@polymorphism-tech/morph-spec 4.7.0 → 4.7.2

package/.morph/framework/standards/integration/event-driven/cqrs.md

@@ -0,0 +1,101 @@
+# Integration Standard: CQRS with MediatR
+
+## Overview
+Commands mutate state. Queries read state. Never mix them.
+
+## Setup
+```xml
+<PackageReference Include="MediatR" Version="12.*" />
+<PackageReference Include="MediatR.Extensions.Microsoft.DependencyInjection" Version="11.*" />
+```
+
+```csharp
+// Program.cs
+builder.Services.AddMediatR(cfg => cfg.RegisterServicesFromAssembly(typeof(Program).Assembly));
+```
+
+## Command Pattern
+```csharp
+// Command (mutates state, returns result)
+public record CreateOrderCommand(Guid UserId, List<OrderItem> Items)
+    : IRequest<CreateOrderResult>;
+
+public record CreateOrderResult(Guid OrderId, decimal Total);
+
+// Handler
+public class CreateOrderHandler : IRequestHandler<CreateOrderCommand, CreateOrderResult>
+{
+    public async Task<CreateOrderResult> Handle(CreateOrderCommand cmd, CancellationToken ct)
+    {
+        var order = Order.Create(cmd.UserId, cmd.Items);
+        await _repository.AddAsync(order, ct);
+        await _unitOfWork.SaveChangesAsync(ct);
+
+        // Publish domain event
+        await _publisher.Publish(new OrderCreatedEvent(order.Id), ct);
+
+        return new CreateOrderResult(order.Id, order.Total);
+    }
+}
+```
+
+## Query Pattern
+```csharp
+// Query (reads only, no side effects)
+public record GetOrderQuery(Guid OrderId) : IRequest<OrderDto?>;
+
+// Handler — use read model, not domain entity
+public class GetOrderHandler : IRequestHandler<GetOrderQuery, OrderDto?>
+{
+    public async Task<OrderDto?> Handle(GetOrderQuery query, CancellationToken ct)
+    {
+        return await _context.Orders
+            .Where(o => o.Id == query.OrderId)
+            .Select(o => new OrderDto(o.Id, o.Status, o.Total))
+            .FirstOrDefaultAsync(ct);
+    }
+}
+```
+
+## Pipeline Behaviors (Cross-Cutting)
+```csharp
+// Validation behavior
+public class ValidationBehavior<TRequest, TResponse>
+    : IPipelineBehavior<TRequest, TResponse>
+    where TRequest : IRequest<TResponse>
+{
+    public async Task<TResponse> Handle(TRequest request,
+        RequestHandlerDelegate<TResponse> next, CancellationToken ct)
+    {
+        var failures = _validators
+            .SelectMany(v => v.Validate(request).Errors)
+            .Where(f => f != null)
+            .ToList();
+
+        if (failures.Any())
+            throw new ValidationException(failures);
+
+        return await next();
+    }
+}
+```
+
+## DI Registration Order
+```csharp
+// 1. MediatR (includes handler scanning)
+builder.Services.AddMediatR(cfg =>
+{
+    cfg.RegisterServicesFromAssembly(Assembly.GetExecutingAssembly());
+    cfg.AddBehavior(typeof(IPipelineBehavior<,>), typeof(ValidationBehavior<,>));
+    cfg.AddBehavior(typeof(IPipelineBehavior<,>), typeof(PerformanceBehavior<,>));
+    cfg.AddBehavior(typeof(IPipelineBehavior<,>), typeof(LoggingBehavior<,>));
+});
+// 2. FluentValidation
+builder.Services.AddValidatorsFromAssembly(Assembly.GetExecutingAssembly());
+```
+
+## Rules
+- Commands return results, not void (enables error handling)
+- Queries use DTOs, never expose domain entities
+- Never call command handlers from query handlers
+- One handler per Command/Query (no inheritance hierarchies)

package/.morph/framework/standards/integration/event-driven/event-sourcing.md

@@ -0,0 +1,124 @@
+# Integration Standard: Event Sourcing
+
+## Overview
+State is derived from a sequence of immutable events. Use only when audit trail or temporal queries are required.
+
+## When to Use
+✅ Financial transactions (audit required by law)
+✅ Order lifecycle (multiple state transitions, replay needed)
+✅ Inventory changes (why did stock go negative?)
