that recalls nothing — admitted, answered, and empty.

Source code in src/symfonic/agent/cutover/authorised.py

def serves_consolidation(self) -> bool:
    """Both halves, because staging without committing recalls nothing.

    ``write`` alone is not evidence, for the reason
    :meth:`serves_retrieval` gives about ``retrieve``: the write port's own
    contract says "Pending memories are not retrievable until
    ``MemoryLifecyclePort.flush``". A bundle that stages and cannot commit
    would be admitted, would run the write stage, and would leave a store
    that recalls nothing — admitted, answered, and empty.
    """
    return _answers(self.writes, "write") and _answers(self.lifecycle, "flush")

serves_delegation

serves_delegation() -> bool

Whether a child can actually be reached from an admitted turn.

Asked by the envelope before sub_agents is admitted, and asked of the bundle rather than of the agent for the reason :meth:serves_hydration is: an agent that declares children and a bundle that carries no way to reach them is the half-shape. The turn would be served, the model would never be offered run_agent, and the parent would answer the question itself -- plausibly, with nothing raised. Both halves travel or the envelope stays closed: a capability that can name its children, and at least one bound tool for the model to reach them with.

Source code in src/symfonic/agent/cutover/authorised.py

def serves_delegation(self) -> bool:
    """Whether a child can actually be reached from an admitted turn.

    Asked by the envelope before ``sub_agents`` is admitted, and asked of
    the *bundle* rather than of the agent for the reason
    :meth:`serves_hydration` is: an agent that declares children and a
    bundle that carries no way to reach them is the half-shape. The turn
    would be served, the model would never be offered ``run_agent``, and
    the parent would answer the question itself -- plausibly, with nothing
    raised. Both halves travel or the envelope stays closed: a capability
    that can name its children, and at least one bound tool for the model
    to reach them with.
    """
    return bool(self.delegation is not None and self.tools)

serves_extensions

serves_extensions() -> bool

Whether a loaded plugin can actually reach an admitted turn (TA8.21).

Asked by the envelope before plugins is admitted, and asked of the bundle for the reason :meth:serves_delegation is. The half-shape here is the quietest one in this migration: an agent with a plugin loaded, admitted onto a path where nothing harvests it, is served normally -- the model answers, nothing raises, and the plugin's instructions are simply not in the prompt while its validate_state_transition is never asked.

Both halves travel or the envelope stays closed: a capability, and evidence its contribution actually landed in this fold. The second is checked by stage id rather than by presence, because a capability object that was passed and then contributed nothing -- an empty composition, a fold that skipped it -- is exactly the state that looks wired and is not.

Source code in src/symfonic/agent/cutover/authorised.py

def serves_extensions(self) -> bool:
    """Whether a loaded plugin can actually reach an admitted turn (TA8.21).

    Asked by the envelope before ``plugins`` is admitted, and asked of the
    *bundle* for the reason :meth:`serves_delegation` is. The half-shape
    here is the quietest one in this migration: an agent with a plugin
    loaded, admitted onto a path where nothing harvests it, is served
    normally -- the model answers, nothing raises, and the plugin's
    instructions are simply not in the prompt while its
    ``validate_state_transition`` is never asked.

    Both halves travel or the envelope stays closed: a capability, **and**
    evidence its contribution actually landed in this fold. The second is
    checked by stage id rather than by presence, because a capability
    object that was passed and then contributed nothing -- an empty
    composition, a fold that skipped it -- is exactly the state that looks
    wired and is not.
    """
    if self.extensions is None:
        return False
    stage = getattr(self.extensions, "stage_id", "")
    return bool(stage) and any(
        getattr(descriptor, "stage_id", None) == stage
        for descriptor in self.stages
    )

serves_human

serves_human() -> bool

Whether a turn admitted here could actually stop and be answered.

