@oscharko-dev/keiko 0.2.0-beta.5 → 0.2.0-beta.6

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/testDesignModel.js

@@ -3,7 +3,8 @@
 // Converts an `IntentSummary` plus the evidence atoms it was derived from
 // into a deterministic list of draft `QualityIntelligenceTestCaseCandidate`
 // records. NO model calls; NO randomness; ID derivation is content-hash +
-// position based, so the same input always produces the same candidate IDs.
+// position based, so the same evidence always produces the same candidate IDs
+// regardless of the enclosing run id.
 //
 // Structurally inspired by
 // Test Intelligence reference (TI) packages/core-engine/src/intent-derivation.ts
@@ -12,7 +13,7 @@
 // envelope/atom-shaped and policy-driven.
 import { QualityIntelligence } from "@oscharko-dev/keiko-contracts";
 import { sha256Hex } from "@oscharko-dev/keiko-security";
-import { isKnownPriority, normaliseText } from "./assertions.js";
+import { isKnownPriority, normaliseCandidateText } from "./assertions.js";
 import { regressionDefault } from "./policyProfile.js";
 const compareString = (left, right) => left < right ? -1 : left > right ? 1 : 0;
 const stableSortAtoms = (atoms) => {
@@ -69,6 +70,18 @@ const buildExpectedResults = (atom, intent) => {
     results.push(`Evidence atom ${atom.canonicalHashSha256Hex.slice(0, 12)} remains canonical.`);
     return Object.freeze(results);
 };
+/**
+ * Stable provenance discriminator carried by every deterministic-baseline candidate.
+ *
+ * The model-delta builder (`parseGeneratedCandidates`) never emits this tag, so it is a reliable
+ * "this is a generic determinism-floor stub, not a judged model candidate" marker — unlike a null
+ * `qualityVerdict`, which is also null whenever the judge stage is skipped entirely. Render-layer
+ * consumers sort baseline-tagged candidates to the end so judged candidates lead the deliverable;
+ * the persisted manifest order stays `[...baseline, ...delta]` (Issue #763 contract). The tag is
+ * additive and feeds no candidate id (`sha256(v2<atomHash><index>)`), dedup signature, or manifest
+ * hash, so it is determinism-safe.
+ */
+export const DETERMINISTIC_BASELINE_PROVENANCE_TAG = "source:deterministic-baseline";
 const buildTags = (intent, riskClass) => {
     const tags = new Set();
     for (const theme of intent.themes) {
@@ -78,21 +91,46 @@ const buildTags = (intent, riskClass) => {
         tags.add(`risk-hint:${risk}`);
     }
     tags.add(`risk-class:${riskClass}`);
+    tags.add(DETERMINISTIC_BASELINE_PROVENANCE_TAG);
     return Object.freeze(Array.from(tags).sort(compareString));
 };
-const deriveCandidateIdString = (runId, atom, index) => {
-    const payload = ["v1", String(runId), atom.canonicalHashSha256Hex, String(index)].join("");
+const deriveCandidateIdString = (atom, index) => {
+    const payload = ["v2", atom.canonicalHashSha256Hex, String(index)].join("");
     const digest = sha256Hex(payload).slice(0, 32);
     return `qi-candidate-${digest}`;
 };
+// Sanitise an ordered fragment list for a persisted candidate field: NFKC-normalise,
+// strip unsafe bidi / zero-width / C0/C1/DEL code points (via normaliseCandidateText),
+// and drop fragments that become empty. Order-preserving, no dedup. The deterministic
+// builder receives untrusted text only through `intent` (derived from source display
+// labels, which sanitiseLabel does NOT strip bidi/zero-width from), so without this the
+// deterministic candidates persist and export those spoofing code points — the
+// deterministic-path twin of the model-path chokepoint in parseGeneratedCandidates
+// (Epic #711 / Issue #724 residual). Clean fragments are byte-identical (strip is a
+// no-op and the fragments are already trimmed), so candidate IDs — derived from
+// atomHash/index, never from text — stay stable.
+const sanitiseFragmentList = (values) => Object.freeze(values.map((value) => normaliseCandidateText(value)).filter((value) => value.length > 0));
+// Sanitise + canonicalise a tag list: strip unsafe code points, drop empties, dedup,
+// and sort — preserving the Set+sort semantics of buildTags on the post-strip values so
+// a zero-width-spoofed theme cannot smuggle a visually-duplicate tag into the export.
+const canonicaliseCandidateTags = (values) => {
+    const seen = new Set();
+    for (const value of values) {
+        const cleaned = normaliseCandidateText(value);
+        if (cleaned.length > 0) {
+            seen.add(cleaned);
+        }
+    }
+    return Object.freeze(Array.from(seen).sort(compareString));
+};
 /**
  * Produce deterministic draft candidates from the intent summary + atoms.
  * Returns the empty array when the atom list is empty. Atoms are first
  * sorted by canonical hash so input ordering does not affect IDs.
  *
  * Candidate IDs are derived as
- * `qi-candidate-<32-hex-of-sha256(v1<runId><atomHash><index>)>`
- * — collision-resistant and round-trip-stable.
+ * `qi-candidate-<32-hex-of-sha256(v2<atomHash><index>)>` — collision-resistant,
+ * run-independent, and round-trip-stable for the same evidence.
  */
 export const designTestCaseCandidates = (input) => {
     const { runId, intent, atoms } = input;
@@ -108,21 +146,21 @@ export const designTestCaseCandidates = (input) => {
         if (atom === undefined) {
             continue;
         }
-        const idString = deriveCandidateIdString(runId, atom, index);
+        const idString = deriveCandidateIdString(atom, index);
         const id = QualityIntelligence.asQualityIntelligenceTestCaseId(idString);
         const riskClass = deriveRiskClass(atom, profile);
-        const title = normaliseText(buildTitle(atom, intent, index));
+        const title = normaliseCandidateText(buildTitle(atom, intent, index));
         const candidate = {
             id,
             runId,
             derivedFromAtomIds: Object.freeze([atom.id]),
             title,
-            preconditions: buildPreconditions(intent),
-            steps: buildSteps(atom, intent),
-            expectedResults: buildExpectedResults(atom, intent),
+            preconditions: sanitiseFragmentList(buildPreconditions(intent)),
+            steps: sanitiseFragmentList(buildSteps(atom, intent)),
+            expectedResults: sanitiseFragmentList(buildExpectedResults(atom, intent)),
             priority,
             riskClass,
-            tags: buildTags(intent, riskClass),
+            tags: canonicaliseCandidateTags(buildTags(intent, riskClass)),
             status: "proposed",
         };
         candidates.push(Object.freeze(candidate));

