@bridge_gpt/mcp-server 0.2.21 → 0.2.24

package/docs/install/mcp-tool-integrations.md

@@ -0,0 +1,305 @@
+# MCP Tools — Integration Dependencies
+
+This catalog lists every tool exposed by the Bridge API MCP server
+(`@bridge_gpt/mcp-server`) and the external integrations each one depends on. It
+answers a single operational question: *before I call this tool, what needs to be
+connected, and what happens if it isn't?*
+
+For the tool **reference** (parameters, endpoints, examples) see the
+[package README](../../README.md). The dependency classes below are not editorial —
+they mirror the enforced policy in the Bridge API backend
+(`api/library/vcs/vcs_route_operations.py`, the single source of truth for
+route → capability gating, and its probes in `api/library/vcs/vcs_preflight.py`).
+
+## Two dependency classes
+
+- **BLOCK** — the tool refuses, or its output is untrustworthy enough that it should
+  not be used, without the integration. This covers both hard blockers (the backend
+  returns a refusal) and "no local alternative" tools. Codebase-grounded generators
+  are blocked on an unindexed repo on purpose: *"plan output on an unindexed repo is
+  worthless"* (`api/routes/jira_api.py`). In code, BLOCK ≈ `VCS_ROUTE_REQUIREMENTS`
+  (VCS-credential refusal) + `INDEX_REQUIRED_ROUTE_KEYS` (parse/index refusal).
+
+- **DEGRADE** — the tool still runs and returns useful output, but quality is weaker
+  without the integration. In code, DEGRADE ≈ `VCS_ROUTE_WARNINGS` (Tier-4
+  "warn, never block"): the shared research helper `plan_researcher` returns *empty*
+  code research instead of erroring, so the tool falls back to ticket text alone and
+  attaches a non-blocking disclosure.
+
+**Baseline (assumed for every tool, not repeated below):** every non-`LOCAL` tool
+needs the Bridge API reachable plus a valid API key with repo access
+(`verify_repo_access`); every AI tool needs an LLM provider (platform-managed).
+`LOCAL` tools make no backend call at all. A tool with no integration dependency is
+marked **— none**.
+
+## Integrations glossary
+
+| Integration | What "connected" means | Where configured |
+|---|---|---|
+| **Ticket backend** | A ticket store in the repo's `ticket_backend_mode` — `jira` (Jira connection) or `local` (Postgres, no external service). Default is `jira`. | `config_projects.ticket_backend_mode`; Jira token in `config_projects_access` |
+| **Jira (only)** | A live Jira connection specifically — for surfaces with no local-mode equivalent (comment threads, binary attachments). | `config_projects_access.jira_api_token` |
+| **Version control (VCS)** | GitHub App or Bitbucket credentials for the repo. | `git_app_installation_id` / `git_app_owner` (GitHub) or `workspace` / `version_control_access_token` (Bitbucket) |
+| **Code index** | A **succeeded** `parse_repository` run (Pinecone code embeddings). A repo can have valid VCS creds yet never have been parsed. | `config_projects_access.pinecone_index_name`; status in `repository_parse_runs` / `code_repositories` |
+| **SFCC OCAPI** | Salesforce B2C sandbox OCAPI access: `dw.json` / AM token + `version` config field + OCAPI grants. | `dw.json`, `version` config field, OCAPI data-API grants |
+| **SFCC WebDAV logs** | WebDAV log credentials (separate from OCAPI) plus the `sfcc_log_monitor_enabled` flag. | `sfcc_webdav_hostname/username/access_key`, `sfcc_log_monitor_enabled` |
+| **Deep-research flag** | The `deep_research_enabled` config flag on the project (403 otherwise). Web research runs via Gemini/OpenAI. | `config_projects.deep_research_enabled` |
+| **Image provider** | An image model provider (OpenAI DALL·E / Google Imagen). | platform provider config |
+| **Conductor ledger** | The local conductor event ledger (`~/.config/bridge/events.db`) — a local file, not a remote service. | local file |
+
+## Profiles (a form of BLOCK)
+
+The server registers **90 tools** total, gated by `BRIDGE_MCP_PROFILE`
+(comma-separated group list, resolved once at startup by
+`mcp_server/src/mcp-profile.ts`). A tool outside
+the active profile is **not registered at all** — an absolute block until the group is
+activated. `core` is always implicitly included.
+
+| Profile | Tools | Registered when |
+|---|---|---|
+| `core` | **57** | always |
+| `pipeline-authoring` | **+5** | `BRIDGE_MCP_PROFILE` includes `pipeline-authoring` or `full` |
+| `conductor` | **+8** | includes `conductor` or `full` |
+| `sfcc` | **+20** (2 diagnostics ship in `core`; 18 gated) | includes `sfcc` or `full` |
+
+(57 core + 5 + 8 + 20 = 90. The 5 pipeline-authoring tools live in `index.ts` alongside
+core, gated by `ACTIVE_GROUPS.has("pipeline-authoring")`, so `index.ts` holds 62
+`registerTool` calls.)
+
+---
+
+## Core profile (57)
+
+### Connectivity, config & setup — no integration deps
+
+These are never gated (`NEVER_GATED_ROUTE_KEYS`) or run entirely locally.
+
+| Tool | Dependencies (class) |
+|---|---|
+| `ping` | — none |
+| `get_project_standards` | — none |
+| `get_my_role` | — none |
+| `config_field` (get/update/list) | — none |
+| `get_install_manifest` | — none |
+| `apply_install_manifest` | — none |
+| `persist_routing_credential` | — none (`LOCAL`) |
+| `get_docs_dir` | — none (`LOCAL`) |
+| `get_parse_status` | — none |
+| `track_ticket` | — none (Bridge DB tracking record) |
+| `update_ticket_state` | — none (Bridge DB) |
+| `get_ticket_state` | — none (Bridge DB) |
+| `get_ticket_model_tier` | — none (Bridge DB difficulty) |
+| `get_pipeline_recipe` | — none (`LOCAL`, bundled recipes) |
+| `generate_decision_page` | — none (`LOCAL` HTML) |
+| `cleanup_fresh_base` | — none (`LOCAL`) |
+
+### Ticket CRUD — ticket backend
+
+Backend-agnostic (work in `jira` **or** `local` mode; Jira-named for v1 compatibility).
+BLOCK applies only in `jira` mode without a Jira connection — `local` mode needs no
+external integration.
