tool.Invocation.ResultSchema (JSON Schema, draft 2020-12): the executor
validates the single-loop final answer and, on violation, runs up to two
bounded corrective rounds on the same conversation (FinalGuard-style
extra rounds, but the round's text IS the new candidate); a conforming
answer is replaced by the bare validated JSON. Fail-open on compile
problems (host pre-dispatch compile is the authoritative gate) and
best-effort on persistent violations (last output stands, hosts keep
their fallback validator). External $refs fail closed — jsonschema/v6's
default loader resolves file:// from local disk, overridden with a deny
loader. Audit events: result_schema_round/_valid/_unmet/_skipped.
Multi-phase runs unvalidated (FinalGuard's single-loop-only scope).

Co-Authored-By: Claude Fable 5 <[email protected]>

@@ -495,0 +497,4 @@
+		// BEFORE FinalGuard so the delivery check inspects the answer that will
+		// actually be returned. Fail-open on compile problems; best-effort on
+		// persistent violations (the host's fallback validator is authoritative).
+		if runErr == nil && runRes != nil && len(inv.ResultSchema) > 0 {

@@ -495,0 +513,4 @@
+						if errs == nil {
+							// Conforming: the bare validated document IS the answer.
+							runRes.Output = string(doc)
+							if rec != nil && round > 0 {

@@ -495,0 +540,4 @@
+					if noteCheckpoint != nil {
+						noteCheckpoint(llm.UserText(correction))
+					}
+					roundOpts := append([]agent.Option{

@@ -495,0 +558,4 @@
+					}
+					// The round's text is the NEW candidate (contrast FinalGuard,
+					// whose extra-round text is discarded meta-commentary).
+					runRes.Output = roundRes.Output

@@ -0,0 +47,4 @@
+type denyLoader struct{}
+
+func (denyLoader) Load(url string) (any, error) {
+	return nil, fmt.Errorf("external $ref %q refused: remote/file schema loading is disabled: %w", url, fs.ErrNotExist)

@@ -0,0 +55,4 @@
+	if len(raw) > resultSchemaMaxBytes {
+		return nil, fmt.Errorf("schema is %d bytes (cap %d)", len(raw), resultSchemaMaxBytes)
+	}
+	doc, err := jsonschema.UnmarshalJSON(strings.NewReader(string(raw)))

@@ -0,0 +72,4 @@
+// left to right. Input is capped at resultSchemaExtractCap.
+func extractResultJSON(s string) (json.RawMessage, bool) {
+	s = strings.TrimSpace(s)
+	if len(s) > resultSchemaExtractCap {

@@ -0,0 +79,4 @@
+		return json.RawMessage(s), true
+	}
+	// Fenced block: ```json ... ``` or bare ``` ... ```.
+	for _, fence := range []string{"```json", "```"} {

@@ -0,0 +90,4 @@
+			}
+		}
+	}
+	// First parseable balanced span.

@@ -0,0 +107,4 @@
+
+// balancedSpanEnd returns the index of the bracket closing the span opened
+// at start, honoring JSON string/escape rules.
+func balancedSpanEnd(s string, start int) (int, bool) {

@@ -0,0 +124,4 @@
+			}
+			continue
+		}
+		switch c {

@@ -0,0 +141,4 @@
+
+// validateResultJSON returns flattened error paths, nil when the doc conforms.
+func validateResultJSON(sch *jsonschema.Schema, doc json.RawMessage) []string {
+	inst, err := jsonschema.UnmarshalJSON(strings.NewReader(string(doc)))

@@ -0,0 +161,4 @@
+	}
+	return out
+}
+

@@ -0,0 +171,4 @@
+}
+
+// flattenValidationError collects leaf causes as "/path: message" lines.
+func flattenValidationError(ve *jsonschema.ValidationError, out *[]string) {

@@ -0,0 +187,4 @@
+
+// resultSchemaCorrection builds the corrective user turn for one round.
+func resultSchemaCorrection(raw json.RawMessage, errs []string) string {
+	return fmt.Sprintf(`Your final answer must be a SINGLE JSON document conforming to this JSON Schema (no prose, no code fences):

@@ -0,0 +161,4 @@
+// TestCompileResultSchema_ExternalRefsFailClosed — http(s) AND file $refs
+// must not resolve (jsonschema/v6's default loader reads local disk).
+func TestCompileResultSchema_ExternalRefsFailClosed(t *testing.T) {
+	for _, ref := range []string{

@@ -0,0 +198,4 @@
+}
+
+// recHas reports whether the recorder saw an event type.
+func recHas(r *eventRecorder, name string) bool {