Date: 2026-09-11 UTC Budget invariant: MONEY_SPEND=0 Candidate SHA bound in staging: 9152f5a50de42be55508f0effed5ed09aee44c60 Val Town branch version after descriptor hardening: 124

• TOOL_COUNT=4
• OUTPUT_SCHEMA=PASS_ALL_FOUR_TOOLS
• ANNOTATIONS=PASS_ALL_FOUR_TOOLS
  • readOnlyHint=true
  • openWorldHint=false
  • destructiveHint=false
• TOOL_NAMES=PASS — names match bounded readiness/proposal behavior.
• TOOL_DESCRIPTIONS=HARDENED — note and stage-change descriptions now say Returns rather than Creates, avoiding any implication that the tools write CRM state.
• CUSTOM_UI=NONE; therefore widget CSP review is NOT_APPLICABLE for this bounded v1.

No input schema explicitly solicits PHI, PCI, SSNs, passwords, API keys, MFA codes, government IDs, biometrics, or authentication secrets.

The proposal tools accept bounded identifiers plus user-supplied note/reason/objective text. Those fields can contain user-entered content, so the support/privacy surfaces explicitly instruct users not to submit secrets or unnecessary sensitive data and disclose the bounded MCP inputs.

The public v1 exposes no customer-data search/retrieval tool, no CRM mutation tool, and no autonomous send tool.

All four tools declare outputSchema and set additionalProperties=false. The runtime returns bounded proposal/readiness fields only; conformance includes hostile-input rejection and output-shape checks.

No missing-outputSchema warning remains.

• verify.ts=PASS
• verify_submission_import.ts=PASS_4_TOOLS_5_POSITIVE_3_NEGATIVE
• submission_gate.ts=BLOCKED_FAIL_CLOSED_PORTAL_ONLY

Portal-only blockers remain authoritative: Apps Management write, verified publisher identity, global project data residency, conditional domain-verification status, logo upload, Scan Tools, explicit distribution scope, and production MCP URL authority.

TECHNICAL_REVIEW_PASS != PORTAL_PASS != SUBMISSION_AUTHORITY != PUBLICATION