@bicon/mcp-composer 0.4.0 → 0.6.0

package/README.md

@@ -24,7 +24,7 @@ via API keys is a separate, security-reviewed phase.
 | Name | What it does |
 |---|---|
 | resource `initiative://schema` / tool `get_initiative_schema` | The field catalog: required fields, enum values, the four dimensions with their named sub-dimensions (EN/DE labels + help text, plus the wording the app uses in digital / innovation portfolios), the exact shape of every optional section, the EU-AI-Act vocabularies, and the handoff steps. **Read this first.** |
-| `assemble_initiative` | Compact spec (metadata + named sub-ratings 0–100 + confidence per dimension + optional sections, optionally the organisation's `context`) → fully-formed initiative validated against the API contract (`CreateInitiativeBody` from `@workspace/api-zod`). Mints the initiative id and every nested row id (decision-log entries, status reports, incidents — a client never invents ids), **derives** the four dimension scores (the app's own scoring function), accepts dates as dd/mm/yyyy, dd.mm.yyyy or yyyy-mm-dd, returns `{ok, initiative, derivedScores, warnings, errors, contextId}`. Pass `id` (an existing initiative's) only to **update** that initiative. |
+| `assemble_initiative` | Compact spec (metadata + named sub-ratings 0–100 + confidence per dimension + optional sections, optionally the organisation's `context`) → fully-formed initiative validated against the API contract (`CreateInitiativeBody` from `@workspace/api-zod`). Mints the initiative id and every nested row id (decision-log entries, status reports, milestones, incidents — a client never invents ids), **derives** the four dimension scores (the app's own scoring function), accepts dates as dd/mm/yyyy, dd.mm.yyyy or yyyy-mm-dd, returns `{ok, initiative, derivedScores, warnings, errors, contextId}`. Pass `id` (an existing initiative's) only to **update** that initiative. |
 | `export_initiative_file` | Takes the **same compact spec**, assembles it and wraps the result in the app's single-initiative JSON envelope; returns `{ok, filename, json, importInstructions, derivedScores, warnings}`. There is one pipeline — a hand-edited initiative object is not an input, so client-supplied scores or unknown keys can never bypass assembly. |
 | `read_portfolio_context` | Takes the organisation's **portfolio-context file** (see below) and returns the interview plan for that organisation — its own labels, help texts and rating notes per sub-dimension, which sub-dimensions are switched off, its business units, categories, tags, skills (id + name), non-archived initiatives (id + name) and the capability map's capabilities (id, name, domain, importance, current → target maturity; context version 2), currency, discount rate, whether the EU-AI-Act module is on — plus a short **contextId** that stands in for the file in the two other tools. |
 | `composer_version` | Returns `{composerVersion, capabilities}`. Every *successful* tool result also carries `composerVersion`. |
@@ -93,7 +93,7 @@ vocabularies (`aiActVocabularies` in the descriptor; the app drops unknown
 obligation keys and never shows unknown artifact keys), the score derivation —
 is checked in the assembler, which reports **all** problems of a call at once
 with the allowed values in the message (id shapes included). Row ids of
-decision-log entries, status reports and incidents are minted by the
+decision-log entries, status reports, milestones and incidents are minted by the
 Composer — a client-supplied UUID is kept, anything else replaced — because
 the app keys those rows per initiative and a re-used id from another
 initiative is exactly what collided on import once.

package/dist/index.mjs

@@ -12,7 +12,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/version.ts
-var COMPOSER_VERSION = true ? "0.4.0" : readPackageVersion();
+var COMPOSER_VERSION = true ? "0.6.0" : readPackageVersion();
 
 // ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
@@ -4170,7 +4170,7 @@ var ListOrganizationMembersResponseItem = objectType({
   "email": stringType(),
   "displayName": stringType().nullable(),
   "role": enumType(["admin", "member", "viewer"]),
-  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact.")
+  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks.")
 });
 var ListOrganizationMembersResponse = arrayType(ListOrganizationMembersResponseItem);
 var SyncOrganizationMembersResponse = objectType({
@@ -4180,18 +4180,18 @@ var SyncOrganizationMembersResponse = objectType({
 var GetMyOrganizationAccessResponse = objectType({
   "userId": stringType().describe(`The caller's own local user id (matches AuthorRef.userId on initiatives), so the client can tell its own changes apart from a teammate's \u2014 e.g. to suppress the "updated by X" collaboration banner when an edit echoing back is the caller's own save.`),
   "role": enumType(["admin", "member", "viewer"]),
-  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact."),
+  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks."),
   "initiativeLimit": numberType().describe("The most initiatives this organisation may hold, archived ones included. Creating one more answers 507 with code initiative_limit_reached, so the client blocks New, Duplicate and Import up front.")
 });
 var UpdateOrganizationMemberPermissionsParams = objectType({
   "userId": coerce.string().uuid()
 });
 var UpdateOrganizationMemberPermissionsBody = objectType({
-  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact.")
+  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks.")
 });
 var UpdateOrganizationMemberPermissionsResponse = objectType({
   "userId": stringType().uuid(),
-  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact.")
+  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks.")
