@planu/cli 5.3.62 → 5.3.64

package/dist/engine/handoff-artifacts/implementation-review-reader.js

@@ -0,0 +1,72 @@
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+import { readTransitionLog } from '../../storage/transition-log.js';
+import { readArtifact } from './io.js';
+export function isLifecycleStubBody(specId, body) {
+    return (body === `Spec ${specId} reviewed by planu-spec-reviewer and approved for approval gates.` ||
+        body === `Spec ${specId} reviewed by planu-spec-reviewer with requested changes.`);
+}
+async function findImplementingActor(specId, projectId) {
+    const entries = await readTransitionLog(projectId, specId);
+    for (let i = entries.length - 1; i >= 0; i--) {
+        const entry = entries[i];
+        if (entry?.to === 'implementing' && entry.actor) {
+            return entry.actor;
+        }
+    }
+    return undefined;
+}
+export async function readVerifiedImplementationReview(projectId, specId) {
+    try {
+        const result = await readArtifact({ projectId, specId, kind: 'implementation_review' });
+        if (!result.ok) {
+            const firstErr = result.errors[0];
+            return {
+                ok: false,
+                reason: firstErr?.code === 'ARTIFACT_NOT_FOUND' ? 'missing' : 'schema_invalid',
+                errors: result.errors,
+            };
+        }
+        const review = result.payload;
+        if (review.specId !== specId) {
+            return { ok: false, reason: 'wrong_spec', review };
+        }
+        if (isLifecycleStubBody(specId, review.body)) {
+            return { ok: false, reason: 'stub_body', review };
+        }
+        if (review.verdict !== 'approved' || review.reviewer.verdict !== 'approved') {
+            return { ok: false, reason: 'not_approved', review };
+        }
+        if (review.reviewer.kind !== 'implementation-review-agent' ||
+            review.reviewer.agent !== 'planu-implementation-reviewer') {
+            return { ok: false, reason: 'wrong_agent_or_kind', review };
+        }
+        let implementerActor;
+        try {
+            implementerActor = await findImplementingActor(specId, projectId);
+        }
+        catch (err) {
+            /* reliability-optional: TRANSITION_LOG_GATE_READ — typed gate error blocks done */
+            reportClassifiedDegradation('TRANSITION_LOG_GATE_READ', err);
+            return {
+                ok: false,
+                reason: 'actor_unreadable',
+                review,
+                readError: err instanceof Error ? err.message : String(err),
+            };
+        }
+        if (implementerActor !== undefined && implementerActor === review.reviewer.agent) {
+            return { ok: false, reason: 'self_review', review, implementingActor: implementerActor };
+        }
+        return { ok: true, review, implementingActor: implementerActor ?? null };
+    }
+    catch (err) {
+        /* reliability-optional: IMPLEMENTATION_REVIEW_GATE_READ — typed gate error blocks done */
+        reportClassifiedDegradation('IMPLEMENTATION_REVIEW_GATE_READ', err);
+        return {
+            ok: false,
+            reason: 'unreadable',
+            readError: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+//# sourceMappingURL=implementation-review-reader.js.map

