Method check_scope

src/orgkernel/schemas/execution_token.py:204–231

Validate a proposed tool call against this token's scope. Called by Tool Gateway before every external call. Returns ScopeCheckResult — never raises.

(self, tool: str, params: dict)

        return True

    def check_scope(self, tool: str, params: dict) -> ScopeCheckResult:
        """
        Validate a proposed tool call against this token's scope.
        Called by Tool Gateway before every external call.
        Returns ScopeCheckResult — never raises.
        """
        violations: list[str] = []

        if tool not in self.execution_scope:
            violations.append(f"tool_not_in_scope: {tool}")

        for key, expected in self.immutable_params.items():
            actual = params.get(key)
            if actual != expected:
                violations.append(
                    f"immutable_param_mismatch: {key} "
                    f"(expected={expected!r}, got={actual!r})"
                )

        for bp in self.bounded_params:
            actual = params.get(bp.param_name)
            if actual is not None and not bp.check(float(actual)):
                violations.append(
                    f"bounded_param_violation: {bp.param_name}={actual} "
                    f"(bounds: [{bp.lower_bound}, {bp.upper_bound}])"
                )

        return ScopeCheckResult(passed=len(violations) == 0, violations=violations)

    def invalidate(self, reason: str) -> ExecutionToken:
        """Return a new invalidated token."""