+
+| Tool | Dependencies (class) |
+|---|---|
+| `create_ticket` | Ticket backend **[BLOCK in jira mode]** |
+| `get_tickets` | Ticket backend **[BLOCK in jira mode]** |
+| `get_ticket` | Ticket backend **[BLOCK in jira mode]** |
+| `update_ticket_description` | Ticket backend **[BLOCK in jira mode]** |
+| `update_jira_status` | Ticket backend **[BLOCK in jira mode]** (local sets a fixed status) |
+| `get_jira_transitions` | Ticket backend **[BLOCK in jira mode]** (local returns fixed statuses) |
+
+Jira-only — no local-mode equivalent (comment threads and binary attachments are out of
+scope for local v1):
+
+| Tool | Dependencies (class) |
+|---|---|
+| `get_comments` | Jira (only) **[BLOCK]** |
+| `add_comment` | Jira (only) **[BLOCK]** |
+| `attachment` (upload/download/list) | Jira (only) **[BLOCK]** |
+
+### AI ticket-artifact generators — ticket backend + VCS + code index
+
+All read the ticket through the ticket-store seam (`_fetch_ticket_webhook_payload` →
+`ticket_store_lib.get_ticket`, which the local store fully supports), so they run in
+`local` mode too — they are **not** hard-Jira-blocked. Their VCS/index behavior splits
+by tier.
+
+**Tier-3 — codebase-grounded (refuse without VCS creds AND a succeeded parse):**
+
+| Tool (request / retrieve) | Dependencies (class) |
+|---|---|
+| `request_plan_generation` / `get_plan` | Ticket backend [BLOCK in jira mode] · VCS **[BLOCK]** · Code index **[BLOCK]** |
+| `request_architecture` / `get_architecture` | Ticket backend [BLOCK in jira mode] · VCS **[BLOCK]** · Code index **[BLOCK]** |
+| `request_reimplement_context` / `get_reimplement_context` | Ticket backend [BLOCK in jira mode] · VCS **[BLOCK]** · Code index **[BLOCK]** |
+| `create_doc` / `get_doc` — `doc_type` ∈ {tdd, architecture} | Ticket backend [BLOCK in jira mode] · VCS **[BLOCK]** · Code index **[BLOCK]** |
+
+**Tier-4 — ticket-text (warn, never block; research empties without index):**
+
+| Tool (request / retrieve) | Dependencies (class) |
+|---|---|
+| `request_clarifying_questions` / `get_clarifying_questions` | Ticket backend [BLOCK in jira mode] · VCS **[DEGRADE]** · Code index **[DEGRADE]** |
+| `request_ticket_critique` / `get_ticket_critique` | Ticket backend [BLOCK in jira mode] · VCS **[DEGRADE]** · Code index **[DEGRADE]** |
+| `request_ticket_review` | Ticket backend [BLOCK in jira mode] · VCS **[DEGRADE]** · Code index **[DEGRADE]** |
+| `request_prd` / `get_prd` | Ticket backend [BLOCK in jira mode] · VCS **[DEGRADE]** · Code index **[DEGRADE]** |
+| `create_doc` / `get_doc` — `doc_type` ∈ {prd, fsd} | Ticket backend [BLOCK in jira mode] · VCS **[DEGRADE]** · Code index **[DEGRADE]** |
+
+**Estimation:**
+
+| Tool | Dependencies (class) |
+|---|---|
+| `estimate_epic` | Jira **[BLOCK]** (resolves the repo from `jira_ticket_key`); no code-index dep |
+
+### Repository parse / index — VCS
+
+| Tool | Dependencies (class) |
+|---|---|
+| `parse_repository` | VCS **[BLOCK]** (Tier-2; refuses without a VCS connection — it *produces* the index) |
+| `regenerate_directory_map` | VCS **[BLOCK]** (Tier-2) |
+
+### LLM utilities & research
+
+| Tool | Dependencies (class) |
+|---|---|
+| `second_opinion` | — none (pure LLM; repo access only) |
+| `generate_image` | — none beyond an image provider |
+| `visual_diff` | — none (`LOCAL` render + pixel diff; needs a reachable `target_url`) |
+| `request_deep_research` / `get_deep_research` | Deep-research flag **[BLOCK]** (403 if `deep_research_enabled` off) |
+| `request_brainstorm` / `get_brainstorm` | Code index **[BLOCK] for `technical`/`discovery` modes**; **— none for `design` mode** |
+
+### VCS & CI
+
+| Tool | Dependencies (class) |
+|---|---|
+| `create_pull_request` | VCS **[BLOCK]** (Tier-1) |
+| `resolve_ci_checks` | VCS **[BLOCK]** (Tier-1) |
+| `poll_ci_checks` | VCS **[BLOCK]** (Tier-1); also **hidden until `ci_check_config` is resolved** (needs a prior `resolve_ci_checks`) |
+| `materialize_fresh_base` | VCS / git base ref **[BLOCK]** (Tier-1; materializes a pinned base tree) |
+
+### Full-automation (composite)
+
+These orchestrate an idea → ticket → review → start chain, so they inherit the
+**strictest** dependency of every child step.
+
+| Tool | Dependencies (class) |
+|---|---|
+| `run_full_automation` | Ticket backend [BLOCK in jira mode] · VCS **[BLOCK]** · Code index **[BLOCK]** (via child plan/review steps) |
+| `resume_full_automation` | Same as `run_full_automation` |
+
+---
+
+## `pipeline-authoring` profile (5)
+
+Profile-gated **[BLOCK]** to register at all. `run_pipeline` / `resume_pipeline`
+additionally inherit the dependencies of whatever steps the invoked pipeline runs
+(e.g. the `implement-ticket` pipeline pulls in ticket-backend + VCS + code-index deps).
+Run state is persisted via the Bridge API.
+
+| Tool | Dependencies (class) |
+|---|---|
+| `list_pipelines` | Profile-gated **[BLOCK]** |
+| `run_pipeline` | Profile-gated **[BLOCK]** · inherits invoked pipeline's step deps |
+| `resume_pipeline` | Profile-gated **[BLOCK]** · inherits invoked pipeline's step deps |
+| `list_pipeline_runs` | Profile-gated **[BLOCK]** |
+| `delete_pipeline_run` | Profile-gated **[BLOCK]** |
+
+---
+
+## `conductor` profile (8)
+
+Profile-gated **[BLOCK]** to register. Most operate on the **local** conductor ledger
+(`~/.config/bridge/events.db`), so beyond the profile gate they have no remote
+integration dependency.