 });
 var ListPermissionProfilesResponseItem = objectType({
   "id": stringType().uuid(),
@@ -4280,6 +4280,24 @@ var listSnapshotsResponseInitiativesItemStatusReportsItemBudgetCommentMax = 1e4;
 var listSnapshotsResponseInitiativesItemStatusReportsItemSkillsCommentMax = 1e4;
 var listSnapshotsResponseInitiativesItemStatusReportsItemSummaryMax = 1e4;
 var listSnapshotsResponseInitiativesItemStatusReportsMax = 1e3;
+var listSnapshotsResponseInitiativesItemMilestonesItemTitleMax = 300;
+var listSnapshotsResponseInitiativesItemMilestonesItemBaselineDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listSnapshotsResponseInitiativesItemMilestonesItemForecastDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listSnapshotsResponseInitiativesItemMilestonesItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listSnapshotsResponseInitiativesItemMilestonesItemNoteMax = 1e4;
+var listSnapshotsResponseInitiativesItemMilestonesMax = 30;
+var listSnapshotsResponseInitiativesItemRisksItemTitleMax = 300;
+var listSnapshotsResponseInitiativesItemRisksItemProbabilityMax = 5;
+var listSnapshotsResponseInitiativesItemRisksItemImpactMax = 5;
+var listSnapshotsResponseInitiativesItemRisksItemResidualProbabilityMax = 5;
+var listSnapshotsResponseInitiativesItemRisksItemResidualImpactMax = 5;
+var listSnapshotsResponseInitiativesItemRisksItemOwnerMax = 300;
+var listSnapshotsResponseInitiativesItemRisksItemMitigationMax = 1e4;
+var listSnapshotsResponseInitiativesItemRisksItemRaisedDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listSnapshotsResponseInitiativesItemRisksItemReviewDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listSnapshotsResponseInitiativesItemRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listSnapshotsResponseInitiativesItemRisksItemNoteMax = 1e4;
+var listSnapshotsResponseInitiativesItemRisksMax = 50;
 var listSnapshotsResponseInitiativesItemDependsOnMax = 1e3;
 var listSnapshotsResponseInitiativesItemRequiredSkillsItemRunFteMin = 0;
 var listSnapshotsResponseInitiativesItemRequiredSkillsMax = 1e3;
@@ -4481,6 +4499,30 @@ var ListSnapshotsResponseItem = objectType({
       }),
       "summary": stringType().max(listSnapshotsResponseInitiativesItemStatusReportsItemSummaryMax).optional()
     })).max(listSnapshotsResponseInitiativesItemStatusReportsMax).optional(),
+    "milestones": arrayType(objectType({
+      "id": stringType(),
+      "title": stringType().min(1).max(listSnapshotsResponseInitiativesItemMilestonesItemTitleMax),
+      "baselineDate": stringType().regex(listSnapshotsResponseInitiativesItemMilestonesItemBaselineDateRegExp),
+      "forecastDate": stringType().regex(listSnapshotsResponseInitiativesItemMilestonesItemForecastDateRegExp).optional(),
+      "doneDate": stringType().regex(listSnapshotsResponseInitiativesItemMilestonesItemDoneDateRegExp).optional(),
+      "note": stringType().max(listSnapshotsResponseInitiativesItemMilestonesItemNoteMax).optional()
+    }).describe("A dated intermediate result (docs/milestones-concept-2026-10-17.md). baselineDate is the agreed plan, forecastDate today's expectation (absent = the baseline), doneDate marks it reached; all yyyy-mm-dd.")).max(listSnapshotsResponseInitiativesItemMilestonesMax).optional(),
+    "risks": arrayType(objectType({
+      "id": stringType(),
+      "title": stringType().min(1).max(listSnapshotsResponseInitiativesItemRisksItemTitleMax),
+      "category": enumType(["delivery", "vendor", "data", "people", "regulatory", "technical", "financial"]),
+      "probability": numberType().min(1).max(listSnapshotsResponseInitiativesItemRisksItemProbabilityMax),
+      "impact": numberType().min(1).max(listSnapshotsResponseInitiativesItemRisksItemImpactMax),
+      "residualProbability": numberType().min(1).max(listSnapshotsResponseInitiativesItemRisksItemResidualProbabilityMax).optional(),
+      "residualImpact": numberType().min(1).max(listSnapshotsResponseInitiativesItemRisksItemResidualImpactMax).optional(),
+      "status": enumType(["open", "mitigating", "closed", "occurred"]),
+      "owner": stringType().max(listSnapshotsResponseInitiativesItemRisksItemOwnerMax).optional(),
+      "mitigation": stringType().max(listSnapshotsResponseInitiativesItemRisksItemMitigationMax).optional(),
+      "raisedDate": stringType().regex(listSnapshotsResponseInitiativesItemRisksItemRaisedDateRegExp).optional(),
+      "reviewDate": stringType().regex(listSnapshotsResponseInitiativesItemRisksItemReviewDateRegExp).optional(),
+      "occurredDate": stringType().regex(listSnapshotsResponseInitiativesItemRisksItemOccurredDateRegExp).optional(),
+      "note": stringType().max(listSnapshotsResponseInitiativesItemRisksItemNoteMax).optional()
+    }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(listSnapshotsResponseInitiativesItemRisksMax).optional(),
     "dependsOn": arrayType(stringType()).max(listSnapshotsResponseInitiativesItemDependsOnMax),
     "requiredSkills": arrayType(objectType({
       "skillId": stringType(),
@@ -4618,6 +4660,24 @@ var createSnapshotBodyInitiativesItemStatusReportsItemBudgetCommentMax = 1e4;
 var createSnapshotBodyInitiativesItemStatusReportsItemSkillsCommentMax = 1e4;
 var createSnapshotBodyInitiativesItemStatusReportsItemSummaryMax = 1e4;
 var createSnapshotBodyInitiativesItemStatusReportsMax = 1e3;
+var createSnapshotBodyInitiativesItemMilestonesItemTitleMax = 300;
+var createSnapshotBodyInitiativesItemMilestonesItemBaselineDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createSnapshotBodyInitiativesItemMilestonesItemForecastDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createSnapshotBodyInitiativesItemMilestonesItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createSnapshotBodyInitiativesItemMilestonesItemNoteMax = 1e4;
+var createSnapshotBodyInitiativesItemMilestonesMax = 30;
+var createSnapshotBodyInitiativesItemRisksItemTitleMax = 300;
+var createSnapshotBodyInitiativesItemRisksItemProbabilityMax = 5;
+var createSnapshotBodyInitiativesItemRisksItemImpactMax = 5;
+var createSnapshotBodyInitiativesItemRisksItemResidualProbabilityMax = 5;
+var createSnapshotBodyInitiativesItemRisksItemResidualImpactMax = 5;
+var createSnapshotBodyInitiativesItemRisksItemOwnerMax = 300;
+var createSnapshotBodyInitiativesItemRisksItemMitigationMax = 1e4;
+var createSnapshotBodyInitiativesItemRisksItemRaisedDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createSnapshotBodyInitiativesItemRisksItemReviewDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createSnapshotBodyInitiativesItemRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createSnapshotBodyInitiativesItemRisksItemNoteMax = 1e4;
+var createSnapshotBodyInitiativesItemRisksMax = 50;
 var createSnapshotBodyInitiativesItemDependsOnMax = 1e3;
 var createSnapshotBodyInitiativesItemRequiredSkillsItemRunFteMin = 0;
