@planu/cli 4.11.1 → 4.11.3

package/dist/tools/challenge-spec.js

@@ -8,23 +8,17 @@ import { updateSpec } from '../storage/spec-store.js';
 import { resolveProjectId, missingProjectIdError } from './resolve-project-id.js';
 import { elicitOrFallback, buildEnumSchema } from '../engine/elicitation/elicit-helper.js';
 import { t, ti } from '../i18n/index.js';
-import { generateFailureScenarios, generateSecurityScenarios, generateScaleScenarios, generateDataConsistencyScenarios, generateGameChallenges, generateDesktopAutoUpdateChallenges, } from './challenge-spec-scenarios.js';
 import { generateConcurrencyAnalysis, buildScalabilityAssessment, calculateOverallRisk, readSpecContent, } from './challenge-spec-helpers.js';
 import { prioritizeScenarios, buildPrioritizedSummary } from '../engine/challenge-prioritizer.js';
 import { checkContradictions as checkScopeContradictions } from '../engine/scope-boundaries/index.js';
 import { buildChallengeSpecSummary } from '../engine/human-summary.js';
-import { generateAgentChallengeScenarios, isAgentSpec, } from './challenge-spec/agent-challenge-scenarios.js';
-import { generateImplementationContractChallengeScenarios } from './challenge-spec/implementation-contract-challenge-scenarios.js';
-import { getPlatformChallenges } from './challenge-spec/platform-challenge-scenarios.js';
-import { generateSecurityChallengeScenarios } from './challenge-spec/security-challenge-scenarios.js';
-import { generatePrivacyChallengeScenarios } from './challenge-spec/privacy-challenge-scenarios.js';
-import { generateEventChallengeScenarios } from './challenge-spec/event-challenge-scenarios.js';
-import { generateDddChallenges, generateXpPairClarityChallenge, } from './challenge-spec/architecture-challenge-scenarios.js';
-import { generateResilienceChallengeScenarios } from './challenge-spec/resilience-challenge-scenarios.js';
 import { detectContradictions as detectDecisionContradictions, searchPriorDecisions, } from '../engine/prior-decisions/index.js';
 import { getDecisions } from '../storage/decision-store.js';
 import { calculateTokenBudget, injectBudgetIntoPrompt } from '../engine/token-budget/index.js';
 import { analyzeMinimalImplementation, loadMinimalImplementationPolicy, } from '../engine/minimality/index.js';
+import { detectChallengeCapabilities, } from './challenge-spec/scenarios-utils.js';
+import { collectCapabilityScenarios } from './challenge-spec/scenario-collector.js';
+import { buildChallengeReport } from './challenge-spec/challenge-report.js';
 const ALL_FOCUS_AREAS = [
     'failures',
     'concurrency',
@@ -32,7 +26,6 @@ const ALL_FOCUS_AREAS = [
     'security',
     'data-consistency',
 ];
-const ACTIONABLE_RELEVANCE_MIN = 15;
 /**
  * SPEC-615 AC3: detect contradictions between spec criteria and prior decisions.
  * Mutates failureScenarios in place. Best-effort — never throws.
@@ -125,6 +118,7 @@ export async function handleChallengeSpec(args, server) {
     const constitution = await knowledgeStore.getConstitution(projectId);
     // 3. Read spec content
     const specContent = await readSpecContent(spec);
+    const capabilities = detectChallengeCapabilities(spec, specContent);
     // 4. Determine focus areas
     const focusAreas = focus && focus.length > 0 ? focus : ALL_FOCUS_AREAS;
     // 5. Generate failure scenarios
@@ -153,58 +147,7 @@ export async function handleChallengeSpec(args, server) {
     catch {
         // Minimality challenge is best-effort and must not hide resilience findings.
     }
-    if (focusAreas.includes('failures')) {
-        failureScenarios.push(...generateFailureScenarios(spec, specContent, knowledge));
-    }
-    if (focusAreas.includes('security')) {
-        failureScenarios.push(...generateSecurityScenarios(spec, specContent, knowledge));
-    }
-    if (focusAreas.includes('scale')) {
-        failureScenarios.push(...generateScaleScenarios(spec, specContent, knowledge));
-    }
-    if (focusAreas.includes('data-consistency')) {
-        failureScenarios.push(...generateDataConsistencyScenarios(spec, specContent, knowledge));
-    }
-    // 5e. Game-specific challenges (performance, balance, cheating, physics)
-    if (knowledge.projectCategory === 'game' ||
-        (knowledge.framework !== null &&
