feat(grid-agent): enforce central action policy (#120)

crates/metacrate-grid-agent/src/backend.rs

@@ -1,6 +1,7 @@
 //! Narrow injected boundaries between orchestration and grid/world I/O.
 
-use crate::types::{GridEvent, GridEventKind, PolicyDecision, ProposedToolCall, ToolCallOutcome};
+use crate::policy::AuthorizedAction;
+use crate::types::{GridEvent, GridEventKind, ToolCallOutcome};
 use libremetaverse_types::compat::CancellationToken;
 use std::error::Error;
 use std::fmt;
@@ -49,18 +50,21 @@ pub trait GridBackend: Send + Sync + 'static {
     ) -> BackendFuture<'_, Result<(), BackendError>>;
 }
 
-/// The sole world-mutation boundary. Later tool implementations cannot bypass
-/// the policy decision passed to this trait, and fake/live implementations use
-/// the same call shape.
-pub trait WorldMutator: Send + Sync + 'static {
+/// Backend for an already authorized tool action. `AuthorizedAction` has no
+/// public constructor and binds the exact name, arguments, principal, budget,
+/// and one policy authorization.
+pub trait AuthorizedToolBackend: Send + Sync + 'static {
     fn apply(
         &self,
-        call: ProposedToolCall,
-        decision: PolicyDecision,
+        action: AuthorizedAction,
         cancellation: CancellationToken,
     ) -> BackendFuture<'_, Result<ToolCallOutcome, BackendError>>;
 }
 
+/// Marker for world-mutating backends. Production mutations use the same
+/// opaque authorization boundary as every other tool backend.
+pub trait WorldMutator: AuthorizedToolBackend {}
+
 /// Inert deterministic backend used by the foundational offline service.
 ///
 /// It performs no login or network operation and is available without the