// Every call to an upstream MCP tool is one governed decision: catalog-pinned, allow-listed and bounded.
CONTRACT ForgeToolCall {
  ENFORCEMENT_MODE: enforced
  CONTEXT {
    ENTITIES ToolCallRequest {
      operation: string
      repository_matches_main: bool
      requester_is_owner: bool
      requester_is_trusted_runtime: bool
      server_exists: bool
      server_enabled: bool
      server_configured: bool
      catalog_current: bool
      tool_in_catalog: bool
      input_schema_hash_matches: bool
      arguments_valid: bool
      tool_allowed: bool
      tool_read_only: bool
      write_permitted: bool
      calls_used: int
      call_limit: int
      argument_bytes: int
      argument_byte_limit: int
      effect_hash: string
    }
  }
  TRIGGER { call_tool() }
  PROHIBITION {
    FORBID call_tool WHEN ToolCallRequest.operation != "call" [SOURCE:tool_operation]
    FORBID call_tool WHEN ToolCallRequest.repository_matches_main == false [SOURCE:tool_repository]
    FORBID call_tool WHEN ToolCallRequest.requester_is_owner == false AND ToolCallRequest.requester_is_trusted_runtime == false [SOURCE:tool_authority]
    FORBID call_tool WHEN ToolCallRequest.server_exists == false [SOURCE:tool_server_exists]
    FORBID call_tool WHEN ToolCallRequest.server_enabled == false [SOURCE:tool_server_enabled]
    FORBID call_tool WHEN ToolCallRequest.server_configured == false [SOURCE:tool_server_configured]
    FORBID call_tool WHEN ToolCallRequest.catalog_current == false [SOURCE:tool_catalog_current]
    FORBID call_tool WHEN ToolCallRequest.tool_in_catalog == false [SOURCE:tool_in_catalog]
    FORBID call_tool WHEN ToolCallRequest.input_schema_hash_matches == false [SOURCE:tool_schema_hash]
    FORBID call_tool WHEN ToolCallRequest.arguments_valid == false [SOURCE:tool_arguments_valid]
    FORBID call_tool WHEN ToolCallRequest.tool_allowed == false [SOURCE:tool_allowed]
    FORBID call_tool WHEN ToolCallRequest.tool_read_only == false AND ToolCallRequest.write_permitted == false [SOURCE:tool_write_permitted]
    FORBID call_tool WHEN ToolCallRequest.calls_used >= ToolCallRequest.call_limit [SOURCE:tool_call_limit]
    FORBID call_tool WHEN ToolCallRequest.argument_bytes > ToolCallRequest.argument_byte_limit [SOURCE:tool_argument_bytes]
  }
  OBSERVABILITY { LOG "ForgeToolCall evaluated" ON decision }
}