-            ['unity', 'godot', 'unreal', 'bevy', 'phaser', 'pygame'].includes(knowledge.framework))) {
-        failureScenarios.push(...generateGameChallenges(spec, specContent, knowledge));
-    }
-    // 5f. SPEC-014b: Desktop auto-update edge cases
-    failureScenarios.push(...generateDesktopAutoUpdateChallenges(spec, specContent, knowledge));
-    // 5g. SPEC-016a: AI agent-specific failure modes
-    if (isAgentSpec(spec, specContent)) {
-        failureScenarios.push(...generateAgentChallengeScenarios(spec, specContent, knowledge));
-    }
-    if (focusAreas.includes('failures')) {
-        failureScenarios.push(...generateImplementationContractChallengeScenarios(spec, specContent));
-    }
-    // 5h. SPEC-015a: Smart contract, bot, and IoT challenges
-    failureScenarios.push(...getPlatformChallenges(spec, specContent, knowledge));
-    // 5i. SPEC-029: Security authorization and STRIDE challenges
-    if (focusAreas.includes('security')) {
-        failureScenarios.push(...generateSecurityChallengeScenarios(spec, specContent, knowledge));
-    }
-    // 5j. SPEC-030: Privacy challenges (mandatory when spec has PII)
-    failureScenarios.push(...generatePrivacyChallengeScenarios(spec, specContent, knowledge));
-    // 5k. SPEC-031: Event-driven challenges (contract, idempotence, DLQ)
-    failureScenarios.push(...generateEventChallengeScenarios(spec, specContent, knowledge));
-    // 5l. SPEC-033: DDD aggregate integrity challenges
-    const hasDdd = knowledge.architecture.primary === 'ddd' || knowledge.architecture.secondary.includes('ddd');
-    if (hasDdd) {
-        failureScenarios.push(...generateDddChallenges(spec, specContent));
-    }
-    // 5n. SPEC-034: Resilience, validation, concurrency, and saga challenges
-    failureScenarios.push(...generateResilienceChallengeScenarios(spec, specContent, knowledge));
-    // 5m. SPEC-033: XP pair programming clarity challenge
-    // `agileConfig` may be present on enriched knowledge objects (AgileProcessDetection mixin)
-    // but is not declared on the base ProjectKnowledge interface — intentional duck-type access.
-    // ProjectKnowledge has no index signature, so `as unknown` intermediate is required.
-    const agileConfig = knowledge.agileConfig;
-    if (agileConfig?.process === 'xp') {
-        failureScenarios.push(...generateXpPairClarityChallenge(spec, specContent));
-    }
+    failureScenarios.push(...collectCapabilityScenarios({ spec, specContent, knowledge, focusAreas, capabilities }));
     // SPEC-612: Check for contradictions between outOfScope and acceptance criteria
     if (spec.outOfScope !== undefined && spec.outOfScope.length > 0) {
         const criteriaTexts = specContent
@@ -228,35 +171,35 @@ export async function handleChallengeSpec(args, server) {
     // SPEC-615 AC3: Check criteria against prior decisions for technology contradictions
     await runPriorDecisionContradictions(projectId, spec.title, spec.tags, specContent, failureScenarios);
     // 6. Generate concurrency analysis
-    const concurrencyAnalysis = focusAreas.includes('concurrency')
+    const concurrencyAnalysis = focusAreas.includes('concurrency') && capabilities.concurrency
         ? generateConcurrencyAnalysis(spec, specContent, knowledge)
         : { hotPaths: [], raceConditions: [], sharedState: [], recommendations: [] };
-    // 7. Build scalability assessment
-    const scalabilityAssessment = buildScalabilityAssessment(spec, knowledge, failureScenarios);
-    // 8. Calculate overall risk
-    const overallRisk = calculateOverallRisk(failureScenarios, concurrencyAnalysis);
+    // Unsupported domain templates are removed before prioritization and risk calculation.
+    const actionableFailureScenarios = failureScenarios.filter((scenario) => isScenarioSupportedByCapabilities(scenario, capabilities));
+    const suppressedScenarioCount = failureScenarios.length - actionableFailureScenarios.length;
+    // 7. Build scalability assessment from grounded scenarios only.
+    const scalabilityAssessment = buildScalabilityAssessment(spec, knowledge, actionableFailureScenarios);
+    // 8. Calculate overall risk from grounded scenarios only.
+    const overallRisk = calculateOverallRisk(actionableFailureScenarios, concurrencyAnalysis);