 var createSnapshotBodyInitiativesItemRequiredSkillsMax = 1e3;
@@ -4819,6 +4879,30 @@ var CreateSnapshotBody = objectType({
       }),
       "summary": stringType().max(createSnapshotBodyInitiativesItemStatusReportsItemSummaryMax).optional()
     })).max(createSnapshotBodyInitiativesItemStatusReportsMax).optional(),
+    "milestones": arrayType(objectType({
+      "id": stringType(),
+      "title": stringType().min(1).max(createSnapshotBodyInitiativesItemMilestonesItemTitleMax),
+      "baselineDate": stringType().regex(createSnapshotBodyInitiativesItemMilestonesItemBaselineDateRegExp),
+      "forecastDate": stringType().regex(createSnapshotBodyInitiativesItemMilestonesItemForecastDateRegExp).optional(),
+      "doneDate": stringType().regex(createSnapshotBodyInitiativesItemMilestonesItemDoneDateRegExp).optional(),
+      "note": stringType().max(createSnapshotBodyInitiativesItemMilestonesItemNoteMax).optional()
+    }).describe("A dated intermediate result (docs/milestones-concept-2026-10-17.md). baselineDate is the agreed plan, forecastDate today's expectation (absent = the baseline), doneDate marks it reached; all yyyy-mm-dd.")).max(createSnapshotBodyInitiativesItemMilestonesMax).optional(),
+    "risks": arrayType(objectType({
+      "id": stringType(),
+      "title": stringType().min(1).max(createSnapshotBodyInitiativesItemRisksItemTitleMax),
+      "category": enumType(["delivery", "vendor", "data", "people", "regulatory", "technical", "financial"]),
+      "probability": numberType().min(1).max(createSnapshotBodyInitiativesItemRisksItemProbabilityMax),
+      "impact": numberType().min(1).max(createSnapshotBodyInitiativesItemRisksItemImpactMax),
+      "residualProbability": numberType().min(1).max(createSnapshotBodyInitiativesItemRisksItemResidualProbabilityMax).optional(),
+      "residualImpact": numberType().min(1).max(createSnapshotBodyInitiativesItemRisksItemResidualImpactMax).optional(),
+      "status": enumType(["open", "mitigating", "closed", "occurred"]),
+      "owner": stringType().max(createSnapshotBodyInitiativesItemRisksItemOwnerMax).optional(),
+      "mitigation": stringType().max(createSnapshotBodyInitiativesItemRisksItemMitigationMax).optional(),
+      "raisedDate": stringType().regex(createSnapshotBodyInitiativesItemRisksItemRaisedDateRegExp).optional(),
+      "reviewDate": stringType().regex(createSnapshotBodyInitiativesItemRisksItemReviewDateRegExp).optional(),
+      "occurredDate": stringType().regex(createSnapshotBodyInitiativesItemRisksItemOccurredDateRegExp).optional(),
+      "note": stringType().max(createSnapshotBodyInitiativesItemRisksItemNoteMax).optional()
+    }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(createSnapshotBodyInitiativesItemRisksMax).optional(),
     "dependsOn": arrayType(stringType()).max(createSnapshotBodyInitiativesItemDependsOnMax),
     "requiredSkills": arrayType(objectType({
       "skillId": stringType(),
@@ -4962,6 +5046,24 @@ var renameSnapshotResponseInitiativesItemStatusReportsItemBudgetCommentMax = 1e4
 var renameSnapshotResponseInitiativesItemStatusReportsItemSkillsCommentMax = 1e4;
 var renameSnapshotResponseInitiativesItemStatusReportsItemSummaryMax = 1e4;
 var renameSnapshotResponseInitiativesItemStatusReportsMax = 1e3;
+var renameSnapshotResponseInitiativesItemMilestonesItemTitleMax = 300;
+var renameSnapshotResponseInitiativesItemMilestonesItemBaselineDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var renameSnapshotResponseInitiativesItemMilestonesItemForecastDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var renameSnapshotResponseInitiativesItemMilestonesItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var renameSnapshotResponseInitiativesItemMilestonesItemNoteMax = 1e4;
+var renameSnapshotResponseInitiativesItemMilestonesMax = 30;
+var renameSnapshotResponseInitiativesItemRisksItemTitleMax = 300;
+var renameSnapshotResponseInitiativesItemRisksItemProbabilityMax = 5;
+var renameSnapshotResponseInitiativesItemRisksItemImpactMax = 5;
+var renameSnapshotResponseInitiativesItemRisksItemResidualProbabilityMax = 5;
+var renameSnapshotResponseInitiativesItemRisksItemResidualImpactMax = 5;
+var renameSnapshotResponseInitiativesItemRisksItemOwnerMax = 300;
+var renameSnapshotResponseInitiativesItemRisksItemMitigationMax = 1e4;
+var renameSnapshotResponseInitiativesItemRisksItemRaisedDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var renameSnapshotResponseInitiativesItemRisksItemReviewDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var renameSnapshotResponseInitiativesItemRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var renameSnapshotResponseInitiativesItemRisksItemNoteMax = 1e4;
+var renameSnapshotResponseInitiativesItemRisksMax = 50;
 var renameSnapshotResponseInitiativesItemDependsOnMax = 1e3;
 var renameSnapshotResponseInitiativesItemRequiredSkillsItemRunFteMin = 0;
 var renameSnapshotResponseInitiativesItemRequiredSkillsMax = 1e3;
@@ -5163,6 +5265,30 @@ var RenameSnapshotResponse = objectType({
       }),
       "summary": stringType().max(renameSnapshotResponseInitiativesItemStatusReportsItemSummaryMax).optional()
     })).max(renameSnapshotResponseInitiativesItemStatusReportsMax).optional(),
+    "milestones": arrayType(objectType({
+      "id": stringType(),
+      "title": stringType().min(1).max(renameSnapshotResponseInitiativesItemMilestonesItemTitleMax),
+      "baselineDate": stringType().regex(renameSnapshotResponseInitiativesItemMilestonesItemBaselineDateRegExp),
+      "forecastDate": stringType().regex(renameSnapshotResponseInitiativesItemMilestonesItemForecastDateRegExp).optional(),
+      "doneDate": stringType().regex(renameSnapshotResponseInitiativesItemMilestonesItemDoneDateRegExp).optional(),
+      "note": stringType().max(renameSnapshotResponseInitiativesItemMilestonesItemNoteMax).optional()
+    }).describe("A dated intermediate result (docs/milestones-concept-2026-10-17.md). baselineDate is the agreed plan, forecastDate today's expectation (absent = the baseline), doneDate marks it reached; all yyyy-mm-dd.")).max(renameSnapshotResponseInitiativesItemMilestonesMax).optional(),
+    "risks": arrayType(objectType({
+      "id": stringType(),
+      "title": stringType().min(1).max(renameSnapshotResponseInitiativesItemRisksItemTitleMax),
+      "category": enumType(["delivery", "vendor", "data", "people", "regulatory", "technical", "financial"]),
+      "probability": numberType().min(1).max(renameSnapshotResponseInitiativesItemRisksItemProbabilityMax),
+      "impact": numberType().min(1).max(renameSnapshotResponseInitiativesItemRisksItemImpactMax),
+      "residualProbability": numberType().min(1).max(renameSnapshotResponseInitiativesItemRisksItemResidualProbabilityMax).optional(),
+      "residualImpact": numberType().min(1).max(renameSnapshotResponseInitiativesItemRisksItemResidualImpactMax).optional(),
