diff --git a/docs/testing/skip-inventory.md b/docs/testing/skip-inventory.md
index 4c4370b..36b0e5e 100644
--- a/docs/testing/skip-inventory.md
+++ b/docs/testing/skip-inventory.md
@@ -114,7 +114,7 @@ Re-run inventory with: `./scripts/skip-inventory.sh`.
 
 ### `internal/ciparity`
 
-- `internal/ciparity/surface_parity_test.go:97` — // readFileOrSkip reads a file; on ENOENT, calls t.Skipf rather than
+- `internal/ciparity/surface_parity_test.go:113` — // readFileOrSkip reads a file; on ENOENT, calls t.Skipf rather than
 
 ### `internal/connector/issuer/acme`
 
diff --git a/internal/ciparity/surface_parity_test.go b/internal/ciparity/surface_parity_test.go
index 1a30ed4..dd2c909 100644
--- a/internal/ciparity/surface_parity_test.go
+++ b/internal/ciparity/surface_parity_test.go
@@ -64,14 +64,30 @@ var (
 
 // mcpToolFiles lists the (non-test) Go files expected to register
 // MCP tools.
+//
+// Phase 9 Sprint 10 (commit fbe053aa, 2026-05-14): tools.go was split
+// into six tool-domain sibling files in the same `mcp` package
+// (tools_certificates.go + tools_agents.go + tools_resources.go +
+// tools_jobs.go + tools_discovery.go + tools_admin.go). Original
+// tools.go now holds only the RegisterTools dispatcher + Bundle-3
+// fence wrappers + paginationQuery helper — zero mcp.AddTool calls.
+// This list is the union of pre-Sprint-10 + Sprint-10 sibling files.
 func mcpToolFiles(repo string) []string {
 	base := filepath.Join(repo, "internal", "mcp")
 	return []string{
+		// Pre-Sprint-10 catalogue.
 		filepath.Join(base, "tools.go"),
 		filepath.Join(base, "tools_audit_fix.go"),
 		filepath.Join(base, "tools_auth.go"),
 		filepath.Join(base, "tools_auth_bundle2.go"),
 		filepath.Join(base, "tools_est.go"),
+		// Phase 9 Sprint 10 sibling files.
+		filepath.Join(base, "tools_certificates.go"),
+		filepath.Join(base, "tools_agents.go"),
+		filepath.Join(base, "tools_resources.go"),
+		filepath.Join(base, "tools_jobs.go"),
+		filepath.Join(base, "tools_discovery.go"),
+		filepath.Join(base, "tools_admin.go"),
 	}
 }
 
diff --git a/scripts/ci-guards/no-new-synthetic-admin.sh b/scripts/ci-guards/no-new-synthetic-admin.sh
index 782f02e..9dc1571 100755
--- a/scripts/ci-guards/no-new-synthetic-admin.sh
+++ b/scripts/ci-guards/no-new-synthetic-admin.sh
@@ -27,6 +27,7 @@ ALLOWLIST=(
     "./internal/auth/context.go"                     # const DemoAnonActorID source-of-truth (canonical)
     "./internal/auth/middleware.go"                  # NewDemoModeAuth — injects synthetic actor under Type=none
     "./internal/cli/auth_scope_down.go"              # interactive prompt filter
+    "./internal/config/auth.go"                      # Phase 9 Sprint 5 — Auth-family validate-time guard comments + AdminKey wiring narrative (relocated from config.go in commit 51f9cf13; same references, different file)
     "./internal/config/config.go"                    # validate-time guard comments + DemoModeResidualStrict env var
     "./internal/domain/audit.go"                     # audit-event documentation comment
     "./internal/domain/auth/validate.go"             # const DemoAnonActorID mirror