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/domain/validation.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AA6JpE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,mBAAmB,CAAC,wBAAwB,EACnD,YAAY,SAAS,mBAAmB,CAAC,oCAAoC,EAAE,KAC9E,SAAS,mBAAmB,CAAC,oCAAoC,EAoBnE,CAAC"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/domain/validation.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AA+JpE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,mBAAmB,CAAC,wBAAwB,EACnD,YAAY,SAAS,mBAAmB,CAAC,oCAAoC,EAAE,KAC9E,SAAS,mBAAmB,CAAC,oCAAoC,EAoBnE,CAAC"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/domain/validation.js

@@ -20,10 +20,12 @@
 // the model-judge tier excluded and a Keiko-shaped finding output.
 import { QualityIntelligence } from "@oscharko-dev/keiko-contracts";
 import { sha256Hex } from "@oscharko-dev/keiko-security";
-import { normaliseText } from "./assertions.js";
+import { normaliseCandidateText, normaliseText } from "./assertions.js";
 const NEGATION_PATTERN = /\b(not|never|no longer|cannot|isn't|aren't|won't|doesn't|do not)\b/iu;
 const collapseWhitespace = (value) => value.replace(/\s+/gu, " ").trim();
-const canonicaliseLine = (value) => collapseWhitespace(normaliseText(value).toLowerCase());
+// Use normaliseCandidateText (NFKC + bidi/zero-width strip + trim) so that two candidates
+// differing only by injected bidi or zero-width spoofing chars produce the same equivalence key.
+const canonicaliseLine = (value) => collapseWhitespace(normaliseCandidateText(value).toLowerCase());
 const stripNegation = (value) => value.replace(NEGATION_PATTERN, " ").replace(/\s+/gu, " ").trim();
 const deriveFindingIdString = (runId, candidateId, kind, ordinal) => {
     const payload = ["v1", String(runId), candidateId, kind, String(ordinal)].join("");

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/export/adapters/markdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../../src/export/adapters/markdown.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,+BAA+B,EAC/B,oCAAoC,EACrC,MAAM,+BAA+B,CAAC;AAoEvC,wBAAgB,eAAe,CAC7B,MAAM,EAAE,+BAA+B,EACvC,UAAU,EAAE,SAAS,oCAAoC,EAAE,GAC1D,MAAM,CAqBR"}
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../../src/export/adapters/markdown.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,+BAA+B,EAC/B,oCAAoC,EACrC,MAAM,+BAA+B,CAAC;AAyEvC,wBAAgB,eAAe,CAC7B,MAAM,EAAE,+BAA+B,EACvC,UAAU,EAAE,SAAS,oCAAoC,EAAE,GAC1D,MAAM,CAqBR"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/export/adapters/markdown.js

