docs(rules): document indirect call arguments

The rules README and tool-rules spec now spell out that an indirect target is
carried as an IndirectCall with its own arguments, and that evaluation uses
those arguments so an argument-scoped rule cannot be sidestepped through a
dispatcher envelope. The re-exports and test formatting were tidied to match.

Auto-committed-on: dragonfly
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Author: senamakel

crates/tinytools/src/lib.rs

@@ -150,10 +150,9 @@ pub use rank::{
 };
 pub use result::{FileData, ImageData, ToolContent, ToolControl, ToolErrorKind, ToolResult};
 pub use rules::{
-    ApprovalDirective, ArgMatcher, DefaultEffect, Patterns, RuleContext, RuleDecision, RuleEffect,
-    IndirectCall, RuleRef, SideEffect, Surface, ToolMatcher, ToolRule, ToolRuleSet, ToolRules,
-    ToolSubject,
-    glob_matches,
+    ApprovalDirective, ArgMatcher, DefaultEffect, IndirectCall, Patterns, RuleContext,
+    RuleDecision, RuleEffect, RuleRef, SideEffect, Surface, ToolMatcher, ToolRule, ToolRuleSet,
+    ToolRules, ToolSubject, glob_matches,
 };
 pub use shared::{SharedTool, owned_belt, share_belt};
 pub use spec::ToolSpec;

crates/tinytools/src/rules/README.md

@@ -34,8 +34,10 @@ same line `deferral` draws.
 - **`ToolRuleSet`** stacks layers, and every layer must admit a tool. Adding a
   layer can only narrow, so two allowlists intersect.
 - **`ToolRuleSet::evaluate_call`** evaluates a call with the tool's
-  argument-aware permission. When the tool reports an `indirect_target`, it
-  evaluates that target too.
+  argument-aware permission. When the tool reports an `indirect_target`, an
+  `IndirectCall { target, arguments }`, it evaluates that target too. It uses
+  the target's own arguments when the dispatcher wraps them in an envelope, so
+  an argument-scoped rule cannot be sidestepped through the dispatcher.
 
 ## Operational constraints
 

crates/tinytools/src/rules/mod_tests.rs

@@ -415,9 +415,8 @@ impl Tool for Execute {
     fn indirect_target(&self, args: &Value) -> Option<IndirectCall> {
         let action = args.get("action")?.as_str()?;
         let toolkit = action.split('_').next()?;
-        let call = IndirectCall::new(
-            ToolSubject::named(action).with_family(toolkit.to_ascii_lowercase()),
-        );
+        let call =
+            IndirectCall::new(ToolSubject::named(action).with_family(toolkit.to_ascii_lowercase()));
         Some(match args.get("arguments") {
             Some(inner) => call.with_arguments(inner.clone()),
             None => call,
@@ -472,8 +471,14 @@ fn evaluate_call_reads_the_targets_own_arguments() {
         )
     };
     let refused = wrapped(true);
-    assert!(!refused.callable, "the envelope does not hide the target's arguments");
-    assert_eq!(refused.blocked_by.expect("blocked").id.as_deref(), Some("no-permanent-delete"));
+    assert!(
+        !refused.callable,
+        "the envelope does not hide the target's arguments"
+    );
+    assert_eq!(
+        refused.blocked_by.expect("blocked").id.as_deref(),
+        Some("no-permanent-delete")
+    );
     assert!(wrapped(false).callable);
     let call = IndirectCall::from(ToolSubject::named("x"));
     assert_eq!(call.arguments, None);

docs/specs/tool-rules.md

@@ -56,7 +56,9 @@ search, and a wildcard worked in one list but not the next.
   hand. `RuleDecision { visible, callable, approval, blocked_by }` names the
   layer and rule behind a refusal; `refusal(tool)` renders it for the model.
 - `ToolRuleSet::evaluate_call(tool, ctx, args)` evaluates the tool with its
-  argument-aware permission and, when `Tool::indirect_target` names a target,
+  argument-aware permission and, when `Tool::indirect_target` returns an
+  `IndirectCall { target, arguments }`, evaluates the target against its own
+  arguments (falling back to the dispatcher's) —
   the target too.
 - `Tool` gains two defaulted, descriptive methods: `tags()` and
   `indirect_target(args)`.