@polymorphism-tech/morph-spec 4.6.0 → 4.7.0

package/.morph/framework/standards/integration/event-driven/cqrs.md

@@ -1,101 +0,0 @@
-# Integration Standard: CQRS with MediatR
-
-## Overview
-Commands mutate state. Queries read state. Never mix them.
-
-## Setup
-```xml
-<PackageReference Include="MediatR" Version="12.*" />
-<PackageReference Include="MediatR.Extensions.Microsoft.DependencyInjection" Version="11.*" />
-```
-
-```csharp
-// Program.cs
-builder.Services.AddMediatR(cfg => cfg.RegisterServicesFromAssembly(typeof(Program).Assembly));
-```
-
-## Command Pattern
-```csharp
-// Command (mutates state, returns result)
-public record CreateOrderCommand(Guid UserId, List<OrderItem> Items)
-    : IRequest<CreateOrderResult>;
-
-public record CreateOrderResult(Guid OrderId, decimal Total);
-
-// Handler
-public class CreateOrderHandler : IRequestHandler<CreateOrderCommand, CreateOrderResult>
-{
-    public async Task<CreateOrderResult> Handle(CreateOrderCommand cmd, CancellationToken ct)
-    {
-        var order = Order.Create(cmd.UserId, cmd.Items);
-        await _repository.AddAsync(order, ct);
-        await _unitOfWork.SaveChangesAsync(ct);
-
-        // Publish domain event
-        await _publisher.Publish(new OrderCreatedEvent(order.Id), ct);
-
-        return new CreateOrderResult(order.Id, order.Total);
-    }
-}
-```
-
-## Query Pattern
-```csharp
-// Query (reads only, no side effects)
-public record GetOrderQuery(Guid OrderId) : IRequest<OrderDto?>;
-
-// Handler — use read model, not domain entity
-public class GetOrderHandler : IRequestHandler<GetOrderQuery, OrderDto?>
-{
-    public async Task<OrderDto?> Handle(GetOrderQuery query, CancellationToken ct)
-    {
-        return await _context.Orders
-            .Where(o => o.Id == query.OrderId)
-            .Select(o => new OrderDto(o.Id, o.Status, o.Total))
-            .FirstOrDefaultAsync(ct);
-    }
-}
-```
-
-## Pipeline Behaviors (Cross-Cutting)
-```csharp
-// Validation behavior
-public class ValidationBehavior<TRequest, TResponse>
-    : IPipelineBehavior<TRequest, TResponse>
-    where TRequest : IRequest<TResponse>
-{
-    public async Task<TResponse> Handle(TRequest request,
-        RequestHandlerDelegate<TResponse> next, CancellationToken ct)
-    {
-        var failures = _validators
-            .SelectMany(v => v.Validate(request).Errors)
-            .Where(f => f != null)
-            .ToList();
-
-        if (failures.Any())
-            throw new ValidationException(failures);
-
-        return await next();
-    }
-}
-```
-
-## DI Registration Order
-```csharp
-// 1. MediatR (includes handler scanning)
-builder.Services.AddMediatR(cfg =>
-{
-    cfg.RegisterServicesFromAssembly(Assembly.GetExecutingAssembly());
-    cfg.AddBehavior(typeof(IPipelineBehavior<,>), typeof(ValidationBehavior<,>));
-    cfg.AddBehavior(typeof(IPipelineBehavior<,>), typeof(PerformanceBehavior<,>));
-    cfg.AddBehavior(typeof(IPipelineBehavior<,>), typeof(LoggingBehavior<,>));
-});
-// 2. FluentValidation
-builder.Services.AddValidatorsFromAssembly(Assembly.GetExecutingAssembly());
-```
-
-## Rules
-- Commands return results, not void (enables error handling)
-- Queries use DTOs, never expose domain entities
-- Never call command handlers from query handlers
-- One handler per Command/Query (no inheritance hierarchies)

package/.morph/framework/standards/integration/event-driven/event-sourcing.md

@@ -1,124 +0,0 @@
-# Integration Standard: Event Sourcing
-
-## Overview
-State is derived from a sequence of immutable events. Use only when audit trail or temporal queries are required.
-
-## When to Use
-✅ Financial transactions (audit required by law)
-✅ Order lifecycle (multiple state transitions, replay needed)
-✅ Inventory changes (why did stock go negative?)
