@planu/cli 4.11.0 → 4.11.2

package/dist/tools/challenge-spec/scenarios-security.js

@@ -1,5 +1,5 @@
 // tools/challenge-spec/scenarios-security.ts — Authentication, injection, and CSRF scenarios
-import { contentMentions, hasAnyAffirmedMatch } from './scenarios-utils.js';
+import { contentMentions, detectChallengeCapabilities, hasAnyAffirmedMatch, } from './scenarios-utils.js';
 const AUTH_SIGNALS = [
     /\b(auth|authentication|login|session|token|jwt|oauth|permission|role|rbac)\b/i,
 ];
@@ -9,10 +9,11 @@ const INPUT_SIGNALS = [
 const STATE_CHANGING_WEB_SIGNALS = [
     /\b(form submit|post request|put request|delete request|mutation|state-changing|cookie auth)\b/i,
 ];
-export function generateSecurityScenarios(_spec, content, _knowledge) {
+export function generateSecurityScenarios(spec, content, _knowledge) {
     const scenarios = [];
     const lower = content.toLowerCase();
     const text = content;
+    const capabilities = detectChallengeCapabilities(spec, content);
     // Authentication bypass
     if (hasAnyAffirmedMatch(text, AUTH_SIGNALS)) {
         scenarios.push({
@@ -22,23 +23,29 @@ export function generateSecurityScenarios(_spec, content, _knowledge) {
             currentHandling: contentMentions(lower, ['auth', 'jwt', 'session', 'middleware'])
                 ? 'Authentication mentioned'
                 : 'No explicit auth handling',
-            requiredHandling: 'Validate auth tokens on every request. Implement RBAC. Never trust client-side auth state.',
-            dataConsistency: 'Ensure RLS policies are enabled. No data leak through unauthorized queries.',
-            userExperience: 'Redirect to login on 401. Clear error messages without leaking implementation details.',
+            requiredHandling: 'Validate identity at the declared trust boundary and enforce the authorization model named by the contract.',
+            dataConsistency: 'Unauthorized operations must not read or mutate protected state.',
+            userExperience: 'Use the unauthorized-access behavior defined by the client contract.',
         });
     }
     // Injection attacks
     if (hasAnyAffirmedMatch(text, INPUT_SIGNALS)) {
         scenarios.push({
-            scenario: 'SQL injection / XSS / command injection via user input',
+            scenario: capabilities.database
+                ? 'SQL injection / XSS / command injection via user input'
+                : 'XSS / command injection via user input',
             probability: 'high',
             impact: 'critical',
             currentHandling: contentMentions(lower, ['sanitiz', 'escap', 'parameterized', 'prepared'])
                 ? 'Some sanitization mentioned'
                 : 'Not explicitly addressed',
-            requiredHandling: 'Use parameterized queries (never string concatenation). Sanitize HTML output. Use CSP headers.',
-            dataConsistency: 'Injection can corrupt or exfiltrate data. Use least-privilege DB connections.',
-            userExperience: 'Transparent to user. Invalid input is silently sanitized.',
+            requiredHandling: capabilities.database
+                ? 'Use parameterized queries and sanitize output at the declared input boundary.'
+                : 'Sanitize output and constrain command execution at the declared input boundary.',
+            dataConsistency: capabilities.database
+                ? 'Use least-privilege database access for data reached through this input.'
+                : 'Invalid input must not reach state-changing operations.',
+            userExperience: 'Use the invalid-input response defined by the interaction contract.',
         });
     }
     // CSRF / rate limiting only applies when the spec explicitly involves auth or
@@ -52,9 +59,9 @@ export function generateSecurityScenarios(_spec, content, _knowledge) {
             currentHandling: contentMentions(lower, ['csrf', 'rate limit', 'throttle', 'captcha'])
                 ? 'Some protection mentioned'
                 : 'Not addressed',
-            requiredHandling: 'Implement CSRF tokens for state-changing operations. Rate-limit sensitive endpoints. Add CAPTCHA for auth endpoints.',
+            requiredHandling: 'Define request-forgery and abuse controls from the authentication and mutation contracts.',
             dataConsistency: 'Prevent mass data modifications from automated attacks.',
-            userExperience: 'Show rate limit message. Require CAPTCHA after N failed attempts.',
+            userExperience: 'Use the throttling and verification behavior defined by the auth contract.',
         });
     }
     return scenarios;

package/dist/tools/challenge-spec/scenarios-utils.d.ts

@@ -1,7 +1,33 @@
-/**
- * Returns true if any of the keywords appear in lowerContent (case-insensitive match).
- * lowerContent is expected to already be lowercased by the caller.