+      "status": enumType(["open", "mitigating", "closed", "occurred"]),
+      "owner": stringType().max(renameSnapshotResponseInitiativesItemRisksItemOwnerMax).optional(),
+      "mitigation": stringType().max(renameSnapshotResponseInitiativesItemRisksItemMitigationMax).optional(),
+      "raisedDate": stringType().regex(renameSnapshotResponseInitiativesItemRisksItemRaisedDateRegExp).optional(),
+      "reviewDate": stringType().regex(renameSnapshotResponseInitiativesItemRisksItemReviewDateRegExp).optional(),
+      "occurredDate": stringType().regex(renameSnapshotResponseInitiativesItemRisksItemOccurredDateRegExp).optional(),
+      "note": stringType().max(renameSnapshotResponseInitiativesItemRisksItemNoteMax).optional()
+    }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(renameSnapshotResponseInitiativesItemRisksMax).optional(),
     "dependsOn": arrayType(stringType()).max(renameSnapshotResponseInitiativesItemDependsOnMax),
     "requiredSkills": arrayType(objectType({
       "skillId": stringType(),
@@ -5301,6 +5427,24 @@ var listInitiativesResponseStatusReportsItemBudgetCommentMax = 1e4;
 var listInitiativesResponseStatusReportsItemSkillsCommentMax = 1e4;
 var listInitiativesResponseStatusReportsItemSummaryMax = 1e4;
 var listInitiativesResponseStatusReportsMax = 1e3;
+var listInitiativesResponseMilestonesItemTitleMax = 300;
+var listInitiativesResponseMilestonesItemBaselineDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listInitiativesResponseMilestonesItemForecastDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listInitiativesResponseMilestonesItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listInitiativesResponseMilestonesItemNoteMax = 1e4;
+var listInitiativesResponseMilestonesMax = 30;
+var listInitiativesResponseRisksItemTitleMax = 300;
+var listInitiativesResponseRisksItemProbabilityMax = 5;
+var listInitiativesResponseRisksItemImpactMax = 5;
+var listInitiativesResponseRisksItemResidualProbabilityMax = 5;
+var listInitiativesResponseRisksItemResidualImpactMax = 5;
+var listInitiativesResponseRisksItemOwnerMax = 300;
+var listInitiativesResponseRisksItemMitigationMax = 1e4;
+var listInitiativesResponseRisksItemRaisedDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listInitiativesResponseRisksItemReviewDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listInitiativesResponseRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listInitiativesResponseRisksItemNoteMax = 1e4;
+var listInitiativesResponseRisksMax = 50;
 var listInitiativesResponseDependsOnMax = 1e3;
 var listInitiativesResponseRequiredSkillsItemRunFteMin = 0;
 var listInitiativesResponseRequiredSkillsMax = 1e3;
@@ -5496,6 +5640,30 @@ var ListInitiativesResponseItem = objectType({
     }),
     "summary": stringType().max(listInitiativesResponseStatusReportsItemSummaryMax).optional()
   })).max(listInitiativesResponseStatusReportsMax).optional(),
+  "milestones": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(listInitiativesResponseMilestonesItemTitleMax),
+    "baselineDate": stringType().regex(listInitiativesResponseMilestonesItemBaselineDateRegExp),
+    "forecastDate": stringType().regex(listInitiativesResponseMilestonesItemForecastDateRegExp).optional(),
+    "doneDate": stringType().regex(listInitiativesResponseMilestonesItemDoneDateRegExp).optional(),
+    "note": stringType().max(listInitiativesResponseMilestonesItemNoteMax).optional()
+  }).describe("A dated intermediate result (docs/milestones-concept-2026-10-17.md). baselineDate is the agreed plan, forecastDate today's expectation (absent = the baseline), doneDate marks it reached; all yyyy-mm-dd.")).max(listInitiativesResponseMilestonesMax).optional(),
+  "risks": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(listInitiativesResponseRisksItemTitleMax),
+    "category": enumType(["delivery", "vendor", "data", "people", "regulatory", "technical", "financial"]),
+    "probability": numberType().min(1).max(listInitiativesResponseRisksItemProbabilityMax),
+    "impact": numberType().min(1).max(listInitiativesResponseRisksItemImpactMax),
+    "residualProbability": numberType().min(1).max(listInitiativesResponseRisksItemResidualProbabilityMax).optional(),
+    "residualImpact": numberType().min(1).max(listInitiativesResponseRisksItemResidualImpactMax).optional(),
+    "status": enumType(["open", "mitigating", "closed", "occurred"]),
+    "owner": stringType().max(listInitiativesResponseRisksItemOwnerMax).optional(),
+    "mitigation": stringType().max(listInitiativesResponseRisksItemMitigationMax).optional(),
+    "raisedDate": stringType().regex(listInitiativesResponseRisksItemRaisedDateRegExp).optional(),
+    "reviewDate": stringType().regex(listInitiativesResponseRisksItemReviewDateRegExp).optional(),
+    "occurredDate": stringType().regex(listInitiativesResponseRisksItemOccurredDateRegExp).optional(),
+    "note": stringType().max(listInitiativesResponseRisksItemNoteMax).optional()
+  }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(listInitiativesResponseRisksMax).optional(),
   "dependsOn": arrayType(stringType()).max(listInitiativesResponseDependsOnMax),
   "requiredSkills": arrayType(objectType({
     "skillId": stringType(),
@@ -5630,6 +5798,24 @@ var createInitiativeBodyOneStatusReportsItemBudgetCommentMax = 1e4;
 var createInitiativeBodyOneStatusReportsItemSkillsCommentMax = 1e4;
 var createInitiativeBodyOneStatusReportsItemSummaryMax = 1e4;
 var createInitiativeBodyOneStatusReportsMax = 1e3;
+var createInitiativeBodyOneMilestonesItemTitleMax = 300;
+var createInitiativeBodyOneMilestonesItemBaselineDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createInitiativeBodyOneMilestonesItemForecastDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createInitiativeBodyOneMilestonesItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createInitiativeBodyOneMilestonesItemNoteMax = 1e4;
+var createInitiativeBodyOneMilestonesMax = 30;
+var createInitiativeBodyOneRisksItemTitleMax = 300;
+var createInitiativeBodyOneRisksItemProbabilityMax = 5;
+var createInitiativeBodyOneRisksItemImpactMax = 5;
+var createInitiativeBodyOneRisksItemResidualProbabilityMax = 5;
+var createInitiativeBodyOneRisksItemResidualImpactMax = 5;
+var createInitiativeBodyOneRisksItemOwnerMax = 300;
+var createInitiativeBodyOneRisksItemMitigationMax = 1e4;
+var createInitiativeBodyOneRisksItemRaisedDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createInitiativeBodyOneRisksItemReviewDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createInitiativeBodyOneRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createInitiativeBodyOneRisksItemNoteMax = 1e4;
+var createInitiativeBodyOneRisksMax = 50;
 var createInitiativeBodyOneDependsOnMax = 1e3;
 var createInitiativeBodyOneRequiredSkillsItemRunFteMin = 0;
