@provos/ironcurtain 0.7.2 → 0.9.0

package/dist/pipeline/pipeline-runner.js

@@ -2,13 +2,13 @@
  * PipelineRunner -- Encapsulates the full policy compilation pipeline.
  *
  * Provides a reusable abstraction over the compile-verify-repair loop.
- * Used by both:
- * - compile.ts CLI (constitutionKind: 'constitution')
- * - compileTaskPolicy() (constitutionKind: 'task-policy')
+ * Used by:
+ * - compile.ts CLI (constitutionKind: 'constitution') -- per-server compilation
+ * - compileTaskPolicy() (constitutionKind: 'task-policy') -- per-server whitelist
  *
- * The two constitutionKind variants differ only in the LLM prompt:
- * - 'constitution': broad-principle compilation from a constitution doc
- * - 'task-policy': whitelist-generation from an English task description
+ * Each MCP server is compiled independently with its own compile-verify-repair
+ * cycle, then results are merged. This enables incremental recompilation and
+ * better per-server rule quality.
  */
 import { resolve } from 'node:path';
 import chalk from 'chalk';
@@ -17,10 +17,12 @@ import { PolicyEngine } from '../trusted-process/policy-engine.js';
 import { buildCompilerSystemPrompt, ConstitutionCompilerSession, formatAnnotationsSummary, validateCompiledRules, } from './constitution-compiler.js';
 import { getHandwrittenScenarios } from './handwritten-scenarios.js';
 import { resolveAllLists } from './list-resolver.js';
-import { computeHash, loadExistingArtifact, loadToolAnnotationsFile, mergeReplacements, resolveRulePaths, writeArtifact, withSpinner, showCached, createPipelineLlm, } from './pipeline-shared.js';
-import { applyScenarioCorrections, buildJudgeSystemPrompt, extractScenarioCorrections, filterStructuralConflicts, PolicyVerifierSession, verifyPolicy, } from './policy-verifier.js';
-import { buildGeneratorSystemPrompt, ScenarioGeneratorSession } from './scenario-generator.js';
-import { connectMcpServersForLists, disconnectMcpServers } from './mcp-connections.js';
+import { computeHash, loadExistingArtifact, loadStoredToolAnnotationsFile, resolveRulePaths, writeArtifact, withSpinner, showCached, createPipelineLlm, } from './pipeline-shared.js';
+import { resolveStoredAnnotationsFile } from '../types/argument-roles.js';
+import { applyScenarioCorrections, buildJudgeSystemPrompt, detectAllDefaultRoleFallbacks, extractScenarioCorrections, filterStructuralConflicts, PolicyVerifierSession, verifyPolicy, } from './policy-verifier.js';
+import { filterInvalidSchemaScenarios } from './scenario-schema-validator.js';
+import { buildGeneratorSystemPrompt, generateScenarios, repairScenarios } from './scenario-generator.js';
+import { connectViaProxy } from './proxy-mcp-connections.js';
 /** Creates PipelineModels from user config. Delegates to shared createPipelineLlm. */
 export async function createPipelineModels(logDir) {
     const effectiveLogDir = logDir ?? resolve(process.cwd(), 'generated');
@@ -35,9 +37,6 @@ export async function createPipelineModels(logDir) {
 // ---------------------------------------------------------------------------
 // Internal helpers
 // ---------------------------------------------------------------------------
-function computePolicyHash(systemPrompt, annotations) {
-    return computeHash(systemPrompt, JSON.stringify(annotations));
-}
 function computeScenariosHash(systemPrompt, handwrittenScenarios) {
     return computeHash(systemPrompt, JSON.stringify(handwrittenScenarios));
 }
@@ -53,14 +52,48 @@ function extractPermittedDirectories(rules) {
 function collectProbeScenarios(result) {
     return result.rounds.flatMap((round) => round.newScenarios);
 }
-function filterAndLogStructuralConflicts(engine, scenarios, label = 'Discarded scenario (structural conflict)') {
-    const { valid, discarded } = filterStructuralConflicts(engine, scenarios);
+function filterAndLogStructuralConflicts(engine, scenarios, label = 'Discarded scenario (structural conflict)', storedAnnotations) {
+    const filterResult = filterStructuralConflicts(engine, scenarios);
+    let valid = filterResult.valid;
+    const discarded = filterResult.discarded;
     for (const d of discarded) {
         const prefix = d.scenario.source === 'handwritten'
             ? chalk.yellow('Warning: handwritten scenario conflicts with structural invariant:')
             : chalk.dim(`${label}:`);
         console.error(`  ${prefix} "${d.scenario.description}" — ${d.rule} always returns ${d.actual}`);
     }
+    // Discard scenarios whose arguments don't match any conditional role spec —
+    // they fall back to all default roles and test the wrong thing.
+    if (storedAnnotations.length > 0) {
+        const fallbackWarnings = detectAllDefaultRoleFallbacks(valid, storedAnnotations);
+        const fallbackDescriptions = new Set(fallbackWarnings.map((w) => w.scenario.description));
+        if (fallbackDescriptions.size > 0) {
+            const kept = [];
+            for (const s of valid) {
+                if (fallbackDescriptions.has(s.description)) {
+                    const w = fallbackWarnings.find((fw) => fw.scenario.description === s.description);
+                    const details = w?.details.join('; ') ?? 'unknown conditional mismatch';
+                    const discardLabel = 'Discarded (default role fallback)';
+                    console.error(`  ${chalk.dim(`${discardLabel}:`)} "${s.description}" — ${details}`);
+                    discarded.push({ scenario: s, rule: 'default-role-fallback', actual: 'deny' });
+                }
+                else {
+                    kept.push(s);
+                }
+            }
+            valid = kept;
+        }
+        // Discard scenarios whose arguments violate the tool's input schema
+        // (unknown arg names, missing required fields, invalid enum values).
+        const schemaResult = filterInvalidSchemaScenarios(valid, storedAnnotations);
+        if (schemaResult.discarded.length > 0) {
+            for (const d of schemaResult.discarded) {
+                console.error(`  ${chalk.dim('Discarded (schema mismatch):')} "${d.scenario.description}" — ${d.rule}`);
+            }
+            discarded.push(...schemaResult.discarded);
+            valid = schemaResult.valid;
+        }
+    }
     return { valid, discarded };
 }
 class RuleValidationError extends Error {
@@ -98,10 +131,14 @@ function buildPolicyArtifact(constitutionHash, rules, listDefinitions, inputHash
  * Builds the task-policy system prompt for per-job compilation.
