GCWing · limityan · Jun 18, 2026 · Jun 18, 2026
diff --git a/docs/plans/core-decomposition-completed.md b/docs/plans/core-decomposition-completed.md
@@ -21,7 +21,7 @@
 - `bitfun-events` 已承接 backend event DTO、agentic event DTO 和 platform-neutral `EventEmitter` trait。
 - `services-integrations` 已承接 remote-connect primitives、wire command routing / response assembly、IM bot provider-neutral config / persistence / file auto-push / locale / menu / state / command parsing、workspace search concrete owner、remote SSH/SFTP/PTY owner、DeepResearch report IO / display-map sidecar、MiniApp host dispatch / storage / worker / import IO。
 - `tool-contracts` 已承接 provider-neutral tool DTO、manifest/catalog/admission/result presentation、Computer Use DTO/input parser/screenshot payload、confirmation facts、truncation recovery presentation、runtime restriction policy 和 provider-entry materialization；core 只保留 Computer Use 旧 public path re-export / compatibility shim 与产品执行入口。
-- `tool-execution` 已承接 local / remote IO helper、Bash shell helper、batching plan、retry policy、state counting、tool state event payload shaping / result redaction、cancellation-state/token-store policy、background exec output capture、部分 result rendering，以及 File tool 的 provider-neutral 结果展示、写入 mode/status/line-count 规则、Edit guardrail 分类和 Delete success 文本；core 只保留 ToolResult 包装、权限、checkpoint、read-state adapter、remote shell/FS 调用和旧工具入口。
+- `tool-execution` 已承接 local / remote IO helper、Bash shell helper、batching plan、retry policy、state counting、tool state event payload shaping / result redaction、cancellation-state/token-store policy、background exec output capture、prompt-safe tool context facts / custom-data materialization、部分 result rendering，以及 File tool 的 provider-neutral 结果展示、写入 mode/status/line-count 规则、Edit guardrail 分类和 Delete success 文本；core 只保留 ToolResult 包装、权限、checkpoint、runtime handles、read-state adapter、remote shell/FS 调用和旧工具入口。
 - `agent-runtime` 已承接 scheduler/background delivery 纯决策、dialog lifecycle port contracts、runtime event queue/router、session management/cancellation port contracts、thread-goal facts、prompt markup / prompt / prompt-cache facts 与持久化写入决策、remote file delivery prompt facts、turn skill/agent snapshot DTO/diff/render/store、file-read session state / prior-read guardrail / freshness 决策、session evidence ledger 与 compression-contract projection、dialog-turn cancellation token store、tool confirmation / user-question wait channel state、custom agent / mode / subagent schema、默认值、discovery/loading、markdown IO、validation、review 工具过滤、skill catalog/root specs、mode policy、selection/shadow/mode-info 规则、assistant payload rendering、post-call hook routing、DeepReview provider-neutral policy/queue/retry/diagnostics shaping 与 queue event payload shaping、DeepResearch citation renumber 与 report post-process gate，并建立不暴露 `bitfun-core` / `product-full` / concrete manager 的内部 SDK facade。SDK facade 已支持注入 fake runtime services、tool registry、harness registry、hook registry 和 agent registry。
 - `harness` 已建立 descriptor、route plan 和 legacy provider registry。
 - `product-domains` 已承接 MiniApp state/workflow planning、compile / permission adaptation、import lifecycle、AI / Agent permission、rate-limit、model/message/session/workspace/turn-text bridge rules、AI / Agent 请求计划、stream / runtime event payload、worker restart / draft key / workspace input 规则、function-agent prompt/parser/response policy 和部分 Git snapshot/fallback 逻辑。