+
+| Tool | Dependencies (class) |
+|---|---|
+| `emit_event` | Profile-gated **[BLOCK]**; else `LOCAL` ledger |
+| `poll_events` | Profile-gated **[BLOCK]**; else `LOCAL` ledger |
+| `wait_for_event` | Profile-gated **[BLOCK]**; else `LOCAL` ledger |
+| `get_supervisor_snapshot` | Profile-gated **[BLOCK]**; else `LOCAL` ledger |
+| `send_message` | Profile-gated **[BLOCK]**; else `LOCAL` relay |
+| `check_messages` | Profile-gated **[BLOCK]**; else `LOCAL` relay |
+| `get_epic_snapshot` | Profile-gated **[BLOCK]** · Bridge API epic snapshot (Jira epic keys) |
+| `wait_for_done_gate` | Profile-gated **[BLOCK]** · VCS **[BLOCK]** (resolves PR number + head SHA) |
+
+---
+
+## `sfcc` group (20)
+
+### Always-on diagnostics (ship in `core`)
+
+| Tool | Dependencies (class) |
+|---|---|
+| `sfcc_setup_status` | — none (its purpose is to report which SFCC prerequisites are missing) |
+| `check_permissions` | SFCC OCAPI **[BLOCK]** (probes OCAPI; reports not-OK without access / version config) |
+
+### Gated behind the `sfcc` group (18)
+
+All are profile-gated **[BLOCK]** to register, and all require SFCC OCAPI creds +
+`version` config + a reachable sandbox → SFCC OCAPI **[BLOCK]**. Writes are
+sandbox-only and destructive.
+
+**Reads (8):**
+
+| Tool | Dependencies (class) |
+|---|---|
+| `system_object_list` | Profile-gated **[BLOCK]** · SFCC OCAPI **[BLOCK]** |
+| `system_object_get` | Profile-gated **[BLOCK]** · SFCC OCAPI **[BLOCK]** |
+| `system_object_attribute_search` | Profile-gated **[BLOCK]** · SFCC OCAPI **[BLOCK]** |
+| `custom_object_definition_attributes_get` | Profile-gated **[BLOCK]** · SFCC OCAPI **[BLOCK]** |
+| `custom_object_definition_attribute_search` | Profile-gated **[BLOCK]** · SFCC OCAPI **[BLOCK]** |
+| `site_preference_group_list` | Profile-gated **[BLOCK]** · SFCC OCAPI **[BLOCK]** |
+| `site_preference_get` | Profile-gated **[BLOCK]** · SFCC OCAPI **[BLOCK]** |
+| `site_preference_search` | Profile-gated **[BLOCK]** · SFCC OCAPI **[BLOCK]** |
+
+**Writes (9, sandbox-only):**
+
+| Tool | Dependencies (class) |
+|---|---|
+| `system_object_attribute_definition_create` | Profile-gated **[BLOCK]** · SFCC OCAPI write **[BLOCK]** |
+| `system_object_attribute_definition_update` | Profile-gated **[BLOCK]** · SFCC OCAPI write **[BLOCK]** |
+| `system_object_attribute_group_create` | Profile-gated **[BLOCK]** · SFCC OCAPI write **[BLOCK]** |
+| `system_object_attribute_group_update` | Profile-gated **[BLOCK]** · SFCC OCAPI write **[BLOCK]** |
+| `system_object_attribute_assign_to_group` | Profile-gated **[BLOCK]** · SFCC OCAPI write **[BLOCK]** |
+| `custom_preference_definition_create` | Profile-gated **[BLOCK]** · SFCC OCAPI write **[BLOCK]** |
+| `custom_object_definition_attribute_create` | Profile-gated **[BLOCK]** · SFCC OCAPI write **[BLOCK]** |
+| `custom_object_definition_attribute_update` | Profile-gated **[BLOCK]** · SFCC OCAPI write **[BLOCK]** |
+| `site_preference_values_set` | Profile-gated **[BLOCK]** · SFCC OCAPI write **[BLOCK]** |
+
+**Logs (1):**
+
+| Tool | Dependencies (class) |
+|---|---|
+| `sfcc_log_query` | Profile-gated **[BLOCK]** · SFCC WebDAV creds **[BLOCK]** · `sfcc_log_monitor_enabled` **[BLOCK]** · required `environment` scope |
+
+---
+
+## Quick matrix: integration → dependent tools
+
+| Integration | BLOCK without it | DEGRADE without it |
+|---|---|---|
+| **Ticket backend** (jira mode) | `create_ticket`, `get_ticket(s)`, `update_ticket_description`, `update_jira_status`, `get_jira_transitions`, and every AI generator (they read the ticket) | — |
+| **Jira (only)** | `get_comments`, `add_comment`, `attachment`, `estimate_epic` | — |
+| **Version control (VCS)** | `create_pull_request`, `resolve_ci_checks`, `poll_ci_checks`, `materialize_fresh_base`, `parse_repository`, `regenerate_directory_map`, `wait_for_done_gate`; **Tier-3** `request_plan_generation`/`get_plan`, `request_architecture`/`get_architecture`, `request_reimplement_context`/`get_reimplement_context`, `create_doc`(tdd/architecture) | **Tier-4** `request_clarifying_questions`, `request_ticket_critique`, `request_ticket_review`, `request_prd`, `create_doc`(prd/fsd) |
+| **Code index** (succeeded parse) | Tier-3 plan/architecture/reimplement/`create_doc`(tdd/architecture); `request_brainstorm` in `technical`/`discovery` modes | Tier-4 clarifying-questions/critique/review/prd/fsd |
+| **SFCC OCAPI** | `check_permissions` + all 16 SFCC read/write tools | — |
+| **SFCC WebDAV logs** | `sfcc_log_query` | — |
+| **Deep-research flag** | `request_deep_research`, `get_deep_research` | — |
+| **Profile gating** | all `pipeline-authoring` (5), `conductor` (8), gated `sfcc` (18) tools | — |
+
+## Notes & caveats
+
+- **Refusals are graceful.** VCS/index BLOCKs are enforced by
+  `build_vcs_preflight_refusal_response`; they return a refusal in the route's normal
+  success-class status (e.g. 202 for job-submit routes) rather than a new 4xx/5xx, so a
+  capability gap never looks like a server error.