  * Instructs the LLM to generate a strict whitelist from the task.
  */
-function buildTaskCompilerSystemPrompt(taskDescription, annotations, protectedPaths, allowedDirectory) {
+function buildTaskCompilerSystemPrompt(taskDescription, annotations, protectedPaths, allowedDirectory, serverScope) {
     const annotationsSummary = formatAnnotationsSummary(annotations);
     return `You are compiling a task-scoped security policy for an automated scheduled job. The job runs unattended on a schedule. Your goal is to generate the MINIMUM set of policy rules required for this specific task -- nothing more.
 
+## Server Scope
+
+You are generating rules ONLY for the "${serverScope}" server. Every rule you emit MUST include "server": ["${serverScope}"] in its "if" condition.
+
 ## Task Description
 
 ${taskDescription}
@@ -150,9 +187,8 @@ Produce an ORDERED list of policy rules (first match wins). Each rule has:
 - "principle": which task requirement this implements
 - "if": conditions that must ALL be true for the rule to fire:
   - "roles": array of argument roles to match. Omit = any tool.
-  - "server": array of server names (omit = any server)
+  - "server": MUST be ["${serverScope}"]
   - "tool": array of specific tool names (omit = any matching tool)
-  - "sideEffects": match on the tool's sideEffects annotation (omit = don't filter)
   - "paths": path condition with "roles" and "within" (concrete absolute directory)
   - "domains": domain condition with "roles" and "allowed" (list of allowed domain patterns). For git-remote-url roles, use hostname/owner/repo patterns for specific repos (e.g., "github.com/provos/ironcurtain") or hostname-only for any repo on that host (e.g., "github.com"). Git tools with both path and URL roles need "domains" conditions for git-remote-url (path roles get sandbox-resolved separately).
   - "lists": array of list conditions with "roles", "allowed", and "matchType"
@@ -164,7 +200,84 @@ CRITICAL RULES:
 2. Use CONCRETE ABSOLUTE paths when needed.
 3. Order matters: more specific rules before more general ones.
 4. Only output "allow" and "escalate" rules.
-5. Be concise in descriptions and reasons -- one sentence each.`;
+5. Be concise in descriptions and reasons -- one sentence each.
+6. EVERY rule MUST have "server": ["${serverScope}"] in its condition.`;
+}
+// ---------------------------------------------------------------------------
+// Per-server merge helpers (exported for testing)
+// ---------------------------------------------------------------------------
+/**
+ * Computes a content hash for a single server's policy compilation inputs.
+ * The hash includes the server name, constitution, annotations, and prompt
+ * template so that any change invalidates the cache for this server.
+ */
+export function computeServerPolicyHash(serverName, constitutionText, annotations, compilerPromptTemplate) {
+    return computeHash(serverName, constitutionText, JSON.stringify(annotations), compilerPromptTemplate);
+}
+/**
+ * Filters handwritten scenarios to only those belonging to a specific server.
+ * Safe because handwritten scenarios are tagged with serverName in their request.
+ */
+export function getHandwrittenScenariosForServer(serverName, sandboxDir) {
+    return getHandwrittenScenarios(sandboxDir).filter((s) => s.request.serverName === serverName);
+}
+/**
+ * Debug assertion: validates that all rules from a server's compilation
+ * are properly scoped to exactly that server. This should never fail if
+ * the Zod schema with requireServer is correct.
+ */
+export function validateServerScoping(serverName, rules) {
+    for (const rule of rules) {
+        if (!rule.if.server || !rule.if.server.includes(serverName)) {
+            throw new Error(`Rule "${rule.name}" from server "${serverName}" is missing ` +
+                `server: ["${serverName}"] in its condition. This is a compiler bug.`);
+        }
+        if (rule.if.server.length !== 1 || rule.if.server[0] !== serverName) {
+            throw new Error(`Rule "${rule.name}" from server "${serverName}" has unexpected ` +
+                `server scope: ${JSON.stringify(rule.if.server)}. Expected exactly ["${serverName}"].`);
+        }
+    }
+}
+/**
+ * Deduplicates list definitions by name. When two servers produce different
+ * generationPrompt values for the same named list, uses first-wins
+ * (alphabetical server order) and logs a warning.
+ */
+export function deduplicateListDefinitions(defs) {
+    const seen = new Map();
+    for (const def of defs) {
+        const existing = seen.get(def.name);
+        if (!existing) {
+            seen.set(def.name, def);
+        }
+        else if (existing.generationPrompt !== def.generationPrompt) {
+            console.error(`  Warning: list "${def.name}" has divergent generation prompts ` +
+                `across servers. Using first definition (alphabetical server order).`);
+        }
+    }
+    return [...seen.values()];
+}
+/**
+ * Merges per-server compilation results into a single CompiledPolicyFile.
+ * Rules are concatenated in alphabetical server order for determinism.
+ * List definitions are deduplicated by name.
+ */
+export function mergeServerResults(results, constitutionHash) {
+    const sortedResults = [...results].sort((a, b) => a.serverName.localeCompare(b.serverName));
+    const allRules = sortedResults.flatMap((r) => r.rules);
+    const allListDefs = sortedResults.flatMap((r) => r.listDefinitions);
+    const uniqueListDefs = deduplicateListDefinitions(allListDefs);
+    const mergedInputHash = computeHash(...sortedResults.map((r) => r.inputHash));
+    const artifact = {
+        generatedAt: new Date().toISOString(),
+        constitutionHash,
+        inputHash: mergedInputHash,
+        rules: allRules,
+    };
+    if (uniqueListDefs.length > 0) {
+        artifact.listDefinitions = uniqueListDefs;
+    }
+    return artifact;
 }
 // ---------------------------------------------------------------------------
 // PipelineRunner
@@ -172,6 +285,10 @@ CRITICAL RULES:
 /**
  * Encapsulates the full policy compilation pipeline:
  * compile rules -> generate scenarios -> verify -> repair loop.
+ *
+ * Uses per-server compilation with independent compile-verify-repair
+ * cycles per server, then merges results. Works for both 'constitution'
+ * (broad principles) and 'task-policy' (strict whitelist) modes.