+❌ User profiles (too much churn, GDPR deletion complexity)
+❌ Session/cache state (ephemeral, no audit need)
+
+## Event Design
+```csharp
+// Base event
+public abstract record DomainEvent
+{
+    public Guid EventId { get; init; } = Guid.NewGuid();
+    public DateTime OccurredAt { get; init; } = DateTime.UtcNow;
+    public int Version { get; init; }
+    public string EventType => GetType().Name;
+}
+
+// Specific events — past tense, immutable
+public record OrderPlaced(Guid OrderId, Guid UserId, decimal Total, List<OrderItem> Items)
+    : DomainEvent;
+
+public record OrderShipped(Guid OrderId, string TrackingNumber, DateTime ShippedAt)
+    : DomainEvent;
+
+public record OrderCancelled(Guid OrderId, string Reason)
+    : DomainEvent;
+```
+
+## Aggregate with Event Sourcing
+```csharp
+public class Order : AggregateRoot
+{
+    public OrderStatus Status { get; private set; }
+    public decimal Total { get; private set; }
+
+    // Reconstruct from events
+    public static Order Replay(IEnumerable<DomainEvent> events)
+    {
+        var order = new Order();
+        foreach (var e in events) order.Apply(e);
+        return order;
+    }
+
+    // Command → validate → raise event
+    public void Ship(string trackingNumber)
+    {
+        if (Status != OrderStatus.Confirmed)
+            throw new InvalidOperationException($"Cannot ship order in {Status} status");
+
+        RaiseEvent(new OrderShipped(Id, trackingNumber, DateTime.UtcNow));
+    }
+
+    // State transition from event (idempotent)
+    protected override void Apply(DomainEvent @event)
+    {
+        switch (@event)
+        {
+            case OrderPlaced e:
+                Id = e.OrderId;
+                Total = e.Total;
+                Status = OrderStatus.Pending;
+                break;
+
+            case OrderShipped e:
+                Status = OrderStatus.Shipped;
+                break;
+
+            case OrderCancelled:
+                Status = OrderStatus.Cancelled;
+                break;
+        }
+    }
+}
+```
+
+## Event Store (Azure Cosmos DB pattern)
+```csharp
+public class CosmosEventStore : IEventStore
+{
+    public async Task AppendAsync(Guid streamId, IEnumerable<DomainEvent> events, int expectedVersion)
+    {
+        foreach (var (evt, i) in events.Select((e, i) => (e, i)))
+        {
+            var document = new EventDocument
+            {
+                Id = $"{streamId}:{expectedVersion + i + 1}",
+                StreamId = streamId.ToString(),
+                Version = expectedVersion + i + 1,
+                EventType = evt.EventType,
+                Data = JsonSerializer.Serialize(evt, evt.GetType()),
+                OccurredAt = evt.OccurredAt
+            };
+            await _container.CreateItemAsync(document, new PartitionKey(streamId.ToString()));
+        }
+    }
+}
+```
+
+## Projections (Read Models)
+```csharp
+// Project events to read-optimized views
+public class OrderSummaryProjection
+{
+    public void Handle(OrderPlaced e, AppDbContext ctx)
+        => ctx.OrderSummaries.Add(new OrderSummary { Id = e.OrderId, Total = e.Total, Status = "Pending" });
+
+    public void Handle(OrderShipped e, AppDbContext ctx)
+        => ctx.OrderSummaries.Where(s => s.Id == e.OrderId).ExecuteUpdate(s => s.SetProperty(p => p.Status, "Shipped"));
+}
+```
+
+## Trade-offs
+| Pro | Con |
+|-----|-----|
+| Complete audit trail | Schema evolution complexity |
+| Temporal queries (state at time T) | Higher storage cost |
+| Event replay for debugging | Eventual consistency for read models |
+| Natural integration events | GDPR deletion requires event masking |

package/.morph/framework/standards/integration/event-driven/service-bus.md

@@ -0,0 +1,95 @@
+# Integration Standard: Azure Service Bus
+
+## Patterns
+
+### Queue vs Topic
+- **Queue**: Point-to-point, one consumer per message. Use for jobs, commands.
+- **Topic + Subscription**: Fan-out, multiple consumers. Use for domain events.