package/dist/engine/rules-generator/index.js

@@ -27,11 +27,9 @@ export const ARCHITECTURE_RULES = {
         ],
         conventions: [
             'Never put business logic in route handlers',
-            'Route handlers should be under 30 lines',
             'Services are framework-agnostic (no NextRequest/NextResponse)',
             'Repositories return plain objects, never ORM entities',
         ],
-        maxLinesPerHandler: 30,
     },
     express: {
         title: 'Express Architecture',
@@ -58,7 +56,6 @@ export const ARCHITECTURE_RULES = {
             'Services are stateless',
             'One file per resource',
         ],
-        maxLinesPerHandler: 40,
     },
     fastapi: {
         title: 'FastAPI Architecture',
@@ -85,34 +82,6 @@ export const ARCHITECTURE_RULES = {
             'Pydantic models for all I/O',
             'Async by default',
         ],
-        maxLinesPerHandler: 30,
-    },
-    default: {
-        title: 'Clean Architecture',
-        description: 'Generic clean architecture rules',
-        layers: [
-            {
-                name: 'Handler',
-                path: 'src/handlers/',
-                responsibility: 'Input/output boundary',
-            },
-            {
-                name: 'Service',
-                path: 'src/services/',
-                responsibility: 'Business logic',
-            },
-            {
-                name: 'Repository',
-                path: 'src/repositories/',
-                responsibility: 'Data access',
-            },
-        ],
-        conventions: [
-            'Separate concerns by layer',
-            'Dependencies point inward',
-            'No framework code in business logic',
-        ],
-        maxLinesPerHandler: 50,
     },
 };
 /** Detect stack from project files. Returns a key into ARCHITECTURE_RULES. */
@@ -187,9 +156,6 @@ export function generateRulesContent(rule, tool) {
                 '## Conventions',
                 conventions,
                 '',
-                `## Handler Size Limit`,
-                `Max ${rule.maxLinesPerHandler} lines per handler/controller.`,
-                '',
             ].join('\n');
         }
         case 'copilot': {
@@ -205,9 +171,6 @@ export function generateRulesContent(rule, tool) {
                 '## Coding Conventions',
                 conventions,
                 '',
-                `## Size Constraints`,
-                `- Max ${rule.maxLinesPerHandler} lines per handler`,
-                '',
             ].join('\n');
         }
         case 'aider': {
@@ -223,9 +186,6 @@ export function generateRulesContent(rule, tool) {
                 '## Conventions',
                 conventions,
                 '',
-                `## Constraints`,
-                `- Handlers/controllers: max ${rule.maxLinesPerHandler} lines`,
-                '',
             ].join('\n');
         }
         case 'claude':
@@ -244,11 +204,6 @@ export function generateRulesContent(rule, tool) {
                 '',
                 conventions,
                 '',
-                '## Size Budget',
-                '',
-                `- Max **${rule.maxLinesPerHandler} lines** per handler/controller`,
-                '- Extract helpers when exceeding this limit',
-                '',
             ].join('\n');
         }
     }
@@ -273,8 +228,10 @@ function resolveRulesFilePath(projectPath, tool, stackKey) {
 /** Main entry: detect stack + tools, generate all rules objects. */
 export function generateProjectRules(projectPath) {
     const stackKey = detectArchitectureStack(projectPath);
-    const defaultRule = ARCHITECTURE_RULES.default;
-    const rule = ARCHITECTURE_RULES[stackKey] ?? defaultRule;
+    if (stackKey === 'default') {
+        return [];
+    }
+    const rule = ARCHITECTURE_RULES[stackKey];
     if (!rule) {
         return [];
     }

package/dist/engine/skill-registry/installer.js

@@ -79,35 +79,24 @@ function buildFrontmatter(entry) {
 /** Prepare a built-in skill from the local catalog, generating a SKILL.md. */
 function prepareFromBuiltIn(skillName) {
     const entry = getBuiltInSkillEntry(skillName);
-    let content;
-    if (entry) {
-        const frontmatter = buildFrontmatter(entry);
-        content = [
-            frontmatter,
-            `# ${entry.name}`,
-            ``,
-            entry.description,
-            ``,
-            `## When to use`,
-            ``,
-            entry.trigger,
-            ``,
-            `## Tags`,
-            ``,
-            entry.tags.join(', '),
-        ].join('\n');
-    }
-    else {
-        content = [
-            `# ${skillName}`,
-            ``,
-            `Built-in Planu skill.`,
-            ``,
-            `## When to use`,
-            ``,
-            `Consult the Planu documentation.`,
-        ].join('\n');
+    if (!entry) {
+        throw new Error(`Built-in skill '${skillName}' has no catalog entry; refusing to install a placeholder`);
     }
+    const frontmatter = buildFrontmatter(entry);
+    const content = [
+        frontmatter,
+        `# ${entry.name}`,
+        ``,
+        entry.description,
+        ``,
+        `## When to use`,
+        ``,
+        entry.trigger,
+        ``,
+        `## Tags`,
+        ``,
+        entry.tags.join(', '),
+    ].join('\n');
     return { content, hasScripts: false };
 }
 /** Prepare a skill placeholder for skillssh/agentskill sources (no direct file API yet). */