  */
 export class PipelineRunner {
     model;
@@ -184,109 +301,272 @@ export class PipelineRunner {
     }
     /**
      * Runs the full pipeline. Returns the compiled policy on success.
+     * All compilation modes use per-server compilation with independent
+     * compile-verify-repair cycles per server, then merge results.
      */
     async run(config) {
-        const toolAnnotationsFile = config.preloadedToolAnnotations ??
-            loadToolAnnotationsFile(config.toolAnnotationsDir, config.toolAnnotationsFallbackDir);
-        if (!toolAnnotationsFile) {
+        return this.runPerServer(config);
+    }
+    // -----------------------------------------------------------------------
+    // Per-server compilation path
+    // -----------------------------------------------------------------------
+    /**
+     * Orchestrates per-server compilation + merge.
+     *
+     * Phase 1: Compile each server independently (compile-verify-repair per server)
+     * Phase 2: Merge all per-server results into final compiled-policy.json
+     * Phase 3: Resolve dynamic lists (global, post-merge)
+     *
+     * Works for both 'constitution' and 'task-policy' modes -- the
+     * constitutionKind is forwarded to each server's compilation unit
+     * to select the appropriate compiler prompt.
+     */
+    async runPerServer(config) {
+        const storedAnnotationsFile = config.preloadedStoredAnnotations ??
+            loadStoredToolAnnotationsFile(config.toolAnnotationsDir, config.toolAnnotationsFallbackDir);
+        if (!storedAnnotationsFile) {
             throw new Error("tool-annotations.json not found. Run 'ironcurtain annotate-tools' first.");
         }
-        const allAnnotations = Object.values(toolAnnotationsFile.servers).flatMap((server) => server.tools);
-        const serverDomainAllowlists = config.mcpServers ? extractServerDomainAllowlists(config.mcpServers) : undefined;
-        const includeHandwritten = config.includeHandwrittenScenarios ?? config.constitutionKind === 'constitution';
+        // Resolve conditional role specs to flat annotations for compiler prompts
+        const toolAnnotationsFile = resolveStoredAnnotationsFile(storedAnnotationsFile);
         const constitutionHash = computeHash(config.constitutionInput);
-        // Build the system prompt based on constitutionKind
-        const handwrittenScenarios = includeHandwritten ? getHandwrittenScenarios(config.allowedDirectory) : [];
-        const compilerPrompt = config.constitutionKind === 'task-policy'
-            ? buildTaskCompilerSystemPrompt(config.constitutionInput, allAnnotations, config.protectedPaths, config.allowedDirectory)
-            : buildCompilerSystemPrompt(config.constitutionInput, allAnnotations, { protectedPaths: config.protectedPaths }, handwrittenScenarios.length > 0 ? handwrittenScenarios : undefined);
-        const compilerHash = computePolicyHash(compilerPrompt, allAnnotations);
-        const compilerSystem = this.cacheStrategy.wrapSystemPrompt(compilerPrompt);
-        // Load existing artifacts for cache comparison
-        const existingPolicy = loadExistingArtifact(config.outputDir, 'compiled-policy.json');
-        const existingScenarios = loadExistingArtifact(config.outputDir, 'test-scenarios.json');
-        // Step 1: Compile constitution/task into policy rules
-        this.logContext.stepName = 'compile-constitution';
-        let { rules, listDefinitions, inputHash, session: compilerSession, } = await this.compilePolicyRules(allAnnotations, compilerHash, existingPolicy, compilerSystem);
-        let compiledPolicyFile = buildPolicyArtifact(constitutionHash, rules, listDefinitions, inputHash);
-        writeArtifact(config.outputDir, 'compiled-policy.json', compiledPolicyFile);
-        // Resolve dynamic lists if the compiler emitted list definitions
-        const hasLists = listDefinitions.length > 0;
-        const totalSteps = hasLists ? 4 : 3;
-        let dynamicLists;
-        if (hasLists) {
-            this.logContext.stepName = 'resolve-lists';
-            const existingLists = loadExistingArtifact(config.outputDir, 'dynamic-lists.json');
-            const needsMcp = listDefinitions.some((d) => d.requiresMcp);
-            let mcpConnections;
-            if (needsMcp && config.mcpServers) {
-                mcpConnections = await connectMcpServersForLists(listDefinitions, config.mcpServers);
+        // Phase 1: Per-server compilation
+        const serverResults = await this.compileAllServers(config, toolAnnotationsFile, constitutionHash, storedAnnotationsFile);
+        // Phase 2: Merge
+        const mergedPolicy = mergeServerResults(serverResults, constitutionHash);
+        writeArtifact(config.outputDir, 'compiled-policy.json', mergedPolicy);
+        // Merge scenarios for the global artifact
+        const allScenarios = serverResults.flatMap((r) => r.scenarios);
+        const mergedScenariosFile = {
+            generatedAt: new Date().toISOString(),
+            constitutionHash,
+            inputHash: mergedPolicy.inputHash,
+            scenarios: allScenarios,
+        };
+        writeArtifact(config.outputDir, 'test-scenarios.json', mergedScenariosFile);
+        // Phase 3: Merge per-server resolved lists into global dynamic-lists.json
+        // Each server resolved its own lists during compileServer(); merge them here.
+        const listDefinitions = mergedPolicy.listDefinitions ?? [];
+        if (listDefinitions.length > 0) {
+            const keptListNames = new Set(listDefinitions.map((d) => d.name));
+            const mergedListEntries = {};
+            // serverResults are already in alphabetical order -- use first-wins
+            // to match deduplicateListDefinitions() merge semantics.
+            for (const result of serverResults) {
+                if (result.resolvedLists) {
+                    for (const [name, list] of Object.entries(result.resolvedLists.lists)) {
+                        if (keptListNames.has(name) && !(name in mergedListEntries)) {
+                            mergedListEntries[name] = list;
+                        }
+                    }
+                }
             }
-            const listStepText = `[2/${totalSteps}] Resolving dynamic lists`;
+            const mergedDynamicLists = {
+                generatedAt: new Date().toISOString(),
+                lists: mergedListEntries,
+            };
+            writeArtifact(config.outputDir, 'dynamic-lists.json', mergedDynamicLists);
+        }
+        // Cross-server verification is intentionally omitted. Per-server rules compose
+        // correctly by construction: every rule has server: [serverName] (enforced by
+        // Zod schema), the engine checks cond.server.includes(request.serverName) so
+        // rules from server A never match server B's calls, rules are only allow/escalate
+        // with default-deny fallback, and structural invariants are evaluated before
+        // compiled rules. If each server's rules verify in isolation, the merged set
+        // behaves identically.
