feat: add host tool catalog for orchestration

Author: ymote

Cargo.lock

@@ -76,11 +76,17 @@ The JSON dataflow example is runnable with:
 cargo run -p splash-cli -- run --allow-json-add examples/json_tool_workflow.splash
 ```
 
+Inspect the exact demo-tool catalog supplied to an LLM host with:
+
+```sh
+cargo run -p splash-cli -- catalog --allow-echo --allow-json-add
+```
+
 ## Workspace
 
 - `splash-core`: bounded VM wrapper and diagnostics.
 - `splash-capabilities`: explicit tool policy, audit log, deferred promises,
-  and safe host bridge.
+  LLM-facing host catalog, and safe host bridge.
 - `splash-protocol`: portable worker messages, capability attenuation, and
   host-side invocation/result validation.
 - `splash-workflow`: host-owned planning, approval, and sequential execution.
@@ -89,4 +95,5 @@ cargo run -p splash-cli -- run --allow-json-add examples/json_tool_workflow.spla
 
 See [SECURITY.md](SECURITY.md) for the current threat model and [UPSTREAM.md](UPSTREAM.md)
 for the import boundary. The [worker protocol](docs/worker-protocol.md)
-defines the handoff to future contained adapters.
+defines the handoff to future contained adapters. The [host tool catalog](docs/tool-catalog.md)
+defines safe discovery for an LLM orchestrator.

README.md

@@ -49,3 +49,7 @@ This baseline does not yet provide filesystem adapters, network adapters,
 secret storage, worker-process isolation, signed packages, JSON-schema
 validation, or mobile policy backends. Those features must not be inferred
 from the presence of the VM.
+
+Tool descriptions and schema hints are available only through the host-side
+catalog. They are prompt metadata, not script-visible authority or executable
+schema enforcement.

SECURITY.md

@@ -11,6 +11,7 @@ workspace = true
 
 [dependencies]
 makepad-script = { path = "../../vendor/makepad/platform/script" }
+serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0.150"
 splash-core = { path = "../splash-core" }
 splash-protocol = { version = "0.1.0", path = "../splash-protocol" }