- */
-export declare function contentMentions(lowerContent: string, keywords: string[]): boolean;
+import type { Spec } from '../../types/index.js';
+export interface ChallengeCapabilities {
+    networkApi: boolean;
+    database: boolean;
+    authentication: boolean;
+    authorization: boolean;
+    userInput: boolean;
+    externalService: boolean;
+    payment: boolean;
+    fileTransfer: boolean;
+    scale: boolean;
+    dataWrite: boolean;
+    cache: boolean;
+    duplicateOperation: boolean;
+    concurrency: boolean;
+    privacy: boolean;
+    events: boolean;
+    implementationContract: boolean;
+    desktopUpdate: boolean;
+    agent: boolean;
+    ddd: boolean;
+    xp: boolean;
+    validation: boolean;
+    rateLimit: boolean;
+    saga: boolean;
+    platform: boolean;
+}
+/** Boundary-aware, affirmative replacement for advisory substring checks. */
+export declare function contentMentions(content: string, keywords: string[]): boolean;
+export declare function detectChallengeCapabilities(spec: Spec, specContent: string): ChallengeCapabilities;
+export declare function hasAnyChallengeCapability(capabilities: ChallengeCapabilities, names: (keyof ChallengeCapabilities)[]): boolean;
 export { hasAffirmedMatch, hasAnyAffirmedMatch, stripNonContractText, } from '../../engine/text-signal-boundaries.js';
 //# sourceMappingURL=scenarios-utils.d.ts.map

package/dist/tools/challenge-spec/scenarios-utils.js

@@ -1,10 +1,106 @@
 // tools/challenge-spec/scenarios-utils.ts — Shared utilities for scenario generators
-/**
- * Returns true if any of the keywords appear in lowerContent (case-insensitive match).
- * lowerContent is expected to already be lowercased by the caller.
- */
-export function contentMentions(lowerContent, keywords) {
-    return keywords.some((kw) => lowerContent.includes(kw.toLowerCase()));
+import { hasAnyAffirmedMatch } from '../../engine/text-signal-boundaries.js';
+const CAPABILITY_SIGNALS = {
+    networkApi: [
+        /(?<!compiler\s)\bapi\b(?!\s+(?:compatibility|surface|package|type))/i,
+        /\b(?:public|external|remote|rest|http)\s+api\b/i,
+        /\bapi\s+(?:endpoint|route|request|response|server|client)\b/i,
+        /\b(?:http|rest)\s+(?:endpoint|route|request|response)\b/i,
+        /\bfetch(?:es|ing)?\s+(?:from\s+)?(?:an?\s+)?(?:endpoint|service|url)\b/i,
+    ],
+    database: [
+        /\b(?:database|postgres(?:ql)?|mysql|sqlite|mongodb|dynamodb|supabase)\b/i,
+        /\b(?:sql|nosql)\s+(?:query|statement|table|database)\b/i,
+        /\b(?:database|persistence)\s+(?:query|schema|table|migration|transaction)\b/i,
+        /\b(?:orm|prisma|drizzle|typeorm|sequelize)\b/i,
+    ],
+    authentication: [
+        /\b(?:auth(?:entication)?|login|sign[ -]?in|password|jwt|oauth2?|session\s+auth)\b/i,
+    ],
+    authorization: [
+        /\b(?:authori[sz]ation|permission|rbac|role-based|access\s+control|resource\s+ownership|tenant)\b/i,
+    ],
+    userInput: [
+        /\b(?:user|client)\s+input\b/i,
+        /\b(?:input\s+form|form\s+(?:input|submission)|request\s+body|query\s+parameter|uploaded\s+payload)\b/i,
+        /\binputs?\s+(?:are\s+)?validat/i,
+    ],
+    externalService: [
+        /\b(?:third-party|external|remote|downstream)\s+(?:service|provider|dependency|system)\b/i,
+        /\bwebhook\s+(?:provider|delivery|endpoint|request)\b/i,
+    ],
+    payment: [/\b(?:payment|billing|checkout|invoice|stripe|paypal)\b/i],
+    fileTransfer: [
+        /\b(?:(?:large|binary|uploaded)\s+)?(?:file|image|media|attachment)\s+(?:upload|download|transfer|stream)\b/i,
+        /\b(?:upload|download|stream)(?:ed|ing|s)?\s+(?:a\s+)?(?:(?:large|binary)\s+)?(?:file|image|media|attachment)\b/i,
+        /\bbatch\s+(?:import|export|processing|operation)\b/i,
+        /\bbatch\s+upload\b/i,
+    ],
+    scale: [
+        /\b(?:traffic|load|throughput|requests?\s+per\s+second|concurrent\s+users?)\b/i,
+        /\b(?:auto[ -]?scal|load\s+test|capacity\s+plan)/i,
