Add executor tool loop (A12/A15) — step 5b

- tools.py: four flat tools (read_file, write_file, list_dir,
  run_command) per A15's reduced manifest. Deliberately unsandboxed:
  the VM is the trust boundary (B3) and tool use is auto-approved
  inside an approved unit of work (A4), so path confinement would add
  failure modes without adding safety. What is enforced is
  operational — timeout with process-group kill so a backgrounded
  server cannot outlive its command, output truncation so a build log
  cannot eat the context window, closed stdin so prompts fail fast,
  and a scrubbed environment so project code never sees the agent's
  credentials
- executor.py: renders the log, calls the executor role with the
  reduced manifest, dispatches tool calls, and checkpoints every
  result (A13). Escalation is observable, never self-assessed (A12):
  consecutive command failures and a hard turn cap. Failed reads do
  not count — looking around is not failing
- Until delegation exists (step 7), escalation gates to the human
  with the failures attached
- control.py: start milestone now runs the executor; a stopped
  milestone gates to AWAIT_INPUT

Two bugs found by running it live against real models:

- A turn-ending gate tool (submit_plan) left a tool_call with no
  tool_result, which providers reject outright, so every planning
  turn after the first failed with a 400. The planner now records the
  gate as the call's outcome, which is also the truthful transcript
- The renderer now emits a placeholder for any tool_call lacking a
  result, so a crash between call and result (A3) cannot poison the
  transcript permanently

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nisse-dev/src/nisse_dev/executor.py

@@ -0,0 +1,107 @@
+"""Local executor loop (spec A12 escalation triggers, A15 accommodations).
+
+Runs the approved plan with the executor role — the cheap local model doing
+mechanical work. Every tool call and result is checkpointed to the canonical
+log as it happens (A13), so a crash mid-milestone leaves a resumable record.
+
+Escalation is decided from outside the model (A12): consecutive command
+failures and hard caps on turns, never the model's own claim that it is stuck
+or finished-enough. Until delegation exists (step 7), an escalation gates to
+the human with the failures attached rather than engaging a frontier model.
+"""
+
+from dataclasses import dataclass
+from typing import Literal
+
+from nisse_dev.canonical import ToolCall, ToolResult
+from nisse_dev.llm import LLMClient, LLMError, RoleMap
+from nisse_dev.state import StateStore
+from nisse_dev.tools import EXECUTOR_TOOLS, Workspace
+
+EXECUTOR_SYSTEM = """You are nisse-dev's executor, doing mechanical work.
+
+Follow the approved plan above exactly. It was written to be executed
+verbatim; do not redesign it, expand its scope, or skip steps.
+
+Work by calling tools. Verify your work by running the project's tests.
+When every step of the plan is done and the tests pass, reply with a short
+plain-text summary and no tool call — that ends the milestone."""
+
+DEFAULT_MAX_TURNS = 24
+DEFAULT_FAILURE_LIMIT = 2
+
+
+@dataclass(frozen=True)
+class ExecutorOutcome:
+    status: Literal["completed", "capped", "escalate"]
+    note: str
+
+
+class LLMExecutor:
+    def __init__(
+        self,
+        client: LLMClient,
+        store: StateStore,
+        roles: RoleMap,
+        workspace: Workspace,
+        *,
+        max_turns: int = DEFAULT_MAX_TURNS,
+        failure_limit: int = DEFAULT_FAILURE_LIMIT,
+    ) -> None:
+        self._client = client
+        self._store = store
+        self._roles = roles
+        self._workspace = workspace
+        self._max_turns = max_turns
+        self._failure_limit = failure_limit
+
+    def run(self, milestone: int) -> ExecutorOutcome:
+        model = self._roles.resolve("executor")
+        system = f"{EXECUTOR_SYSTEM}\n\nYou are executing milestone {milestone}."
+        consecutive_failures = 0
+
+        for _turn in range(self._max_turns):
+            try:
+                produced = self._client.complete(
+                    self._store.read_events(),
+                    tools=EXECUTOR_TOOLS,
+                    model=model,
+                    system=system,
+                )
+            except LLMError as exc:
+                return ExecutorOutcome("escalate", f"executor call failed: {exc}")
+
+            calls: list[ToolCall] = []
+            for event in produced:
+                self._store.append_event(event)
+                if isinstance(event, ToolCall):
+                    calls.append(event)
+
+            if not calls:
+                return ExecutorOutcome("completed", "executor reported the plan done")
+
+            for call in calls:
+                outcome = self._workspace.dispatch(call.tool, call.arguments)
+                self._store.append_event(
+                    ToolResult(
+                        call_id=call.call_id,
+                        result=outcome.result,
+                        success=outcome.success,
+                    )
+                )
+                # Only commands count toward escalation: a failed read is the
+                # model looking around, a failed command is work not working.
+                if call.tool == "run_command":
+                    consecutive_failures = (
+                        0 if outcome.success else consecutive_failures + 1
+                    )
+                    if consecutive_failures >= self._failure_limit:
+                        return ExecutorOutcome(
+                            "escalate",
+                            f"{consecutive_failures} consecutive command failures; "
+                            f"last: {outcome.result[:500]}",
+                        )
+
+        return ExecutorOutcome(
+            "capped", f"hit the {self._max_turns}-turn cap for milestone {milestone}"
+        )