{"version":"2.1.221","anchor":"review-page-publishes-are-validated-for-capabilities-and-app","canonical_anchor":"review-page-publishes-are-validated-for-capabilities-and-app","heading":"Review-page publishes are validated for capabilities and approve stamps","tier":"notice","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221\/e\/review-page-publishes-are-validated-for-capabilities-and-app","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221","markdown":"### Review-page publishes are validated for capabilities and approve stamps\n\nPR review pages you publish are now strictly validated, with a clear refusal message when something is off.\n\n**What**\n\nPR review artifacts now go through a strict validator covering what the page may declare and what its approve action may do, with a specific refusal string per failure.\n\n**Details**\n\n- The capabilities declaration may only carry `mcp` and `self`, and `self` must be the empty-object marker.\n- The mcp manifest must name exactly one GitHub connector and must declare exactly the live read tool and the approve tool, once each.\n- The live slot must be a read-shaped tool: \"a read verb prefix such as get_\/list_\/search_, or an entity_read suffix such as pull_request_read \/ issue_read\".\n- The approve stamp's inputs must all be the anchored PR's own owner\/repo\/number, or an approve word under an event-named key.\n- `live.shaPath` must point at a head sha field.\n\n**Evidence**\n\n`stamp.input does not carry an explicit approve value under an event-named key`\n\n- Area: Artifacts\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 0\/5"}