Add protected typed tool media and fenced native task continuation

Cargo.toml

@@ -38,7 +38,7 @@ futures = "0.3"
 getrandom = "0.3"
 graphql-composition = "=0.12.2"
 graphql-orm = { path = "crates/graphql-orm", version = "0.43.1", default-features = false }
-graphql-orm-ai-tool-profiles = { path = "crates/graphql-orm-ai-tool-profiles", version = "0.15.0" }
+graphql-orm-ai-tool-profiles = { path = "crates/graphql-orm-ai-tool-profiles", version = "0.16.0" }
 graphql-orm-backup = { path = "crates/graphql-orm-backup", version = "0.7.2", default-features = false }
 graphql-orm-operation-catalog = { path = "crates/graphql-orm-operation-catalog", version = "0.4.0" }
 graphql-orm-router-protocol = { path = "crates/graphql-orm-router-protocol", version = "0.2.1" }

crates/graphql-orm-ai-tool-profiles/CHANGELOG.md

@@ -10,6 +10,22 @@ supersedes: []
 
 # Changelog
 
+## [0.16.0] - 2026-10-13
+
+### Changed
+
+- This pre-1.0 minor is source-breaking for public `AiToolDescriptor` literals:
+  initialize the new optional `result_media` field or use existing constructors.
+  Missing media preserves serialized descriptors and their fingerprints.
+
+### Added
+
+- Immutable result-media policies bind selected image-reference fields, exact
+  object paths, logical resolver, confidentiality and finite limits to tool
+  fingerprints. Secret/NeverExport ancestors and URL/path resolver IDs fail.
+- `PreTransportToolSourceUnavailable` retains safe no-dispatch classification
+  for unavailable protected history after an unstarted reservation is released.
+
 ## [Unreleased]
 
 ### Added

crates/graphql-orm-ai-tool-profiles/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "graphql-orm-ai-tool-profiles"
-version = "0.15.0"
+version = "0.16.0"
 edition = "2024"
 authors = ["Toby Martin <toby@dastari.net>"]
 description = "Backend-neutral GraphQL AI tool profile compiler and manifest contracts"

crates/graphql-orm-ai-tool-profiles/MIGRATION.md

@@ -10,6 +10,26 @@ supersedes: []
 
 # Migration Guide
 
+## 0.15.0 to 0.16.0
+
+This is a source-breaking pre-1.0 minor release: the public
+`AiToolDescriptor` gains the optional `result_media` field. Recompile consumers;
+old struct literals must initialize it to `None` or use the existing
+constructors. Serialized descriptors without media retain their previous
+representation and fingerprints.
+
+Profiles and descriptors gain an optional `AiToolResultMediaPolicy`. Construct
+it from validated field bindings, exact selected object paths and finite limits;
+use a logical owner resolver ID, never a URL or path. The declaration is included
+in the immutable fingerprint and can only tighten result classification. Missing
+policy preserves previous serialization/fingerprints. Consumers using public
+struct literals must initialize `result_media` or use existing constructors.
+
+Media metadata is descriptive and grants neither execution nor disclosure.
+Adopt AI 0.107.0 from the same workspace release for the trusted byte resolver,
+current source hooks, atomic budgets and typed provider transport. This package
+requires no data migration; the owning AI package does require module 0.72.0.
+
 ## 0.14.0 to 0.15.0
 
 Adopt the AI and tool-profile packages from one reviewed workspace release.

crates/graphql-orm-ai-tool-profiles/README.md

@@ -24,7 +24,7 @@ are separate runtime decisions and must remain default-deny.
 
 ```toml
 [dependencies]
-graphql-orm-ai-tool-profiles = { git = "https://github.com/Dastari/graphql-orm.git", rev = "<reviewed-full-40-character-commit-sha>", version = "0.15.0" }
+graphql-orm-ai-tool-profiles = { git = "https://github.com/Dastari/graphql-orm.git", rev = "<reviewed-full-40-character-commit-sha>", version = "0.16.0" }
 serde_json = "1"
 ```
 
@@ -252,3 +252,8 @@ registered or remote binding helpers after independently verifying the owner's
 authenticated evidence. The binding hash correlates one request/attempt; it
 never proves remote authenticity or grants authority. Generic transport and
 resolver failures remain uncertain for consequential operations.
+
+`AiToolResultMediaPolicy` binds a logical owner resolver, exact selected opaque
+image metadata, classification and finite limits to the tool fingerprint. See
+the [AI media contract](../graphql-orm-ai/docs/tool-result-media.md); reference
+JSON never supplies image bytes or resource authorization.

crates/graphql-orm-ai-tool-profiles/src/error.rs

@@ -48,6 +48,12 @@ pub enum AiError {
     /// [`Self::ProviderFailed`] and remain recovery-required.
     #[error("AI provider operation failed before dispatch")]
     PreTransportProviderFailed,
+    /// Retained protected tool content became unavailable before provider dispatch. The
+    /// unstarted reservation was durably released. A coordinator may reset the old cursor and
+    /// send only independently reopened current human input with a truthful withholding notice;
+    /// this never authorizes replay of the original effects or the unavailable history.
+    #[error("retained tool content is unavailable before dispatch")]
+    PreTransportToolSourceUnavailable,
     /// Input failed a public schema contract.
     #[error("invalid AI input: {0}")]
     InvalidInput(String),
@@ -119,6 +125,7 @@ impl AiError {
             Self::BudgetDenied => "AI_BUDGET_DENIED",
             Self::PreTransportBudgetDenied => "AI_BUDGET_DENIED",
             Self::PreTransportProviderFailed => "AI_PROVIDER_FAILED",
+            Self::PreTransportToolSourceUnavailable => "AI_TOOL_SOURCE_UNAVAILABLE",
             Self::InvalidInput(_) => "AI_INVALID_INPUT",
             Self::ResultBudgetExceeded => "AI_RESULT_BUDGET_EXCEEDED",
             Self::ReauthorizationFailed => "AI_REAUTHORIZATION_FAILED",

