[enot3615]

Skill 2.10.2, the guide side of two findings from the 2026-10-19 end-to-end test (Codex + MCP 2.11.2 paid $0.10 on Raters Dev). Companion of the AiFinPay/sdk PR for MCP 2.11.3. Draft: the owner publishes.

What changed (agent/skills/aifinpay/SKILL.md)

Funding amount

• Step 4 no longer names a POL amount or a POL/USD rate (it said "about 0.5 POL covers one $0.10 batch plus a 0.3 POL cap"; the test's quote priced $0.10 at 1.08 POL). The amount is what payment_setup_status prices in its funding field (MCP 2.11.3): the smallest batch at today's rate plus the gas cap, summed as amount. The agent never quotes a remembered number; when funding has a rate_error and no amount, it asks the owner to fund "the batch price in POL at today's rate plus the gas cap" and names no number.
• Step 2 and the surface table mention funding; the "Paying with payable_fetch" funding sentence points at the priced amount.

Owner limits

• The env block example now shows AIFINPAY_MAX_USD: "5" / AIFINPAY_DAILY_USD: "20" and says the USD values are a ceiling the owner sets once, not a budget; AIFINPAY_MAX_USD only has to be at or above the batch (was "keep it a little above the batch you expect to buy").
• "After creating a wallet: link it to the owner's dashboard" now says the dashboard Controls (per-payment cap, daily cap, pause, allowed sites) are where the owner manages the working limits once the agent is claimed with agent_claim_self, enforced by the backend on every /v1/quote and /v1/pay; the env values stay as the ceiling the SDK requires before it signs, a payment has to pass both, and after the claim the agent points the owner at Controls rather than at the config file. This replaces "Keep local owner spending limits in the agent's configuration".
• Step 4 tells the agent to ask for a ceiling the owner will not need to revisit.

Versions

• version: 2.10.2 (both skills, package, lock, .claude-plugin/plugin.json, marketplace).
• Release target MCP 2.11.3, Node SDK 2.9.0 (MCP 2.11.3 requires agent 2.9.0 for the codex framework), Python 2.7.0 — in the payer guide, the merchant guide and the README.
• Published baseline checked 2026-10-19: MCP 2.11.2, Node SDK 2.8.0.
• CHANGELOG entry.

Nothing in the merchant guide changed apart from the release-target line.

Verification (at 8a6875a)

• npm test → node scripts/validate.mjs ok (both skills, README targets equal, baseline line present, changelog/lock/plugin versions equal) and validate.test.mjs 13/13.
• node scripts/check-version-bump.mjs origin/main → 2.10.1 → 2.10.2.
• No 0.5 POL / $0.20 / 0.15 / 1.00 left in the payer guide or README.

Release order

1. Merge and publish @aifinpay/skill 2.10.2 (the first step of the chain, as 2.10.0/2.10.1 were).
2. AiFinPay/sdk: the MCP 2.11.3 PR merges and @aifinpay/agent 2.9.0 is published.
3. AiFinPay/sdk follow-up bumps @aifinpay/skill ^2.10.2 + @aifinpay/agent ^2.9.0 in the MCP lock, re-pins the cohort (commit/tree/SKILL.md sha256/pack) and re-syncs mcp/skills/SKILL.md; then MCP 2.11.3 is published.

Linked surfaces

• SDK / MCP: companion PR in AiFinPay/sdk (MCP 2.11.3 + agent 2.9.0): payment_setup_status.funding, the same example block and Controls text in the MCP README and tool text, the Codex framework.
• Backend (framework whitelist codex): follow-up PR in aifinpay-web.
• Dashboard (Controls is the referenced surface; the codex label): dashboard pass-4 PR.
• Docs (AiFinPay/docs agent guide: funding at today's rate, Controls vs env ceiling): follow-up.
• Site: not affected — no install or discovery text changed.