@bicon/mcp-composer 0.13.1 → 0.17.0

package/dist/index.mjs

@@ -11,9 +11,6 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
-// src/version.ts
-var COMPOSER_VERSION = true ? "0.13.1" : readPackageVersion();
-
 // ../../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -19731,6 +19728,9 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// src/version.ts
+var COMPOSER_VERSION = true ? "0.17.0" : readPackageVersion();
+
 // ../../api-zod/src/generated/api.ts
 var HealthCheckResponse = object({
   "status": string2(),
@@ -19846,7 +19846,7 @@ var ListOrganizationMembersResponseItem = object({
   "email": string2(),
   "displayName": string2().nullable(),
   "role": _enum2(["admin", "member", "viewer"]),
-  "permissions": array(string2()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks, manage_follow_ups.")
+  "permissions": array(string2()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks, manage_follow_ups, manage_quality.")
 });
 var ListOrganizationMembersResponse = array(ListOrganizationMembersResponseItem);
 var SyncOrganizationMembersResponse = object({
@@ -19856,7 +19856,7 @@ var SyncOrganizationMembersResponse = object({
 var GetMyOrganizationAccessResponse = object({
   "userId": string2().describe(`The caller's own local user id (matches AuthorRef.userId on initiatives), so the client can tell its own changes apart from a teammate's \u2014 e.g. to suppress the "updated by X" collaboration banner when an edit echoing back is the caller's own save.`),
   "role": _enum2(["admin", "member", "viewer"]),
-  "permissions": array(string2()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks, manage_follow_ups."),
+  "permissions": array(string2()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks, manage_follow_ups, manage_quality."),
   "initiativeLimit": number2().describe("The most initiatives this organisation may hold, archived ones included. Creating one more answers 507 with code initiative_limit_reached, so the client blocks New, Duplicate and Import up front.")
 });
 var ListOrganizationDirectoryResponseItem = object({
@@ -19868,11 +19868,11 @@ var UpdateOrganizationMemberPermissionsParams = object({
   "userId": guid2()
 });
 var UpdateOrganizationMemberPermissionsBody = object({
-  "permissions": array(string2()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks, manage_follow_ups.")
+  "permissions": array(string2()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks, manage_follow_ups, manage_quality.")
 });
 var UpdateOrganizationMemberPermissionsResponse = object({
   "userId": guid2(),
-  "permissions": array(string2()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks, manage_follow_ups.")
+  "permissions": array(string2()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks, manage_follow_ups, manage_quality.")
 });
 var ListPermissionProfilesResponseItem = object({
   "id": guid2(),
@@ -19986,6 +19986,10 @@ var listSnapshotsResponseInitiativesItemFollowUpsItemDueDateRegExp = new RegExp(
 var listSnapshotsResponseInitiativesItemFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var listSnapshotsResponseInitiativesItemFollowUpsItemNoteMax = 1e4;
 var listSnapshotsResponseInitiativesItemFollowUpsMax = 50;
+var listSnapshotsResponseInitiativesItemQualityFactorsItemStateMax = 5;
+var listSnapshotsResponseInitiativesItemQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listSnapshotsResponseInitiativesItemQualityFactorsItemNoteMax = 2e3;
+var listSnapshotsResponseInitiativesItemQualityFactorsMax = 8;
 var listSnapshotsResponseInitiativesItemDependsOnMax = 1e3;
 var listSnapshotsResponseInitiativesItemRequiredSkillsItemRunFteMin = 0;
 var listSnapshotsResponseInitiativesItemRequiredSkillsMax = 1e3;
@@ -20224,6 +20228,13 @@ var ListSnapshotsResponseItem = object({
       "riskId": string2().optional(),
       "note": string2().max(listSnapshotsResponseInitiativesItemFollowUpsItemNoteMax).optional()
     }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(listSnapshotsResponseInitiativesItemFollowUpsMax).optional(),
+    "qualityFactors": array(object({
+      "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+      "required": _enum2(["low", "medium", "high"]).optional(),
+      "state": number2().min(1).max(listSnapshotsResponseInitiativesItemQualityFactorsItemStateMax).optional(),
+      "targetDate": string2().regex(listSnapshotsResponseInitiativesItemQualityFactorsItemTargetDateRegExp).optional(),
+      "note": string2().max(listSnapshotsResponseInitiativesItemQualityFactorsItemNoteMax).optional()
+    }).describe("The quality of the delivered solution on one factor (docs/quality-factors-concept-2026-10-21.md, after ISO/IEC 25010). One entry per factor; required is how much it matters, state (1-5) how well the solution meets it today. Never part of a score.")).max(listSnapshotsResponseInitiativesItemQualityFactorsMax).optional(),
     "dependsOn": array(string2()).max(listSnapshotsResponseInitiativesItemDependsOnMax),
     "requiredSkills": array(object({
       "skillId": string2(),
@@ -20386,6 +20397,10 @@ var createSnapshotBodyInitiativesItemFollowUpsItemDueDateRegExp = new RegExp("^\
 var createSnapshotBodyInitiativesItemFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var createSnapshotBodyInitiativesItemFollowUpsItemNoteMax = 1e4;
 var createSnapshotBodyInitiativesItemFollowUpsMax = 50;
+var createSnapshotBodyInitiativesItemQualityFactorsItemStateMax = 5;
+var createSnapshotBodyInitiativesItemQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createSnapshotBodyInitiativesItemQualityFactorsItemNoteMax = 2e3;
+var createSnapshotBodyInitiativesItemQualityFactorsMax = 8;
 var createSnapshotBodyInitiativesItemDependsOnMax = 1e3;
 var createSnapshotBodyInitiativesItemRequiredSkillsItemRunFteMin = 0;
 var createSnapshotBodyInitiativesItemRequiredSkillsMax = 1e3;
@@ -20624,6 +20639,13 @@ var CreateSnapshotBody = object({
       "riskId": string2().optional(),
       "note": string2().max(createSnapshotBodyInitiativesItemFollowUpsItemNoteMax).optional()
     }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(createSnapshotBodyInitiativesItemFollowUpsMax).optional(),
+    "qualityFactors": array(object({
+      "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+      "required": _enum2(["low", "medium", "high"]).optional(),
+      "state": number2().min(1).max(createSnapshotBodyInitiativesItemQualityFactorsItemStateMax).optional(),
+      "targetDate": string2().regex(createSnapshotBodyInitiativesItemQualityFactorsItemTargetDateRegExp).optional(),
+      "note": string2().max(createSnapshotBodyInitiativesItemQualityFactorsItemNoteMax).optional()
+    }).describe("The quality of the delivered solution on one factor (docs/quality-factors-concept-2026-10-21.md, after ISO/IEC 25010). One entry per factor; required is how much it matters, state (1-5) how well the solution meets it today. Never part of a score.")).max(createSnapshotBodyInitiativesItemQualityFactorsMax).optional(),
     "dependsOn": array(string2()).max(createSnapshotBodyInitiativesItemDependsOnMax),
     "requiredSkills": array(object({
       "skillId": string2(),
@@ -20792,6 +20814,10 @@ var renameSnapshotResponseInitiativesItemFollowUpsItemDueDateRegExp = new RegExp
 var renameSnapshotResponseInitiativesItemFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var renameSnapshotResponseInitiativesItemFollowUpsItemNoteMax = 1e4;
 var renameSnapshotResponseInitiativesItemFollowUpsMax = 50;
+var renameSnapshotResponseInitiativesItemQualityFactorsItemStateMax = 5;
+var renameSnapshotResponseInitiativesItemQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var renameSnapshotResponseInitiativesItemQualityFactorsItemNoteMax = 2e3;
+var renameSnapshotResponseInitiativesItemQualityFactorsMax = 8;
 var renameSnapshotResponseInitiativesItemDependsOnMax = 1e3;
 var renameSnapshotResponseInitiativesItemRequiredSkillsItemRunFteMin = 0;
 var renameSnapshotResponseInitiativesItemRequiredSkillsMax = 1e3;
@@ -21030,6 +21056,13 @@ var RenameSnapshotResponse = object({
       "riskId": string2().optional(),
       "note": string2().max(renameSnapshotResponseInitiativesItemFollowUpsItemNoteMax).optional()
     }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(renameSnapshotResponseInitiativesItemFollowUpsMax).optional(),
+    "qualityFactors": array(object({
+      "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+      "required": _enum2(["low", "medium", "high"]).optional(),
+      "state": number2().min(1).max(renameSnapshotResponseInitiativesItemQualityFactorsItemStateMax).optional(),
+      "targetDate": string2().regex(renameSnapshotResponseInitiativesItemQualityFactorsItemTargetDateRegExp).optional(),
+      "note": string2().max(renameSnapshotResponseInitiativesItemQualityFactorsItemNoteMax).optional()
+    }).describe("The quality of the delivered solution on one factor (docs/quality-factors-concept-2026-10-21.md, after ISO/IEC 25010). One entry per factor; required is how much it matters, state (1-5) how well the solution meets it today. Never part of a score.")).max(renameSnapshotResponseInitiativesItemQualityFactorsMax).optional(),
     "dependsOn": array(string2()).max(renameSnapshotResponseInitiativesItemDependsOnMax),
     "requiredSkills": array(object({
       "skillId": string2(),
@@ -21193,6 +21226,10 @@ var listInitiativesResponseFollowUpsItemDueDateRegExp = new RegExp("^\\d{4}-\\d{
 var listInitiativesResponseFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var listInitiativesResponseFollowUpsItemNoteMax = 1e4;
 var listInitiativesResponseFollowUpsMax = 50;
+var listInitiativesResponseQualityFactorsItemStateMax = 5;
+var listInitiativesResponseQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listInitiativesResponseQualityFactorsItemNoteMax = 2e3;
+var listInitiativesResponseQualityFactorsMax = 8;
 var listInitiativesResponseDependsOnMax = 1e3;
 var listInitiativesResponseRequiredSkillsItemRunFteMin = 0;
 var listInitiativesResponseRequiredSkillsMax = 1e3;
@@ -21425,6 +21462,13 @@ var ListInitiativesResponseItem = object({
     "riskId": string2().optional(),
     "note": string2().max(listInitiativesResponseFollowUpsItemNoteMax).optional()
   }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(listInitiativesResponseFollowUpsMax).optional(),
+  "qualityFactors": array(object({
+    "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+    "required": _enum2(["low", "medium", "high"]).optional(),
+    "state": number2().min(1).max(listInitiativesResponseQualityFactorsItemStateMax).optional(),
+    "targetDate": string2().regex(listInitiativesResponseQualityFactorsItemTargetDateRegExp).optional(),
+    "note": string2().max(listInitiativesResponseQualityFactorsItemNoteMax).optional()
+  }).describe("The quality of the delivered solution on one factor (docs/quality-factors-concept-2026-10-21.md, after ISO/IEC 25010). One entry per factor; required is how much it matters, state (1-5) how well the solution meets it today. Never part of a score.")).max(listInitiativesResponseQualityFactorsMax).optional(),
   "dependsOn": array(string2()).max(listInitiativesResponseDependsOnMax),
   "requiredSkills": array(object({
     "skillId": string2(),
@@ -21584,6 +21628,10 @@ var createInitiativeBodyOneFollowUpsItemDueDateRegExp = new RegExp("^\\d{4}-\\d{
 var createInitiativeBodyOneFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var createInitiativeBodyOneFollowUpsItemNoteMax = 1e4;
 var createInitiativeBodyOneFollowUpsMax = 50;
+var createInitiativeBodyOneQualityFactorsItemStateMax = 5;
+var createInitiativeBodyOneQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createInitiativeBodyOneQualityFactorsItemNoteMax = 2e3;
+var createInitiativeBodyOneQualityFactorsMax = 8;
 var createInitiativeBodyOneDependsOnMax = 1e3;
 var createInitiativeBodyOneRequiredSkillsItemRunFteMin = 0;
 var createInitiativeBodyOneRequiredSkillsMax = 1e3;
@@ -21816,6 +21864,13 @@ var CreateInitiativeBody = object({
     "riskId": string2().optional(),
     "note": string2().max(createInitiativeBodyOneFollowUpsItemNoteMax).optional()
   }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(createInitiativeBodyOneFollowUpsMax).optional(),
+  "qualityFactors": array(object({
+    "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+    "required": _enum2(["low", "medium", "high"]).optional(),
+    "state": number2().min(1).max(createInitiativeBodyOneQualityFactorsItemStateMax).optional(),
+    "targetDate": string2().regex(createInitiativeBodyOneQualityFactorsItemTargetDateRegExp).optional(),
+    "note": string2().max(createInitiativeBodyOneQualityFactorsItemNoteMax).optional()
+  }).describe("The quality of the delivered solution on one factor (docs/quality-factors-concept-2026-10-21.md, after ISO/IEC 25010). One entry per factor; required is how much it matters, state (1-5) how well the solution meets it today. Never part of a score.")).max(createInitiativeBodyOneQualityFactorsMax).optional(),