+        /\b(?:data\s+growth|growing\s+dataset|query\s+performance\s+at\s+scale)\b/i,
+    ],
+    dataWrite: [
+        /\b(?:database\s+transaction|persist(?:s|ed|ing)?\s+(?:record|entity|data)|write(?:s|ing)?\s+(?:record|entity|database))\b/i,
+        /\b(?:state-changing|data\s+mutation|atomic\s+database\s+write)\b/i,
+        /\b(?:transaction|atomic\s+write|update\s+(?:record|state)|modify\s+(?:record|state))\b/i,
+    ],
+    cache: [/\b(?:cache|caching|cached\s+(?:data|response)|redis)\b/i],
+    duplicateOperation: [
+        /\b(?:double[ -]?click|duplicate\s+(?:request|submission|operation|record)|idempoten)/i,
+    ],
+    concurrency: [
+        /\b(?:concurren|race\s+condition|shared\s+state|parallel\s+write|atomic\s+increment|optimistic\s+lock)/i,
+        /\b(?:counter|increment|balance|stock|quantity|vote|status\s+(?:update|transition))\b/i,
+        /\b(?:file\s+upload|resource\s+manager|search\s+feed|list\s+endpoint|global\s+cache|session\s+state|cart\s+state|draft\s+state)\b/i,
+    ],
+    privacy: [
+        /\b(?:pii|personal\s+data|personal\s+information|privacy|gdpr|hipaa|data\s+subject)\b/i,
+        /\b(?:email\s+address|phone\s+number|social\s+security\s+number)\b/i,
+    ],
+    events: [
+        /\b(?:process|handle|publish|consume)\w*(?:\s+[a-z0-9_-]+){0,3}\s+event\b/i,
+        /\b(?:event\s+(?:schema|contract|producer|consumer|handler|stream)|message\s+(?:broker|queue|consumer|producer))\b/i,
+        /\b(?:kafka|rabbitmq|pubsub|nats|eventbridge|sqs|sns|dead[ -]?letter\s+queue|dlq)\b/i,
+        /\b(?:publish|produce|consume)(?:es|d|r|rs|ing)?\s+(?:an?\s+)?(?:event|message)\b/i,
+    ],
+    implementationContract: [
+        /\bimplementation\s+contract\b/i,
+        /\b(?:file-level\s+work\s+plan|acceptance-to-verification\s+map|behavior\s+contract)\b/i,
+    ],
+    desktopUpdate: [
+        /\b(?:desktop|electron|tauri)\s+(?:app\s+)?(?:auto[ -]?)?update\b/i,
+        /\b(?:auto[ -]?updater|electron-updater)\b/i,
+    ],
+    agent: [/\b(?:ai\s+agent|agent\s+contract|llm\s+agent|tool\s+call|autonomous\s+agent)\b/i],
+    ddd: [/\b(?:domain-driven\s+design|ddd\s+aggregate|aggregate\s+root|bounded\s+context)\b/i],
+    xp: [/\b(?:pair\s+programming|extreme\s+programming|xp\s+pair)\b/i],
+    validation: [/\b(?:input|payload|request|schema)\s+validat/i, /\b(?:zod|joi|json\s+schema)\b/i],
+    rateLimit: [/\b(?:rate[ -]?limit|throttl|request\s+quota)\b/i],
+    saga: [/\b(?:saga|compensating\s+transaction|distributed\s+transaction)\b/i],
+    platform: [
+        /\b(?:smart\s+contract|solidity|discord\s+bot|telegram\s+bot|iot\s+device|firmware|infrastructure\s+as\s+code|terraform|machine\s+learning\s+model)\b/i,
+    ],
+};
+function keywordPattern(keyword) {
+    const escaped = keyword.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace(/\s+/g, '\\s+');
+    const suffix = /^[a-z0-9]+$/i.test(keyword) && keyword.length > 3 ? '[a-z0-9_-]*' : '';
+    return new RegExp(`\\b${escaped}${suffix}\\b`, 'i');
+}
+/** Boundary-aware, affirmative replacement for advisory substring checks. */
+export function contentMentions(content, keywords) {
+    return hasAnyAffirmedMatch(content, keywords.map(keywordPattern));
+}
+export function detectChallengeCapabilities(spec, specContent) {
+    const text = `${spec.title}\n${spec.tags.join(' ')}\n${specContent}`;
+    return Object.fromEntries(Object.entries(CAPABILITY_SIGNALS).map(([capability, patterns]) => [
+        capability,
+        hasAnyAffirmedMatch(text, patterns),
+    ]));
+}
+export function hasAnyChallengeCapability(capabilities, names) {
+    return names.some((name) => capabilities[name]);
 }
 export { hasAffirmedMatch, hasAnyAffirmedMatch, stripNonContractText, } from '../../engine/text-signal-boundaries.js';
 //# sourceMappingURL=scenarios-utils.js.map

package/dist/tools/challenge-spec/security-challenge-scenarios.d.ts

@@ -3,7 +3,7 @@ import type { FailureScenario, Spec, ProjectKnowledge } from '../../types/index.
