refactor(agent-tools): prepare tool provider ownership

AGENTS.md

@@ -120,15 +120,20 @@ and milestone verification gates.
 
 ### Tool ownership guardrails
 
-- `src/crates/agent-tools` owns lightweight tool contracts, pure
-  manifest/exposure contracts, and the generic registry / dynamic-provider
-  container.
-- `src/crates/core/src/agentic/tools` owns product tool assembly, `dyn Tool`
-  adaptation, snapshot decoration, runtime manifest assembly / context
-  filtering, and on-demand tool spec discovery execution (`GetToolSpec`) for
-  now.
+- `src/crates/agent-tools` owns lightweight tool contracts, portable tool
+  context facts/provider contracts, pure manifest/exposure contracts, and
+  generic registry / static-provider / dynamic-provider container contracts.
+- `src/crates/tool-packs` may expose planned tool-pack feature-group scaffold
+  metadata, but it must not own concrete tool implementations or product
+  manifest runtime until a reviewed provider migration exists.
+- `src/crates/core/src/agentic/tools` owns product tool provider assembly
+  (`static_providers.rs`), `dyn Tool` adaptation, snapshot decoration, runtime
+  manifest assembly / context filtering, and on-demand tool spec discovery
+  execution (`GetToolSpec`) for now.
 - Keep `ToolUseContext` and concrete tool implementations in core until a
-  reviewed port/provider design and equivalence tests exist.
+  reviewed port/provider design and equivalence tests exist. A portable
+  `ToolContextFacts` projection via `PortableToolContextProvider` may cross
+  crate boundaries, but runtime handles and service objects must stay in core.
 - Tool migrations must preserve expanded/collapsed exposure, prompt-visible
   manifests, `ToolUseContext.unlocked_collapsed_tools`, and desktop/MCP/ACP
   tool catalog behavior.

docs/architecture/core-decomposition.md

@@ -66,8 +66,8 @@ Rust 编译和链接面。
 | `bitfun-agent-stream` | Stream 聚合和 stream-focused 测试 | done：stream 聚合已独立 |
 | `bitfun-runtime-ports` | 面向 service/agent 边界的轻量跨层 DTO 和 trait | partial：DTO/trait-only 边界已建立，包含 agent submission/transcript/cancel、remote state、runtime event 与 remote image attachment 契约；不拥有 runtime 实现 |
 | `bitfun-agent-runtime` | Sessions、execution、coordination、agent system | target：crate 尚不存在，agent runtime 仍在 core |
-| `bitfun-agent-tools` | 轻量 tool DTO / contract、runtime restriction、pure manifest/exposure contract、generic registry / provider container | partial：runtime manifest assembly / context filtering、`ToolUseContext`、`GetToolSpec` 执行和 concrete tools 仍在 core |
-| `bitfun-tool-packs` | 由 feature group 隔离的具体工具实现 | target/scaffold：不得声明 concrete tools 已迁移 |
+| `bitfun-agent-tools` | 轻量 tool DTO / contract、portable tool context facts / provider、runtime restriction、pure manifest/exposure contract、generic registry / static-provider / dynamic-provider container | partial：runtime manifest assembly / context filtering、`ToolUseContext`、`GetToolSpec` 执行和 concrete tools 仍在 core；core 当前仅把内置工具列表收敛为 core-owned static provider group，并只通过 `PortableToolContextProvider` 提供 `ToolContextFacts` 只读投影 |
+| `bitfun-tool-packs` | 由 feature group 隔离的具体工具实现 | target/scaffold：仅提供 basic / git / mcp / browser-web / computer-use / image-analysis / miniapp / agent-control feature-group 元数据，不得声明 concrete tools 已迁移 |
 | `bitfun-services-core` | Config、session、workspace、storage、filesystem、system services | partial：部分 pure helper 已迁出；config/workspace/filesystem runtime 多数仍在 core |
 | `bitfun-services-integrations` | Git、MCP、remote SSH、remote connect、file watch integrations | partial：MCP runtime 已迁入；remote SSH 仍只迁移低风险 contracts/helpers；remote-connect 已拥有 wire DTO、request builder、tracker state / registry lifecycle 与 tracker event reduction，dispatcher/product execution 仍在 core |
 | `bitfun-product-domains` | Miniapp 和 function-agent 产品子域 | partial：pure decision、port、storage layout 可迁入；IO、worker、Git/AI service runtime 仍在 core |
@@ -141,6 +141,17 @@ owner 边界，否则不要把一个 feature group 继续拆成更小的 crate
   tool schema/description、`GetToolSpec` 执行和 `ToolUseContext.unlocked_collapsed_tools`
   暂时仍属于 `bitfun-core` product tool runtime。继续迁移前必须证明 prompt-visible
   manifest、expanded/collapsed exposure、unlock state 与 desktop/MCP/ACP tool catalog 等价。
+- 当前 tool runtime 外移的低风险入口是 `StaticToolProvider` / `install_static_provider`
+  合约归属 `bitfun-agent-tools`，并让 core 在 `static_providers.rs` 中将内置工具列表收敛为
+  `core.basic`、`core.agent`、`core.session`、`core.integration` provider group。
+  这不代表 concrete tools、`ToolUseContext`、runtime manifest resolver 或
+  `GetToolSpecTool` 执行已经迁移。
+- `ToolContextFacts` 只记录 tool call、agent/session/turn、workspace kind/root
+  与 runtime restriction 等可移植事实。它不携带 collapsed-tool unlock state、
+  `computer_use_host`、workspace services、cancellation token、custom data 或任何
+  可执行 service handle；workspace root 使用 session identity 的 logical path
+  （remote 为 normalized remote root）。`PortableToolContextProvider` 只是只读 facts
+  provider 合约，当前由 core `ToolUseContext` 实现；`ToolUseContext` 本体仍归 core 拥有。
 - 最新主干的 remote workspace guard 和 search fallback/context 修复提高了 workspace/search
   迁移门槛。后续迁移 workspace 或 search runtime 时，必须保留 remote workspace metadata、
   startup runtime ensure、remote flashgrep fallback、preview mapping 和 local/remote fallback 语义。