   "dependsOn": array(string2()).max(createInitiativeBodyOneDependsOnMax),
   "requiredSkills": array(object({
     "skillId": string2(),
@@ -21985,6 +22040,10 @@ var getInitiativeResponseFollowUpsItemDueDateRegExp = new RegExp("^\\d{4}-\\d{2}
 var getInitiativeResponseFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var getInitiativeResponseFollowUpsItemNoteMax = 1e4;
 var getInitiativeResponseFollowUpsMax = 50;
+var getInitiativeResponseQualityFactorsItemStateMax = 5;
+var getInitiativeResponseQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var getInitiativeResponseQualityFactorsItemNoteMax = 2e3;
+var getInitiativeResponseQualityFactorsMax = 8;
 var getInitiativeResponseDependsOnMax = 1e3;
 var getInitiativeResponseRequiredSkillsItemRunFteMin = 0;
 var getInitiativeResponseRequiredSkillsMax = 1e3;
@@ -22217,6 +22276,13 @@ var GetInitiativeResponse = object({
     "riskId": string2().optional(),
     "note": string2().max(getInitiativeResponseFollowUpsItemNoteMax).optional()
   }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(getInitiativeResponseFollowUpsMax).optional(),
+  "qualityFactors": array(object({
+    "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+    "required": _enum2(["low", "medium", "high"]).optional(),
+    "state": number2().min(1).max(getInitiativeResponseQualityFactorsItemStateMax).optional(),
+    "targetDate": string2().regex(getInitiativeResponseQualityFactorsItemTargetDateRegExp).optional(),
+    "note": string2().max(getInitiativeResponseQualityFactorsItemNoteMax).optional()
+  }).describe("The quality of the delivered solution on one factor (docs/quality-factors-concept-2026-10-21.md, after ISO/IEC 25010). One entry per factor; required is how much it matters, state (1-5) how well the solution meets it today. Never part of a score.")).max(getInitiativeResponseQualityFactorsMax).optional(),
   "dependsOn": array(string2()).max(getInitiativeResponseDependsOnMax),
   "requiredSkills": array(object({
     "skillId": string2(),
@@ -22378,6 +22444,10 @@ var updateInitiativeBodyOneFollowUpsItemDueDateRegExp = new RegExp("^\\d{4}-\\d{
 var updateInitiativeBodyOneFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var updateInitiativeBodyOneFollowUpsItemNoteMax = 1e4;
 var updateInitiativeBodyOneFollowUpsMax = 50;
+var updateInitiativeBodyOneQualityFactorsItemStateMax = 5;
+var updateInitiativeBodyOneQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeBodyOneQualityFactorsItemNoteMax = 2e3;
+var updateInitiativeBodyOneQualityFactorsMax = 8;
 var updateInitiativeBodyOneDependsOnMax = 1e3;
 var updateInitiativeBodyOneRequiredSkillsItemRunFteMin = 0;
 var updateInitiativeBodyOneRequiredSkillsMax = 1e3;
@@ -22610,6 +22680,13 @@ var UpdateInitiativeBody = object({
     "riskId": string2().optional(),
     "note": string2().max(updateInitiativeBodyOneFollowUpsItemNoteMax).optional()
   }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(updateInitiativeBodyOneFollowUpsMax).optional(),
+  "qualityFactors": array(object({
+    "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+    "required": _enum2(["low", "medium", "high"]).optional(),
+    "state": number2().min(1).max(updateInitiativeBodyOneQualityFactorsItemStateMax).optional(),
+    "targetDate": string2().regex(updateInitiativeBodyOneQualityFactorsItemTargetDateRegExp).optional(),
+    "note": string2().max(updateInitiativeBodyOneQualityFactorsItemNoteMax).optional()
+  }).describe("The quality of the delivered solution on one factor (docs/quality-factors-concept-2026-10-21.md, after ISO/IEC 25010). One entry per factor; required is how much it matters, state (1-5) how well the solution meets it today. Never part of a score.")).max(updateInitiativeBodyOneQualityFactorsMax).optional(),
   "dependsOn": array(string2()).max(updateInitiativeBodyOneDependsOnMax),
   "requiredSkills": array(object({
     "skillId": string2(),
@@ -22776,6 +22853,10 @@ var updateInitiativeResponseFollowUpsItemDueDateRegExp = new RegExp("^\\d{4}-\\d
 var updateInitiativeResponseFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var updateInitiativeResponseFollowUpsItemNoteMax = 1e4;
 var updateInitiativeResponseFollowUpsMax = 50;
+var updateInitiativeResponseQualityFactorsItemStateMax = 5;
+var updateInitiativeResponseQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeResponseQualityFactorsItemNoteMax = 2e3;
+var updateInitiativeResponseQualityFactorsMax = 8;
 var updateInitiativeResponseDependsOnMax = 1e3;
 var updateInitiativeResponseRequiredSkillsItemRunFteMin = 0;
 var updateInitiativeResponseRequiredSkillsMax = 1e3;
@@ -23008,6 +23089,13 @@ var UpdateInitiativeResponse = object({
     "riskId": string2().optional(),
     "note": string2().max(updateInitiativeResponseFollowUpsItemNoteMax).optional()
   }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(updateInitiativeResponseFollowUpsMax).optional(),
+  "qualityFactors": array(object({
+    "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+    "required": _enum2(["low", "medium", "high"]).optional(),
+    "state": number2().min(1).max(updateInitiativeResponseQualityFactorsItemStateMax).optional(),
+    "targetDate": string2().regex(updateInitiativeResponseQualityFactorsItemTargetDateRegExp).optional(),
+    "note": string2().max(updateInitiativeResponseQualityFactorsItemNoteMax).optional()
+  }).describe("The quality of the delivered solution on one factor (docs/quality-factors-concept-2026-10-21.md, after ISO/IEC 25010). One entry per factor; required is how much it matters, state (1-5) how well the solution meets it today. Never part of a score.")).max(updateInitiativeResponseQualityFactorsMax).optional(),
   "dependsOn": array(string2()).max(updateInitiativeResponseDependsOnMax),
   "requiredSkills": array(object({
     "skillId": string2(),
@@ -23286,6 +23374,17 @@ var RISK_CATEGORIES = [
 var RISK_STATUSES = ["open", "mitigating", "closed", "occurred"];
 var MAX_RISKS_PER_INITIATIVE = 50;
 var MAX_FOLLOW_UPS_PER_INITIATIVE = 50;
+var QUALITY_FACTORS = [
+  "reliability",
+  "security",
+  "safety",
+  "performance",
+  "usability",
+  "maintainability",
+  "compatibility",
+  "dataQuality"
+];
+var QUALITY_REQUIRED_LEVELS = ["low", "medium", "high"];
 var GATE_TRANSITIONS = [
   { key: "idea-pilot", from: "Idea", to: "Pilot" },
   { key: "pilot-scaling", from: "Pilot", to: "Scaling" },
@@ -23617,7 +23716,16 @@ var EN_DIGITAL = {
   "method.audit.scope.governance": "<strong>Status</strong> and the four <strong>evaluation dimension scores</strong> (Value, Delivery Feasibility, Compliance &amp; Operational Risk, Strategic Impact) with their confidence.",
   "method.audit.scope.metadata": "<strong>All Core Metadata fields</strong> \u2014 name, business unit, owner, description, timeline, budget, vendor strategy, solution type, digital category and tags.",
   "method.gates.enforced.intro": "Two governance fields are enforced as hard checks when the lifecycle status changes \u2014 active because the EU AI Act module is enabled for this workspace:",
-  "method.gates.enforced.scope": "Both checks feed the EU AI Act readiness score in addition to the hard block."
+  "method.gates.enforced.scope": "Both checks feed the EU AI Act readiness score in addition to the hard block.",
+  // Quality factor help (docs/quality-factors-concept-2026-10-21.md).
+  "quality.factor.reliability.help": "Does the service stay up and behave correctly? Availability against the agreed SLA, incident rate, recovery time after an outage, batch and job success.",
+  "quality.factor.security.help": "Is the platform protected? Access control and roles, protection of customer data, secure interfaces, pen test or security review done, findings closed.",
+  "quality.factor.safety.help": "Can it cause harm when it fails? Safety-critical processes it touches (payments, physical operations, client advice), fail-safe behaviour and a manual fallback, hazard or impact analysis done, safety incidents.",
+  "quality.factor.performance.help": "Is it fast enough at peak load? Page and API response times, throughput at month-end or campaign peaks, headroom to grow.",
+  "quality.factor.usability.help": "Can customers and staff use it without help? Task completion, adoption, accessibility, number of support calls.",
+  "quality.factor.maintainability.help": "Can the team change and run it safely? Code quality, automated tests and deployment, documentation, technical debt, dependency on single experts.",
+  "quality.factor.compatibility.help": "Does it fit the landscape? Interfaces to core and neighbouring systems, standards (APIs, formats), vendor lock-in.",
+  "quality.factor.dataQuality.help": "Is the data the service uses fit for purpose? Accuracy, completeness, timeliness and lineage of master and transaction data (ISO/IEC 25012). The Data & Process Quality slider rates feasibility before delivery; this rates the delivered state."
 };
 var DE_DIGITAL = {
   "brand.app": "BICon Portfolio Steering",
@@ -23827,7 +23935,16 @@ var DE_DIGITAL = {
   "method.audit.scope.governance": "<strong>Status</strong> und die vier <strong>Bewertungsdimensions-Scores</strong> (Wert, Liefer-Machbarkeit, Compliance &amp; Betriebsrisiko, Strategischer Impact) mit ihrer Konfidenz.",
   "method.audit.scope.metadata": "<strong>Alle Kern-Metadatenfelder</strong> \u2014 Name, Gesch\xE4ftseinheit, Verantwortliche, Beschreibung, Zeitplan, Budget, Anbieterstrategie, L\xF6sungstyp, Digital-Kategorie und Tags.",
   "method.gates.enforced.intro": "Zwei Governance-Felder werden beim Wechsel des Lebenszyklus-Status als harte Pr\xFCfungen erzwungen \u2014 aktiv, weil das EU-AI-Act-Modul f\xFCr diesen Arbeitsbereich aktiviert ist:",
-  "method.gates.enforced.scope": "Beide Pr\xFCfungen fliessen zus\xE4tzlich zum harten Block in den EU-AI-Act-Reifegrad ein."
+  "method.gates.enforced.scope": "Beide Pr\xFCfungen fliessen zus\xE4tzlich zum harten Block in den EU-AI-Act-Reifegrad ein.",
+  // Quality factor help (docs/quality-factors-concept-2026-10-21.md).
+  "quality.factor.reliability.help": "Bleibt der Dienst verf\xFCgbar und arbeitet korrekt? Verf\xFCgbarkeit gegen\xFCber dem vereinbarten SLA, St\xF6rungsrate, Wiederherstellungszeit nach Ausf\xE4llen, Erfolg von Batches und Jobs.",
+  "quality.factor.security.help": "Ist die Plattform gesch\xFCtzt? Zugriffsschutz und Rollen, Schutz der Kundendaten, sichere Schnittstellen, Pentest oder Sicherheitspr\xFCfung erfolgt, Befunde behoben.",
+  "quality.factor.safety.help": "Kann es bei einem Fehler Schaden anrichten? Sicherheitskritische Abl\xE4ufe, die es ber\xFChrt (Zahlungen, physische Abl\xE4ufe, Kundenberatung), ausfallsicheres Verhalten und ein manueller R\xFCckfall, Gef\xE4hrdungs- oder Auswirkungsanalyse erfolgt, Vorf\xE4lle mit Personen- oder Sachschaden.",
+  "quality.factor.performance.help": "Ist es bei Spitzenlast schnell genug? Antwortzeiten von Seiten und APIs, Durchsatz am Monatsende oder bei Kampagnen, Reserve f\xFCr Wachstum.",
+  "quality.factor.usability.help": "K\xF6nnen Kundinnen, Kunden und Mitarbeitende es ohne Hilfe nutzen? Aufgabenerfolg, Akzeptanz, Barrierefreiheit, Zahl der Supportanfragen.",
+  "quality.factor.maintainability.help": "Kann das Team es sicher \xE4ndern und betreiben? Codequalit\xE4t, automatisierte Tests und Deployments, Dokumentation, technische Schulden, Abh\xE4ngigkeit von einzelnen Fachleuten.",
+  "quality.factor.compatibility.help": "Passt es in die Landschaft? Schnittstellen zu Kern- und Nachbarsystemen, Standards (APIs, Formate), Anbieterabh\xE4ngigkeit.",
+  "quality.factor.dataQuality.help": "Sind die Daten, die der Dienst nutzt, f\xFCr den Zweck geeignet? Richtigkeit, Vollst\xE4ndigkeit, Aktualit\xE4t und Herkunft von Stamm- und Bewegungsdaten (ISO/IEC 25012). Der Schieberegler Daten- und Prozessqualit\xE4t bewertet die Machbarkeit vor der Lieferung; hier wird der gelieferte Stand bewertet."
 };
 var EN_INNOVATION = {
   "brand.app": "BICon Portfolio Steering",
@@ -24091,7 +24208,29 @@ var EN_INNOVATION = {
   "method.audit.scope.governance": "<strong>Status</strong> and the four <strong>evaluation dimension scores</strong> (Value Potential, Validation &amp; Evidence, Governance &amp; Uncertainty, Strategic Impact) with their confidence.",
   "method.audit.scope.metadata": "<strong>All Core Metadata fields</strong> \u2014 name, business unit, owner, description, timeline, budget, partner strategy, solution type, innovation category and tags.",
   "method.gates.enforced.intro": "Two governance fields are enforced as hard checks when the lifecycle status changes \u2014 active because the EU AI Act module is enabled for this workspace:",
-  "method.gates.enforced.scope": "Both checks feed the EU AI Act readiness score in addition to the hard block."
+  "method.gates.enforced.scope": "Both checks feed the EU AI Act readiness score in addition to the hard block.",
+  // Quality factor help (docs/quality-factors-concept-2026-10-21.md).