     // 9. Compute relevance scores and select top-3 (SPEC-338)
-    const prioritized = prioritizeScenarios(failureScenarios, spec);
+    const prioritized = prioritizeScenarios(actionableFailureScenarios, spec);
     const prioritizedSummary = buildPrioritizedSummary(prioritized);
-    // Attach relevanceScore to each scenario in the full list
-    const failureScenariosScored = failureScenarios.map((s) => {
+    const failureScenariosScored = actionableFailureScenarios.map((s) => {
         const match = prioritized.find((p) => p.scenario === s.scenario);
         return match !== undefined ? { ...s, relevanceScore: match.relevanceScore } : s;
     });
-    const prioritizedScenarios = new Set(prioritized.map((scenario) => scenario.scenario));
-    const actionableFailureScenarios = failureScenariosScored.filter((scenario) => prioritizedScenarios.has(scenario.scenario) ||
-        scenario.impact === 'critical' ||
-        scenario.impact === 'high' ||
-        isDomainRelevantScenario(scenario, specContent, knowledge) ||
-        (scenario.relevanceScore ?? computeScenarioRelevanceFallback(scenario)) >=
-            ACTIONABLE_RELEVANCE_MIN);
-    const suppressedScenarioCount = failureScenariosScored.length - actionableFailureScenarios.length;
     const analysis = {
-        failureScenarios: actionableFailureScenarios,
+        failureScenarios: failureScenariosScored,
         concurrencyAnalysis,
         scalabilityAssessment,
         overallRisk,
     };
+    const challengeReport = buildChallengeReport({
+        scenarios: failureScenariosScored,
+        focusAreas,
+        overallRisk,
+        previousReport: spec.challengeReport,
+    });
     const rawHumanSummary = buildChallengeSpecSummary(prioritized, overallRisk);
     // SPEC-620: Inject token budget tag into the LLM-facing summary prompt
     const specDevHours = spec.estimation.devHours;
@@ -271,12 +214,12 @@ export async function handleChallengeSpec(args, server) {
         },
         summary: {
             totalScenarios: failureScenarios.length,
-            actionableScenarios: actionableFailureScenarios.length,
+            actionableScenarios: failureScenariosScored.length,
             suppressedLowRelevanceScenarios: suppressedScenarioCount,
             shownByDefault: 3,
             mustAddressBeforeCoding: prioritizedSummary,
-            criticalImpact: failureScenarios.filter((s) => s.impact === 'critical').length,
-            highImpact: failureScenarios.filter((s) => s.impact === 'high').length,
+            criticalImpact: actionableFailureScenarios.filter((s) => s.impact === 'critical').length,
+            highImpact: actionableFailureScenarios.filter((s) => s.impact === 'high').length,
             raceConditions: concurrencyAnalysis.raceConditions.length,
             overallRisk,
             focusAreas: focusAreas,
@@ -296,25 +239,19 @@ export async function handleChallengeSpec(args, server) {
                 checkedAt: new Date().toISOString(),
             }
             : null,
+        challengeReport,
     };
     // SPEC-964: Persist challenge report so update_status can gate on it
     try {
         await updateSpec(projectId, specId, {
-            challengeReport: {
-                runAt: new Date().toISOString(),
-                totalScenarios: failureScenarios.length,
-                addressedCount: failureScenarios.length, // All generated scenarios are considered "addressed" by running challenge_spec
-                focusAreas: focusAreas,
-                overallRisk: overallRisk,
-                passed: true,
-            },
+            challengeReport,
         });
     }
     catch {
         // Best-effort: don't fail the challenge if persistence fails
     }
     // SPEC-595: Elicit how user wants to apply suggestions when critical issues exist
-    const criticalCount = failureScenarios.filter((s) => s.impact === 'critical').length;
+    const criticalCount = actionableFailureScenarios.filter((s) => s.impact === 'critical').length;
     if (server !== undefined && criticalCount > 0) {
         const { field, property } = buildEnumSchema('apply', ['all', 'critical', 'none'], ['Apply all suggestions', 'Apply critical only (Recommended)', 'Review manually'], 'Apply suggestions', 'critical');