@@ -17,9 +17,14 @@ const byCandidateIdAsc = (a, b) => a.candidateId < b.candidateId ? -1 : a.candid
 //   2. neutralise a leading spreadsheet formula lead (=,+,-,@, incl. a trimmed leading-whitespace
 //      run) with a single-quote prefix — parity with the CSV adapters / traceability.mdCell;
 //   3. escape the Markdown-active vectors a single-line value can still smuggle — a link or image
-//      (incl. javascript:/data: hrefs) and a fenced-code run — mirroring the accepted #278
-//      untrusted-markdown escape set (ingestion/untrustedContentNormalisation). The literal text is
-//      preserved so an auditor still reads the original content.
+//      (incl. javascript:/data: hrefs) and a fenced-code run — the link/image/fenced subset of the
+//      accepted #278 untrusted-markdown escape set (ingestion/untrustedContentNormalisation). The
+//      literal text is preserved so an auditor still reads the original content.
+// The #278 set's fourth vector — a line-leading `#` heading — is intentionally NOT escaped here: it
+// is already mitigated structurally, not by escaping. Step 1 folds every internal line break to a
+// space, and every field value is rendered behind a fixed prefix (`## ` for the title, `- `/`N. `
+// for list items, `**Tags:** ` etc.), so a leading `#` in untrusted text can never reach a true
+// line-start and open a heading.
 const FENCED_CODE = /```/gu;
 const IMAGE_OPEN = /!\[/gu;
 const LINK_OPEN = /(?<!!)\[([^\]]*)\]\(/gu;

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/export/adapters/traceability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traceability.d.ts","sourceRoot":"","sources":["../../../src/export/adapters/traceability.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAGxE;;;;GAIG;AACH,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;CAC9C;AAED,4FAA4F;AAC5F,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3D;AAED,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAOhD,CAAC;AAEH,uEAAuE;AACvE,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAKxD,CAAC;AAyDH;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,SAAS,kCAAkC,EAAE,EACnD,OAAO,GAAE,6CAAkD,GAC1D,MAAM,CA0BR;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,SAAS,kCAAkC,EAAE,EACnD,OAAO,GAAE,6CAAkD,GAC1D,MAAM,CA0CR"}
+{"version":3,"file":"traceability.d.ts","sourceRoot":"","sources":["../../../src/export/adapters/traceability.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAIxE;;;;GAIG;AACH,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;CAC9C;AAED,4FAA4F;AAC5F,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3D;AAED,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAOhD,CAAC;AAEH,uEAAuE;AACvE,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAKxD,CAAC;AA2DH;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,SAAS,kCAAkC,EAAE,EACnD,OAAO,GAAE,6CAAkD,GAC1D,MAAM,CA0BR;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,SAAS,kCAAkC,EAAE,EACnD,OAAO,GAAE,6CAAkD,GAC1D,MAAM,CA0CR"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/export/adapters/traceability.js

@@ -9,6 +9,7 @@
 // atom text, so the adapter depends on nothing outside keiko-contracts/keiko-quality-intelligence
 // (ADR-0019 direction rule). Deterministic: rows are sorted by id, confidence is fixed-precision,
 // and there are no timestamps — so the export is byte-stable for identical inputs.
+import { inlineField } from "../textSafety.js";
 import { encodeSpreadsheetSafeRow, startsWithFormulaLead } from "./spreadsheetSafeCsv.js";
 /** CSV header row for the requirement -> tests direction. */
 export const TRACEABILITY_HEADERS = Object.freeze([
@@ -55,10 +56,12 @@ function invertToReverseRows(rows) {
 }
 // Escape Markdown table delimiters so an id containing a pipe cannot break the row structure, and
 // neutralise a spreadsheet formula lead (=,+,-,@) so a cell stays inert if the table is pasted into
-// a spreadsheet. Backslashes are escaped FIRST so a literal backslash cannot consume the following
-// escape and a pre-existing `\|` cannot smuggle an unescaped pipe through (CWE-20).
+// a spreadsheet. inlineField runs FIRST so embedded newlines/tabs cannot split one logical row across
+// two physical Markdown lines (CWE-1284). Backslashes are escaped BEFORE pipes so a literal backslash
+// cannot consume the following escape and a pre-existing `\|` cannot smuggle an unescaped pipe (CWE-20).
 const mdCell = (value) => {
-    const safe = startsWithFormulaLead(value) ? `'${value}` : value;
+    const oneLine = inlineField(value);
+    const safe = startsWithFormulaLead(oneLine) ? `'${oneLine}` : oneLine;
     return safe.replace(/\\/gu, "\\\\").replace(/\|/gu, "\\|");
 };
 const mdRow = (cells) => `| ${cells.map(mdCell).join(" | ")} |`;
@@ -73,11 +76,11 @@ export function adaptToTraceabilityCsv(rows, display = {}) {
     body += encodeSpreadsheetSafeRow(TRACEABILITY_HEADERS);
     for (const row of sorted) {
         body += encodeSpreadsheetSafeRow([
-            row.atomId,
-            row.requirementExcerptRedacted ?? ABSENT,
+            inlineField(row.atomId),
+            inlineField(row.requirementExcerptRedacted ?? ABSENT),
             row.status,
             fixed2(row.confidence),
-            joinSemicolon(row.coveringCandidateIds),
+            inlineField(joinSemicolon(row.coveringCandidateIds)),
             String(row.coveringCandidateIds.length),
         ]);
     }
@@ -86,9 +89,9 @@ export function adaptToTraceabilityCsv(rows, display = {}) {
     body += encodeSpreadsheetSafeRow(TRACEABILITY_REVERSE_HEADERS);
     for (const reverse of invertToReverseRows(sorted)) {
         body += encodeSpreadsheetSafeRow([
-            reverse.candidateId,
-            display.candidateTitleById?.get(reverse.candidateId) ?? ABSENT,
-            joinSemicolon(reverse.requirementIds),
+            inlineField(reverse.candidateId),
+            inlineField(display.candidateTitleById?.get(reverse.candidateId) ?? ABSENT),
+            inlineField(joinSemicolon(reverse.requirementIds)),
             String(reverse.requirementIds.length),
         ]);
     }