+- **DEGRADE is deliberately non-fatal.** Tier-4 tools attach a disclosure via
+  `build_vcs_preflight_warning_disclosure`; `plan_researcher` returns empty research on
+  an unindexed repo instead of raising — the same fallback the Tier-3 routes rely on.
+- **Index check fails open.** A transient DB error during the index probe collapses to
+  "available" (blocking an indexed repo on a flaky read is worse than a rare ungrounded
+  generation). Legacy repos parsed before `repository_parse_runs` existed fall back to a
+  `code_repositories` existence check and are not falsely refused.
+- **Ticket-backend default is `jira`.** The seam is fail-safe: any config/DAL problem
+  resolves to `jira`, so a misconfigured repo behaves as jira-mode (and thus BLOCKs
+  without a Jira connection) rather than silently using local.
+- **Baseline is assumed.** A reachable Bridge API + valid API key (and, for AI tools, an
+  LLM provider) underlies everything above and is not listed per tool.

package/docs/install/sfcc-integration.md

@@ -0,0 +1,140 @@
+# Installing the SFCC Integration (OCAPI)
+
+Bridge's Salesforce B2C Commerce (SFCC) tools give an AI coding agent read access to
+a sandbox's object model, custom object definitions, and site preferences — plus a
+small set of sandbox-only writes — through the **OCAPI Data API**. This guide covers
+setting up the OCAPI client that those tools authenticate against.
+
+> **Sandbox / local development only.** This integration is intended for a **developer
+> sandbox**. The tools reject non-sandbox instances, and the permissions grant below is
+> deliberately broad (all methods, all resources) — appropriate for a throwaway dev
+> sandbox, **never** for staging or production. Do not configure this grant on any
+> instance that holds real data. Credentials stay local (in `dw.json` or `SFCC_*` env
+> vars) and are never sent to Bridge.
+
+For the full per-tool list and what each SFCC tool depends on, see
+[MCP Tool Integration Dependencies](./mcp-tool-integrations.md). For the tool reference
+and the `BRIDGE_MCP_PROFILE` gating, see the SFCC section of the
+[package README](../../README.md).
+
+## Prerequisites
+
+- A running SFCC **developer sandbox** and its hostname
+  (e.g. `zzzz-001.sandbox.us01.dx.commercecloud.salesforce.com`).
+- An **Account Manager API client** — a `client-id` and `client-secret`. This is the
+  OCAPI client the tools use to obtain an OAuth token. Create one in Account Manager
+  (**API Client** → *Add API Client*) if you don't already have it, and note its
+  `client_id`.
+- Business Manager access to the sandbox with permission to edit **Open Commerce API
+  Settings**.
+
+## 1. Grant the OCAPI client access in Business Manager
+
+In Business Manager for the sandbox:
+
+**Administration → Site Development → Open Commerce API Settings → Data API** tab.
+
+Add the following client entry to the `clients` array of the Data API settings, then
+**Save**. This grants the client full read/write access to every Data API resource —
+acceptable only on a developer sandbox:
+
+```json
+{
+  "client_id": "<your-client-id-here>",
+  "resources": [
+    {
+      "methods": ["get", "post", "put", "patch", "delete"],
+      "read_attributes": "(**)",
+      "write_attributes": "(**)",
+      "resource_id": "/**"
+    }
+  ]
+}
+```
+
+Notes:
+
+- The `client_id` **must match** the Account Manager API client whose credentials you
+  put in `dw.json` / `SFCC_*` below. Replace the value above with your own client id if
+  it differs.
+- If the Data API settings are empty, wrap the entry in the standard settings envelope:
+
+  ```json
+  {
+    "_v": "23.2",
+    "clients": [
+      {
+        "client_id": "<your-client-id-here>",
+        "resources": [
+          {
+            "methods": ["get", "post", "put", "patch", "delete"],
+            "read_attributes": "(**)",
+            "write_attributes": "(**)",
+            "resource_id": "/**"
+          }
+        ]
+      }
+    ]
+  }
+  ```
+
+- `check_permissions` (below) prints a ready-to-paste grant JSON on a 401/403, so you can
+  also let the tool tell you exactly what to add.
+
+## 2. Provide credentials locally
+
+Create a `dw.json` in your project root (auto-added to git exclude — never commit it):
+
+```json
+{
+  "hostname": "zzzz-001.sandbox.us01.dx.commercecloud.salesforce.com",
+  "client-id": "<your-client-id-here>",
+  "client-secret": "<account-manager-client-secret>"
+}
+```
+
+Accepted key spellings: `hostname`/`host`, `client-id`/`clientId`/`client_id`,
+`client-secret`/`clientSecret`/`client_secret`. Prefer a single config — a multi-entry
+`configs[]` array forces an explicit `instance` on every call. Alternatively, export
+`SFCC_HOSTNAME` / `SFCC_CLIENT_ID` / `SFCC_CLIENT_SECRET` in the MCP server environment.
+
+## 3. Set the repo `version` config field
+
+Set the repo's `version` config to your SFCC project type — one of
+`sfra | pwakit | sitegenesis | storefrontnext | hybrid`. The call-time gate reads this;
+a non-SFCC value blocks every SFCC tool except `sfcc_setup_status`. Set it via your
+normal config path, the `config_field` MCP tool (operation `update`, field `version`),
+or the `/teach-bridge` skill.
+
+## 4. Enable the SFCC tools
+
+The two diagnostic tools (`sfcc_setup_status`, `check_permissions`) are always
+registered. The read tools, write tools, and `sfcc_log_query` are gated behind the
+`sfcc` profile. Add `sfcc` to `BRIDGE_MCP_PROFILE` in the MCP server `env` block (it is
+comma-separated; `full` also works), then **restart the MCP client**:
+
+```json
+"env": { "BRIDGE_MCP_PROFILE": "sfcc" }
+```
+
+## 5. Verify
+
+Ask your agent to run:
+
+1. `sfcc_setup_status` — expect all prerequisite checks ✓ (Bridge API key, repo name,
+   `version` config, `dw.json` presence/uniqueness, AM/OCAPI token acquisition).
+2. `check_permissions` — probes OCAPI via `GET /system_object_definitions`. A 200 (with
+   the OCAPI version) confirms the grant. On 401/403 it prints the exact grant JSON to
+   paste back in step 1.
+
+Restart the MCP client after any credential, grant, or env change — a running session
+does not pick them up.
