[krsnak]

Summary

• Correct the canonical diagnose_coding_agent ToolSpec description: the presence-only response is keyed by configured env_from_env destination keys, while its booleans indicate the presence of the mapped source variables in the running Runner's environment. It does not independently disclose source names or values.
• Clarify that include_live_acp=true reuses start_coding_agent launch admission (including OAuth coding_agent:run and project:write) plus fresh per-Project permission. Presence-only observation does not need Project write.
• Update the misleading nearby runtime comment; add a focused regression test for the registered/model-visible ToolSpec, ensuring these distinctions remain documented.

Reproduction

On upstream main at 5e3a6a4e, the ToolSpec claimed env_presence returned source names and the runtime comment claimed the diagnostic never required Project write. The actual Runner implementation emits destination keys (declared_provider_env_presence); coding_agent_diagnose explicitly gates the optional live probe through start_coding_agent scope and per-Project permission.

The new acp_diagnose_tool_spec_describes_destination_keys_and_live_probe_authority regression failed before the descriptor change with description missing env_from_env destination keys, then passed after the correction.

Validation (isolated macOS arm64 checkout, offline)

• cargo test --locked --offline -p webcodex-tool-contracts acp_diagnose_tool_spec_describes_destination_keys_and_live_probe_authority — 1 passed (after expected RED baseline).
• cargo test --locked --offline -p webcodex-tool-contracts — 348 passed, 1 ignored, 0 failed.
• cargo test --locked --offline -p webcodex --lib tool_runtime::tests::coding_agent_diagnose — 14 passed, 0 failed (includes OAuth scope, per-Project permission, non-disclosure, bounded response and recovery checks).
• cargo fmt --all -- --check and git diff --check — passed.
• Rebased cleanly onto latest main at 8553da96 (fix(workflow-session): retain authorized Session history after Project unregister (#1362) #1386); none of the three changed paths overlapped the intervening upstream commit; final commit diff/check clean.

Scope and safety

No behavior, authentication, OAuth scope, per-Project permission, API schema, Runner launch/transport, or secret-handling changes. Only one public descriptor string, one internal source comment, and one ToolSpec contract regression. No live ACP provider was launched; no production WebCodex installation was changed.

Fixes #1354.

[swjnxyf]

Reviewed all three documentation-only changes against the canonical ToolSpec, ToolRuntime::coding_agent_diagnose and Runner's declared_provider_env_presence implementation. The diagnosis map keys are configured env_from_env DESTINATION keys while boolean values reflect mapped SOURCE variable presence in the running Runner, without exposing source variable names/values. Presence-only diagnose requires no Project write; include_live_acp=true explicitly applies start_coding_agent scope admission (OAuth coding_agent:run and project:write) plus fresh per-Project permission before launching the bounded probe. The edited runtime comment accurately reflects this behavior. The new ToolSpec regression guards the public descriptor without changing policy, schema, launch, transport or secrets. All 18 hosted CI jobs passed; no blockers or extra commits required. Approved for maintainer-authorized squash merge.