Pin the approved tool schema and environment result contracts

tests/test_core_extraction.py

@@ -114,8 +114,9 @@ def test_core_catalog_schema_bytes_and_handler_owners_are_stable():
     # the chat as an ordinary owner message) and the optional `max_wait_minutes`
     # bound joins its parameters. Diffing the whole catalog base to head shows
     # exactly those edits and nothing else.
+    # Workflow scope: describe lazy artifact writes and the shared brace-mask selector.
     assert hashlib.sha256(schema_bytes).hexdigest() == (
-        "532059cb95c431df39b0a950ced52e05228e88ec3ddd180bc0d2fa9a0cc8f616"
+        "eb0f87df6a8507019363fe4fb9ba0e0d96cadb094e7619cb41b0821cb71c8e43"
     )
     assert {
         entry.name: (entry.handler.__module__, entry.handler.__name__)

tests/test_git_extraction.py

@@ -107,8 +107,9 @@ def test_git_catalog_schema_bytes_and_handler_owners_are_stable():
         ensure_ascii=False,
         separators=(",", ":"),
     ).encode()
+    # Workflow scope: explicit local base/head comparisons on vcs_diff.
     assert hashlib.sha256(schema_bytes).hexdigest() == (
-        "729fdf1425126168c7408e431611f70ddd11139fa1c4161628fbcec7a27bf8ec"
+        "73f2e452b574e31135f4992750afcd08ecf3b329216df8203b07b7e5e7e32ef0"
     )
     assert {
         entry.name: (entry.handler.__module__, entry.handler.__name__)

tests/test_node_runtime_resolver.py

@@ -882,7 +882,7 @@ def test_relative_path_which_result_is_a_noop(tmp_path, monkeypatch, quiet_boots
     the resolver must run as written — never substitute bundled node."""
     bundled = _healthy_stub(tmp_path / "bundle" / "node-standalone" / "bin" / "node")
     monkeypatch.setattr(resolver, "resolve_bundled_node", lambda: str(bundled))
-    monkeypatch.setattr(resolver.shutil, "which", lambda tok: "bin/node")
+    monkeypatch.setattr(resolver.shutil, "which", lambda tok, path=None: "bin/node")
     ctx = _context(tmp_path)
     args = {"cmd": ["node", "app.js"]}
     resolved, trace = resolve_process_node(ctx, "run_command", args, runtime_mode="advanced")

tests/test_shell_extraction.py

@@ -109,10 +109,16 @@ def test_shell_catalog_schema_bytes_and_handler_owners_are_stable():
     ).encode()
     # run_script accepts any installed file interpreter; its temporary file
     # lives in an ignored workspace directory or the existing task drive.
+    # Workflow scope: explicit saved-setting references and lazy-output guidance.
     assert hashlib.sha256(schema_bytes).hexdigest() == (
-        "2e6ebf9e5d81bc2fb321bd9615d66af2c6cd1e58f7bcc23a1a557353049e99f8"
+        "87606208e795ede931339a7ba106fd0cf795fae314e1bc02cafaba6af8c62660"
     )
     original = json.loads(schema_bytes)
+    for schema in original:
+        schema["parameters"]["properties"].pop("env_from_settings")
+        schema["parameters"]["properties"]["outputs"]["description"] = (
+            "Generated file paths to copy/register into the task artifact store after success."
+        )
     original[1]["description"] = (
         "Run a short task-scoped temporary script with a declared interpreter. "
         "Use for multi-line diagnostics or harness helpers; generated script files live under the task drive. "

tests/test_tool_classification_differential.py

@@ -326,6 +326,9 @@ def _golden() -> dict[str, dict]:
 # unavailable. Keep the historical corpus intact and assert the new observed
 # outcome explicitly rather than manufacture old evidence (04-AGENCY S1/S3).
 CURRENT_PRODUCER_CONTRACTS = {
+    # Saved-setting selection uses the existing process access authority; its new
+    # foreground refusal remains blocked through both text and native ACCESS_BLOCKED.
+    "PROCESS_ENV_REFERENCE_BLOCKED": (True, "blocked"),
     "SAFETY_ADVICE": (False, "ok"),
     "LIGHT_MODE_REPO_CHANGED": (False, "ok"),
     "BROWSER_ACTION_OUTCOME_UNKNOWN": (True, "error"),