+
+## Notes
+
+- **WebDAV logs are separate.** `sfcc_log_query` authenticates with a Business Manager
+  username + a 40-character **WebDAV access key** over HTTP Basic auth — *not* the OCAPI
+  OAuth token configured here. `sfcc_setup_status` reports OCAPI (step 5) and WebDAV
+  (step 6) independently; one can be green while the other is not.
+- **Writes are sandbox-only.** The write tools (attribute/preference create/update) target
+  a developer sandbox and echo a paste-ready grant JSON on a 403.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge_gpt/mcp-server",
-  "version": "0.2.21",
+  "version": "0.2.24",
   "description": "Bridge API MCP server — exposes Jira endpoints as MCP tools for Claude Code agents",
   "license": "MIT",
   "type": "module",
@@ -19,16 +19,16 @@
     "design-assets/",
     "public/",
     "README.md",
-    "CONDUCTOR.md",
+    "docs/",
     "LICENSE"
   ],
   "scripts": {
-    "build": "node scripts/bundle-version.js && node scripts/bundle-readme.js && node scripts/bundle-pipelines.js && node scripts/bundle-commands.js && node scripts/bundle-agents.js && tsc && node scripts/bundle-esbuild.js",
+    "build": "node scripts/bundle-version.js && node scripts/bundle-readme.js && node scripts/bundle-pipelines.js && node scripts/bundle-commands.js && node scripts/bundle-agents.js && node scripts/bundle-docs.js && tsc && node scripts/bundle-esbuild.js",
     "check:version-generated": "node scripts/bundle-version.js && node scripts/check-version-generated.js",
     "postbuild": "node scripts/prepend-shebang.cjs",
     "start": "node build/index.js",
-    "test": "node --test --test-force-exit build/pipeline-utils.test.js build/backend-warnings.test.js build/update-check.test.js build/cli-upgrade.test.js build/decision-page-schema.test.js build/decision-page-template.test.js build/bundle-pipelines.test.js build/instructions-contract.test.js build/pipeline-orchestrator-persistence.test.js build/pipeline-orchestrator-execution.test.js build/pipeline-orchestrator-integration.test.js build/index-static.test.js build/config-fields.static.test.js build/index-resolvers.test.js build/index-project-root.test.js build/index-pipelines.test.js build/index.test.js build/bridge-config.test.js build/credential-store.test.js build/agent-config-credential-migration.test.js build/mcp-invoke.test.js build/mcp-provisioning.test.js build/mcp-server-invocation.test.js build/third-party-mcp-targets.test.js build/git-ignore-utils.test.js build/credential-materialization.test.js build/mcp-registration-doctor.test.js build/secret-safety.test.js build/start-tickets.test.js build/review-tickets.test.js build/start-tickets-base-branch.test.js build/agent-registry.test.js build/agent-registry.model-routing.test.js build/start-tickets.shell-model-routing.test.js build/start-tickets.bridge-api-model-routing.test.js build/start-tickets.tier-fetch-model-routing.test.js build/start-tickets.resolve-model-routing.test.js build/start-tickets.orchestrate-model-routing.test.js build/start-tickets.routing-diagnostics.test.js build/start-tickets-repo.test.js build/start-tickets-credential-invariants.static.test.js build/credentials-cli.test.js build/start-tickets-prereqs.test.js build/regression-check.test.js build/doctor.test.js build/install-doctor.test.js build/install-bridge.test.js build/init.test.js build/resolveUploadAttachment.test.js build/package-static.test.js build/chain-utils.test.js build/chain-orchestrator.test.js build/scheduler-backends/types.test.js build/scheduler-backends/escaping.test.js build/scheduler-backends/launchd.test.js build/scheduler-backends/task-scheduler.test.js build/scheduler-backends/systemd-user.test.js build/scheduler-backends/at-fallback.test.js build/scheduler-backends/index.test.js build/command-catalog.test.js build/scheduled-prompt.test.js build/agent-launchers/claude.test.js build/agent-launchers/cursor.test.js build/agent-launchers/index.test.js build/schedule-store.test.js build/schedule-run.test.js build/agent-capabilities/cli.test.js build/agent-capabilities/runner.test.js build/agent-capabilities/probes.test.js build/agent-capabilities/probe-context.test.js build/agent-capabilities/reporter.test.js build/conductor/taxonomy-and-errors.test.js build/conductor/github-mergeability.test.js build/conductor/merge-conflict-routing.test.js build/conductor/redaction-normalization.test.js build/conductor/claude-hook.test.js build/conductor/git-ci-types.test.js build/conductor/done-gate.test.js build/conductor/git-ci-taxonomy-payload.test.js build/conductor/bridge-api-client.test.js build/conductor/plan.test.js build/conductor/producer-ledger.test.js build/conductor/spec-review-producer.test.js build/conductor/git-producer.test.js build/conductor/git-hooks.test.js build/conductor/store-migration.test.js build/conductor/pr-discovery.test.js build/conductor/pr-ci-producer.test.js build/conductor/pr-review-producer.test.js build/conductor/doctor.test.js build/conductor/deny-enforcement-preflight.test.js build/conductor/errors.test.js build/conductor/store.test.js build/conductor/index-poll-ci-producer.test.js build/start-tickets-conductor.test.js build/start-tickets-conductor.spawn.test.js build/start-tickets-conductor-node-propagation.test.js build/start-tickets.non-mutating-base.test.js build/start-tickets-live-source-guard.test.js build/conductor/worker-ledger-cli.test.js build/conductor/supervisor-config.test.js build/conductor/supervisor-ledger.test.js build/conductor/supervisor-state-reducer.test.js build/conductor/supervisor-housekeeping-projection.test.js build/conductor/supervisor-escalation.test.js build/conductor/supervisor-retired-judgment.static.test.js build/conductor/supervisor-runtime.test.js build/conductor/supervisor-store-projection.test.js build/conductor/supervisor-cli.test.js build/conductor/supervisor-start-tickets.test.js build/conductor/supervisor-message-relay.test.js build/conductor/supervisor-state-message-events.test.js build/conductor/store-message-relay.test.js build/start-tickets-message-relay.test.js build/conductor/event-accessors.test.js build/conductor/merge-ledger.test.js build/conductor/deterministic-completion.static.test.js build/conductor/deterministic-completion.integration.test.js build/conductor/local-merge.test.js