refactor(core): move tool registry contracts into agent-tools

AGENTS-CN.md

@@ -115,6 +115,18 @@ await api.invoke('your_command', { request: { ... } });
 [`docs/architecture/core-decomposition.md`](docs/architecture/core-decomposition.md)。
 该文档定义产品行为不变量、crate 归属目标、禁止依赖方向、feature 安全规则和里程碑验证门禁。
 
+### Tool 归属护栏
+
+- `src/crates/agent-tools` 拥有轻量 tool contract，以及 generic registry / dynamic-provider container。
+- `src/crates/core/src/agentic/tools/registry.rs` 只负责产品工具组装、`dyn Tool` 适配和 snapshot decoration。
+- `ToolUseContext` 与具体工具实现继续留在 core，直到有已评审的 port/provider 设计和等价测试。
+
+### DeepReview 护栏
+
+Deep Review / 代码审核团队横跨 core runtime 与 Web UI。target resolution 与
+manifest construction 保持在前端；policy validation、queue/retry state 和
+report enrichment 保持在 shared core。
+
 ### 后端链路
 
 大多数功能建议按这个顺序追踪：

AGENTS.md

@@ -117,6 +117,15 @@ before editing. The guardrail document defines product-behavior invariants,
 crate ownership targets, forbidden dependency directions, feature safety rules,
 and milestone verification gates.
 
+### Tool ownership guardrails
+
+- `src/crates/agent-tools` owns lightweight tool contracts and the generic
+  registry / dynamic-provider container.
+- `src/crates/core/src/agentic/tools/registry.rs` owns product tool assembly,
+  `dyn Tool` adaptation, and snapshot decoration only.
+- Keep `ToolUseContext` and concrete tool implementations in core until a
+  reviewed port/provider design and equivalence tests exist.
+
 ### DeepReview guardrails
 
 Deep Review / Code Review Team work spans the core runtime and web UI. Keep

scripts/check-core-boundaries.mjs

@@ -317,6 +317,69 @@ const facadeOnlyFiles = [
 ];
 
