Function tool_output_is_external 

pub fn tool_output_is_external(
    tool: &str,
    labels: &HashMap<String, ToolLabels>,
) -> bool

Whether a tool’s output should be treated as coming from outside the trust boundary (car#723).

Derived from the information-flow labels a tool already has to carry rather than from a second, parallel list. That is the whole point: a new network-reaching tool needs a net_send label anyway — without one it is invisible to the exfiltration gate — so deriving provenance from the same label means there is one place to forget instead of two. A second list would drift, and the drift would be silent and security-relevant.

Two signals count:

• capability == "net_send" — the tool talks to the network, so what it returns is shaped by something outside this host. That includes the generator tools, which submit a prompt to a third-party service and return what it produced; treating those as external is the conservative reading.
• trust == Untrusted — an explicit declaration in .car/tool-labels.json, for a project’s own tools that read from somewhere untrusted without themselves being network sinks.

An unlabeled tool is false. That is the same blind spot the flow gate already has, deliberately shared rather than papered over with a heuristic on tool names — a name-matching guess here would produce confident-looking marks that are wrong in both directions.