Asked by the envelope (_human_refusal) before an agent carrying a _human_interaction capability is admitted, of the bundle for the reason :meth:serves_extensions is asked of it, and checked by stage id rather than by presence for the same reason: a capability object that was passed and then contributed nothing -- nothing registered, no per-run binding resolver, no token encoder -- is exactly the state that looks wired and is not. An agent in it would offer ask_user to the model, or worse would not, and either way a human-in-the-loop consumer would wait for a pause that no stage in the compiled plan can raise.

Source code in src/symfonic/agent/cutover/authorised.py

def serves_human(self) -> bool:
    """Whether a turn admitted here could actually stop and be answered.

    Asked by the envelope (``_human_refusal``) before an agent carrying a
    ``_human_interaction`` capability is admitted, of the *bundle* for the
    reason :meth:`serves_extensions` is asked of it, and
    checked by **stage id rather than by presence** for the same reason: a
    capability object that was passed and then contributed nothing --
    nothing registered, no per-run binding resolver, no token encoder -- is
    exactly the state that looks wired and is not. An agent in it would
    offer ``ask_user`` to the model, or worse would not, and either way a
    human-in-the-loop consumer would wait for a pause that no stage in the
    compiled plan can raise.
    """
    if self.human is None:
        return False
    from symfonic.capabilities.human.contribution import PAUSE_STAGE_ID

    return any(
        getattr(descriptor, "stage_id", None) == PAUSE_STAGE_ID
        for descriptor in self.stages
    )

serves_hydration

serves_hydration() -> bool

Both segments, or the envelope stays closed.

Source code in src/symfonic/agent/cutover/authorised.py

def serves_hydration(self) -> bool:
    """Both segments, or the envelope stays closed."""
    return self.serves_retrieval() and self.serves_conversation()

serves_identity

serves_identity() -> bool

Whether the assistant's identity travels and can be rendered.

Source code in src/symfonic/agent/cutover/authorised.py

def serves_identity(self) -> bool:
    """Whether the assistant's identity travels and can be rendered."""
    return _answers(self.identity, "read")

serves_onboarding

serves_onboarding() -> bool

Whether an onboarding directive travels and can be rendered.

Source code in src/symfonic/agent/cutover/authorised.py

def serves_onboarding(self) -> bool:
    """Whether an onboarding directive travels and can be rendered."""
    return _answers(self.onboarding, "read")

serves_retrieval

serves_retrieval() -> bool

Both seams, because the composition needs both.

retrieve alone is not evidence. PortCandidateSource requires scan_candidates -- the gates that decide what survives run after retrieval, so a capped read starves them -- and a bundle claiming to serve recall on the strength of retrieve was admitted by the envelope and then refused by the fold. Admission has to ask for what composition will demand, or the refusal arrives after the decision that depended on it.

Source code in src/symfonic/agent/cutover/authorised.py

def serves_retrieval(self) -> bool:
    """Both seams, because the composition needs both.

    ``retrieve`` alone is not evidence. ``PortCandidateSource`` requires
    ``scan_candidates`` -- the gates that decide what survives run after
    retrieval, so a capped read starves them -- and a bundle claiming to
    serve recall on the strength of ``retrieve`` was admitted by the
    envelope and then refused by the fold. Admission has to ask for what
    composition will demand, or the refusal arrives after the decision that
    depended on it.
    """
    return _answers(self.retrieval, "retrieve") and _answers(
        self.retrieval, "scan_candidates"
    )

serves_routing

serves_routing() -> bool

Whether a turn's palette can actually be narrowed.

contribute alone is not evidence for the same reason retrieve was not: the boundary binds what the snapshot holds, so a router that cannot answer leaves the plan's binding in place and the turn is offered every tool -- which is the disabled behaviour wearing an admission.

Source code in src/symfonic/agent/cutover/authorised.py

def serves_routing(self) -> bool:
    """Whether a turn's palette can actually be narrowed.

    ``contribute`` alone is not evidence for the same reason ``retrieve``
    was not: the boundary binds what the *snapshot* holds, so a router that
    cannot answer leaves the plan's binding in place and the turn is offered
    every tool -- which is the disabled behaviour wearing an admission.
    """
    return _answers(self.router, "contribute")

serves_system_prompt

serves_system_prompt() -> bool

Whether an authored system prompt travels and can be read.

