Function classify_memory_action 

pub fn classify_memory_action(
    tool_name: &str,
    arguments: &Value,
) -> Option<MemoryActionKind>

Inspect tool_name + arguments and return a memory action if the call matches one of the well-known memory-write / memory-read tool name conventions. Returns None for everything else so non-memory tool calls bypass the provenance hook entirely.