Tools are the only way the harness reaches beyond the prompt. Each tool has a fixed input schema, a fixed output schema, a stated safety boundary, and a declared execution mode (local, hub, or both).
Tools ship as part of the harness; each tool's schema and safety boundary are version-pinned and signed alongside packs.
locallocallocallocallocalhubbothhubTool definitions are signed and registered alongside packs. The schema is what the harness checks every call against.
namestringDotted name, e.g. fee.cap_check.versionsemverPinned by the pack manifest's compatible_with.input_schemaJSON SchemaStrictly enforced; calls with extra keys are rejected.output_schemaJSON SchemaOutput is validated before reaching the model's reply.safety_boundarystringPlain-English statement of what the tool may not do (e.g. never returns case content).allowed_callersrole[]Which audiences (worker, NGO, regulator, platform) may import this tool.executionenumlocal, hub, or both.Every call is logged, every input validated, every output schema-checked before the model sees it.
# request { "tool": "fee.cap_check", "input": { "corridor": "qa-np", "fee_amount_usd": 1450, "fee_kind": "recruitment" } } # response { "flag": "over_cap", "cap_usd": 700, "citation": "qa-np/2026.05.06#sec-3.1", "reason": "corridor cap is USD 700" }