feat(addie): prove provider-neutral read-only tool loop

[bokelley]

Summary

• add a provider-neutral, retry-free loop for an explicitly authorized pure_local read tool boundary
• extend the Google adapter with exact custom-tool request/continuation handling, including Gemini thought-signature and model-role validation
• expose only canonical search_docs and get_doc handlers with search telemetry disabled
• add a synthetic, production-isolated Gemini compatibility runner with bounded dispatches and privacy-safe success/failure accounting

Safety boundary

• no production activation or provider fallback
• maximum two provider dispatches and one local read tool call
• no web/provider tools, mutations, principal data, persistence, or user delivery
• request, schemas, and tool inputs are cloned/frozen; execution requires immediate policy authorization
• transport and compatibility failures emit categorical/hash-only accounting without raw prompts, responses, tool IDs, or provider errors

Validation

• both architecture/security reviewers signed off with no remaining findings
• pre-commit: 487 server test files, 6,994 passed / 30 skipped
• focused provider/replay suite: 78 passed
• final changed-file suite: 24 passed
• typecheck, full build, Addie tool inventory, portability, and diff checks passed
• storyboard matrix: all non-sales tenants passed; three sales scenarios hit concurrent local timeout/RSS limits, then passed individually under the same per-scenario limits (28/28 steps)

No live Gemini call was run because this workspace does not have a Gemini API key. The runner remains manual and production-isolated.

[bokelley]

CI status: all deterministic, security, build, Docker, and storyboard checks are green on the current head. The one storyboard retry was a transient creative_lifecycle.preview_display fetch failure; the exact local replay passed 5/5 graded steps, and the targeted CI shard restored the aggregate to 556 passing steps. The required code_review check remains red after three reproducible Ladon attempts across the original and refreshed heads, each ending in error_max_structured_output_retries with no inline/top-level findings. Tracking the fail-closed reviewer issue in adcontextprotocol/actions#14. No merge override requested.

[aao-secretariat]

Ladon verdict: Approve

Approve — Server/Addie-only PR with no blocking or medium findings.

Scope: Adds a provider-neutral, retry-free read-only tool loop against a synthetic, production-isolated Gemini path. No static/schemas/source/**, docs/reference/**, dist/**, or package.json version surface touched — no changeset required and no protocol governance/breaking-class gate applies.

High-risk flag: true, but all matches under server/src/addie/** are (added) new files (scaffolding) or (modified) files with no medium-or-higher findings. Per the change-kind rules, new files and clean modifications on high-risk paths do not escalate on the flag alone.

Reviewer notes reviewed: the loop caps tool calls to one per iteration with MAX_ITERATIONS=2, caps handler output at 128KB, and collapses handler exceptions to a fixed string so provider/tool-id/exception text never leaks. The Google provider fails closed on missing thought signature / incompatible finish reason. The customTools false→true flip alters no live path (GoogleGenerateContentProvider has zero production instantiations). The unrun live Gemini dispatch is manual and key-gated, wired to nothing in production — acceptable, with a noted follow-up to run the canary before any production activation.

Decision table: no critical/high findings (row 1 n/a); gated_paths false (row 2 n/a); no deletions (row 3 n/a); no medium findings at all (rows 4/5/8 n/a); no prior decision (row 6 n/a); no no-auto-approve team match (row 7 n/a). Falls through to row 9 → approve.