         const schema = { type: 'object', properties: { [field]: property } };
@@ -326,7 +263,7 @@ export async function handleChallengeSpec(args, server) {
                     {
                         type: 'text',
                         text: ti('tools.challenge_spec.success', {
-                            scenarioCount: String(failureScenarios.length),
+                            scenarioCount: String(actionableFailureScenarios.length),
                         }),
                     },
                     { type: 'text', text: humanSummary },
@@ -349,7 +286,7 @@ export async function handleChallengeSpec(args, server) {
                 {
                     type: 'text',
                     text: ti('tools.challenge_spec.success', {
-                        scenarioCount: String(failureScenarios.length),
+                        scenarioCount: String(actionableFailureScenarios.length),
                     }),
                 },
                 { type: 'text', text: humanSummary },
@@ -362,12 +299,12 @@ export async function handleChallengeSpec(args, server) {
             {
                 type: 'text',
                 text: ti('tools.challenge_spec.success', {
-                    scenarioCount: String(failureScenarios.length),
+                    scenarioCount: String(actionableFailureScenarios.length),
                 }),
             },
             {
                 type: 'text',
-                text: `Actionable scenarios: ${String(actionableFailureScenarios.length)}` +
+                text: `Actionable scenarios: ${String(failureScenariosScored.length)}` +
                     ` | Suppressed low-relevance: ${String(suppressedScenarioCount)}` +
                     ` | Overall risk: ${overallRisk}`,
             },
@@ -376,37 +313,22 @@ export async function handleChallengeSpec(args, server) {
         structuredContent: analysisPayload,
     };
 }
-function computeScenarioRelevanceFallback(scenario) {
-    if (scenario.impact === 'critical') {
-        return 100;
-    }
-    if (scenario.impact === 'high') {
-        return 70;
-    }
-    if (scenario.probability === 'high') {
-        return 35;
-    }
-    return 0;
-}
-function isDomainRelevantScenario(scenario, specContent, knowledge) {
+function isScenarioSupportedByCapabilities(scenario, capabilities) {
     const haystack = `${scenario.scenario} ${scenario.currentHandling} ${scenario.requiredHandling}`
         .toLowerCase()
         .trim();
-    const specText = specContent.toLowerCase();
-    const framework = knowledge.framework?.toLowerCase() ?? '';
-    const isGameProject = knowledge.projectCategory === 'game' ||
-        ['unity', 'godot', 'unreal', 'bevy', 'phaser', 'pygame'].includes(framework);
-    if (isGameProject && /\b(game|physics|cheat|balance|save|hud|player)\b/.test(haystack)) {
-        return true;
-    }
-    if (/\b(database|query|index|pagination|transaction|cache)\b/.test(haystack) &&
-        /\b(database|query|index|pagination|transaction|cache|sql|postgres|sqlite)\b/.test(specText)) {
-        return true;
-    }
-    if (/\b(api|auth|jwt|session|csrf|injection|tenant|bola)\b/.test(haystack) &&
-        /\b(api|auth|jwt|session|csrf|injection|tenant|bola)\b/.test(specText)) {
-        return true;
-    }
-    return false;
+    const rules = [
+        [/\b(?:payment|billing|checkout|stripe|paypal)\b/, capabilities.payment],
+        [/\b(?:privacy|pii|gdpr|personal data)\b/, capabilities.privacy],
+        [
+            /\b(?:bola|idor|jwt|authentication|authorization|csrf|privilege)\b/,
+            capabilities.authentication || capabilities.authorization,
+        ],
+        [/\b(?:sql|nosql|database|connection pool)\b/, capabilities.database],
+        [/\b(?:event contract|event schema|message broker|kafka|rabbitmq|dlq)\b/, capabilities.events],
+        [/\b(?:api endpoint|http route|http status|network timeout)\b/, capabilities.networkApi],
+        [/\b(?:traffic spike|load test|auto-scaling|throughput)\b/, capabilities.scale],
+    ];
+    return rules.every(([pattern, supported]) => !pattern.test(haystack) || supported);
 }
 //# sourceMappingURL=challenge-spec.js.map