 var createInitiativeBodyOneRequiredSkillsMax = 1e3;
@@ -5825,6 +6011,30 @@ var CreateInitiativeBody = objectType({
     }),
     "summary": stringType().max(createInitiativeBodyOneStatusReportsItemSummaryMax).optional()
   })).max(createInitiativeBodyOneStatusReportsMax).optional(),
+  "milestones": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(createInitiativeBodyOneMilestonesItemTitleMax),
+    "baselineDate": stringType().regex(createInitiativeBodyOneMilestonesItemBaselineDateRegExp),
+    "forecastDate": stringType().regex(createInitiativeBodyOneMilestonesItemForecastDateRegExp).optional(),
+    "doneDate": stringType().regex(createInitiativeBodyOneMilestonesItemDoneDateRegExp).optional(),
+    "note": stringType().max(createInitiativeBodyOneMilestonesItemNoteMax).optional()
+  }).describe("A dated intermediate result (docs/milestones-concept-2026-10-17.md). baselineDate is the agreed plan, forecastDate today's expectation (absent = the baseline), doneDate marks it reached; all yyyy-mm-dd.")).max(createInitiativeBodyOneMilestonesMax).optional(),
+  "risks": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(createInitiativeBodyOneRisksItemTitleMax),
+    "category": enumType(["delivery", "vendor", "data", "people", "regulatory", "technical", "financial"]),
+    "probability": numberType().min(1).max(createInitiativeBodyOneRisksItemProbabilityMax),
+    "impact": numberType().min(1).max(createInitiativeBodyOneRisksItemImpactMax),
+    "residualProbability": numberType().min(1).max(createInitiativeBodyOneRisksItemResidualProbabilityMax).optional(),
+    "residualImpact": numberType().min(1).max(createInitiativeBodyOneRisksItemResidualImpactMax).optional(),
+    "status": enumType(["open", "mitigating", "closed", "occurred"]),
+    "owner": stringType().max(createInitiativeBodyOneRisksItemOwnerMax).optional(),
+    "mitigation": stringType().max(createInitiativeBodyOneRisksItemMitigationMax).optional(),
+    "raisedDate": stringType().regex(createInitiativeBodyOneRisksItemRaisedDateRegExp).optional(),
+    "reviewDate": stringType().regex(createInitiativeBodyOneRisksItemReviewDateRegExp).optional(),
+    "occurredDate": stringType().regex(createInitiativeBodyOneRisksItemOccurredDateRegExp).optional(),
+    "note": stringType().max(createInitiativeBodyOneRisksItemNoteMax).optional()
+  }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(createInitiativeBodyOneRisksMax).optional(),
   "dependsOn": arrayType(stringType()).max(createInitiativeBodyOneDependsOnMax),
   "requiredSkills": arrayType(objectType({
     "skillId": stringType(),
@@ -5969,6 +6179,24 @@ var getInitiativeResponseStatusReportsItemBudgetCommentMax = 1e4;
 var getInitiativeResponseStatusReportsItemSkillsCommentMax = 1e4;
 var getInitiativeResponseStatusReportsItemSummaryMax = 1e4;
 var getInitiativeResponseStatusReportsMax = 1e3;
+var getInitiativeResponseMilestonesItemTitleMax = 300;
+var getInitiativeResponseMilestonesItemBaselineDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var getInitiativeResponseMilestonesItemForecastDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var getInitiativeResponseMilestonesItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var getInitiativeResponseMilestonesItemNoteMax = 1e4;
+var getInitiativeResponseMilestonesMax = 30;
+var getInitiativeResponseRisksItemTitleMax = 300;
+var getInitiativeResponseRisksItemProbabilityMax = 5;
+var getInitiativeResponseRisksItemImpactMax = 5;
+var getInitiativeResponseRisksItemResidualProbabilityMax = 5;
+var getInitiativeResponseRisksItemResidualImpactMax = 5;
+var getInitiativeResponseRisksItemOwnerMax = 300;
+var getInitiativeResponseRisksItemMitigationMax = 1e4;
+var getInitiativeResponseRisksItemRaisedDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var getInitiativeResponseRisksItemReviewDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var getInitiativeResponseRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var getInitiativeResponseRisksItemNoteMax = 1e4;
+var getInitiativeResponseRisksMax = 50;
 var getInitiativeResponseDependsOnMax = 1e3;
 var getInitiativeResponseRequiredSkillsItemRunFteMin = 0;
 var getInitiativeResponseRequiredSkillsMax = 1e3;
@@ -6164,6 +6392,30 @@ var GetInitiativeResponse = objectType({
     }),
     "summary": stringType().max(getInitiativeResponseStatusReportsItemSummaryMax).optional()
   })).max(getInitiativeResponseStatusReportsMax).optional(),
+  "milestones": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(getInitiativeResponseMilestonesItemTitleMax),
+    "baselineDate": stringType().regex(getInitiativeResponseMilestonesItemBaselineDateRegExp),
+    "forecastDate": stringType().regex(getInitiativeResponseMilestonesItemForecastDateRegExp).optional(),
+    "doneDate": stringType().regex(getInitiativeResponseMilestonesItemDoneDateRegExp).optional(),
+    "note": stringType().max(getInitiativeResponseMilestonesItemNoteMax).optional()
+  }).describe("A dated intermediate result (docs/milestones-concept-2026-10-17.md). baselineDate is the agreed plan, forecastDate today's expectation (absent = the baseline), doneDate marks it reached; all yyyy-mm-dd.")).max(getInitiativeResponseMilestonesMax).optional(),
+  "risks": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(getInitiativeResponseRisksItemTitleMax),
+    "category": enumType(["delivery", "vendor", "data", "people", "regulatory", "technical", "financial"]),
+    "probability": numberType().min(1).max(getInitiativeResponseRisksItemProbabilityMax),
+    "impact": numberType().min(1).max(getInitiativeResponseRisksItemImpactMax),
+    "residualProbability": numberType().min(1).max(getInitiativeResponseRisksItemResidualProbabilityMax).optional(),
+    "residualImpact": numberType().min(1).max(getInitiativeResponseRisksItemResidualImpactMax).optional(),
+    "status": enumType(["open", "mitigating", "closed", "occurred"]),
+    "owner": stringType().max(getInitiativeResponseRisksItemOwnerMax).optional(),
+    "mitigation": stringType().max(getInitiativeResponseRisksItemMitigationMax).optional(),
+    "raisedDate": stringType().regex(getInitiativeResponseRisksItemRaisedDateRegExp).optional(),
+    "reviewDate": stringType().regex(getInitiativeResponseRisksItemReviewDateRegExp).optional(),
+    "occurredDate": stringType().regex(getInitiativeResponseRisksItemOccurredDateRegExp).optional(),
+    "note": stringType().max(getInitiativeResponseRisksItemNoteMax).optional()
+  }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(getInitiativeResponseRisksMax).optional(),
   "dependsOn": arrayType(stringType()).max(getInitiativeResponseDependsOnMax),
   "requiredSkills": arrayType(objectType({
     "skillId": stringType(),
@@ -6300,6 +6552,24 @@ var updateInitiativeBodyOneStatusReportsItemBudgetCommentMax = 1e4;
 var updateInitiativeBodyOneStatusReportsItemSkillsCommentMax = 1e4;
