handler

type Handler struct {
	Registry   *registry.Registry
	Policy     *policy.Engine
	Capability capability.RootIssuer
	Approvals  *approval.Store
	Audit      *audit.Logger
	Metrics    *metrics.Recorder
	Risk       risk.Scorer
	Sagas      *saga.Store
	// ProvenanceJudge is nil unless cmd/rinwall sets it - the model-based
	// provenance add-on is opt-in at the deployment level (a judge must be
	// configured at all) AND per-tool (registry.Tool.ProvenanceJudge), on
	// top of the caller supplying a context window for that specific call.
	// All three gates must be open; any one absent means the existing
	// self-reported-taint path is the only thing that runs, unchanged.
	ProvenanceJudge provenance.Judge
	// VisualProvenanceJudge is the screenshot-reasoning analog - nil
	// unless cmd/rinwall configures it, opt-in the same three-gate way
	// (deployment-level judge configured, registry.Tool.VisualProvenanceJudge
	// set, AND the caller supplies both a screenshot and stated intent for
	// this specific call). Checked at a call site independent of
	// ReversibilityClass - see assessVisualProvenance's own doc comment for
	// why that's deliberate, not an oversight matching ProvenanceJudge's
	// A/C-only gate.
	VisualProvenanceJudge visualprovenance.Judge
	UpstreamBase          string
	HTTPClient            *http.Client

	// ReviewURL is where a person approves or cancels a held call, when
	// cmd/rinwall knows it (zero-config mode: the loopback console). It
	// only shapes the message the agent relays to its user; it is never a
	// credential and grants nothing. Empty means "unknown" - a real
	// deployment's console may sit behind the operator's own ingress, so
	// the message names the reviewer role instead of guessing a URL.
	ReviewURL string

	// DBSecrets/DBDSNTemplate are nil/empty unless cmd/rinwall configures
	// them - the real Vault database dynamic-secrets path (see
	// dbquery.go) is opt-in the same way ProvenanceJudge is: a tool only
	// takes this path at all if registry.Tool.IsDBBacked() is true, and
	// that path only works if a minter is actually wired up here.
	// DBDSNTemplate is a printf-style DSN with two %s placeholders
	// (username, password) - everything else about the connection
	// (host/port/database/sslmode) is fixed per deployment, only the
	// per-session credential varies.
	DBSecrets     capability.DBCredentialMinter
	DBDSNTemplate string

	// AWSSecrets/AWSRegion are the AWS analog - nil/empty unless
	// cmd/rinwall configures them, opt-in the same way. AWSRegion is the
	// one piece of AWS SDK config that doesn't vary per credential (the
	// bucket a tool reads is registry.Tool.S3Bucket, per-tool, since
	// different aws-backed tools could plausibly target different
	// buckets).
	AWSSecrets capability.AWSCredentialMinter
	AWSRegion  string

	// MCPUpstream is the client half of MCP-to-MCP passthrough - nil
	// unless cmd/rinwall configures an upstream MCP server, opt-in the same
	// way the others are, and only reached by a tool that sets mcp_tool.
	// It holds the upstream's own credential, which is precisely what
	// keeps that credential out of the agent's context - see mcpcall.go.
	MCPUpstream *mcpclient.Client
	// contains filtered or unexported fields
}