+  "quality.factor.reliability.help": "Does the prototype or pilot work reliably enough for the next stage? Repeatable results, uptime during the trial, known failure modes.",
+  "quality.factor.security.help": "Is what the pilot handles protected? Access to lab and trial data, protection of IP, a security review before real users or data come in.",
+  "quality.factor.safety.help": "Is it safe for the people and the environment it reaches? Hazard and risk analysis (e.g. ISO 14971 for medical devices), safety testing in the trial, adverse events, what must be shown before the next stage.",
+  "quality.factor.performance.help": "Will it hold at the next stage's scale? Throughput and cost per unit at pilot volume, a credible path to production volume. Often still Low required before Pilot.",
+  "quality.factor.usability.help": "Can the intended users work with it? Feedback from trial users, task success, what must change before roll-out.",
+  "quality.factor.maintainability.help": "Can the work be handed over? Someone other than the inventors can run and change it: documentation, a reproducible build or protocol, technical debt taken on for speed, no single expert. Often still Low required before Pilot.",
+  "quality.factor.compatibility.help": "Does it fit the operation that takes it over? Interfaces to lab, clinical, production or partner systems and their processes, standards, lock-in to a partner.",
+  "quality.factor.dataQuality.help": "Is the data behind the results fit for purpose? Accuracy, completeness and lineage of experimental and trial data (ISO/IEC 25012). The Quality of Evidence slider rates feasibility before delivery; this rates the delivered state.",
+  // R&D labels for the same factor keys (docs/quality-factors-innovation-concept-2026-10-25.md):
+  // the stored keys stay, so ratings survive a mode switch.
+  "quality.factor.reliability": "Robustness and reproducibility",
+  "quality.factor.security": "Security and IP protection",
+  "quality.factor.safety": "Product safety",
+  "quality.factor.performance": "Scale-up and unit cost",
+  "quality.factor.usability": "User acceptance",
+  "quality.factor.maintainability": "Transferability",
+  "quality.factor.compatibility": "Fit with operations",
+  "quality.factor.dataQuality": "Data and result quality",
+  "evaluate.quality.subtitle": "Is the result solid enough for the next stage? Rate each factor that matters: how much it is required here, and how well the result meets it today. Factors after ISO/IEC 25010, adapted for R&D. The ratings flag gaps; they do not change any score.",
+  "evaluate.quality.notePlaceholder": "e.g. results repeated at 2 sites; transfer protocol v1",
+  "method.qf.what": "Each initiative can rate eight <strong>quality factors</strong> of the result it delivers, after the product-quality model of ISO/IEC 25010:2023, adapted for R&amp;D: robustness and reproducibility, security and IP protection, product safety, scale-up and unit cost, user acceptance, transferability, fit with operations, and data and result quality (ISO/IEC 25012). The factors are the same in every mode; labels and help texts follow the mode, so ratings survive a mode switch."
 };
 var DE_INNOVATION = {
   "brand.app": "BICon Portfolio Steering",
@@ -24355,7 +24494,28 @@ var DE_INNOVATION = {
   "method.audit.scope.governance": "<strong>Status</strong> und die vier <strong>Bewertungsdimensions-Scores</strong> (Wertpotenzial, Validierung &amp; Evidenz, Governance &amp; Unsicherheit, Strategischer Impact) mit ihrer Konfidenz.",
   "method.audit.scope.metadata": "<strong>Alle Kern-Metadatenfelder</strong> \u2014 Name, Gesch\xE4ftseinheit, Verantwortliche, Beschreibung, Zeitplan, Budget, Partnerstrategie, L\xF6sungstyp, Innovations-Kategorie und Tags.",
   "method.gates.enforced.intro": "Zwei Governance-Felder werden beim Wechsel des Lebenszyklus-Status als harte Pr\xFCfungen erzwungen \u2014 aktiv, weil das EU-AI-Act-Modul f\xFCr diesen Arbeitsbereich aktiviert ist:",
-  "method.gates.enforced.scope": "Beide Pr\xFCfungen fliessen zus\xE4tzlich zum harten Block in den EU-AI-Act-Reifegrad ein."
+  "method.gates.enforced.scope": "Beide Pr\xFCfungen fliessen zus\xE4tzlich zum harten Block in den EU-AI-Act-Reifegrad ein.",
+  // Quality factor help (docs/quality-factors-concept-2026-10-21.md).
+  "quality.factor.reliability.help": "Funktioniert der Prototyp oder Pilot zuverl\xE4ssig genug f\xFCr die n\xE4chste Stufe? Wiederholbare Ergebnisse, Verf\xFCgbarkeit w\xE4hrend des Versuchs, bekannte Fehlerbilder.",
+  "quality.factor.security.help": "Ist gesch\xFCtzt, was der Pilot verarbeitet? Zugriff auf Labor- und Versuchsdaten, Schutz des geistigen Eigentums, Sicherheitspr\xFCfung, bevor echte Nutzer oder Daten dazukommen.",
+  "quality.factor.safety.help": "Ist es sicher f\xFCr die Menschen und die Umwelt, die es erreicht? Gef\xE4hrdungs- und Risikoanalyse (z. B. ISO 14971 f\xFCr Medizinprodukte), Sicherheitstests im Versuch, unerw\xFCnschte Ereignisse, was vor der n\xE4chsten Stufe nachgewiesen sein muss.",
+  "quality.factor.performance.help": "H\xE4lt es im Massstab der n\xE4chsten Stufe? Durchsatz und St\xFCckkosten im Pilotvolumen, ein glaubw\xFCrdiger Weg zum Produktionsvolumen. Vor dem Pilot oft noch niedrig gefordert.",
+  "quality.factor.usability.help": "K\xF6nnen die vorgesehenen Nutzerinnen und Nutzer damit arbeiten? R\xFCckmeldungen aus dem Versuch, Aufgabenerfolg, was vor dem Rollout \xE4ndern muss.",
+  "quality.factor.maintainability.help": "L\xE4sst sich die Arbeit \xFCbergeben? Jemand ausser den Erfinderinnen und Erfindern kann das Ergebnis betreiben und \xE4ndern: Dokumentation, reproduzierbarer Aufbau oder reproduzierbares Protokoll, technische Schulden zugunsten der Geschwindigkeit, keine Abh\xE4ngigkeit von einzelnen Fachleuten. Vor dem Pilot oft noch niedrig gefordert.",
+  "quality.factor.compatibility.help": "Passt es in den Betrieb, der es \xFCbernimmt? Schnittstellen zu Labor-, Klinik-, Produktions- oder Partnersystemen und deren Abl\xE4ufen, Standards, Abh\xE4ngigkeit von einem Partner.",
+  "quality.factor.dataQuality.help": "Sind die Daten hinter den Ergebnissen f\xFCr den Zweck geeignet? Richtigkeit, Vollst\xE4ndigkeit und Herkunft der Versuchs- und Testdaten (ISO/IEC 25012). Der Schieberegler Qualit\xE4t der Evidenz bewertet die Machbarkeit vor der Lieferung; hier wird der gelieferte Stand bewertet.",
+  // F&E-Bezeichnungen für dieselben Faktorschlüssel (docs/quality-factors-innovation-concept-2026-10-25.md).
+  "quality.factor.reliability": "Robustheit und Reproduzierbarkeit",
+  "quality.factor.security": "Informationssicherheit und Schutz geistigen Eigentums",
+  "quality.factor.safety": "Produktsicherheit",
+  "quality.factor.performance": "Hochskalierung und St\xFCckkosten",
+  "quality.factor.usability": "Nutzerakzeptanz",
+  "quality.factor.maintainability": "\xDCbertragbarkeit",
+  "quality.factor.compatibility": "Integration in den Betrieb",
+  "quality.factor.dataQuality": "Daten- und Ergebnisqualit\xE4t",
+  "evaluate.quality.subtitle": "Ist das Ergebnis solide genug f\xFCr die n\xE4chste Stufe? Bewerten Sie jeden Faktor, der z\xE4hlt: wie stark er hier gefordert ist und wie gut das Ergebnis ihn heute erf\xFCllt. Faktoren nach ISO/IEC 25010, ausgelegt f\xFCr F&E. Die Bewertung zeigt L\xFCcken; sie ver\xE4ndert keinen Score.",
+  "evaluate.quality.notePlaceholder": "z. B. Ergebnisse an 2 Standorten wiederholt; Transferprotokoll v1",
+  "method.qf.what": "Jede Initiative kann acht <strong>Qualit\xE4tsfaktoren</strong> des gelieferten Ergebnisses bewerten, nach dem Produktqualit\xE4tsmodell der ISO/IEC 25010:2023, f\xFCr F&amp;E ausgelegt: Robustheit und Reproduzierbarkeit, Informationssicherheit und Schutz geistigen Eigentums, Produktsicherheit, Hochskalierung und St\xFCckkosten, Nutzerakzeptanz, \xDCbertragbarkeit, Integration in den Betrieb sowie Daten- und Ergebnisqualit\xE4t (ISO/IEC 25012). Die Faktoren sind in jedem Modus gleich; Bezeichnungen und Hilfetexte folgen dem Modus, die Bewertungen bleiben bei einem Moduswechsel erhalten."
 };
 var DEMO_DIGITAL = {
   "Advisor Copilot": {
@@ -25729,6 +25889,13 @@ var OPTIONAL_SECTIONS = [
       de: "[{title, dueDate, assigneeName?, assigneeUserId?, doneDate?, milestoneId?, riskId?, note?}] \u2014 vereinbarte n\xE4chste Schritte: wer macht was bis wann (h\xF6chstens 50, Titel bis 300 Zeichen). assigneeName ist ein Freitext-Name; assigneeUserId nur, wenn der Benutzer eine Mitglieds-ID aus der App nennt (die App l\xF6scht eine ID, die kein Mitglied ist, der Name bleibt). milestoneId / riskId zeigen auf einen Meilenstein oder ein Risiko derselben Spezifikation \xFCber die dort vergebene id (z. B. \u201Em1\u201C, \u201Er1\u201C); der Composer pr\xE4gt die gespeicherten IDs und beh\xE4lt die Verkn\xFCpfung. Nach den offenen Schritten fragen, besonders je einem pro schwerem Risiko. Bei einem Update alle Pendenzen senden, die bleiben sollen: die Datei ersetzt die Liste."
     }
   },
+  {
+    key: "qualityFactors",
+    hint: {
+      en: "[{factor, required?, state?, targetDate?, note?}] \u2014 is the delivered solution good enough to run? One row per factor that was rated (after ISO/IEC 25010): reliability (availability, stable output), security, safety (harm to people or the environment, fail-safe behaviour), performance (speed, running cost at load), usability, maintainability, compatibility (interfaces, lock-in), dataQuality (the delivered data, not the feasibility slider). In an innovation portfolio the app names them for R&D: reliability = robustness and reproducibility, security = security and IP protection, safety = product safety, performance = scale-up and unit cost, usability = user acceptance, maintainability = transferability, compatibility = fit with operations, dataQuality = data and result quality. required low | medium | high = how much the factor matters here; state 1\u20135 as a whole number (1 unknown or poor, 2 weak, 3 adequate, 4 good, 5 proven in production); targetDate when a gap should be closed; note = evidence or an SLA figure. A gap = required high with state 1\u20132, or required medium with state 1; nothing here changes a score. Ask for the factors that matter once the initiative is at Pilot or later. On an update, send every rating the initiative keeps: the file replaces the list.",
+      de: "[{factor, required?, state?, targetDate?, note?}] \u2014 ist die gelieferte L\xF6sung gut genug f\xFCr den Betrieb? Eine Zeile je bewertetem Faktor (nach ISO/IEC 25010): reliability (Verf\xFCgbarkeit, stabile Ergebnisse), security, safety (Schaden f\xFCr Menschen oder Umwelt, ausfallsicheres Verhalten), performance (Tempo, Betriebskosten unter Last), usability, maintainability, compatibility (Schnittstellen, Anbieterabh\xE4ngigkeit), dataQuality (die gelieferten Daten, nicht der Machbarkeits-Regler). In einem Innovationsportfolio nennt die App sie f\xFCr F&E: reliability = Robustheit und Reproduzierbarkeit, security = Informationssicherheit und Schutz geistigen Eigentums, safety = Produktsicherheit, performance = Hochskalierung und St\xFCckkosten, usability = Nutzerakzeptanz, maintainability = \xDCbertragbarkeit, compatibility = Integration in den Betrieb, dataQuality = Daten- und Ergebnisqualit\xE4t. required low | medium | high = wie stark der Faktor hier z\xE4hlt; state 1\u20135 als ganze Zahl (1 unbekannt oder ungen\xFCgend, 2 schwach, 3 ausreichend, 4 gut, 5 im Betrieb bew\xE4hrt); targetDate, bis wann eine L\xFCcke geschlossen sein soll; note = Nachweis oder SLA-Wert. Eine L\xFCcke = gefordert hoch mit Stand 1\u20132 oder gefordert mittel mit Stand 1; nichts davon \xE4ndert einen Score. Ab Pilot nach den Faktoren fragen, die z\xE4hlen. Bei einem Update alle Bewertungen senden, die bleiben sollen: die Datei ersetzt die Liste."
+    }
+  },
   {
     key: "capabilityImpacts",
     hint: {
@@ -25822,7 +25989,7 @@ function buildSchemaDescriptor(sectionShapes) {
     optionalSections: OPTIONAL_SECTIONS,
     // Exact shapes of the object/array sections (aiAct, economics, actuals,
     // decisionLog, statusReports, requiredSkills, capabilityImpacts,
-    // milestones, risks, followUps). Keys ending in "?" are
+    // milestones, risks, followUps, qualityFactors). Keys ending in "?" are
     // optional; "enum[a|b]" lists the allowed values; "<key>" marks a map.
     // Pass these sections as JSON objects/arrays. Any key not listed is
     // rejected with its path.