+
+### Sender Pattern
+```csharp
+public class ServiceBusSender<T>
+{
+    private readonly ServiceBusSender _sender;
+
+    public async Task SendAsync(T message, CancellationToken ct = default)
+    {
+        var json = JsonSerializer.Serialize(message);
+        var serviceBusMessage = new ServiceBusMessage(json)
+        {
+            ContentType = "application/json",
+            MessageId = Guid.NewGuid().ToString(),
+            Subject = typeof(T).Name // For filtering
+        };
+        await _sender.SendMessageAsync(serviceBusMessage, ct);
+    }
+}
+```
+
+### Receiver Pattern (with IHostedService)
+```csharp
+public class OrderProcessor : IHostedService
+{
+    private ServiceBusProcessor _processor;
+
+    public async Task StartAsync(CancellationToken ct)
+    {
+        _processor.ProcessMessageAsync += HandleMessageAsync;
+        _processor.ProcessErrorAsync += HandleErrorAsync;
+        await _processor.StartProcessingAsync(ct);
+    }
+
+    private async Task HandleMessageAsync(ProcessMessageEventArgs args)
+    {
+        var order = JsonSerializer.Deserialize<OrderCreatedEvent>(args.Message.Body);
+        await _orderService.ProcessAsync(order!);
+        await args.CompleteMessageAsync(args.Message);
+    }
+
+    private Task HandleErrorAsync(ProcessErrorEventArgs args)
+    {
+        _logger.LogError(args.Exception, "Service Bus error on {EntityPath}", args.EntityPath);
+        return Task.CompletedTask; // Abandon → retry → dead-letter
+    }
+}
+```
+
+### Dead-Letter Processing
+```csharp
+// Check dead-letter queue periodically
+var client = new ServiceBusClient(connectionString);
+var receiver = client.CreateReceiver(queueName, new ServiceBusReceiverOptions
+{
+    SubQueue = SubQueue.DeadLetter
+});
+
+await foreach (var msg in receiver.ReceiveMessagesAsync())
+{
+    _logger.LogError("Dead-lettered: {Reason} | Body: {Body}",
+        msg.DeadLetterReason, msg.Body.ToString());
+    await receiver.CompleteMessageAsync(msg);
+}
+```
+
+## Retry Policy
+- MaxDeliveryCount: 5 (queue setting)
+- Lock duration: 5 minutes (for long-processing messages)
+- Dead-letter after MaxDeliveryCount exceeded
+
+## Required Settings
+```json
+{
+  "ServiceBus": {
+    "ConnectionString": "from-key-vault",
+    "QueueName": "feature-name-queue",
+    "MaxConcurrentCalls": 4,
+    "PrefetchCount": 10
+  }
+}
+```
+
+## Anti-Patterns
+- Never use connection string in code — always Key Vault
+- Never process in `HandleErrorAsync` — only log
+- Never use topics for commands (use queues)
+- Never use synchronous sends in Blazor components

package/.morph/framework/standards/integration/mcp/mcp-tools.md

@@ -0,0 +1,384 @@
+# Integration Standard: MCP Tools in MORPH Workflows
+
+> Reference for using Model Context Protocol (MCP) tools across morph-spec phases. Each phase benefits from different MCPs depending on what data is needed.
+
+## MCP Availability Detection
+
+Before using any MCP tool, check if it's available in the current session:
+
+```javascript
+// Pattern: Attempt the call — if the tool doesn't exist, Claude Code will report it
+// There is no "list MCPs" command; just try the most common operation
+
+// Supabase MCP
+await mcp__supabase__list_tables();
+
+// GitHub MCP
+await mcp__github__get_repo();
+
+// Context7 (library docs)
+await mcp__context7__resolve_library_id({ libraryName: "react" });
+
+// Playwright (browser automation)
+await mcp__playwright__browser_navigate({ url: "https://example.com" });
+```
+
+**Fallback rule:** If an MCP is not available, every phase has a manual alternative using Claude Code native tools (Read, Grep, Glob, Bash).
