Unify compact runtime core tools with shared contract inventory

src/clean_agent_preview.py

@@ -89,7 +89,7 @@ SAFE_WRITE_TOOLS = frozenset({
     'draft_email', 'draft_email_reply',
     'edit_image',
 })
-EXPLICIT_EXECUTE_TOOLS = frozenset({'bash'})
+EXPLICIT_EXECUTE_TOOLS = frozenset({'bash', 'python'})
 SAFE_UI_TOOLS = frozenset({'ui_control'})
 BROKERED_JOB_TOOLS = frozenset({'trigger_research'})
 CONTRACT_REQUIRED_TOOLS = frozenset({
@@ -100,17 +100,16 @@ CONTRACT_REQUIRED_TOOLS = frozenset({
     'download_model',
     'ask_teacher',
 })
+from src.turn_contract import CONTRACT_CORE_TOOLS
+
 PREVIEW_TOOLS = (
     READ_TOOLS | SAFE_WRITE_TOOLS | EXPLICIT_EXECUTE_TOOLS | SAFE_UI_TOOLS
-    | BROKERED_JOB_TOOLS | CONTRACT_REQUIRED_TOOLS
+    | BROKERED_JOB_TOOLS | CONTRACT_REQUIRED_TOOLS | CONTRACT_CORE_TOOLS
 )
 # Keep a small recovery-capable surface on every interactive compact agent
 # turn. Routing still adds domain tools, while policy and action guards remain
-# authoritative for execution. Python is deliberately excluded here because
-# the WebUI does not own a confined workspace.
-INTERACTIVE_CORE_TOOLS = frozenset({
-    'web_search', 'web_fetch', 'private_browser', 'bash', 'ask_user',
-})
+# authoritative for execution. Use the same definition as contract resolution.
+INTERACTIVE_CORE_TOOLS = CONTRACT_CORE_TOOLS
 # The interactive compact-v5 surface above stays unchanged. These tools are
 # added only for a server-validated ``odysseus-native`` request with an active,
 # confined workspace. This lets the model-specific clean runtime serve native
@@ -2534,6 +2533,8 @@ def evaluate_preview_call(name, args, user_text='', *, allow_execute_code=False,
         ToolEffect.EXTERNAL_SIDE_EFFECT, ToolEffect.UI_SIDE_EFFECT, ToolEffect.ADMIN_CHANGE,
     }
     allowed_effects = set(ALLOWED_EFFECTS)
+    if bare == 'ask_user':
+        allowed_effects.add(ToolEffect.USER_INTERACTION)
     # web_fetch is an intentionally brokered public reader. Its capability
     # carries NETWORK_EGRESS as well as BROKERED_NETWORK_READ because the
     # backend opens a supplied URL; the URL/tool policy remains the sandbox.