package/dist/tools/clarify-requirements/multiple-choice.js

@@ -277,7 +277,7 @@ export function attachOptions(question) {
  * The returned string is suitable for passing directly to create_spec.
  */
 export function buildSuggestedDescription(topic, answers, questions) {
-    const parts = [`Feature: ${topic}.`];
+    const parts = [`Topic: ${topic}.`];
     for (const q of questions) {
         const answer = answers[q.id];
         if (answer === undefined || answer.trim() === '') {

package/dist/tools/clarify-requirements/questions-context.js

@@ -6,13 +6,12 @@ import { buildSuggestedAnswers } from './questions.js';
  */
 export function generateQuestions(topic, _context, knowledge, maxQuestions) {
     const questions = [];
-    const lower = topic.toLowerCase();
     let idx = 0;
     const nextId = () => `q-${++idx}`;
     // === Core question: What do you want? (always relevant) ===
     questions.push({
         id: nextId(),
-        question: `What is the main goal of "${topic}"? What should the user be able to do?`,
+        question: `What observable behavior or result should "${topic}" produce?`,
         category: 'scope',
         importance: 'critical',
     });
@@ -26,16 +25,13 @@ export function generateQuestions(topic, _context, knowledge, maxQuestions) {
     // === Acceptance: What does done look like? ===
     questions.push({
         id: nextId(),
-        question: `What does "done" look like? Describe the ideal user flow.`,
+        question: `Which explicit observations or checks will prove that "${topic}" is done?`,
         category: 'acceptance',
         importance: 'critical',
     });
     // === Context-specific (only if topic mentions specific domains) ===
     // Auth related — only ask which method, nothing else
-    if (lower.includes('auth') ||
-        lower.includes('login') ||
-        lower.includes('register') ||
-        lower.includes('password')) {
+    if (hasAffirmedTerm(topic, /\b(?:auth|authentication|login|register|password)\b/i)) {
         questions.push({
             id: nextId(),
             question: `What login methods? (email/password, Google, Apple, magic link, etc.)`,
@@ -44,10 +40,7 @@ export function generateQuestions(topic, _context, knowledge, maxQuestions) {
         });
     }
     // UI related — only ask if there are mockups
-    if (lower.includes('ui') ||
-        lower.includes('page') ||
-        lower.includes('screen') ||
-        lower.includes('dashboard')) {
+    if (hasAffirmedTerm(topic, /\b(?:ui|page|screen|dashboard)\b/i)) {
         questions.push({
             id: nextId(),
             question: `Are there mockups or a reference design to follow?`,
@@ -71,4 +64,11 @@ export function generateQuestions(topic, _context, knowledge, maxQuestions) {
         suggestedAnswers: buildSuggestedAnswers(q, knowledge),
     }));
 }
+const NEGATION_RE = /\b(?:no|not|never|without|exclude|excluding|forbid|forbidden|remove|avoid|must not|should not|do not|does not|don't|doesn't|out[- ]of[- ]scope)\b/i;
+function hasAffirmedTerm(text, pattern) {
+    return text.split(/(?:\r?\n|[.;!?]+)/).some((segment) => {
+        const match = new RegExp(pattern.source, pattern.flags.replace('g', '')).exec(segment);
+        return match !== null && !NEGATION_RE.test(segment.slice(0, match.index));
+    });
+}
 //# sourceMappingURL=questions-context.js.map

package/dist/tools/clarify-requirements/questions.js

@@ -7,28 +7,22 @@ export function generateMetaQuestions() {
     return [
         {
             id: 'meta-1',
-            question: 'Is this a brand new feature or an improvement to something that already exists?',
+            question: 'Which change type best describes the request?',
             category: 'scope',
             importance: 'critical',
             suggestedAnswers: ['New feature', 'Improvement to existing feature', 'Bug fix', 'Refactor'],
         },
         {
             id: 'meta-2',
-            question: 'Who is the primary user that benefits from this? (e.g., end user, admin, developer)',
+            question: 'What observable outcome must this work produce?',
             category: 'scope',
             importance: 'critical',
-            suggestedAnswers: ['End user', 'Admin', 'Developer/internal', 'All users'],
         },
         {
             id: 'meta-3',
-            question: 'What is the minimum viable scope — what would make this "done" at a basic level?',
+            question: 'Which boundaries are explicitly in scope and out of scope?',
             category: 'scope',
             importance: 'critical',
-            suggestedAnswers: [
-                'Just the core happy path',
-                'Happy path + error handling',
-                'Full feature with edge cases',
-            ],
         },
     ];
 }
@@ -97,20 +91,6 @@ export function buildSuggestedAnswers(question, knowledge) {
             ];
         }
     }
-    // Performance questions
-    if (lower.includes('performance') ||
-        lower.includes('response time') ||
-        lower.includes('throughput')) {
-        return ['< 200ms response', '< 1s response', 'No strict requirement', 'Depends on load'];
-    }
-    // Auth questions
-    if (lower.includes('authentication') || lower.includes('auth')) {
-        return ['JWT tokens', 'Session-based', 'OAuth 2.0', 'No authentication needed', 'API key'];
-    }
-    // Timeline questions
-    if (lower.includes('deadline') || lower.includes('timeline')) {
-        return ['No strict deadline', 'Within 1 week', 'Within 1 sprint (2 weeks)', 'Specific date'];
-    }
     return [];
 }
 //# sourceMappingURL=questions.js.map

