Registered tool name recorded in the audit event.
Resolved B2 credentials and runtime policy.
A tool callback that logs the attempt and returns missing_credentials.
Discovery mode registers the full surface with placeholder credentials but
must reject every execution ahead of provider/destructive handling. This short
circuit returns the missing_credentials error without touching the real
handler, yet still emits the tool.call audit event (with the classified
code/status) so rejected attempts stay observable instead of leaving a gap.
It backstops the low-level discovery-mode tools/call interceptor: it runs
only when a call already cleared the SDK's schema validation (a
no-required-argument tool) and reached the per-tool callback.
Build an audit-only tool callback for discovery mode.