 const forbiddenContentRules = [
+  {
+    path: 'src/crates/core/src/agentic/tools/framework.rs',
+    patterns: [
+      {
+        regex: /\bpub struct DynamicMcpToolInfo\b/,
+        message: 'core tool framework must not redefine DynamicMcpToolInfo; use bitfun-agent-tools',
+      },
+      {
+        regex: /\bpub struct DynamicToolInfo\b/,
+        message: 'core tool framework must not redefine DynamicToolInfo; use bitfun-agent-tools',
+      },
+      {
+        regex: /\bpub struct ToolRenderOptions\b/,
+        message: 'core tool framework must not redefine ToolRenderOptions; use bitfun-agent-tools',
+      },
+      {
+        regex: /\bpub enum ToolPathBackend\b/,
+        message: 'core tool framework must not redefine ToolPathBackend; use bitfun-agent-tools',
+      },
+      {
+        regex: /\bpub struct ToolPathResolution\b/,
+        message: 'core tool framework must not redefine ToolPathResolution; use bitfun-agent-tools',
+      },
+    ],
+  },
+  {
+    path: 'src/crates/core/src/agentic/tools/restrictions.rs',
+    patterns: [
+      {
+        regex: /\bpub enum ToolPathOperation\b/,
+        message: 'core tool restrictions must not redefine ToolPathOperation; use bitfun-agent-tools',
+      },
+      {
+        regex: /\bpub struct ToolPathPolicy\b/,
+        message: 'core tool restrictions must not redefine ToolPathPolicy; use bitfun-agent-tools',
+      },
+      {
+        regex: /\bpub struct ToolRuntimeRestrictions\b/,
+        message:
+          'core tool restrictions must not redefine ToolRuntimeRestrictions; use bitfun-agent-tools',
+      },
+    ],
+  },
+  {
+    path: 'src/crates/core/src/agentic/tools/registry.rs',
+    patterns: [
+      {
+        regex: /\bstruct DynamicToolMetadata\b/,
+        message:
+          'core tool registry must not own dynamic tool metadata storage; use bitfun-agent-tools ToolRegistry',
+      },
+      {
+        regex: /\btools\s*:\s*IndexMap\b/,
+        message:
+          'core tool registry must not own the generic tool map; use bitfun-agent-tools ToolRegistry',
+      },
+      {
+        regex: /\bdynamic_tools\s*:\s*IndexMap\b/,
+        message:
+          'core tool registry must not own the dynamic tool map; use bitfun-agent-tools ToolRegistry',
+      },
+    ],
+  },
   {
     path: 'src/crates/core/src/service/mcp/server/process.rs',
     patterns: [
@@ -999,6 +1062,65 @@ function runManifestParserSelfTest() {
   if (!agentToolsRule?.forbiddenDeps.includes('bitfun-ai-adapters')) {
     throw new Error('agent-tools lightweight boundary must forbid bitfun-ai-adapters');
   }
+  const coreToolFrameworkRule = forbiddenContentRules.find(
+    (rule) => rule.path === 'src/crates/core/src/agentic/tools/framework.rs',
+  );
+  if (!coreToolFrameworkRule) {
+    throw new Error('missing core tool framework boundary rule');
+  }
+  const coreToolFrameworkContracts = [
+    'DynamicMcpToolInfo',
+    'DynamicToolInfo',
+    'ToolRenderOptions',
+    'ToolPathBackend',
+    'ToolPathResolution',
+  ];
+  const coreToolFrameworkRuleText = coreToolFrameworkRule.patterns
+    .map((pattern) => pattern.regex.source)
+    .join('\n');
+  for (const contract of coreToolFrameworkContracts) {
+    if (!coreToolFrameworkRuleText.includes(contract)) {
+      throw new Error(`core tool framework boundary rule must forbid contract: ${contract}`);
+    }
+  }
+  const coreToolRestrictionRule = forbiddenContentRules.find(
+    (rule) => rule.path === 'src/crates/core/src/agentic/tools/restrictions.rs',
+  );
+  if (!coreToolRestrictionRule) {
+    throw new Error('missing core tool restrictions boundary rule');
+  }
+  const coreToolRestrictionContracts = [
+    'ToolPathOperation',
+    'ToolPathPolicy',
+    'ToolRuntimeRestrictions',
+  ];
+  const coreToolRestrictionRuleText = coreToolRestrictionRule.patterns
+    .map((pattern) => pattern.regex.source)
+    .join('\n');
+  for (const contract of coreToolRestrictionContracts) {
+    if (!coreToolRestrictionRuleText.includes(contract)) {
+      throw new Error(`core tool restrictions boundary rule must forbid contract: ${contract}`);
+    }
+  }
+  const coreToolRegistryRule = forbiddenContentRules.find(
+    (rule) => rule.path === 'src/crates/core/src/agentic/tools/registry.rs',
+  );
+  if (!coreToolRegistryRule) {
+    throw new Error('missing core tool registry boundary rule');
+  }
+  const coreToolRegistryRuleText = coreToolRegistryRule.patterns
+    .map((pattern) => pattern.regex.source)
+    .join('\n');
+  const coreToolRegistryContracts = [
+    'DynamicToolMetadata',
+    'tools\\s*:\\s*IndexMap',
+    'dynamic_tools\\s*:\\s*IndexMap',
+  ];
+  for (const contract of coreToolRegistryContracts) {
+    if (!coreToolRegistryRuleText.includes(contract)) {
+      throw new Error(`core tool registry boundary rule must forbid contract: ${contract}`);
+    }
+  }
 
   const productDomainProfile = dependencyProfileRules.find(
     (rule) => rule.crateName === 'product-domains',

src/apps/desktop/src/api/tool_api.rs

@@ -186,7 +186,9 @@ async fn build_tool_context(workspace_path: Option<&str>) -> ToolUseContext {
     }
 }
 
-fn to_dynamic_mcp_tool_info(info: bitfun_core::service::mcp::McpToolInfo) -> DynamicMcpToolInfo {
+fn to_dynamic_mcp_tool_info(
+    info: bitfun_core::agentic::tools::framework::DynamicMcpToolInfo,
+) -> DynamicMcpToolInfo {
     DynamicMcpToolInfo {
         server_id: info.server_id,
         server_name: info.server_name,

src/crates/agent-tools/Cargo.toml

@@ -13,3 +13,9 @@ crate-type = ["rlib"]
 serde = { workspace = true }
 serde_json = { workspace = true }
 bitfun-core-types = { path = "../core-types" }
+bitfun-runtime-ports = { path = "../runtime-ports" }
+async-trait = { workspace = true }
+indexmap = { workspace = true }
+
+[dev-dependencies]
+tokio = { workspace = true }