Harden M8 trust and guidance workflows

tests/test_tool.py

@@ -685,3 +685,30 @@ class TestAgentContext:
         )
         restored = PromptStep.from_dict(step.to_dict())
         assert restored.skills == ["python"]
+
+
+class TestDeprecationFields:
+    def test_round_trip_and_warning(self):
+        from cmdforge.tool import deprecation_warning
+
+        tool = Tool(
+            name="old", deprecated=True, deprecated_message="Moved.",
+            replacement="official/new",
+        )
+        restored = Tool.from_dict(tool.to_dict())
+        assert restored.deprecated is True
+        assert restored.replacement == "official/new"
+        assert "official/new" in deprecation_warning(restored)
+
+    @pytest.mark.parametrize(
+        "values",
+        [
+            {"deprecated": "false"},
+            {"deprecated_message": 123},
+            {"replacement": "../../escape"},
+            {"replacement": "owner/name/extra"},
+        ],
+    )
+    def test_invalid_deprecation_metadata_is_rejected(self, values):
+        with pytest.raises(ValueError):
+            Tool(name="old", **values)