Roadmap: tool-calling policy and audit layer

[ykshv]

Goal

Add a real tool-calling layer without letting the LLM own permissions, timing, or audit state.

Scope

• Explicit tool schemas.
• Permission policy and allow/deny decisions outside the LLM.
• Timeouts, cancellation, and stale generation handling.
• Conversation audit trail for tool calls and tool results.

Acceptance

• Tool calls cannot bypass runtime state or admin policy.
• Tool results carry the same session/turn/generation contract as other hot-path events.
• Failure modes are explicit and observable.