Module scope 

ScopedToolExecutor: config-driven capability scoping wrapper.

Wraps any ToolExecutor and filters both tool_definitions() (LLM tool list) and execute_tool_call() (dispatch path) to an operator-configured allow-list of fully-qualified tool ids.

Wiring order

ScopedToolExecutor          ← outermost (this crate)
  → PolicyGateExecutor
      → TrustGateExecutor
          → CompositeExecutor
              → ToolFilter, AuditedExecutor, ...

ScopedToolExecutor is placed outside PolicyGateExecutor so an out-of-scope call short-circuits before policy evaluation.

Tool-id namespacing

All tool ids MUST carry a namespace prefix before scope resolution:

Source	Prefix
Built-in executors	builtin:
Skill-defined tools	skill:<name>/
MCP tools	mcp:<server_id>/
ACP / A2A proxied tools	acp:<peer>/ / a2a:<peer>/

An un-namespaced tool id returned by an executor at registration is a ScopeError::UnqualifiedId.

Pattern strictness

• builtin: / skill: globs: strict — zero-match is ScopeError::DeadPattern.
• mcp: / acp: / a2a: globs: provisional — zero-match is ScopeWarning::ProvisionalDeadPattern (re-resolved on dynamic registration).
• A glob matching the entire registry without an explicit general opt-in is ScopeError::AccidentallyFull.

Structs

ScopeWarning

Non-fatal warning emitted for provisional-namespace zero-match patterns.

ScopedToolExecutor

Wraps any ToolExecutor and enforces a capability scope on both tool listing and dispatch.

ToolScope

Materialised tool scope: a pre-compiled allow-list of fully-qualified tool ids.

Enums

ScopeError

Fatal startup error emitted when a scope configuration is invalid.

Functions

build_scoped_executor

Build a ScopedToolExecutor from a CapabilityScopesConfig and a registered tool set.