Role delegation mid-execution GitHub issue

$db = '[some database connection]'
$agent = %puck['https://agents.example.com/claude'].new()

$result = %role.delegate_to($agent.object.role) do
    $agent.yield(prompt: 'find recent users', db: $db)
end

{
    "roles": {
        "user": {},
        "stdlib": {},
        "agent": {}
    },

    "call_stack": [
        {
            "comment": "Frame 0: the bootstrap frame — the program's outermost scope. $db was assigned on line 1 (a plain string), $agent was constructed on line 2. We're past line 4 — execution is inside the delegate_to block at this point, so this frame's src points at the line that initiated the block. The bootstrap frame has no `call` field; it wasn't invoked the way other frames were.",
            "action": "top_level",
            "role": "user",
            "src": ["a", 4],
            "locals": {
                "db": {"value": "[some database connection]", "src": ["a", 1]},
                "agent": {"ref": "obj_43"}
            }
        },
        {
            "comment": "Frame 1: the delegate_to block. The delegations field records that this frame grants the agent's role (obtained via $agent.object.role) the user role's permissions for the block's lifetime. The call field carries the call object — owned by user (the caller's role), accessible as %call from inside this frame.",
            "action": "delegate_to",
            "role": "user",
            "delegations": {"agent": {}},
            "src": ["a", 4],
            "locals": {},
            "call": {
                "role": "user",
                "dispatcher": "%role",
                "method": "delegate_to",
                "src": ["a", 4]
            }
        },
        {
            "comment": "Frame 2: the $agent.yield(...) call. The engine has already round-tripped to the agent over ACP, received the agent-authored function, and is now invoking it. Action is method_call from user's perspective; the actual function-invocation frame is Frame 3. The call's role is user — the caller — even though the dispatcher is the agent object.",
            "action": "method_call",
            "receiver_type": "agent",
            "method": "yield",
            "role": "user",
            "src": ["a", 5],
            "locals": {},
            "call": {
                "role": "user",
                "dispatcher": {"ref": "obj_43"},
                "method": "yield",
                "src": ["a", 5]
            }
        },
        {
            "comment": "Frame 3: the agent-authored function the engine is invoking. Cross-role into agent. Per the agent-yield protocol the function's first param is the agent object itself, followed by the kwargs the caller supplied (in the order they were given: prompt, then db). The agent's role has user's permissions because Frame 1's delegation is on the stack above this frame. The call's role is STILL user — the caller is user, even though the called code runs as agent.",
            "action": "function_invocation",
            "role": "agent",
            "src": null,
            "locals": {
                "agent": {"ref": "obj_43"},
                "prompt": {"value": "find recent users", "src": ["a", 5]},
                "db": {"value": "[some database connection]", "src": ["a", 1]}
            },
            "call": {
                "role": "user",
                "src": ["a", 5],
                "note": "Function-invocation entered via Frame 2's yield call. The call object stays owned by user (the original caller); the function code, running as agent, reads it via cross-role access."
            }
        },
        {
            "comment": "Frame 4: the agent's function called $db.split(';') to parse the connection string. Cross-role into stdlib, which owns string methods. Even though Frame 1 delegated user's permissions to agent, this frame is running AS stdlib — the engine walks the stack looking for delegations targeting stdlib, finds none (Frame 1 targets agent), and stdlib uses its own permissions. The call's role is agent because the agent's function (Frame 3) is the caller here.",
            "action": "method_call",
            "receiver_type": "string",
            "method": "split",
            "role": "stdlib",
            "src": null,
            "locals": {
                "separator": {"value": ";"}
            },
            "call": {
                "role": "agent",
                "dispatcher": {"value": "[some database connection]"},
                "method": "split",
                "src": null
            }
        }
    ]
}