package/dist/tools/clarify-requirements.js

@@ -6,6 +6,12 @@ import { isShortTopic, generateMetaQuestions, detectContradictions, buildSuggest
 import { generateQuestions } from './clarify-requirements/questions-context.js';
 import { detectStack, shouldSkipQuestion, attachOptions, buildSuggestedDescription, } from './clarify-requirements/multiple-choice.js';
 import { compactJson, compactResult, compactError } from './output-formatter.js';
+function buildConfirmedChoices(questions, answers) {
+    return questions.flatMap((question) => {
+        const value = answers[question.id]?.trim();
+        return value ? [{ questionId: question.id, value, source: 'user_confirmation' }] : [];
+    });
+}
 /** Resume an existing clarification session with new answers. */
 async function handleResumeSession(projectId, sessionId, newAnswers, knowledge) {
     const existing = await knowledgeStore.getClarification(projectId, sessionId).catch(() => null);
@@ -50,11 +56,14 @@ async function handleResumeSession(projectId, sessionId, newAnswers, knowledge)
             category: q.category,
             importance: q.importance,
             suggestedAnswers: q.suggestedAnswers,
+            ...(q.suggestedAnswers.length > 0 ? { suggestedAnswersClassification: 'candidate' } : {}),
             options: q.options,
+            ...(q.options ? { optionsClassification: 'candidate' } : {}),
             skipped: q.skipped,
             answered: mergedAnswers[q.id] !== undefined,
         })),
         specReady,
+        confirmedChoices: buildConfirmedChoices(enriched, mergedAnswers),
         ...(suggestedDescription !== undefined ? { suggestedDescription } : {}),
         answeredCount: Object.keys(mergedAnswers).length,
         ...(contradictions.length > 0
@@ -126,6 +135,29 @@ export async function handleClarifyRequirements(params, server) {
             const skipped = shouldSkipQuestion(q, stack);
             return skipped ? { ...withOptions, skipped: true } : withOptions;
         });
+        const detectedEvidence = [
+            ...(stack.language
+                ? [{ field: 'language', value: stack.language, source: 'project_manifest' }]
+                : knowledge?.language && knowledge.language !== 'unknown'
+                    ? [{ field: 'language', value: knowledge.language, source: 'project_knowledge' }]
+                    : []),
+            ...(stack.framework
+                ? [{ field: 'framework', value: stack.framework, source: 'project_manifest' }]
+                : knowledge?.framework
+                    ? [
+                        {
+                            field: 'framework',
+                            value: knowledge.framework,
+                            source: 'project_knowledge',
+                        },
+                    ]
+                    : []),
+            ...(stack.database
+                ? [{ field: 'database', value: stack.database, source: 'project_manifest' }]
+                : knowledge?.database && knowledge.database !== 'unknown'
+                    ? [{ field: 'database', value: knowledge.database, source: 'project_knowledge' }]
+                    : []),
+        ];
         // Determine if spec is ready (all non-skipped critical questions have non-empty answers)
         const criticalIds = questions
             .filter((q) => q.importance === 'critical' && q.skipped !== true)
@@ -170,9 +202,15 @@ export async function handleClarifyRequirements(params, server) {
                 suggestedAnswer: q.suggestedAnswer,
                 /* v8 ignore next 1 */
                 suggestedAnswers: q.suggestedAnswers ?? [],
+                ...(q.suggestedAnswers && q.suggestedAnswers.length > 0
+                    ? { suggestedAnswersClassification: 'candidate' }
+                    : {}),
                 options: q.options,
+                ...(q.options ? { optionsClassification: 'candidate' } : {}),
                 skipped: q.skipped,
             })),
+            detectedEvidence,
+            confirmedChoices: buildConfirmedChoices(questions, currentAnswers),
             specReady,
             ...(suggestedDescription !== undefined ? { suggestedDescription } : {}),
             instructions: specReady

