Enforce report-first short intents and async large execManagedNe batches.

Block CLI/inventory until ume_alarm_xlsx_report (or aggregate) succeeds, and return job_id for big NE batches via get_ne_exec_job.

Co-authored-by: Cursor <cursoragent@cursor.com>

runtime/tools/ops_system_tool_allowlist.py

@@ -51,6 +51,8 @@ _OPS_SYSTEM_TOOL_ALLOWLIST = frozenset(
         "get_env",
         # Compact tool-result refetch
         "fetch_tool_result",
+        # Background NE CLI poll
+        "get_ne_exec_job",
     }
 )
 

runtime/tools/playbook_contracts.py

@@ -151,10 +151,12 @@ def build_turn_checklist(
         lines.append(f"- goal: {goal_s[:160]}")
     if step:
         tool, example = step
-        lines.append(f"- step1: {tool}({_fmt_args(example)})")
+        lines.append(f"- step1 (REQUIRED first): {tool}({_fmt_args(example)})")
         if is_zh:
+            lines.append("- 未完成 step1 前禁止 listCliTargets/execManagedNe/清单循环")
             lines.append("- 完成后用 Result/Evidence 短答；勿翻页或开无关 playbook")
         else:
+            lines.append("- Do NOT call listCliTargets/execManagedNe/inventory before step1 succeeds")
             lines.append("- then reply with Result/Evidence; no pagination / unrelated playbooks")
     elif is_zh:
         lines.append("- 需要证据时立刻调用工具；失败时改参数或换 fallback，禁止相同参数盲重试")

runtime/tools/public/get_ne_exec_job_tool.py

@@ -0,0 +1,35 @@
+from __future__ import annotations
+
+from typing import Any
+
+from runtime.tools.base import ToolSpec
+from svc.jobs.ne_exec_jobs import get_ne_exec_job
+
+
+def get_ne_exec_job_tool() -> ToolSpec:
+    def handler(args: dict[str, Any]) -> dict[str, Any]:
+        return get_ne_exec_job(str(args.get("job_id") or "").strip())
+
+    return ToolSpec(
+        name="get_ne_exec_job",
+        description=(
+            "Poll a background execManagedNe job started with async=true (or auto-async for large batches). "
+            "Pass job_id from the async ack. When status is succeeded/failed/timeout, result contains the full CLI output."
+        ),
+        parameters={
+            "type": "object",
+            "properties": {
+                "job_id": {"type": "string", "description": "Job id returned by async execManagedNe."},
+            },
+            "required": ["job_id"],
+            "additionalProperties": False,
+        },
+        handler=handler,
+        tags=frozenset({"netx", "ops", "jobs", "read"}),
+        read_only=True,
+        risk_level="low",
+        timeout_s=8.0,
+    )
+
+
+__all__ = ["get_ne_exec_job_tool"]