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/export/textSafety.d.ts

@@ -1,6 +1,13 @@
 /**
  * Collapse embedded line-breaking / tab whitespace in a single field value to one space. Leaves all
  * other characters (including ordinary spaces and non-ASCII text) untouched.
+ *
+ * Scope note: this folds ONLY the line-breaking / tab run above — its sole job is to keep a field on
+ * one logical line so it cannot break the structure of a line-oriented serializer. It does NOT strip
+ * other C0/C1/DEL control characters (NUL, BEL, backspace, …) or bidi/zero-width code points; the
+ * line-oriented Markdown / plain-text serializers assume candidate text is already control-clean and
+ * redacted by the upstream persist-time redactor (#278/#284), which is the single content-safety
+ * chokepoint. This helper is a structural folder, not a content scrubber.
  */
 export declare function inlineField(value: string): string;
 /** Apply {@link inlineField} across a list of field values. */

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/export/textSafety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"textSafety.d.ts","sourceRoot":"","sources":["../../src/export/textSafety.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAEhE"}
+{"version":3,"file":"textSafety.d.ts","sourceRoot":"","sources":["../../src/export/textSafety.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAEhE"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/export/textSafety.js

@@ -13,6 +13,13 @@ const LINE_BREAKING_RUN = /[\r\n\t\u000b\f\u0085\u2028\u2029]+/gu;
 /**
  * Collapse embedded line-breaking / tab whitespace in a single field value to one space. Leaves all
  * other characters (including ordinary spaces and non-ASCII text) untouched.
+ *
+ * Scope note: this folds ONLY the line-breaking / tab run above — its sole job is to keep a field on
+ * one logical line so it cannot break the structure of a line-oriented serializer. It does NOT strip
+ * other C0/C1/DEL control characters (NUL, BEL, backspace, …) or bidi/zero-width code points; the
+ * line-oriented Markdown / plain-text serializers assume candidate text is already control-clean and
+ * redacted by the upstream persist-time redactor (#278/#284), which is the single content-safety
+ * chokepoint. This helper is a structural folder, not a content scrubber.
  */
 export function inlineField(value) {
     return value.replace(LINE_BREAKING_RUN, " ");

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/generation/candidateBounds.d.ts

@@ -0,0 +1,10 @@
+export declare const GENERATED_CANDIDATE_RESPONSE_MAX_ITEMS = 1024;
+export declare const GENERATED_CANDIDATE_TITLE_MAX_CHARS = 256;
+export declare const GENERATED_CANDIDATE_TEXT_ITEM_MAX_CHARS = 1000;
+export declare const GENERATED_CANDIDATE_TAG_MAX_CHARS = 120;
+export declare const GENERATED_CANDIDATE_PRECONDITION_MAX_ITEMS = 20;
+export declare const GENERATED_CANDIDATE_STEP_MAX_ITEMS = 50;
+export declare const GENERATED_CANDIDATE_EXPECTED_RESULT_MAX_ITEMS = 50;
+export declare const GENERATED_CANDIDATE_TAG_MAX_ITEMS = 30;
+export declare const GENERATED_CANDIDATE_EVIDENCE_INDEX_MAX_ITEMS = 120;
+//# sourceMappingURL=candidateBounds.d.ts.map

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/generation/candidateBounds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidateBounds.d.ts","sourceRoot":"","sources":["../../src/generation/candidateBounds.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,sCAAsC,OAAO,CAAC;AAC3D,eAAO,MAAM,mCAAmC,MAAM,CAAC;AACvD,eAAO,MAAM,uCAAuC,OAAO,CAAC;AAC5D,eAAO,MAAM,iCAAiC,MAAM,CAAC;AACrD,eAAO,MAAM,0CAA0C,KAAK,CAAC;AAC7D,eAAO,MAAM,kCAAkC,KAAK,CAAC;AACrD,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAChE,eAAO,MAAM,iCAAiC,KAAK,CAAC;AACpD,eAAO,MAAM,4CAA4C,MAAM,CAAC"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/generation/candidateBounds.js

