@@ -369,10 +369,10 @@ impl<State: Send + Sync, Ctx: Send + Sync> AgentHarness<State, Ctx> {
         });
         status.set_last_event(record.id);
 
-        messages.push(Message::tool(
-            result.call_id.clone(),
-            result.content.clone(),
-        ));
+        // `tool_from_result`, not `tool`: a result that asked to reach the model
+        // byte-for-byte must carry that request into the transcript, or the host
+        // has no way to tell it apart from output it may freely reshape.
+        messages.push(Message::tool_from_result(&result));
         Ok(())
     }
 
 
@@ -125,10 +125,30 @@ impl Message {
     }
 
     /// Creates a tool result message for the given tool call id.
+    ///
+    /// Leaves [`ToolMessage::trusted_verbatim`] unset. Use
+    /// [`Message::tool_from_result`] to fold a real
+    /// [`crate::harness::tool::ToolResult`], which carries the flag across.
     pub fn tool(tool_call_id: impl Into<String>, content: impl Into<String>) -> Self {
         Message::Tool(ToolMessage {
             tool_call_id: tool_call_id.into(),
             content: vec![ContentBlock::Text(content.into())],
+            trusted_verbatim: false,
+        })
+    }
+
+    /// Folds a [`crate::harness::tool::ToolResult`] into the transcript message
+    /// that answers its call.
+    ///
+    /// Preferred over [`Message::tool`] on the agent-loop path: a `ToolResult`
+    /// carries structured metadata the message shape would otherwise drop, and
+    /// [`ToolMessage::trusted_verbatim`] is the part a host must not lose — it
+    /// is what tells the host this content may not be reshaped.
+    pub fn tool_from_result(result: &crate::harness::tool::ToolResult) -> Self {
+        Message::Tool(ToolMessage {
+            tool_call_id: result.call_id.clone(),
+            content: vec![ContentBlock::Text(result.content.clone())],
+            trusted_verbatim: result.is_trusted_verbatim(),
         })
     }
 
 
@@ -208,3 +208,72 @@ fn legacy_content_without_thinking_still_parses() {
     assert_eq!(blocks[0].as_text(), Some("hello"));
     assert!(!blocks[1].is_reasoning());
 }
+
+#[test]
+fn tool_from_result_carries_trusted_verbatim_and_tool_does_not() {
+    use crate::harness::tool::ToolResult;
+
+    let mut result = ToolResult {
+        call_id: "call-7".into(),
+        name: "read_schema".into(),
+        content: "verbatim body".into(),
+        raw: None,
+        error: None,
+        elapsed_ms: 0,
+    };
+
+    // The plain constructor never claims the flag — nothing changes for the
+    // callers that do not opt in.
+    let Message::Tool(plain) = Message::tool("call-7", "verbatim body") else {
+        panic!("expected a tool message");
+    };
+    assert!(!plain.trusted_verbatim);
+
+    // Folding an unmarked result matches the plain constructor.
+    let Message::Tool(unmarked) = Message::tool_from_result(&result) else {
+        panic!("expected a tool message");
+    };
+    assert!(!unmarked.trusted_verbatim);
+    assert_eq!(unmarked, plain);
+
+    // Folding a marked result carries the request across, which is the whole
+    // point: without it the host cannot tell this content apart from output it
+    // may freely summarise or re-frame.
+    assert!(result.mark_trusted_verbatim());
+    let Message::Tool(marked) = Message::tool_from_result(&result) else {
+        panic!("expected a tool message");
+    };
+    assert!(marked.trusted_verbatim);
+    assert_eq!(marked.tool_call_id, "call-7");
+    assert_eq!(marked.content, plain.content);
+}
+
+#[test]
+fn a_transcript_stored_before_the_flag_existed_still_deserializes() {
+    // Additive field: `#[serde(default)]` keeps older persisted transcripts
+    // loadable, and they read as not-trusted rather than failing.
+    let legacy = json!({ "tool_call_id": "call-1", "content": [{ "text": "ok" }] });
+    let msg: ToolMessage = serde_json::from_value(legacy).unwrap();
+    assert_eq!(msg.tool_call_id, "call-1");
+    assert!(!msg.trusted_verbatim);
+}
+
+#[test]
+fn an_unset_flag_is_omitted_from_the_wire() {
+    // The opt-in must cost nothing for the messages that never use it: a tool
+    // message without the flag serializes exactly as it did before the field
+    // existed, matching how the rest of the crate omits unset fields.
+    let plain = Message::tool("call-1", "ok");
+    let wire = serde_json::to_value(&plain).unwrap();
+    assert_eq!(
+        wire,
+        json!({ "tool": { "tool_call_id": "call-1", "content": [{ "text": "ok" }] } })
+    );
+
+    let Message::Tool(mut msg) = plain else {
+        panic!("expected a tool message");
+    };
+    msg.trusted_verbatim = true;
+    let wire = serde_json::to_value(Message::Tool(msg)).unwrap();
+    assert_eq!(wire["tool"]["trusted_verbatim"], json!(true));
+}
@@ -99,6 +99,26 @@ pub struct ToolMessage {
     pub tool_call_id: String,
     /// Ordered content blocks.
     pub content: Vec<ContentBlock>,
+    /// The producing tool asked for this content to reach the model
+    /// byte-for-byte, so a host that rewrites tool output must leave it alone.
+    ///
+    /// Set from [`ToolResult::is_trusted_verbatim`] by
+    /// [`Message::tool_from_result`]; `false` for every other constructor, so
+    /// nothing changes unless a tool opts in.
+    ///
+    /// A host is free to summarise, truncate, batch, or re-frame tool output —
+    /// and normally should. But some results are only useful intact: an input
+    /// schema the model must copy argument names out of, a signature, a diff.
+    /// Rewriting those silently produces content that reads fine and is wrong.
+    /// The flag lets a tool say "this one is not safe to reshape" without the
+    /// host having to guess from the text.
+    ///
+    /// `#[serde(default)]` so transcripts persisted before this field existed
+    /// still deserialise, and `skip_serializing_if` so a message that never
+    /// opted in stays byte-identical on the wire — matching how the rest of the
+    /// crate omits unset fields.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub trusted_verbatim: bool,
 }
 
