refactor(agent-tools): extract tool manifest contracts

AGENTS.md

@@ -120,11 +120,13 @@ and milestone verification gates.
 
 ### Tool ownership guardrails
 
-- `src/crates/agent-tools` owns lightweight tool contracts and the generic
-  registry / dynamic-provider container.
+- `src/crates/agent-tools` owns lightweight tool contracts, pure
+  manifest/exposure contracts, and the generic registry / dynamic-provider
+  container.
 - `src/crates/core/src/agentic/tools` owns product tool assembly, `dyn Tool`
-  adaptation, snapshot decoration, tool exposure / manifest resolution, and
-  on-demand tool spec discovery (`GetToolSpec`) for now.
+  adaptation, snapshot decoration, runtime manifest assembly / context
+  filtering, and on-demand tool spec discovery execution (`GetToolSpec`) for
+  now.
 - Keep `ToolUseContext` and concrete tool implementations in core until a
   reviewed port/provider design and equivalence tests exist.
 - Tool migrations must preserve expanded/collapsed exposure, prompt-visible

docs/architecture/core-decomposition.md

@@ -66,7 +66,7 @@ Rust 编译和链接面。
 | `bitfun-agent-stream` | Stream 聚合和 stream-focused 测试 | done：stream 聚合已独立 |
 | `bitfun-runtime-ports` | 面向 service/agent 边界的轻量跨层 DTO 和 trait | partial：DTO/trait-only 边界已建立，包含 agent submission/transcript/cancel、remote state、runtime event 与 remote image attachment 契约；不拥有 runtime 实现 |
 | `bitfun-agent-runtime` | Sessions、execution、coordination、agent system | target：crate 尚不存在，agent runtime 仍在 core |
-| `bitfun-agent-tools` | 轻量 tool DTO / contract、runtime restriction、generic registry / provider container | partial：product manifest、`ToolUseContext`、`GetToolSpec` 和 concrete tools 仍在 core |
+| `bitfun-agent-tools` | 轻量 tool DTO / contract、runtime restriction、pure manifest/exposure contract、generic registry / provider container | partial：runtime manifest assembly / context filtering、`ToolUseContext`、`GetToolSpec` 执行和 concrete tools 仍在 core |
 | `bitfun-tool-packs` | 由 feature group 隔离的具体工具实现 | target/scaffold：不得声明 concrete tools 已迁移 |
 | `bitfun-services-core` | Config、session、workspace、storage、filesystem、system services | partial：部分 pure helper 已迁出；config/workspace/filesystem runtime 多数仍在 core |
 | `bitfun-services-integrations` | Git、MCP、remote SSH、remote connect、file watch integrations | partial：MCP runtime 已迁入；remote SSH 仍只迁移低风险 contracts/helpers；remote-connect 已拥有 wire DTO、request builder、tracker state / registry lifecycle 与 tracker event reduction，dispatcher/product execution 仍在 core |
@@ -135,11 +135,12 @@ owner 边界，否则不要把一个 feature group 继续拆成更小的 crate
 - DeepResearch 现在包含 citation renumber post-turn hook。迁移 agent runtime 或 prompt/report
   处理前，必须保留 `report.md` / `citations.md` / `display_map.json` 的 deterministic post-processing 行为；
   在此之前该 hook 仍属于 `bitfun-core` agent runtime assembly。
-- 最新主干新增 on-demand tool spec discovery。`ToolExposure`、`GetToolSpec`、
-  `manifest_resolver`、collapsed-tool catalog、context-aware tool schema/description
-  和 `ToolUseContext.unlocked_collapsed_tools` 暂时属于 `bitfun-core` product tool runtime；
-  迁移前必须证明 prompt-visible manifest、expanded/collapsed exposure、unlock state 与
-  desktop/MCP/ACP tool catalog 等价。
+- 最新主干新增 on-demand tool spec discovery。`ToolExposure`、`GetToolSpec` 名称、
+  collapsed stub 和 manifest ordering 等纯契约可由 `bitfun-agent-tools` 拥有；但
+  `manifest_resolver`、产品 registry snapshot、collapsed-tool catalog、context-aware
+  tool schema/description、`GetToolSpec` 执行和 `ToolUseContext.unlocked_collapsed_tools`
+  暂时仍属于 `bitfun-core` product tool runtime。继续迁移前必须证明 prompt-visible