  * Generate security challenge scenarios specific to authorization, STRIDE threats,
  * and resource ownership. Used by handleChallengeSpec in the 'security' focus area.
  */
-export declare function generateSecurityChallengeScenarios(spec: Spec, _specContent: string, _knowledge: ProjectKnowledge): FailureScenario[];
+export declare function generateSecurityChallengeScenarios(spec: Spec, specContent: string, _knowledge: ProjectKnowledge): FailureScenario[];
 /**
  * Generate security test case scaffolds for auth/API features.
  * SPEC-029 criterion 12: auto-generate security test scaffolds.

package/dist/tools/challenge-spec/security-challenge-scenarios.js

@@ -1,12 +1,13 @@
 // tools/challenge-spec/security-challenge-scenarios.ts — Security challenges for challenge_spec
 // SPEC-029 criteria 11, 24: authorization challenges and STRIDE-based challenges
 import { detectSecurityProfiles } from '../../engine/security-analyzer.js';
+import { hasAnyAffirmedMatch } from './scenarios-utils.js';
 /**
  * Generate security challenge scenarios specific to authorization, STRIDE threats,
  * and resource ownership. Used by handleChallengeSpec in the 'security' focus area.
  */
-export function generateSecurityChallengeScenarios(spec, _specContent, _knowledge) {
-    const profiles = detectSecurityProfiles(spec.title, '', spec.tags);
+export function generateSecurityChallengeScenarios(spec, specContent, _knowledge) {
+    const profiles = detectSecurityProfiles(spec.title, specContent, spec.tags);
     const scenarios = [];
     // Authorization challenge (criterion 11): resource ownership
     if (profiles.includes('public-api') || profiles.includes('db-access')) {
@@ -16,15 +17,14 @@ export function generateSecurityChallengeScenarios(spec, _specContent, _knowledg
             impact: 'critical',
             currentHandling: 'Authorization check may be missing at the data access layer — only route-level guards present.',
             requiredHandling: 'Implement object-level authorization on every data access operation. ' +
-                'Never trust client-provided resource IDs without verifying ownership. ' +
-                'Use indirect references (UUIDs) instead of sequential IDs.',
-            dataConsistency: 'Unauthorized access should return 403, never 404 that leaks resource existence.',
-            userExperience: 'Return consistent 403 Forbidden for unauthorized access — do not reveal if the resource exists.',
+                'Never trust client-provided resource identifiers without verifying ownership using the declared authorization model.',
+            dataConsistency: 'Unauthorized access must not reveal resource existence.',
+            userExperience: 'Use the authorization failure response defined by the API contract.',
         });
     }
     // JWT-specific challenges
-    const lower = `${spec.title} ${spec.tags.join(' ')}`.toLowerCase();
-    const hasJwt = lower.includes('jwt') || lower.includes('token') || lower.includes('auth');
+    const signalText = `${spec.title}\n${spec.tags.join(' ')}\n${specContent}`;
+    const hasJwt = hasAnyAffirmedMatch(signalText, [/\b(?:jwt|json\s+web\s+token)\b/i]);
     if (hasJwt) {
         scenarios.push({
             scenario: `[${spec.id}] JWT Algorithm Confusion Attack: attacker changes JWT header algorithm to "none" or switches RS256 to HS256. Server accepts forged token if it trusts the header.`,
@@ -34,17 +34,16 @@ export function generateSecurityChallengeScenarios(spec, _specContent, _knowledg
             requiredHandling: 'Explicitly configure the allowed algorithm(s) in JWT verification. ' +
                 'Never use the algorithm from the token header. Reject tokens with "none" algorithm.',
             dataConsistency: 'Invalid tokens must never reach business logic — reject at middleware boundary.',
-            userExperience: 'Return 401 Unauthorized for invalid tokens — do not expose algorithm validation details.',
+            userExperience: 'Use the invalid-token response defined by the authentication contract.',
         });
         scenarios.push({
-            scenario: `[${spec.id}] Expired Token Access: user presents an expired JWT. Does the API return 401 immediately, or does expired token reach business logic?`,
+            scenario: `[${spec.id}] Expired Token Access: user presents an expired JWT. Does the declared authentication failure occur before business logic?`,
             probability: 'medium',
             impact: 'high',
             currentHandling: 'Expiry check may not be the first middleware step — race conditions possible.',
-            requiredHandling: 'Verify token expiry (exp claim) as the first step in auth middleware. ' +
-                'Return 401 with error code "token_expired" so clients can trigger refresh flow.',
+            requiredHandling: 'Verify token expiry before business logic and use the expiration result defined by the authentication contract.',
             dataConsistency: 'Expired tokens must never modify state — check before any write operations.',
-            userExperience: 'Return structured error { "error": "token_expired" } so clients can refresh automatically.',