+        // Summary
+        const totalRules = mergedPolicy.rules.length;
+        const totalScenarios = allScenarios.length;
+        const serverCount = serverResults.length;
+        console.error('');
+        console.error(`  Servers compiled: ${serverCount}`);
+        console.error(`  Rules: ${totalRules}`);
+        console.error(`  Scenarios tested: ${totalScenarios}`);
+        console.error(`  Artifacts written to: ${chalk.dim(config.outputDir + '/')}`);
+        if (config.llmLogPath) {
+            console.error(`  LLM interaction log: ${chalk.dim(config.llmLogPath)}`);
+        }
+        console.error('');
+        console.error(chalk.green.bold('Policy compilation successful!'));
+        return mergedPolicy;
+    }
+    /**
+     * Compiles rules for all servers sequentially.
+     * Respects serverFilter if provided (for debugging single servers).
+     */
+    async compileAllServers(config, toolAnnotationsFile, constitutionHash, storedAnnotationsFile) {
+        const results = [];
+        const serverEntries = Object.entries(toolAnnotationsFile.servers);
+        // Apply server filter if provided
+        const { serverFilter } = config;
+        const filteredEntries = serverFilter
+            ? serverEntries.filter(([name]) => serverFilter.includes(name))
+            : serverEntries;
+        if (config.serverFilter && filteredEntries.length === 0) {
+            throw new Error(`No matching servers found for filter: ${config.serverFilter.join(', ')}. ` +
+                `Available: ${serverEntries.map(([n]) => n).join(', ')}`);
+        }
+        // Load handwritten scenarios once, then filter per server (avoids N redundant loads)
+        const includeHandwritten = config.includeHandwrittenScenarios ?? config.constitutionKind === 'constitution';
+        const allHandwrittenScenarios = includeHandwritten ? getHandwrittenScenarios(config.allowedDirectory) : [];
+        const totalServers = filteredEntries.length;
+        const failedServers = [];
+        for (let i = 0; i < filteredEntries.length; i++) {
+            const [serverName, serverData] = filteredEntries[i];
+            console.error('');
+            console.error(chalk.bold(`[${i + 1}/${totalServers}] Compiling server: ${serverName}`));
             try {
-                const { result: resolvedLists } = await withSpinner(listStepText, async (spinner) => resolveAllLists(listDefinitions, { model: this.model, mcpConnections }, existingLists, (msg) => {
-                    spinner.text = `${listStepText} — ${msg}`;
-                }), (result, elapsed) => {
-                    const count = Object.keys(result.lists).length;
-                    return `${listStepText}: ${count} list(s) resolved (${elapsed.toFixed(1)}s)`;
-                });
-                dynamicLists = resolvedLists;
-                writeArtifact(config.outputDir, 'dynamic-lists.json', dynamicLists);
+                const result = await this.compileServer({
+                    serverName,
+                    annotations: serverData.tools,
+                    storedAnnotations: storedAnnotationsFile.servers[serverName].tools,
+                    constitutionText: config.constitutionInput,
+                    constitutionKind: config.constitutionKind,
+                    allowedDirectory: config.allowedDirectory,
+                    protectedPaths: config.protectedPaths,
+                    mcpServerConfig: config.mcpServers?.[serverName],
+                    handwrittenScenarios: allHandwrittenScenarios.filter((s) => s.request.serverName === serverName),
+                }, config, constitutionHash);
+                results.push(result);
             }
-            finally {
-                if (mcpConnections) {
-                    await disconnectMcpServers(mcpConnections);
-                }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                console.error(`  ${chalk.red(`Server "${serverName}" failed:`)} ${msg}`);
+                failedServers.push(serverName);
             }
         }
-        // Extract permitted directories from compiled rules
-        const permittedDirectories = extractPermittedDirectories(rules);
-        // Step 2: Generate test scenarios
-        const scenarioStepLabel = `[${hasLists ? 3 : 2}/${totalSteps}]`;
-        this.logContext.stepName = 'generate-scenarios';
-        const scenarioPrompt = buildGeneratorSystemPrompt(config.constitutionInput, allAnnotations, config.allowedDirectory, permittedDirectories, dynamicLists);
-        const scenarioHash = computeScenariosHash(scenarioPrompt, handwrittenScenarios);
-        const scenarioSystem = this.cacheStrategy.wrapSystemPrompt(scenarioPrompt);
-        const scenarioResult = await this.generateTestScenarios(allAnnotations, config.allowedDirectory, handwrittenScenarios, scenarioHash, existingScenarios, scenarioStepLabel, scenarioSystem);
-        writeArtifact(config.outputDir, 'test-scenarios.json', {
+        if (failedServers.length > 0) {
+            console.error(`\n${chalk.yellow(`Warning: ${failedServers.length} server(s) failed verification: ${failedServers.join(', ')}`)}`);
+            console.error(chalk.yellow('Continuing with successfully compiled servers.'));
+        }
+        if (results.length === 0) {
+            throw new Error(`All ${failedServers.length} server(s) failed compilation: ${failedServers.join(', ')}. ` +
+                'No policy rules were produced.');
+        }
+        return results;
+    }
+    /**
+     * Compiles a single server: compile -> generate scenarios -> verify -> repair.
+     * Self-contained compile-verify-repair loop per server.