@@ -25996,7 +26163,7 @@ var parseIfString = (v) => typeof v === "string" ? tryParseJson(v) : v;
 function wireSection(inner, description) {
   return external_exports.preprocess(parseIfString, deepStrict(inner)).describe(description);
 }
-var SECTION_KEYS = ["aiAct", "economics", "actuals", "decisionLog", "statusReports", "requiredSkills", "capabilityImpacts", "milestones", "risks", "followUps"];
+var SECTION_KEYS = ["aiAct", "economics", "actuals", "decisionLog", "statusReports", "requiredSkills", "capabilityImpacts", "milestones", "risks", "followUps", "qualityFactors"];
 var SECTION_SCHEMAS = Object.fromEntries(
   SECTION_KEYS.map((k) => [k, contractSection(k)])
 );
@@ -26010,6 +26177,7 @@ var SECTION_DESCRIPTIONS = {
   milestones: `Milestones (max 30, title \u2264300 chars): baselineDate = the plan, forecastDate = today's expectation (omit = baseline), doneDate = reached. Dates dd/mm/yyyy or yyyy-mm-dd; ids minted \u2014 an id you give (e.g. "m1") is a label a follow-up's milestoneId can point at. An update replaces the list: send all.`,
   risks: `Risks (max 50, title \u2264300 chars): category delivery|vendor|data|people|regulatory|technical|financial; probability and impact 1\u20135 as whole numbers (score = product); status open|mitigating|closed|occurred (occurred = an issue, with occurredDate); residualProbability + residualImpact = the expectation after mitigation (both or neither); owner (free text), mitigation (the plan), raisedDate, reviewDate, note. Dates dd/mm/yyyy or yyyy-mm-dd; ids minted \u2014 an id you give (e.g. "r1") is a label a follow-up's riskId can point at. An update replaces the list: send all.`,
   followUps: "Follow-ups (max 50, title \u2264300 chars): who does what by when \u2014 title, dueDate, assigneeName (free text; assigneeUserId only when the user gives a member id from the app), doneDate once done, note; milestoneId / riskId = the id label of a milestone or risk in THIS spec (the Composer keeps the link when it mints the stored ids). Dates dd/mm/yyyy or yyyy-mm-dd; ids minted. An update replaces the list: send all.",
+  qualityFactors: "Quality factors of the delivered solution (one row per factor, at most 8): factor reliability|security|safety|performance|usability|maintainability|compatibility|dataQuality; required low|medium|high; state 1\u20135 as a whole number (1 unknown or poor \u2026 5 proven in production); targetDate; note (evidence or SLA). Leave out a factor nobody rated. An update replaces the list: send all.",
   requiredSkills: "Required skills [{skillId, fte, runFte?}] \u2014 fte is the build-phase demand, the optional runFte the run-team demand after the planned end (absent = build fte continues, 0 = no run demand). skillId must be the id of a skill that exists in the organisation. With the portfolio context the Composer validates it (read_portfolio_context \u2192 lists.skills gives id + name); without it, leave the list empty and link skills in the app."
 };
 var contextWire = () => external_exports.preprocess(parseIfString, external_exports.union([external_exports.string().regex(/^ctx_[0-9a-f]{16}$/, "a contextId looks like ctx_<16 hex>"), external_exports.object({}).passthrough()]));
@@ -26059,6 +26227,7 @@ var compactSpecSchema = external_exports.object({
   milestones: wireSection(SECTION_SCHEMAS.milestones, SECTION_DESCRIPTIONS.milestones).optional(),
   risks: wireSection(SECTION_SCHEMAS.risks, SECTION_DESCRIPTIONS.risks).optional(),
   followUps: wireSection(SECTION_SCHEMAS.followUps, SECTION_DESCRIPTIONS.followUps).optional(),
+  qualityFactors: wireSection(SECTION_SCHEMAS.qualityFactors, SECTION_DESCRIPTIONS.qualityFactors).optional(),
   aiRiskTier: external_exports.enum(AI_RISK_TIERS2).optional(),
   hitlPosture: external_exports.enum(HITL_POSTURES2).optional(),
   dpiaStatus: external_exports.enum(DPIA_STATUSES2).optional(),
@@ -26123,6 +26292,181 @@ function initiativeQuadrant(i) {
   );
 }
 
+// ../../initiative-model/src/portfolio-scope.ts
+function isLiveInitiative(i) {
+  return !i.archived && i.status !== "Retired";
+}
+function isInFlightInitiative(i) {
+  return isLiveInitiative(i) && i.status !== "On Hold";
+}
+
+// ../../initiative-model/src/quality.ts
+var QUALITY_NOTE_MAX = 2e3;
+var QUALITY_STATE_MIN = 1;
+var QUALITY_STATE_MAX = 5;
+function isQualityGap(r) {
+  if (r.state === void 0) return false;
+  if (r.required === "high") return r.state <= 2;
+  if (r.required === "medium") return r.state <= 1;
+  return false;
+}
+var REQUIRED_RANK = { high: 0, medium: 1, low: 2 };
+var FACTOR_RANK = new Map(QUALITY_FACTORS.map((f, i) => [f, i]));
+function weaker(a, b) {
+  const ra = a.required ? REQUIRED_RANK[a.required] : 3;
+  const rb = b.required ? REQUIRED_RANK[b.required] : 3;
+  return ra - rb || (a.state ?? 99) - (b.state ?? 99) || (FACTOR_RANK.get(a.factor) ?? 99) - (FACTOR_RANK.get(b.factor) ?? 99);
+}
+function qualityGaps(list) {
+  return (list ?? []).filter(isQualityGap).sort(weaker);
+}
+function summariseQuality(list) {
+  const rows = list ?? [];
+  const gaps = qualityGaps(rows);
+  const withState = rows.filter((r) => r.state !== void 0).sort((a, b) => a.state - b.state || weaker(a, b));
+  return {
+    rated: rows.filter((r) => r.required !== void 0 || r.state !== void 0).length,
+    gaps: gaps.length,
+    weakest: gaps[0] ?? withState[0]
+  };
+}
+var QUALITY_SCALING_STATUSES = ["Scaling", "In Production"];
+function scalingQualityGaps(i) {
+  if (!QUALITY_SCALING_STATUSES.includes(i.status)) return [];
+  return qualityGaps(i.qualityFactors).filter((r) => r.required === "high");
+}
+function hasQualityGaps(i) {
+  return (i.qualityFactors ?? []).some(isQualityGap);
+}
+var BOARD_QUALITY_ROWS = 10;
+var STAGE_RANK = { "In Production": 0, Scaling: 1, Pilot: 2, Idea: 3 };
+function boardQualitySlice(initiatives) {
+  const scope = initiatives.filter((i) => isInFlightInitiative(i) && summariseQuality(i.qualityFactors).rated > 0);
+  if (scope.length === 0) return void 0;
+  const rows = [];
+  const perFactor = /* @__PURE__ */ new Map();
+  let withGaps = 0;
+  let scaling = 0;
+  for (const i of scope) {
+    const gaps = qualityGaps(i.qualityFactors);
+    if (gaps.length === 0) continue;
+    withGaps += 1;
+    if (scalingQualityGaps(i).length > 0) scaling += 1;
+    for (const g of gaps) {
+      perFactor.set(g.factor, (perFactor.get(g.factor) ?? 0) + 1);
+      rows.push({
+        initiativeId: i.id,
+        initiativeName: i.name,
+        status: i.status,
+        factor: g.factor,
+        required: g.required,
+        state: g.state,
+        ...g.targetDate ? { targetDate: g.targetDate } : {}
+      });
+    }
+  }
+  rows.sort((a, b) => REQUIRED_RANK[a.required] - REQUIRED_RANK[b.required] || (STAGE_RANK[a.status] ?? 9) - (STAGE_RANK[b.status] ?? 9) || a.state - b.state || a.initiativeName.localeCompare(b.initiativeName) || (FACTOR_RANK.get(a.factor) ?? 99) - (FACTOR_RANK.get(b.factor) ?? 99));
+  const byFactor = QUALITY_FACTORS.filter((f) => perFactor.has(f)).map((f) => ({ factor: f, initiatives: perFactor.get(f) })).sort((a, b) => b.initiatives - a.initiatives);
+  return {
+    gaps: rows.slice(0, BOARD_QUALITY_ROWS),
+    gapCount: rows.length,
+    ratedInitiativeCount: scope.length,
+    initiativesWithGaps: withGaps,
+    scalingWithGaps: scaling,
+    byFactor
+  };
+}
+function hasContent(r) {
+  return r.required !== void 0 || r.state !== void 0 || !!r.targetDate || !!r.note;
+}
+function canonicalQualityFactors(list) {
+  const byFactor = /* @__PURE__ */ new Map();
+  for (const r of list) if (!byFactor.has(r.factor)) byFactor.set(r.factor, r);
+  return QUALITY_FACTORS.flatMap((factor) => {
+    const r = byFactor.get(factor);
+    if (!r || !hasContent(r)) return [];
+    return [{
+      factor,
+      ...r.required ? { required: r.required } : {},
+      ...r.state !== void 0 ? { state: r.state } : {},
+      ...r.targetDate ? { targetDate: r.targetDate } : {},
+      ...r.note ? { note: r.note } : {}
+    }];
+  });
+}
+var squash = (v) => v.toLowerCase().replace(/[^a-z]/g, "");
+var FACTOR_BY_NAME = new Map(QUALITY_FACTORS.map((f) => [squash(f), f]));
+var REQUIRED_BY_NAME = new Map([
+  ...QUALITY_REQUIRED_LEVELS.map((l) => [l, l]),
+  ["l", "low"],
+  ["m", "medium"],
+  ["h", "high"],
+  ["niedrig", "low"],
+  ["mittel", "medium"],
+  ["hoch", "high"]
+]);
+function stateOf(v) {
+  const n = typeof v === "number" ? v : typeof v === "string" && v.trim() ? Number(v.trim()) : NaN;
+  if (!Number.isFinite(n)) return void 0;
+  const r = Math.round(n);
+  return r >= QUALITY_STATE_MIN && r <= QUALITY_STATE_MAX ? r : void 0;
+}
+function sanitiseQualityFactors(raw, idx, warnings) {
+  if (raw === void 0 || raw === null) return [];
+  if (!Array.isArray(raw)) {
+    warnings.push(`Initiative #${idx + 1} qualityFactors is not an array; skipped.`);
+    return [];
+  }
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  raw.forEach((entry, eIdx) => {
+    if (!entry || typeof entry !== "object") return;
+    const e = entry;
+    const where = `Initiative #${idx + 1} quality factor #${eIdx + 1}`;
+    const factor = typeof e.factor === "string" ? FACTOR_BY_NAME.get(squash(e.factor)) : void 0;
+    if (!factor) {
+      warnings.push(`${where}: factor "${String(e.factor ?? "")}" is unknown (expected ${QUALITY_FACTORS.join(", ")}); skipped.`);
+      return;
+    }
+    const given = (v) => v !== void 0 && v !== null && v !== "";
+    const required2 = typeof e.required === "string" ? REQUIRED_BY_NAME.get(e.required.trim().toLowerCase()) : void 0;
+    if (given(e.required) && !required2) {
+      warnings.push(`${where}: required level "${String(e.required)}" is unknown (expected low, medium or high); cleared.`);
+    }
+    const state = stateOf(e.state);
+    if (given(e.state) && state === void 0) {
+      warnings.push(`${where}: state "${String(e.state)}" is not a whole number from 1 to 5; cleared.`);
+    }
+    let targetDate;
+    if (given(e.targetDate) && typeof e.targetDate !== "string") {
+      warnings.push(`${where}: targetDate is not a date text (use dd/mm/yyyy or yyyy-mm-dd); cleared.`);
+    } else if (typeof e.targetDate === "string" && e.targetDate.trim()) {
+      const d = normaliseDateCell(e.targetDate);
+      if (d && isCalendarDate(d)) targetDate = d;
+      else warnings.push(`${where}: targetDate "${e.targetDate}" is not a recognised date (use dd/mm/yyyy or yyyy-mm-dd); cleared.`);
+    }
+    const note = typeof e.note === "string" && e.note.trim() ? e.note.slice(0, QUALITY_NOTE_MAX) : void 0;
+    if (note && e.note.length > QUALITY_NOTE_MAX) {
+      warnings.push(`${where}: the note is longer than ${QUALITY_NOTE_MAX} characters; cut.`);
+    }
+    const rating = {
+      factor,
+      ...required2 ? { required: required2 } : {},
+      ...state !== void 0 ? { state } : {},
+      ...targetDate ? { targetDate } : {},
+      ...note ? { note } : {}
+    };
+    if (!hasContent(rating)) return;
+    if (seen.has(factor)) {
+      warnings.push(`${where}: ${factor} is rated twice; the later row was dropped.`);
+      return;
+    }
+    seen.add(factor);
+    out.push(rating);
+  });
+  return canonicalQualityFactors(out);
+}
+
 // src/context.ts
 import { createHash } from "node:crypto";
 
@@ -26565,6 +26909,21 @@ function assembleInitiative(input2, now = /* @__PURE__ */ new Date()) {
       warnings.push(`followUps.${i}.assigneeUserId: the Composer cannot verify workspace members, and the app clears an id that is not a member of the workspace \u2014 send assigneeName too, so the follow-up keeps its assignee either way.`);
     }
   }
+  const quality = spec.qualityFactors ?? [];
+  const seenFactors = /* @__PURE__ */ new Set();
+  for (const [i, q] of quality.entries()) {
+    const blankNote = q.note !== void 0 && !q.note.trim();
+    const empty = q.required === void 0 && q.state === void 0 && q.targetDate === void 0 && (q.note === void 0 || blankNote);
+    if (empty) {
+      errors.push(`qualityFactors.${i}: ${q.factor} has nothing set \u2014 the app drops an empty row; leave the factor out.`);
+      continue;
+    }
+    if (seenFactors.has(q.factor)) errors.push(`qualityFactors.${i}.factor: ${q.factor} is rated twice \u2014 send one row per factor.`);
+    seenFactors.add(q.factor);
+    if (q.state !== void 0 && !Number.isInteger(q.state)) errors.push(`qualityFactors.${i}.state: must be a whole number 1\u20135 (got ${q.state}).`);
+    if (q.targetDate !== void 0 && !isCalendarDate(q.targetDate)) errors.push(`qualityFactors.${i}.targetDate: "${q.targetDate}" is not a real calendar date \u2014 dd/mm/yyyy or yyyy-mm-dd`);
+    if (blankNote) errors.push(`qualityFactors.${i}.note: must not be blank \u2014 leave it out instead.`);
+  }
   const norm3 = (v) => (v ?? "").trim().toLowerCase();
   const others = context?.initiatives ?? [];
   const ext = norm3(spec.externalId);
@@ -26579,12 +26938,14 @@ function assembleInitiative(input2, now = /* @__PURE__ */ new Date()) {
     for (const [key, what] of [
       ["milestones", "milestones"],
       ["risks", "risks"],
-      ["followUps", "follow-ups"]
+      ["followUps", "follow-ups"],
+      ["qualityFactors", "quality ratings"]
     ]) {
       if (spec[key] === void 0) {
         warnings.push(`${key}: none sent, and the app will offer this file as an update \u2014 it replaces the initiative's ${what}, so any the app holds are removed. Send the full list to keep them.`);
       }
     }
+    warnings.push("gateEvidence: the Composer cannot carry stage-gate evidence, and the app will offer this file as an update \u2014 it replaces the record, so the initiative's ticked gate items and a gate bypass are cleared. Re-tick them in the app after the import.");
   }
   let businessUnit = spec.businessUnit;
   let aiCategory = spec.aiCategory;
@@ -26657,6 +27018,9 @@ function assembleInitiative(input2, now = /* @__PURE__ */ new Date()) {
     milestones: mintedMilestones,
     risks: mintedRisks,
     followUps: mintedFollowUps,
+    // The order and key order every writer stores (the leaf's canonical form);
+    // the note as typed, as the app and the API keep it.