+            userExperience: 'Use the expiration and refresh behavior defined by the client contract.',
         });
     }
     // SQL injection challenges for DB features
@@ -62,28 +61,24 @@ export function generateSecurityChallengeScenarios(spec, _specContent, _knowledg
         });
     }
     // Role-based access challenges
-    const hasRoles = lower.includes('role') ||
-        lower.includes('admin') ||
-        lower.includes('permission') ||
-        lower.includes('rbac');
+    const hasRoles = hasAnyAffirmedMatch(signalText, [
+        /\b(?:role|admin|permission|rbac|access\s+control)\b/i,
+    ]);
     if (hasRoles) {
         scenarios.push({
             scenario: `[${spec.id}] Privilege Escalation via Role Manipulation: user with role "viewer" calls admin endpoint, or modifies JWT payload claiming role "admin". Role enforcement missing at middleware.`,
             probability: 'medium',
             impact: 'critical',
             currentHandling: 'Role enforcement may be per-handler instead of middleware — inconsistent coverage.',
-            requiredHandling: 'Enforce RBAC in middleware, not per-handler. ' +
-                'Never derive roles from user-supplied data; always load from a trusted store. ' +
-                'Log unauthorized access attempts for monitoring.',
+            requiredHandling: 'Enforce the declared role model consistently before protected behavior, load roles from the trusted identity boundary, and record the audit evidence required by the contract.',
             dataConsistency: 'Admin operations that modify state must verify role before any data mutation.',
-            userExperience: 'Return 403 Forbidden with a user-facing message — log the attempt with user ID for audit.',
+            userExperience: 'Use the forbidden-action response defined by the authorization contract.',
         });
     }
     // STRIDE elevation of privilege challenge for admin/payment
-    const isHighRisk = lower.includes('payment') ||
-        lower.includes('admin') ||
-        lower.includes('billing') ||
-        lower.includes('sensitive');
+    const isHighRisk = hasAnyAffirmedMatch(signalText, [
+        /\b(?:payment|billing|admin\s+operation|sensitive\s+operation)\b/i,
+    ]);
     if (isHighRisk) {
         scenarios.push({
             scenario: `[${spec.id}] STRIDE Elevation of Privilege: regular user performs a sequence of legitimate API calls that results in unintended elevated access (e.g., create → transfer → access with original permissions).`,

package/dist/tools/challenge-spec.js

@@ -8,23 +8,16 @@ import { updateSpec } from '../storage/spec-store.js';
 import { resolveProjectId, missingProjectIdError } from './resolve-project-id.js';
 import { elicitOrFallback, buildEnumSchema } from '../engine/elicitation/elicit-helper.js';
 import { t, ti } from '../i18n/index.js';
-import { generateFailureScenarios, generateSecurityScenarios, generateScaleScenarios, generateDataConsistencyScenarios, generateGameChallenges, generateDesktopAutoUpdateChallenges, } from './challenge-spec-scenarios.js';
 import { generateConcurrencyAnalysis, buildScalabilityAssessment, calculateOverallRisk, readSpecContent, } from './challenge-spec-helpers.js';
 import { prioritizeScenarios, buildPrioritizedSummary } from '../engine/challenge-prioritizer.js';
 import { checkContradictions as checkScopeContradictions } from '../engine/scope-boundaries/index.js';
 import { buildChallengeSpecSummary } from '../engine/human-summary.js';
-import { generateAgentChallengeScenarios, isAgentSpec, } from './challenge-spec/agent-challenge-scenarios.js';
-import { generateImplementationContractChallengeScenarios } from './challenge-spec/implementation-contract-challenge-scenarios.js';
-import { getPlatformChallenges } from './challenge-spec/platform-challenge-scenarios.js';
-import { generateSecurityChallengeScenarios } from './challenge-spec/security-challenge-scenarios.js';
-import { generatePrivacyChallengeScenarios } from './challenge-spec/privacy-challenge-scenarios.js';
-import { generateEventChallengeScenarios } from './challenge-spec/event-challenge-scenarios.js';
-import { generateDddChallenges, generateXpPairClarityChallenge, } from './challenge-spec/architecture-challenge-scenarios.js';
-import { generateResilienceChallengeScenarios } from './challenge-spec/resilience-challenge-scenarios.js';
 import { detectContradictions as detectDecisionContradictions, searchPriorDecisions, } from '../engine/prior-decisions/index.js';
 import { getDecisions } from '../storage/decision-store.js';
 import { calculateTokenBudget, injectBudgetIntoPrompt } from '../engine/token-budget/index.js';
 import { analyzeMinimalImplementation, loadMinimalImplementationPolicy, } from '../engine/minimality/index.js';
+import { detectChallengeCapabilities, } from './challenge-spec/scenarios-utils.js';
+import { collectCapabilityScenarios } from './challenge-spec/scenario-collector.js';
 const ALL_FOCUS_AREAS = [
     'failures',
     'concurrency',
@@ -32,7 +25,6 @@ const ALL_FOCUS_AREAS = [
     'security',
     'data-consistency',
 ];
-const ACTIONABLE_RELEVANCE_MIN = 15;
 /**
  * SPEC-615 AC3: detect contradictions between spec criteria and prior decisions.