package/dist/engine/skills/skills-fetcher.js

@@ -89,15 +89,6 @@ async function fetchSkillsShCatalog(stack, language) {
 function buildFallbackSkills(knowledge) {
     const skills = [];
     const stackLower = knowledge.stack.map((s) => s.toLowerCase());
-    const lang = knowledge.language.toLowerCase();
-    if (lang === technologyValue('technology-typescript-969545') || lang === 'javascript') {
-        skills.push({
-            name: 'typescript-patterns',
-            description: 'TypeScript best practices, strict mode patterns, and type safety conventions',
-            installCommand: 'npx skills add typescript-patterns',
-            justification: `Project uses ${knowledge.language}`,
-        });
-    }
     if (stackLower.some((s) => s.includes(technologyValue('technology-react-275976')))) {
         skills.push({
             name: 'react-patterns',

package/dist/engine/skills-reconciler.js

@@ -1,4 +1,3 @@
-import { technologyValue } from './technology-registry.js';
 // engine/skills-reconciler.ts — SPEC-189: Detect stack changes and reconcile skills
 // SPEC-395: autoFixSkills — install missing, remove stale, repair corrupt paths.
 // SPEC-607: Detect old-format skills and new agents, trigger regeneration.
@@ -32,7 +31,7 @@ export async function reconcileSkills(projectPath, knowledge) {
     const newSkillsDetected = recommendedSkills
         .filter((s) => !installedSet.has(s.name))
         .map((s) => s.name);
-    const staleSkills = installedNames.filter((name) => !recommendedNames.has(name) && !isProtectedBuiltInSkill(name, knowledge));
+    const staleSkills = installedNames.filter((name) => !recommendedNames.has(name));
     const totalRelevant = recommendedNames.size;
     const alreadyInSync = installedNames.filter((name) => recommendedNames.has(name)).length;
     const healthScore = computeHealthScore(totalRelevant, alreadyInSync, staleSkills.length);
@@ -167,17 +166,6 @@ function computeHealthScore(totalRelevant, alreadyInSync, staleCount) {
     const penalty = staleCount * 5;
     return Math.max(0, base - penalty);
 }
-function isProtectedBuiltInSkill(name, knowledge) {
-    if (name !== 'typescript-patterns') {
-        return false;
-    }
-    const language = knowledge.language.toLowerCase();
-    const stack = knowledge.stack.map((item) => item.toLowerCase());
-    return (language === technologyValue('technology-typescript-969545') ||
-        language === 'javascript' ||
-        stack.some((item) => item.includes(technologyValue('technology-typescript-969545')) ||
-            item.includes('javascript')));
-}
 /** Return a neutral reconciliation when prerequisites are missing. */
 function buildEmptyReconciliation(_reason) {
     return {

package/dist/engine/validator/dor-dod.d.ts

@@ -1,4 +1,4 @@
-import type { Spec, ValidateResult, DefinitionOfReady, DefinitionOfDone, CodeState } from '../../types/index.js';
+import type { Spec, ValidateResult, DefinitionOfReady, DefinitionOfDone, CodeState, VerifiedImplementationReviewResult } from '../../types/index.js';
 export declare function isBlockingQualitySeverity(severity: unknown): boolean;
 /**
  * Generate a Definition of Ready checklist for a spec.
@@ -7,5 +7,5 @@ export declare function generateDoR(spec: Spec): DefinitionOfReady;
 /**
  * Generate a Definition of Done checklist for a spec.
  */
-export declare function generateDoD(spec: Spec, validationResult?: ValidateResult, codeState?: CodeState, projectPath?: string): Promise<DefinitionOfDone>;
+export declare function generateDoD(spec: Spec, validationResult?: ValidateResult, codeState?: CodeState, projectPath?: string, verifiedReview?: VerifiedImplementationReviewResult): Promise<DefinitionOfDone>;
 //# sourceMappingURL=dor-dod.d.ts.map

