In multi-agent pentests (e.g. Issue #1439 against DVWA), subagents frequently
discover exploitable vulnerabilities and supply them as narrative strings in
agent_finish(findings=[...]) without first calling create_vulnerability_report.
Because parent agents strictly rely on filed_report_ids from authoritative state
and avoid refiling from narrative text, these findings are silently dropped,
causing scans of vulnerable targets to complete with 0 findings.
1. In child_initial_input, explicitly instruct subagents to file confirmed
vulnerabilities via create_vulnerability_report before calling agent_finish,
clarifying that passing findings to agent_finish does not persist reports.
2. In agent_finish, when findings is non-empty but filed_report_ids is empty,
attach an explicit warning to the tool response payload and the rendered
completion report delivered to the parent inbox.
3. Add regression tests in test_agent_graph_coordination.py and test_inputs.py.
A base URL no longer forces chat completions. resolve_api_type() keeps an
explicit STRIX_API_TYPE, uses Responses without a base URL or for
api.openai.com, uses Responses for models whose LiteLLM catalog entry has
no /v1/chat/completions endpoint, and chat completions for other gateways.
On the chat completions route, reasoning_effort is omitted for models
whose LiteLLM parameter map does not list it there instead of failing the
request with function tools. STRIX_REASONING_EFFORT and STRIX_API_TYPE
are matched case-insensitively.
Siblings differ only in the skills they were spawned with, but those came
first in <specialized_knowledge>, so their prompts diverged at 39%. Shared
skills and the catalog now come first, and the requested skills follow a
cache point, so siblings share 93%.
The extra system message takes a fourth Claude breakpoint, so the Bedrock
tool_config one goes: the first system breakpoint already covers the tools.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
feat(inputs): implement logic for required tool choice based on model
test(inputs): add tests for force_required_tool_choice behavior
test(runner): update tests to include force_required_tool_choice in settings
