Add the lightweight hash part to the set of hash standards your approved list may draw on, and show for each mechanism whether it draws on it. Where a mechanism clause names only the main hash part, that narrower list still governs, and the new reference does not widen it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.