Separate from :meth:serves_hydration because they lift separate pins: an agent may hydrate without shaping a system prompt, and one that shapes a prompt without hydrating is equally valid. Folding them into one predicate would make each flag wait on the other's evidence.

Source code in src/symfonic/agent/cutover/authorised.py

def serves_system_prompt(self) -> bool:
    """Whether an authored system prompt travels and can be read.

    Separate from :meth:`serves_hydration` because they lift separate pins:
    an agent may hydrate without shaping a system prompt, and one that
    shapes a prompt without hydrating is equally valid. Folding them into
    one predicate would make each flag wait on the other's evidence.
    """
    return _answers(self.system_prompt, "read")

fold_retrieval_bundle

fold_retrieval_bundle(*, retrieval: Any = None, conversation: Any = None, scope: Any = None, limit: int = 5, recent_turns: int = 5, exclude_speakers: frozenset[str] = frozenset(), min_relevance: float = 0.0, min_salience: float = 0.0, order: int = 0, system_prompt: Any = None, context_window: int | None = None, prompt_share: float | None = None, chars_per_token: int | None = None, writes: Any = None, lifecycle: Any = None, records_from: Any = None, identity: Any = None, onboarding: Any = None, router: Any = None, delegation: Any = None, extensions: Any = None, human: Any = None) -> RetrievalBundle

The composition root: two ports in, one authorised bundle out.

This is the only place the memory stack is assembled for the migrated path, and assembling it here is the point — KernelDelegate transports a decision already made, it does not compose one. A delegate handed a raw list of capabilities would be a delegate deciding what a host trusts.

The chain is short because #14 chose to reuse the composition that exists rather than build a second one:

• the retrieval port becomes a CandidateSource;
• RetrievalCoordinator ranks, gates and blends scopes;
• WorkingWindow reads the conversation through its own source;
• HydrationCoordinator composes both — window first, then recall, under one ceiling with one drop ledger — and is the single owner of that order.

recent_turns defaults to a real number rather than to WorkingWindow's own 0. That default means "disabled without being unwired -- skip the round trip entirely", which is the correct default for a window an adopter assembles deliberately and precisely the wrong one here: this function exists to serve both segments, and taking the class default would have wired a conversation source that is never called. The first version of this function did exactly that, and the integration test is what found it. 0 is now refused rather than silently honoured.

min_relevance, min_salience and exclude_speakers are TA8.37's (C1-C) threading of the deployment's own retrieval gates, and they default to "no gate" because a composition root that states none must get the behaviour it got before they existed. They are values, not policy objects, for the reason recent_turns is a number: the composition root knows the deployment's configuration and this function knows the capability's shape, and handing a RetrievalPolicy across that seam would make the caller import the capability to configure it.

Only these three. The layer set, the ranking weights and the scope blend are honoured by the retrieval engine the port wraps -- they are already in the answer it returns -- so restating them on the coordinator's policy would be two components deciding one ranking, which is the defect PortCandidateSource's pre_ranked flag exists to prevent.

context_window, prompt_share and chars_per_token are the deployment's budgeting, bound to the compiler here because neither side of that seam may import the other -- :mod:symfonic.agent.cutover.budget.

delegation is a DelegationCapability the composition root already built over the parent's children (TA8.12). It is folded like any other capability rather than special-cased, which is the point: its contribution is tools, and until this task the fold had nowhere to put one and raised. Passing None -- what every agent with no child passes -- folds no delegation and changes nothing.

extensions is an ExtensionsCapability over the agent's loaded plugins (TA8.21), folded the same way and for the same reason. Its contribution is a resolution stage: it harvests each plugin's prompt hook once per turn and leaves compiler-ready mappings in the turn's snapshot, which is where prompting reads them. Folded before prompting because a fragment that arrived after the compile is a fragment that is not in the prompt -- the ladder already guarantees resolution precedes compilation, and the stage's optional_before says so a second time.

human is a HumanInteractionCapability the composition root wired over its own signer, ledger and checkpoint ports (TA8.34). Folded the same way and for the same reason; it is the first capability to contribute both halves -- a pre-tool stage that stops the run and the ask_user tool the model reaches for -- and neither is special-cased here. None for every agent whose deployment wired no pause transport, which folds nothing and changes nothing.

