docs(mcp): add MCP-029 PHP untyped-params rationale

[eulestadt]

Rationale for MCP-029, the PHP sibling of MCP-002, from trustabl-rules#80. Renumbered from MCP-023 to clear an ID collision with rules PRs #82/#85/#88/#91 — reasoning is on that PR. Front-matter matches the shipped YAML: medium/0.85, tool scope, fix_type: code.

This extends the existing docs/Policy/mcp/tool_definition.md rather than adding a file, since MCP-029 lives in mcp/tool_definition.yaml and the gate maps one doc per pack file. That doc already defends twelve rules across five languages; this is the thirteenth.

Most of the new words go to why PHP and not the other four languages, since "just add it everywhere" is the obvious critique. Go, C# and Rust MCP tools are statically typed, so the signature always constrains the published schema and there's nothing to detect — a rule there would be dead weight. PHP hints are optional, which puts it in Python's position.

The confidence-gap section is the part I'd want checked. HasTypedParams is set when any parameter carries a type, so a single hint silences the whole signature, and I verified that against a live scan rather than reading it off the code — mixedHints(string $query, $limit) reports nothing despite $limit being bare. Tightening it would change MCP-002 and eight other packs that match the same field, so the doc records it as a deliberate engine-side follow-up rather than pretending it's a defect here. Schemas published outside the signature and #[McpResource] / #[McpPrompt] handlers are noted as out of scope too.

check_rulebook.py goes from 3 errors to 2 with this in place. The remaining two are OAI-112 and PYD-106, which came in with rules #47 before this branch and are being handled in #25 / #31. Until #80 merges the CI job validates against rules main, since it can't resolve a fork branch.

Index changes are mcp/POLICY_INDEX.md plus the MCP row and totals in the master index. I left the other SDK indexes alone — rules main has entries this book hasn't caught up with, and sweeping them in would turn a one-rule doc PR into an unreviewable catalog diff. Can do that separately if it's useful.

Made with Cursor

[eulestadt]

Closing this. The rules PR it documents (trustabl/agent-reliability-rules#80) was closed in the ID reconciliation: MCP-029 went to the TypeScript filesystem-write rule, which is a different rule. A rationale for MCP-029 here would now describe the wrong thing.