-❌ User profiles (too much churn, GDPR deletion complexity)
-❌ Session/cache state (ephemeral, no audit need)
-
-## Event Design
-```csharp
-// Base event
-public abstract record DomainEvent
-{
-    public Guid EventId { get; init; } = Guid.NewGuid();
-    public DateTime OccurredAt { get; init; } = DateTime.UtcNow;
-    public int Version { get; init; }
-    public string EventType => GetType().Name;
-}
-
-// Specific events — past tense, immutable
-public record OrderPlaced(Guid OrderId, Guid UserId, decimal Total, List<OrderItem> Items)
-    : DomainEvent;
-
-public record OrderShipped(Guid OrderId, string TrackingNumber, DateTime ShippedAt)
-    : DomainEvent;
-
-public record OrderCancelled(Guid OrderId, string Reason)
-    : DomainEvent;
-```
-
-## Aggregate with Event Sourcing
-```csharp
-public class Order : AggregateRoot
-{
-    public OrderStatus Status { get; private set; }
-    public decimal Total { get; private set; }
-
-    // Reconstruct from events
-    public static Order Replay(IEnumerable<DomainEvent> events)
-    {
-        var order = new Order();
-        foreach (var e in events) order.Apply(e);
-        return order;
-    }
-
-    // Command → validate → raise event
-    public void Ship(string trackingNumber)
-    {
-        if (Status != OrderStatus.Confirmed)
-            throw new InvalidOperationException($"Cannot ship order in {Status} status");
-
-        RaiseEvent(new OrderShipped(Id, trackingNumber, DateTime.UtcNow));
-    }
-
-    // State transition from event (idempotent)
-    protected override void Apply(DomainEvent @event)
-    {
-        switch (@event)
-        {
-            case OrderPlaced e:
-                Id = e.OrderId;
-                Total = e.Total;
-                Status = OrderStatus.Pending;
-                break;
-
-            case OrderShipped e:
-                Status = OrderStatus.Shipped;
-                break;
-
-            case OrderCancelled:
-                Status = OrderStatus.Cancelled;
-                break;
-        }
-    }
-}
-```
-
-## Event Store (Azure Cosmos DB pattern)
-```csharp
-public class CosmosEventStore : IEventStore
-{
-    public async Task AppendAsync(Guid streamId, IEnumerable<DomainEvent> events, int expectedVersion)
-    {
-        foreach (var (evt, i) in events.Select((e, i) => (e, i)))
-        {
-            var document = new EventDocument
-            {
-                Id = $"{streamId}:{expectedVersion + i + 1}",
-                StreamId = streamId.ToString(),
-                Version = expectedVersion + i + 1,
-                EventType = evt.EventType,
-                Data = JsonSerializer.Serialize(evt, evt.GetType()),
-                OccurredAt = evt.OccurredAt
-            };
-            await _container.CreateItemAsync(document, new PartitionKey(streamId.ToString()));
-        }
-    }
-}
-```
-
-## Projections (Read Models)
-```csharp
-// Project events to read-optimized views
-public class OrderSummaryProjection
-{
-    public void Handle(OrderPlaced e, AppDbContext ctx)
-        => ctx.OrderSummaries.Add(new OrderSummary { Id = e.OrderId, Total = e.Total, Status = "Pending" });
-
-    public void Handle(OrderShipped e, AppDbContext ctx)
-        => ctx.OrderSummaries.Where(s => s.Id == e.OrderId).ExecuteUpdate(s => s.SetProperty(p => p.Status, "Shipped"));
-}
-```
-
-## Trade-offs
-| Pro | Con |
-|-----|-----|
-| Complete audit trail | Schema evolution complexity |
-| Temporal queries (state at time T) | Higher storage cost |
-| Event replay for debugging | Eventual consistency for read models |
-| Natural integration events | GDPR deletion requires event masking |

package/.morph/framework/standards/integration/event-driven/service-bus.md

@@ -1,95 +0,0 @@
-# Integration Standard: Azure Service Bus
-
-## Patterns
-
-### Queue vs Topic
-- **Queue**: Point-to-point, one consumer per message. Use for jobs, commands.
-- **Topic + Subscription**: Fan-out, multiple consumers. Use for domain events.
