Merge pull request #673 from szhygulin/chore/trim-past-incidents

chore(claude-md): trim past-incident bullets

Author: szhygulin

CLAUDE.md

@@ -9,7 +9,6 @@
 - **When modifying behavior at any block of `assertTransactionSafe` (block 2 approve-allowlist, block 3 transfer-on-unknown-token, block 4 catch-all unknown-destination, block 5 per-destination ABI-selector check), audit every `prepare_*` path that targets the modified gate's destination class — not just the case the user/issue named.** A pre-sign block is a horizontal line through the prepare surface; it fails the same way for every prepare_* whose `to` lands in that class. Fixing only the named direction ships a half-fix.
 - Tells: the issue/PR names a single direction (`steth_to_eth`) when the same `to` is reachable by multiple directions (`eth_to_steth` too); the broken path has no `preview_send`/`send_transaction` test exercising the modified block; the proposed fix is gated on a flag only the named direction passes (rogue-agent-aside, the other directions don't pass the flag because the user had no reason to).
 - Format: before committing the fix, list every `prepare_*` path whose outer `to` lands in the modified block's class. For each, decide: does the new behavior cover this path, OR does the path remain blocked by the same gate? If blocked, either widen the fix or surface the gap explicitly in the PR description as out-of-scope. The exercise either widens the fix (one edit covers both) or confirms the named scope is intentional.
-- Past incident 2026-05-01: vaultpilot-mcp#626 named only `prepare_curve_swap` direction `steth_to_eth` (ERC-20 → native) at block 4's catch-all destination refusal. `eth_to_steth` (native → ERC-20) hits the same gate via the same pool `to` — but had no preview/send test asserting it, and the issue's option-1 framing would have gated the fix on `acknowledgeNonAllowlistedSpender: true` (which `eth_to_steth` never passes, no approval needed). PR [#628](https://github.com/szhygulin/vaultpilot-mcp/pull/628) widened the fix to stamp the swap leg unconditionally, sourced from `ensureSupportedCurvePool`'s upstream pool validation; both directions now pass.
 
 ## Per-protocol `prepare_*` vs. `prepare_custom_call` cutoff
 - **Keep a per-protocol `prepare_*` tool when the flow encodes any of these prepare-time invariants; otherwise route the agent to `prepare_custom_call`:**
@@ -31,7 +30,6 @@
 - **Run the cross-repo sweep at PR-write time, not when the user asks.** Before opening the MCP PR, walk: (a) does this change a behavior the skill cross-checks? (b) does it add/remove a tool the skill's `Scope` section enumerates? (c) does it change MCP-emitted block shapes the skill expects verbatim? (d) does it add a defense layer worth mirroring as skill-side ground truth (Inv #6 / Inv #1.a / Inv #11 patterns)? Yes to any → file the skill issue NOW. Past incident 2026-05-01: PR [#618](https://github.com/szhygulin/vaultpilot-mcp/pull/618) softened the MCP approve-allowlist; the skill-side companion (mirrored spender allowlist + ⚠ NON-CANONICAL SPENDER advisory) was foreseeable from the diff but filed at [vaultpilot-security-skill#26](https://github.com/szhygulin/vaultpilot-security-skill/issues/26) only after the user asked.
 - Tells the split is happening: the issue's suggested fix names a tool the MCP doesn't expose (`list_contacts(label=…)` re-derivation before a non-recipient-parameter tool); the proposed defense is "agent should call X first" (skill rules bind cooperating agents); the proposed defense is "emit a CHECKS PERFORMED block listing …" (skill renders the block, not the MCP).
 - Format for the skill issue: link the MCP issue + PR; one-paragraph context on what MCP-side shipped; the proposed rules in numbered sections; explicit scope label "cooperating-agent guidance only — rogue agent ignores any rule" (per Rogue-Agent-Only Finding Triage).
-- Past application 2026-04-29: vaultpilot-mcp#557 (share_strategy / import_strategy bypass preflight Step 0). MCP-side ship: strict-shape gate ([PR #571](https://github.com/szhygulin/vaultpilot-mcp/pull/571)). Skill-side filed at [vaultpilot-security-skill#23](https://github.com/szhygulin/vaultpilot-security-skill/issues/23) — list_contacts re-derive, CHECKS PERFORMED, schema-relay refusal as defense in depth.
 
 ## Typed-Data Signing Discipline
 - **No typed-data signing tool ships without paired Inv #1b (typed-data tree decode) + Inv #2b (digest recompute) in the same release.** Tools: `prepare_eip2612_permit`, `prepare_permit2_*`, `prepare_cowswap_order`, `sign_typed_data_v4`, any `eth_signTypedData_v4` exposure. Tracked at [#453](https://github.com/szhygulin/vaultpilot-mcp/issues/453).