+
+---
+
+## MCP Providers by Phase
+
+### Phase 1 (Setup) — Project Discovery
+
+| MCP | Use Case | Example |
+|-----|----------|---------|
+| **GitHub** | Repo info, recent PRs, issues | `mcp__github__get_repo()` |
+| **Filesystem** | Scan project structure | Native Glob/Read preferred |
+
+```javascript
+// Detect project type from repo metadata
+const repo = await mcp__github__get_repo();
+// → language, default_branch, topics
+
+// Fallback: use Glob to detect stack
+// Glob: "**/{package.json,*.csproj,*.sln,go.mod,Cargo.toml}"
+```
+
+### Phase 1.5 (UI/UX) — Design References
+
+| MCP | Use Case | Example |
+|-----|----------|---------|
+| **Figma** | Extract design tokens, components | `mcp__figma__get_file({ fileKey })` |
+| **Playwright** | Navigate, screenshot, inspect live pages | `mcp__playwright__browser_navigate({ url })` |
+| **Context7** | Component library documentation | `mcp__context7__query_docs({ libraryId, query })` |
+
+```javascript
+// Get design tokens from Figma
+const file = await mcp__figma__get_file({ fileKey: "abc123" });
+// → colors, typography, spacing from design file
+
+// Screenshot existing app for design reference
+await mcp__playwright__browser_navigate({ url: "https://app.example.com/dashboard" });
+const screenshot = await mcp__playwright__browser_take_screenshot();
+// → Visual reference for UI/UX design
+
+// Inspect page structure via accessibility tree
+const snapshot = await mcp__playwright__browser_snapshot();
+// → Structured element tree (headings, buttons, inputs, etc.)
+
+// Test responsive layout
+await mcp__playwright__browser_resize({ width: 375, height: 812 });
+const mobileScreenshot = await mcp__playwright__browser_take_screenshot();
+
+// Get MudBlazor component docs for UI specs
+const libId = await mcp__context7__resolve_library_id({
+  libraryName: "mudblazor",
+  query: "data grid with sorting and filtering"
+});
+const docs = await mcp__context7__query_docs({
+  libraryId: libId,
+  query: "DataGrid component props and events"
+});
+
+// Fallback: WebSearch for component documentation
+// WebFetch for specific component API pages
+```
+
+### Phase 2 (Design) — Schema & Architecture
+
+| MCP | Use Case | Example |
+|-----|----------|---------|
+| **Supabase** | Database schema, tables, relationships, RLS | `mcp__supabase__get_table_schema({ table })` |
+| **Database MCPs** | PostgreSQL, MySQL, SQL Server schema | Provider-specific tools |
+| **Context7** | Library docs for architecture decisions | `mcp__context7__query_docs()` |
+| **GitHub** | Check existing code patterns, PRs | `mcp__github__search_code()` |
+
+```javascript
+// === SCHEMA ANALYSIS (Critical for contracts.cs) ===
+
+// 1. List all tables
+const tables = await mcp__supabase__list_tables();
+
+// 2. Get schema for each relevant table
+const schema = await mcp__supabase__get_table_schema({ table: 'leads' });
+// → column_name, data_type, is_nullable, column_default
+
+// 3. Get foreign key relationships
+const rels = await mcp__supabase__get_relationships({ table: 'leads' });
+// → foreign_table, foreign_column, constraint_type
+
+// 4. Run custom query for complex schema info
+const result = await mcp__supabase__query({
+  query: `SELECT column_name, data_type, is_nullable
+          FROM information_schema.columns
+          WHERE table_name = 'leads'
+          ORDER BY ordinal_position`
+});
+
+// 5. Check RLS policies (security-critical)
+const policies = await mcp__supabase__query({
+  query: `SELECT tablename, policyname, cmd, qual
+          FROM pg_policies
+          WHERE tablename = 'leads'`
+});
+```
+
+**Fallback (no Supabase MCP):**
+```
+1. Grep: "\.from\(|\.select\(|SELECT |supabase\.|DbSet<" → find query files
+2. Read each query file → extract table/column names
+3. Glob: "src/**/types/**/*.ts" or "**/Entities/**/*.cs" → find type definitions
+4. Read type files → map properties to database columns
+```
+
+### Phase 3 (Clarify) — Validation & Research
