[v0.5.1 HGW-W6] Tool errors reach the model #76

Part of the v0.5.1 "Hermes gets to work" (HGW) sprint, Week 1: the loop can finish. Goal of the sprint: on a fresh macOS/Linux install, "build me X and deploy it" works in a few prompts with HIC approvals.

Scope, acceptance criteria and tests

• Repos: citrate-agent-runtime (agent-sidecar toolchain.rs verdict builder, shell_run.rs). Lane: Farzan. Effort: 1.5 d.
• Goal: when a toolchain tool prints nothing useful on stdout, the verdict carries the last ~2 KB of stderr (e.g. "missing lib/openzeppelin-contracts"); shell_run output in the model context is trimmed to the last 4 KB with the full output kept in the event log.
• AC/tests: red: forge_test on a tree missing libs returns the stderr cause (today "printed nothing on stdout"); trimming keeps the tail and marks truncation; event log keeps the full text; no secrets path leaks (existing redaction applies to the tail).

Tests are red-first (Agentile red-green); test count does not drop (Rule 2). Every new IPC command, sidecar route or tool above names its data source (Rule 7). No stubs or TODOs in production paths (Rule 1).

Dependencies

None.

Links

• Sprint file (status source, private federation repo): https://github.com/CitrateNetwork/citrate-federation/blob/main/.agentile/sprints/active/2026-10-15-hgw-hermes-gets-to-work.md
• Release hub: [v0.5.0] Release alignment: one plan for all teams citrate-core#266
• Suggested lane: Farzan