package/dist/engine/validator/dor-dod.js

@@ -120,10 +120,11 @@ export function generateDoR(spec) {
         generatedAt: new Date().toISOString(),
     };
 }
-function buildDoDItems(spec, score, hasBlockingQualityIssues, hasTestFiles) {
+function buildDoDItems(spec, score, hasBlockingQualityIssues, hasTestFiles, verifiedReview) {
     // If spec is already marked "done", manual gates are implicitly satisfied —
     // the user explicitly transitioned the spec, which implies review/tests/docs passed.
     const isDone = spec.status === 'done';
+    const reviewApproved = isDone || verifiedReview?.ok === true;
     return [
         {
             id: 'dod-1',
@@ -157,7 +158,7 @@ function buildDoDItems(spec, score, hasBlockingQualityIssues, hasTestFiles) {
             category: 'review',
             required: true,
             autoCheck: false,
-            status: isDone ? 'passed' : 'pending',
+            status: reviewApproved ? 'passed' : 'pending',
         },
         {
             id: 'dod-5',
@@ -321,12 +322,12 @@ function gateCategory(gate) {
 /**
  * Generate a Definition of Done checklist for a spec.
  */
-export async function generateDoD(spec, validationResult, codeState, projectPath) {
+export async function generateDoD(spec, validationResult, codeState, projectPath, verifiedReview) {
     const score = validationResult?.score ?? 0;
     const hasBlockingQualityIssues = validationResult?.qualityIssues.some((issue) => isBlockingQualitySeverity(issue.severity)) ??
         false;
     const hasTestFiles = await detectTestFiles(spec, codeState);
-    const items = buildDoDItems(spec, score, hasBlockingQualityIssues, hasTestFiles);
+    const items = buildDoDItems(spec, score, hasBlockingQualityIssues, hasTestFiles, verifiedReview);
     // Override actuals check with progress.md parsing
     const actualsItem = items.find((i) => i.id === 'dod-8');
     if (actualsItem?.status === 'pending') {

package/dist/tools/challenge-spec/resilience-challenge-scenarios-a.d.ts

@@ -1,4 +1,5 @@
 import type { FailureScenario, Spec } from '../../types/index.js';
+import { type ChallengeCapabilities } from './scenarios-utils.js';
 export declare const EXTERNAL_CALL_KEYWORDS: string[];
 export declare const VALIDATION_KEYWORDS: string[];
 export declare const RATE_LIMIT_KEYWORDS: string[];
@@ -24,10 +25,7 @@ export declare function hasConcurrencySignal(spec: Spec, specContent: string): b
  * Returns true when the spec describes a distributed saga.
  */
 export declare function hasSagaSignal(spec: Spec, specContent: string): boolean;
-/**
- * Generate validation boundary challenge scenarios.
- */
-export declare function generateValidationBoundaryScenarios(spec: Spec): FailureScenario[];
+export declare function generateValidationBoundaryScenarios(spec: Spec, capabilities: ChallengeCapabilities): FailureScenario[];
 /**
  * Generate cascade failure challenge scenarios.
  */