+    ...spec.qualityFactors !== void 0 ? { qualityFactors: canonicalQualityFactors(spec.qualityFactors) } : {},
     aiAct: aiAct ? { ...aiAct, ...aiAct.incidents ? { incidents: mintNestedIds(aiAct.incidents, stamp, true) } : {} } : void 0,
     createdAt: stamp,
     updatedAt: stamp
@@ -26694,7 +27058,7 @@ var IMPORT_INSTRUCTIONS = [
   "2. In the BICon app (signed in to the target organisation), open Import/Export.",
   "3. If the initiative carries EU-AI-Act data, make sure the organisation's EU-AI-Act module is switched on (Settings \u203A AI Act) \u2014 the app strips AI-Act fields while it is off.",
   "4. In the 'Single initiative' card, drop the file (or Browse).",
-  "5. Review the preview \u2014 it should show 0 warnings \u2014 then choose 'Add as new' (or 'Update' when the file carries an existing initiative's id, Initiative ID or name \u2014 the app keeps that initiative's id and creation date, and REPLACES everything else with this file, decision log, status reports, milestones, risks and follow-ups included) and Confirm.",
+  "5. Review the preview \u2014 it should show 0 warnings \u2014 then choose 'Add as new' (or 'Update' when the file carries an existing initiative's id, Initiative ID or name \u2014 the app keeps that initiative's id and creation date, and REPLACES everything else with this file, decision log, status reports, milestones, risks, follow-ups and quality ratings included) and Confirm.",
   "6. The initiative appears in the Inventory with the derived dimension scores."
 ].join("\n");
 
@@ -27055,7 +27419,6 @@ var RULE_CATEGORY_NAME = {
 };
 var UNCATEGORISED_CATEGORY = "Uncategorised / Tactical";
 var CATEGORY_NAME_MAX = 60;
-var RULES_ORDER_REV = 2;
 var bound = (min, max) => ({
   ...min !== void 0 ? { min } : {},
   ...max !== void 0 ? { max } : {}
@@ -27076,8 +27439,7 @@ var DEFAULT_PRIORITISATION_RULES = {
   names: {},
   checkOrder: [...DEFAULT_CHECK_ORDER],
   fundingOrder: [...DEFAULT_FUNDING_ORDER],
-  weightValueAtStake: false,
-  orderRev: RULES_ORDER_REV
+  weightValueAtStake: false
 };
 var LEGACY_DEFAULTS = {
   quickWins: { v: 60, f: 60, g: 40 },
@@ -27150,28 +27512,23 @@ function sanitiseNames(input2) {
   }
   return out;
 }
-var sameOrder = (a, b) => a.length === b.length && a.every((k, i) => k === b[i]);
 function sanitisePrioritisationRules(input2) {
   const d = DEFAULT_PRIORITISATION_RULES;
   const r = input2 && typeof input2 === "object" ? input2 : {};
   const weightValueAtStake = typeof r.weightValueAtStake === "boolean" ? r.weightValueAtStake : d.weightValueAtStake;
   if (isLegacyShape(r)) {
-    return { categories: migrateLegacy(r), names: {}, checkOrder: [...LEGACY_CHECK_ORDER], fundingOrder: [...DEFAULT_FUNDING_ORDER], weightValueAtStake, orderRev: RULES_ORDER_REV };
+    return { categories: migrateLegacy(r), names: {}, checkOrder: [...LEGACY_CHECK_ORDER], fundingOrder: [...DEFAULT_FUNDING_ORDER], weightValueAtStake };
   }
   const cats = r.categories && typeof r.categories === "object" ? r.categories : {};
   const categories = Object.fromEntries(
     RULE_CATEGORY_KEYS.map((k) => [k, sanitiseCategory(cats[k], d.categories[k])])
   );
-  const names = sanitiseNames(r.names);
-  let checkOrder = sanitiseCategoryOrder(r.checkOrder, DEFAULT_CHECK_ORDER);
-  if (r.orderRev !== RULES_ORDER_REV && sameOrder(checkOrder, LEGACY_CHECK_ORDER) && Object.keys(names).length === 0 && JSON.stringify(categories) === JSON.stringify(d.categories)) checkOrder = [...DEFAULT_CHECK_ORDER];
   return {
     categories,
-    names,
-    checkOrder,
+    names: sanitiseNames(r.names),
+    checkOrder: sanitiseCategoryOrder(r.checkOrder, DEFAULT_CHECK_ORDER),
     fundingOrder: sanitiseCategoryOrder(r.fundingOrder, DEFAULT_FUNDING_ORDER),
-    weightValueAtStake,
-    orderRev: RULES_ORDER_REV
+    weightValueAtStake
   };
 }
 var KEY_BY_NAME = new Map(RULE_CATEGORY_KEYS.map((k) => [RULE_CATEGORY_NAME[k], k]));
@@ -28086,6 +28443,7 @@ function sanitiseInitiative(raw, idx, warnings) {
   const milestones = sanitiseMilestones(o.milestones, idx, warnings);
   const risks = sanitiseRisks(o.risks, idx, warnings);
   const followUps = pruneFollowUpLinks(sanitiseFollowUps(o.followUps, idx, warnings), milestones, risks) ?? [];
+  const qualityFactors = sanitiseQualityFactors(o.qualityFactors, idx, warnings);
   const nowIso = (/* @__PURE__ */ new Date()).toISOString();
   return {
     id,
@@ -28142,6 +28500,7 @@ function sanitiseInitiative(raw, idx, warnings) {
     ...milestones.length > 0 ? { milestones } : {},
     ...risks.length > 0 ? { risks } : {},
     ...followUps.length > 0 ? { followUps } : {},
+    ...qualityFactors.length > 0 ? { qualityFactors } : {},
     dependsOn,
     requiredSkills,
     ...capabilityImpacts.length > 0 ? { capabilityImpacts } : {},
@@ -29608,14 +29967,6 @@ function budgetAmount(i, field = "budget") {
   return typeof v === "number" && Number.isFinite(v) ? Math.max(0, v) : 0;
 }
 
-// ../../initiative-model/src/portfolio-scope.ts
-function isLiveInitiative(i) {
-  return !i.archived && i.status !== "Retired";
-}
-function isInFlightInitiative(i) {
-  return isLiveInitiative(i) && i.status !== "On Hold";
-}
-
 // ../../initiative-model/src/guardrails.ts
 var GUARDRAIL_KEYS = [
   "maxBuBudgetSharePct",
@@ -30169,6 +30520,64 @@ function deriveCapabilityImpact(capabilities, initiatives) {
     linkedInitiativeCount
   };
 }
+function quarterOf(isoDate) {
+  if (!isoDate) return null;
+  const m = /^(\d{4})-(\d{2})/.exec(isoDate);
+  if (!m) return null;
+  const month = Number(m[2]);
+  if (month < 1 || month > 12) return null;
+  return `${m[1]}-Q${Math.floor((month - 1) / 3) + 1}`;
+}
+function maturityTimeline(capabilities, initiatives) {
+  const byId = new Map(capabilities.map((c) => [c.id, c]));
+  const order = /* @__PURE__ */ new Map();
+  const bySort = (a, b) => a.sortOrder - b.sortOrder || a.name.localeCompare(b.name);
+  const domains = capabilities.filter((c) => c.parentId === null).sort(bySort);
+  let n = 0;
+  for (const d of domains) {
+    for (const c of capabilities.filter((x) => x.parentId === d.id).sort(bySort)) order.set(c.id, n++);
+  }
+  const steps = [];
+  for (const i of inScope(initiatives)) {
+    if (!countsAsAchieved(i) && !countsAsPlanned(i)) continue;
+    const best = /* @__PURE__ */ new Map();
+    for (const link of i.capabilityImpacts ?? []) {
+      const cap = byId.get(link.capabilityId);
+      if (!cap || cap.parentId === null || !order.has(cap.id)) continue;
+      const level2 = levelOfImpact(link, cap);
+      const prev = best.get(cap.id);
+      if (!prev || level2 !== null && (prev.level === null || level2 > prev.level)) {
+        best.set(cap.id, { cap, kind: link.kind, level: level2 });
+      }
+    }
+    const achieved = countsAsAchieved(i);
+    const endDate = achieved ? null : isoDay(i.timelineEnd);
+    for (const { cap, kind, level: level2 } of best.values()) {
+      steps.push({
+        capability: cap,
+        domainName: byId.get(cap.parentId)?.name ?? "",
+        initiative: i,
+        kind,
+        level: level2,
+        quarter: achieved ? null : quarterOf(endDate),
+        achieved,
+        endDate
+      });
+    }
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const s of steps) {
+    const key = s.achieved ? "achieved" : s.quarter ?? "undated";
+    (groups.get(key) ?? groups.set(key, []).get(key)).push(s);
+  }
+  const rank = (key) => key === "achieved" ? 0 : key === "undated" ? 2 : 1;
+  return [...groups.entries()].sort(([a], [b]) => rank(a) - rank(b) || a.localeCompare(b)).map(([key, list]) => ({
+    key,
+    steps: list.sort(
+      (a, b) => (order.get(a.capability.id) ?? 0) - (order.get(b.capability.id) ?? 0) || a.initiative.name.localeCompare(b.initiative.name)
+    )
+  }));
+}
 function linkedCapabilityIds(initiative, capabilities) {
   const leafIds = new Set(capabilities.filter((c) => c.parentId !== null).map((c) => c.id));
   const out = [];
@@ -30831,6 +31240,26 @@ function computeBoardActions(input2) {
         });
       }
     }
+    const qualityGaps2 = scalingQualityGaps(i);
+    if (qualityGaps2.length > 0) {
+      const first = qualityGaps2[0];
+      actions.push({
+        id: `qualityGapScaling:${i.id}`,
+        kind: "qualityGapScaling",
+        severity: "medium",
+        href: `/evaluate/${i.id}`,
+        initiativeId: i.id,
+        initiativeName: i.name,
+        params: {
+          count: qualityGaps2.length,
+          factor: first.factor,
+          state: first.state,
+          status: i.status,
+          ...first.targetDate ? { targetDate: first.targetDate } : {}
+        },
+        weight: i.budget || 0
+      });
+    }
     if (i.status === "In Production") {
       if (hasActualsData(i.actuals)) {
         const si = computeSollIst(i.economics, i.actuals);
@@ -31459,6 +31888,7 @@ function applyScope(p, f, now, base) {
     if (f.hasOverdueMilestone !== void 0 && summariseMilestones(i, now).overdue > 0 !== f.hasOverdueMilestone) return false;
     if (f.hasOverdueFollowUp !== void 0 && summariseFollowUps(i.followUps, now).overdue > 0 !== f.hasOverdueFollowUp) return false;
     if (f.hasSevereRisk !== void 0 && summariseRisks(i.risks).severe > 0 !== f.hasSevereRisk) return false;
+    if (f.hasQualityGap !== void 0 && hasQualityGaps(i) !== f.hasQualityGap) return false;
     return true;
   });
   return { items, errors };
@@ -31500,6 +31930,7 @@ var FIELD_NAMES = [
   "nextMilestone",
   "openFollowUps",
   "overdueFollowUps",
+  "qualityGaps",
   "lastStatusReport",
   "capabilities",
   "requiredSkills",
@@ -31592,6 +32023,11 @@ function fieldValue(i, f, c) {
     }
     case "overdueFollowUps":
       return summariseFollowUps(i.followUps, c.now).overdue;
+    case "qualityGaps": {
+      const s = summariseQuality(i.qualityFactors);
+      if (s.rated === 0) return null;
+      return { rated: s.rated, gaps: s.gaps, weakest: s.gaps > 0 && s.weakest?.state !== void 0 ? { factor: s.weakest.factor, state: s.weakest.state } : null };
+    }
     case "lastStatusReport": {
       const r = latestStatusReport(i);
       return r ? { date: r.date, scope: r.scope, timeline: r.timeline, budget: r.budget, skills: r.skills, summary: r.summary ?? null } : null;
@@ -31703,6 +32139,11 @@ function portfolioSummary(p) {
     warnings: p.warnings
   };
 }
+function qualityGapSeverity(i) {
+  const s = summariseQuality(i.qualityFactors);
+  if (s.rated === 0) return null;
+  return s.gaps === 0 ? 0 : s.gaps * 10 + (10 - (s.weakest?.state ?? 1));
+}
 function queryInitiatives(p, q, now = Date.now()) {
   const { items, errors } = applyScope(p, q.filter, now);
   if (errors.length) return { ok: false, errors };
@@ -31712,7 +32153,7 @@ function queryInitiatives(p, q, now = Date.now()) {
   if (q.sortBy) {
     const key = q.sortBy;
     const dir = q.sortDir === "asc" ? 1 : -1;
-    const val = (i) => fieldValue(i, key, c);
+    const val = (i) => key === "qualityGaps" ? qualityGapSeverity(i) : fieldValue(i, key, c);
     ordered = [...items].sort((a, b) => {
       const va = val(a);
       const vb = val(b);
@@ -32027,6 +32468,7 @@ function initiativeDetail(p, ref, now = Date.now()) {
       economics: effEcon(i) ?? null,
       milestonesList: sortMilestones(i.milestones ?? []).map((m) => ({ title: m.title, baseline: m.baselineDate, forecast: effectiveForecast(m), done: m.doneDate ?? null, state: milestoneState(m, now) })),
       risksList: (i.risks ?? []).map((r) => ({ title: r.title, category: r.category, probability: r.probability, impact: r.impact, residual: r.residualProbability !== void 0 ? [r.residualProbability, r.residualImpact] : null, status: r.status, owner: r.owner ?? null, mitigation: r.mitigation ?? null, unmitigated: isUnmitigated(r, i.followUps) })),
+      qualityFactors: canonicalQualityFactors(i.qualityFactors ?? []).map((q) => ({ factor: q.factor, required: q.required ?? null, state: q.state ?? null, targetDate: q.targetDate ?? null, note: q.note ?? null, gap: isQualityGap(q) })),
       followUpsList: sortFollowUps(i.followUps ?? []).map((f) => ({ title: f.title, due: f.dueDate, done: f.doneDate ?? null, state: followUpState(f, now), assignee: f.assigneeName ?? null })),
       // The six latest by reporting date, newest first, as the Status Report page.
