Structural validation is the plane's answer to the model-behavior failure class: an agent that invents a tool, invents parameters, or fabricates a structured output. The check is not semantic — it does not judge whether the output is good, which is the verifier's job. It judges whether the output is structurally the thing the step declared, which no amount of reasoning quality can substitute for.
The two gates
planner proposal
│
▼
input gate ....... tool + parameters against the declared tool schema
│ deviation ──▶ failure · no call is made
▼
executor ......... MCP sandbox runs the tool
│
▼
output gate ...... returned structure against the declared output schema
deviation ──▶ failure · nothing commits| Gate | Placement | Checks | On deviation |
|---|---|---|---|
| Input gate | Before execution | Tool identity, parameter structure, required fields | Failure — the call is never made |
| Output gate | Before commit | Returned structure against the step's output declaration | Failure — the result never becomes workflow state |
Deviation is failure
The gates do not coerce, do not best-effort, do not pass through with a warning. A deviation is a failure of the model-behavior class: the attempt fails, the critique back-edge engages within iteration bounds, and the event records the deviation with the structural delta.
| Behavior | The plane | Best-effort alternatives |
|---|---|---|
| Extra field in output | Failure, recorded | Silently dropped |
| Missing required field | Failure, recorded | Null-filled, passed through |
| Wrong scalar type | Failure, recorded | Coerced if plausible |
| Invented tool | Failure at input gate | Called anyway if resolvable |
The right-hand column is how hallucinations become state: each accommodation is small, none is visible in an audit, and the accumulated result is a workflow whose recorded behavior no longer matches its declaration. The left-hand column is the property the Evidence Ledger depends on — events describe what was declared and checked, or they describe a failure.
Strict mode
strict_mode tightens the posture workflow-wide: every deviation at either gate becomes a terminal failure routed to compensation, rather than an attempt-level failure routed to the critique loop. The flag is declared once, in global_config — the workflow's validation posture is a property of the whole run, not a per-step judgment call.
Where schemas come from
MCP tools declare their JSON schemas at registration; the input gate validates against the tool's own declaration, not a parallel copy maintained in the SOP. Output declarations belong to the step. In both cases the validated structure and the declared structure are the same artifact — there is no second source of truth to drift.