package/dist/tools/challenge-spec/resilience-challenge-scenarios-a.js

@@ -97,11 +97,8 @@ export function hasConcurrencySignal(spec, specContent) {
 export function hasSagaSignal(spec, specContent) {
     return contentMentions(`${spec.title}\n${spec.tags.join(' ')}\n${specContent}`, SAGA_KEYWORDS);
 }
-/**
- * Generate validation boundary challenge scenarios.
- */
-export function generateValidationBoundaryScenarios(spec) {
-    return [
+export function generateValidationBoundaryScenarios(spec, capabilities) {
+    const scenarios = [
         {
             scenario: `[${spec.id}] Validation Boundary — String Fields: ` +
                 'What happens when a required string field receives: (a) empty string "", (b) null, (c) field absent from body entirely, ' +
@@ -119,7 +116,9 @@ export function generateValidationBoundaryScenarios(spec) {
             dataConsistency: 'Accepting empty strings as valid inputs leads to records with meaningless values polluting the database.',
             userExperience: 'Clear per-field error messages with the specific constraint violated improve form UX significantly.',
         },
-        {
+    ];
+    if (capabilities.numericInput) {
+        scenarios.push({
             scenario: `[${spec.id}] Validation Boundary — Numeric Fields: ` +
                 'What happens when a numeric field receives: (a) value exactly at min boundary (e.g., min=0 → test with -1, 0, 1), ' +
                 '(b) value exactly at max boundary, (c) NaN, (d) Infinity or -Infinity, ' +
@@ -132,24 +131,25 @@ export function generateValidationBoundaryScenarios(spec) {
                 'Coercion policy must be explicit: either always reject type mismatches or always coerce with documented behavior.',
             dataConsistency: 'NaN or Infinity stored in numeric columns causes silent corruption or runtime exceptions.',
             userExperience: 'Off-by-one errors in validation create confusing UX where users cannot submit valid data.',
-        },
-        {
-            scenario: `[${spec.id}] Validation Security — Injection Payloads: ` +
-                'Does the validation layer handle security-relevant strings without crashing or leaking internals? ' +
-                "Test with: SQL injection ('; DROP TABLE users; --), XSS (<script>alert(1)</script>), " +
-                'path traversal (../../etc/passwd), null bytes (\\0), template injection ({{7*7}}). ' +
-                'Validation is not the primary defense (that is parameterized queries / output encoding), ' +
-                'but it must not crash and must not expose stack traces.',
-            probability: 'medium',
-            impact: 'critical',
-            currentHandling: 'Injection payloads may cause unhandled exceptions in validation middleware, exposing internal error details.',
-            requiredHandling: 'All string inputs must be treated as untrusted. ' +
-                'Validation rejects malformed types; sanitization and parameterized queries handle injection prevention downstream. ' +
-                'Error responses must never include the rejected payload or stack trace — return sanitized field name + constraint only.',
-            dataConsistency: 'If injection payloads reach the database layer (even as errors), they can leak schema information via error messages.',
-            userExperience: 'Stack traces exposed in 400 responses are a security vulnerability — use opaque error IDs instead.',
-        },
-    ];
+        });
+    }
+    scenarios.push({
+        scenario: `[${spec.id}] Validation Security — Injection Payloads: ` +
+            'Does the validation layer handle security-relevant strings without crashing or leaking internals? ' +
+            "Test with: SQL injection ('; DROP TABLE users; --), XSS (<script>alert(1)</script>), " +
+            'path traversal (../../etc/passwd), null bytes (\\0), template injection ({{7*7}}). ' +
+            'Validation is not the primary defense (that is parameterized queries / output encoding), ' +
+            'but it must not crash and must not expose stack traces.',
+        probability: 'medium',
+        impact: 'critical',
+        currentHandling: 'Injection payloads may cause unhandled exceptions in validation middleware, exposing internal error details.',
+        requiredHandling: 'All string inputs must be treated as untrusted. ' +
+            'Validation rejects malformed types; sanitization and parameterized queries handle injection prevention downstream. ' +
+            'Error responses must never include the rejected payload or stack trace — return sanitized field name + constraint only.',
+        dataConsistency: 'If injection payloads reach the database layer (even as errors), they can leak schema information via error messages.',
+        userExperience: 'Stack traces exposed in 400 responses are a security vulnerability — use opaque error IDs instead.',
+    });
+    return scenarios;
 }
 /**
  * Generate cascade failure challenge scenarios.

package/dist/tools/challenge-spec/resilience-challenge-scenarios.js

@@ -15,7 +15,7 @@ export function generateResilienceChallengeScenarios(spec, specContent, knowledg
     const resolvedCapabilities = capabilities ?? detectChallengeCapabilities(spec, specContent);
     if (resolvedCapabilities.validation &&
         (resolvedCapabilities.userInput || resolvedCapabilities.networkApi)) {
-        scenarios.push(...generateValidationBoundaryScenarios(spec));
+        scenarios.push(...generateValidationBoundaryScenarios(spec, resolvedCapabilities));
     }
     if (resolvedCapabilities.externalService || resolvedCapabilities.payment) {
         scenarios.push(...generateCascadeFailureScenarios(spec));

package/dist/tools/challenge-spec/scenarios-failure.js

@@ -3,8 +3,7 @@ import { contentMentions, detectChallengeCapabilities } from './scenarios-utils.
 export function generateFailureScenarios(spec, content, _knowledge) {
     const scenarios = [];
     const capabilities = detectChallengeCapabilities(spec, content);
-    // Network failures
-    if (capabilities.networkApi) {
+    if (capabilities.outboundDependency) {
         scenarios.push({
             scenario: 'API endpoint becomes unreachable (network timeout)',
             probability: 'medium',

package/dist/tools/challenge-spec/scenarios-utils.d.ts

@@ -24,6 +24,9 @@ export interface ChallengeCapabilities {
     rateLimit: boolean;
     saga: boolean;
     platform: boolean;
+    outboundDependency: boolean;
+    numericInput: boolean;
+    rollout: boolean;
 }
 /** Boundary-aware, affirmative replacement for advisory substring checks. */
 export declare function contentMentions(content: string, keywords: string[]): boolean;