 /// A structured conversation message.
@@ -154,3 +174,8 @@ impl MessageDelta {
         }
     }
 }
+
+/// Serde helper: skip serializing `false` booleans.
+fn is_false(value: &bool) -> bool {
+    !*value
+}
@@ -384,3 +384,104 @@ fn schema_validation_rejects_wrong_types_and_extra_fields() {
     let err = schema.validate_call(&extra).expect_err("extra field");
     assert!(err.to_string().contains("extra"));
 }
+
+#[test]
+fn trusted_verbatim_is_opt_in_and_round_trips_through_raw() {
+    let mut result = ToolResult {
+        call_id: "call-1".into(),
+        name: "read_schema".into(),
+        content: "{\n  \"a\": 1\n}".into(),
+        raw: None,
+        error: None,
+        elapsed_ms: 0,
+    };
+    assert!(
+        !result.is_trusted_verbatim(),
+        "a plain result must not claim the flag"
+    );
+
+    assert!(result.mark_trusted_verbatim(), "an absent `raw` makes room");
+    assert!(result.is_trusted_verbatim());
+
+    // Stored under a known key in `raw`, so a host can round-trip it through its
+    // own serialization without a schema change.
+    assert_eq!(
+        result
+            .raw
+            .as_ref()
+            .and_then(|r| r.get(TRUSTED_VERBATIM_KEY)),
+        Some(&json!(true))
+    );
+
+    // Marking twice is idempotent and preserves unrelated metadata.
+    result.raw.as_mut().unwrap()["other"] = json!("kept");
+    assert!(result.mark_trusted_verbatim());
+    assert!(result.is_trusted_verbatim());
+    assert_eq!(result.raw.as_ref().unwrap()["other"], json!("kept"));
+}
+
+#[test]
+fn unrelated_raw_metadata_never_sets_the_flag() {
+    // The opt-in must not be trippable by a tool that happens to return raw
+    // metadata — including a value at the key that is not `true`.
+    let with_other = ToolResult {
+        call_id: "c".into(),
+        name: "t".into(),
+        content: "x".into(),
+        raw: Some(json!({ "rows": 3 })),
+        error: None,
+        elapsed_ms: 0,
+    };
+    assert!(!with_other.is_trusted_verbatim());
+
+    let wrong_type = ToolResult {
+        raw: Some(json!({ TRUSTED_VERBATIM_KEY: "yes" })),
+        ..with_other.clone()
+    };
+    assert!(!wrong_type.is_trusted_verbatim());
+
+    let not_an_object = ToolResult {
+        raw: Some(json!("opaque")),
+        ..with_other
+    };
+    assert!(!not_an_object.is_trusted_verbatim());
+}
+
+#[test]
+fn marking_is_refused_rather_than_silently_lost_when_raw_is_not_an_object() {
+    // Regression: the flag lives under a key in `raw`, so a scalar `raw` has
+    // nowhere to put it. Clobbering a value the tool deliberately set would be
+    // worse, so the request is refused — and the caller is told, because a
+    // silent failure leaves `is_trusted_verbatim()` answering `false` forever
+    // while the author believes the opt-in took effect.
+    for raw in [json!("opaque"), json!([1, 2, 3]), json!(7)] {
+        let mut result = ToolResult {
+            call_id: "c".into(),
+            name: "t".into(),
+            content: "x".into(),
+            raw: Some(raw.clone()),
+            error: None,
+            elapsed_ms: 0,
+        };
+        assert!(
+            !result.mark_trusted_verbatim(),
+            "a non-object `raw` ({raw}) must refuse the request"
+        );
+        assert!(!result.is_trusted_verbatim());
+        // The tool's own value is left exactly as it was.
+        assert_eq!(result.raw, Some(raw));
+    }
+
+    // Once the tool makes room, the same call succeeds.
+    let mut moved = ToolResult {
+        call_id: "c".into(),
+        name: "t".into(),
+        content: "x".into(),
+        raw: Some(json!({ "value": "opaque" })),
+        error: None,
+        elapsed_ms: 0,
+    };
+    assert!(moved.mark_trusted_verbatim());
+    assert!(moved.is_trusted_verbatim());
+    assert_eq!(moved.raw.as_ref().unwrap()["value"], json!("opaque"));
+}
@@ -109,6 +109,65 @@ pub struct ToolResult {
     pub elapsed_ms: u64,
 }
 