build/conductor/local-merge.static.test.js build/conductor/supervisor-merge.test.js build/conductor/bridge-api-merge-client.test.js build/conductor/bridge-api-epic-client.test.js build/conductor/supervisor-merge-runtime-state.test.js build/conductor/epic-state.test.js build/executor/claude-settings.test.js build/executor/cli.test.js build/executor/credentials.test.js build/executor/echo-acceptance.test.js build/executor/env.test.js build/executor/heartbeat.test.js build/executor/http-client.test.js build/executor/job-runner.test.js build/executor/job-runner.payload-timeout.test.js build/executor/worker-finalization.test.js build/executor/job-runner.static.test.js build/executor/prompt-spec.test.js build/executor/job-types.test.js build/executor/recovery-job.static.test.js build/executor/observation.test.js build/executor/permissions.test.js build/executor/preflight.test.js build/executor/process.test.js build/executor/results.test.js build/executor/runner.test.js build/executor/terminal-mutation.test.js build/executor/worker-command.test.js build/executor/worktree-core.test.js build/executor/worktree.test.js build/executor/job-errors.test.js build/executor/worktree-inspection.test.js build/executor/resume-pre-spawn.test.js build/executor/verdict-artifact.test.js build/executor/worker-log.test.js build/executor/job-log-registry.test.js build/executor/viewer-tabs.test.js build/executor/watch-cli.test.js build/executor/merge-job.test.js build/executor/job-runner.merge.test.js build/executor/worktree-gc.test.js build/executor/runner.job-behaviors.test.js build/conductor/cli-freeze.test.js build/conductor/epic-reconcile.test.js build/conductor/epic-runtime.test.js build/conductor/epic-tick-sequence.test.js build/conductor/epic-runtime-post-action.test.js build/conductor/file-scope-guard.test.js build/conductor/file-scope-guard.integration.test.js build/mcp-profile.test.js build/mcp-profile-registration.test.js build/tools-budget.test.js build/visual-diff-worker.test.js build/visual-diff.test.js build/estimate-epic.test.js build/integration/measure-tools.test.js build/sfcc/config.test.js build/sfcc/ocapi-shape.test.js build/sfcc/output.test.js build/sfcc/credentials.test.js build/sfcc/ocapi-write-faults.test.js build/sfcc/write-guard.test.js build/sfcc/write-grants.test.js build/sfcc/write-result.test.js build/sfcc/writes.test.js build/sfcc/writes-system-object-payloads.test.js build/sfcc/writes-payloads.test.js && node --experimental-test-module-mocks --test --test-force-exit build/index-heavy-read-truncation.test.js build/index-artifacts.test.js build/index.review-rounds.test.js build/index-brainstorm-filenames.test.js build/index-output-path.test.js build/index-generate-decision-page.test.js build/index-generate-decision-page.integration.test.js build/visual-diff.registration.test.js build/visual-diff.attachment-adapter.test.js build/attachment-download.test.js build/attachment-upload.test.js build/conductor/paths.test.js build/conductor/store-lifecycle.test.js build/conductor/store-queries.test.js build/conductor/tools.test.js build/conductor/cli.test.js build/conductor/security-regressions.test.js build/conductor/git-inspection.test.js build/conductor/tools-done-gate.test.js build/conductor/pr-ci-producer-emit-seam.test.js build/conductor/cli-git-hooks.test.js build/sfcc/client.test.js build/sfcc/tool-wrapper.test.js build/sfcc/setup-status.test.js build/sfcc/permissions.test.js build/sfcc/register.test.js build/sfcc/reads-system-object.test.js build/sfcc/reads-custom-object-def.test.js build/sfcc/reads-site-preference.test.js build/sfcc/writes-system-object.test.js build/sfcc/writes-custom-object-def.test.js build/sfcc/writes-site-preference.test.js",
-    "test:integration": "node --test build/integration/refresh-main.integration.test.js build/integration/start-tickets.integration.test.js build/integration/doctor.integration.test.js build/integration/agent-capabilities.integration.test.js build/integration/conductor-producer.integration.test.js build/integration/conductor-message-relay.integration.test.js build/integration/executor-http-runner.integration.test.js build/integration/executor-job-behaviors.integration.test.js build/integration/executor-recovery-jobs.integration.test.js build/integration/executor-spec-review-prompt.integration.test.js build/integration/resume-pre-spawn.git.integration.test.js build/integration/worker-finalization-origin.integration.test.js build/integration/post-remediation-merge-ci-wait.integration.test.js build/integration/executor-merge-supervision.integration.test.js build/integration/attachment-binary-roundtrip.integration.test.js",
+    "test": "node --test --test-force-exit build/pipeline-utils.test.js build/backend-warnings.test.js build/update-check.test.js build/cli-upgrade.test.js build/decision-page-schema.test.js build/decision-page-template.test.js build/bundle-pipelines.test.js build/instructions-contract.test.js build/pipeline-orchestrator-persistence.test.js build/pipeline-orchestrator-execution.test.js build/pipeline-orchestrator-integration.test.js build/index-static.test.js build/config-fields.static.test.js build/execute-plan-instructions.static.test.js build/index-resolvers.test.js build/index-project-root.test.js build/index-pipelines.test.js build/index.test.js build/bridge-config.test.js build/credential-store.test.js build/agent-config-credential-migration.test.js build/mcp-invoke.test.js build/mcp-provisioning.test.js build/mcp-server-invocation.test.js build/third-party-mcp-targets.test.js build/git-ignore-utils.test.js build/credential-materialization.test.js build/mcp-registration-doctor.test.js build/secret-safety.test.js build/base-ref.test.js build/pr-base-contract.test.js build/start-tickets.test.js build/review-tickets.test.js build/start-tickets-base-branch.test.js build/agent-registry.test.js build/agent-registry.model-routing.test.js build/start-tickets.shell-model-routing.test.js build/start-tickets.bridge-api-model-routing.test.js build/start-tickets.tier-fetch-model-routing.test.js build/start-tickets.resolve-model-routing.test.js build/start-tickets.orchestrate-model-routing.test.js build/start-tickets.routing-diagnostics.test.js build/start-tickets-repo.test.js build/start-tickets-credential-invariants.static.test.js