       statusReports: sortStatusReports(i.statusReports ?? []).slice(0, 6),
@@ -32216,7 +32658,7 @@ function compareSnapshots(p, q, now = Date.now()) {
   };
 }
 var BOARD_RISK_ROWS = 10;
-var BOARD_SECTIONS = ["kpis", "capacity", "milestones", "risks", "capabilityImpact"];
+var BOARD_SECTIONS = ["kpis", "capacity", "milestones", "risks", "quality", "capabilityImpact"];
 function boardSlices(p, q, now = Date.now()) {
   const want = new Set(q.sections?.length ? q.sections : BOARD_SECTIONS);
   const { items, errors } = applyScope(p, q.filter, now, p.initiatives.filter(isLiveInitiative));
@@ -32288,6 +32730,17 @@ function boardSlices(p, q, now = Date.now()) {
       roseCount: s.rose.length
     } : null;
   }
+  if (want.has("quality")) {
+    const s = boardQualitySlice(items);
+    out.quality = s ? {
+      ratedInitiatives: s.ratedInitiativeCount,
+      initiativesWithGaps: s.initiativesWithGaps,
+      scalingWithHighGap: s.scalingWithGaps,
+      gapCount: s.gapCount,
+      byFactor: s.byFactor,
+      gaps: s.gaps.map((g) => ({ initiative: g.initiativeName, status: g.status, factor: g.factor, required: g.required, state: g.state, targetDate: g.targetDate ?? null }))
+    } : null;
+  }
   if (want.has("capabilityImpact")) {
     if (!p.capabilities.some((c) => c.parentId !== null)) out.capabilityImpact = null;
     else {
@@ -32312,6 +32765,11 @@ function boardSlices(p, q, now = Date.now()) {
   };
 }
 var SKILL_MONTHS_DEFAULT = 24;
+function queueStateOf(cl, names) {
+  const funded = new Set(cl.funded.map((i) => i.id));
+  const ranked = new Set(cl.ranked.map((i) => i.id));
+  return (i) => funded.has(i.id) ? "funded" : !ranked.has(i.id) ? "not in queue" : cl.excludedInitiativeIds.has(i.id) ? "parked: excluded" : cl.parkedSkillReason[i.id] ? `parked: skill cap ${cl.parkedSkillReason[i.id]}` : cl.parkedDependencyReason[i.id] ? `parked: waits on ${names.get(cl.parkedDependencyUpstreamId[i.id] ?? "") ?? cl.parkedDependencyReason[i.id]}` : "parked: budget";
+}
 function capDeltaErrors(p, deltas) {
   const errors = [];
   for (const [id, d] of Object.entries(deltas ?? {})) {
@@ -32346,7 +32804,7 @@ function skillAllocation(p, q, now = Date.now()) {
   const base = baselineScenario(p.budgetField, p.exclusions);
   const cl = computeScenarioCutLine(candidates, p.rules, p.discountRatePct, p.skills, p.budgetCap, base, liveAll);
   const funded = new Set(cl.funded.map((i) => i.id));
-  const ranked = new Set(cl.ranked.map((i) => i.id));
+  const queueState = queueStateOf(cl, names);
   const pipeline = pipelineSkillDemand(items.filter(isInFlightInitiative));
   const run = inProductionSkillFte(liveAll);
   const includeRun = q.includeRunTeams ?? false;
@@ -32368,7 +32826,6 @@ function skillAllocation(p, q, now = Date.now()) {
   const perSkill = skills.map((s) => {
     const users = items.filter((i) => (i.requiredSkills ?? []).some((rs) => rs.skillId === s.id && (rs.fte > 0 || (rs.runFte ?? 0) > 0))).map((i) => {
       const rs = (i.requiredSkills ?? []).find((x) => x.skillId === s.id);
-      const parkedBySkill = cl.parkedSkillReason[i.id];
       return {
         id: i.id,
         name: i.name,
@@ -32378,8 +32835,7 @@ function skillAllocation(p, q, now = Date.now()) {
         buildFte: rs.fte,
         ...rs.runFte !== void 0 ? { runFte: rs.runFte } : {},
         timeline: { start: i.timelineStart ?? null, end: i.timelineEnd ?? null },
-        // The reasons in rank_initiatives' order.
-        queue: funded.has(i.id) ? "funded" : !ranked.has(i.id) ? "not in queue" : cl.excludedInitiativeIds.has(i.id) ? "parked: excluded" : parkedBySkill ? `parked: skill cap ${parkedBySkill}` : cl.parkedDependencyReason[i.id] ? `parked: waits on ${names.get(cl.parkedDependencyUpstreamId[i.id] ?? "") ?? cl.parkedDependencyReason[i.id]}` : "parked: budget"
+        queue: queueState(i)
       };
     }).sort((a, b) => b.fte - a.fte || a.name.localeCompare(b.name));
     const series = rows.map((r) => ({ month: String(r.month), fte: Number(r[s.id] ?? 0) }));
@@ -32446,6 +32902,307 @@ function skillAllocation(p, q, now = Date.now()) {
   while (rowCap > 5 && JSON.stringify(build(rowCap, perSkill)).length > OUTPUT_BUDGET_CHARS) rowCap = Math.max(5, Math.floor(rowCap / 2));
   return fitRows((list) => build(rowCap, list), perSkill).body;
 }
+var PLANNED = /* @__PURE__ */ new Set(["Idea", "Pilot", "Scaling"]);
+function capabilityAllocation(p, q, now = Date.now()) {
+  const errors = [];
+  const leaves = p.capabilities.filter((c) => c.parentId !== null);
+  if (leaves.length === 0) return { ok: false, errors: ["The backup has no capability map (Settings \u2192 Taxonomy \u2192 Capabilities in the app)."] };
+  const domainName = (c) => p.capabilities.find((d) => d.id === c.parentId)?.name ?? "";
+  const path2 = (c) => `${domainName(c)} / ${c.name}`;
+  let pool = leaves;
+  if (q.domain) {
+    const ds = p.capabilities.filter((x) => x.parentId === null && lc(x.name) === lc(q.domain));
+    if (ds.length === 0) errors.push(`domain: "${q.domain}" is not a domain of this map (have: ${p.capabilities.filter((x) => x.parentId === null).map((x) => x.name).join(" | ")}).`);
+    else pool = leaves.filter((c) => ds.some((d) => d.id === c.parentId));
+  }
+  const chosen = /* @__PURE__ */ new Map();
+  for (const ref of q.capabilities ?? []) {
+    const hits = pool.filter((c) => c.id === ref || lc(path2(c)) === lc(ref));
+    const byName = hits.length ? hits : pool.filter((c) => lc(c.name) === lc(ref));
+    if (byName.length === 1) chosen.set(byName[0].id, byName[0]);
+    else if (byName.length > 1) errors.push(`capabilities: "${ref}" names ${byName.length} capabilities (${byName.map(path2).join(" | ")}); pass "Domain / Capability" or the id.`);
+    else if (q.domain && leaves.some((c) => c.id === ref || lc(path2(c)) === lc(ref) || lc(c.name) === lc(ref))) errors.push(`capabilities: "${ref}" is not in the domain ${q.domain}.`);
+    else errors.push(`capabilities: "${ref}" is not a capability of this map (a domain is not a capability; pass domain for a whole domain).`);
+  }
+  const known = new Set(p.initiatives.map((i) => i.id));
+  for (const id of q.excludedIds ?? []) if (!known.has(id)) errors.push(`excludedIds: "${id}" is not an initiative id of this backup.`);
+  const liveAll = p.initiatives.filter(isLiveInitiative);
+  const scoped = applyScope(p, q.filter, now, liveAll);
+  errors.push(...scoped.errors);
+  if (errors.length) return { ok: false, errors };
+  const items = scoped.items;
+  const names = new Map(p.initiatives.map((i) => [i.id, i.name]));
+  const wantedIds = new Set((chosen.size ? [...chosen.values()] : pool).map((c) => c.id));
+  const candidates = applyScope(p, q.filter ? { ...q.filter, status: void 0 } : void 0, now, liveAll).items;
+  const base = baselineScenario(p.budgetField, p.exclusions);
+  const cl = computeScenarioCutLine(candidates, p.rules, p.discountRatePct, p.skills, p.budgetCap, base, liveAll);
+  const queueState = queueStateOf(cl, names);
+  const funded = new Set(cl.funded.map((i) => i.id));
+  const ranked = new Set(cl.ranked.map((i) => i.id));
+  const parked = (i) => PLANNED.has(i.status) && ranked.has(i.id) && !funded.has(i.id);
+  const result = deriveCapabilityImpact(p.capabilities, items);
+  const steps = maturityTimeline(p.capabilities, items).flatMap((g) => g.steps.map((st) => ({ ...st, group: g.key })));
+  const leafIds = new Set(leaves.map((c) => c.id));
+  const limit = Math.min(q.limit ?? ROW_LIMIT_DEFAULT, ROW_LIMIT_MAX);
+  const perCap = result.capabilities.filter((cp) => wantedIds.has(cp.capability.id)).map((cp) => {
+    const c = cp.capability;
+    const rows = cp.linked.map((i) => {
+      const link = (i.capabilityImpacts ?? []).find((l) => l.capabilityId === c.id);
+      return {
+        id: i.id,
+        name: i.name,
+        status: i.status,
+        parked: parked(i),
+        kind: link.kind,
+        level: levelOfImpact(link, c),
+        counts: cp.counting.includes(i),
+        plannedQuarter: PLANNED.has(i.status) ? quarterOf(i.timelineEnd) : null,
+        spend: Math.round(attributedSpend(i, leafIds).get(c.id) ?? 0),
+        queue: i.status === "In Production" ? "in production" : queueState(i)
+      };
+    }).sort((a, b) => (b.level ?? -1) - (a.level ?? -1) || a.name.localeCompare(b.name));
+    const securedLevel = Math.max(cp.current, ...rows.filter((r) => r.counts && !r.parked).map((r) => r.level ?? 0));
+    const atRisk = cp.projected > securedLevel;
+    return {
+      id: c.id,
+      capability: c.name,
+      domain: cp.domainName,
+      importance: c.importance,
+      current: cp.current,
+      projected: cp.projected,
+      target: cp.target,
+      achieved: cp.achieved,
+      planned: cp.planned,
+      plannedBy: cp.plannedBy,
+      change: cp.change,
+      gap: cp.gap,
+      coverage: cp.coverage,
+      concentrated: cp.concentrated,
+      retire: cp.retire,
+      spend: Math.round(cp.spend),
+      spendSharePct: Math.round(cp.spendShare * 1e3) / 10,
+      ...atRisk ? { atRisk: { securedLevel, because: `The projected ${cp.projected} relies on pipeline work the baseline cut line parks; funded and running work brings ${securedLevel}.` } } : {},
+      initiatives: rows.map(({ parked: _parked, ...r }) => r),
+      initiativeCount: rows.length,
+      path: steps.filter((st) => st.capability.id === c.id).map((st) => ({ when: st.group, initiative: st.initiative.name, kind: st.kind, level: st.level }))
+    };
+  });
+  let whatIf;
+  if (q.excludedIds || q.budgetCap !== void 0) {
+    const scenario = { ...base, ...q.excludedIds ? { excludedIds: Object.fromEntries(q.excludedIds.map((id) => [id, {}])) } : {} };
+    const cap = q.budgetCap === null ? void 0 : q.budgetCap ?? p.budgetCap;
+    const alt = computeScenarioCutLine(candidates, p.rules, p.discountRatePct, p.skills, cap, scenario, liveAll);
+    const altFunded = new Set(alt.funded.map((i) => i.id));
+    const lost = items.filter((i) => PLANNED.has(i.status) && (funded.has(i.id) && !altFunded.has(i.id) || alt.excludedInitiativeIds.has(i.id) && !cl.excludedInitiativeIds.has(i.id)));
+    const lostIds = new Set(lost.map((i) => i.id));
+    const after = deriveCapabilityImpact(p.capabilities, items.filter((i) => !lostIds.has(i.id)));
+    const afterById = new Map(after.capabilities.map((cp) => [cp.capability.id, cp]));
+    const changed = result.capabilities.filter((cp) => wantedIds.has(cp.capability.id)).map((cp) => ({ cp, a: afterById.get(cp.capability.id) })).filter(({ cp, a }) => a.projected !== cp.projected || a.gap !== cp.gap || a.coverage !== cp.coverage).map(({ cp, a }) => ({
+      capability: cp.capability.name,
+      domain: cp.domainName,
+      importance: cp.capability.importance,
+      projected: { before: cp.projected, after: a.projected },
+      gap: { before: cp.gap, after: a.gap },
+      coverage: { before: cp.coverage, after: a.coverage }
+    }));
+    whatIf = {
+      excluded: [...alt.excludedInitiativeIds].map((id) => names.get(id) ?? id),
+      budgetCap: alt.cap.budgetCap ?? null,
+      // Funded in the baseline and not in the what-if, or newly excluded.
