Struct StubTools 

pub struct StubTools;

Placeholder executor: advertises no tools and reports any call it receives as unhandled (the model shouldn’t call anything without specs, but the guard keeps the loop progressing if it does).

Trait Implementations

impl Clone for StubTools

fn clone(&self) -> StubTools

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for StubTools

impl Default for StubTools

fn default() -> StubTools

Returns the “default value” for a type.

impl ToolExecutor for StubTools

fn execute<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, name: &'life1 str, args_json: &'life2 str, ) -> Pin<Box<dyn Future<Output = String> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Run name with JSON args_json; return a JSON result.

fn specs(&self) -> Vec<ToolSpec>

Specs for the tools this executor knows how to run. The default returns an empty list — the model won’t be told about any tools, so it won’t emit tool_calls. Real registries override this.

fn owns(&self, name: &str) -> bool

Whether this executor advertises a tool named name.

fn needs_approval(&self, _name: &str) -> bool

Whether name requires explicit human approval before Self::execute may run. The default is false — pure / read-only tools shouldn’t trigger an approval gate. Override for sensitive tools (writes, code execution, network reach, anything with side effects).

fn pre_dispatch(&self, name: &str, _args_json: &str) -> ToolDecision

The dispatch-time policy decision for a call, seeing BOTH the tool name AND its arguments (#67). This is the argument-aware gate the turn loop consults before every execution — richer than the name-only Self::needs_approval, so a policy can allow read foo.txt but deny read /etc/shadow.

fn post_dispatch( &self, _name: &str, _args_json: &str, _result_json: &str, ) -> Option<String>

Optionally rewrite a tool’s RESULT before it re-enters the model’s context (#67, #540) — the place to redact a secret from output or enrich it. Some(new) replaces the result; None (the default) leaves it unchanged. A redaction is recorded as a distinct signed event, so the substitution is transparent in the audit log, never silent.

fn cacheable_approval(&self, name: &str) -> bool

Whether a single human approval for name may be remembered for the rest of a conversation session (per-caller) and reused for later calls of the tool. This is the authoritative gate for session-scoped approval (run_turn only honors a remembered approval when this returns true), so a non-idempotent tool can never have its approval cached.

fn sandbox_would_deny(&self, _name: &str, _args_json: &str) -> bool

Whether running name with args_json would be DENIED by the sandbox before any side effect, so the call should ESCALATE to a human approval (an unsandboxed retry) instead of executing and returning a flat denial (graduated approval, #301).

fn required_capabilities(&self, _name: &str) -> CapabilitySet

The capabilities a call to name requires (#592) — the executor’s one gate-facing classification surface, derived from the tool’s spec annotations plus what the executor knows about the tool’s registry provenance (see polyc_capability::required_capabilities).

fn ingests_untrusted_content(&self, name: &str) -> bool

Whether name’s RESULT carries untrusted-provenance content — the taint SOURCE predicate: “did content of open-world, attacker-influenceable provenance enter the transcript”. NOT the dual of the required-capability surface — that asks what a call may do outbound; this asks what its result brings in.

fn recover_unadvertised(&self, _name: &str, _args_json: &str) -> Vec<ToolSpec>

Attempts in-turn recovery for a tool call that named no advertised tool — the fuzzy-match escape hatch (#582, invariant 9). The inputs are the raw facts of the failed call, mirroring Self::execute: the called (hallucinated) name and its args_json. How they become a retrieval query is the implementor’s business — the executor owns the ranking pipeline. Returns full specs for the closest not-yet-advertised tools in the executor’s catalog, matched FUZZILY — never by exact-name lookup, because a model that needs an unoffered capability hallucinates a plausible name rather than abstaining — for run_turn_with to append to the turn’s advertised set.