Agents may request. Rust decides.
Every delegation crosses a typed boundary into a policy engine that returns one auditable outcome. The learning router ranks what policy already allows, and can never widen it.
An agent in Bridge can ask for help. It cannot grant itself the right to receive it. A delegation request crosses the adapter boundary as a typed envelope carrying role, objective, acceptance criteria, known facts, owned paths, write mode, capability tier, effort, verification steps, and an output contract. On the other side, Rust decides.
Six outcomes, one of them auditable
The policy engine weighs task family, compatible warm workers, requested capability tier, per-turn budget, active leases, owned-path overlap, retry count, and the previous outcome. It returns exactly one decision.
- Execute in the parent
- Resume a compatible worker
- Spawn a new worker
- Queue the request
- Reject it
- Require human approval
There is no seventh outcome where a sufficiently confident model talks its way past the gate.
Blocked is not failed
A background worker's approval card renders on the worker's own conversation, which is usually not the one you are looking at. So Bridge mirrors it onto the parent with the worker label, objective, command, working directory, and owned-path scope, and tells the parent its child is blocked rather than failed.
Waiting on a person is legitimately idle, so it is excluded from the stall watchdog and given its own deadline of thirty minutes. Past that the worker resolves to a terminal blocked result naming the unanswered approval, which releases the parent instead of stranding it. A queued request whose ancestor is waiting on a human moves to a durable blocked state where it can neither dispatch nor expire, and resolution advances its expiry by the full blocked duration.
Failing before the reservation
An adapter descriptor declares which sandbox modes its harness can actually start in, including transport constraints. The router excludes an incompatible harness before any reservation is made, so a route guaranteed to fail at adapter startup never creates a worker session at all. A pinned incompatible route returns an actionable error naming the harness, the sandbox mode, and the alternatives that would work.
OpenCode, for instance, declares no read-only support, because its localhost HTTP transport cannot run inside the offline read-only sandbox. The adapter keeps its own fail-closed guard anyway, as defense in depth.
The router ranks. It does not grant.
Every route records the full candidate inventory, reason-coded exclusions, a conservative prediction, the baseline, the recommendation, the executed candidate, the deterministic policy outcome, and the eventual worker outcome. Predictions combine tier priors with durable task-family history for pass probability, latency, normalized quota cost, and retry risk.
Sparse history stays visibly prior-weighted rather than turning missing data into certainty. And all of it only ever reorders candidates the policy has already found eligible. Learning can make a better choice among permitted options. It cannot create one.