-
-### Sender Pattern
-```csharp
-public class ServiceBusSender<T>
-{
-    private readonly ServiceBusSender _sender;
-
-    public async Task SendAsync(T message, CancellationToken ct = default)
-    {
-        var json = JsonSerializer.Serialize(message);
-        var serviceBusMessage = new ServiceBusMessage(json)
-        {
-            ContentType = "application/json",
-            MessageId = Guid.NewGuid().ToString(),
-            Subject = typeof(T).Name // For filtering
-        };
-        await _sender.SendMessageAsync(serviceBusMessage, ct);
-    }
-}
-```
-
-### Receiver Pattern (with IHostedService)
-```csharp
-public class OrderProcessor : IHostedService
-{
-    private ServiceBusProcessor _processor;
-
-    public async Task StartAsync(CancellationToken ct)
-    {
-        _processor.ProcessMessageAsync += HandleMessageAsync;
-        _processor.ProcessErrorAsync += HandleErrorAsync;
-        await _processor.StartProcessingAsync(ct);
-    }
-
-    private async Task HandleMessageAsync(ProcessMessageEventArgs args)
-    {
-        var order = JsonSerializer.Deserialize<OrderCreatedEvent>(args.Message.Body);
-        await _orderService.ProcessAsync(order!);
-        await args.CompleteMessageAsync(args.Message);
-    }
-
-    private Task HandleErrorAsync(ProcessErrorEventArgs args)
-    {
-        _logger.LogError(args.Exception, "Service Bus error on {EntityPath}", args.EntityPath);
-        return Task.CompletedTask; // Abandon → retry → dead-letter
-    }
-}
-```
-
-### Dead-Letter Processing
-```csharp
-// Check dead-letter queue periodically
-var client = new ServiceBusClient(connectionString);
-var receiver = client.CreateReceiver(queueName, new ServiceBusReceiverOptions
-{
-    SubQueue = SubQueue.DeadLetter
-});
-
-await foreach (var msg in receiver.ReceiveMessagesAsync())
-{
-    _logger.LogError("Dead-lettered: {Reason} | Body: {Body}",
-        msg.DeadLetterReason, msg.Body.ToString());
-    await receiver.CompleteMessageAsync(msg);
-}
-```
-
-## Retry Policy
-- MaxDeliveryCount: 5 (queue setting)
-- Lock duration: 5 minutes (for long-processing messages)
-- Dead-letter after MaxDeliveryCount exceeded
-
-## Required Settings
-```json
-{
-  "ServiceBus": {
-    "ConnectionString": "from-key-vault",
-    "QueueName": "feature-name-queue",
-    "MaxConcurrentCalls": 4,
-    "PrefetchCount": 10
-  }
-}
-```
-
-## Anti-Patterns
-- Never use connection string in code — always Key Vault
-- Never process in `HandleErrorAsync` — only log
-- Never use topics for commands (use queues)
-- Never use synchronous sends in Blazor components

package/.morph/framework/standards/integration/mcp/mcp-tools.md

@@ -1,384 +0,0 @@
-# Integration Standard: MCP Tools in MORPH Workflows
-
-> Reference for using Model Context Protocol (MCP) tools across morph-spec phases. Each phase benefits from different MCPs depending on what data is needed.
-
-## MCP Availability Detection
-
-Before using any MCP tool, check if it's available in the current session:
-
-```javascript
-// Pattern: Attempt the call — if the tool doesn't exist, Claude Code will report it
-// There is no "list MCPs" command; just try the most common operation
-
-// Supabase MCP
-await mcp__supabase__list_tables();
-
-// GitHub MCP
-await mcp__github__get_repo();
-
-// Context7 (library docs)
-await mcp__context7__resolve_library_id({ libraryName: "react" });
-
-// Playwright (browser automation)
-await mcp__playwright__browser_navigate({ url: "https://example.com" });
-```
-
-**Fallback rule:** If an MCP is not available, every phase has a manual alternative using Claude Code native tools (Read, Grep, Glob, Bash).
