Previewing a capability exactly the way the model sees it
The tool tab compiles the real, per-city tool definition live — the same fingerprint, the same stripped identity fields, the same JSON the model is actually handed.
Every other tab on a capability's detail screen shows what an author wrote. The tool tab shows what actually got compiled — for one specific city, in one specific environment — and that distinction is the entire reason this screen exists.
Two forms of the same fact
A rendered view breaks the compiled tool description into its structural lines — summary, "USE WHEN," "DO NOT USE WHEN," a write warning where it applies, a "NOT AVAILABLE FROM THIS MUNICIPALITY" line for any field a vendor genuinely can't fill, the tenant's own addendum, disambiguation — in the compiler's own fixed order, because that order is part of the contract with both the model and the fingerprint. Beside it sits the raw JSON — literally the bytes handed to the model's tool parameter, no reconstruction, no paraphrase. When the two need to match exactly, this is where you'd catch a drift between them.
The rendered description is a presentation of the exact compiled string, not a re-derivation from the source fields on the fly — it's built this way specifically so what's on screen stays byte-for-byte identical to what the model receives, rather than silently drifting the first time the compiler's own logic changes.
The identity-parameter guarantee, made checkable
If the compiler ever had to strip a parameter from this capability's schema because it named a resident's identity, this tab is where that becomes a fact you can verify rather than a claim you take on trust — every stripped field is listed, at every nesting depth it was found at. A capability declaring an identity field in its contract is a real defect even though the tool itself is safe either way (the strip is unconditional): the tab surfaces it as its own banner, above every other diagnostic, because it's a security finding rather than a quality one.
Errors block; warnings ship
Diagnostics from the same compile come in two severities that mean genuinely different things: an error means nothing was written and publishing is disabled outright; a warning means it will be written, and it's worth reading anyway — a too-thin summary is the common one. The panel also states plainly whether the compiled tool is publishable at all, right beside its name.
The fingerprint is the cache key every downstream layer trusts
It's a SHA-256 over the name, description and canonical schema. Two cities showing the same fingerprint really are running the identical tool; a fingerprint that changes on a save nobody meant to make anything is exactly the signal that something changed that shouldn't have.
Check this tab after any semantics edit, not just after a contract change — a summary tweak or a synonym edit changes the compiled description and therefore the fingerprint too, even though the contract itself never moved.