diff --git a/docs/plans/core-decomposition-plan.md b/docs/plans/core-decomposition-plan.md
@@ -21,7 +21,7 @@
 - Desktop / CLI / ACP 仍通过 `bitfun-core/product-full` 获取完整能力；Server / Remote / Web / Mobile Web 不直接依赖 core。Product Assembly 已按入口矩阵裁剪能力计划：完整兼容入口保留 product-full 能力，无直接 core 入口不再 materialize product-full capability packs、feature groups、runtime services、tool groups 或 harness routes。
 - Runtime Services、Agent Runtime、Tool Contracts、Tool Execution、Harness、Product Domains、Services Core、Services Integrations 等 owner crate 已建立；Agent Runtime SDK 内部 facade 已能注入 runtime services、tool registry、harness registry、hook registry、workspace-scoped agent registry 和 runtime event queue/router，部分 concrete 生命周期仍由 core concrete manager 或产品命令路径持有。
 - 最新 custom agent / mode / skill 路径已纳入 `agent-runtime` owner：schema、默认值、skill catalog/root specs、mode policy、selection/shadow 规则、markdown parse/render、validation 与 review 工具过滤规则由 runtime 持有；core 和 desktop 只保留产品工具/模型查询、日志、registry/config 写入、文件路径选择、扫描加载 IO 和命令入口。
-- PR-B 已收口 Agent lifecycle 与 tool side-effect owner：turn skill/agent snapshot DTO / diff / render / store、file-read session state / prior-read guardrail / freshness 决策、session evidence ledger 与 compression-contract projection、dialog-turn cancellation token store、tool confirmation / user-question wait channel state 已迁入 `agent-runtime`；background exec output capture、tool cancellation token store 已迁入 `tool-execution`；core 保留 resolver、产品事件、具体工具执行、IO 编排和旧路径兼容 re-export。
+- PR-B 已收口 Agent lifecycle 与 tool side-effect owner：turn skill/agent snapshot DTO / diff / render / store、file-read session state / prior-read guardrail / freshness 决策、session evidence ledger 与 compression-contract projection、dialog-turn cancellation token store、tool confirmation / user-question wait channel state 已迁入 `agent-runtime`；background exec output capture、tool cancellation token store、prompt-safe tool context facts / custom-data materialization 已迁入 `tool-execution`；core 保留 resolver、产品事件、具体工具执行、IO 编排、runtime handles 和旧路径兼容 re-export。
 - Computer Use 的 provider-neutral DTO、输入解析、截图结果 body/hint 组装已迁入 `tool-contracts`；core 保留 host trait、base64 attachment 生成、产品工具执行和旧 public path re-export / compatibility shim。
 - File tool 的 provider-neutral 结果展示、写入 mode/status/line-count 规则、Edit guardrail 分类和 Delete success 文本已迁入 `tool-execution`；file-read state 的 provider-neutral guardrail / freshness 语义已迁入 `agent-runtime`；core 保留 ToolResult 包装、权限、checkpoint、read-state adapter、remote shell/FS 调用和旧工具入口。
 - PR-C 已收口 Harness / product workflow 的低风险 owner：MiniApp AI / Agent permission、rate-limit、model/message/session/workspace/turn-text 规则迁入 `product-domains`；DeepResearch 后处理 gate 迁入 `agent-runtime`，report IO 继续由 `services-integrations` 持有；function-agent AI concrete acquisition 收拢为 core port adapter，旧 `runtime_services` 路径删除。
@@ -33,7 +33,7 @@
 - `services-core` 已承接 session metadata store、session index rebuild、lineage / branch metadata shaping、JSON file store、session layout 和 legacy session-store merge。
 - `runtime-services` 已承接 typed runtime service assembly、capability validation、provider registry、backend event delivery owner 和无副作用 capability marker ports。
 - `agent-runtime` 已承接 provider-neutral scheduler decisions、dialog lifecycle port contracts、runtime event queue/router、background delivery decisions、thread-goal facts、prompt markup / prompt-cache facts 与持久化写入决策、remote file delivery prompt facts、turn skill/agent snapshot state、file-read session state / prior-read guardrail / freshness 决策、session evidence ledger、dialog-turn cancellation token store、tool confirmation / user-question wait channel state、DeepReview provider-neutral policy / queue / retry / diagnostics shaping 与 queue event payload shaping。
-- `tool-contracts` / `tool-execution` 已承接 tool manifest / catalog / admission、Computer Use contract/payload、batching plan、retry policy、state counting、tool state event payload shaping / result redaction、cancellation-state/token-store policy、background exec output capture、shell helper、部分 local / remote IO helper，以及 file tool provider-neutral result presentation / mode / status / guardrail facts。
+- `tool-contracts` / `tool-execution` 已承接 tool manifest / catalog / admission、Computer Use contract/payload、batching plan、retry policy、state counting、tool state event payload shaping / result redaction、cancellation-state/token-store policy、background exec output capture、prompt-safe tool context facts / custom-data materialization、shell helper、部分 local / remote IO helper，以及 file tool provider-neutral result presentation / mode / status / guardrail facts。
 - `services-core` 已承接 managed runtime command resolution 和 PATH merge 规则；core 只保留产品 managed runtime root 适配。
 - `services-integrations` 已承接 remote-connect primitives、workspace search concrete owner、remote SSH/SFTP/PTY owner、MiniApp host dispatch / storage / worker IO、DeepResearch report IO。
 - `product-domains` 已承接 MiniApp workflow planning、compile / permission path adaptation、AI / Agent 请求计划、stream/event payload、worker restart / draft key / workspace input 规则、function-agent prompt / parser / response policy 和部分 Git snapshot/fallback 逻辑。

