## Handoff: team-verify → complete
- **Decided**: This phase only extracts tooling-policy helpers out of `app/main.py` into `app/http/tooling_policy.py`; OpenAI / Anthropic tool allowlist, `tool_config`, and tooling-context behavior stay unchanged.
- **Rejected**: No protocol/runtime behavior change, no stream/non-stream bridge rewrite, and no session-cache or ask-mode semantic change beyond moving helper definitions.
- **Risks**: The new helper takes `settings` explicitly, so any future callers must pass the gateway settings object; if tooling policy expands later, keep helper/module boundaries aligned with the existing bridge regression suite.
- **Files**: `app/main.py`, `app/http/tooling_policy.py`
- **Remaining**: Run git scope check, create the phase checkpoint commit, push to Gitea, and keep local `main` synced with `origin/main`.