build/credentials-cli.test.js build/start-tickets-prereqs.test.js build/regression-check.test.js build/doctor.test.js build/install-doctor.test.js build/install-bridge.test.js build/install-bridge-invite.test.js build/install-bridge-prompt.test.js build/init.test.js build/resolveUploadAttachment.test.js build/package-static.test.js build/chain-utils.test.js build/chain-orchestrator.test.js build/scheduler-backends/types.test.js build/scheduler-backends/escaping.test.js build/scheduler-backends/launchd.test.js build/scheduler-backends/task-scheduler.test.js build/scheduler-backends/systemd-user.test.js build/scheduler-backends/at-fallback.test.js build/scheduler-backends/index.test.js build/command-catalog.test.js build/scheduled-prompt.test.js build/agent-launchers/claude.test.js build/agent-launchers/cursor.test.js build/agent-launchers/index.test.js build/schedule-store.test.js build/schedule-run.test.js build/setup-epic.test.js build/agent-capabilities/cli.test.js build/agent-capabilities/runner.test.js build/agent-capabilities/probes.test.js build/agent-capabilities/probe-context.test.js build/agent-capabilities/reporter.test.js build/conductor/taxonomy-and-errors.test.js build/conductor/github-mergeability.test.js build/conductor/merge-conflict-routing.test.js build/conductor/redaction-normalization.test.js build/conductor/claude-hook.test.js build/conductor/git-ci-types.test.js build/conductor/done-gate.test.js build/conductor/git-ci-taxonomy-payload.test.js build/conductor/bridge-api-client.test.js build/conductor/plan.test.js build/conductor/producer-ledger.test.js build/conductor/spec-review-producer.test.js build/conductor/git-producer.test.js build/conductor/git-hooks.test.js build/conductor/store-migration.test.js build/conductor/pr-discovery.test.js build/conductor/pr-ci-producer.test.js build/conductor/pr-review-producer.test.js build/conductor/doctor.test.js build/conductor/deny-enforcement-preflight.test.js build/conductor/errors.test.js build/conductor/store.test.js build/conductor/index-poll-ci-producer.test.js build/start-tickets-conductor.test.js build/start-tickets-conductor.spawn.test.js build/start-tickets-conductor-node-propagation.test.js build/start-tickets.non-mutating-base.test.js build/start-tickets-live-source-guard.test.js build/conductor/worker-ledger-cli.test.js build/conductor/supervisor-config.test.js build/conductor/supervisor-ledger.test.js build/conductor/supervisor-state-reducer.test.js build/conductor/supervisor-housekeeping-projection.test.js build/conductor/supervisor-escalation.test.js build/conductor/supervisor-retired-judgment.static.test.js build/conductor/supervisor-runtime.test.js build/conductor/supervisor-store-projection.test.js build/conductor/supervisor-cli.test.js build/conductor/supervisor-start-tickets.test.js build/conductor/supervisor-message-relay.test.js build/conductor/supervisor-state-message-events.test.js build/conductor/store-message-relay.test.js build/start-tickets-message-relay.test.js build/conductor/event-accessors.test.js build/conductor/merge-ledger.test.js build/conductor/deterministic-completion.static.test.js build/conductor/deterministic-completion.integration.test.js build/conductor/local-merge.test.js build/conductor/local-merge.static.test.js build/conductor/supervisor-merge.test.js build/conductor/bridge-api-merge-client.test.js build/conductor/bridge-api-epic-client.test.js build/conductor/supervisor-merge-runtime-state.test.js build/conductor/epic-state.test.js build/executor/claude-settings.test.js build/executor/cli.test.js build/executor/credentials.test.js build/executor/echo-acceptance.test.js build/executor/env.test.js build/executor/base-branch.test.js build/executor/heartbeat.test.js build/executor/http-client.test.js build/executor/job-runner.test.js build/executor/job-runner.payload-timeout.test.js build/executor/worker-finalization.test.js build/executor/job-runner.static.test.js build/executor/prompt-spec.test.js build/executor/job-types.test.js build/executor/recovery-job.static.test.js build/executor/observation.test.js build/executor/permissions.test.js build/executor/preflight.test.js build/executor/process.test.js build/executor/results.test.js build/executor/runner.test.js build/executor/terminal-mutation.test.js build/executor/worker-command.test.js build/executor/worktree-core.test.js build/executor/worktree.test.js build/executor/job-errors.test.js build/executor/worktree-inspection.test.js build/executor/resume-pre-spawn.test.js build/executor/verdict-artifact.test.js build/executor/worker-log.test.js build/executor/job-log-registry.test.js build/executor/viewer-tabs.test.js build/executor/watch-cli.test.js build/executor/merge-job.test.js build/executor/job-runner.merge.test.js build/executor/worktree-gc.test.js build/executor/runner.job-behaviors.test.js build/conductor/cli-freeze.test.js build/conductor/epic-reconcile.test.js build/conductor/epic-runtime.test.js build/conductor/epic-tick-sequence.test.js build/conductor/epic-runtime-post-action.test.js build/conductor/file-scope-guard.test.js build/conductor/file-scope-guard.integration.test.js build/mcp-profile.test.js build/mcp-profile-registration.test.js build/tools-budget.test.js build/visual-diff-worker.test.js build/visual-diff.test.js build/estimate-epic.test.js build/integration/measure-tools.test.js build/sfcc/config.test.js build/sfcc/ocapi-shape.test.js build/sfcc/output.test.js build/sfcc/credentials.test.js build/sfcc/ocapi-write-faults.test.js build/sfcc/write-guard.test.js build/sfcc/write-grants.test.js build/sfcc/write-result.test.js build/sfcc/writes.test.js build/sfcc/writes-system-object-payloads.test.js build/sfcc/writes-payloads.test.js build/sfcc/log-gate.test.js build/sfcc/log-query.test.js && node --experimental-test-module-mocks --test --test-force-exit build/index-heavy-read-truncation.test.js build/index-artifacts.test.js build/index.review-rounds.test.js build/index-brainstorm-filenames.test.js build/index-output-path.test.js build/index-generate-decision-page.test.js build/index-generate-decision-page.integration.test.js build/visual-diff.registration.test.js build/visual-diff.attachment-adapter.test.js build/attachment-download.test.js build/attachment-upload.test.js build/conductor/paths.test.js build/conductor/store-lifecycle.test.js build/conductor/store-queries.test.js build/conductor/tools.test.js build/conductor/cli.test.js build/conductor/security-regressions.test.js build/conductor/git-inspection.test.js build/conductor/tools-done-gate.test.js build/conductor/pr-ci-producer-emit-seam.test.js build/conductor/cli-git-hooks.test.js build/sfcc/client.test.js build/sfcc/tool-wrapper.test.js build/sfcc/setup-status.test.js build/sfcc/permissions.test.js build/sfcc/register.test.js build/sfcc/reads-system-object.test.js build/sfcc/reads-custom-object-def.test.js build/sfcc/reads-site-preference.test.js build/sfcc/writes-system-object.test.js build/sfcc/writes-custom-object-def.test.js build/sfcc/writes-site-preference.test.js",