diff --git a/scripts/core-boundaries/rules/source/required-rules.mjs b/scripts/core-boundaries/rules/source/required-rules.mjs
@@ -2968,6 +2968,45 @@ export const requiredContentRules = [
       },
     ],
   },
+  {
+    path: 'src/crates/execution/tool-execution/src/context.rs',
+    reason:
+      'tool-runtime must own provider-neutral tool custom-data materialization and context facts projection while core keeps runtime handles and concrete ToolUseContext',
+    patterns: [
+      {
+        regex: /\bpub struct ToolRuntimeCustomDataInput\b/,
+        message: 'missing tool runtime custom-data input DTO',
+      },
+      {
+        regex: /\bpub fn build_tool_runtime_custom_data\b/,
+        message: 'missing tool runtime custom-data owner',
+      },
+      {
+        regex: /\bpub struct ToolRuntimeContextFactsInput\b/,
+        message: 'missing tool runtime context facts input DTO',
+      },
+      {
+        regex: /\bpub fn project_tool_context_facts\b/,
+        message: 'missing tool runtime context facts projection owner',
+      },
+      {
+        regex: /\bpub fn delegation_policy_from_custom_data\b/,
+        message: 'missing delegation policy parsing owner',
+      },
+      {
+        regex: /\bpub fn primary_model_supports_image_understanding\b/,
+        message: 'missing model image-support policy owner',
+      },
+      {
+        regex: /\bmaterializes_provider_neutral_tool_custom_data\b/,
+        message: 'missing tool runtime custom-data regression',
+      },
+      {
+        regex: /\bprojects_prompt_safe_tool_context_facts_only\b/,
+        message: 'missing prompt-safe context facts regression',
+      },
+    ],
+  },
   {
     path: 'src/crates/execution/tool-execution/tests/tool_pipeline_planning.rs',
     reason:
@@ -5895,6 +5934,18 @@ export const requiredContentRules = [
         regex: /\bto_tool_context_facts\b/,
         message: 'missing portable ToolUseContext facts projection',
       },
+      {
+        regex: /\bproject_tool_context_facts\b/,
+        message: 'missing tool-runtime context facts owner delegation',
+      },
+      {
+        regex: /\bbuild_tool_runtime_custom_data\b/,
+        message: 'missing tool-runtime custom-data owner delegation',
+      },
+      {
+        regex: /\bdelegation_policy_from_custom_data\b/,
+        message: 'missing tool-runtime delegation policy owner delegation',
+      },
       {
         regex: /\bimpl PortableToolContextProvider for ToolUseContext\b/,
         message: 'missing portable ToolUseContext facts provider impl',