 var updateInitiativeBodyOneStatusReportsItemSummaryMax = 1e4;
 var updateInitiativeBodyOneStatusReportsMax = 1e3;
+var updateInitiativeBodyOneMilestonesItemTitleMax = 300;
+var updateInitiativeBodyOneMilestonesItemBaselineDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeBodyOneMilestonesItemForecastDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeBodyOneMilestonesItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeBodyOneMilestonesItemNoteMax = 1e4;
+var updateInitiativeBodyOneMilestonesMax = 30;
+var updateInitiativeBodyOneRisksItemTitleMax = 300;
+var updateInitiativeBodyOneRisksItemProbabilityMax = 5;
+var updateInitiativeBodyOneRisksItemImpactMax = 5;
+var updateInitiativeBodyOneRisksItemResidualProbabilityMax = 5;
+var updateInitiativeBodyOneRisksItemResidualImpactMax = 5;
+var updateInitiativeBodyOneRisksItemOwnerMax = 300;
+var updateInitiativeBodyOneRisksItemMitigationMax = 1e4;
+var updateInitiativeBodyOneRisksItemRaisedDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeBodyOneRisksItemReviewDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeBodyOneRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeBodyOneRisksItemNoteMax = 1e4;
+var updateInitiativeBodyOneRisksMax = 50;
 var updateInitiativeBodyOneDependsOnMax = 1e3;
 var updateInitiativeBodyOneRequiredSkillsItemRunFteMin = 0;
 var updateInitiativeBodyOneRequiredSkillsMax = 1e3;
@@ -6495,6 +6765,30 @@ var UpdateInitiativeBody = objectType({
     }),
     "summary": stringType().max(updateInitiativeBodyOneStatusReportsItemSummaryMax).optional()
   })).max(updateInitiativeBodyOneStatusReportsMax).optional(),
+  "milestones": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(updateInitiativeBodyOneMilestonesItemTitleMax),
+    "baselineDate": stringType().regex(updateInitiativeBodyOneMilestonesItemBaselineDateRegExp),
+    "forecastDate": stringType().regex(updateInitiativeBodyOneMilestonesItemForecastDateRegExp).optional(),
+    "doneDate": stringType().regex(updateInitiativeBodyOneMilestonesItemDoneDateRegExp).optional(),
+    "note": stringType().max(updateInitiativeBodyOneMilestonesItemNoteMax).optional()
+  }).describe("A dated intermediate result (docs/milestones-concept-2026-10-17.md). baselineDate is the agreed plan, forecastDate today's expectation (absent = the baseline), doneDate marks it reached; all yyyy-mm-dd.")).max(updateInitiativeBodyOneMilestonesMax).optional(),
+  "risks": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(updateInitiativeBodyOneRisksItemTitleMax),
+    "category": enumType(["delivery", "vendor", "data", "people", "regulatory", "technical", "financial"]),
+    "probability": numberType().min(1).max(updateInitiativeBodyOneRisksItemProbabilityMax),
+    "impact": numberType().min(1).max(updateInitiativeBodyOneRisksItemImpactMax),
+    "residualProbability": numberType().min(1).max(updateInitiativeBodyOneRisksItemResidualProbabilityMax).optional(),
+    "residualImpact": numberType().min(1).max(updateInitiativeBodyOneRisksItemResidualImpactMax).optional(),
+    "status": enumType(["open", "mitigating", "closed", "occurred"]),
+    "owner": stringType().max(updateInitiativeBodyOneRisksItemOwnerMax).optional(),
+    "mitigation": stringType().max(updateInitiativeBodyOneRisksItemMitigationMax).optional(),
+    "raisedDate": stringType().regex(updateInitiativeBodyOneRisksItemRaisedDateRegExp).optional(),
+    "reviewDate": stringType().regex(updateInitiativeBodyOneRisksItemReviewDateRegExp).optional(),
+    "occurredDate": stringType().regex(updateInitiativeBodyOneRisksItemOccurredDateRegExp).optional(),
+    "note": stringType().max(updateInitiativeBodyOneRisksItemNoteMax).optional()
+  }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(updateInitiativeBodyOneRisksMax).optional(),
   "dependsOn": arrayType(stringType()).max(updateInitiativeBodyOneDependsOnMax),
   "requiredSkills": arrayType(objectType({
     "skillId": stringType(),
@@ -6636,6 +6930,24 @@ var updateInitiativeResponseStatusReportsItemBudgetCommentMax = 1e4;
 var updateInitiativeResponseStatusReportsItemSkillsCommentMax = 1e4;
 var updateInitiativeResponseStatusReportsItemSummaryMax = 1e4;
 var updateInitiativeResponseStatusReportsMax = 1e3;
+var updateInitiativeResponseMilestonesItemTitleMax = 300;
+var updateInitiativeResponseMilestonesItemBaselineDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeResponseMilestonesItemForecastDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeResponseMilestonesItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeResponseMilestonesItemNoteMax = 1e4;
+var updateInitiativeResponseMilestonesMax = 30;
+var updateInitiativeResponseRisksItemTitleMax = 300;
+var updateInitiativeResponseRisksItemProbabilityMax = 5;
+var updateInitiativeResponseRisksItemImpactMax = 5;
+var updateInitiativeResponseRisksItemResidualProbabilityMax = 5;
+var updateInitiativeResponseRisksItemResidualImpactMax = 5;
+var updateInitiativeResponseRisksItemOwnerMax = 300;
+var updateInitiativeResponseRisksItemMitigationMax = 1e4;
+var updateInitiativeResponseRisksItemRaisedDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeResponseRisksItemReviewDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeResponseRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeResponseRisksItemNoteMax = 1e4;
+var updateInitiativeResponseRisksMax = 50;
 var updateInitiativeResponseDependsOnMax = 1e3;
 var updateInitiativeResponseRequiredSkillsItemRunFteMin = 0;
 var updateInitiativeResponseRequiredSkillsMax = 1e3;
@@ -6831,6 +7143,30 @@ var UpdateInitiativeResponse = objectType({
     }),
     "summary": stringType().max(updateInitiativeResponseStatusReportsItemSummaryMax).optional()
   })).max(updateInitiativeResponseStatusReportsMax).optional(),
+  "milestones": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(updateInitiativeResponseMilestonesItemTitleMax),
+    "baselineDate": stringType().regex(updateInitiativeResponseMilestonesItemBaselineDateRegExp),
+    "forecastDate": stringType().regex(updateInitiativeResponseMilestonesItemForecastDateRegExp).optional(),
+    "doneDate": stringType().regex(updateInitiativeResponseMilestonesItemDoneDateRegExp).optional(),
+    "note": stringType().max(updateInitiativeResponseMilestonesItemNoteMax).optional()
+  }).describe("A dated intermediate result (docs/milestones-concept-2026-10-17.md). baselineDate is the agreed plan, forecastDate today's expectation (absent = the baseline), doneDate marks it reached; all yyyy-mm-dd.")).max(updateInitiativeResponseMilestonesMax).optional(),
+  "risks": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(updateInitiativeResponseRisksItemTitleMax),
+    "category": enumType(["delivery", "vendor", "data", "people", "regulatory", "technical", "financial"]),
+    "probability": numberType().min(1).max(updateInitiativeResponseRisksItemProbabilityMax),