package/dist/tools/challenge-spec/scenarios-utils.js

@@ -33,7 +33,7 @@ const CAPABILITY_SIGNALS = {
         /\bbatch\s+upload\b/i,
     ],
     scale: [
-        /\b(?:traffic|load|throughput|requests?\s+per\s+second|concurrent\s+users?)\b/i,
+        /\b(?:traffic|load\b(?![\s‐-―-]+bearing)|throughput|requests?\s+per\s+second|concurrent\s+users?)\b/i,
         /\b(?:auto[ -]?scal|load\s+test|capacity\s+plan)/i,
         /\b(?:data\s+growth|growing\s+dataset|query\s+performance\s+at\s+scale)\b/i,
     ],
@@ -87,6 +87,22 @@ const CAPABILITY_SIGNALS = {
     platform: [
         /\b(?:smart\s+contract|solidity|discord\s+bot|telegram\s+bot|iot\s+device|firmware|infrastructure\s+as\s+code|terraform|machine\s+learning\s+model)\b/i,
     ],
+    outboundDependency: [
+        /\boutbound\s+(?:http\s+)?(?:client|call|request|dependency)\b/i,
+        /\b(?:fetch(?:es|ing)?|calls?|invokes?)\b(?:\W+\w+){0,4}?\W+(?:api|endpoint|service|dependency)\b/i,
+        /\bremote\s+dependency\s+call\b/i,
+    ],
+    numericInput: [
+        /\bnumeric\s+(?:field|input|value|schema|constraint)\b/i,
+        /\b(?:integer|float|decimal)\s+field\b/i,
+        /\b(?:min|max)(?:imum)?\s+(?:value|constraint|boundary)\b/i,
+        /\bz\.number\(/i,
+    ],
+    rollout: [
+        /\b(?:canary|phased\s+rollout|gradual\s+rollout|blue-green\s+deploy(?:ment)?|rolling\s+deployment|feature\s+flag)\b/i,
+        /\broll(?:s|ed|ing)?\s+out\b(?:\W+\w+){0,4}?\W+(?:in\s+phases|gradually)\b/i,
+        /\bdeployment\s+strategy\b/i,
+    ],
 };
 const AUTHENTICATION_BARE_TOKEN_RE = /\bauth(?:entication|enticate)?\b/i;
 // A bare "auth" token next to registry/package-manager vocabulary describes a

package/dist/tools/challenge-spec-helpers.d.ts

@@ -9,7 +9,7 @@ export interface ConcurrencyAnalysisResult extends ConcurrencyAnalysis {
     suppressedCount: number;
 }
 export declare function generateConcurrencyAnalysis(_spec: Spec, content: string, _knowledge: ProjectKnowledge): ConcurrencyAnalysisResult;
-export declare function buildScalabilityAssessment(spec: Spec, knowledge: ProjectKnowledge, scenarios: FailureScenario[]): string;
+export declare function buildScalabilityAssessment(spec: Spec, knowledge: ProjectKnowledge, scenarios: FailureScenario[], hasRolloutEvidence?: boolean): string;
 export declare function calculateOverallRisk(scenarios: FailureScenario[], concurrency: ConcurrencyAnalysis): RiskLevel;
 export declare function readSpecContent(spec: Spec): Promise<string>;
 //# sourceMappingURL=challenge-spec-helpers.d.ts.map

package/dist/tools/challenge-spec-helpers.js

@@ -93,7 +93,7 @@ export function generateConcurrencyAnalysis(_spec, content, _knowledge) {
     return { hotPaths, raceConditions, sharedState, recommendations, suppressedCount };
 }
 // --- Scalability and risk ---
-export function buildScalabilityAssessment(spec, knowledge, scenarios) {
+export function buildScalabilityAssessment(spec, knowledge, scenarios, hasRolloutEvidence = false) {
     const criticalCount = scenarios.filter((s) => s.impact === 'critical').length;
     const arch = knowledge.architecture.primary;
     const parts = [];
@@ -108,7 +108,10 @@ export function buildScalabilityAssessment(spec, knowledge, scenarios) {
         parts.push('No critical scalability concerns for the current scope.');
     }
     if (spec.scope === 'architectural' || spec.scope === 'cross-module') {
-        parts.push('Cross-module scope increases blast radius. Consider phased rollout with feature flags.');
+        parts.push('Cross-module scope increases blast radius.');
+        if (hasRolloutEvidence) {
+            parts.push('Consider phased rollout with feature flags.');
+        }
     }
     return parts.join(' ');
 }

