How should a route that proxies tool execution keep a stable contract and safe baseline?