Skip to content

feat: make V3 ToolRegistry the authoritative tool catalog - #273

Merged
EvanProgramming merged 2 commits into
mainfrom
Evan/v3-232-tool-registry
Oct 10, 2026
Merged

EvanProgramming merged 2 commits into
mainfrom
Evan/v3-232-tool-registry

Conversation

@EvanProgramming

@EvanProgramming EvanProgramming commented Oct 9, 2026 •

Copy link
Copy Markdown
Owner

Tool identity, capability policy, aliases and MCP schemas previously lived in separate dictionaries, while ToolRegistry was not connected to runtime tools. The active workspace now owns a registry of complete ToolSpec records. Runtime lookup, policy, prompts, discovery, MCP/provider schemas and generated documentation derive from that catalog.

Closes #232. Prerequisite #227 is merged. Only this V3 issue is included.

Requirement coverage

Requirement Implementation
R011 One authoritative catalog for all48 runtime tools; registry-backed compatibility mappings replace raw registration dictionaries, and aliases/capabilities derive from specs.
R012 Immutable ToolSpec stores identity, schema, description, capability, risk, side effects, parallel safety, executor, visibility and version/source; ToolManifest remains a compatibility projection. Executors bind perworkspace/runtime.
R013 MCP inputSchema and provider-neutral parameters derive from defensive copies of the same registered schema. Existing string encoders/argument aliases move into tool-owned compatibility metadata.
R022 Built-in/runtime binding, dictionary mutation, approved dynamic source registration and learning snapshot restore pass through registry. Invalid names/aliases/schema/policy reject atomically; dynamic rejection/registration remains audited without storing source.
R023 Generated inventory and prompt/discovery descriptions come from specs. make docs-check detects inventory drift. HTTP endpoint inventory remains generated from routes.

Compatibility and boundaries

The40 adapter tools plus memory/discovery/orchestration yield48 runtime tools. Workspace/session isolation and child orchestration exclusion remain intact. Capability, token expiry/narrowing, configuration/mode restrictions and argument-sensitive approval logic remain owned by security. CLI confirmation surfaces and TUI risk remain distinct to preserve existing gates. Graph refresh retains its read capability but declares internal writes; browser/orchestration tools remain nonparallel. Only the existing pure calculator is marked parallel-safe; no scheduling behavior changes.

AVAILABLE_TOOLS stays a mutable compatibility view: registration obtains metadata, executor replacement retains metadata, removal drops descriptors/aliases without re-binding removed runtime tools, and snapshots retain complete specs. Legacy unknown callables remain dynamic/nonparallel. Registered names and aliases preserve canonical spelling across plain/XML/DSML calls, reject case-insensitive collisions, and immediately update existing action parsing and stream filtering; provider schemas contain canonical names only.

Existing string executors, MCP object/string conversion and shell CommandResult receipt behavior are preserved. Native typed invocation and pipe-protocol removal remain #233; SDK request serialization remains #229; typed result changes remain #235. The registry validates its supported JSON-schema vocabulary and rejects unsupported keywords rather than forwarding them unchecked; it is not a general JSON-schema evaluation engine. No new dependency or persistence schema change.

Validation

  • PASS: Full Python3.12 make test:615 tests, including browser integration.
  • PASS: Focused Python3.13 registry, capability, discovery, dynamic tools, permission, architecture, MCP/server and streaming suites:76 tests.
  • PASS: make check, make lint, make docs-check, make agent-acceptance, make subagent-acceptance and git diff --check.
  • PASS: Automated-review follow-up fixes four reproduced defects: case-preserving names/aliases, durable runtime-tool deletion, combinator schema support, and string-only legacy conversion metadata. Explicit invalid schema types also reject. Independent re-review found no material defects.
  • PASS: Independent review reproduced alias-collision rejection/audit and invalid-schema-admission defects; both received failing regressions and fixes. Final review reports no material findings; all48 builtin schemas independently validated against Draft2020-12.
  • PASS: Both commits GPG-verified locally and on GitHub. Final head: 0807549c00301635fd9a644de99bee4e837b5299.
  • PASS: Final-head GitHub CI: full Python3.13 suite (615 tests), Python3.12 core tests, offline agent acceptance, architecture/docs inventory, Docker persistence, wheel install, installer syntax, and installed updates on Linux/macOS/Windows.
  • PASS: CodeRabbit final-head review completed with no actionable comments; all four valid Codex threads are resolved. Independent re-review is clear.

