pub struct ToolDefinition {Show 22 fields
pub name: String,
pub provider: String,
pub max_results: Option<i64>,
pub filter_expr: String,
pub timeout: String,
pub runtime: String,
pub resource_ref: String,
pub sandbox: Option<bool>,
pub effects: Option<EffectRow>,
pub parameters: Vec<Parameter>,
pub output_type: Option<String>,
pub requires: Vec<String>,
pub secret: String,
pub secret_partition: String,
pub target: Option<String>,
pub risk: Option<String>,
pub argv: Vec<String>,
pub cache: String,
pub scrape: Option<ScrapeSpec>,
pub loc: Loc,
pub leading_trivia: Vec<Trivia>,
pub trailing_trivia: Vec<Trivia>,
}Fields§
§name: String§provider: String§max_results: Option<i64>§filter_expr: String§timeout: String§runtime: String§resource_ref: Stringv2.69.0 — the resource this tool’s channel runs on (tool T { resource: Api }).
When present, the tool DERIVES its endpoint from resource.endpoint, its
concurrency bound from resource.capacity, and (via lease/observe) its
lifecycle and health from the resource. runtime: then names the PATH
within that channel, not the channel itself.
This is what governs tool.runtime — the third island. An absolute
runtime: "https://…" (a production URL in source, with no lifetime, no
capacity, no shield) is now refused; the address lives on the resource.
Empty ⇒ the legacy form (slug runtime: joined onto a per-tenant base URL,
which already conforms). Ungoverned, and therefore ineligible for the
channel shield / lease / observe.
sandbox: Option<bool>§effects: Option<EffectRow>§parameters: Vec<Parameter>v2.8.0 — the tool’s typed INPUT SCHEMA (W2: the caller↔tool
contract). Each entry is a named, typed parameter that the canonical
use Tool(k = v, …) invocation binds against and the type-checker
validates the caller’s args against (CT-2 caller blame, pre-HTTP).
Empty for a schema-less tool — the legacy single-on <arg> form still
applies (v2.8.0 D5 back-compat). Reuses Parameter (same TypeExpr
grammar as flow params).
output_type: Option<String>v2.8.0 — the tool’s declared OUTPUT type, so a tool-step’s result
is referenceable as ${Step.output} with a real type (v2.8.0 D8). Flat
string (mirrors step output:); None when undeclared.
requires: Vec<String>v2.77.0 — the authorization scopes this tool’s operation
requires (requires: ["w_organization_social"]): flat capability atoms,
the same vocabulary as credential.grants (v2.46.0) and endpoint
requires_capabilities (v2.4.0). axon-T956 enforces subset coverage —
every use of a tool with a non-empty requires must occur where the
program’s granted set covers it. Empty = no scope demand (every
pre-v2.77.0 tool, unchanged). Flat SETS by design: OAuth scopes are
per-platform atoms with no hierarchy — a scope tree would model
structure the domain does not have.
secret: Stringv2.48.0 — the per-tenant secret KEY injected into every dispatch
of this tool (doctrine rotation_without_revelation): at use
time the runtime resolves the key against the tenant’s secret
custody and injects the value into the tool-server request under
the reserved axon_secret field — the flow never touches it. The
v2.37.0 posture extended to tools: this is a config KEY, never a
credential literal (axon-T902, the T850 charset mirror). Empty =
no injection (every pre-v2.48.0 tool). Meaningless on a
target:-bound technician tool (execve dispatch, no HTTP request
to inject into) — declaring both is axon-T902.
secret_partition: Stringv2.49.0 — the secret_partition: field (doctrine
selection_without_revelation): the name of one of THIS tool’s own
parameters: whose runtime value is appended as a single key
SEGMENT to secret: at dispatch, so one tool serves N sub-tenants
multiplexed under one axon-tenant. With secret: crm.hubspot and
secret_partition: tenant_id, a use CrmCrearContacto(tenant_id = "acme", …) resolves the custody key crm.hubspot.acme. The
secret: class prefix is pinned at compile time (a literal); only
this bounded segment is dynamic — the resolved key can NEVER leave
the tool’s declared class (the segment is charset-checked to a
single dot-free run at dispatch, fail-closed). Empty = the v2.48.0
static-key behaviour, unchanged. axon-T903 governs its laws:
requires a non-empty secret:, must name a String parameter of
this tool, forbidden on a technician tool. The value SELECTED is
still never revealed to cognition — secret_partition chooses
WHICH borrowed authority to spend, never reads it.
target: Option<String>v2.39.0 — Remote Hands. The socket this technician tool dispatches
over: a program acting on a real machine dials axon as a socket
client, and a target:-bound tool call sends its rendered argv down
that connection. None ⇒ today’s unchanged in-process / model-surface
behaviour (zero regression; the whole v2.39.0 surface is inert unless
target: is set). Resolved to a declared socket and duality-checked
by axon-T861.
risk: Option<String>v2.39.0 — the operation’s risk class, a v1-closed catalog of exactly
safe | destructive (technician::VALID_RISK_LEVELS). destructive
forces the bound session to carry a reachable branch{approved/denied}
confirmation (axon-T860). None on a non-technician tool.
argv: Vec<String>v2.39.0 — the argv template: an ordered list of argv elements,
each either a literal token ("ping", "-c") or a whole-element
${param} placeholder ("${host}"). A placeholder binds to a declared
parameters: entry and is substituted as ONE opaque argv argument at
dispatch — never concatenated, never re-parsed by a shell. This
is the injection-safety keystone: the market’s free template: STRING
is deliberately NOT offered. Empty for a non-technician tool; required
(axon-T858) when target: is set on a provider: bash tool.
cache: Stringv2.40.0 — the result-memoization policy for this tool. Names a
declared cache (axon-T864), or the reserved sentinel none to opt
OUT of an active cache { default: true } policy (the escape hatch for
a rare mislabeled-pure tool). Empty ⇒ governed by the module default
if one exists and this tool is eligible (pure, or covered by the
default’s apply_to_effects). Distinct from memory.
scrape: Option<ScrapeSpec>v2.52.0 — Native Web Acquisition. The closed-catalog scrape
configuration for a tool whose provider: is one of the three
web-acquisition engines (scrape_http | scrape_dom |
scrape_crawl). None ⇒ this is not a scrape tool — the entire
v2.52.0 surface is inert (zero regression). Present ⇒ the tool acquires
content from the OPEN, ADVERSARIAL web: its output is born
epistemically Untrusted (⊥, the design decision) and its effects: row MUST
carry the first-class web base (axon-T904, effect honesty).
The sub-block is a closed catalog — an unknown field is a hard
parse error (the v2.38.0/v2.39.0 discipline, the design decision).
loc: Loc§leading_trivia: Vec<Trivia>v1.5.2 — leading comment trivia attached to this declaration (comments preceding the declaration’s first token, since the previous declaration or file start). Empty by default.
trailing_trivia: Vec<Trivia>v1.5.2 — trailing comment trivia (same line as the declaration’s last effective token). Empty by default.