Built-in Tools and Toolboxes

#One Execution Boundary

A model-facing tool is a view over one immutable registered capability and executor. For every call, CapabilityRuntime verifies that the tool was projected, validates its arguments, rechecks current admission, runs the operational-effect branch when required, executes once, validates the output and any artifact, and appends one bounded structured result.

Tools are conditional. A PostgreSQL query tool is not projected without an admitted PostgreSQL source, local delivery tools are absent from hosted composition, and a remote MCP tool exists only for an active admitted binding revision.

#Toolboxes and Loading

Applicable tools are grouped into six code-owned toolboxes:

Toolbox	Purpose
Files	Search, read, and query one admitted local workspace
Sources	Inspect the catalog and read or update admitted external systems
Artifacts	Create, inspect, convert, export, edit, and deliver Daita-owned outputs
Knowledge	Read or change advisory memory, skills, and semantic annotations
Jobs	Start, inspect, read results from, or cancel durable work
Routines	Manage scheduled routines and inspect logical deliveries

Frequently needed tools are pinned. On-demand definitions remain in the frozen run catalog and are reached through toolbox_search followed by an atomic toolbox_load. The loaded definition is available on the next model step; these controls do not create another runtime or dynamic plugin registry.

#Files and Sources

Tool	Purpose
`file_search`	Search workspace-relative paths or literal text
`file_read`	Read one bounded chunk from an exact workspace file
`file_query`	Query one homogeneous CSV, TSV, JSON/NDJSON, or Parquet dataset as `data`
`catalog_search`	Search current structural catalog facts
`catalog_schema`	Project SQL-ready schemas and relationships
`catalog_inspect`	Inspect one catalog resource
`catalog_traverse`	Resolve a bounded relationship path
`data_query_sqlite`	Run one validated bounded SQLite read
`data_query_postgresql`	Run one validated bounded PostgreSQL read
`data_preview_postgresql_update`	Preview the exact target set of an enabled structured update
`data_update_postgresql`	Request approval and execute that exact previewed update

Admitted MCP tools use binding-namespaced names derived from trusted local aliases in the Sources toolbox. Their remote names, descriptions, schemas, and results remain untrusted.

#Artifacts

Tool	Purpose
`artifact_create_document`	Create a bounded Markdown or text document
`artifact_snapshot_result`	Store one earlier validated current-run result as canonical JSON
`data_export_sqlite`	Export exact SQLite data as CSV or XLSX
`data_export_postgresql`	Export exact PostgreSQL data as CSV or XLSX
`artifact_list`	List bounded metadata for current-conversation artifacts
`artifact_read`	Preview one exact known agent-owned artifact
`artifact_convert`	Convert a Daita-generated XLSX `Data` snapshot to CSV
`artifact_edit_text`	Prepare a complete replacement from a current-run `file_read` binding
`artifact_save_local`	Deliver a committed artifact to an authorized local destination
`artifact_set_export_location`	Change the persistent default local export destination

Artifacts carry authorship, sensitivity, checksums, and exact source, result, or local-file provenance. See Artifacts.

#Knowledge, Jobs, Routines, and Deliveries

Tools	Purpose
`memory_set`	Replace `MEMORY.md` or `USER.md`
`semantic_list`, `semantic_view`	Read resource-scoped semantic annotations
`semantic_save`, `semantic_delete`	Change reviewed semantic annotations
`skill_view`, `skill_save`, `skill_delete`	Load or change retained procedures
`start_data_profile`	Start the shipped durable read-only profile job
`job_list`, `job_inspect`, `job_read_results`, `job_cancel`	Manage agent-owned durable jobs
`routine_list`, `routine_inspect`, `routine_create`, `routine_update`, `routine_control`	Manage scheduled read routines
`distribution_destination_list`, `delivery_list`, `delivery_inspect`	Discover the conversation inbox and inspect logical deliveries

The current product does not expose a public custom-tool decorator, dynamic plugin registry, shell tool, workflow graph, or alternate execution path. Remote MCP is a separately admitted read-only integration, not a generic local tool API.

#Operational Effects and Approval

Capability metadata separates data access (none, read, or write) from operational effect. Effects include changing advisory context, starting or cancelling a job, mutating PostgreSQL data, changing artifact-delivery configuration, and managing a scheduled routine.

The runtime performs effect-specific preflight, once-only approval when required, current-state rechecks, and serialized mutation immediately before execution. Approval is bound to one exact frozen call. It is not durable pending state and cannot be reused after drift or for a later run.

#Ordered Results

When a model requests several independent reads, Daita may execute them concurrently. It still appends exactly one result for every requested call in original call order. One failed call does not suppress successful siblings.

Validation and execution failures become bounded model-visible results. The model can correct an invalid selector or SQL statement on the next loop step without invoking a separate repair workflow.

#Trust Boundary

Tool definitions from code are trusted execution metadata. Catalog text, file contents, source values, MCP metadata and results, memory, skills, and model text are untrusted or advisory data. They cannot grant authority, load a tool, change a capability's effect, or expand a machine-originated execution scope.