Design: source-bound tool interoperability for policy extensions #966

Problem

Policy extensions that coordinate work or protect managed documents currently reject AFT's same-name tool replacements because their provenance is an extension rather than a built-in. Trusting every extension with a familiar tool name or matching a filesystem path pattern would weaken those policies. AFT already delegates native internal URLs, so another transport or renamed write tool is unnecessary.

Proposed design

Add an optional, synchronous v1 binding over the host extension event bus:

• A correlated request carries version, session ID and request ID.
• A response lists actually registered tools with explicit absolute source paths and finite capabilities, plus a non-mutating project(toolName, input, cwd) function.
• Consumers compare each call's live source exactly and retain their own operation-level policy. A capability claim alone grants no permission.
• Projection reuses AFT's real argument normalizers and authoritative engine preflights for hashline/safety operations, preserving the issuing session and move destinations. Compound AST scopes use literal-first expansion; ambiguous or incomplete scopes fail closed.
• No observational tool-call hook is added, avoiding a global speculative-execution penalty. Other harnesses are unchanged.
• Worker identity remains host-envelope metadata, not an extra hashline patch argument, in preflight and apply.

This is cooperation between loaded extensions, not a security sandbox against malicious in-process code. No new runtime dependency, persisted format, host feature probe or fuzzy-path trust is proposed.

Implementation and evidence

Draft implementation: #963

Companion consumer: TheOrdinaryWow/wows-omp-plugins#49

The extension build/typecheck, 1105 unit tests (2 platform skips), 14 native hashline regressions and real SDK integration at host versions 18.12.5 and 18.10.4 have passed. The SDK matrix covers both load orders and both edit modes. Independent review identified compound whitespace AST scope coverage; that defect is repaired with literal-first expansion and complete-root validation, and the updated real SDK matrix passes at both host endpoints.

Approval request

Please review the public binding/projection contract and its policy boundary. This issue requests maintainer design approval; no approval is implied. The implementation PR will remain a draft until this issue receives design-approved, as required by the contribution policy. Please keep the issue open until the change ships.