@spec bind_contract(pid(), atom(), map()) ::
  {:ok, Backplane.AgentRuntime.Codex.Contract.t()}
  | {:error, Backplane.AgentRuntime.Error.t()}

Binds a normalized host contract to one collaboration action in this manager.

The returned contract does not grant authority. Hosts must explicitly grant its name, revision and collaboration_binding.fingerprint in tool_bindings. Argument/result conversion belongs to its trusted registered backend.

@spec call_bound(map(), map()) :: Backplane.AgentRuntime.ToolEffects.result()

Executes an admitted host invocation using its immutable collaboration binding.

The original invocation and arguments remain the effect/refusal identity; canonical_arguments are separately converted by the trusted host adapter.

Cancels only the current child interaction identified by the exact correlation.

Success acknowledges terminal persistence and confirmed resource settlement. The reason is diagnostic text (at most 1024 bytes), not a stop policy. An unknown outcome must be reconciled through observation, never retried.

Returns a specification to start this module under a supervisor.

See Supervisor.

Completes a persisted stage without the source manager or executing any effect.

Only exact Goal acknowledgements and recovery fences may follow its checkpoint. The host must explicitly refresh stale retirement receipts before completion.

Sends a bounded notification only to an expected live recipient turn.

sender is the trusted Runtime operation (including incarnation and Session resource owner). recipient is an identity from this manager's snapshot and includes manager_id, agent_id, run_id and incarnation. notification contains stable id, text and optional serializable metadata. Skips never enter mailboxes; ambiguous delivery is an error and must be reconciled rather than retried.

Consumes an independently persisted exact child retirement receipt.

Seals a fenced, host-only manager or exact child recovery inventory.

Resolves an observed child interaction after its checkpoint is acknowledged.

Correlation must come from the current manager snapshot or observation stream. An unknown outcome must be reconciled through observation, never retried.

Seals portable export evidence before losing a fenced source manager.

The host must durably persist the complete returned record under one immutable recovery evidence reference. Goal delivery may remain pending. :host_metadata optionally replaces the child's bounded metadata in the resulting archive.