+    "impact": numberType().min(1).max(updateInitiativeResponseRisksItemImpactMax),
+    "residualProbability": numberType().min(1).max(updateInitiativeResponseRisksItemResidualProbabilityMax).optional(),
+    "residualImpact": numberType().min(1).max(updateInitiativeResponseRisksItemResidualImpactMax).optional(),
+    "status": enumType(["open", "mitigating", "closed", "occurred"]),
+    "owner": stringType().max(updateInitiativeResponseRisksItemOwnerMax).optional(),
+    "mitigation": stringType().max(updateInitiativeResponseRisksItemMitigationMax).optional(),
+    "raisedDate": stringType().regex(updateInitiativeResponseRisksItemRaisedDateRegExp).optional(),
+    "reviewDate": stringType().regex(updateInitiativeResponseRisksItemReviewDateRegExp).optional(),
+    "occurredDate": stringType().regex(updateInitiativeResponseRisksItemOccurredDateRegExp).optional(),
+    "note": stringType().max(updateInitiativeResponseRisksItemNoteMax).optional()
+  }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(updateInitiativeResponseRisksMax).optional(),
   "dependsOn": arrayType(stringType()).max(updateInitiativeResponseDependsOnMax),
   "requiredSkills": arrayType(objectType({
     "skillId": stringType(),
@@ -9434,6 +9770,13 @@ var OPTIONAL_SECTIONS = [
   { key: "economics", hint: { en: "Benefit/cost P10/P50/P90 ranges, ramp, confidence, discount rate", de: "Nutzen/Kosten P10/P50/P90, Ramp, Konfidenz, Diskontsatz" } },
   { key: "decisionLog", hint: { en: "Dated decisions (go/pause/stop/rescope/rebudget/other)", de: "Datierte Entscheidungen" } },
   { key: "statusReports", hint: { en: "Dated RAG reports (scope/timeline/budget/skills)", de: "Datierte RAG-Berichte" } },
+  {
+    key: "milestones",
+    hint: {
+      en: "[{title, baselineDate, forecastDate?, doneDate?, note?}] \u2014 dated intermediate results (pilot live, vendor selected, go-live; at most 30, title up to 300 characters). baselineDate is the agreed plan; forecastDate today's expectation when it differs; doneDate once reached. Ask for the 3\u20135 that the steering committee watches. On an update, send every milestone the initiative keeps: the file replaces the list.",
+      de: "[{title, baselineDate, forecastDate?, doneDate?, note?}] \u2014 datierte Zwischenergebnisse (Pilot live, Anbieter gew\xE4hlt, Go-live; h\xF6chstens 30, Titel bis 300 Zeichen). baselineDate ist der vereinbarte Plan, forecastDate die heutige Erwartung, wenn sie abweicht, doneDate sobald erreicht. Nach den 3\u20135 fragen, die der Lenkungsausschuss verfolgt. Bei einem Update alle Meilensteine senden, die bleiben sollen: die Datei ersetzt die Liste."
+    }
+  },
   {
     key: "capabilityImpacts",
     hint: {
@@ -9493,7 +9836,7 @@ function describeZodShape(schema, depth = 0) {
 }
 function buildSchemaDescriptor(sectionShapes) {
   return {
-    about: "BICon initiative composer. Collect the required fields, then rate every sub-dimension 0\u2013100 (higher = more of the named quality) and a confidence per dimension. Dimension scores are DERIVED (mean of subs) \u2014 never ask the user for them. Values are used verbatim; enum values must match exactly; unknown keys are rejected. Dates: talk dd/mm/yyyy with the user (dd/mm/yyyy, dd.mm.yyyy and yyyy-mm-dd are all accepted; stored as yyyy-mm-dd). Row ids of decision-log entries, status reports and incidents are minted by the Composer \u2014 never invent ids. To UPDATE an existing initiative pass its id as `id`; omit it for a new one.",
+    about: "BICon initiative composer. Collect the required fields, then rate every sub-dimension 0\u2013100 (higher = more of the named quality) and a confidence per dimension. Dimension scores are DERIVED (mean of subs) \u2014 never ask the user for them. Values are used verbatim; enum values must match exactly; unknown keys are rejected. Dates: talk dd/mm/yyyy with the user (dd/mm/yyyy, dd.mm.yyyy and yyyy-mm-dd are all accepted; stored as yyyy-mm-dd). Row ids of decision-log entries, status reports, milestones and incidents are minted by the Composer \u2014 never invent ids. To UPDATE an existing initiative pass its id as `id`; omit it for a new one.",
     requiredFields: REQUIRED_FIELDS,
     enums: {
       status: STATUS_VALUES,
@@ -9525,7 +9868,7 @@ function buildSchemaDescriptor(sectionShapes) {
     },
     optionalSections: OPTIONAL_SECTIONS,
     // Exact shapes of the object/array sections (aiAct, economics, actuals,
-    // decisionLog, statusReports, requiredSkills, capabilityImpacts). Keys ending in "?" are
+    // decisionLog, statusReports, requiredSkills, capabilityImpacts, milestones). Keys ending in "?" are
     // optional; "enum[a|b]" lists the allowed values; "<key>" marks a map.
     // Pass these sections as JSON objects/arrays. Any key not listed is
     // rejected with its path.
@@ -9621,7 +9964,7 @@ var parseIfString = (v) => typeof v === "string" ? tryParseJson(v) : v;
 function wireSection(inner, description) {
   return external_exports.preprocess(parseIfString, deepStrict(inner)).describe(description);
 }
-var SECTION_KEYS = ["aiAct", "economics", "actuals", "decisionLog", "statusReports", "requiredSkills", "capabilityImpacts"];
+var SECTION_KEYS = ["aiAct", "economics", "actuals", "decisionLog", "statusReports", "requiredSkills", "capabilityImpacts", "milestones"];
 var SECTION_SCHEMAS = Object.fromEntries(
   SECTION_KEYS.map((k) => [k, contractSection(k)])
 );
@@ -9632,6 +9975,7 @@ var SECTION_DESCRIPTIONS = {
   decisionLog: "Decision log entries \u2014 see sectionShapes.decisionLog. Entry ids are minted by the Composer \u2014 leave them out. Dates dd/mm/yyyy or yyyy-mm-dd.",
   statusReports: "Status reports \u2014 see sectionShapes.statusReports. Report ids are minted by the Composer \u2014 leave them out. Dates dd/mm/yyyy or yyyy-mm-dd.",
   capabilityImpacts: "Capability links [{capabilityId, kind: improve|new|replace|retire, maturityTo?}]. maturityTo 1\u20135 = level reached (omit = the capability's target; never for retire). capabilityId: a capability of the map, from read_portfolio_context \u2192 lists.capabilities; without the context leave the list empty.",
+  milestones: "Milestones (max 30, title \u2264300 chars): baselineDate = the plan, forecastDate = today's expectation (omit = baseline), doneDate = reached. Dates dd/mm/yyyy or yyyy-mm-dd; ids minted. An update replaces the list: send all.",
   requiredSkills: "Required skills [{skillId, fte, runFte?}] \u2014 fte is the build-phase demand, the optional runFte the run-team demand after the planned end (absent = build fte continues, 0 = no run demand). skillId must be the id of a skill that exists in the organisation. With the portfolio context the Composer validates it (read_portfolio_context \u2192 lists.skills gives id + name); without it, leave the list empty and link skills in the app."