+     */
+    async compileServer(unit, config, constitutionHash) {
+        const serverOutputDir = resolve(config.outputDir, 'servers', unit.serverName);
+        // Build per-server system prompt (only this server's annotations)
+        const compilerPrompt = unit.constitutionKind === 'task-policy'
+            ? buildTaskCompilerSystemPrompt(unit.constitutionText, unit.annotations, unit.protectedPaths, unit.allowedDirectory, unit.serverName)
+            : buildCompilerSystemPrompt(unit.constitutionText, unit.annotations, { protectedPaths: unit.protectedPaths, allowedDirectory: unit.allowedDirectory }, unit.handwrittenScenarios.length > 0 ? unit.handwrittenScenarios : undefined, { serverScope: unit.serverName });
+        // Check per-server cache
+        const inputHash = computeServerPolicyHash(unit.serverName, unit.constitutionText, unit.annotations, compilerPrompt);
+        const existingServerPolicy = loadExistingArtifact(serverOutputDir, 'compiled-policy.json');
+        const existingServerScenarios = loadExistingArtifact(serverOutputDir, 'test-scenarios.json');
+        if (existingServerPolicy && existingServerPolicy.inputHash === inputHash && existingServerScenarios) {
+            // Verify scenario hash to detect stale scenarios (e.g., changed templates or handwritten scenarios)
+            const cachedPermittedDirs = extractPermittedDirectories(resolveRulePaths(existingServerPolicy.rules));
+            const cachedDynamicLists = loadExistingArtifact(serverOutputDir, 'dynamic-lists.json');
+            const cachedScenarioPrompt = buildGeneratorSystemPrompt(unit.constitutionText, unit.annotations, unit.allowedDirectory, cachedPermittedDirs, cachedDynamicLists, unit.storedAnnotations);
+            const cachedScenarioHash = computeScenariosHash(cachedScenarioPrompt, unit.handwrittenScenarios);
+            if (existingServerScenarios.inputHash === cachedScenarioHash) {
+                showCached(`  ${unit.serverName}: compilation`);
+                return {
+                    serverName: unit.serverName,
+                    rules: resolveRulePaths(existingServerPolicy.rules),
+                    listDefinitions: existingServerPolicy.listDefinitions ?? [],
+                    scenarios: existingServerScenarios.scenarios,
+                    inputHash,
+                    constitutionHash,
+                    resolvedLists: cachedDynamicLists,
+                };
+            }
+        }
+        const compilerSystem = this.cacheStrategy.wrapSystemPrompt(compilerPrompt);
+        // Step 1: Compile rules for this server
+        this.logContext.stepName = `compile-${unit.serverName}`;
+        const compileResult = await this.compileServerPolicyRules(unit, compilerSystem, inputHash);
+        let { rules } = compileResult;
+        let { listDefinitions } = compileResult;
+        let compilerSession = compileResult.session;
+        // Validate server scoping (debug assertion)
+        validateServerScoping(unit.serverName, rules);
+        // Resolve dynamic lists for this server (before scenario generation so lists are available)
+        let dynamicLists;
+        if (listDefinitions.length > 0) {
+            dynamicLists = await this.resolveServerLists(listDefinitions, serverOutputDir, config, `  ${unit.serverName}`);
+        }
+        // Build per-server policy artifact for engine construction
+        let serverPolicyFile = buildPolicyArtifact(constitutionHash, rules, listDefinitions, inputHash);
+        // Persist early so intermediate results survive scenario/verification failures
+        const writeServerPolicy = () => writeArtifact(serverOutputDir, 'compiled-policy.json', {
             generatedAt: new Date().toISOString(),
+            serverName: unit.serverName,
             constitutionHash,
-            inputHash: scenarioResult.inputHash,
-            scenarios: scenarioResult.scenarios,
+            inputHash,
+            rules,
+            listDefinitions: listDefinitions.length > 0 ? listDefinitions : undefined,
         });
-        // Filter scenarios against structural invariants
-        const filterEngine = new PolicyEngine(compiledPolicyFile, toolAnnotationsFile, config.protectedPaths, config.allowedDirectory, undefined, dynamicLists);
-        const { valid: initialValid, discarded: discardedScenarios } = filterAndLogStructuralConflicts(filterEngine, scenarioResult.scenarios);
-        let filteredScenarios = initialValid;
-        // Step 3: Verify compiled policy against scenarios
-        const verifyStepLabel = `[${totalSteps}/${totalSteps}]`;
-        this.logContext.stepName = 'verify-policy';
-        const allAvailableTools = allAnnotations.map((a) => ({ serverName: a.serverName, toolName: a.toolName }));
-        const serverNamesList = [...new Set(allAnnotations.map((a) => a.serverName))];
-        const toolNamesList = [...new Set(allAnnotations.map((a) => a.toolName))];
-        let verifierSystem = this.cacheStrategy.wrapSystemPrompt(buildJudgeSystemPrompt(config.constitutionInput, compiledPolicyFile, config.protectedPaths, allAvailableTools, dynamicLists, config.allowedDirectory));
+        writeServerPolicy();
+        // Build per-server tool annotations file with conditional role specs preserved
+        const serverAnnotationsFile = {
+            generatedAt: new Date().toISOString(),
+            servers: { [unit.serverName]: { inputHash, tools: unit.storedAnnotations } },
+        };
+        // Extract domain allowlists for this server
+        const serverDomainAllowlists = unit.mcpServerConfig
+            ? extractServerDomainAllowlists({ [unit.serverName]: unit.mcpServerConfig })
+            : undefined;
+        // Step 2: Generate test scenarios for this server
+        this.logContext.stepName = `scenarios-${unit.serverName}`;
+        const permittedDirectories = extractPermittedDirectories(rules);
+        const scenarioPrompt = buildGeneratorSystemPrompt(unit.constitutionText, unit.annotations, unit.allowedDirectory, permittedDirectories, dynamicLists, unit.storedAnnotations);
+        const scenarioHash = computeScenariosHash(scenarioPrompt, unit.handwrittenScenarios);
+        const scenarioResult = await this.generateTestScenarios(unit.constitutionText, unit.annotations, unit.allowedDirectory, unit.handwrittenScenarios, scenarioHash, existingServerScenarios, `  ${unit.serverName}`, permittedDirectories, dynamicLists, unit.storedAnnotations);
+        // Step 3: Verify compiled rules against scenarios
+        this.logContext.stepName = `verify-${unit.serverName}`;
+        const filterEngine = new PolicyEngine(serverPolicyFile, serverAnnotationsFile, unit.protectedPaths, unit.allowedDirectory, undefined, dynamicLists);
