[Brian Krabach (bkrabach)]

Expose scoped tools.dispatch and model.complete capabilities so portable controllers can execute bounded sub-actions and ordinary-model selection through the same orchestrator authority as a foreground tool call. A mounted module may register its caller and tools; explicit host disablement and allowlists remain authoritative. No vendor, browser, CLI or application implementation is added to the loop.

Leases exist only during the admitted parent call. Nested actions re-enter normal hooks and approvals, retain parent/call identity, serialize execution, and distinguish denied, failed and unknown outcomes. Cancellation revokes authority without claiming rollback or replaying actions. Utility inference reuses the selected provider/account, allows only stateless tool-free requests, preserves usage accounting, and has a bounded per-turn call budget.

Validation in an isolated DTU with synthetic providers: tests/test_approved_dispatch.py, tests/test_call_budget.py, tests/test_tool_dispatch_context.py, and tests/test_cancellation_sibling_preservation.py — 68 passed. Independent-upgrade checks also passed with actual old live main (20 tests) and coordinated new live (24 tests). Wheel build and refreshed lock passed. The base engine honors an older subclass’s owned dispatcher instead of wrapping it twice or assuming the new budget interface. Portable registration admits only the registered callers; legacy tool_exec still requires explicit host authorization. The real-session test dependency is declared and installed by CI. This is execution/authority coverage, not a live-provider or browser performance claim.

Merge this before loop-live #19, which reuses this implementation instead of maintaining a second dispatcher. Portable UI-use is one consumer; no decision-model package is required by this module.

Normal GitHub CI passes on Python 3.11, 3.12, 3.13 and 3.14 (503 passed, 1 skipped each). The ordinary required-review rules still apply.

Review candidate: 20792f1cc7afe0945a789db61a3fa476306efd69. Normal CI: https://github.com/microsoft/amplifier-module-loop-streaming/actions/runs/39720006547 . This can merge independently after normal review; live #19 must follow.

[Brian Krabach (bkrabach)]

Application qualification for exact head 20792f1cc7afe0945a789db61a3fa476306efd69 is complete for the user-authorized admin merge.

• Fresh public-source install of CLI 4801c9d7bdf7e60159e21234b22e0c50c0bb214e, Foundation 81b9bb07eb8fa3b0be2f080fb560a3b203cb2ad1, Core 2.0.2 and this exact Streaming candidate. Package and prepared runtime-source hashes verified; dependency check passed.
• Actual CLI + Anchors: ordinary bash task without an app behavior passed; app-level UI-use ordinary selection completed the synthetic form; configured Jev completed with three actual decision selections and no fallback. Both UI cases used the normal four exact action approvals. Decisions were not invoked by the ordinary cases.
• Existing Unified full-Work normal-chat qualification executes this same Streaming revision: ordinary selection and configured Jev with ordinary recovery passed, with independent saved-page readback. That proof remains scoped to the frozen Unified candidate and public PR refs, not future merged-main qualification.
• Current Python 3.11–3.14 CI and CLA are green. Earlier independent source review is clear. Formal review remains absent; this merge uses the user's explicitly authorized admin exception only for Expose scoped dispatch and attributed ordinary inference to tool controllers #68, without changing repository protections.

CLI users retain their existing root, providers and ordinary execution path unless an optional controller registers for dispatch. This adds no browser installation, decision backend, implicit inference or device grant. CLI configuration and runtime source were separately verified; no CLI implementation change is included.

The first baseline evidence reader expected function.name, while the native transcript uses tool; the same successful exact-command trace was rechecked after correcting the reader. No application failure was hidden or task replayed. These synthetic checks are not a performance benchmark or universal browser/platform claim.

Next: refresh Live against the actual accepted Streaming commit, run its affected checks/CI, and retain its normal review requirements.