feat(run): kernel-native result_schema — validate + in-loop self-repair

tool.Invocation.ResultSchema (JSON Schema, draft 2020-12): the executor
validates the single-loop final answer and, on violation, runs up to two
bounded corrective rounds on the same conversation (FinalGuard-style
extra rounds, but the round's text IS the new candidate); a conforming
answer is replaced by the bare validated JSON. Fail-open on compile
problems (host pre-dispatch compile is the authoritative gate) and
best-effort on persistent violations (last output stands, hosts keep
their fallback validator). External $refs fail closed — jsonschema/v6's
default loader resolves file:// from local disk, overridden with a deny
loader. Audit events: result_schema_round/_valid/_unmet/_skipped.
Multi-phase runs unvalidated (FinalGuard's single-loop-only scope).

Co-Authored-By: Claude Fable 5 <[email protected]>

tool/registry.go

@@ -19,6 +19,7 @@ package tool
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"sync"
 	"time"
@@ -238,6 +239,20 @@ type Invocation struct {
 	// persisted agent row. Skill runs ignore this field.
 	SystemPromptPrepend string
 
+	// ResultSchema, when non-empty, is a JSON Schema (draft 2020-12) the
+	// run's final answer must conform to. The executor validates the
+	// single-loop final output against it and, on violation, runs up to
+	// two bounded corrective rounds on the same conversation so the
+	// model self-repairs with full task context; a conforming answer is
+	// replaced by the bare validated JSON document. The kernel is
+	// FAIL-OPEN on schema problems (an uncompilable schema logs a WARN
+	// and skips validation — the host's own pre-dispatch compile is the
+	// authoritative gate) and best-effort on persistent violations (the
+	// last output stands; hosts keep their own fallback validator /
+	// error envelope). Multi-phase runs are not validated, matching
+	// FinalGuard's single-loop-only scope.
+	ResultSchema json.RawMessage
+
 	// SuppressDelivery, when true, instructs the skill executor to
 	// SKIP its OutputTarget Delivery (Deliver / DeliverError) entirely.
 	// The run still produces an output string (returned from Run) and