# PRO_TOOLS single source of truth — LED-1410.
#
# This file is the canonical list of every Delimit MCP tool that
# requires a Pro license. Codegen propagates it into:
#
#   - ai/license_core.py    : PRO_TOOLS + FREE_TRIAL_LIMITS (gets
#                             compiled to .so for paying customers)
#   - ai/license.py         : Python fallback PRO_TOOLS for customers
#                             whose platform has no .so, AND the
#                             extension frozenset that fills in tools
#                             added after the last compiled build
#   - ai/rate_limiter.py    : PRO_TOOLS (filtered to non-deliberation
#                             tools, since DELIBERATION_TOOLS has its
#                             own tier in rate_limiter)
#
# To add or remove a Pro tool:
#   1. Edit this file
#   2. Run: python3 scripts/gen_pro_tools.py
#   3. Commit the regenerated .py files alongside the YAML change
#
# CI runs scripts/check_pro_tools_drift.py on every push and fails if
# any of the three generated files diverge from this manifest.
#
# DO NOT add an "extension set" in license.py by hand — that was the
# class of bug that LED-1260 caught (compiled set diverged from
# fallback set; customers with the binary got tools free while
# customers without paid). One YAML, three regenerated callers.

version: 1

# Tools tagged `kind: deliberation` go into the DELIBERATION_TOOLS
# frozenset in rate_limiter.py (separate rate-limit tier). They are
# ALSO Pro, but they're not in rate_limiter's PRO_TOOLS frozenset
# (that one is "pro non-deliberation").
#
# `in_compiled` controls whether the tool appears in license_core.py's
# baked-in PRO_TOOLS set (which gets compiled into the .so customers
# receive). License.py's fallback + extension sets always include
# every tool here regardless of in_compiled, so the gate is consistent
# for non-binary customers. The split exists because:
#   - true  → tool is gated by gate_tool() (the function that ships
#             in the .so). Binary customers see this tool as Pro.
#   - false → tool is in the fallback set but NOT in the compiled set.
#             Binary customers' gate_tool() returns None (not gated).
#             Non-binary customers see the tool as Pro via the fallback.
# The `false` entries are a historical leak — LED-1260 surfaced this
# class of bug and added the affected tools to the extension/fallback
# but did NOT close the gate-side gap. The codegen here preserves the
# current behavior verbatim; closing the gap requires founder
# ratification per CLAUDE.md "What Constitutes a Breaking Change for
# Users" (changes default behavior for paying customers). Track at
# LED-1454 (PR-B follow-up).
#
# `free_trial_limit` lets a tool be called N times before requiring a
# license (used by license_core's FREE_TRIAL_LIMITS dict). Only set
# this on tools where a free trial makes operational sense; most Pro
# tools should NOT be partially-free.

tools:
  # ── Deliberation (separate rate tier) ────────────────────────────
  - {name: delimit_deliberate,           kind: deliberation, free_trial_limit: 3}
  # LED-1454 (founder-ratified 2026-06-17): leaky-gap CLOSED — now in the
  # compiled set. The only metered (LLM-cost) leak; free compiled-path users
  # get a 90-day grace via _NEWLY_ENFORCED_PRO (server.py).
  - {name: delimit_security_deliberate,  kind: deliberation}

  # ── Governance (deep) ────────────────────────────────────────────
  - {name: delimit_gov_evaluate,         kind: pro, category: governance}
  - {name: delimit_gov_policy,           kind: pro, category: governance}
  - {name: delimit_gov_run,              kind: pro, category: governance}
  - {name: delimit_gov_verify,           kind: pro, category: governance}
  # LED-1454 (founder-ratified 2026-06-17): leaky-gap CLOSED — in compiled set.
  # Entry of new_task -> gov_run -> gov_verify (both already compiled-gated).
  - {name: delimit_gov_new_task,         kind: pro, category: governance}

  # ── OS layer ─────────────────────────────────────────────────────
  - {name: delimit_os_plan,              kind: pro, category: os}
  - {name: delimit_os_status,            kind: pro, category: os}
  - {name: delimit_os_gates,             kind: pro, category: os}

  # ── Deploy pipeline ──────────────────────────────────────────────
  - {name: delimit_deploy_plan,          kind: pro, category: deploy}
  - {name: delimit_deploy_build,         kind: pro, category: deploy}
  - {name: delimit_deploy_publish,       kind: pro, category: deploy}
  - {name: delimit_deploy_verify,        kind: pro, category: deploy}
  - {name: delimit_deploy_rollback,      kind: pro, category: deploy}
  - {name: delimit_deploy_status,        kind: pro, category: deploy}
  - {name: delimit_deploy_site,          kind: pro, category: deploy}
  - {name: delimit_deploy_npm,           kind: pro, category: deploy}

  # ── Memory (note: store + recent are FREE; only search is Pro) ───
  - {name: delimit_memory_search,        kind: pro, category: memory}

  # ── Vault ────────────────────────────────────────────────────────
  - {name: delimit_vault_search,         kind: pro, category: vault}
  - {name: delimit_vault_snapshot,       kind: pro, category: vault}
  - {name: delimit_vault_health,         kind: pro, category: vault}

  # ── Evidence ─────────────────────────────────────────────────────
  - {name: delimit_evidence_collect,     kind: pro, category: evidence}
  - {name: delimit_evidence_verify,      kind: pro, category: evidence}

  # ── Models (provider configuration surface) ──────────────────────
  - {name: delimit_models,               kind: pro, category: models}

