Module gate 

The workflow tool gate: the one decision both call paths apply — the direct call (server/call_tool/policy.rs::guard_workflow) and the inner tool of ctx_call (server/dispatch/mod.rs). They pass the active run and the tool name and act on the answer; neither decides anything itself.

Enums

ToolGate

What the gate answers for one tool call under an active run.

Constants

WORKFLOW_PASSTHROUGH_TOOLS

Tools that always pass through the workflow gate regardless of state. Read-only tools should never be blocked — agents need them for context recovery after crashes or session transitions. The server passes this list to tool_gate on both call paths.

Functions

tool_gate

Decide tool under run. passthrough is the server’s list of tools a real run never blocks.