diff --git a/scripts/core-boundaries/self-test.mjs b/scripts/core-boundaries/self-test.mjs
@@ -2286,6 +2286,9 @@ export function runManifestParserSelfTest({
       contracts: [
         'pub struct ToolUseContext',
         'to_tool_context_facts',
+        'project_tool_context_facts',
+        'build_tool_runtime_custom_data',
+        'delegation_policy_from_custom_data',
         'impl PortableToolContextProvider for ToolUseContext',
         'tool_context_facts_omit_runtime_owner_fields_even_when_context_is_populated',
         'customData',

diff --git a/src/crates/assembly/core/src/agentic/tools/tool_context_runtime.rs b/src/crates/assembly/core/src/agentic/tools/tool_context_runtime.rs
@@ -2,8 +2,8 @@
 //!
 //! This module intentionally keeps service handles, workspace runtime lookup,
 //! path enforcement, cancellation/post-call hooks, and checkpoint recording in
-//! core. The portable facts projection uses `bitfun-agent-tools` DTOs while the
-//! runtime owner type stays here.
+//! core. Provider-neutral context projection and custom-data materialization are
+//! owned by `tool-runtime` while the runtime owner type stays here.
 
 use crate::agentic::coordination::get_global_coordinator;
 use crate::agentic::deep_review::tool_context;
@@ -45,6 +45,11 @@ use std::collections::HashMap;
 use std::future::Future;
 use std::path::{Path, PathBuf};
 use tokio_util::sync::CancellationToken;
+use tool_runtime::context::{
+    build_tool_runtime_custom_data, delegation_policy_from_custom_data,
+    primary_model_supports_image_understanding as runtime_primary_model_supports_image_understanding,
+    project_tool_context_facts, ToolRuntimeContextFactsInput, ToolRuntimeCustomDataInput,
+};
 
 /// Core-owned tool use context.
 #[derive(Debug, Clone)]
@@ -66,22 +71,7 @@ pub struct ToolUseContext {
 
 impl ToolUseContext {
     pub(crate) fn delegation_policy(&self) -> DelegationPolicy {
-        let allow_subagent_spawn = self
-            .custom_data
-            .get("delegation_allow_subagent_spawn")
-            .and_then(|value| value.as_bool())
-            .unwrap_or(true);
-        let nesting_depth = self
-            .custom_data
-            .get("delegation_nesting_depth")
-            .and_then(|value| value.as_u64())
-            .and_then(|value| u8::try_from(value).ok())
-            .unwrap_or(0);
-
-        DelegationPolicy {
-            allow_subagent_spawn,
-            nesting_depth,
-        }
+        delegation_policy_from_custom_data(&self.custom_data)
     }
 
     pub fn workspace_root(&self) -> Option<&Path> {
@@ -104,7 +94,7 @@ impl ToolUseContext {
             }
         });
 
-        ToolContextFacts {
+        project_tool_context_facts(ToolRuntimeContextFactsInput {
             tool_call_id: self.tool_call_id.clone(),
             agent_type: self.agent_type.clone(),
             session_id: self.session_id.clone(),
@@ -117,16 +107,13 @@ impl ToolUseContext {
                     .to_string()
             }),
             runtime_tool_restrictions: self.runtime_tool_restrictions.clone(),
-        }
+        })
     }
 
     /// Whether the session primary model accepts image inputs (from tool-definition / pipeline context).
     /// Defaults to **true** when unset (e.g. API listings without model metadata).
     pub fn primary_model_supports_image_understanding(&self) -> bool {
-        self.custom_data
-            .get("primary_model_supports_image_understanding")
-            .and_then(|v| v.as_bool())
-            .unwrap_or(true)
+        runtime_primary_model_supports_image_understanding(&self.custom_data)
     }
 
     pub fn cancellation_token(&self) -> Option<&CancellationToken> {
@@ -264,60 +251,8 @@ pub(crate) fn build_tool_description_context(
 }
 
