Refresh submission docs against verified production state

README.md

@@ -417,7 +417,8 @@ blank — so the endpoint is inert except during a submission window.
 ## Deploy
 
 The deployment binary is **self-contained**: the connect/landing HTML, CSS, and SVG
-(`src/assets/`) and the reference docs (`static/`) are compiled in with `include_str!`,
+(`src/assets/` and `crates/imcp2-core/src/assets/`) and the reference
+docs (`crates/imcp2-core/static/`) are compiled in with `include_str!`,
 so nothing has to ship next to it (both are build-time inputs only). The
 only runtime file is the OAuth clients store, which the server always uses: it reads
 the file on startup and writes it (best-effort) as client registrations change, so
@@ -557,7 +558,8 @@ II handshake renders as a **nicely formatted, on-brand screen** — an editorial
 headline, a best-effort diagnostic ("your client may be out of date; remove and
 re-add the connector", etc.), and always the line *"If this error is unexpected,
 please contact mcp@dfinity.org to report it."* — rather than a raw JSON blob. The
-shared shell lives in `src/assets/connect-error.html` + `src/assets/connect.css` (reused from
+shared shell lives in `src/assets/connect-error.html` +
+`crates/imcp2-core/src/assets/connect.css` (reused from
 the connect callback page: same parchment grid, serif display, foot-of-page "Hosted
 by" mark, light/dark theming) and is fully self-contained under a strict, nonce'd,
 non-scripted, unframeable CSP that reflects no request value. Authorize errors

docs/anthropic-directory-submission.md

@@ -37,7 +37,11 @@ details (e.g. exact icon dimensions) not published in the docs.
 
 ## Readiness: requirements already met
 
-Verified against the live production deployment (2026-07-31):
+Transport and auth rows were verified against the live production
+deployment (2026-07-31). The tool-surface rows (annotations, counts, names,
+schemas) describe `main` — the build the next release deploys and the one
+under submission; the live pre-release build still serves the old surface
+(see blocker 4), so re-verify them against production after that release:
 
 | Requirement | Status |
 |---|---|
@@ -49,7 +53,7 @@ Verified against the live production deployment (2026-07-31):
 | Discovery documents (RFC 8414 + RFC 9728, path-scoped + root fallback) | ✅ all four live, `WWW-Authenticate` on the 401 points at the resource metadata |
 | Every tool: `title` + `readOnlyHint`/`destructiveHint` (+ `idempotentHint`, `openWorldHint`) | ✅ on all 11 tools, enforced by a unit test ([`crates/imcp2-core/src/tools.rs`](../crates/imcp2-core/src/tools.rs)) |
 | No catch-all read/write tool; reads and writes are separate tools | ✅ 10 of the 11 tools are read-only; the one write is `canister_update_call`. |
-| Tool names ≤ 64 chars | ✅ longest is 30 |
+| Tool names ≤ 64 chars | ✅ longest on `main` (the build to submit) is 23 (`get_canister_oql_schema`); the live pre-release build's longest is 30 — both within the limit |
 | `outputSchema` + structured content on every tool | ✅ enforced by a unit test |
 | Certificates from a recognized authority | ✅ Let's Encrypt via Caddy |
 | OAuth endpoint latency ≤ 10 s (discovery/registration/token) | ✅ all sub-second in probes |
@@ -127,10 +131,11 @@ server actually does, it should cover at least:
 Publication venue: `https://mcp.internetcomputer.org/privacy-policy`, served
 by the MCP server itself. The page and its route shipped in
 [#112](https://github.com/dfinity/imcp2/pull/112) (effective date August 3,
-2026) and the landing page's footer links it, so what remains is the
-**production release**: staging serves it now, production at the next
-`release-*` tag — cut on or after August 3 so the live page and its stated
-effective date agree. Then enter that URL in the portal. The reviewed source
+2026), the landing page's footer links it, and the page is live on
+production (verified 2026-08-27: HTTP 200). What remains: enter that URL in
+the portal, and cut the next `release-*` first — the live text is one
+revision behind `main` (the current draft's identifier-linkability wording
+lands with that release). The reviewed source
 text is [`icp-mcp-privacy-policy-draft.md`](icp-mcp-privacy-policy-draft.md).
 
 ### 2. Financial-transactions policy (resolved in code)
@@ -207,9 +212,12 @@ cycles balance is needed: the connector has no canister-management tools.)
 
