[aterga]

Summary

Directory review asked, alongside the guard extension that landed in #213 and #214, that the server instructions "no longer describe the guard as incomplete". The financial-transactions paragraph still carried the pre-extension clause "that guard is a safeguard, not a complete filter, so treat this policy, rather than the absence of a refusal, as the limit", and financial_policy_is_a_server_instruction_not_a_description pinned it.

Two things happen here:

1. The instructions describe the guard (85c28ff, ae2270c). The paragraph says what an update call is checked against, in general terms, and states the one thing none of the checks judges, so a reader knows what the guard covers without being told it is incomplete and without the limit being implied away.
2. The keyword scope loses its exemption list (b6bd546). Review on the first commit pointed out that the paragraph over-claimed: the keyword check exempted transfer_ownership / transferOwnership. Rather than document the exemption, it is removed: the two spellings were carried on the OpenZeppelin Ownable convention alone, no mainnet interface declaring either was found, and the list's own rule was that a name with no source does not get in. A name that carries a keyword is now refused whatever the app means by it. This is a guard behaviour change, not only wording.

Related issues

Follows #213 and #214 (the guard extension the review asked for) and #212 (the optional unknown-app suggestion). Closes the last item from the directory review's follow-up email.

Changes

Server instructions (crates/imcp2-core/src/tools.rs):

• SERVER_INSTRUCTIONS: the financial paragraph describes the three checks: by method name (ICRC ledger methods, neuron management, financial keywords as whole words, naming transfer, withdraw and swap as examples), by destination (the known financial-service canisters), and by the canister's own published Candid interface (ICRC-1/ICRC-2 methods make it a financial service; a missing or unreadable interface means no update call at all). It states the limit ("Not judged: a bespoke value-moving method under an unrelated name on a canister whose interface is not a ledger's") and keeps the redirect. The keyword list, interface markers and canister ids are still not restated, for the same drift reason as before.
• The doc comment above the constant explains that split.
• financial_policy_is_a_server_instruction_not_a_description pins the three checks and the stated limit, pins the old clause out, checks the three example keywords against compliance::disallowed_update_method, and pins that the paragraph mentions no exemption and that transfer_ownership is refused. The existing policy-gate scan (model_readable_metadata_respects_marketplace_policy) covers the new text unchanged.

Guard (crates/imcp2-core/src/compliance.rs):

• EXEMPT_METHODS is removed and financial_keyword no longer consults a list; it is a pure whole-word match against FINANCIAL_KEYWORDS.
• Module docs record that the exemption was tried and why it went.
• Tests: exemptions_are_literal becomes no_name_is_exempt (both ownership spellings and three variants refused, with the by-name register); financial_keyword_matches_whole_words_only gains the two spellings as transfer matches; the generic-names-stay-callable list drops them; keyword_and_exemption_lists_are_well_formed becomes keyword_list_is_well_formed.

Docs:

• README.md: the policy paragraph and the canister_update_call row say the keyword rule has no exemptions, so transfer_ownership is refused too.
• docs/anthropic-directory-submission.md and docs/openai-directory-submission.md: the sentences describing the keyword rule and what the instructions state are aligned.

Testing

CI on the head commit (b6bd546): test (cargo test --locked --workspace --all-targets), End-to-end (PocketIC), Formatting and Scan for internal identifiers all green; Copilot re-review reports no open issues.

Locally, on the first two commits:

• cargo test --locked -p imcp2-core --lib: 203 passed, 0 failed
• cargo fmt --all -- --check clean; cargo clippy -p imcp2-core --all-targets --locked reports only pre-existing warnings (map_or, repeat().take(), a redundant closure), none in the changed lines
• cargo build --locked --all-targets for the whole workspace was not run locally; CI's test job covers it
• npm test --prefix monitoring/mcp-status (dashboard unchanged)

Checklist

• I have read the Contributing guidelines.
• Docs (README / comments) updated for any user-visible change.
• No secrets, credentials, or internal-only information are included.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PruVfYuaS7ZAgNBMTsuRP6

[Copilot]

🟡 Changes recommended

The new instructions incorrectly claim all financial-keyword method names are refused, omitting the control-handover exemptions and misleading clients about available operations.

1 open issue

• Document control-handover exemptions from financial keyword blocking · New

What changed in this PR

Updates the server instructions to describe the financial guard extended in #213 and #214, replacing the “incomplete filter” wording while preserving the policy and its stated limit. Guard behavior is unchanged.

Changes:

• Describes checks by method name, destination, and published Candid interface.
• Updates assertions to require the new wording and verify the example keywords against the guard.
• Aligns both directory submission documents with the revised instructions.

File	Description
docs/​openai-directory-submission.md	Aligns the policy explanation with the three checks and stated limit.
docs/​anthropic-directory-submission.md	Documents the revised instructions and keyword assertions.
crates/​imcp2-core/​src/​tools.rs	Revises server instructions, explanatory comments, and regression assertions.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the changes clarifying the financial guard’s checks and limitations.

No open issues 🎉

1 resolved since last review

• Document control-handover exemptions from financial keyword blocking

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are reported for the financial-guard documentation and keyword-enforcement updates.

No open issues 🎉

_{Review effort: Balanced}