MCP tool name approved by elicitation.
Canonical digest of the approved destructive target.
Work to execute with consent installed.
The callback result.
The consent is scoped to the exact tool name and canonical target-argument digest. The inner handler still calls checkDestructive; this context simply tells the gate that human approval was already validated by the shared wrapper.
Run a callback with wrapper-validated destructive elicitation consent.