  # ── Observability ────────────────────────────────────────────────
  - {name: delimit_obs_metrics,          kind: pro, category: observability}
  - {name: delimit_obs_logs,             kind: pro, category: observability}
  - {name: delimit_obs_status,           kind: pro, category: observability}

  # ── Release ──────────────────────────────────────────────────────
  - {name: delimit_release_plan,         kind: pro, category: release}
  - {name: delimit_release_status,       kind: pro, category: release}
  - {name: delimit_release_sync,         kind: pro, category: release}

  # ── Cost ─────────────────────────────────────────────────────────
  - {name: delimit_cost_analyze,         kind: pro, category: cost}
  - {name: delimit_cost_optimize,        kind: pro, category: cost}
  - {name: delimit_cost_alert,           kind: pro, category: cost}

  # ── Social ───────────────────────────────────────────────────────
  - {name: delimit_social_post,          kind: pro, category: social}
  - {name: delimit_social_generate,      kind: pro, category: social}
  - {name: delimit_social_history,       kind: pro, category: social}
  # LED-1454 (founder-ratified 2026-06-17): leaky-gap CLOSED — in compiled set.
  # Approval point of the Pro social suite; already in _NEWLY_ENFORCED_PRO grace.
  - {name: delimit_social_approve,       kind: pro, category: social}

  # ── Security orchestrator ────────────────────────────────────────
  # LED-1454 (founder-ratified 2026-06-17): leaky-gap CLOSED — in compiled set.
  # Ingest half of the Pro ingest -> security_deliberate pair.
  - {name: delimit_security_ingest,      kind: pro, category: security}

  # ── Repo deep ────────────────────────────────────────────────────
  # repo_analyze / repo_config_audit / repo_config_validate moved to FREE
  # 2026-06-16 (LED-1741). repo_diagnose MOVED TO FREE 2026-06-17 (LED-1454):
  # read-only quick health smoke pass, zero marginal cost — completes the
  # repo-inspection family as the PLG free on-ramp. Removed from manifest = free.
  # (Corrects the old "stays Pro (deeper)" note: diagnose is the SHALLOW pass;
  # the deep audit is repo_analyze, already free.)

  # ── Test ─────────────────────────────────────────────────────────
  # test_coverage MOVED TO FREE 2026-06-17 (LED-1454): os.walk file-count
  # estimate (NOT a coverage runner), zero marginal cost; sibling test_smoke
  # already free. Removed from manifest = free. (Revisit if it ever invokes a
  # real runner — that would add compute cost.)

  # ── Screen capture (browser automation) ──────────────────────────
  - {name: delimit_screen_record,        kind: pro, category: capture}
  - {name: delimit_screenshot,           kind: pro, category: capture}

  # ── Moved to FREE 2026-06-16 (LED-1741, ratified) ────────────────
  # notify, the agent lifecycle (dispatch/status/complete/handoff), and the
  # loop/task control plane (next_task/task_complete/loop_status/loop_config)
  # are local-state / audit / control-plane ops with ZERO marginal cost — they
  # anchor the PLG free tier (the dead central gate meant they already shipped
  # free; this makes intent match reality). The autonomous DAEMON that runs the
  # loop (build_loop_daemon) and outbound senders are separately Pro-eligible —
  # staged for a follow-on gating pass (LED-1740 audit).

  # ── Worker Pool v2 executor (LED-981) ────────────────────────────
  - {name: delimit_executor,             kind: pro, category: agent}

  # ── LED-1740 staged-12 gating (founder-ratified 2026-06-16) ──────
  # Tools with REAL marginal cost — moved into Pro. in_compiled: false
  # because they were added AFTER the last compiled .so build (so they
  # land in license.py's fallback/extension union but not license_core's
  # compiled set, identical to the LED-1260 leaky-gap class). The inline
  # _pro_gate_graced gate in server.py enforces for non-binary customers
  # with a 90-day grace + grandfather (LED-1741), so no existing free
  # user is hard-cut. Tracked at LED-1740.
  # 3-model cross-model LLM audit:
  - {name: delimit_audit,                kind: pro, category: audit, in_compiled: false}
  # Background daemon threads (spawn long-running workers):
  - {name: delimit_build_loop_daemon,    kind: pro, category: daemon, in_compiled: false}
  - {name: delimit_inbox_daemon,         kind: pro, category: daemon, in_compiled: false}
  - {name: delimit_social_daemon,        kind: pro, category: daemon, in_compiled: false}
  - {name: delimit_daemon_run,           kind: pro, category: daemon, in_compiled: false}
  # Paid-API + LLM vendor news:
  - {name: delimit_vendor_news_scan,     kind: pro, category: vendor_news, in_compiled: false}
  - {name: delimit_vendor_news_draft,    kind: pro, category: vendor_news, in_compiled: false}
  # Outbound posting / uploads (X + YouTube):
  - {name: delimit_content_publish,      kind: pro, category: content, in_compiled: false}
  # Network scrapers (outbound network):
  - {name: delimit_social_target,        kind: pro, category: scan, in_compiled: false}
  - {name: delimit_github_scan,          kind: pro, category: scan, in_compiled: false}
  - {name: delimit_reddit_scan,          kind: pro, category: scan, in_compiled: false}
  # Inbound inbox poll (network writes when forwarding owner-action mail):
  - {name: delimit_notify_inbox,         kind: pro, category: notify, in_compiled: false}