Repair AI Tool Calling, Actions & Side Effects

The likely issue is a contract mismatch around AI tool selection, argument schemas, action authorization, idempotency, retries, approval gates, side effects, tool errors, result binding, and multi-step agent state. I would first define the invariant: The model may propose an action, but only validated arguments plus current application-side authorization/approval may execute it, and each externally visible side effect must have one durable idempotency identity. Then I would trace the smallest owning boundary, apply or propose a bounded repair/review step, and add deterministic normal, boundary, failure and replay tests. The workflow preserves existing user approvals, authorization policy, destructive-action boundaries, billing rules, and external side-effect controls. If repository/workspace files are available, the findings can be mapped to exact paths and focused local validation; with partial evidence, the result stays an explicit diagnosis/evidence map with assumptions and no invented execution claims.