package/dist/tools/compliance-gate-handler.d.ts

@@ -3,8 +3,8 @@ import type { ToolResult } from '../types/index.js';
 export declare const ConfigureComplianceGateSchema: z.ZodObject<{
     projectPath: z.ZodString;
     mode: z.ZodEnum<{
-        soft: "soft";
         hard: "hard";
+        soft: "soft";
     }>;
     threshold: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strip>;

package/dist/tools/create-spec/autopilot-analyzer.d.ts

@@ -20,7 +20,7 @@ export declare function getEmptyAutopilotResult(): AutopilotAnalysis;
  * Analyze the project to enrich a spec with real file paths and patterns.
  * Runs automatically during create_spec — no user interaction needed.
  */
-export declare function analyzeProjectForSpec(projectPath: string, description: string, title: string, knowledge: ProjectKnowledge | null): Promise<AutopilotAnalysis>;
+export declare function analyzeProjectForSpec(projectPath: string, description: string, title: string, _knowledge: ProjectKnowledge | null): Promise<AutopilotAnalysis>;
 /**
  * SPEC-619 AC1: Detect broad-scope descriptions that mention 2+ major subsystems.
  * When true, create_spec should ask clarifying questions before proceeding.

package/dist/tools/create-spec/autopilot-analyzer.js

@@ -19,7 +19,7 @@ export function getEmptyAutopilotResult() {
  * Analyze the project to enrich a spec with real file paths and patterns.
  * Runs automatically during create_spec — no user interaction needed.
  */
-export async function analyzeProjectForSpec(projectPath, description, title, knowledge) {
+export async function analyzeProjectForSpec(projectPath, description, title, _knowledge) {
     const result = {
         suggestedFiles: { create: [], modify: [], test: [] },
         detectedPatterns: [],
@@ -68,10 +68,8 @@ export async function analyzeProjectForSpec(projectPath, description, title, kno
     catch {
         // Best-effort — file scanning failure doesn't block spec creation
     }
-    // Detect stack patterns and suggest relevant criteria
-    if (knowledge) {
-        result.detectedPatterns = detectPatterns(knowledge, description);
-    }
+    // Detect patterns only from affirmed request wording.
+    result.detectedPatterns = detectPatterns(description);
     return result;
 }
 /** Check if description contains technical terms (stack, framework, or code references). */
@@ -89,7 +87,23 @@ function hasTechnicalTerms(description) {
         /\.\w{2,4}\b/, // file extensions like .ts, .py
         /src\/|tests\/|lib\/|app\//, // file paths
     ];
-    return techTerms.some((re) => re.test(description));
+    return techTerms.some((pattern) => hasAffirmedPattern(description, pattern));
+}
+const NEGATIVE_CONTEXT_RE = /\b(?:no|not|never|without|exclude|excluding|forbid|forbidden|remove|avoid|must not|should not|do not|does not|don't|doesn't|out[- ]of[- ]scope|unsupported|unrelated|false positive)\b/i;
+const INCIDENTAL_CONTEXT_RE = /\b(?:example|for example|e\.g\.|quoted|regression|incorrectly inferred|must not infer)\b/i;
+function hasAffirmedPattern(description, pattern) {
+    const withoutQuotedText = description
+        .replace(/```[\s\S]*?```/g, ' ')
+        .replace(/`[^`]+`/g, ' ')
+        .replace(/"[^"]+"|'[^']+'/g, ' ');
+    return withoutQuotedText.split(/(?:\r?\n|[.;!?]+)/).some((segment) => {
+        const match = new RegExp(pattern.source, pattern.flags.replace('g', '')).exec(segment);
+        if (!match) {
+            return false;
+        }
+        const prefix = segment.slice(0, match.index);
+        return !NEGATIVE_CONTEXT_RE.test(prefix) && !INCIDENTAL_CONTEXT_RE.test(prefix);
+    });
 }
 /**
  * SPEC-619 AC1: Detect broad-scope descriptions that mention 2+ major subsystems.
@@ -100,8 +114,7 @@ function hasTechnicalTerms(description) {
  * one feature, not two independent systems).
  */
 export function detectBroadScope(description) {
-    const lower = description.toLowerCase();
-    const wordCount = lower.trim().split(/\s+/).length;