 fn build_tool_context_custom_data(context: &ToolExecutionContext) -> HashMap<String, Value> {
-    let mut map = HashMap::new();
-
-    map.insert(
-        "delegation_allow_subagent_spawn".to_string(),
-        serde_json::json!(context.delegation_policy.allow_subagent_spawn),
-    );
-    map.insert(
-        "delegation_nesting_depth".to_string(),
-        serde_json::json!(context.delegation_policy.nesting_depth),
-    );
-
-    if let Some(turn_index) = context.context_vars.get("turn_index") {
-        if let Ok(n) = turn_index.parse::<u64>() {
-            map.insert("turn_index".to_string(), serde_json::json!(n));
-        }
-    }
-
-    if let Some(provider) = context.context_vars.get("primary_model_provider") {
-        if !provider.is_empty() {
-            map.insert(
-                "primary_model_provider".to_string(),
-                serde_json::json!(provider),
-            );
-        }
-    }
-    if let Some(supports_images) = context
-        .context_vars
-        .get("primary_model_supports_image_understanding")
-    {
-        if let Ok(flag) = supports_images.parse::<bool>() {
-            map.insert(
-                "primary_model_supports_image_understanding".to_string(),
-                serde_json::json!(flag),
-            );
-        }
-    }
-    if let Some(acp_transport) = context.context_vars.get("acp_transport") {
-        if let Ok(flag) = acp_transport.parse::<bool>() {
-            map.insert("acp_transport".to_string(), serde_json::json!(flag));
-        }
-    }
-    if let Some(remote_file_delivery) = context
-        .context_vars
-        .get(TOOL_CONTEXT_REMOTE_FILE_DELIVERY_KEY)
-    {
-        if let Ok(flag) = remote_file_delivery.parse::<bool>() {
-            map.insert(
-                TOOL_CONTEXT_REMOTE_FILE_DELIVERY_KEY.to_string(),
-                serde_json::json!(flag),
-            );
-        }
-    }
-
-    let deep_review_parent_context = context.subagent_parent_info.as_ref().map(|parent_info| {
+    let mut extension_custom_data = HashMap::new();
+    let deep_review_parent = context.subagent_parent_info.as_ref().map(|parent_info| {
         tool_context::DeepReviewToolParentContext {
             tool_call_id: parent_info.tool_call_id.as_str(),
             session_id: parent_info.session_id.as_str(),
@@ -326,11 +261,15 @@ fn build_tool_context_custom_data(context: &ToolExecutionContext) -> HashMap<Str
     });
     tool_context::append_tool_use_context_data(
         &context.context_vars,
-        deep_review_parent_context,
-        &mut map,
+        deep_review_parent,
+        &mut extension_custom_data,
     );
-
-    map
+    build_tool_runtime_custom_data(ToolRuntimeCustomDataInput {
+        context_vars: &context.context_vars,
+        delegation_policy: context.delegation_policy,
+        remote_file_delivery_key: TOOL_CONTEXT_REMOTE_FILE_DELIVERY_KEY,
+        extension_custom_data: Some(&extension_custom_data),
+    })
 }
 
 impl ToolUseContext {

diff --git a/src/crates/execution/AGENTS.md b/src/crates/execution/AGENTS.md
@@ -18,7 +18,7 @@ delivery form.
 | `harness` | Harness workflow contracts and registry primitives | [AGENTS.md](harness/AGENTS.md) |
 | `runtime-services` | Typed runtime service assembly and service availability facts | [AGENTS.md](runtime-services/AGENTS.md) |
 | `tool-provider-groups` | Tool provider group facts and product-full tool group composition. Cargo package remains `bitfun-tool-packs`. | [AGENTS.md](tool-provider-groups/AGENTS.md) |
-| `tool-execution` | Low-level file/search/tool IO helpers. Cargo package remains `tool-runtime`. | [AGENTS.md](tool-execution/AGENTS.md) |
+| `tool-execution` | Low-level file/search/tool IO helpers, prompt-safe tool context facts, and provider-neutral tool runtime policies. Cargo package remains `tool-runtime`. | [AGENTS.md](tool-execution/AGENTS.md) |
 
 ## Placement Rules