  * Mutates failureScenarios in place. Best-effort — never throws.
@@ -125,6 +117,7 @@ export async function handleChallengeSpec(args, server) {
     const constitution = await knowledgeStore.getConstitution(projectId);
     // 3. Read spec content
     const specContent = await readSpecContent(spec);
+    const capabilities = detectChallengeCapabilities(spec, specContent);
     // 4. Determine focus areas
     const focusAreas = focus && focus.length > 0 ? focus : ALL_FOCUS_AREAS;
     // 5. Generate failure scenarios
@@ -153,58 +146,7 @@ export async function handleChallengeSpec(args, server) {
     catch {
         // Minimality challenge is best-effort and must not hide resilience findings.
     }
-    if (focusAreas.includes('failures')) {
-        failureScenarios.push(...generateFailureScenarios(spec, specContent, knowledge));
-    }
-    if (focusAreas.includes('security')) {
-        failureScenarios.push(...generateSecurityScenarios(spec, specContent, knowledge));
-    }
-    if (focusAreas.includes('scale')) {
-        failureScenarios.push(...generateScaleScenarios(spec, specContent, knowledge));
-    }
-    if (focusAreas.includes('data-consistency')) {
-        failureScenarios.push(...generateDataConsistencyScenarios(spec, specContent, knowledge));
-    }
-    // 5e. Game-specific challenges (performance, balance, cheating, physics)
-    if (knowledge.projectCategory === 'game' ||
-        (knowledge.framework !== null &&
-            ['unity', 'godot', 'unreal', 'bevy', 'phaser', 'pygame'].includes(knowledge.framework))) {
-        failureScenarios.push(...generateGameChallenges(spec, specContent, knowledge));
-    }
-    // 5f. SPEC-014b: Desktop auto-update edge cases
-    failureScenarios.push(...generateDesktopAutoUpdateChallenges(spec, specContent, knowledge));
-    // 5g. SPEC-016a: AI agent-specific failure modes
-    if (isAgentSpec(spec, specContent)) {
-        failureScenarios.push(...generateAgentChallengeScenarios(spec, specContent, knowledge));
-    }
-    if (focusAreas.includes('failures')) {
-        failureScenarios.push(...generateImplementationContractChallengeScenarios(spec, specContent));
-    }
-    // 5h. SPEC-015a: Smart contract, bot, and IoT challenges
-    failureScenarios.push(...getPlatformChallenges(spec, specContent, knowledge));
-    // 5i. SPEC-029: Security authorization and STRIDE challenges
-    if (focusAreas.includes('security')) {
-        failureScenarios.push(...generateSecurityChallengeScenarios(spec, specContent, knowledge));
-    }
-    // 5j. SPEC-030: Privacy challenges (mandatory when spec has PII)
-    failureScenarios.push(...generatePrivacyChallengeScenarios(spec, specContent, knowledge));
-    // 5k. SPEC-031: Event-driven challenges (contract, idempotence, DLQ)
-    failureScenarios.push(...generateEventChallengeScenarios(spec, specContent, knowledge));
-    // 5l. SPEC-033: DDD aggregate integrity challenges
-    const hasDdd = knowledge.architecture.primary === 'ddd' || knowledge.architecture.secondary.includes('ddd');
-    if (hasDdd) {
-        failureScenarios.push(...generateDddChallenges(spec, specContent));
-    }
-    // 5n. SPEC-034: Resilience, validation, concurrency, and saga challenges
-    failureScenarios.push(...generateResilienceChallengeScenarios(spec, specContent, knowledge));
-    // 5m. SPEC-033: XP pair programming clarity challenge
-    // `agileConfig` may be present on enriched knowledge objects (AgileProcessDetection mixin)
-    // but is not declared on the base ProjectKnowledge interface — intentional duck-type access.
-    // ProjectKnowledge has no index signature, so `as unknown` intermediate is required.