package/dist/tools/challenge-spec.js

@@ -2,6 +2,7 @@
 // Analyzes a spec from adversarial perspectives: failure scenarios,
 // concurrency issues, scale limits, security holes, and data consistency.
 import { readFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
 import { specStore, knowledgeStore } from '../storage/index.js';
 // SPEC-1011 Bug F: fallback resolver using disk fingerprints
 import { resolveProjectFromPath } from '../storage/project-resolver.js';
@@ -29,6 +30,14 @@ const ALL_FOCUS_AREAS = [
     'security',
     'data-consistency',
 ];
+function truncateCriterionDiscriminator(criterion) {
+    const codePoints = Array.from(criterion);
+    if (codePoints.length <= 80) {
+        return criterion;
+    }
+    const digest = createHash('sha256').update(criterion).digest('hex').slice(0, 8);
+    return `${codePoints.slice(0, 79).join('')}… [${digest}]`;
+}
 function extractOutOfScopeSection(content) {
     const headingPattern = /^(#{1,6})[ \t]+(.+?)[ \t]*#*[ \t]*$/;
     const fencePattern = /^[ \t]{0,3}(`{3,}|~{3,})/;
@@ -224,7 +233,7 @@ export async function handleChallengeSpec(args, server) {
         const contradictionResult = checkScopeContradictions(resolvedOutOfScope, criteriaTexts);
         for (const c of contradictionResult.contradictions) {
             failureScenarios.push({
-                scenario: `Criterion contradicts outOfScope declaration: "${c.contradicts}"`,
+                scenario: `Criterion contradicts outOfScope declaration: "${c.contradicts}" (criterion: "${truncateCriterionDiscriminator(c.criterion)}")`,
                 probability: 'medium',
                 impact: 'low',
                 currentHandling: `Criterion: "${c.criterion}"`,
@@ -259,7 +268,7 @@ export async function handleChallengeSpec(args, server) {
     const actionableFailureScenarios = failureScenarios.filter((scenario) => isScenarioSupportedByCapabilities(scenario, capabilities));
     const suppressedScenarioCount = failureScenarios.length - actionableFailureScenarios.length;
     // 7. Build scalability assessment from grounded scenarios only.
-    const scalabilityAssessment = buildScalabilityAssessment(spec, knowledge, actionableFailureScenarios);
+    const scalabilityAssessment = buildScalabilityAssessment(spec, knowledge, actionableFailureScenarios, capabilities.rollout);
     // 8. Calculate overall risk from grounded scenarios only.
     const overallRisk = calculateOverallRisk(actionableFailureScenarios, concurrencyAnalysis);
     // 9. Compute relevance scores and select top-3 diagnostics (SPEC-338) — retained as-is
@@ -456,7 +465,10 @@ function isScenarioSupportedByCapabilities(scenario, capabilities) {
         ],
         [/\b(?:sql|nosql|database|connection pool)\b/, capabilities.database],
         [/\b(?:event contract|event schema|message broker|kafka|rabbitmq|dlq)\b/, capabilities.events],
-        [/\b(?:api endpoint|http route|http status|network timeout)\b/, capabilities.networkApi],
+        [
+            /\b(?:api endpoint|http route|http status|network timeout)\b/,
+            capabilities.outboundDependency,
+        ],
         [/\b(?:traffic spike|load test|auto-scaling|throughput)\b/, capabilities.scale],
     ];
     return rules.every(([pattern, supported]) => !pattern.test(haystack) || supported);

package/dist/tools/create-spec.js

@@ -1335,8 +1335,26 @@ async function prepareCreateSpecCandidate(initialParams, server) {
         },
     };
 }
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function buildMissingTitleResult() {
+    return {
+        content: [
+            {
+                type: 'text',
+                text: 'create_spec requires a non-empty title. Provide the title field and call create_spec again.',
+            },
+        ],
+        isError: true,
+        structuredContent: { error: 'MISSING_TITLE', code: 'INVALID_INPUT', field: 'title' },
+    };
+}
 // eslint-disable-next-line max-lines-per-function
 export async function handleCreateSpec(inputParams, server) {
+    if (!isNonEmptyString(inputParams.title)) {
+        return buildMissingTitleResult();
+    }
     const enumValidation = validateCreateSpecEnums(inputParams);
     if (enumValidation) {
         return enumValidation;