Run: python agent_simulator.py
Expected states: drafted, awaiting_human_action, rejected, drafted. No external action occurs. The fourth case deliberately returns an untrusted instruction inside a quoted source excerpt; it is not executed and cannot change the fixed tool allowlist. Inspect the event log rather than treating the presence of hostile words as a permission. The simulator has a fixed two-tool flow; the design worksheet asks you to enforce a four-step maximum when extending it. Test dispatch with an unknown tool and malformed arguments, then simulate a missing source to inspect failure behavior.