//! Tool registry + risk classification.
//!
//! Every tool exposed to agents carries a `Risk` tag. The `aos-policy` crate
//! enforces that an agent's tier (and autonomy level) permits the call. See
//! `policies/tool-risk.md` for the human-readable classification.

use serde::{Deserialize, Serialize};

/// Risk classification for an MCP tool. Drives approval gating.
///
/// - `Low`: read-only, idempotent, no external side effects. Any tier.
/// - `Medium`: internal reversible writes, or reads touching PII/financials.
///   T1/T2 direct; T3 needs a reviewer pass.
/// - `High`: irreversible, external, or money-moving. **Always** produces an
///   `ApprovalRequest` regardless of tier. Never auto-executed.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum Risk {
    Low,
    Medium,
    High,
}

/// Specification of a tool exposed via the MCP server.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ToolSpec {
    /// Dotted name, e.g. `aos-mcp:read_task`, `ads:spend`.
    pub name: String,
    pub risk: Risk,
    pub description: String,
}

/// Returns the registered tool specs.
///
/// TODO: populate from a manifest file or a proc-macro inventory. For now
/// this is an empty registry — the structure is what the policy crate
/// consumes.
pub fn list_tools() -> Vec<ToolSpec> {
    Vec::new()
}