@@ -0,0 +1,14 @@
+// Shared bounds for model-generated Quality Intelligence candidates.
+//
+// These limits keep generated test cases concise enough for persistence, judge prompts, exports, and
+// UI review while still allowing rich manual test steps. They intentionally mirror the stricter UI
+// projection/edit-route envelope instead of the wider raw-provider payload size.
+export const GENERATED_CANDIDATE_RESPONSE_MAX_ITEMS = 1024;
+export const GENERATED_CANDIDATE_TITLE_MAX_CHARS = 256;
+export const GENERATED_CANDIDATE_TEXT_ITEM_MAX_CHARS = 1000;
+export const GENERATED_CANDIDATE_TAG_MAX_CHARS = 120;
+export const GENERATED_CANDIDATE_PRECONDITION_MAX_ITEMS = 20;
+export const GENERATED_CANDIDATE_STEP_MAX_ITEMS = 50;
+export const GENERATED_CANDIDATE_EXPECTED_RESULT_MAX_ITEMS = 50;
+export const GENERATED_CANDIDATE_TAG_MAX_ITEMS = 30;
+export const GENERATED_CANDIDATE_EVIDENCE_INDEX_MAX_ITEMS = 120;

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/generation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generation/index.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,0BAA0B,EAC1B,KAAK,+BAA+B,GACrC,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,wBAAwB,EACxB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,GACpC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,0BAA0B,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generation/index.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,0BAA0B,EAC1B,KAAK,+BAA+B,GACrC,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,wBAAwB,EACxB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,GACpC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,0BAA0B,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/generation/index.js

@@ -5,8 +5,9 @@
 // DETERMINISM-FIRST INVARIANT (Epic #761, Issue #763):
 // - The structural stages — coverage mapping, deduplication, validation, and candidate-ID
 //   derivation — are 100% deterministic and replayable: `parseGeneratedCandidates` derives every
-//   candidate id from a content hash (sha256 of run id + ordinal + title), so identical model
-//   text yields identical ids regardless of model, seed, or sampling temperature.
+//   candidate id from a content hash (sha256 of ordinal + title + cited atoms), so identical model
+//   text over identical evidence yields identical ids regardless of run id, model, seed, or sampling
+//   temperature.
 // - The model is invoked ONLY to draft candidate text; its output is an attributed delta. The
 //   evidence manifest records which model produced it (`modelId`), the request parameters used
 //   (`modelParameters`, e.g. responseFormat), and the seed (`seedUsed`, null when unsupported).

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/generation/parseGeneratedCandidates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parseGeneratedCandidates.d.ts","sourceRoot":"","sources":["../../src/generation/parseGeneratedCandidates.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAIpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAGhE,KAAK,SAAS,GAAG,mBAAmB,CAAC,oCAAoC,CAAC;AAC1E,KAAK,KAAK,GAAG,mBAAmB,CAAC,wBAAwB,CAAC;AAC1D,KAAK,MAAM,GAAG,mBAAmB,CAAC,iCAAiC,CAAC;AAWpE,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AA8JD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACnC,SAAS,MAAM,EACf,OAAO,6BAA6B,KACnC,8BAqBF,CAAC"}
+{"version":3,"file":"parseGeneratedCandidates.d.ts","sourceRoot":"","sources":["../../src/generation/parseGeneratedCandidates.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAIpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAYhE,KAAK,SAAS,GAAG,mBAAmB,CAAC,oCAAoC,CAAC;AAC1E,KAAK,KAAK,GAAG,mBAAmB,CAAC,wBAAwB,CAAC;AAC1D,KAAK,MAAM,GAAG,mBAAmB,CAAC,iCAAiC,CAAC;AAWpE,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAuPD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACnC,SAAS,MAAM,EACf,OAAO,6BAA6B,KACnC,8BAqBF,CAAC"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/generation/parseGeneratedCandidates.js

