ScopeProof

Each tool occupies a distinct stage of the workflow: preflight does free structural/secret validation without a verdict, check_action produces a paid authorization verdict plus signed receipt, and verify_receipt cryptographically validates a receipt. The descriptions explicitly state what each tool does NOT do, eliminating overlap.

All tools follow the same scopeproof.<verb_noun> snake_case convention (check_action, preflight, verify_receipt) under a single consistent namespace prefix. No mixing of casing or verb styles.

Three tools is at the low edge but each is justified by a distinct step in the authorization pipeline. The scope is deliberately narrow (verdict + receipt verification), so the small surface is defensible, though it leaves little room for auxiliary operations.

The core lifecycle is covered end-to-end: validate input, obtain a signed authorization verdict, then verify that receipt. Minor gaps exist around key/issuer discovery or bulk checking, but agents can work around these for the stated purpose.