2026-07-07 audit corrections: ADK bash-tool rename, AG2/OAI match guards, timeout harmonization, CSDK-121..124, CSKILL-001 recalibration

[jhumel-code]

Corrections from the 2026-07-07 full rules audit (verified against live SDK sources) plus one calibration driven by maintainer feedback from the outreach program.

Rule fixes

• ADK-008/102/103: match ExecuteBashTool (the current google-adk class; upstream ships no BashTool class) alongside the legacy name — these rules could not fire on current ADK code. ADK-008 explanation now also acknowledges the tool's built-in confirmation prompt.
• ADK-110: also matches the idiomatic url_context / load_web_page instance forms (LoadWebPage is a function upstream, not a class).
• ADK-002: added the has_params: true guard — no longer fires on zero-param tools.
• AG2-002/005/006: no longer fire on code_execution_config=False, the explicit-disable form their own fix text recommends.
• OAI-014/111: fire on needs_approval absent or explicitly False; a per-call approval callable (the SDK's documented HITL form) now counts as a gate and stays silent.
• OAI-019: underscore-free prefixes so idiomatic camelCase TS tool names match; removed the stale "will not fire until the TS parser ships" text.
• OAI-106: no longer fires on an empty mcp_servers=[].
• Timeout rules (CSDK-003 / OAI-005 / ADK-003 / MCP-004 / PYD-006 / AG2-012): harmonized to one callee superset (requests incl. Session aliases, httpx, urllib both forms, aliased aiohttp); corrected CSDK-003's wrong NOTE about aiohttp alias canonicalization.
• CSKILL-001: recalibrated critical→high, 0.95→0.9, with docs-accurate explanation/fix (allowed-tools is scoped to the active skill and trust dialog; model invocation is on by default) — response to the gsd-plugin maintainer's by-design rebuttal.

New rules

• CSDK-121..124 (TypeScript, claude_agent_definition): Bash / WebSearch / write built-ins / WebFetch grants on a TS AgentDefinition — previously a zero-coverage gap (CSDK-101..105 are python-gated).

Hygiene

• CSDK-203 / OAI-202 / ADK-201: dropped the language: python gate so TS-only repos get the agent-guidance-doc check.

Merge order

Merge this before (or together with) the engine branch cf/sharp-curie-ae4b0a — the engine fixture mirrors this content and its rules-sync CI job compares against this repo's main. The rulebook PR (trustabl-rulebook#fix/rules-audit-2026-07-07) carries the paired rationale docs and should land alongside.

Engine-side: all fire/silent cases updated, go test ./... green, check-rules-sync.sh green against this branch, rulebook check_rulebook.py green.

🤖 Generated with Claude Code