@@ -7,11 +7,13 @@
 // same candidate IDs (round-trip stable, mutation-detectable).
 import { QualityIntelligence } from "@oscharko-dev/keiko-contracts";
 import { sha256Hex } from "@oscharko-dev/keiko-security";
-import { normaliseText } from "../domain/assertions.js";
+import { normaliseCandidateText } from "../domain/assertions.js";
 import { regressionDefault } from "../domain/policyProfile.js";
+import { GENERATED_CANDIDATE_EXPECTED_RESULT_MAX_ITEMS, GENERATED_CANDIDATE_PRECONDITION_MAX_ITEMS, GENERATED_CANDIDATE_STEP_MAX_ITEMS, GENERATED_CANDIDATE_TAG_MAX_CHARS, GENERATED_CANDIDATE_TAG_MAX_ITEMS, GENERATED_CANDIDATE_TEXT_ITEM_MAX_CHARS, GENERATED_CANDIDATE_TITLE_MAX_CHARS, } from "./candidateBounds.js";
 const PRIORITIES = new Set(QualityIntelligence.QUALITY_INTELLIGENCE_PRIORITIES);
 const RISK_CLASSES = new Set(QualityIntelligence.QUALITY_INTELLIGENCE_RISK_CLASSES);
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const CANDIDATE_ARRAY_KEYS = ["testCases", "test_cases", "tests", "cases"];
 // Strip a single ```json … ``` or ``` … ``` fence if the whole payload is fenced.
 const stripCodeFence = (raw) => {
     const fence = /^```(?:json)?\s*([\s\S]*?)\s*```$/u.exec(raw.trim());
@@ -27,64 +29,98 @@ const consumeStringChar = (ch, escaped) => {
         return { inString: false, escaped: false };
     return { inString: true, escaped: false };
 };
-// Scan for the first balanced JSON value (object or array) honouring string literals + escapes,
-// so a `}` inside a quoted step does not terminate the scan early.
-const extractFirstJsonValue = (text) => {
-    const open = firstOpenIndex(text);
-    if (open === -1)
-        return undefined;
+const isJsonOpen = (ch) => ch === "{" || ch === "[";
+const advanceJsonBalance = (ch, openChar, closeChar, scan, depth) => {
+    if (scan.inString) {
+        return { depth, scan: consumeStringChar(ch, scan.escaped), closed: false };
+    }
+    if (ch === '"')
+        return { depth, scan: { inString: true, escaped: false }, closed: false };
+    if (ch === openChar)
+        return { depth: depth + 1, scan, closed: false };
+    if (ch !== closeChar)
+        return { depth, scan, closed: false };
+    const nextDepth = depth - 1;
+    return { depth: nextDepth, scan, closed: nextDepth === 0 };
+};
+// Scan a balanced JSON value (object or array) at `open`, honouring string literals + escapes, so a
+// `}` inside a quoted step does not terminate the scan early.
+const extractJsonValueAt = (text, open) => {
     const openChar = text[open];
+    if (!isJsonOpen(openChar))
+        return undefined;
     const closeChar = openChar === "{" ? "}" : "]";
     let depth = 0;
     let scan = { inString: false, escaped: false };
     for (let i = open; i < text.length; i += 1) {
         const ch = text[i] ?? "";
-        if (scan.inString) {
-            scan = consumeStringChar(ch, scan.escaped);
-            continue;
-        }
-        if (ch === '"')
-            scan = { inString: true, escaped: false };
-        else if (ch === openChar)
-            depth += 1;
-        else if (ch === closeChar) {
-            depth -= 1;
-            if (depth === 0)
-                return text.slice(open, i + 1);
-        }
+        const next = advanceJsonBalance(ch, openChar, closeChar, scan, depth);
+        depth = next.depth;
+        scan = next.scan;
+        if (next.closed)
+            return text.slice(open, i + 1);
     }
     return undefined;
 };
-const firstOpenIndex = (text) => {
-    const obj = text.indexOf("{");
-    const arr = text.indexOf("[");
-    if (obj === -1)
-        return arr;
-    if (arr === -1)
-        return obj;
-    return Math.min(obj, arr);
+const hasCandidateContainer = (parsed) => Array.isArray(parsed) ||
+    (isObject(parsed) && CANDIDATE_ARRAY_KEYS.some((key) => Array.isArray(parsed[key])));
+// Accept either a bare array of test cases, the documented `{ testCases: [...] }` wrapper, or a
+// small set of common chat-model aliases used when response-format schemas are unavailable.
+const toRawItems = (parsed) => {
+    if (Array.isArray(parsed))
+        return parsed;
+    if (isObject(parsed)) {
+        for (const key of CANDIDATE_ARRAY_KEYS) {
+            const value = parsed[key];
+            if (Array.isArray(value))
+                return value;
+        }
+    }
+    return [];
 };
-const parseJsonLoose = (raw) => {
-    const stripped = stripCodeFence(raw);
-    const slice = extractFirstJsonValue(stripped);
+const candidateContainerItemCount = (parsed) => hasCandidateContainer(parsed) ? toRawItems(parsed).length : -1;
+const parseJsonSliceAt = (text, index) => {
+    if (!isJsonOpen(text[index]))
+        return undefined;
+    const slice = extractJsonValueAt(text, index);
     if (slice === undefined)
         return undefined;
     try {
-        return JSON.parse(slice);
+        const parsed = JSON.parse(slice);
