Module toolcall 

Canonical signing for tool-call provenance.

A signed tool call commits to its canonical bytes: the buffa encoding of the message with its signature field cleared. Both the signer and the verifier clear the field before encoding, so the signature covers every other field (id, oneof body, …) but not itself. buffa’s encoding is deterministic for a given message, making the round-trip reproducible.

Use sign_tool_call / sign_tool_result to mint a signature, the *_into helpers to fill the message’s field in place, and verify_tool_call / verify_tool_result to check provenance. The verifiers never panic.

Functions

sign_tool_call

Sign the canonical bytes of call; returns signature bytes suitable for ToolCallContent::signature.

sign_tool_call_into

Sign call and store the signature in its signature field in place.

sign_tool_result

Sign the canonical bytes of result; returns signature bytes suitable for ToolResultContent::signature.

sign_tool_result_into

Sign result and store the signature in its signature field in place.

verify_tool_call

Verify the provenance signature carried in call.signature against an encoded public_key.

verify_tool_result

Verify the provenance signature carried in result.signature against an encoded public_key.