[shipmill-romamo]

Summary

Since #45 the investigation record's spec.trace[].reasoning kept the model's reasoning_content verbatim, with no bound, and a model's reasoning often quotes the host output it just read. This caps it as D-4 settled.

• _turn in sdk/src/cloudfall/investigation.py keeps at most TRACE_TEXT_LIMIT (= TOOL_TEXT_LIMIT, 8000) characters of each turn's reasoning and of its text. A longer value keeps its end after the same [first N characters cut] mark the tool-text cap writes (host_text now shares the mark helper). The mark counts against the limit, so the stored value never exceeds 8000 characters, mark included. Characters are counted, not bytes
• The stream's turn event carries the same Turn, so it is capped the same way: the stream and the record stay equal
• config/schemas/v1/agent-investigation.schema.json: maxLength: 8000 on trace[].text and trace[].reasoning, with descriptions, and point 2 of the issue: toolCalls[].arguments says the step's parsed arguments are what ran and the raw string is only the model's text
• The record's answer (what the finding is read from) is not capped; only the trace's copy of the turn text is

Stored records are not re-validated on read: InvestigationStore only validates on save, cloudfall why does not read investigations, and evaluations/nemotron-incident/run.py reads them as plain JSON. A record written before with a longer reasoning stays readable everywhere it is read today.

Test plan

• New test_a_long_reasoning_is_cut_to_the_limit_and_marked: a 10,532-character Cyrillic reasoning and a 9,017-character turn text are cut to at most 8000 characters with the mark, keep their ends, and the saved record passes the schema; the record's answer stays whole
• New test_the_schema_refuses_a_trace_longer_than_the_limit: an 8001-character reasoning fails the schema
• uv run ruff check ., uv run mypy, uv run pytest (438 passed), uv run cloudfall config validate --project config/examples, cloudfall-engine inventory render all pass locally
• The Ansible syntax checks and ansible-lint could not run in the local session (Ansible refuses non-blocking stdio there); this PR touches no Ansible file, and CI runs them

Fixes #50

🤖 Generated with Claude Code