Struct ToolDefinition 

pub struct ToolDefinition {

    pub name: String,
    pub provider: String,
    pub max_results: Option<i64>,
    pub filter_expr: String,
    pub timeout: String,
    pub runtime: String,
    pub resource_ref: String,
    pub sandbox: Option<bool>,
    pub effects: Option<EffectRow>,
    pub parameters: Vec<Parameter>,
    pub output_type: Option<String>,
    pub requires: Vec<String>,
    pub secret: String,
    pub secret_partition: String,
    pub target: Option<String>,
    pub risk: Option<String>,
    pub argv: Vec<String>,
    pub cache: String,
    pub scrape: Option<ScrapeSpec>,
    pub loc: Loc,
    pub leading_trivia: Vec<Trivia>,
    pub trailing_trivia: Vec<Trivia>,
}

Fields

name: String

provider: String

max_results: Option<i64>

filter_expr: String

timeout: String

runtime: String

resource_ref: String

§Fase 114.c — the resource this tool’s channel runs on (tool T { resource: Api }).

When present, the tool DERIVES its endpoint from resource.endpoint, its concurrency bound from resource.capacity, and (via lease/observe) its lifecycle and health from the resource. runtime: then names the PATH within that channel, not the channel itself.

This is what governs tool.runtime — the third island. An absolute runtime: "https://…" (a production URL in source, with no lifetime, no capacity, no shield) is now refused; the address lives on the resource.

Empty ⇒ the legacy form (slug runtime: joined onto a per-tenant base URL, which already conforms). Ungoverned, and therefore ineligible for the channel shield / lease / observe.

sandbox: Option<bool>

effects: Option<EffectRow>

parameters: Vec<Parameter>

§Fase 58.a — the tool’s typed INPUT SCHEMA (W2: the caller↔tool contract). Each entry is a named, typed parameter that the canonical use Tool(k = v, …) invocation binds against and the type-checker validates the caller’s args against (CT-2 caller blame, pre-HTTP). Empty for a schema-less tool — the legacy single-on <arg> form still applies (§58 D5 back-compat). Reuses Parameter (same TypeExpr grammar as flow params).

output_type: Option<String>

§Fase 58.a — the tool’s declared OUTPUT type, so a tool-step’s result is referenceable as ${Step.output} with a real type (§58 D8). Flat string (mirrors step output:); None when undeclared.

requires: Vec<String>

§Fase 116.a (D116.9) — the authorization scopes this tool’s operation requires (requires: ["w_organization_social"]): flat capability atoms, the same vocabulary as credential.grants (§92) and endpoint requires_capabilities (§51.x). axon-T956 enforces subset coverage — every use of a tool with a non-empty requires must occur where the program’s granted set covers it. Empty = no scope demand (every pre-§116 tool, unchanged). Flat SETS by design: OAuth scopes are per-platform atoms with no hierarchy — a scope tree would model structure the domain does not have.

secret: String

§Fase 94.c — the per-tenant secret KEY injected into every dispatch of this tool (doctrine rotation_without_revelation): at use time the runtime resolves the key against the tenant’s secret custody and injects the value into the tool-server request under the reserved axon_secret field — the flow never touches it. The §80.c posture extended to tools: this is a config KEY, never a credential literal (axon-T902, the T850 charset mirror). Empty = no injection (every pre-§94 tool). Meaningless on a target:-bound technician tool (execve dispatch, no HTTP request to inject into) — declaring both is axon-T902.

secret_partition: String

§Fase 95.a — the secret_partition: field (doctrine selection_without_revelation): the name of one of THIS tool’s own parameters: whose runtime value is appended as a single key SEGMENT to secret: at dispatch, so one tool serves N sub-tenants multiplexed under one axon-tenant. With secret: crm.hubspot and secret_partition: tenant_id, a use CrmCrearContacto(tenant_id = "acme", …) resolves the custody key crm.hubspot.acme. The secret: class prefix is pinned at compile time (a literal); only this bounded segment is dynamic — the resolved key can NEVER leave the tool’s declared class (the segment is charset-checked to a single dot-free run at dispatch, fail-closed). Empty = the §94 static-key behaviour, unchanged. axon-T903 governs its laws: requires a non-empty secret:, must name a String parameter of this tool, forbidden on a technician tool. The value SELECTED is still never revealed to cognition — secret_partition chooses WHICH borrowed authority to spend, never reads it.

target: Option<String>

§Fase 84.b — Remote Hands. The socket this technician tool dispatches over: a program acting on a real machine dials axon as a socket client, and a target:-bound tool call sends its rendered argv down that connection. None ⇒ today’s unchanged in-process / model-surface behaviour (zero regression; the whole §84 surface is inert unless target: is set). Resolved to a declared socket and duality-checked by axon-T861.

risk: Option<String>

§Fase 84.b — the operation’s risk class, a v1-closed catalog of exactly safe | destructive (technician::VALID_RISK_LEVELS). destructive forces the bound session to carry a reachable branch{approved/denied} confirmation (axon-T860). None on a non-technician tool.

argv: Vec<String>

§Fase 84.b — the argv template: an ordered list of argv elements, each either a literal token ("ping", "-c") or a whole-element ${param} placeholder ("${host}"). A placeholder binds to a declared parameters: entry and is substituted as ONE opaque argv argument at dispatch — never concatenated, never re-parsed by a shell (D84.1). This is the injection-safety keystone: the market’s free template: STRING is deliberately NOT offered. Empty for a non-technician tool; required (axon-T858) when target: is set on a provider: bash tool.

cache: String

§Fase 85.b — the result-memoization policy for this tool. Names a declared cache (axon-T864), or the reserved sentinel none to opt OUT of an active cache { default: true } policy (the escape hatch for a rare mislabeled-pure tool). Empty ⇒ governed by the module default if one exists and this tool is eligible (pure, or covered by the default’s apply_to_effects). Distinct from memory (D85.6).

scrape: Option<ScrapeSpec>

§Fase 98.b — Native Web Acquisition. The closed-catalog scrape configuration for a tool whose provider: is one of the three web-acquisition engines (scrape_http | scrape_dom | scrape_crawl). None ⇒ this is not a scrape tool — the entire §98 surface is inert (zero regression). Present ⇒ the tool acquires content from the OPEN, ADVERSARIAL web: its output is born epistemically Untrusted (⊥, D98.1) and its effects: row MUST carry the first-class web base (axon-T904, effect honesty). The sub-block is a closed catalog — an unknown field is a hard parse error (the §83/§84 discipline, D98.2).

loc: Loc

leading_trivia: Vec<Trivia>

Fase 14.b — leading comment trivia attached to this declaration (comments preceding the declaration’s first token, since the previous declaration or file start). Empty by default.

trailing_trivia: Vec<Trivia>

Fase 14.b — trailing comment trivia (same line as the declaration’s last effective token). Empty by default.

Trait Implementations

impl Debug for ToolDefinition

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.