+  manifest、expanded/collapsed exposure、unlock state 与 desktop/MCP/ACP tool catalog 等价。
 - 最新主干的 remote workspace guard 和 search fallback/context 修复提高了 workspace/search
   迁移门槛。后续迁移 workspace 或 search runtime 时，必须保留 remote workspace metadata、
   startup runtime ensure、remote flashgrep fallback、preview mapping 和 local/remote fallback 语义。
@@ -183,7 +184,7 @@ owner 边界，否则不要把一个 feature group 继续拆成更小的 crate
     built-in asset seeding/source-hash lookup, host-dispatch execution,
     `PathManager` integration, function-agent Git/AI calls, prompt templates,
     JSON extraction, and error mapping.
-  - 高风险：`ToolUseContext`、product tool registry / manifest / exposure / `GetToolSpec` owner 化、
+  - 高风险：`ToolUseContext`、product tool registry / runtime manifest assembly / `GetToolSpec` 执行 owner 化、
     MCP concrete tool integration、remote-connect、remote SSH runtime、miniapp / function-agent runtime、
     agent registry、`bitfun-core default = []`
     或任何产品 crate feature set 调整。
@@ -193,7 +194,7 @@ owner 边界，否则不要把一个 feature group 继续拆成更小的 crate
   owner 主题：`services-integrations` runtime 收口、MCP runtime/dynamic tools、
   remote-connect runtime、agent tools + `tool-packs` owner 化、`product-domains`
   runtime + core facade finalization。PR 2 的 MCP runtime/dynamic tools 已完成；后续不得把
-  remote-connect、product tool manifest/exposure owner 化或 product-domain runtime 顺带混入已完成的 MCP PR。
+  remote-connect、product tool runtime manifest / `GetToolSpec` 执行 owner 化或 product-domain runtime 顺带混入已完成的 MCP PR。
   `bitfun-core default = []` 和 per-product feature matrix 仍是上述 runtime 队列之后的独立评估。
 - 当前批次的 remote-connect runtime 收口以“tracker / wire / pure policy / registry lifecycle 归
   `bitfun-services-integrations`，dispatcher / product execution 显式保留 core-owned”作为可合入闭环。
@@ -203,14 +204,20 @@ owner 边界，否则不要把一个 feature group 继续拆成更小的 crate
   transport lifecycle、resource/prompt adapter、catalog cache、list-changed / reconnect policy、
   dynamic tool descriptor、dynamic tool provider 与 result rendering。`bitfun-core` 保留
   core `ConfigService` store adapter、OAuth data-dir 注入、`BitFunError` 映射、旧路径 facade
-  和全局 tool registry / manifest 组装；product tool manifest/exposure owner 化仍归后续 tool/provider PR。
+  和全局 tool registry / manifest 组装；product tool runtime manifest / `GetToolSpec` 执行 owner 化仍归后续 tool/provider PR。
 - core MCP facade 当前允许保留窄 adapter 语义：data-dir injection、credential/config store adapter、
   `BitFunError` 映射、legacy facade、product tool wrapper 和 global registry / manifest 接入。
   如果继续收敛 MCP manager 行为，必须先补 config failure、catalog invalidation、list-changed
   与 dynamic tool manifest 回归测试。
 - 已合入的 semantic baseline 已补 config failure、catalog replacement invalidation、沿用既有 list-changed
   helper baseline、dynamic manifest order/metadata、tool manifest / `GetToolSpec`、MiniApp storage layout
   adapter 等价和 remote search fallback gate；这些都是 behavior-locking tests，不移动 runtime owner。
+- 当前 tool manifest contract closure PR 只把 `ToolExposure`、`GetToolSpec` 名称、纯 manifest
+  policy、collapsed prompt stub 与 prompt-visible ordering 归入 `bitfun-agent-tools`，并让 core
+  runtime manifest resolver 委托这些纯 helper；不迁移 `ToolUseContext`、registry snapshot、
+  context-aware schema/description、`GetToolSpecTool` 执行、unlock state 或 concrete tool implementation。
+  该 PR 闭环后，后续不应再插入 baseline-only PR 才开始 runtime owner 迁移；下一组 PR 应直接以
+  单一 owner 为单位移动实际 runtime，并沿用本节等价测试和边界脚本。
 - 已合入的 `Services/Product Runtime Owner Closure` 只收口已经有 port/contract 保护的低风险 owner：
   remote-SSH session identity / mirror path / unresolved-session layout 归属
   `bitfun-services-integrations`，MiniApp storage/import file layout、fallback payload