+      takenOut: lost.slice(0, limit).map((i) => ({ name: i.name, was: queueState(i) })),
+      ...lost.length > limit ? { takenOutCount: lost.length } : {},
+      capabilitiesChanged: changed.slice(0, limit),
+      ...changed.length > limit ? { changedCount: changed.length } : {},
+      newGaps: changed.filter((x) => x.gap.before === 0 && x.gap.after > 0).map((x) => x.capability),
+      note: "Estimate with the app's rules: the planned initiatives that lose their funding, or that the what-if newly excludes, are taken out and the map is derived again. The baseline projection already counts parked pipeline work (as the page does), so a higher budget cap cannot show a gain here; see atRisk instead. excludedIds replaces the organisation's exclusions. The app has no such what-if of its own."
+    };
+  }
+  const build = (rowCap2, list) => ({
+    ok: true,
+    asOf: p.exportedAt,
+    scope: `${items.length} live initiatives${q.filter ? " in the filter" : ""}, ${result.linkedInitiativeCount} linked to the map`,
+    hasCap: cl.hasCap,
+    capabilities: list.map((x) => ({ ...x, initiatives: x.initiatives.slice(0, rowCap2), path: x.path.slice(0, rowCap2) })),
+    ...list.length < perCap.length ? { capabilitiesReturned: list.length, capabilityCount: perCap.length, cutForSize: `Cut to the first ${list.length} of ${perCap.length} capabilities to fit; pass capabilities or domain to see the others.` } : {},
+    ...rowCap2 < limit && perCap.some((x) => x.initiatives.length > rowCap2) ? { rowsCutForSize: `Initiative rows and path steps cut to ${rowCap2} per capability to fit (initiativeCount gives the full number).` } : {},
+    ...whatIf ? { whatIf } : {},
+    note: "The Capabilities page's rules over live initiatives (archived and Retired ones are out of scope): projected = the highest level the counting initiatives bring, never below current; In Production = achieved, Idea/Pilot/Scaling = planned (plannedBy = earliest end date reaching it), On Hold and retire links do not count; a link without its own level brings the target; spend = each initiative's budget split evenly over its mapped links; coverage and concentration as on the page. queue = the baseline cut line (rank_initiatives' rule); hasCap = the cut line has a budget cap, a skill cap or exclusions (without any, everything is funded). atRisk = the projection needs parked pipeline work. path = the Timeline tab (achieved, then quarters of the planned end dates, then undated); a retire step has level null. Quote these figures rather than recomputing them."
+  });
+  let rowCap = limit;
+  while (rowCap > 5 && JSON.stringify(build(rowCap, perCap)).length > OUTPUT_BUDGET_CHARS) rowCap = Math.max(5, Math.floor(rowCap / 2));
+  return fitRows((list) => build(rowCap, list), perCap).body;
+}
+
+// src/analysis-templates.ts
+var RULES = [
+  "Rules for every step:",
+  "- If no portfolio is loaded in this conversation, ask for the path of the backup file (BICon app: Import/Export \u2192 Backup \u2192 Export; often in Downloads) and call `load_portfolio` first; pass the portfolioId it returns as `portfolio` to every other tool.",
+  "- Use only figures the tools return. Never compute, re-derive or round them differently; when two figures differ, say which tool gave which.",
+  "- Name the export date the figures stand on (exportedAt in load_portfolio's answer), and pass on every note, cut or size line the tools return.",
+  "- Answer in the user's language, plainly, without jargon."
+].join("\n");
+var ANALYSIS_TEMPLATES = [
+  {
+    key: "board_briefing",
+    title: "Board briefing on the portfolio",
+    description: "A one-page briefing for the board: health, capacity, delivery, risks, capabilities and the actions to decide.",
+    example: "Give me a one-page board briefing on the portfolio.",
+    tools: ["board_slices", "portfolio_readings", "rank_initiatives"],
+    args: [],
+    body: () => [
+      "Write a one-page board briefing on the loaded portfolio.",
+      "1. Call `board_slices` (all `sections`). It gives the Board Memo's own chapter data: KPIs, capacity, milestones, risks, quality gaps and capability impact.",
+      '2. Call `portfolio_readings` with `readings` ["boardActions", "signals"] for the actions the app proposes and the early warnings.',
+      "3. Call `rank_initiatives` with no other input for the baseline cut line: what is funded, what is parked and why.",
+      "Structure: three headline sentences; then Health (KPIs), Capacity (funded vs parked, the must-do block), Delivery (missed and due milestones), Risks (severe and rising), Capabilities (top changes and uncovered gaps); end with the three to five decisions the board should take, each tied to a Board Action."
+    ].join("\n")
+  },
+  {
+    key: "budget_what_if",
+    title: "What if the budget changes",
+    description: "What a budget cut or rise does to the cut line: which initiatives fall below it or come back.",
+    example: "What happens if the budget drops by 10 %?",
+    tools: ["rank_initiatives"],
+    args: [{ name: "changePct", description: "Budget change in percent, a whole number from -90 to 200, e.g. -10 or 20 (default -10)", required: false, number: { min: -90, max: 200 } }],
+    body: (a) => {
+      const pct = a.changePct?.trim() || "-10";
+      return [
+        `Show what a budget change of ${pct} % does to the portfolio.`,
+        "1. Call `rank_initiatives` with `limit` 200: the baseline cut line. If its scenario.budgetCap is null, say that the organisation has no budget cap, so a budget change moves nothing, and stop.",
+        `2. Call \`rank_initiatives\` again with \`tradeoffPct\` ${pct} and \`limit\` 200.`,
+        "3. Compare the two answers row by row: initiatives that lose or gain funding, the budget cap before and after (scenario.budgetCap) and the funded budget before and after (totals). If either answer says truncated, say that only the rows shown were compared.",
+        "Report: the change in one sentence; a table of the initiatives that move (name, status, bucket, budget, before \u2192 after); what happens to the must-do block; which parked initiatives come closest to funding."
+      ].join("\n");
+    }
+  },
+  {
+    key: "skill_bottlenecks",
+    title: "Skill bottlenecks and what frees them",
+    description: "Which skills are over their cap, when, who drives the peak, and how many FTE would free the parked work.",
+    example: "Which skills are over their cap in the next 12 months, and who drives the peak?",
+    tools: ["skill_allocation"],
+    args: [{ name: "months", description: "Months to look ahead, 1 to 48 (default 12)", required: false, number: { min: 1, max: 48 } }],
+    body: (a) => {
+      const months = a.months?.trim() || "12";
+      return [
+        `Find the skill bottlenecks over the next ${months} months.`,
+        `1. Call \`skill_allocation\` with \`months\` ${months}.`,
+        '2. For each skill with months over cap (timeline.monthsOverCap) or initiatives parked by its cap (queue "parked: skill cap \u2026"), call `skill_allocation` again for that skill with `skillFteDeltas` mapping that skill\'s id from step 1 to the extra FTE, which is the larger of the highest overBy in monthsOverCap and the shortfall now (minus now.headroom, when headroom is below zero), to see what the extra FTE frees.',
+        "Report per bottleneck skill: cap vs pipeline demand now; the months over cap and the peak with the initiatives behind it; the initiatives the cap parks; what the extra FTE frees (nowFunded). End with a short ranking of where extra FTE helps most."
+      ].join("\n");
+    }
+  },
+  {
+    key: "capability_gaps",
+    title: "Capability gaps and who closes them",
+    description: "Which capabilities stay below target, which gaps nobody covers, and which depend on parked work.",
+    example: "Which capability gaps stay open, and which ones depend on work we have parked?",
+    tools: ["capability_allocation"],
+    args: [{ name: "domain", description: "Only this domain of the capability map (default all)", required: false }],
+    body: (a) => {
+      const domain2 = a.domain?.trim();
+      return [
+        `Review the capability gaps${domain2 ? ` in the domain ${domain2}` : ""}.`,
+        `1. Call \`capability_allocation\`${domain2 ? ` with \`domain\` ${JSON.stringify(domain2)}` : ""}.`,
+        "2. Group the capabilities: (a) uncovered gaps (coverage uncovered), differentiating first; (b) gaps closed only on paper (atRisk: the projection needs parked work); (c) partly covered gaps; (d) concentration (concentrated).",
+        '3. For the two atRisk capabilities with the largest gap between projected and securedLevel, name the parked initiatives (queue starting "parked:") and their reason.',
+        "Report: a table per group (capability, domain, importance, current \u2192 projected \u2192 target, initiatives); then the maturity path of the differentiating capabilities by quarter (path); end with the decisions that would close the most important gaps."
+      ].join("\n");
+    }
+  },
+  {
+    key: "risk_review",
+    title: "Risk and delivery review",
+    description: "Severe and rising risks, missed milestones, overdue follow-ups and the early warnings not yet recorded.",
+    example: "Which high risks have no owner, and which milestones are slipping?",
+    tools: ["portfolio_readings", "board_slices", "query_initiatives", "initiative_detail"],
+    args: [],
+    body: () => [
+      "Review risks and delivery across the portfolio.",
+      '1. Call `portfolio_readings` with `readings` ["risks", "signals"].',
+      '2. Call `board_slices` with `sections` ["milestones", "risks"] for missed and due milestones and the risks that rose since the baseline.',
+      '3. Call `query_initiatives` with `filter` {"hasSevereRisk": true} and `fields` ["status", "severeRisks", "topRisk", "unmitigatedRisks", "overdueMilestones", "nextMilestone", "overdueFollowUps"] for the initiatives behind them.',
+      '4. Call `query_initiatives` with `filter` {"hasOverdueFollowUp": true} and `fields` ["status", "overdueFollowUps", "openFollowUps"] for overdue follow-ups anywhere in the portfolio.',
+      "5. For each initiative from step 3 with unmitigatedRisks above zero (at most five, most first), call `initiative_detail` with `initiative` set to its name: risksList marks each unmitigated risk (no owner, or no linked follow-up).",
+      "Report: severe risks without an owner or a follow-up (from step 5, and say how many initiatives were not opened); risks that rose; missed milestones and the next 90 days; overdue follow-ups; early warnings not yet in the register; end with the five actions that reduce exposure most."
+    ].join("\n")
+  },
+  {
+    key: "since_snapshot",
+    title: "What changed since the last snapshot",
+    description: "KPIs, added and dropped initiatives, score and risk moves since a snapshot.",
+    example: "What changed since the last snapshot?",
+    tools: ["compare_snapshots"],
+    args: [{ name: "from", description: "Snapshot id or label to compare from (default the newest)", required: false }],
+    body: (a) => {
+      const from = a.from?.trim();
+      return [
+        `Show what changed since ${from ? `the snapshot "${from}"` : "the newest snapshot"}.`,
+        `1. Call \`compare_snapshots\`${from ? ` with \`from\` "${from}"` : ""}.`,
+        "Report: the KPI moves in one table; initiatives added and gone; the largest score changes (value and governance side by side); risks that rose. End with what deserves the board's attention and why."
+      ].join("\n");
+    }
+  },
+  {
+    key: "initiative_brief",
+    title: "One initiative, one page",
+    description: "A one-page brief on one initiative: scores, economics, delivery, risks, capabilities and decisions.",
+    example: "Give me a one-page brief on KYC Remediation.",
+    tools: ["initiative_detail", "rank_initiatives"],
+    args: [{ name: "initiative", description: "Initiative name or id", required: true }],
+    body: (a) => {
+      const name = a.initiative?.trim() ?? "";
+      return [
+        `Write a one-page brief on the initiative ${name}.`,
+        `1. Call \`initiative_detail\` with \`initiative\` ${JSON.stringify(name)}.`,
+        "2. Call `rank_initiatives` with `limit` 200 and find the initiative's row: rank, bucket, funded or parked and why. In Production, Retired and archived initiatives are not in the queue: then say so and take the bucket from initiative_detail (priorityBucket); never call it parked.",
+        "Report: purpose and status in two sentences; scores and quadrant; economics; place in the cut line; milestones; open risks and follow-ups; capabilities it moves; the latest status report; the last decisions. End with the open questions for its sponsor."