+
+| MCP | Use Case | Example |
+|-----|----------|---------|
+| **Context7** | Verify library capabilities, API limits | `mcp__context7__query_docs()` |
+| **GitHub** | Check issue discussions, known limitations | `mcp__github__search_issues()` |
+
+```javascript
+// Verify if library supports a required feature
+const docs = await mcp__context7__query_docs({
+  libraryId: "/mudblazor/mudblazor",
+  query: "DataGrid server-side pagination with virtual scrolling"
+});
+// → Confirms capability or identifies limitation for spec update
+
+// Fallback: WebSearch for library capabilities
+```
+
+### Phase 4 (Tasks) — Planning & Organization
+
+| MCP | Use Case | Example |
+|-----|----------|---------|
+| **GitHub** | Create issues from tasks, link to milestone | `mcp__github__create_issue()` |
+| **Context7** | Estimate complexity based on library docs | `mcp__context7__query_docs()` |
+
+```javascript
+// Create GitHub issues from tasks.json (if team uses GitHub Projects)
+for (const task of tasks) {
+  await mcp__github__create_issue({
+    title: task.title,
+    body: task.description,
+    labels: [task.category],
+    milestone: featureMilestone
+  });
+}
+
+// Fallback: Bash with gh CLI
+// gh issue create --title "T001: Create Entity Lead" --label "domain"
+```
+
+### Phase 5 (Implement) — Build & Deploy
+
+| MCP | Use Case | Example |
+|-----|----------|---------|
+| **Supabase** | Run migrations, create RLS policies | `mcp__supabase__query()` |
+| **GitHub** | Create PR, push branches | `mcp__github__create_pull_request()` |
+| **Context7** | Look up API usage during coding | `mcp__context7__query_docs()` |
+| **Playwright** | Smoke test deployed features, verify UI | `mcp__playwright__browser_navigate()` |
+| **Azure** | Provision resources, check deployment status | Provider-specific |
+| **Docker** | Build images, manage containers | Provider-specific |
+
+```javascript
+// Run migration after implementing data model
+await mcp__supabase__query({
+  query: `ALTER TABLE leads ADD COLUMN status varchar(20) DEFAULT 'new'`
+});
+
+// Create RLS policy for new feature
+await mcp__supabase__query({
+  query: `CREATE POLICY "Users can view own leads"
+          ON leads FOR SELECT
+          USING (auth.uid() = user_id)`
+});
+
+// Lookup API during implementation
+const docs = await mcp__context7__query_docs({
+  libraryId: "/dotnet/efcore",
+  query: "owned entity types configuration"
+});
+
+// Smoke test deployed feature via browser
+await mcp__playwright__browser_navigate({ url: "https://localhost:5001/leads" });
+const snapshot = await mcp__playwright__browser_snapshot();
+// → Verify page renders correctly, check for errors
+
+// Check for console errors after deploy
+const logs = await mcp__playwright__browser_console_messages();
+// → Catch JavaScript errors, failed API calls
+
+// Screenshot for recap.md documentation
+const screenshot = await mcp__playwright__browser_take_screenshot();
+
+// Fallback: Bash for migrations, gh CLI for PRs
+```
+
+---
+
+## MCP vs Native Tools Decision
+
+| Need | MCP Tool | Native Alternative |
+|------|----------|--------------------|
+| Database schema | Supabase/DB MCP | Grep queries + Read types |
+| Repo metadata | GitHub MCP | Bash `gh` CLI |
+| Design tokens | Figma MCP | Read CSS/SCSS variables |
+| Library docs | Context7 | WebSearch + WebFetch |
+| Live page preview | Playwright MCP | WebFetch URL |
+| Page interaction (click, type, navigate) | Playwright MCP | Manual testing |
+| Responsive layout testing | Playwright MCP (`browser_resize`) | Manual testing |
+| Console error checking | Playwright MCP (`browser_console_messages`) | Browser DevTools |
+| Container ops | Docker MCP | Bash `docker` CLI |
+| Cloud resources | Azure MCP | Bash `az` CLI |
+
+**Rule:** MCP tools provide structured data (JSON responses). Native tools require manual parsing. **Always prefer MCP when available** — fall back to native when not.
