spawn.exclude_tools is session-global across every spawned agent — need per-agent spawn tool policy

[bkrabach]

Feature request

Support per-agent spawn tool policy — today spawn.exclude_tools in a composed bundle applies to every spawned sub-agent in every session, which makes it unusable for the common case: a bundle that wants to restrict its own agents' capabilities without touching anyone else's.

Context

amplifier-bundle-converge ships four reasoning agents whose contracts say "returns needs, never re-routes" (no delegate / no skills / no shell). To make those claims structural rather than behavioral, it declared a top-level spawn: exclude_tools: [tool-delegate, tool-skills, tool-bash].

What happens today (DTU-verified 2026-09-02)

apply_spawn_tool_policy reads spawn from the composed mount plan and filters the parent tool list on every spawn:

• With the converge behavior added via --app, foundation:explorer spawned in a plain foundation session lost bash, delegate, load_skill (functional proof: asked to run echo, it replied BASH_ABSENT).
• Removing the bundle restored a byte-identical baseline tool list (causal control).
• The blast radius covers host agents, custom agents, and any agent that doesn't explicitly re-declare the excluded tools.

The bundle has removed the block (microsoft/amplifier-bundle-converge@e1747ba) and downgraded those agent contracts to behavioral rules — the only safe option available.

Ask

A scoped mechanism, e.g. either:

1. Agent-frontmatter spawn policy — an agent file may declare its own spawn: exclude_tools: [...] applied only when that agent is spawned; or
2. Named scoping in the bundle key — spawn: agents: {converge:negotiator: {exclude_tools: [...]}}.

Either restores structural negative-capability contracts ("this agent physically cannot delegate") without any session-wide collateral. Today the only alternatives are prose instructions (unenforced) or the session-wide block (measured collateral above).