-
----
-
-## MCP Providers by Phase
-
-### Phase 1 (Setup) — Project Discovery
-
-| MCP | Use Case | Example |
-|-----|----------|---------|
-| **GitHub** | Repo info, recent PRs, issues | `mcp__github__get_repo()` |
-| **Filesystem** | Scan project structure | Native Glob/Read preferred |
-
-```javascript
-// Detect project type from repo metadata
-const repo = await mcp__github__get_repo();
-// → language, default_branch, topics
-
-// Fallback: use Glob to detect stack
-// Glob: "**/{package.json,*.csproj,*.sln,go.mod,Cargo.toml}"
-```
-
-### Phase 1.5 (UI/UX) — Design References
-
-| MCP | Use Case | Example |
-|-----|----------|---------|
-| **Figma** | Extract design tokens, components | `mcp__figma__get_file({ fileKey })` |
-| **Playwright** | Navigate, screenshot, inspect live pages | `mcp__playwright__browser_navigate({ url })` |
-| **Context7** | Component library documentation | `mcp__context7__query_docs({ libraryId, query })` |
-
-```javascript
-// Get design tokens from Figma
-const file = await mcp__figma__get_file({ fileKey: "abc123" });
-// → colors, typography, spacing from design file
-
-// Screenshot existing app for design reference
-await mcp__playwright__browser_navigate({ url: "https://app.example.com/dashboard" });
-const screenshot = await mcp__playwright__browser_take_screenshot();
-// → Visual reference for UI/UX design
-
-// Inspect page structure via accessibility tree
-const snapshot = await mcp__playwright__browser_snapshot();
-// → Structured element tree (headings, buttons, inputs, etc.)
-
-// Test responsive layout
-await mcp__playwright__browser_resize({ width: 375, height: 812 });
-const mobileScreenshot = await mcp__playwright__browser_take_screenshot();
-
-// Get MudBlazor component docs for UI specs
-const libId = await mcp__context7__resolve_library_id({
-  libraryName: "mudblazor",
-  query: "data grid with sorting and filtering"
-});
-const docs = await mcp__context7__query_docs({
-  libraryId: libId,
-  query: "DataGrid component props and events"
-});
-
-// Fallback: WebSearch for component documentation
-// WebFetch for specific component API pages
-```
-
-### Phase 2 (Design) — Schema & Architecture
-
-| MCP | Use Case | Example |
-|-----|----------|---------|
-| **Supabase** | Database schema, tables, relationships, RLS | `mcp__supabase__get_table_schema({ table })` |
-| **Database MCPs** | PostgreSQL, MySQL, SQL Server schema | Provider-specific tools |
-| **Context7** | Library docs for architecture decisions | `mcp__context7__query_docs()` |
-| **GitHub** | Check existing code patterns, PRs | `mcp__github__search_code()` |
-
-```javascript
-// === SCHEMA ANALYSIS (Critical for contracts.cs) ===
-
-// 1. List all tables
-const tables = await mcp__supabase__list_tables();
-
-// 2. Get schema for each relevant table
-const schema = await mcp__supabase__get_table_schema({ table: 'leads' });
-// → column_name, data_type, is_nullable, column_default
-
-// 3. Get foreign key relationships
-const rels = await mcp__supabase__get_relationships({ table: 'leads' });
-// → foreign_table, foreign_column, constraint_type
-
-// 4. Run custom query for complex schema info
-const result = await mcp__supabase__query({
-  query: `SELECT column_name, data_type, is_nullable
-          FROM information_schema.columns
-          WHERE table_name = 'leads'
-          ORDER BY ordinal_position`
-});
-
-// 5. Check RLS policies (security-critical)
-const policies = await mcp__supabase__query({
-  query: `SELECT tablename, policyname, cmd, qual
-          FROM pg_policies
-          WHERE tablename = 'leads'`
-});
-```
-
-**Fallback (no Supabase MCP):**
-```
-1. Grep: "\.from\(|\.select\(|SELECT |supabase\.|DbSet<" → find query files
-2. Read each query file → extract table/column names
-3. Glob: "src/**/types/**/*.ts" or "**/Entities/**/*.cs" → find type definitions
-4. Read type files → map properties to database columns
-```
-
-### Phase 3 (Clarify) — Validation & Research
