feat(mcp): add MCP-027, MCP-028, MCP-029 TypeScript and PHP parity rules

[Paramjeet-singh-neu]

Summary

• Add MCP-027: TypeScript MCP mutating tool has no idempotency key (name_has_prefix without a trailing _ + negated param_name_matches on inputSchema), matching CSDK-016 / LC-016 / MCP-007.
• Add MCP-028: Ambiguous TypeScript MCP tool name (name_in on registerTool / tool), matching MCP-003 / MCP-016 / MCP-018 / MCP-020 / MCP-022. TypeScript was the only MCP language surface with a description rule (MCP-011) but no ambiguous-name rule.
• Add MCP-029: PHP MCP mutating tool has no idempotency key (name_has_prefix with _ + negated param_name_matches on the #[McpTool] signature), matching MCP-007.

IDs MCP-023..026 were already claimed in open PRs (#80 PHP untyped, #82 stdout, #85 TS timeout, #88 description quality), so this pack starts at 027. Original Track A items that are already filed (TS HTTP timeout, PHP untyped params) are not re-filed here.

No new predicates and no schema_version bump — both matches are already used by other packs. Discovery already captures TS ParamNames from Zod inputSchema and PHP ParamNames from method signatures.

Paired PRs (same branch name feat/mcp-ts-php-parity):

• Engine fixture + tests: opened next
• Rulebook rationale: opened next

Test plan

• trustabl rules validate . on this pack
• Engine go test ./internal/rules/ -run TestPolicyRules (fire + silent cases for all three IDs)
• Confirm MCP-023..026 open PRs do not collide — this pack uses 027/028/029

Made with Cursor