Optional Pro · not core

A typed tool protocol, and Text2SQL with an allowlist

Two optional notes. Neither is part of Easy or Medium. Neither is required to finish the six weeks.

A typed tool protocol

A tool has a name, a fixed set of argument names, and a result shape. The loop may call a name only if that name is on the allowlist for this loop. A typed tool protocol, sometimes called MCP, is one way to describe that call. The type does not decide trust. A tool you did not review is still a new allowlist entry. A remote hop does not make the refund gateway optional.

This loop may look up an order and may search policy. It may not refund. An unknown name is recorded and not run. Extra argument names are rejected. Groups are not an argument the model may pass.

TOOLS = {
    "lookup_order": {"args": ["order_id"], "writes": False},
    "search_policy": {"args": ["query"], "writes": False},
}
ALLOW = ["lookup_order", "search_policy"]

def call_typed(name: str, arguments: dict) -> dict:
    if name not in ALLOW or name not in TOOLS:
        return {"error": "unknown_tool", "name": name}
    spec = TOOLS[name]
    if set(arguments) != set(spec["args"]):
        return {"error": "bad_arguments", "name": name}
    if spec["writes"]:
        return {"error": "write_not_on_this_loop", "name": name}
    return {"ok": True, "name": name, "arguments": arguments}

assert call_typed("refund_order", {"order_id": "1042"})["error"] == "unknown_tool"
assert call_typed("lookup_order", {"order_id": "1042", "email": "ada@example.com"})["error"] == "bad_arguments"
assert call_typed("lookup_order", {"order_id": "1042"})["ok"] is True

Returning ok here only means the name and the argument names were allowed. The real lookup is still lookup_order in orders.py. Week 4 still blocks the refund in code. This snippet does not.

Text2SQL over the orders table

The model may propose one statement. You run it only if it is exactly the allowlisted text, with one bound parameter, and that parameter is one of the three order ids. There is no email column, so a statement cannot select one. SELECT *, a second statement, and any write are rejected before execute.

import sqlite3

con = sqlite3.connect(":memory:")
con.execute(
    "CREATE TABLE orders (id TEXT PRIMARY KEY, state TEXT, carrier TEXT, total_cents INTEGER)"
)
con.executemany(
    "INSERT INTO orders VALUES (?,?,?,?)",
    [
        ("1042", "shipped", "Parcel North", 4200),
        ("1043", "paid", None, 1500),
        ("1044", "cancelled", None, 8000),
    ],
)
ALLOW_SQL = "SELECT id, state, carrier FROM orders WHERE id = ?"
IDS = {"1042", "1043", "1044"}

def run_allowlisted(sql: str, params: tuple) -> dict:
    if sql.strip() != ALLOW_SQL:
        return {"error": "not_allowlisted"}
    if len(params) != 1 or params[0] not in IDS:
        return {"error": "id_not_allowlisted"}
    row = con.execute(sql, params).fetchone()
    return {"row": row}

assert run_allowlisted(ALLOW_SQL, ("1042",))["row"][1] == "shipped"
assert run_allowlisted(ALLOW_SQL, ("1043",))["row"][1] == "paid"
assert run_allowlisted(ALLOW_SQL, ("1044",))["row"][1] == "cancelled"
assert run_allowlisted("SELECT * FROM orders", ())["error"] == "not_allowlisted"
assert run_allowlisted(ALLOW_SQL + "; DROP TABLE orders", ("1042",))["error"] == "not_allowlisted"
assert run_allowlisted(ALLOW_SQL, ("9999",))["error"] == "id_not_allowlisted"
assert "email" not in {r[1] for r in con.execute("PRAGMA table_info(orders)")}

The allowlist is an exact string, not a pattern that almost matches. A pattern is how a second statement gets through. Do not loosen it to be helpful. Do not add the email column so the model can answer who bought this.

This is optional. The core path remains the tool functions in the lab, not a generated statement. Interview practice stays on the interview page. The 45-minute exercise is parse, join, and write once.