+    const wordCount = description.trim().split(/\s+/).length;
     const subsystems = [
         /\b(auth|authentication|login|signup|sign.?up|register|oauth|sso)\b/,
         /\b(payment|billing|invoice|subscription|stripe|checkout|pricing)\b/,
@@ -114,7 +127,7 @@ export function detectBroadScope(description) {
         /\b(user.?management|profile|account|role|permission|rbac)\b/,
         /\b(chat|messaging|real.?time|websocket|feed|timeline)\b/,
     ];
-    const matched = subsystems.filter((re) => re.test(lower));
+    const matched = subsystems.filter((pattern) => hasAffirmedPattern(description, pattern));
     // Longer descriptions are specific enough to reference adjacent domain terms
     // without being genuinely broad (e.g. "Stripe billing + webhook handler" = one feature).
     const threshold = wordCount >= 20 ? 3 : 2;
@@ -135,62 +148,24 @@ function inferTestPath(srcPath) {
     return `tests/${withoutExt}.test${ext}`;
 }
 /** Detect relevant patterns from project knowledge. */
-function detectPatterns(knowledge, description) {
+function detectPatterns(description) {
     const patterns = [];
-    const desc = description.toLowerCase();
-    const hasDatabaseIntent = desc.includes('data') ||
-        desc.includes('database') ||
-        desc.includes('tabla') ||
-        desc.includes('schema') ||
-        desc.includes('rls') ||
-        desc.includes('rpc') ||
-        desc.includes('migration') ||
-        desc.includes('persistence') ||
-        desc.includes('data access');
-    const hasUiIntent = desc.includes('component') ||
-        desc.includes('ui') ||
-        desc.includes('page') ||
-        desc.includes('screen') ||
-        desc.includes('form') ||
-        desc.includes('layout') ||
-        desc.includes('style') ||
-        desc.includes('button') ||
-        desc.includes('modal') ||
-        desc.includes('dialog');
+    const hasDatabaseIntent = hasAffirmedPattern(description, /\b(?:data|database|tabla|schema|rls|rpc|migration|persistence|data access)\b/i);
     if (hasDatabaseIntent) {
         patterns.push('database');
     }
-    if (knowledge.framework?.toLowerCase().includes('next') && desc.includes('page')) {
-        patterns.push('nextjs-pages');
-    }
-    if (knowledge.framework?.toLowerCase().includes('react') && hasUiIntent) {
-        patterns.push('react-components');
-    }
-    if (desc.includes('api') || desc.includes('endpoint')) {
+    if (hasAffirmedPattern(description, /\b(?:api|endpoint)\b/i)) {
         patterns.push('api-endpoint');
     }
-    if (desc.includes('auth') || desc.includes('login')) {
+    if (hasAffirmedPattern(description, /\b(?:auth|authentication|login)\b/i)) {
         patterns.push('authentication');
     }
-    if (desc.includes('test') || desc.includes('coverage')) {
+    if (hasAffirmedPattern(description, /\b(?:test|testing|coverage)\b/i)) {
         patterns.push('testing');
     }
-    if (knowledge.stack.some((s) => s.toLowerCase().includes('supabase')) && hasDatabaseIntent) {
-        patterns.push('supabase');
-    }
     // SPEC-535: Detect LLM/foundation model features for EU AI Act Article 53-55 compliance
-    if (desc.includes('llm') ||
-        desc.includes('ai ') ||
-        desc.includes(' ai') ||
-        desc.includes('claude') ||
-        desc.includes('openai') ||
-        desc.includes('gpt') ||
-        desc.includes('gemini') ||
-        desc.includes('anthropic') ||
-        desc.includes('chatbot') ||
-        desc.includes('language model') ||
-        desc.includes('foundation model') ||
-        (desc.includes('chat') && desc.includes('model'))) {
+    if (hasAffirmedPattern(description, /\b(?:llm|ai|claude|openai|gpt|gemini|anthropic|chatbot|language model|foundation model)\b/i) ||
+        (hasAffirmedPattern(description, /\bchat\b/i) && hasAffirmedPattern(description, /\bmodel\b/i))) {
         patterns.push('llm-feature');
     }
     return patterns;