✨ feat: WP-06 工具域——注册表、四维裁决、审批与 RunBudget

- 迁移 10：tool（注册表：风险级/审批声明/输入 Schema）、tool_call（六态含 pending_approval、幂等唯一约束）、run.max_tool_calls（RunBudget 硬上限）
- 内置工具三件：get-current-time/calculate（AST 白名单四则，只读循律）、record-note（真实副作用：写入记忆候选，必须请命）
- 四维裁决（能力/数据/后果/情境→autonomy_level）：read_only 循律直接执行；side_effect/high_impact 进入 pending_approval 请命；禁用工具 forbidden
- 审批流（朱批）：approve → 执行并落审计；deny → 拒绝且不可逆（重复审批 409）；副作用工具产物走既有记忆审核通道
- 工具入参按不可信模型输出处理：JSON Schema 子集校验（required/type/未知字段拒绝）；RunBudget 超限 422 不静默放行
- 幂等：同 (run, tool, Idempotency-Key) 重放返回 200 原调用
- 测试 67 项全绿（+7）：循律即执行、请命→朱批→真实候选产物、拒绝不可逆与不执行、Schema 三类拒绝、未注册 404、幂等重放、预算硬上限

backend/app/models.py

@@ -240,6 +240,7 @@ class Run(Base):
         ForeignKey("conversation.id", ondelete="cascade"), nullable=True, index=True
     )
     status: Mapped[str] = mapped_column(String, nullable=False, default="queued")
+    max_tool_calls: Mapped[int] = mapped_column(nullable=False, default=10)  # RunBudget 硬上限
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), nullable=False, server_default=func.now()
     )
@@ -614,3 +615,61 @@ class BigCycle(Base):
             "status IN ('pending', 'running', 'completed', 'failed')", name="status_values"
         ),
     )
+
+
+class Tool(Base):
+    """工具注册表：内置工具与后续插件贡献统一登记（WP-06）。"""
+
+    __tablename__ = "tool"
+
+    name: Mapped[str] = mapped_column(String, primary_key=True)  # kebab-case
+    description: Mapped[str] = mapped_column(String, nullable=False, default="")
+    input_schema: Mapped[dict[str, Any]] = mapped_column(JSONB, nullable=False, default=dict)
+    risk_level: Mapped[str] = mapped_column(String, nullable=False, default="read_only")
+    requires_approval: Mapped[bool] = mapped_column(nullable=False, default=False)
+    enabled: Mapped[bool] = mapped_column(nullable=False, default=True)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now()
+    )
+
+    __table_args__ = (
+        CheckConstraint(
+            "risk_level IN ('read_only', 'side_effect', 'high_impact')",
+            name="risk_level_values",
+        ),
+    )
+
+
+class ToolCall(Base):
+    """工具调用：Schema 校验与 Policy 判定后的执行记录（含审批态）。"""
+
+    __tablename__ = "tool_call"
+
+    id: Mapped[str] = mapped_column(
+        String, primary_key=True, default=lambda: new_id("tool_call_")
+    )
+    run_id: Mapped[str] = mapped_column(
+        ForeignKey("run.id", ondelete="cascade"), nullable=False, index=True
+    )
+    tool_name: Mapped[str] = mapped_column(String, nullable=False)
+    input: Mapped[dict[str, Any]] = mapped_column(JSONB, nullable=False, default=dict)
+    output: Mapped[dict[str, Any] | None] = mapped_column(JSONB, nullable=True)
+    status: Mapped[str] = mapped_column(String, nullable=False, default="pending_approval")
+    error: Mapped[str | None] = mapped_column(String, nullable=True)
+    idempotency_key: Mapped[str | None] = mapped_column(String, nullable=True)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now()
+    )
+    completed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+
+    __table_args__ = (
+        CheckConstraint(
+            "status IN ('pending_approval', 'approved', 'denied', "
+            "'executing', 'succeeded', 'failed')",
+            name="status_values",
+        ),
+        Index(
+            "uq_tool_call_idempotency", "run_id", "tool_name", "idempotency_key",
+            unique=True,
+        ),
+    )