No paid provider calls were made. Provider-neutral schema generation is tested; live/native provider tool execution is not claimed by this catalog change. Leave this PR unmerged pending maintainer confirmation.

Summary by CodeRabbit

  • Improvements
    • Tool descriptions, capabilities, permissions, and input requirements are now managed consistently across tool discovery, execution, and integrations.
    • Tool listings respect visibility settings, and available tools reflect the active workspace.
    • Tool registration now checks for duplicate names and alias conflicts, and validates supported input schemas.
    • Tool approval requirements and parallel-safety information are reflected in the tool catalog.
  • Documentation
    • Updated the tool inventory with side-effect and parallel-safety details, and added guidance on catalog behavior and registration safeguards.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 9, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-09T16:41:47.227199Z d3744b0 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@ghfind-review ghfind-review Bot added the review: high ghfind author score; see https://ghfind.com label Oct 9, 2026
@coderabbitai

coderabbitai Bot commented Oct 9, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 5df2ff4a-9ffc-4cad-afaa-c20baff2b4fd

📥 Commits

Reviewing files that changed from the base of the PR and between d3744b0 and 0807549.


📒 Files selected for processing (6)
  • docs/superpowers/plans/2026-10-09-v3-issue-232.md
  • openkyrozen/agent/protocol.py
  • openkyrozen/agent/runtime.py
  • openkyrozen/tools/adapters.py
  • openkyrozen/tools/manifest.py
  • tests/test_tool_registry.py

🚧 Files skipped from review as they are similar to previous changes (1)
  • docs/superpowers/plans/2026-10-09-v3-issue-232.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.



📝 Walkthrough

Walkthrough

The changes make ToolRegistry authoritative for tool specifications, schemas, aliases, policy metadata, runtime registration, MCP descriptors, prompts, and documentation. Tests cover registry contracts, runtime behavior, policy metadata, parsing, and schema validation.

Changes

Tool Catalog

Layer / File(s) Summary
Tool specifications and built-in catalog
openkyrozen/tools/manifest.py, openkyrozen/tools/catalog.py, openkyrozen/tools/__init__.py, openkyrozen/tools/ports.py, tests/test_tool_registry.py
Adds validated ToolSpec contracts, built-in metadata, registry operations, compatibility mappings, schema handling, and contract tests.
Runtime registration and tool mapping
openkyrozen/tools/adapters.py, openkyrozen/tools/dynamic.py, openkyrozen/agent/runtime.py, openkyrozen/agent/delegation.py, openkyrozen/agent/types.py, openkyrozen/app/state.py, openkyrozen/workspace/binding.py, openkyrozen/learning/regression.py, tests/test_tool_registry.py
Routes workspace tools, dynamic tools, snapshots, aliases, action markers, and child-run visibility through registry state.
Policy and tool-facing integrations
openkyrozen/security/*, openkyrozen/agent/*, openkyrozen/interfaces/mcp/server.py, tests/test_tool_registry.py
Uses registry metadata for capability, risk, confirmation, visibility, prompts, parsing, MCP schemas, and legacy argument conversion.
Inventory and catalog documentation
scripts/generate_tool_inventory.py, docs/tool-inventory.md, docs/extensions.md, docs/index.md, docs/superpowers/plans/*
Updates generated inventory and documentation to describe registry metadata, schemas, side effects, parallel safety, and catalog verification.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~50 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant AgentRuntime
  participant ToolRegistry
  participant SecurityPolicy
  participant MCPServer
  participant RegisteredExecutor
  AgentRuntime->>ToolRegistry: Resolve tools and aliases
  AgentRuntime->>SecurityPolicy: Check capability and confirmation metadata
  SecurityPolicy->>ToolRegistry: Read ToolSpec policy
  MCPServer->>ToolRegistry: Read schemas and descriptors
  AgentRuntime->>ToolRegistry: Invoke authorized tool
  ToolRegistry->>RegisteredExecutor: Execute spec executor
Loading