 ### 4. Production is behind `main`
 
-The live server reports commit `48f1ed6`; `main` carries later hardening
-(e.g. #98, #99, #107, #108). Cut a `release-*` tag so the deployment under
-review includes them.
+The live server reports commit `bbf0844` (v0.1.1, tag
+`release-2026-08-18-0.1.1`), which predates the entire compliance chain
+(#153, #154, #155, #157, #158): it still serves the old 26-tool surface,
+including the funding and management tools this document says do not exist.
+Cut a `release-*` tag from current `main` and deploy it BEFORE submitting —
+every attestation here describes `main`, not what is currently live.
 
 ### 5. Icon asset — ready
 
@@ -226,7 +234,7 @@ both light and dark listing backgrounds. Regenerate with the Chromium
 rasteriser if the source ever changes (lighter rasterisers mis-render its
 `linearGradient` with a `rotate` transform). This is the *listing* icon only:
 the served pages keep using the DFINITY wordmark
-([`src/assets/dfinity-logo.svg`](../src/assets/dfinity-logo.svg)) for their
+([`crates/imcp2-core/src/assets/dfinity-logo.svg`](../crates/imcp2-core/src/assets/dfinity-logo.svg)) for their
 "Hosted by" footer.
 
 ## Portal field drafts
@@ -246,8 +254,8 @@ Paste-and-adapt; portal limits in parentheses.
 
   > The official connector between Claude and the Internet Computer, hosted by
   > DFINITY. Sign in once with Internet Identity — no keys or seed phrases in
-  > the chat — and Claude can work with the IC directly: identify what a
-  > canister is, fetch its Candid interface, read app data via typed queries
+  > the chat — and Claude can work with the IC directly: fetch a canister's
+  > Candid interface, read app data via typed queries
   > or OQL, and discover the canisters behind any IC app from its name or URL.
   > With your consent it can also act as your Internet Identity accounts at a
   > specific app. Financial transactions are not supported: token-ledger
@@ -352,8 +360,8 @@ conversation beyond tool arguments and generates no media.
 
 ## Submission-day checklist
 
-- [ ] Dedicated ICP MCP privacy policy live at `https://mcp.internetcomputer.org/privacy-policy` (page + landing-page link merged; needs the production release) and entered in the portal (blocker 1)
-- [ ] Reply received from mcp-review@anthropic.com settling the financial-transactions and first-party-API acknowledgments (asked 2026-07-31; blocker 2)
+- [ ] Privacy policy entered in the portal — the page is already live at `https://mcp.internetcomputer.org/privacy-policy` (verified 2026-08-27); the next `release-*` refreshes its text to the current draft (blocker 1)
+- [x] Financial-transactions question resolved in code (blocker 2) — no mcp-review reply is needed; if one arrives, answer with the shipped posture. The first-party-API/data-handling question was NOT in the 2026-07-31 email: raise it with mcp-review only if the portal's data-handling options don't fit
 - [x] Reviewer access settled: self-serve Internet Identity, instructions in the test-credentials field (blocker 3) — if a reviewer asks for a populated account, provision a demo-app account (no funding needed: there are no funding or canister-management tools)
 - [ ] `release-*` tag cut; `/version` on production shows the intended commit (blocker 4)
 - [x] Square PNG icon exported — `docs/assets/icp-logo-{1024,512}.png` (blocker 5)