-
-| MCP | Use Case | Example |
-|-----|----------|---------|
-| **Context7** | Verify library capabilities, API limits | `mcp__context7__query_docs()` |
-| **GitHub** | Check issue discussions, known limitations | `mcp__github__search_issues()` |
-
-```javascript
-// Verify if library supports a required feature
-const docs = await mcp__context7__query_docs({
-  libraryId: "/mudblazor/mudblazor",
-  query: "DataGrid server-side pagination with virtual scrolling"
-});
-// → Confirms capability or identifies limitation for spec update
-
-// Fallback: WebSearch for library capabilities
-```
-
-### Phase 4 (Tasks) — Planning & Organization
-
-| MCP | Use Case | Example |
-|-----|----------|---------|
-| **GitHub** | Create issues from tasks, link to milestone | `mcp__github__create_issue()` |
-| **Context7** | Estimate complexity based on library docs | `mcp__context7__query_docs()` |
-
-```javascript
-// Create GitHub issues from tasks.json (if team uses GitHub Projects)
-for (const task of tasks) {
-  await mcp__github__create_issue({
-    title: task.title,
-    body: task.description,
-    labels: [task.category],
-    milestone: featureMilestone
-  });
-}
-
-// Fallback: Bash with gh CLI
-// gh issue create --title "T001: Create Entity Lead" --label "domain"
-```
-
-### Phase 5 (Implement) — Build & Deploy
-
-| MCP | Use Case | Example |
-|-----|----------|---------|
-| **Supabase** | Run migrations, create RLS policies | `mcp__supabase__query()` |
-| **GitHub** | Create PR, push branches | `mcp__github__create_pull_request()` |
-| **Context7** | Look up API usage during coding | `mcp__context7__query_docs()` |
-| **Playwright** | Smoke test deployed features, verify UI | `mcp__playwright__browser_navigate()` |
-| **Azure** | Provision resources, check deployment status | Provider-specific |
-| **Docker** | Build images, manage containers | Provider-specific |
-
-```javascript
-// Run migration after implementing data model
-await mcp__supabase__query({
-  query: `ALTER TABLE leads ADD COLUMN status varchar(20) DEFAULT 'new'`
-});
-
-// Create RLS policy for new feature
-await mcp__supabase__query({
-  query: `CREATE POLICY "Users can view own leads"
-          ON leads FOR SELECT
-          USING (auth.uid() = user_id)`
-});
-
-// Lookup API during implementation
-const docs = await mcp__context7__query_docs({
-  libraryId: "/dotnet/efcore",
-  query: "owned entity types configuration"
-});
-
-// Smoke test deployed feature via browser
-await mcp__playwright__browser_navigate({ url: "https://localhost:5001/leads" });
-const snapshot = await mcp__playwright__browser_snapshot();
-// → Verify page renders correctly, check for errors
-
-// Check for console errors after deploy
-const logs = await mcp__playwright__browser_console_messages();
-// → Catch JavaScript errors, failed API calls
-
-// Screenshot for recap.md documentation
-const screenshot = await mcp__playwright__browser_take_screenshot();
-
-// Fallback: Bash for migrations, gh CLI for PRs
-```
-
----
-
-## MCP vs Native Tools Decision
-
-| Need | MCP Tool | Native Alternative |
-|------|----------|--------------------|
-| Database schema | Supabase/DB MCP | Grep queries + Read types |
-| Repo metadata | GitHub MCP | Bash `gh` CLI |
-| Design tokens | Figma MCP | Read CSS/SCSS variables |
-| Library docs | Context7 | WebSearch + WebFetch |
-| Live page preview | Playwright MCP | WebFetch URL |
-| Page interaction (click, type, navigate) | Playwright MCP | Manual testing |
-| Responsive layout testing | Playwright MCP (`browser_resize`) | Manual testing |
-| Console error checking | Playwright MCP (`browser_console_messages`) | Browser DevTools |
-| Container ops | Docker MCP | Bash `docker` CLI |
-| Cloud resources | Azure MCP | Bash `az` CLI |
-
-**Rule:** MCP tools provide structured data (JSON responses). Native tools require manual parsing. **Always prefer MCP when available** — fall back to native when not.