+        const { valid: filteredScenarios, discarded: discardedScenarios } = filterAndLogStructuralConflicts(filterEngine, scenarioResult.scenarios, undefined, unit.storedAnnotations);
+        // Generate replacement scenarios for structurally discarded ones (pre-loop, one-time)
+        if (discardedScenarios.length > 0) {
+            const discardedForRepair = discardedScenarios.map((d) => ({
+                scenario: d.scenario,
+                feedback: `${d.rule} always returns ${d.actual}`,
+            }));
+            this.logContext.stepName = `repair-scenarios-${unit.serverName}`;
+            const replacementScenarios = await repairScenarios(discardedForRepair, unit.constitutionText, unit.annotations, unit.allowedDirectory, this.model, permittedDirectories, dynamicLists, (msg) => console.error(`  ${chalk.dim(msg)}`), unit.storedAnnotations);
+            if (replacementScenarios.length > 0) {
+                // Filter replacements through structural invariants too
+                const { valid: validReplacements } = filterAndLogStructuralConflicts(filterEngine, replacementScenarios, 'Discarded replacement (structural conflict)', unit.storedAnnotations);
+                scenarioResult.scenarios.push(...validReplacements);
+                filteredScenarios.push(...validReplacements);
+                console.error(`  ${chalk.dim(`Repaired ${discardedScenarios.length} discarded scenario(s) → ${validReplacements.length} replacement(s)`)}`);
+            }
+        }
+        const serverToolNames = [...new Set(unit.annotations.map((a) => a.toolName))];
+        const serverNames = [unit.serverName];
+        const serverTools = unit.annotations.map((a) => ({ serverName: a.serverName, toolName: a.toolName }));
+        let verifierSystem = this.cacheStrategy.wrapSystemPrompt(buildJudgeSystemPrompt(unit.constitutionText, serverPolicyFile, unit.protectedPaths, serverTools, dynamicLists, unit.allowedDirectory, unit.storedAnnotations));
         let verifierSession = new PolicyVerifierSession({
             system: verifierSystem,
             model: this.model,
-            serverNames: serverNamesList,
-            toolNames: toolNamesList,
+            serverNames,
+            toolNames: serverToolNames,
+            storedAnnotations: unit.storedAnnotations,
         });
-        const { result: verificationResultInitial } = await withSpinner(`${verifyStepLabel} Verifying policy`, async (spinner) => verifyPolicy(config.constitutionInput, compiledPolicyFile, toolAnnotationsFile, config.protectedPaths, filteredScenarios, this.model, 3, config.allowedDirectory, (msg) => {
-            spinner.text = `${verifyStepLabel} Verifying policy — ${msg}`;
-        }, serverDomainAllowlists, dynamicLists, verifierSystem, verifierSession), (r, elapsed) => r.pass
-            ? `${verifyStepLabel} Verified policy: ${r.rounds.length} round(s) (${elapsed.toFixed(1)}s)`
-            : `${verifyStepLabel} Verification completed with failures (${elapsed.toFixed(1)}s)`);
+        const verifyLabel = `  ${unit.serverName}: Verifying`;
+        const { result: verificationResultInitial } = await withSpinner(verifyLabel, async (spinner) => verifyPolicy(unit.constitutionText, serverPolicyFile, serverAnnotationsFile, unit.protectedPaths, filteredScenarios, this.model, 3, unit.allowedDirectory, (msg) => {
+            spinner.text = `${verifyLabel} — ${msg}`;
+        }, serverDomainAllowlists, dynamicLists, verifierSystem, verifierSession, unit.storedAnnotations), (r, elapsed) => r.pass
+            ? `${verifyLabel}: ${r.rounds.length} round(s) (${elapsed.toFixed(1)}s)`
+            : `${verifyLabel}: completed with failures (${elapsed.toFixed(1)}s)`);
         let verificationResult = verificationResultInitial;
         if (!verificationResult.pass) {
             this.logVerboseFailures(verificationResult);
         }
-        // Collect probe scenarios from verifier
-        const { valid: filteredInitialProbes } = filterAndLogStructuralConflicts(filterEngine, collectProbeScenarios(verificationResult), 'Discarded probe (structural conflict)');
+        // Collect probe scenarios
+        const { valid: filteredInitialProbes } = filterAndLogStructuralConflicts(filterEngine, collectProbeScenarios(verificationResult), 'Discarded probe (structural conflict)', unit.storedAnnotations);
         const accumulatedProbes = filteredInitialProbes;
         // Compile-verify-repair loop (up to 2 repair attempts)
         const MAX_REPAIRS = 2;
         let repairAttempts = 0;
-        let scenarioCorrectionsApplied = 0;
+        let currentFilteredScenarios;
         if (!verificationResult.pass) {
             const baseInputHash = inputHash;
             for (let attempt = 1; attempt <= MAX_REPAIRS; attempt++) {
@@ -303,26 +583,9 @@ export class PipelineRunner {
                     scenarioResult.scenarios = applyScenarioCorrections(scenarioResult.scenarios, corrections);
                     const correctedProbes = applyScenarioCorrections(accumulatedProbes, corrections);
                     accumulatedProbes.splice(0, accumulatedProbes.length, ...correctedProbes);
-                    scenarioCorrectionsApplied += corrections.length;
                     console.error(`  ${chalk.dim(`Corrected ${corrections.length} scenario expectation(s)`)}`);
                 }
-                // Feed corrections back to the scenario generator session
-                const { session: scenarioSession } = scenarioResult;
-                if (scenarioSession &&
-                    (corrections.length > 0 || discardedScenarios.length > 0 || accumulatedProbes.length > 0)) {
-                    const feedback = {
-                        corrections,
-                        discardedScenarios,
-                        probeScenarios: accumulatedProbes,
-                    };
-                    this.logContext.stepName = `repair-regenerate-${attempt}`;
-                    const regenText = `Repair ${attempt}/${MAX_REPAIRS}: Regenerating scenarios`;
-                    const { result: replacements } = await withSpinner(regenText, async (spinner) => scenarioSession.regenerate(feedback, (msg) => {
-                        spinner.text = `${regenText} — ${msg}`;
-                    }), (r, elapsed) => `${regenText}: ${r.length} replacement(s) (${elapsed.toFixed(1)}s)`);
-                    scenarioResult.scenarios = mergeReplacements(scenarioResult.scenarios, replacements, corrections, discardedScenarios);
-                }
-                ({ valid: filteredScenarios } = filterAndLogStructuralConflicts(filterEngine, scenarioResult.scenarios));
+                ({ valid: currentFilteredScenarios } = filterAndLogStructuralConflicts(filterEngine, scenarioResult.scenarios, undefined, unit.storedAnnotations));