docs/openai-directory-submission.md

@@ -57,9 +57,9 @@ add details not published in the docs.
 | Tools explicitly annotated `readOnlyHint` / `destructiveHint` / `openWorldHint` — "incorrect or missing action labels are a common cause of rejection" | ✅ set on all 11 tools. The unit test enforces annotation presence and the `readOnlyHint`/`destructiveHint` values; `openWorldHint` is declared everywhere but not asserted by the test, so re-check it in the portal's Scan Tools step |
 | Tool names "human-readable, specific, and descriptive"; accurate descriptions; minimum-information requests | ✅ reviewed against the same bar for the Anthropic listing |
 | Public HTTPS production endpoint, stable and complete ("trial or demo plugins will not be accepted") | ✅ production deployment |
-| Privacy policy disclosing "categories of personal data collected, purposes of use, categories of recipients, data retention timelines" | ⏳ **pending the production release**: the rewritten policy matches these four required disclosures exactly and is live on staging, but `https://mcp.internetcomputer.org/privacy-policy` serves nothing until the next `release-*` tag ships it (see the checklist) |
-| Customer support contact (OpenAI asks for a URL) | ✅ `https://mcp.internetcomputer.org/support` — ships with this PR (live at the next release); routes users to <mcp@dfinity.org>, the status dashboard, id.ai access management, GitHub issues, and the security policy |
-| Terms of Service URL | ✅ `https://mcp.internetcomputer.org/terms` — ships with this PR (live at the next release); Swiss-law terms covering the non-custodial model, user responsibility for authorized actions, irreversibility of network actions, as-is/liability limits with the Art. 100 CO carve-out. Needs the same legal pass as the privacy policy |
+| Privacy policy disclosing "categories of personal data collected, purposes of use, categories of recipients, data retention timelines" | ✅ the rewritten policy matches these four required disclosures exactly and `https://mcp.internetcomputer.org/privacy-policy` is live (verified 2026-08-27); the next `release-*` refreshes its text to the current draft |
+| Customer support contact (OpenAI asks for a URL) | ✅ `https://mcp.internetcomputer.org/support` — merged and live on production; routes users to <mcp@dfinity.org>, the status dashboard, id.ai access management, GitHub issues, and the security policy |
+| Terms of Service URL | ✅ `https://mcp.internetcomputer.org/terms` — merged and live on production; Swiss-law terms covering the non-custodial model, user responsibility for authorized actions, irreversibility of network actions, as-is/liability limits with the Art. 100 CO carve-out. Needs the same legal pass as the privacy policy |
 | Logo | ✅ [`docs/assets/icp-logo-1024.png`](assets/icp-logo-1024.png) |
 
 Note the legacy redirect `chatgpt.com/connector_platform_oauth_redirect` is
@@ -75,7 +75,7 @@ if a reviewer reports a failure.
 The portal requires proving control of the host: an endpoint at
 `https://<host>/.well-known/openai-apps-challenge` must return **only** the
 verification token revealed during submission ("do not return JSON, a list of
-tokens, or multiple tokens"). The route ships with this PR: it serves
+tokens, or multiple tokens"). The route is merged and deployed: it serves
 `$OPENAI_APPS_CHALLENGE_TOKEN` verbatim as `text/plain` (trimmed, so unit-file
 whitespace can't break OpenAI's exact-match check) and 404s while the variable
 is unset, so it is inert until a submission is in flight. When the portal
@@ -106,8 +106,7 @@ financial-transfers prohibition:
 
 - Prohibited: "Crypto or NFT offerings involving **speculation, consumer
   deception**". IMCP2 offers no speculation product — no trading, prices, or
-  markets. Cycles funding is metered compute credit for the user's own
-  canisters.
+  markets.
 - Commerce rules ("only for physical goods", no digital-goods selling, no
   embedded checkout) govern *selling through the app*; IMCP2 sells nothing.
 - The attestation "my plugin does not initiate or execute money transfers,
@@ -177,8 +176,9 @@ Negative:
 
 - [ ] OpenAI Platform organization verified (business verification)
 - [ ] Submitter holds the Apps Management write permission
-- [ ] Repository secret `OPENAI_APPS_CHALLENGE_TOKEN` set to the portal's token and deployed; `curl https://mcp.internetcomputer.org/.well-known/openai-apps-challenge` returns exactly the token (blocker 1 — the route itself ships with this PR)
-- [ ] Privacy policy live at `https://mcp.internetcomputer.org/privacy-policy` (same release as the Anthropic listing needs)
+- [ ] Production runs a release cut from current `main`: `curl https://mcp.internetcomputer.org/version` reports a commit that contains #153–#158 — verify immediately before submitting, since the deploy workflow also accepts older tags/SHAs (rollbacks), so a deployed challenge token alone does not prove the compliant build is live
+- [ ] Repository secret `OPENAI_APPS_CHALLENGE_TOKEN` set to the portal's token and deployed; `curl https://mcp.internetcomputer.org/.well-known/openai-apps-challenge` returns exactly the token (blocker 1 — the route is merged and deployed; it 404s until the variable is set, by design)
+- [x] Privacy policy live at `https://mcp.internetcomputer.org/privacy-policy` (verified 2026-08-27; the next release refreshes its text to the current draft)
 - [ ] Tools re-scanned in the portal after any server change; annotations verified in the scan
 - [ ] 5+ positive and 3+ negative test cases entered, verified on web and mobile
 - [ ] Starter prompts entered; country availability chosen