Imported inside the function on purpose: agent.cutover must not take a module-level dependency on the memory capability, or every agent that never hydrates would import the whole memory stack to construct a plan.

Source code in src/symfonic/agent/cutover/bundle.py

def fold_retrieval_bundle(
    *,
    retrieval: Any = None,
    conversation: Any = None,
    scope: Any = None,
    limit: int = 5,
    recent_turns: int = 5,
    exclude_speakers: frozenset[str] = frozenset(),
    min_relevance: float = 0.0,
    min_salience: float = 0.0,
    order: int = 0,
    system_prompt: Any = None,
    context_window: int | None = None,
    prompt_share: float | None = None,
    chars_per_token: int | None = None,
    writes: Any = None,
    lifecycle: Any = None,
    records_from: Any = None,
    identity: Any = None,
    onboarding: Any = None,
    router: Any = None,
    delegation: Any = None,
    extensions: Any = None,
    human: Any = None,
) -> RetrievalBundle:
    """The composition root: two ports in, one authorised bundle out.

    This is the only place the memory stack is assembled for the migrated path,
    and assembling it here is the point — ``KernelDelegate`` transports a
    decision already made, it does not compose one. A delegate handed a raw
    list of capabilities would be a delegate deciding what a host trusts.

    The chain is short because #14 chose to reuse the composition that exists
    rather than build a second one:

    * the retrieval port becomes a ``CandidateSource``;
    * ``RetrievalCoordinator`` ranks, gates and blends scopes;
    * ``WorkingWindow`` reads the conversation through its own source;
    * ``HydrationCoordinator`` composes both — window first, then recall, under
      one ceiling with one drop ledger — and is the single owner of that order.

    ``recent_turns`` defaults to a real number rather than to
    ``WorkingWindow``'s own ``0``. That default means "disabled without being
    unwired -- skip the round trip entirely", which is the correct default for
    a window an adopter assembles deliberately and precisely the wrong one
    here: this function exists to serve both segments, and taking the class
    default would have wired a conversation source that is never called. The
    first version of this function did exactly that, and the integration test
    is what found it. ``0`` is now refused rather than silently honoured.

    ``min_relevance``, ``min_salience`` and ``exclude_speakers`` are TA8.37's
    (C1-C) threading of the deployment's own retrieval gates, and they default
    to "no gate" because a composition root that states none must get the
    behaviour it got before they existed. They are *values*, not policy
    objects, for the reason ``recent_turns`` is a number: the composition root
    knows the deployment's configuration and this function knows the
    capability's shape, and handing a ``RetrievalPolicy`` across that seam
    would make the caller import the capability to configure it.

    Only these three. The layer set, the ranking weights and the scope blend
    are honoured by the retrieval engine the port wraps -- they are already in
    the answer it returns -- so restating them on the coordinator's policy
    would be two components deciding one ranking, which is the defect
    ``PortCandidateSource``'s ``pre_ranked`` flag exists to prevent.

    ``context_window``, ``prompt_share`` and ``chars_per_token`` are the
    deployment's budgeting, bound to the compiler here because neither side of
    that seam may import the other -- :mod:`symfonic.agent.cutover.budget`.

    ``delegation`` is a ``DelegationCapability`` the composition root already
    built over the parent's children (TA8.12). It is folded like any other
    capability rather than special-cased, which is the point: its contribution
    is *tools*, and until this task the fold had nowhere to put one and raised.
    Passing ``None`` -- what every agent with no child passes -- folds no
    delegation and changes nothing.

