Module resolver 

Tool policy resolvers — dynamic (per-call) and global (pipeline-wide).

Structs

ExecPolicyResolver

ExecTool dynamic policy. Preserves current behavior: structured + allowed_commands binary → Auto; shell / unknown → OnDemand.

Traits

GlobalResolver

Pipeline-wide resolver (Phase 3 of the evaluation). Security blacklist, audit, rate-limit, etc. Return Some(policy) to escalate; the gate adopts it via ToolPolicy::max, so it can only strengthen — never weaken.

ToolPolicyResolver

Per-tool dynamic resolver: returns Some(policy) to override the declared default based on call arguments, or None to keep the declared policy. lobehub resolveDynamicPolicy analog.