-
----
-
-## Common MCP Patterns
-
-### Browser (Playwright): Page Automation & Analysis
-
-```javascript
-// === SETUP ===
-// Playwright MCP: npx @playwright/mcp@latest
-// Config in .claude/settings.json or claude_desktop_config.json:
-// { "mcpServers": { "playwright": { "command": "npx", "args": ["@playwright/mcp@latest"] } } }
-
-// === NAVIGATION & SNAPSHOT ===
-
-// 1. Navigate to a page
-await mcp__playwright__browser_navigate({ url: "https://app.example.com/dashboard" });
-
-// 2. Take accessibility snapshot (preferred — structured, LLM-friendly)
-const snapshot = await mcp__playwright__browser_snapshot();
-// → Returns accessibility tree with element refs for interaction
-
-// 3. Take visual screenshot (requires --caps vision)
-const screenshot = await mcp__playwright__browser_take_screenshot();
-// → Returns PNG image of current page
-
-// === INTERACTION ===
-
-// 4. Click an element (use ref from snapshot)
-await mcp__playwright__browser_click({ element: "Submit button", ref: "s1e15" });
-
-// 5. Type into an input field
-await mcp__playwright__browser_type({ element: "Search input", ref: "s1e8", text: "query" });
-
-// 6. Fill a form field (replaces existing value)
-await mcp__playwright__browser_fill_form({ ref: "s1e8", value: "new value" });
-
-// 7. Select dropdown option
-await mcp__playwright__browser_select_option({ element: "Status", ref: "s1e12", values: ["active"] });
-
-// 8. Press keyboard key
-await mcp__playwright__browser_press_key({ key: "Enter" });
-
-// === TABS & NAVIGATION ===
-
-// 9. List open tabs
-const tabs = await mcp__playwright__browser_tabs();
-
-// 10. Navigate back
-await mcp__playwright__browser_navigate_back();
-
-// 11. Close current tab
-await mcp__playwright__browser_close();
-
-// === ADVANCED ===
-
-// 12. Evaluate JavaScript in page context
-const result = await mcp__playwright__browser_evaluate({
-  expression: "document.querySelectorAll('.error').length"
-});
-
-// 13. Get console messages (debug)
-const logs = await mcp__playwright__browser_console_messages();
-
-// 14. Get network requests
-const requests = await mcp__playwright__browser_network_requests();
-
-// 15. Handle dialog (alert, confirm, prompt)
-await mcp__playwright__browser_handle_dialog({ accept: true });
-
-// 16. Resize viewport
-await mcp__playwright__browser_resize({ width: 375, height: 812 }); // iPhone viewport
-
-// 17. Save page as PDF (requires --caps pdf)
-await mcp__playwright__browser_pdf_save();
-
-// 18. Upload file
-await mcp__playwright__browser_file_upload({ ref: "s1e20", paths: ["/path/to/file.png"] });
-```
-
-**Use cases by phase:**
-
-| Phase | Use Case | Tool |
-|-------|----------|------|
-| UI/UX (1.5) | Screenshot reference pages for design | `browser_navigate` + `browser_take_screenshot` |
-| UI/UX (1.5) | Inspect existing app structure | `browser_navigate` + `browser_snapshot` |
-| UI/UX (1.5) | Test responsive layouts | `browser_resize` + `browser_take_screenshot` |
-| Clarify (3) | Verify existing UI behavior | `browser_navigate` + `browser_snapshot` |
-| Implement (5) | Smoke test deployed features | `browser_navigate` + `browser_click` + `browser_snapshot` |
-| Implement (5) | Verify form flows end-to-end | `browser_fill_form` + `browser_click` + `browser_snapshot` |
-| Implement (5) | Check console errors after deploy | `browser_navigate` + `browser_console_messages` |
-| Implement (5) | Screenshot for recap.md | `browser_take_screenshot` |
-
----
-
-### Supabase: Full Schema Discovery
-
-```javascript
-// Complete workflow for Phase 2 schema analysis
-const tables = await mcp__supabase__list_tables();
-
-for (const table of tables.filter(t => isRelevant(t))) {
-  const schema = await mcp__supabase__get_table_schema({ table: table.name });
-  const rels = await mcp__supabase__get_relationships({ table: table.name });
-  // → Write findings to schema-analysis.md
-}
-```
-
-### Context7: Library Research
-
-```javascript
-// Workflow for any phase needing library documentation
-// Step 1: Resolve library ID
-const lib = await mcp__context7__resolve_library_id({
-  libraryName: "fluent-ui-blazor",
-  query: "dialog component with form validation"
-});
-
-// Step 2: Query specific documentation
-const docs = await mcp__context7__query_docs({
-  libraryId: lib.id,
-  query: "FluentDialog component usage with EditForm validation"
-});
-```
-
-### GitHub: Code Search Across Repo
-
-```javascript
-// Find patterns in large codebase during Phase 2
-const results = await mcp__github__search_code({
-  query: "supabase.from leads repo:myorg/myrepo",
-});
-// → Find all places that query the leads table
-```
-
----
-
-## Security Considerations
-
-- **Never pass secrets** in MCP tool parameters (API keys, tokens, passwords)
-- **Supabase MCP** uses project-level auth — queries run with service role by default
-- **GitHub MCP** inherits the configured token's permissions
-- **Always validate MCP responses** before using in contracts or code generation
-
----
-
-*MORPH-SPEC by Polymorphism Tech*