 };
 var contextWire = () => external_exports.preprocess(parseIfString, external_exports.union([external_exports.string().regex(/^ctx_[0-9a-f]{16}$/, "a contextId looks like ctx_<16 hex>"), external_exports.object({}).passthrough()]));
@@ -9676,6 +10020,7 @@ var compactSpecSchema = external_exports.object({
   statusReports: wireSection(SECTION_SCHEMAS.statusReports, SECTION_DESCRIPTIONS.statusReports).optional(),
   requiredSkills: wireSection(SECTION_SCHEMAS.requiredSkills, SECTION_DESCRIPTIONS.requiredSkills).optional(),
   capabilityImpacts: wireSection(SECTION_SCHEMAS.capabilityImpacts, SECTION_DESCRIPTIONS.capabilityImpacts).optional(),
+  milestones: wireSection(SECTION_SCHEMAS.milestones, SECTION_DESCRIPTIONS.milestones).optional(),
   aiRiskTier: external_exports.enum(AI_RISK_TIERS).optional(),
   hitlPosture: external_exports.enum(HITL_POSTURES).optional(),
   dpiaStatus: external_exports.enum(DPIA_STATUSES).optional(),
@@ -10047,8 +10392,11 @@ function checkAiActVocabularies(block, errors) {
 }
 function mintNestedIds(rows, stamp, withStamps = false) {
   if (!rows) return void 0;
+  const seen = /* @__PURE__ */ new Set();
   return rows.map((r) => {
-    const next = { ...r, id: isUuid(r.id) ? r.id : randomUUID() };
+    const id = isUuid(r.id) && !seen.has(r.id) ? r.id : randomUUID();
+    seen.add(id);
+    const next = { ...r, id };
     if (withStamps) {
       if (!next.createdAt) next.createdAt = stamp;
       if (!next.updatedAt) next.updatedAt = stamp;
@@ -10095,6 +10443,31 @@ function assembleInitiative(input, now = /* @__PURE__ */ new Date()) {
     if (link.kind === "retire" && link.maturityTo !== void 0) errors.push(`capabilityImpacts.${i}.maturityTo: a retire link has no target level \u2014 omit maturityTo.`);
     else if (link.maturityTo !== void 0 && !Number.isInteger(link.maturityTo)) errors.push(`capabilityImpacts.${i}.maturityTo: must be a whole number 1\u20135 (got ${link.maturityTo}).`);
   }
+  const milestones = spec.milestones ?? [];
+  const pad = (n) => String(n).padStart(2, "0");
+  const today = `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`;
+  for (const [i, m] of milestones.entries()) {
+    if (!m.title.trim()) errors.push(`milestones.${i}.title: must not be empty (got only spaces).`);
+    for (const field of ["baselineDate", "forecastDate", "doneDate"]) {
+      const v = m[field];
+      if (v !== void 0 && !isCalendarDate(v)) errors.push(`milestones.${i}.${field}: "${v}" is not a real calendar date \u2014 dd/mm/yyyy or yyyy-mm-dd`);
+    }
+    const due = m.doneDate ?? m.forecastDate ?? m.baselineDate;
+    if (isCalendarDate(due) && (spec.timelineStart && due < spec.timelineStart || spec.timelineEnd && due > spec.timelineEnd)) {
+      warnings.push(`milestones.${i}: "${m.title.trim()}" falls on ${due}, outside the timeline ${spec.timelineStart} \u2013 ${spec.timelineEnd}.`);
+    }
+    if (m.doneDate && isCalendarDate(m.doneDate) && m.doneDate > today) warnings.push(`milestones.${i}.doneDate: ${m.doneDate} lies in the future \u2014 a done date marks a milestone already reached.`);
+  }
+  const norm2 = (v) => (v ?? "").trim().toLowerCase();
+  const others = context?.initiatives ?? [];
+  const ext = norm2(spec.externalId);
+  const updates = spec.id !== void 0 || !!ext && others.filter((x) => norm2(x.externalId) === ext).length === 1 || others.some((x) => norm2(x.name) === norm2(spec.name));
+  if (updates && spec.milestones === void 0) {
+    warnings.push("milestones: none sent, and the app will offer this file as an update \u2014 it replaces the initiative's milestones, so any the app holds are removed. Send the full list to keep them.");
+  }
+  if (updates) {
+    warnings.push("risks: this file cannot carry risks, and the app will offer it as an update \u2014 any risks the app holds for this initiative are removed. Re-enter them in the app after the import, or add the initiative's details there instead.");
+  }
   let businessUnit = spec.businessUnit;
   let aiCategory = spec.aiCategory;
   if (context) {
@@ -10145,6 +10518,7 @@ function assembleInitiative(input, now = /* @__PURE__ */ new Date()) {
     evaluation,
     decisionLog: mintNestedIds(spec.decisionLog, stamp),
     statusReports: mintNestedIds(spec.statusReports, stamp),
+    milestones: mintNestedIds(spec.milestones, stamp)?.map((m) => ({ ...m, title: m.title.trim() })),
     aiAct: aiAct ? { ...aiAct, ...aiAct.incidents ? { incidents: mintNestedIds(aiAct.incidents, stamp, true) } : {} } : void 0,
     createdAt: stamp,
     updatedAt: stamp
@@ -10214,7 +10588,7 @@ function createServer() {
     async () => text({
       capabilities: [
         "strict typed schemas: unknown keys anywhere in the spec are rejected with their exact path (never silently dropped)",
-        "sections (aiAct/economics/actuals/decisionLog/statusReports/requiredSkills/capabilityImpacts) accept a JSON object/array or the same JSON as a string; row ids are minted by the Composer",
+        "sections (aiAct/economics/actuals/decisionLog/statusReports/requiredSkills/capabilityImpacts/milestones) accept a JSON object/array or the same JSON as a string; row ids are minted by the Composer",
         "dates accepted as dd/mm/yyyy, dd.mm.yyyy or yyyy-mm-dd (stored as yyyy-mm-dd)",
         "get_initiative_schema: sectionShapes, aiActVocabularies, portfolio-mode wording overlays",
         "AI-Act vocabulary and id-format enforcement with the allowed values in the error",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bicon/mcp-composer",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "MCP server that helps an AI client compose a valid BICon portfolio initiative and hand it back as an import file (draft-first, no auth, no API calls).",
   "license": "UNLICENSED",
   "author": "BICon Establishment",