+
+---
+
+## Common MCP Patterns
+
+### Browser (Playwright): Page Automation & Analysis
+
+```javascript
+// === SETUP ===
+// Playwright MCP: npx @playwright/mcp@latest
+// Config in .claude/settings.json or claude_desktop_config.json:
+// { "mcpServers": { "playwright": { "command": "npx", "args": ["@playwright/mcp@latest"] } } }
+
+// === NAVIGATION & SNAPSHOT ===
+
+// 1. Navigate to a page
+await mcp__playwright__browser_navigate({ url: "https://app.example.com/dashboard" });
+
+// 2. Take accessibility snapshot (preferred — structured, LLM-friendly)
+const snapshot = await mcp__playwright__browser_snapshot();
+// → Returns accessibility tree with element refs for interaction
+
+// 3. Take visual screenshot (requires --caps vision)
+const screenshot = await mcp__playwright__browser_take_screenshot();
+// → Returns PNG image of current page
+
+// === INTERACTION ===
+
+// 4. Click an element (use ref from snapshot)
+await mcp__playwright__browser_click({ element: "Submit button", ref: "s1e15" });
+
+// 5. Type into an input field
+await mcp__playwright__browser_type({ element: "Search input", ref: "s1e8", text: "query" });
+
+// 6. Fill a form field (replaces existing value)
+await mcp__playwright__browser_fill_form({ ref: "s1e8", value: "new value" });
+
+// 7. Select dropdown option
+await mcp__playwright__browser_select_option({ element: "Status", ref: "s1e12", values: ["active"] });
+
+// 8. Press keyboard key
+await mcp__playwright__browser_press_key({ key: "Enter" });
+
+// === TABS & NAVIGATION ===
+
+// 9. List open tabs
+const tabs = await mcp__playwright__browser_tabs();
+
+// 10. Navigate back
+await mcp__playwright__browser_navigate_back();
+
+// 11. Close current tab
+await mcp__playwright__browser_close();
+
+// === ADVANCED ===
+
+// 12. Evaluate JavaScript in page context
+const result = await mcp__playwright__browser_evaluate({
+  expression: "document.querySelectorAll('.error').length"
+});
+
+// 13. Get console messages (debug)
+const logs = await mcp__playwright__browser_console_messages();
+
+// 14. Get network requests
+const requests = await mcp__playwright__browser_network_requests();
+
+// 15. Handle dialog (alert, confirm, prompt)
+await mcp__playwright__browser_handle_dialog({ accept: true });
+
+// 16. Resize viewport
+await mcp__playwright__browser_resize({ width: 375, height: 812 }); // iPhone viewport
+
+// 17. Save page as PDF (requires --caps pdf)
+await mcp__playwright__browser_pdf_save();
+
+// 18. Upload file
+await mcp__playwright__browser_file_upload({ ref: "s1e20", paths: ["/path/to/file.png"] });
+```
+
+**Use cases by phase:**
+
+| Phase | Use Case | Tool |
+|-------|----------|------|
+| UI/UX (1.5) | Screenshot reference pages for design | `browser_navigate` + `browser_take_screenshot` |
+| UI/UX (1.5) | Inspect existing app structure | `browser_navigate` + `browser_snapshot` |
+| UI/UX (1.5) | Test responsive layouts | `browser_resize` + `browser_take_screenshot` |
+| Clarify (3) | Verify existing UI behavior | `browser_navigate` + `browser_snapshot` |
+| Implement (5) | Smoke test deployed features | `browser_navigate` + `browser_click` + `browser_snapshot` |
+| Implement (5) | Verify form flows end-to-end | `browser_fill_form` + `browser_click` + `browser_snapshot` |
+| Implement (5) | Check console errors after deploy | `browser_navigate` + `browser_console_messages` |
+| Implement (5) | Screenshot for recap.md | `browser_take_screenshot` |
+
+---
+
+### Supabase: Full Schema Discovery
+
+```javascript
+// Complete workflow for Phase 2 schema analysis
+const tables = await mcp__supabase__list_tables();
+
+for (const table of tables.filter(t => isRelevant(t))) {
+  const schema = await mcp__supabase__get_table_schema({ table: table.name });
+  const rels = await mcp__supabase__get_relationships({ table: table.name });
+  // → Write findings to schema-analysis.md
+}
+```
+
+### Context7: Library Research
+
+```javascript
+// Workflow for any phase needing library documentation
+// Step 1: Resolve library ID
+const lib = await mcp__context7__resolve_library_id({
+  libraryName: "fluent-ui-blazor",
+  query: "dialog component with form validation"
+});
+
+// Step 2: Query specific documentation
+const docs = await mcp__context7__query_docs({
+  libraryId: lib.id,
+  query: "FluentDialog component usage with EditForm validation"
+});
+```
+
+### GitHub: Code Search Across Repo
+
+```javascript
+// Find patterns in large codebase during Phase 2
+const results = await mcp__github__search_code({
+  query: "supabase.from leads repo:myorg/myrepo",
+});
+// → Find all places that query the leads table
+```
+
+---
+
+## Security Considerations
+
+- **Never pass secrets** in MCP tool parameters (API keys, tokens, passwords)
+- **Supabase MCP** uses project-level auth — queries run with service role by default
+- **GitHub MCP** inherits the configured token's permissions
+- **Always validate MCP responses** before using in contracts or code generation
+
+---
+
+*MORPH-SPEC by Polymorphism Tech*