-    const agileConfig = knowledge.agileConfig;
-    if (agileConfig?.process === 'xp') {
-        failureScenarios.push(...generateXpPairClarityChallenge(spec, specContent));
-    }
+    failureScenarios.push(...collectCapabilityScenarios({ spec, specContent, knowledge, focusAreas, capabilities }));
     // SPEC-612: Check for contradictions between outOfScope and acceptance criteria
     if (spec.outOfScope !== undefined && spec.outOfScope.length > 0) {
         const criteriaTexts = specContent
@@ -228,31 +170,25 @@ export async function handleChallengeSpec(args, server) {
     // SPEC-615 AC3: Check criteria against prior decisions for technology contradictions
     await runPriorDecisionContradictions(projectId, spec.title, spec.tags, specContent, failureScenarios);
     // 6. Generate concurrency analysis
-    const concurrencyAnalysis = focusAreas.includes('concurrency')
+    const concurrencyAnalysis = focusAreas.includes('concurrency') && capabilities.concurrency
         ? generateConcurrencyAnalysis(spec, specContent, knowledge)
         : { hotPaths: [], raceConditions: [], sharedState: [], recommendations: [] };
-    // 7. Build scalability assessment
-    const scalabilityAssessment = buildScalabilityAssessment(spec, knowledge, failureScenarios);
-    // 8. Calculate overall risk
-    const overallRisk = calculateOverallRisk(failureScenarios, concurrencyAnalysis);
+    // Unsupported domain templates are removed before prioritization and risk calculation.
+    const actionableFailureScenarios = failureScenarios.filter((scenario) => isScenarioSupportedByCapabilities(scenario, capabilities));
+    const suppressedScenarioCount = failureScenarios.length - actionableFailureScenarios.length;
+    // 7. Build scalability assessment from grounded scenarios only.
+    const scalabilityAssessment = buildScalabilityAssessment(spec, knowledge, actionableFailureScenarios);
+    // 8. Calculate overall risk from grounded scenarios only.
+    const overallRisk = calculateOverallRisk(actionableFailureScenarios, concurrencyAnalysis);
     // 9. Compute relevance scores and select top-3 (SPEC-338)
-    const prioritized = prioritizeScenarios(failureScenarios, spec);
+    const prioritized = prioritizeScenarios(actionableFailureScenarios, spec);
     const prioritizedSummary = buildPrioritizedSummary(prioritized);
-    // Attach relevanceScore to each scenario in the full list
-    const failureScenariosScored = failureScenarios.map((s) => {
+    const failureScenariosScored = actionableFailureScenarios.map((s) => {
         const match = prioritized.find((p) => p.scenario === s.scenario);
         return match !== undefined ? { ...s, relevanceScore: match.relevanceScore } : s;
     });
-    const prioritizedScenarios = new Set(prioritized.map((scenario) => scenario.scenario));
-    const actionableFailureScenarios = failureScenariosScored.filter((scenario) => prioritizedScenarios.has(scenario.scenario) ||
-        scenario.impact === 'critical' ||
-        scenario.impact === 'high' ||
-        isDomainRelevantScenario(scenario, specContent, knowledge) ||
-        (scenario.relevanceScore ?? computeScenarioRelevanceFallback(scenario)) >=
-            ACTIONABLE_RELEVANCE_MIN);
-    const suppressedScenarioCount = failureScenariosScored.length - actionableFailureScenarios.length;
     const analysis = {
-        failureScenarios: actionableFailureScenarios,
+        failureScenarios: failureScenariosScored,
         concurrencyAnalysis,
         scalabilityAssessment,
         overallRisk,
@@ -271,12 +207,12 @@ export async function handleChallengeSpec(args, server) {
         },
         summary: {
             totalScenarios: failureScenarios.length,
-            actionableScenarios: actionableFailureScenarios.length,
+            actionableScenarios: failureScenariosScored.length,
             suppressedLowRelevanceScenarios: suppressedScenarioCount,
             shownByDefault: 3,
             mustAddressBeforeCoding: prioritizedSummary,
-            criticalImpact: failureScenarios.filter((s) => s.impact === 'critical').length,
-            highImpact: failureScenarios.filter((s) => s.impact === 'high').length,
+            criticalImpact: actionableFailureScenarios.filter((s) => s.impact === 'critical').length,
+            highImpact: actionableFailureScenarios.filter((s) => s.impact === 'high').length,
             raceConditions: concurrencyAnalysis.raceConditions.length,
             overallRisk,
             focusAreas: focusAreas,
@@ -302,8 +238,8 @@ export async function handleChallengeSpec(args, server) {
         await updateSpec(projectId, specId, {
             challengeReport: {
                 runAt: new Date().toISOString(),
-                totalScenarios: failureScenarios.length,
-                addressedCount: failureScenarios.length, // All generated scenarios are considered "addressed" by running challenge_spec
+                totalScenarios: actionableFailureScenarios.length,
+                addressedCount: actionableFailureScenarios.length,
                 focusAreas: focusAreas,
                 overallRisk: overallRisk,
                 passed: true,
@@ -314,7 +250,7 @@ export async function handleChallengeSpec(args, server) {