    ``extensions`` is an ``ExtensionsCapability`` over the agent's loaded
    plugins (TA8.21), folded the same way and for the same reason. Its
    contribution is a *resolution stage*: it harvests each plugin's prompt hook
    once per turn and leaves compiler-ready mappings in the turn's snapshot,
    which is where prompting reads them. Folded **before** prompting because a
    fragment that arrived after the compile is a fragment that is not in the
    prompt -- the ladder already guarantees resolution precedes compilation,
    and the stage's ``optional_before`` says so a second time.

    ``human`` is a ``HumanInteractionCapability`` the composition root wired
    over its own signer, ledger and checkpoint ports (TA8.34). Folded the same
    way and for the same reason; it is the first capability to contribute
    *both* halves -- a ``pre-tool`` stage that stops the run and the
    ``ask_user`` tool the model reaches for -- and neither is special-cased
    here. ``None`` for every agent whose deployment wired no pause transport,
    which folds nothing and changes nothing.

    Imported inside the function on purpose: ``agent.cutover`` must not take a
    module-level dependency on the memory capability, or every agent that never
    hydrates would import the whole memory stack to construct a plan.
    """
    from symfonic.agent.cutover.budget import prompt_compile_options
    from symfonic.agent.cutover.completeness import (
        refuse_partial_consolidation,
        refuse_partial_hydration,
    )
    from symfonic.capabilities.memory.candidates import PortCandidateSource
    from symfonic.capabilities.memory.coordinator import (
        RetrievalCoordinator,
        RetrievalPolicy,
    )
    from symfonic.capabilities.memory.hydration import HydrationCoordinator
    from symfonic.capabilities.memory.working import WorkingWindow
    from symfonic.capabilities.prompting.capability import PromptingCapability
    from symfonic.kernel.contracts.contributions import fold_contributions
    from symfonic.kernel.contracts.effects import EffectFamily

    # Memory is optional, and each segment is folded on its own evidence: an
    # agent may shape a prompt without hydrating, or record without recalling.
    hydrating = refuse_partial_hydration(retrieval, conversation, recent_turns)
    consolidating = refuse_partial_consolidation(writes, lifecycle, records_from)

    capabilities: list[Any] = []
    hydrator = None if not hydrating else HydrationCoordinator(
        retrieval=RetrievalCoordinator(
            source=PortCandidateSource(retrieval),
            # TA8.37 (C1-C). The deployment's two floors, threaded rather than
            # defaulted. Before this the coordinator took ``RetrievalPolicy()``
            # and an adopter's relevance and importance floors were dropped on
            # the migrated route with nothing said -- the silent drop this
            # whole programme keeps finding one capability lower down. Passed
            # as ``min_relevance``/``min_salience`` and nothing else, so the
            # layer set, the weights and the scope blend stay the policy's own
            # defaults: those three are honoured by the retrieval engine the
            # port wraps, and stating them twice would be two places to
            # disagree about one ranking.
            policy=RetrievalPolicy(
                min_relevance=min_relevance, min_salience=min_salience
            ),
        ),
        working=WorkingWindow(
            source=conversation,
            recent_turns=recent_turns,
            exclude_speakers=exclude_speakers,
        ),
        order=order,
    )
    # The grant travels in ``effect_grants``, not in the capability list. The
    # two are a deliberately separate channel: the facade pre-scans adopter
    # ``GrantEffects`` entries and strips them *before* folding, so a capability
    # can never reach the fold carrying its own authorisation. Passing one in
    # the list here would be that same self-grant, wearing the host's clothes.
    #
    # ``MemoryCapability`` declares ``memory-read``; the host grants it, and the
    # fold checks the declaration is a narrowing of what was granted.
    # Both halves, and the second is not optional. Memory is a *resolution*
    # stage: it performs the effect and contributes to the snapshot, never the
    # assembly. Prompting is the *compilation* stage that reads that snapshot.
    # Folding memory alone left the model with the bare instructions.
    # The system prompt rides as one of prompting's own sources, which is the
    # whole of path A: it is a contribution the compiler orders, budgets and
    # delimits like any other, not a second prompt assembled beside it.
    sources: tuple[Any, ...] = ()
    if system_prompt is not None:
        from symfonic.capabilities.prompting.hms import hms_contribution