                 const allRuleBlamedFailures = verificationResult.failedScenarios.filter((f) => {
                     const attr = attributedFailures.find((a) => a.scenarioDescription === f.scenario.description);
                     if (!attr || attr.blame.kind === 'rule' || attr.blame.kind === 'both')
@@ -335,149 +598,92 @@ export class PipelineRunner {
                         judgeAnalysis,
                         attemptNumber: attempt,
                         existingListDefinitions: listDefinitions.length > 0 ? listDefinitions : undefined,
-                        handwrittenScenarios: includeHandwritten ? handwrittenScenarios : undefined,
+                        handwrittenScenarios: unit.handwrittenScenarios.length > 0 ? unit.handwrittenScenarios : undefined,
                     };
-                    this.logContext.stepName = `repair-compile-${attempt}`;
-                    const repairCompileText = `Repair ${attempt}/${MAX_REPAIRS}: Recompiling`;
-                    const { result: repairResult } = await withSpinner(repairCompileText, async (spinner) => this.compilePolicyRulesWithRepair(allAnnotations, config.protectedPaths, baseInputHash, repairContext, compilerSystem, compilerSession, (msg) => {
-                        spinner.text = `${repairCompileText} — ${msg}`;
-                    }), (r, elapsed) => `Repair ${attempt}/${MAX_REPAIRS}: Recompiled ${r.rules.length} rules (${elapsed.toFixed(1)}s)`);
+                    this.logContext.stepName = `repair-compile-${unit.serverName}-${attempt}`;
+                    const repairText = `  ${unit.serverName} repair ${attempt}/${MAX_REPAIRS}: Recompiling`;
+                    const { result: repairResult } = await withSpinner(repairText, async (spinner) => this.compilePolicyRulesWithPointFix(rules, unit.annotations, unit.protectedPaths, baseInputHash, repairContext, compilerSystem, compilerSession, listDefinitions, (msg) => {
+                        spinner.text = `${repairText} — ${msg}`;
+                    }), (r, elapsed) => `${repairText}: ${r.rules.length} rules (${elapsed.toFixed(1)}s)`);
                     rules = repairResult.rules;
                     listDefinitions = repairResult.listDefinitions;
-                    inputHash = repairResult.inputHash;
                     compilerSession = repairResult.session;
-                    // Re-resolve dynamic lists if repair introduced new ones
-                    if (dynamicLists && listDefinitions.length > 0) {
-                        const currentLists = dynamicLists;
-                        const newListDefs = listDefinitions.filter((def) => !(def.name in currentLists.lists));
-                        if (newListDefs.length > 0) {
-                            const mcpRequired = newListDefs.filter((d) => d.requiresMcp);
-                            if (mcpRequired.length > 0) {
-                                console.error(`  ${chalk.yellow('Warning:')} Repair introduced ${mcpRequired.length} new MCP-requiring list(s) — skipping resolution`);
-                            }
-                            const knowledgeDefs = newListDefs.filter((d) => !d.requiresMcp);
-                            if (knowledgeDefs.length > 0) {
-                                console.error(`  ${chalk.dim(`Resolving ${knowledgeDefs.length} new list(s) from repair...`)}`);
-                                const resolved = await resolveAllLists(knowledgeDefs, { model: this.model }, currentLists);
-                                dynamicLists = {
-                                    ...resolved,
-                                    lists: { ...currentLists.lists, ...resolved.lists },
-                                };
-                                writeArtifact(config.outputDir, 'dynamic-lists.json', dynamicLists);
-                            }
-                        }
+                    // Re-validate server scoping after repair
+                    validateServerScoping(unit.serverName, rules);
+                    // Re-resolve dynamic lists if repair changed list definitions
+                    if (listDefinitions.length > 0) {
+                        dynamicLists = await this.resolveServerLists(listDefinitions, serverOutputDir, config, `  ${unit.serverName}`);
                     }
-                    compiledPolicyFile = buildPolicyArtifact(constitutionHash, rules, listDefinitions, inputHash);
-                    writeArtifact(config.outputDir, 'compiled-policy.json', compiledPolicyFile);
-                    verifierSystem = this.cacheStrategy.wrapSystemPrompt(buildJudgeSystemPrompt(config.constitutionInput, compiledPolicyFile, config.protectedPaths, allAvailableTools, dynamicLists, config.allowedDirectory));
+                    serverPolicyFile = buildPolicyArtifact(constitutionHash, rules, listDefinitions, inputHash);
+                    // Persist repaired rules immediately
+                    writeServerPolicy();
+                    verifierSystem = this.cacheStrategy.wrapSystemPrompt(buildJudgeSystemPrompt(unit.constitutionText, serverPolicyFile, unit.protectedPaths, serverTools, dynamicLists, unit.allowedDirectory, unit.storedAnnotations));
                     verifierSession = new PolicyVerifierSession({
                         system: verifierSystem,
                         model: this.model,
-                        serverNames: serverNamesList,
-                        toolNames: toolNamesList,
+                        serverNames,
+                        toolNames: serverToolNames,
+                        storedAnnotations: unit.storedAnnotations,
                     });
                 }
                 else {
                     console.error(`  ${chalk.dim('No rule-blamed failures — skipping recompilation')}`);
                 }
-                this.logContext.stepName = `repair-verify-${attempt}`;
-                const repairScenarios = [...filteredScenarios, ...accumulatedProbes];
-                const repairVerifyText = `Repair ${attempt}/${MAX_REPAIRS}: Verifying`;
-                const { result: repairVerifyResult } = await withSpinner(repairVerifyText, async (spinner) => verifyPolicy(config.constitutionInput, compiledPolicyFile, toolAnnotationsFile, config.protectedPaths, repairScenarios, this.model, 1, config.allowedDirectory, (msg) => {
+                this.logContext.stepName = `repair-verify-${unit.serverName}-${attempt}`;
+                const scenariosForRepairVerify = [...currentFilteredScenarios, ...accumulatedProbes];
+                const repairVerifyText = `  ${unit.serverName} repair ${attempt}/${MAX_REPAIRS}: Verifying`;
+                const { result: repairVerifyResult } = await withSpinner(repairVerifyText, async (spinner) => verifyPolicy(unit.constitutionText, serverPolicyFile, serverAnnotationsFile, unit.protectedPaths, scenariosForRepairVerify, this.model, 1, unit.allowedDirectory, (msg) => {