         // Best-effort: don't fail the challenge if persistence fails
     }
     // SPEC-595: Elicit how user wants to apply suggestions when critical issues exist
-    const criticalCount = failureScenarios.filter((s) => s.impact === 'critical').length;
+    const criticalCount = actionableFailureScenarios.filter((s) => s.impact === 'critical').length;
     if (server !== undefined && criticalCount > 0) {
         const { field, property } = buildEnumSchema('apply', ['all', 'critical', 'none'], ['Apply all suggestions', 'Apply critical only (Recommended)', 'Review manually'], 'Apply suggestions', 'critical');
         const schema = { type: 'object', properties: { [field]: property } };
@@ -326,7 +262,7 @@ export async function handleChallengeSpec(args, server) {
                     {
                         type: 'text',
                         text: ti('tools.challenge_spec.success', {
-                            scenarioCount: String(failureScenarios.length),
+                            scenarioCount: String(actionableFailureScenarios.length),
                         }),
                     },
                     { type: 'text', text: humanSummary },
@@ -349,7 +285,7 @@ export async function handleChallengeSpec(args, server) {
                 {
                     type: 'text',
                     text: ti('tools.challenge_spec.success', {
-                        scenarioCount: String(failureScenarios.length),
+                        scenarioCount: String(actionableFailureScenarios.length),
                     }),
                 },
                 { type: 'text', text: humanSummary },
@@ -362,12 +298,12 @@ export async function handleChallengeSpec(args, server) {
             {
                 type: 'text',
                 text: ti('tools.challenge_spec.success', {
-                    scenarioCount: String(failureScenarios.length),
+                    scenarioCount: String(actionableFailureScenarios.length),
                 }),
             },
             {
                 type: 'text',
-                text: `Actionable scenarios: ${String(actionableFailureScenarios.length)}` +
+                text: `Actionable scenarios: ${String(failureScenariosScored.length)}` +
                     ` | Suppressed low-relevance: ${String(suppressedScenarioCount)}` +
                     ` | Overall risk: ${overallRisk}`,
             },
@@ -376,37 +312,22 @@ export async function handleChallengeSpec(args, server) {
         structuredContent: analysisPayload,
     };
 }
-function computeScenarioRelevanceFallback(scenario) {
-    if (scenario.impact === 'critical') {
-        return 100;
-    }
-    if (scenario.impact === 'high') {
-        return 70;
-    }
-    if (scenario.probability === 'high') {
-        return 35;
-    }
-    return 0;
-}
-function isDomainRelevantScenario(scenario, specContent, knowledge) {
+function isScenarioSupportedByCapabilities(scenario, capabilities) {
     const haystack = `${scenario.scenario} ${scenario.currentHandling} ${scenario.requiredHandling}`
         .toLowerCase()
         .trim();
-    const specText = specContent.toLowerCase();
-    const framework = knowledge.framework?.toLowerCase() ?? '';
-    const isGameProject = knowledge.projectCategory === 'game' ||
-        ['unity', 'godot', 'unreal', 'bevy', 'phaser', 'pygame'].includes(framework);
-    if (isGameProject && /\b(game|physics|cheat|balance|save|hud|player)\b/.test(haystack)) {
-        return true;
-    }
-    if (/\b(database|query|index|pagination|transaction|cache)\b/.test(haystack) &&
-        /\b(database|query|index|pagination|transaction|cache|sql|postgres|sqlite)\b/.test(specText)) {
-        return true;
-    }
-    if (/\b(api|auth|jwt|session|csrf|injection|tenant|bola)\b/.test(haystack) &&
-        /\b(api|auth|jwt|session|csrf|injection|tenant|bola)\b/.test(specText)) {
-        return true;
-    }
-    return false;
+    const rules = [
+        [/\b(?:payment|billing|checkout|stripe|paypal)\b/, capabilities.payment],
+        [/\b(?:privacy|pii|gdpr|personal data)\b/, capabilities.privacy],
+        [
+            /\b(?:bola|idor|jwt|authentication|authorization|csrf|privilege)\b/,
+            capabilities.authentication || capabilities.authorization,
+        ],
+        [/\b(?:sql|nosql|database|connection pool)\b/, capabilities.database],
+        [/\b(?:event contract|event schema|message broker|kafka|rabbitmq|dlq)\b/, capabilities.events],
+        [/\b(?:api endpoint|http route|http status|network timeout)\b/, capabilities.networkApi],
+        [/\b(?:traffic spike|load test|auto-scaling|throughput)\b/, capabilities.scale],
+    ];
+    return rules.every(([pattern, supported]) => !pattern.test(haystack) || supported);
 }
 //# sourceMappingURL=challenge-spec.js.map

package/dist/tools/compliance-gate-handler.d.ts

@@ -3,8 +3,8 @@ import type { ToolResult } from '../types/index.js';
 export declare const ConfigureComplianceGateSchema: z.ZodObject<{
     projectPath: z.ZodString;
     mode: z.ZodEnum<{
-        soft: "soft";
         hard: "hard";
+        soft: "soft";
     }>;
     threshold: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strip>;