[lilyshen0722]

Docs-only, based on main. It was stacked on #2323. After #2323 squash-merged (2f403e8), this branch was rebuilt as main plus this PR's own commit, and both documents are byte-identical to the head cleared at 2464ace (Rhea re-stamped at eca36d2).

Sam ruled on 2026-10-19 that writes are allowed when the member approves them, and apps are chosen by what our users use. That lifts the plan's §3 bar that every entry's credential be unable to write. This amends the plan to match.

• §3. An entry's credential may write. Each write is pinned write, so it parks for the credential's owner with its exact arguments, and the mint still refuses write on a hosted grant. The section records the two residuals the ruling accepts, and the rules each Wave 1 pin set is ruled under.
• §5. Drops the credential fence the bar required, and specifies the other gate item: a parked call runs only under the pin it parked under. Approval binds the arguments and the tool's name, not the pin, and a write pin is re-pinned on any schema change. So without this, a call parked across a re-pin would run under the new pin. It is broker code, built once, before the first entry that pins a write merges.
• §10, step 8. Records Wave 1 (TASK-237 to TASK-246) and names the binding's two tests. The hold and the earlier orders stay as the record.
• §11 and the 2026-10-13 sweep. Each notes where the old bar stood.

§12 is unchanged. Code cites are read at main df8c219f.

Gate: Rhea (docs-only).

🤖 Generated with Claude Code

[lilyshen0722]

#2330 CLEARED at 2464ace

Reviewed the complete stacked merge-base diff against #2323 at 54065b4: two documents, 28 additions and 8 deletions. No blocking documentation defect found. The base is the exact head previously cleared in review 5564631117; its review carries for the inherited content. REVIEW.md and the incident checklist are unchanged from the previously read versions. Diff whitespace check passes.

The amendment matches the 10-19 ruling recorded on TASK-237–246 and the shared Wave 1 plan: credential write authority is allowed, named writes require the credential owner's approval, and the ten selected rows replace the earlier catalogue hold/order. Read the accepted residuals and Wren's 78917 pin-set ruling. The new text explicitly includes the effect on unparked reads rather than claiming the approval park confines a write-capable credential. The old sweep is correctly labelled evidence measured against the former bar. No private paths or operator identifiers were added to these public documents.

Independently checked the cited current source at df8c219: writeModeFor maps write pins to write-with-confirm; the hosted grant mint refuses plain write; callTool parks canonical arguments for connection.ownerUserId before reserving budget. ApprovalToolCall and executeApprovedToolCall currently bind the arguments and tool name, with no stored definition digest. The new pin-binding requirement is therefore future broker work, not a claim of existing protection. Exact write-schema comparison includes property descriptions, the card default lifetime is 24 hours, and all four currently registered hosted entries pin reads only.

Sections 5 and 10 require the broker to refuse a changed pin as tool_drift before reservation and before the first write entry merges; the required tests include the refusal/seat-ending arm and the unchanged-pin execution control. Section 12 is byte-identical to the cleared base. This docs gate neither certifies that implementation nor clears an individual vendor pin set, authenticated walk, deployment, or Wednesday merge hold. No application tests or rendered-doc check were run for this prose-only amendment.

Final live PR head matches the fetched SHA above. A rebase after #2323 lands needs a new exact-head check.

Written by Rhea, a Commonly agent — https://commonly.me/v2/pods/6a8f6dc7a1dccf2e02f31015?threadRootId=78929

GATE: PASS

[lilyshen0722]

#2330 CLEARED at eca36d2

Re-stamp of review 5568155972 at 2464ace. No blocking defect found.

Independently compared the complete bytes of both changed documents: docs/plans/hosted-mcp-connection-scope.md and docs/plans/hosted-mcp-catalogue-sweep-2026-10-13.md are identical to the previously cleared head. Their respective parent versions are also byte-identical, so the amendment itself is preserved exactly. The new head is one commit directly on main/#2323 squash 2f403e8. The complete main-to-head and merge-base scope contains exactly those two files, +28/-8; whitespace check passes. REVIEW.md and the review checklist are unchanged.

The prior docs/source review carries unchanged, including its limits: this is not certification of broker implementation, vendor pin sets, authenticated walks or deployment. No application tests or rendered-doc checks were repeated for identical prose. Fetched pull ref and live PR head both match this review’s full SHA.

Nonblocking PR-body housekeeping: its opening still says stacked on #2323 and describes the rebase as future work. The actual base is main and the rebuild is complete; update that opening when convenient.

Written by Rhea, a Commonly agent — https://commonly.me/pods/6a8f6dc7a1dccf2e02f31015

GATE: PASS