        sources = (hms_contribution(system_prompt),)

    memory = memory_capability(
        hydrator, scope=scope, limit=limit,
        writes=writes, records_from=records_from, lifecycle=lifecycle,
        consolidating=consolidating,
    )
    if memory is not None:
        capabilities.append(memory)
    # Delegation is folded *before* prompting only so that the tool list reads
    # in declaration order; it contributes no stage, so the ladder is unmoved.
    if router is not None:
        capabilities.append(router)
    if delegation is not None:
        capabilities.append(delegation)
    # Extensions before prompting for a real reason rather than a cosmetic one:
    # it is the resolution half of the prompt seam, and the compiler reads what
    # resolution left behind.
    if extensions is not None:
        capabilities.append(extensions)
    # Human interaction after extensions and before prompting, and the position
    # is cosmetic rather than structural: its stage is ``pre-tool``, and the
    # phase ladder puts every ``pre-tool`` stage after every ``prompt-assembly``
    # one no matter what order they were folded in. Folded here so the tool
    # list reads in declaration order, which is delegation's reason too.
    if human is not None:
        capabilities.append(human)
    # Budgeting is bound here, not chosen by the capability: the compiler
    # refuses to resolve its own estimator, and the runtime service that
    # produces one may not be imported from a capability. See
    # ``agent/cutover/budget.py`` for which deployment gets which binding.
    capabilities.append(
        PromptingCapability(
            sources=sources,
            options=prompt_compile_options(
                context_window=context_window,
                prompt_share=prompt_share,
                chars_per_token=chars_per_token,
            ),
        )
    )

    folded = fold_contributions(
        capabilities,
        # Granted only when a capability declares it. A grant with no claimant
        # is authority nobody asked for, and the fold refuses a declaration
        # wider than the grant rather than the other way round.
        effect_grants=(
            (frozenset({EffectFamily.MEMORY_READ}) if hydrating else frozenset())
            | (frozenset({EffectFamily.MEMORY_WRITE}) if consolidating else frozenset())
            # TA8.71. Consolidation is two effects, not one. Staging a record
            # and publishing it are separate operations on separate protocols,
            # and the capability declares ``memory-flush`` for the finalize
            # stage; granting only ``memory-write`` made the fold refuse the
            # whole bundle the moment that stage was declared -- which is why
            # the stage had never been declared, and why nothing published.
            | (frozenset({EffectFamily.MEMORY_FLUSH}) if consolidating else frozenset())
        ),
    )
    stages, handlers, effects, contributed_tools, names, _preconditions = folded
    # The tool path this bundle used to refuse to have (TA8.12).
    #
    # It raised here, and the raise was correct while it stood: the bundle
    # handed stages and handlers to a legacy engine that bound its own tools,
    # so a tool-offering capability's tools vanished with nothing said -- the
    # declared-and-never-read defect the comment above names. What changed is
    # not the tolerance, it is the destination. ``KernelDelegate`` now merges
    # :attr:`RetrievalBundle.tools` into the one normalized set
    # ``AgentPlanFactory`` compiles from, which is the set ``bind_tools``, the
    # G4 manifest, ``ToolAdapter`` and the ``tool_call`` grant all read.
    #
    # Bound here rather than in the delegate, because binding is a composition
    # decision: a capability offers a *description* of a tool precisely so it
    # never has to know which tool type the runtime uses, and the root is what
    # knows. The pairing with the capability name survives the binding so a
    # collision is still reported by whoever caused it.
    from symfonic.agent.cutover.delegation import bind_contributed_tools

    tools = bind_contributed_tools(contributed_tools)

    return RetrievalBundle(
        retrieval=retrieval,
        conversation=conversation,
        writes=writes,
        lifecycle=lifecycle,
        identity=identity,
        onboarding=onboarding,
        router=router,
        system_prompt=system_prompt,
        stages=stages,
        stage_handlers=handlers,
        authorized_effects=effects,
        capability_names=names,
        tools=tools,
        delegation=delegation,
        extensions=extensions,
        human=human,
    )