Merge Risk: ⚪ Minimal · up to 08075

No confirmed issue from this review prevents merging, subject to the planned maintainer confirmation and normal final checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 08075

Reviewed execution paths retain capability checks, applicable approval gates, and workspace ownership. No introduced authorization bypass was established. Concurrent catalog updates and recovery behavior remain incompletely established, leaving some residual risk.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — A catalog mutation affects consumers sharing the workspace's adapters, including same-workspace sessions; the catalog is not independently owned by each request. Its security relevance spans file access, shell execution, network activity, browser state, Git operations, and delegation, bounded by execution capabilities and applicable controls rather than catalog visibility alone.

Trust Boundaries and Controls

  • observed — Model-generated dynamic tools still require dynamic tools to be enabled, configured dynamic capability, a permitting capability token, source validation, and applicable definition approval. Registration assigns dynamic capability and rejects existing canonical names or aliases before approval.
  • observed — Child runtime views exclude orchestration tool names, and their compatibility mappings reject lookup, assignment, and deletion of excluded names. Delegation separately rejects nested spawning and narrows child capabilities and tools.
  • observed — ToolRegistry.invoke authorizes and executes the same captured specification, but supplies only a capability check, not the runtime's approval or child-view controls. The base method likewise provided capability-only invocation; no new production caller bypassing runtime execution was established in the inspected consumers.

Resilience and Maintainability Implications

  • observed — Registry identity checks and publication have no enclosing synchronization, while ordinary runtime execution reads the executor and policy separately and MCP dispatches through worker threads. Concurrent mutation therefore lacks an established version-consistent authorization contract. This is not a demonstrated attacker-reachable mismatch: the inspected dynamic entrypoint does not expose arbitrary policy replacement, and mutable executor replacement already existed at the base.

Hardening Proposals

  • proposed — Define concurrent mutation semantics explicitly. A version-consistent binding for identity, argument conversion, capability, risk, approval, and execution—or serialization against catalog mutation—would strengthen the authorization contract without replacing existing execution gates.


Pre-merge checks | Passed 4 | Failed 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 15.24% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 105 functions across 21 files. (1 skipped… Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check Passed The PR satisfies the coding requirements in directly linked issue #232. R011 uses the workspace-owned ToolRegistry as the authoritative catalog, with compatibility mappings derived from registry spe…
Out of Scope Changes check Passed The changes remain within issue #232. Runtime, security, prompt, discovery, MCP, provider-schema, learning, workspace, and documentation changes connect existing consumers to the authoritative registr…
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely identifies the main change: making V3 ToolRegistry the authoritative tool catalog.

Full details: Docstring Coverage

Explanation

Docstring coverage is 15.24% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 105 functions across 21 files. (1 skipped: 1 unsupported.)



  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Commit to this branch
  • Create a new PR

🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR


  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d3744b0022

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread openkyrozen/tools/manifest.py
Comment thread openkyrozen/agent/runtime.py Outdated
Comment thread openkyrozen/tools/manifest.py
Comment thread openkyrozen/tools/manifest.py
@EvanProgramming
EvanProgramming merged commit ddd9896 into main Oct 10, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

review: high ghfind author score; see https://ghfind.com

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[V3] Extend ToolRegistry into the authoritative schema and policy catalog

1 participant