Harden external tool category loading boundary #66

Merged

lost-rob0t merged 12 commits from agent/external-tool-category-boundary into main

2026-08-17 06:57:22 +00:00

lost-rob0t commented

2026-08-17 06:51:57 +00:00

(Migrated from github.com)

Scope

Finishes the remaining external tool-library/category boundary for #48 and the loader-facing MCP category slice of #52, while preserving the loader ABI introduced by #60.

Loader boundary

retains trusted multifile tool_pack/2 declarations;
adds sanitized tool_pack_manifest/2 metadata with library/category/tool advertisement;
supports multiple independent libraries in one category and one library across multiple category-scoped packs;
adds library/category/catalog discovery without exposing trusted loader callables;
adds deterministic category loading, load-all, idempotent loaded/reused semantics, and preflight duplicate-name conflict errors;
preserves legacy exact-pack loading;
keeps loading separate from capabilities and host authority.

MCP category

adds an inert mcp pack exposing read-only declarative MCP server discovery/inspection schemas;
strips trusted transport callables/handles from model-facing inspection;
does not install, start, connect, import remote tools, or grant capabilities.

Determinism

fixes #65 by requiring exactly one matching inert MCP fixture definition rather than leaving a member/2 choicepoint.

Tests/docs

two independent fixture libraries;
one library advertises multiple categories;
multi-library category composition;
category isolation;
idempotency/reuse;
load-all;
malformed manifest/loader declarations;
duplicate manifest and duplicate tool conflict handling;
capability/authority separation;
inert MCP category and sanitized discovery;
extension-boundary documentation and third-party example.

Explicitly deferred

#52 remains open for the final host-controlled installer/package-manager allow-list and first-class environment/config secret-reference representation. #49, #50 and #54 remain intentionally open and are not duplicated here.

Refs #48
Refs #52
Refs #65
Refs #49
Refs #50
Refs #54

## Scope Finishes the remaining external tool-library/category boundary for #48 and the loader-facing MCP category slice of #52, while preserving the loader ABI introduced by #60. ### Loader boundary - retains trusted multifile `tool_pack/2` declarations; - adds sanitized `tool_pack_manifest/2` metadata with library/category/tool advertisement; - supports multiple independent libraries in one category and one library across multiple category-scoped packs; - adds library/category/catalog discovery without exposing trusted loader callables; - adds deterministic category loading, load-all, idempotent `loaded`/`reused` semantics, and preflight duplicate-name conflict errors; - preserves legacy exact-pack loading; - keeps loading separate from capabilities and host authority. ### MCP category - adds an inert `mcp` pack exposing read-only declarative MCP server discovery/inspection schemas; - strips trusted transport callables/handles from model-facing inspection; - does not install, start, connect, import remote tools, or grant capabilities. ### Determinism - fixes #65 by requiring exactly one matching inert MCP fixture definition rather than leaving a `member/2` choicepoint. ### Tests/docs - two independent fixture libraries; - one library advertises multiple categories; - multi-library category composition; - category isolation; - idempotency/reuse; - load-all; - malformed manifest/loader declarations; - duplicate manifest and duplicate tool conflict handling; - capability/authority separation; - inert MCP category and sanitized discovery; - extension-boundary documentation and third-party example. ## Explicitly deferred #52 remains open for the final host-controlled installer/package-manager allow-list and first-class environment/config secret-reference representation. #49, #50 and #54 remain intentionally open and are not duplicated here. Refs #48 Refs #52 Refs #65 Refs #49 Refs #50 Refs #54