+        return { parsed, itemCount: candidateContainerItemCount(parsed) };
     }
     catch {
         return undefined;
     }
 };
-// Accept either a bare array of test cases or the documented `{ testCases: [...] }` wrapper.
-const toRawItems = (parsed) => {
-    if (Array.isArray(parsed))
-        return parsed;
-    if (isObject(parsed) && Array.isArray(parsed.testCases))
-        return parsed.testCases;
-    return [];
+// Parse the first useful JSON candidate payload. If a chat model emits an invalid bracket fragment
+// before the real JSON, keep scanning; if it emits only a wrong-shape JSON value, preserve the old
+// `recovered:true, candidates:[]` behaviour by returning the first successfully parsed value.
+const parseFirstUsefulJsonValue = (text) => {
+    let firstParsed;
+    let firstEmptyCandidateContainer;
+    for (let i = 0; i < text.length; i += 1) {
+        const parsedSlice = parseJsonSliceAt(text, i);
+        if (parsedSlice === undefined)
+            continue;
+        const { parsed, itemCount } = parsedSlice;
+        if (firstParsed === undefined)
+            firstParsed = parsed;
+        if (itemCount > 0)
+            return parsed;
+        if (itemCount === 0 && firstEmptyCandidateContainer === undefined) {
+            firstEmptyCandidateContainer = parsed;
+        }
+    }
+    return firstEmptyCandidateContainer ?? firstParsed;
 };
-const toStringList = (value) => {
+const parseJsonLoose = (raw) => {
+    const stripped = stripCodeFence(raw);
+    return parseFirstUsefulJsonValue(stripped);
+};
+const truncateText = (value, limit) => value.length <= limit ? value : `${value.slice(0, Math.max(0, limit - 3))}...`;
+const toBoundedText = (value, maxChars) => truncateText(normaliseCandidateText(typeof value === "string" ? value : ""), maxChars);
+const toStringList = (value, limits) => {
     const source = Array.isArray(value)
         ? value
         : typeof value === "string"
@@ -92,14 +128,20 @@ const toStringList = (value) => {
             : [];
     const out = [];
     for (const entry of source) {
+        if (out.length >= limits.maxItems)
+            break;
         if (typeof entry !== "string")
             continue;
-        const text = normaliseText(entry);
+        const text = toBoundedText(entry, limits.maxChars);
         if (text.length > 0)
             out.push(text);
     }
     return out;
 };
+const textList = (value, maxItems) => toStringList(value, {
+    maxItems,
+    maxChars: GENERATED_CANDIDATE_TEXT_ITEM_MAX_CHARS,
+});
 const clampPriority = (value, profile) => typeof value === "string" && PRIORITIES.has(value)
     ? value
     : profile.defaultPriority;
@@ -126,23 +168,28 @@ const resolveDerivedAtomIds = (value, atomIds, positionalIndex) => {
     const fallback = atomIds[positionalIndex % atomIds.length];
     return fallback === undefined ? Object.freeze([]) : Object.freeze([fallback]);
 };
-const deriveCandidateId = (runId, index, title) => {
-    const digest = sha256Hex(`qi-cand-v1|${String(runId)}|${String(index)}|${title}`).slice(0, 32);
+const deriveCandidateId = (index, title, derivedFromAtomIds) => {
+    const atomRefs = derivedFromAtomIds.map(String).join("|");
+    const digest = sha256Hex(`qi-cand-v2|${String(index)}|${title}|${atomRefs}`).slice(0, 32);
     return `qi-candidate-${digest}`;
 };
 const buildCandidate = (raw, index, input, profile) => {
-    const title = normaliseText(typeof raw.title === "string" ? raw.title : "");
-    const steps = toStringList(raw.steps);
+    const title = toBoundedText(raw.title, GENERATED_CANDIDATE_TITLE_MAX_CHARS);
+    const steps = textList(raw.steps, GENERATED_CANDIDATE_STEP_MAX_ITEMS);
     if (title.length === 0 || steps.length === 0)
         return undefined;
-    const expectedResults = toStringList(raw.expectedResults);
-    const tags = toStringList(raw.tags);
+    const expectedResults = textList(raw.expectedResults, GENERATED_CANDIDATE_EXPECTED_RESULT_MAX_ITEMS);
+    const tags = toStringList(raw.tags, {
+        maxItems: GENERATED_CANDIDATE_TAG_MAX_ITEMS,
+        maxChars: GENERATED_CANDIDATE_TAG_MAX_CHARS,
+    });
+    const derivedFromAtomIds = resolveDerivedAtomIds(raw.derivedFromEvidenceIndexes, input.atomIds, index);
     return Object.freeze({
-        id: QualityIntelligence.asQualityIntelligenceTestCaseId(deriveCandidateId(input.runId, index, title)),
+        id: QualityIntelligence.asQualityIntelligenceTestCaseId(deriveCandidateId(index, title, derivedFromAtomIds)),
         runId: input.runId,
-        derivedFromAtomIds: resolveDerivedAtomIds(raw.derivedFromEvidenceIndexes, input.atomIds, index),
+        derivedFromAtomIds,
         title,
-        preconditions: toStringList(raw.preconditions),
+        preconditions: textList(raw.preconditions, GENERATED_CANDIDATE_PRECONDITION_MAX_ITEMS),
         steps,
         expectedResults: expectedResults.length > 0
             ? expectedResults

