test(rules): add MCP-027, MCP-028, MCP-029 fire/silent cases

[Paramjeet-singh-neu]

Summary

• Mirror MCP-027 / MCP-028 / MCP-029 into testdata/rules-fixture/mcp/ so the engine fixture stays in sync with the rules pack.
• Add fire/silent TestPolicyRules cases:
  • MCP-027: createCharge without idempotencyKey fires; with key silent; getBalance silent
  • MCP-028: registerTool("process", ...) fires; summarizeInvoice silent
  • MCP-029: PHP create_order without idempotency_key fires; with key silent; fetch_weather silent

Paired with trustabl-rules and trustabl-rulebook on the same branch feat/mcp-ts-php-parity.

Test plan

• go test ./internal/rules/ -run TestPolicyRules
• RULES_REPO=../trustabl-rules scripts/check-rules-sync.sh

Made with Cursor

[jhumel-code]

Thanks @Paramjeet-singh-neu. This is exactly how the fixture half of a rule PR should look. Both YAML files are byte-identical to the production pack in trustabl/agent-reliability-rules#100, so the rules-sync check will be happy, and every new rule has both a fire and a silent case. I walked the cases against discovery and they hold up: the TypeScript cases work because Zod inputSchema keys are captured as ParamNames, so idempotencyKey satisfies the case-insensitive contains: idempot match in the silent case, and the PHP cases work because the #[McpTool] attribute supplies the tool name while the method signature supplies the params, so $idempotency_key correctly silences MCP-029. The getBalance and fetch_weather negative cases exercise the prefix gate rather than just the param gate, which is a nice touch.

The only thing holding this pair up is coordination, not quality: MCP-027 and MCP-028 are also claimed by #168 and trustabl/agent-reliability-rules#91, and MCP-029 by #124, #172, trustabl/agent-reliability-rules#80, and trustabl/agent-reliability-rules#94. Whichever set lands first keeps the IDs, and the rest will need to renumber and rebase, so this may need a mechanical renumber before merge. I will keep it in lockstep with the rules-repo PR either way.

[sairenchristianbuerano]

Closing. All three ids resolve elsewhere:

• MCP-027, MCP-028 → feat(mcp): add MCP-027, MCP-028 TypeScript description quality rules agent-reliability-rules#91 (TypeScript description quality)
• MCP-029 → feat(mcp): add MCP-029, TypeScript tool writes to the filesystem agent-reliability-rules#94 (TypeScript filesystem write)

Your three rules — TypeScript MCP idempotency, ambiguous TypeScript MCP tool name, and PHP MCP idempotency — are all distinct from those and are not shipping as a result. MCP-030 onward is free if anyone wants to bring them back.

To be clear about what this is and is not: the review found no fault with the work. Several contributors picked the same ids independently, and we are settling each id on a single pair rather than renumbering across six forks. Thanks for the contribution.