crates/graphql-orm-ai-tool-profiles/src/lib.rs

@@ -16,6 +16,7 @@ mod execution;
 mod execution_rejection;
 mod profiles;
 mod query_plans;
+mod tool_media;
 mod tools;
 
 pub use capability_index::*;
@@ -26,4 +27,5 @@ pub use execution::*;
 pub use execution_rejection::*;
 pub use profiles::*;
 pub use query_plans::*;
+pub use tool_media::*;
 pub use tools::*;

crates/graphql-orm-ai-tool-profiles/src/profiles.rs

@@ -15,8 +15,8 @@ use sha2::{Digest, Sha256};
 use crate::{
     AiApprovalRule, AiBrowserResultPreviewPolicy, AiDisclosureDisposition, AiDisclosureSchema,
     AiDisclosureShape, AiError, AiGeneratedGraphqlOperationPolicy, AiToolDescriptor,
-    AiToolOperationDomain, AiToolOperationKind, AiToolRisk, DataClassification,
-    GraphqlExecutionTargetId, GraphqlOperationContract, ToolMaturity,
+    AiToolOperationDomain, AiToolOperationKind, AiToolResultMediaPolicy, AiToolRisk,
+    DataClassification, GraphqlExecutionTargetId, GraphqlOperationContract, ToolMaturity,
     canonical_json::canonical_json_bytes,
 };
 
@@ -416,6 +416,8 @@ pub struct AiGraphqlToolProfile {
     idempotent: bool,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     browser_result_preview: Option<AiBrowserResultPreviewPolicy>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    result_media: Option<AiToolResultMediaPolicy>,
 }
 
 impl AiGraphqlToolProfile {
@@ -448,6 +450,7 @@ impl AiGraphqlToolProfile {
             approval: AiApprovalRule::None,
             idempotent: true,
             browser_result_preview: None,
+            result_media: None,
         }
     }
 
@@ -492,6 +495,7 @@ impl AiGraphqlToolProfile {
             approval: AiApprovalRule::OneShot,
             idempotent,
             browser_result_preview: None,
+            result_media: None,
         })
     }
 
@@ -579,6 +583,14 @@ impl AiGraphqlToolProfile {
         self
     }
 
+    /// Declares exact selected output-image metadata and one deployment-owned resolver. The
+    /// compiler validates static disclosure paths and includes this policy in the tool fingerprint.
+    #[must_use]
+    pub fn with_result_media(mut self, policy: AiToolResultMediaPolicy) -> Self {
+        self.result_media = Some(policy);
+        self
+    }
+
     /// Returns the stable host-authored profile identifier.
     pub fn profile_id(&self) -> &str {
         &self.profile_id
@@ -1000,6 +1012,9 @@ impl AiGraphqlToolManifestBuilder {
             projected_shape,
         )]));
         validate_disclosure_shape(&profile.disclosure_schema.root, &response_shape)?;
+        if let Some(media) = &profile.result_media {
+            media.validate_disclosure(&profile.disclosure_schema.root)?;
+        }
 
         let operation_name = operation_name(
             &self.subgraph_id,
@@ -1089,6 +1104,10 @@ impl AiGraphqlToolManifestBuilder {
             Some(policy) => descriptor.with_browser_result_preview(policy),
             None => descriptor,
         };
+        let descriptor = match profile.result_media {
+            Some(policy) => descriptor.with_result_media(policy)?,
+            None => descriptor,
+        };
         Ok(AiGraphqlToolManifestEntry {
             root_type: profile.root_type,
             field_name: profile.field_name,
@@ -1524,6 +1543,9 @@ fn wrap_list(shape: ProjectedShape, maximum_items: Option<u32>) -> ProjectedShap
 }
 
 fn validate_profile_shape(profile: &AiGraphqlToolProfile) -> Result<(), AiError> {
+    if let Some(media) = &profile.result_media {
+        media.validate_disclosure(&profile.disclosure_schema.root)?;
+    }
     validate_public_token(&profile.profile_id, "profile ID")?;
     validate_graphql_name(&profile.field_name, "root field")?;
     validate_model_description(&profile.description, "tool description")?;
@@ -1619,6 +1641,9 @@ fn validate_profile_shape(profile: &AiGraphqlToolProfile) -> Result<(), AiError>
 
 fn validate_compiled_descriptor(entry: &AiGraphqlToolManifestEntry) -> Result<(), AiError> {
     let descriptor = &entry.descriptor;
+    if let Some(media) = &descriptor.result_media {
+        media.validate_disclosure(&entry.disclosure_schema.root)?;
+    }
     let safe_read = entry.root_type == AiGraphqlRootType::Query
         && descriptor.maturity == ToolMaturity::ReadOnly
         && descriptor.risk == AiToolRisk::ReadOnly
@@ -1643,7 +1668,12 @@ fn validate_compiled_descriptor(entry: &AiGraphqlToolManifestEntry) -> Result<()
         || descriptor.maximum_result_bytes == 0
         || descriptor.maximum_result_records == 0
         || descriptor.maximum_classification
-            != maximum_classification(&entry.disclosure_schema.root)?
+            != maximum_classification(&entry.disclosure_schema.root)?.max(
+                descriptor
+                    .result_media
+                    .as_ref()
+                    .map_or(DataClassification::Public, |media| media.classification()),
+            )
         || descriptor.browser_result_preview.is_some_and(|preview| {
             preview.maximum_bytes > descriptor.maximum_result_bytes
                 || preview.maximum_records > descriptor.maximum_result_records