+/// `raw` key under which [`ToolResult::mark_trusted_verbatim`] records the
+/// request that this result reach the model byte-for-byte.
+///
+/// Kept in `raw` rather than as a dedicated field so the opt-in costs nothing
+/// for the results that never use it, and so a host can round-trip the flag
+/// through its own serialisation without a schema change.
+pub const TRUSTED_VERBATIM_KEY: &str = "trusted_verbatim";
+
+impl ToolResult {
+    /// Asks hosts to deliver this result's content to the model unchanged.
+    ///
+    /// A host is free to summarise, truncate, batch, or re-frame tool output —
+    /// and usually should. This marks the results where that is not safe: an
+    /// input schema whose argument names the model must copy exactly, a
+    /// signature, a diff. Reshaping those yields content that still reads well
+    /// and is wrong.
+    ///
+    /// Advisory: the crate carries the flag to [`super::super::message::ToolMessage`]
+    /// via [`crate::harness::message::Message::tool_from_result`]; honouring it
+    /// is the host's job.
+    /// # Returns
+    ///
+    /// `true` when the request was recorded. `false` when [`Self::raw`] already
+    /// holds a **non-object** value (a string, array, or number): the flag lives
+    /// under a key in `raw`, and a scalar has nowhere to put a key. The crate
+    /// will not clobber a value the tool deliberately set, so the request is
+    /// refused rather than silently lost — make room by moving that value under
+    /// a key of its own, then call this again.
+    ///
+    /// `#[must_use]` precisely because the failure is otherwise invisible:
+    /// [`Self::is_trusted_verbatim`] would keep answering `false` with no
+    /// diagnostic, and the caller would believe the opt-in took effect.
+    #[must_use = "returns false when `raw` holds a non-object value and the request was refused"]
+    pub fn mark_trusted_verbatim(&mut self) -> bool {
+        let raw = self
+            .raw
+            .get_or_insert_with(|| Value::Object(Default::default()));
+        match raw.as_object_mut() {
+            Some(map) => {
+                map.insert(TRUSTED_VERBATIM_KEY.to_string(), Value::Bool(true));
+                true
+            }
+            None => false,
+        }
+    }
+
+    /// Whether [`Self::mark_trusted_verbatim`] was set on this result.
+    ///
+    /// `false` when `raw` is absent, is not an object, or holds anything other
+    /// than `true` — an opt-in that cannot be tripped by unrelated metadata.
+    pub fn is_trusted_verbatim(&self) -> bool {
+        self.raw
+            .as_ref()
+            .and_then(|raw| raw.get(TRUSTED_VERBATIM_KEY))
+            .and_then(Value::as_bool)
+            .unwrap_or(false)
+    }
+}
+
 /// Live run context visible to a tool invoked by an agent loop.
 ///
 /// The legacy [`Tool::call`] entry point remains available for direct calls and