+    "test:integration": "node --test build/integration/refresh-main.integration.test.js build/integration/start-tickets.integration.test.js build/integration/doctor.integration.test.js build/integration/agent-capabilities.integration.test.js build/integration/conductor-producer.integration.test.js build/integration/conductor-message-relay.integration.test.js build/integration/executor-http-runner.integration.test.js build/integration/executor-job-behaviors.integration.test.js build/integration/executor-recovery-jobs.integration.test.js build/integration/executor-spec-review-prompt.integration.test.js build/integration/resume-pre-spawn.git.integration.test.js build/integration/worker-finalization-origin.integration.test.js build/integration/post-remediation-merge-ci-wait.integration.test.js build/integration/executor-merge-supervision.integration.test.js build/integration/attachment-binary-roundtrip.integration.test.js build/integration/dependent-ticket-fresh-base.integration.test.js build/integration/execute-plan-instructions.integration.test.js build/integration/install-bridge-repo-resolution.integration.test.js",
     "test:smoke": "node --test build/integration/packaged-cli-smoke.test.js",
     "prepublishOnly": "node scripts/bundle-assets.js && npm run build && node scripts/verify-shebang.cjs"
   },

package/public/js/main.min.js

@@ -3496,7 +3496,9 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   hideModal: () => (/* binding */ hideModal),
 /* harmony export */   initModal: () => (/* binding */ initModal),
-/* harmony export */   showModal: () => (/* binding */ showModal)
+/* harmony export */   replaceModalBody: () => (/* binding */ replaceModalBody),
+/* harmony export */   showModal: () => (/* binding */ showModal),
+/* harmony export */   showModalNode: () => (/* binding */ showModalNode)
 /* harmony export */ });
 // src/js/modal.js
 
@@ -3550,6 +3552,49 @@ function showModal(title, message, onConfirm = null, showCancel = false, onClose
     }
 }
 
+/**
+ * Show the modal with a caller-built DOM node as its body.
+ *
+ * Additive companion to {@link showModal} for rich, structured content (e.g. the
+ * SFCC ticket preview). The node is appended directly — never serialized through
+ * innerHTML — so untrusted values built with textContent stay safe. The caller
+ * supplies its own action controls inside `contentEl`, so the shared
+ * confirm/cancel actions are hidden. `onClose` runs when the modal is dismissed,
+ * letting the caller restore focus to the invoking element.
+ *
+ * @param {string} title - Modal header text.
+ * @param {HTMLElement} contentEl - Caller-created body node.
+ * @param {Function|null} onClose - Optional callback fired on dismiss.
+ */
+function showModalNode(title, contentEl, onClose = null) {
+    if (pageModalTitle) pageModalTitle.textContent = title;
+    replaceModalBody(contentEl);
+
+    currentConfirmCallback = null;
+    currentCloseCallback = onClose;
+
+    if (pageModalActions) pageModalActions.classList.add('hidden');
+    if (pageModal) {
+        pageModal.style.display = 'block';
+    } else {
+        console.error('Modal element not found.');
+    }
+}
+
+/**
+ * Replace the modal body with a caller-built DOM node without re-showing it.
+ *
+ * Used to transition the same open modal between states (processing → preview →
+ * success/error). Clears the previous content with textContent then appends the
+ * node — never innerHTML.
+ * @param {HTMLElement} contentEl
+ */
+function replaceModalBody(contentEl) {
+    if (!pageModalBody) return;
+    pageModalBody.textContent = '';
+    if (contentEl) pageModalBody.appendChild(contentEl);
+}
+
 /**
  * Hides the modal dialog.
  */
@@ -5321,12 +5366,12 @@ function populateCiFollowupConfig(rawValue) {
 // ladder below are kept byte-identical to the backend
 // (api/library/review_ticket_policy.py) so a stored override round-trips exactly.
 const REVIEW_POLICY_BUCKETS = Object.freeze([
-    { name: 'Very Easy', slug: 'very-easy', range: '1' },
-    { name: 'Easy', slug: 'easy', range: '2' },
-    { name: 'Easy-Moderate', slug: 'easy-moderate', range: '3-4' },
-    { name: 'Moderate', slug: 'moderate', range: '5' },
-    { name: 'Moderate-Hard', slug: 'moderate-hard', range: '6' },
-    { name: 'Hard', slug: 'hard', range: '7-10' },
+    { name: 'Very Easy', slug: 'very-easy', range: '1-2' },
+    { name: 'Easy', slug: 'easy', range: '3-4' },
+    { name: 'Easy-Moderate', slug: 'easy-moderate', range: '5' },
+    { name: 'Moderate', slug: 'moderate', range: '6' },
+    { name: 'Moderate-Hard', slug: 'moderate-hard', range: '7' },
+    { name: 'Hard', slug: 'hard', range: '8-10' },
 ]);
 
 // The two per-bucket automations and their coarse per-round tiers. `clarify` must
@@ -5345,9 +5390,9 @@ const REVIEW_POLICY_DEFAULT_NEW_TIER = 'basic';
 const DEFAULT_REVIEW_POLICY_LADDER = Object.freeze({
     'Very Easy': { clarify: ['basic'], critique: [] },
     'Easy': { clarify: ['basic', 'basic'], critique: [] },
-    'Easy-Moderate': { clarify: ['premium', 'basic'], critique: [] },
-    'Moderate': { clarify: ['premium', 'premium'], critique: ['basic'] },
-    'Moderate-Hard': { clarify: ['premium'], critique: ['premium'] },
+    'Easy-Moderate': { clarify: ['basic', 'basic'], critique: ['basic'] },
+    'Moderate': { clarify: ['premium', 'basic'], critique: ['premium'] },
+    'Moderate-Hard': { clarify: ['premium', 'basic'], critique: ['premium', 'basic'] },
     'Hard': { clarify: ['premium', 'premium'], critique: ['premium', 'premium'] },
 });