+      ].join("\n");
+    }
+  }
+];
+function checkTemplateArgs(t, args = {}) {
+  const errors = [];
+  const out = {};
+  for (const name of Object.keys(args)) {
+    if (!t.args.some((a) => a.name === name)) errors.push(`${t.key} takes no argument "${name}"${t.args.length ? ` (it takes: ${t.args.map((a) => a.name).join(", ")})` : ""}`);
+  }
+  for (const a of t.args) {
+    const raw = args[a.name];
+    const v = raw === void 0 ? "" : String(raw).trim();
+    if (!v) {
+      if (a.required) errors.push(`${t.key} needs "${a.name}": ${a.description}`);
+      continue;
+    }
+    if (a.number) {
+      const n = Number(v);
+      if (!Number.isInteger(n) || n < a.number.min || n > a.number.max) {
+        errors.push(`"${a.name}" must be a whole number from ${a.number.min} to ${a.number.max}, not ${JSON.stringify(raw)}`);
+        continue;
+      }
+      out[a.name] = String(n);
+    } else {
+      out[a.name] = v;
+    }
+  }
+  return errors.length ? { ok: false, errors } : { ok: true, args: out };
+}
+function templateText(t, args = {}) {
+  return `${t.title}
+
+${t.body(args)}
+
+${RULES}`;
+}
+function nextSteps() {
+  return {
+    hint: "Unless the user already asked something specific, give a two-line summary and offer these as a short numbered list (title and example), then wait for the choice. To run one, call get_analysis_template with its key and follow the text; an option with needs asks the user for those inputs first.",
+    options: ANALYSIS_TEMPLATES.map((t) => {
+      const needs = t.args.filter((a) => a.required).map((a) => a.name);
+      return { key: t.key, title: t.title, example: t.example, ...needs.length ? { needs } : {} };
+    })
+  };
+}
 
 // src/analysis-schema.ts
 var portfolioId = () => external_exports.string().regex(/^pf_[0-9a-f]{16}$/, "a portfolioId looks like pf_<16 hex>, from load_portfolio").describe("The portfolioId load_portfolio returned");
@@ -32466,6 +33223,7 @@ var scopeFilter = () => external_exports.object({
   hasOverdueMilestone: external_exports.boolean().optional(),
   hasOverdueFollowUp: external_exports.boolean().optional(),
   hasSevereRisk: external_exports.boolean().optional().describe("live high/critical risk"),
+  hasQualityGap: external_exports.boolean().optional().describe("a quality gap, any status"),
   ids: external_exports.array(external_exports.string()).optional()
 }).strict().optional().describe("Scope (AND; text matches ignore case; archived left out unless includeArchived; scores 0\u2013100, composite = Prioritisation's)");
 var loadPortfolioInputSchema = external_exports.object({
@@ -32534,6 +33292,15 @@ var skillAllocationInputSchema = external_exports.object({
   excludedIds: external_exports.array(external_exports.string()).optional().describe("What-if: initiative ids parked out of the queue (replaces the organisation's exclusions)"),
   limit: external_exports.number().int().min(1).max(ROW_LIMIT_MAX).optional().describe("Initiative rows per skill (default 50)")
 }).strict();
+var capabilityAllocationInputSchema = external_exports.object({
+  portfolio: portfolioId(),
+  capabilities: external_exports.array(external_exports.string().trim().min(1)).optional().describe('Capability ids, names or "Domain / Capability" (default every capability; a domain is not a capability, use domain)'),
+  domain: external_exports.string().trim().min(1).optional().describe("Only the capabilities of this domain (by name)"),
+  filter: scopeFilter(),
+  excludedIds: external_exports.array(external_exports.string()).optional().describe("What-if: initiative ids parked out of the queue (replaces the organisation's exclusions)"),
+  budgetCap: external_exports.number().positive().nullable().optional().describe("What-if: budget cap, above 0; null = no cap; default the organisation's envelope"),
+  limit: external_exports.number().int().min(1).max(ROW_LIMIT_MAX).optional().describe("Initiative rows per capability (default 50)")
+}).strict();
 
 // src/server.ts
 var SERVER_NAME = "bicon-initiative-composer";
@@ -32570,12 +33337,13 @@ function createServer() {
     async () => text({
       capabilities: [
         "strict typed schemas: unknown keys anywhere in the spec are rejected with their exact path (never silently dropped)",
-        "sections (aiAct/economics/actuals/decisionLog/statusReports/requiredSkills/capabilityImpacts/milestones/risks/followUps) accept a JSON object/array or the same JSON as a string; row ids are minted by the Composer, and a follow-up's milestoneId / riskId names a milestone or risk of the same spec by the id label given there",
+        "sections (aiAct/economics/actuals/decisionLog/statusReports/requiredSkills/capabilityImpacts/milestones/risks/followUps/qualityFactors) accept a JSON object/array or the same JSON as a string; row ids are minted by the Composer, and a follow-up's milestoneId / riskId names a milestone or risk of the same spec by the id label given there",
         "dates accepted as dd/mm/yyyy, dd.mm.yyyy or yyyy-mm-dd (stored as yyyy-mm-dd)",
         "get_initiative_schema: sectionShapes, aiActVocabularies, portfolio-mode wording overlays",
         "AI-Act vocabulary and id-format enforcement with the allowed values in the error",
         "one pipeline: export_initiative_file takes the same spec as assemble_initiative \u2014 scores are always derived; pass `id` to update an existing initiative",
-        "portfolio analysis: load_portfolio reads the app's full backup (by path) with the app's own sanitiser; query_initiatives, portfolio_readings, rank_initiatives, initiative_detail, compare_snapshots, board_slices and skill_allocation compute with the app's own rules (ranking and cut line, KPIs, concentration and HHI, operating model, capability impact, risk register, early warnings, Board Actions, snapshot deltas, the Board Memo's chapter data, skill allocation over time)",
+        "portfolio analysis: load_portfolio reads the app's full backup (by path) with the app's own sanitiser; query_initiatives, portfolio_readings, rank_initiatives, initiative_detail, compare_snapshots, board_slices, skill_allocation and capability_allocation compute with the app's own rules (ranking and cut line, KPIs, concentration and HHI, operating model, capability impact, risk register, early warnings, Board Actions, snapshot deltas, the Board Memo's chapter data, skill allocation over time, capability allocation)",
+        "ready-made analyses: seven recipes (board briefing, budget what-if, skill bottlenecks, capability gaps, risk review, change since a snapshot, one-page initiative brief) as prompts, as load_portfolio's nextSteps and by get_analysis_template",
         "portfolio context: read_portfolio_context turns the app's exported context file into an organisation-specific interview plan and a short contextId; with it, switched-off sub-dimensions are skipped in the score, business unit / category must be the organisation's own, and skill / dependency / capability / update ids are validated (capabilities from the version-2 context file)"
       ]
     })
@@ -32650,14 +33418,14 @@ function createServer() {
     },
     async (input2) => {
       const r = loadPortfolio(input2);
-      return r.ok ? compact(fitAnswer({ ok: true, ...portfolioSummary(r.portfolio) })) : compact({ ok: false, errors: r.errors });
+      return r.ok ? compact({ ...fitAnswer({ ok: true, ...portfolioSummary(r.portfolio) }), nextSteps: nextSteps() }) : compact({ ok: false, errors: r.errors });
     }
   );
   server.registerTool(
     "query_initiatives",
     {
       title: "Query initiatives",
-      description: "Filters the loaded portfolio's initiatives (status, business unit, category, driver, tags, saved portfolio, capability, skill, score ranges, overdue milestones or follow-ups, severe risks) and returns chosen columns per initiative, sorted, plus aggregates over the whole scope (count, budget sum, mean scores, count by status). Columns include the four dimension scores, composite, quadrant, priority bucket, NPV, risks, milestones, follow-ups, last status report, capabilities, skills and dependencies.",
+      description: "Filters the loaded portfolio's initiatives (status, business unit, category, driver, tags, saved portfolio, capability, skill, score ranges, overdue milestones or follow-ups, severe risks, quality gaps) and returns chosen columns per initiative, sorted, plus aggregates over the whole scope (count, budget sum, mean scores, count by status). Columns include the four dimension scores, composite, quadrant, priority bucket, NPV, risks, milestones, follow-ups, quality gaps, last status report, capabilities, skills and dependencies.",
       inputSchema: queryInputSchema
     },
     async ({ portfolio, ...q }) => withPortfolio(portfolio, (p) => queryInitiatives(p, q))
@@ -32684,7 +33452,7 @@ function createServer() {
     "initiative_detail",
     {
       title: "Initiative detail",
-      description: "One initiative in full from the loaded portfolio, by id, externalId or name: every column of query_initiatives plus description, sub-scores, economics, milestones, risks, follow-ups, recent status reports and decisions, capability impacts and the initiatives that depend on it.",
+      description: "One initiative in full from the loaded portfolio, by id, externalId or name: every column of query_initiatives plus description, sub-scores, economics, milestones, risks, follow-ups, quality factors, recent status reports and decisions, capability impacts and the initiatives that depend on it.",
       inputSchema: detailInputSchema
     },
     async ({ portfolio, initiative }) => withPortfolio(portfolio, (p) => initiativeDetail(p, initiative))
@@ -32702,7 +33470,7 @@ function createServer() {
     "board_slices",
     {
       title: "Board memo slices",
-      description: "The raw data of the Board Memo's chapters, from the same functions the memo and the board pack use: KPIs since the baseline snapshot, capacity (cut line totals, parked by reason, the must-do block), milestones (missed and due in the next 90 days), risks (heat map, top severe, issues and rises since the baseline) and capability impact (domains, top changes, uncovered gaps). Use it to draft a memo section, a committee note or slides; state the snapshot and export date the numbers stand on.",
+      description: "The raw data of the Board Memo's chapters, from the same functions the memo and the board pack use: KPIs since the baseline snapshot, capacity (cut line totals, parked by reason, the must-do block), milestones (missed and due in the next 90 days), risks (heat map, top severe, issues and rises since the baseline), quality gaps (top 10, per factor) and capability impact (domains, top changes, uncovered gaps). Use it to draft a memo section, a committee note or slides; state the snapshot and export date the numbers stand on.",
       inputSchema: boardSlicesInputSchema
     },
     async ({ portfolio, ...q }) => withPortfolio(portfolio, (p) => boardSlices(p, q))
@@ -32716,6 +33484,40 @@ function createServer() {
     },
     async ({ portfolio, ...q }) => withPortfolio(portfolio, (p) => skillAllocation(p, q))
   );
+  server.registerTool(
+    "capability_allocation",
+    {
+      title: "Capability allocation",
+      description: "Per capability of the map (or the ones named, or one domain): current, projected and target maturity, the gap, coverage, concentration and attributed spend, from the Capabilities page's own rules; every initiative linked to it (status, kind, the level it brings, planned quarter, spend, and its place in the baseline cut line: funded or parked and why), with atRisk when the projection needs parked pipeline work; the maturity path by quarter (the Timeline tab); and with excludedIds or budgetCap, which capabilities fall back, which gaps open and which initiatives are taken out (funded in the baseline but not in the what-if, or excluded).",
+      inputSchema: capabilityAllocationInputSchema
+    },
+    async ({ portfolio, ...q }) => withPortfolio(portfolio, (p) => capabilityAllocation(p, q))
+  );
+  for (const t of ANALYSIS_TEMPLATES) {
+    const argsSchema = Object.fromEntries(t.args.map((a) => [a.name, a.required ? external_exports.string().describe(a.description) : external_exports.string().optional().describe(a.description)]));
+    server.registerPrompt(`bicon_${t.key}`, { title: `BICon: ${t.title}`, description: t.description, argsSchema }, (args) => {
+      const c = checkTemplateArgs(t, args);
+      if (!c.ok) throw new Error(c.errors.join("; "));
+      return { messages: [{ role: "user", content: { type: "text", text: templateText(t, c.args) } }] };
+    });
+  }
+  server.registerTool(
+    "get_analysis_template",
+    {
+      title: "Ready-made analysis",
+      description: `Returns the recipe of a ready-made portfolio analysis: which analysis tools to call with which inputs, what to report, and the rules (quote the tools' figures, name the export date). Follow it step by step. The same recipes are offered as prompts and as load_portfolio's nextSteps. Keys: ${ANALYSIS_TEMPLATES.map((t) => `${t.key} (${t.title})`).join("; ")}.`,
+      inputSchema: external_exports.object({
+        key: external_exports.enum(ANALYSIS_TEMPLATES.map((t) => t.key)).describe("Which analysis"),
+        args: external_exports.record(external_exports.string(), external_exports.union([external_exports.string(), external_exports.number()])).optional().describe(`Inputs by name: ${ANALYSIS_TEMPLATES.filter((t) => t.args.length).map((t) => `${t.key}: ${t.args.map((a) => `${a.name}${a.required ? " (required)" : ""}`).join(", ")}`).join("; ")}`)
+      }).strict()
+    },
+    async ({ key, args }) => {
+      const t = ANALYSIS_TEMPLATES.find((x) => x.key === key);
+      const c = checkTemplateArgs(t, args ?? {});
+      if (!c.ok) return { ...compact({ ok: false, errors: c.errors }), isError: true };
+      return compact({ ok: true, key: t.key, title: t.title, text: templateText(t, c.args) });
+    }
+  );
   return server;
 }