Merge branch 'codex/goal-tools' into codex/goal-session

# Conflicts:
#	docs/cordis-catalog/events.md
#	docs/event-producer-consumer.md
#	packages/core/agent-loop/README.md
#	packages/core/agent/README.md

packages/goal/goal-session/README.md

@@ -32,7 +32,7 @@ The retained prompt names the JSON-quoted objective and `round/maxGoalRounds`, t
 | `completed` with goal still active and armed | admit the next round, or block with code `round-limit` at the cap | yes |
 | cancellation of a reserved/admitted goal round, or its `aborted` outcome | `paused` | no |
 | cancellation with no goal-round attempt | keep durable phase; disarm activation | no |
-| `error` with `RATE_LIMIT` | `blocked` with code `usage-limited` | no |
+| `error` with `RATE_LIMIT` or `QUOTA` | `blocked` with code `usage-limited` | no |
 | other `error`, `max-tokens`, or a non-stale prompt rejection | `blocked` with a diagnostic code and message | no |
 | durability failure, disposal, interruption, or unknown future outcome | disarm or block for inspection | no |
 
@@ -67,5 +67,5 @@ Append-only within an epoch: each admitted round extends the existing conversati
 - **No independent evaluator** — the model-facing goal policy decides when evidence is sufficient for completion and whether a blocker is semantically unchanged; evaluator-backed certification remains deferred.
 - **Same-session execution only** — this package deliberately does not spawn a fresh agent, fork a session prefix, or implement Ralph-style independent attempts; that workflow belongs to its own plugin layer.
 - **Accepted-queue unload race** — Cordis plugin unload is asynchronous. A goal prompt already accepted by the agent inbox can begin and consume its round before unload starts; teardown then cancels the request, disarms the goal, and awaits quiescence. No later round starts.
-- **Round cap, not resource budget** — token, currency, time, and provider quota policies remain independent; `RATE_LIMIT` only maps an observed provider stop into the blocked reason code `usage-limited`.
+- **Round cap, not resource budget** — token, currency, time, and provider quota policies remain independent; observed `RATE_LIMIT` and `QUOTA` stops only map into the blocked reason code `usage-limited`.
 - **No abnormal auto-retry** — transient provider and persistence failures require a later human-authorized resume rather than an implicit retry policy.

packages/goal/goal-session/src/outcome.ts

@@ -27,10 +27,13 @@ export function classifyGoalRound(reason: TurnEndReason, durable: boolean): Goal
       return { kind: 'continue' }
     case 'aborted':
       return { kind: 'pause', reason: reason.reason ?? 'cancelled' }
-    case 'error':
-      return reason.code === 'RATE_LIMIT'
-        ? { kind: 'blocked', code: 'usage-limited', message: reason.message }
-        : { kind: 'blocked', code: 'turn-error', message: reason.message }
+    case 'error': {
+      const code = reason.failure?.code ?? reason.code
+      const message = reason.failure?.message ?? reason.message ?? 'model request failed'
+      return code === 'RATE_LIMIT' || code === 'QUOTA'
+        ? { kind: 'blocked', code: 'usage-limited', message }
+        : { kind: 'blocked', code: 'turn-error', message }
+    }
     case 'max-tokens':
       return { kind: 'blocked', code: 'max-tokens', message: 'model output reached max tokens' }
     case 'rejected':

packages/goal/goal-session/tests/goal-session.spec.ts

@@ -127,6 +127,10 @@ describe('goal-round outcome policy', () => {
     [{ kind: 'aborted' }, true, { kind: 'pause', reason: 'cancelled' }],
     [{ kind: 'error', step: 1, message: 'slow down', code: 'RATE_LIMIT' }, true,
       { kind: 'blocked', code: 'usage-limited', message: 'slow down' }],
+    [{ kind: 'error', step: 1, failure: { message: 'credits exhausted', code: 'QUOTA' } }, true,
+      { kind: 'blocked', code: 'usage-limited', message: 'credits exhausted' }],
+    [{ kind: 'error', step: 1, failure: { message: 'provider failed', code: 'SERVER' } }, true,
+      { kind: 'blocked', code: 'turn-error', message: 'provider failed' }],
     [{ kind: 'error', step: 1, message: 'broken' }, true,
       { kind: 'blocked', code: 'turn-error', message: 'broken' }],
     [{ kind: 'max-tokens' }, true,