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/generation/prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../src/generation/prompt.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAMhE,eAAO,MAAM,4BAA4B,EAAE,MAc/B,CAAC;AAIb,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2B3E,CAAC;AAEH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,kGAAkG;IAClG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,+BAA+B,KAAG,MAwBnF,CAAC"}
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../src/generation/prompt.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAiBhE,eAAO,MAAM,4BAA4B,EAAE,MAc/B,CAAC;AAIb,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgD3E,CAAC;AAEH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,kGAAkG;IAClG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,+BAA+B,KAAG,MA8BnF,CAAC"}

package/node_modules/@oscharko-dev/keiko-quality-intelligence/dist/generation/prompt.js

@@ -6,6 +6,7 @@
 // server tier feeds the untrusted evidence segments separately so trusted instructions
 // and untrusted source text never share a string (ADR-0023 D5, Issue #284).
 import { regressionDefault } from "../domain/policyProfile.js";
+import { GENERATED_CANDIDATE_EVIDENCE_INDEX_MAX_ITEMS, GENERATED_CANDIDATE_EXPECTED_RESULT_MAX_ITEMS, GENERATED_CANDIDATE_PRECONDITION_MAX_ITEMS, GENERATED_CANDIDATE_RESPONSE_MAX_ITEMS, GENERATED_CANDIDATE_STEP_MAX_ITEMS, GENERATED_CANDIDATE_TAG_MAX_CHARS, GENERATED_CANDIDATE_TAG_MAX_ITEMS, GENERATED_CANDIDATE_TEXT_ITEM_MAX_CHARS, GENERATED_CANDIDATE_TITLE_MAX_CHARS, } from "./candidateBounds.js";
 // The trusted system instruction. Pinned, never interpolates untrusted content. Frames the
 // model as a regulated-delivery QA engineer and fixes the output contract to STRICT JSON so
 // the deterministic parser can recover candidates without free-text heuristics.
@@ -33,22 +34,43 @@ export const QI_TEST_DESIGN_RESPONSE_SCHEMA = Object.freeze({
     properties: {
         testCases: {
             type: "array",
+            maxItems: GENERATED_CANDIDATE_RESPONSE_MAX_ITEMS,
             items: {
                 type: "object",
                 required: ["title", "steps", "expectedResults", "derivedFromEvidenceIndexes"],
                 additionalProperties: false,
                 properties: {
-                    title: { type: "string" },
-                    preconditions: { type: "array", items: { type: "string" } },
-                    steps: { type: "array", items: { type: "string" } },
-                    expectedResults: { type: "array", items: { type: "string" } },
+                    title: { type: "string", maxLength: GENERATED_CANDIDATE_TITLE_MAX_CHARS },
+                    preconditions: {
+                        type: "array",
+                        maxItems: GENERATED_CANDIDATE_PRECONDITION_MAX_ITEMS,
+                        items: { type: "string", maxLength: GENERATED_CANDIDATE_TEXT_ITEM_MAX_CHARS },
+                    },
+                    steps: {
+                        type: "array",
+                        maxItems: GENERATED_CANDIDATE_STEP_MAX_ITEMS,
+                        items: { type: "string", maxLength: GENERATED_CANDIDATE_TEXT_ITEM_MAX_CHARS },
+                    },
+                    expectedResults: {
+                        type: "array",
+                        maxItems: GENERATED_CANDIDATE_EXPECTED_RESULT_MAX_ITEMS,
+                        items: { type: "string", maxLength: GENERATED_CANDIDATE_TEXT_ITEM_MAX_CHARS },
+                    },
                     priority: { type: "string", enum: ["P0", "P1", "P2", "P3"] },
                     riskClass: {
                         type: "string",
                         enum: ["safety", "compliance", "regression", "functional", "visual"],
                     },
-                    tags: { type: "array", items: { type: "string" } },
-                    derivedFromEvidenceIndexes: { type: "array", items: { type: "integer" } },
+                    tags: {
+                        type: "array",
+                        maxItems: GENERATED_CANDIDATE_TAG_MAX_ITEMS,
+                        items: { type: "string", maxLength: GENERATED_CANDIDATE_TAG_MAX_CHARS },
+                    },
+                    derivedFromEvidenceIndexes: {
+                        type: "array",
+                        maxItems: GENERATED_CANDIDATE_EVIDENCE_INDEX_MAX_ITEMS,
+                        items: { type: "integer" },
+                    },
                 },
             },
         },
@@ -61,7 +83,7 @@ export const QI_TEST_DESIGN_RESPONSE_SCHEMA = Object.freeze({
  */
 export const buildTestDesignInstruction = (input) => {
     const profile = input.profile ?? regressionDefault;
-    const cap = Math.max(1, Math.min(input.maxTestCases, 200));
+    const cap = Math.max(1, Math.min(input.maxTestCases, GENERATED_CANDIDATE_RESPONSE_MAX_ITEMS));
     return [
         `Design up to ${String(cap)} test cases from the ${String(input.evidenceCount)} evidence`,
         `item(s) provided below as <qi-evidence> blocks (numbered 1..${String(input.evidenceCount)}).`,
@@ -80,6 +102,12 @@ export const buildTestDesignInstruction = (input) => {
         '  "derivedFromEvidenceIndexes": number[]',
         "} ] }",
         "",
+        `Keep each title under ${String(GENERATED_CANDIDATE_TITLE_MAX_CHARS)} characters,`,
+        `each list item under ${String(GENERATED_CANDIDATE_TEXT_ITEM_MAX_CHARS)} characters,`,
+        `and use at most ${String(GENERATED_CANDIDATE_PRECONDITION_MAX_ITEMS)} preconditions,`,
+        `${String(GENERATED_CANDIDATE_STEP_MAX_ITEMS)} steps,`,
+        `${String(GENERATED_CANDIDATE_EXPECTED_RESULT_MAX_ITEMS)} expected results, and`,
+        `${String(GENERATED_CANDIDATE_TAG_MAX_ITEMS)} tags per test case.`,
         "Every test case must list at least one evidence index in derivedFromEvidenceIndexes.",
         "Respond with the JSON object only.",
     ].join("\n");