[SychPL]

Change

Stage 2 (Teams meetings and transcripts) needs two things from the core that a module could not do before.

Module read tools in the registry. A module can declare its own tools in its manifest. The registry lists the read tools of active modules as <module>_<tool>, over both MCP and the CLI, with an optional account that the core adds and resolves.

The core enforces the rules, not the module:

• it checks the arguments against the declared schema,
• it checks the read permission before the call and again after it, for the same account,
• it drops items of conversations the agent may not read,
• it takes back only a JSON object of at most 1 MiB.

Some declared tools are not listed, and status says why: write tools, bad names, names declared twice or taken by a core tool, schemas the core cannot check, and schemas that declare account. Every MCP session gets tools/list_changed when the list changes, whether from a scan or because the host stopped a module after crashes.

A module tool never shadows a core tool. A call goes ahead only if the module it reaches still declares that very tool. Without this, a replacement approved in between could run a tool that now writes, under the read permission.

WAM scope patterns. A WAM scope may now be https://*.<domain>/.default, checked at load like a host pattern. It covers one lowercase DNS label on the module's host list and nothing else. Literal scopes compare as before. The approval window says what the SharePoint pattern hands over (Sites.FullControl.All included), in the window's language. That text is the one commit added after the split (8e696e1): since #8, every Polish literal of the daemon needs its English beside it.

This is the first of three stacked pull requests split from one working branch. The Teams meetings and transcripts PR is based on this branch.

Spec

.specs/2026-10-28-meetings-transcripts.md, sections 5.1 and 5.2, already on main (8ebb79c). Codex and GLM both approved it in R10, and again in R18 after later changes.

Tests

• crates/open-mess/tests/shared_tools.rs, tests/modules.rs, tests/channel.rs and src/tools/extra.rs cover:
  • listing tools, and the reasons a tool is not listed,
  • the argument check, and the read checks before and after the call,
  • the result limit and tools/list_changed,
  • a core tool name never routing to a module.
• crates/open-mess-host/tests/sign_in.rs and tests/load.rs cover scope patterns at load and at sign-in. Literal scopes are unchanged. A pattern outside the host list, or one that covers more than one label, is refused.
• src/ui/commands.rs, wam_scopes_in_both_languages: the approval text in Polish and in English.

cargo xtask ci (CARGO_BUILD_JOBS=3): fmt, clippy -D warnings, the wasm module build and tests all green, 556 passed, 0 failed.

Commit reviews

• 3148814 (cherry-pick of fc631e3, differs only in context lines):
  • P2 (Codex and GLM on fc631e3): a module tool named like a core tool shadows it.
  • P1 (Codex, on the cherry-pick): the declaration was read before the module handle was taken.
  • Both are fixed in the next commit, 3220c13.
• 3220c13 (same patch as 4567b6e): Codex APPROVE. GLM APPROVE with one P3: no test for the "module changed meanwhile" guard. Not fixed, because the race needs a module replaced in the middle of a call.
• 8e696e1: Codex APPROVE, GLM APPROVE.

Each commit is recorded in .reviews/<sha>.processed.

Coexistence (platform modules only)

Not applicable: this changes the core and the host. The Teams module starts using it in the next PR.

Checklist

• No secrets, tokens or real message contents in code, fixtures, logs or this PR
• No unwrap / expect / panic! / unchecked indexing in non-test code
• New tool available over both MCP and the CLI (module tools come from the same registry for both)
• New dependencies named here, with their licence and why (none)