Priority: P2 (product decision).
Finding: Some wording says payments above auto-approve require confirmation, but the default LOG_AND_APPROVE tier ($1-$5) proceeds WITHOUT confirmation (confirmation begins above $5; first-payment approval defaults off).
Acceptance: either strengthen defaults to match the promise OR correct README/tool descriptions/MCPB manifest/docs/errors; one source of truth for policy wording; default-policy tests match docs; distinguish logging from human authorization.
Full finding + acceptance criteria: Vault spec lightning-enable-api-mcp-security-remediation-backlog-2026-08-15.md. Deferred (non-P0) from the 2026-08 source audit; reproduce against current main before implementing.
Priority: P2 (product decision).
Finding: Some wording says payments above auto-approve require confirmation, but the default LOG_AND_APPROVE tier ($1-$5) proceeds WITHOUT confirmation (confirmation begins above $5; first-payment approval defaults off).
Acceptance: either strengthen defaults to match the promise OR correct README/tool descriptions/MCPB manifest/docs/errors; one source of truth for policy wording; default-policy tests match docs; distinguish logging from human authorization.
Full finding + acceptance criteria: Vault spec lightning-enable-api-mcp-security-remediation-backlog-2026-08-15.md. Deferred (non-P0) from the 2026-08 source audit; reproduce against current main before implementing.