                     spinner.text = `${repairVerifyText} — ${msg}`;
-                }, serverDomainAllowlists, dynamicLists, verifierSystem, verifierSession), (r, elapsed) => r.pass
-                    ? `Repair ${attempt}/${MAX_REPAIRS}: Verified (${elapsed.toFixed(1)}s)`
-                    : `Repair ${attempt}/${MAX_REPAIRS}: ${r.failedScenarios.length} failure(s) (${elapsed.toFixed(1)}s)`);
+                }, serverDomainAllowlists, dynamicLists, verifierSystem, verifierSession, unit.storedAnnotations), (r, elapsed) => r.pass
+                    ? `${repairVerifyText}: passed (${elapsed.toFixed(1)}s)`
+                    : `${repairVerifyText}: ${r.failedScenarios.length} failure(s) (${elapsed.toFixed(1)}s)`);
                 verificationResult = repairVerifyResult;
                 if (!verificationResult.pass) {
                     this.logVerboseFailures(verificationResult);
                 }
-                const { valid: validRepairProbes } = filterAndLogStructuralConflicts(filterEngine, collectProbeScenarios(verificationResult), 'Discarded probe (structural conflict)');
+                const { valid: validRepairProbes } = filterAndLogStructuralConflicts(filterEngine, collectProbeScenarios(verificationResult), 'Discarded probe (structural conflict)', unit.storedAnnotations);
                 accumulatedProbes.push(...validRepairProbes);
                 repairAttempts = attempt;
                 if (verificationResult.pass) {
-                    // Final full verification
-                    this.logContext.stepName = 'final-verify';
-                    const finalScenarios = [...filteredScenarios, ...accumulatedProbes];
-                    const finalSession = new PolicyVerifierSession({
-                        system: verifierSystem,
-                        model: this.model,
-                        serverNames: serverNamesList,
-                        toolNames: toolNamesList,
-                    });
-                    const { result: finalVerifyResult } = await withSpinner('Final full verification', async (spinner) => verifyPolicy(config.constitutionInput, compiledPolicyFile, toolAnnotationsFile, config.protectedPaths, finalScenarios, this.model, 3, config.allowedDirectory, (msg) => {
-                        spinner.text = `Final full verification — ${msg}`;
-                    }, serverDomainAllowlists, dynamicLists, verifierSystem, finalSession), (r, elapsed) => r.pass
-                        ? `Final full verification: passed (${elapsed.toFixed(1)}s)`
-                        : `Final full verification: ${r.failedScenarios.length} failure(s) (${elapsed.toFixed(1)}s)`);
-                    verificationResult = finalVerifyResult;
-                    const { valid: validFinalProbes } = filterAndLogStructuralConflicts(filterEngine, collectProbeScenarios(verificationResult), 'Discarded probe (structural conflict)');
-                    accumulatedProbes.push(...validFinalProbes);
                     break;
                 }
             }
         }
-        // Re-write scenarios if the repair loop modified them
-        if (repairAttempts > 0) {
-            writeArtifact(config.outputDir, 'test-scenarios.json', {
-                generatedAt: new Date().toISOString(),
-                constitutionHash,
-                inputHash: scenarioResult.inputHash,
-                scenarios: scenarioResult.scenarios,
-            });
-        }
-        // Summary
-        const seenDescriptions = new Set(scenarioResult.scenarios.map((s) => s.description));
-        const uniqueProbes = accumulatedProbes.filter((s) => {
-            if (seenDescriptions.has(s.description))
-                return false;
-            seenDescriptions.add(s.description);
-            return true;
+        // Write per-server artifacts (before verification check so they can be inspected on failure)
+        const finalScenarios = [...scenarioResult.scenarios, ...accumulatedProbes];
+        writeServerPolicy();
+        writeArtifact(serverOutputDir, 'test-scenarios.json', {
+            generatedAt: new Date().toISOString(),
+            constitutionHash,
+            inputHash: scenarioResult.inputHash,
+            scenarios: finalScenarios,
         });
-        const totalScenariosTested = filteredScenarios.length + uniqueProbes.length;
-        console.error('');
-        console.error(`  Rules: ${rules.length}`);
-        console.error(`  Scenarios tested: ${totalScenariosTested}`);
-        if (discardedScenarios.length > 0) {
-            console.error(`  Scenarios discarded (structural conflicts): ${discardedScenarios.length}`);
-        }
-        if (uniqueProbes.length > 0) {
-            console.error(`  Probe scenarios accumulated: ${uniqueProbes.length}`);
-        }
-        if (repairAttempts > 0) {
-            console.error(`  Repair attempts: ${repairAttempts}`);
-        }
-        if (scenarioCorrectionsApplied > 0) {
-            console.error(`  Scenario corrections: ${scenarioCorrectionsApplied}`);
-        }
-        console.error(`  Artifacts written to: ${chalk.dim(config.outputDir + '/')}`);
-        if (config.llmLogPath) {
-            console.error(`  LLM interaction log: ${chalk.dim(config.llmLogPath)}`);
-        }
         if (!verificationResult.pass) {
-            throw new Error('Verification FAILED — artifacts written but policy may need review.');
+            throw new Error(`Verification FAILED for server "${unit.serverName}" — artifacts written for inspection but policy may need review.`);
         }
-        console.error('');
-        console.error(chalk.green.bold('Policy compilation successful!'));
-        return compiledPolicyFile;
+        console.error(`  ${chalk.green(unit.serverName)}: ${rules.length} rules, ${finalScenarios.length} scenarios` +
+            (repairAttempts > 0 ? `, ${repairAttempts} repair(s)` : ''));
+        return {
+            serverName: unit.serverName,
+            rules,
+            listDefinitions,
+            scenarios: finalScenarios,
+            inputHash,
+            constitutionHash,
+            resolvedLists: dynamicLists,
+        };
     }
-    // -----------------------------------------------------------------------
-    // Private compilation methods
-    // -----------------------------------------------------------------------
-    async compilePolicyRules(annotations, inputHash, existingPolicy, system) {
-        const stepText = '[1/3] Compiling constitution';
-        if (existingPolicy && existingPolicy.inputHash === inputHash) {
-            showCached(stepText);
-            return {
-                rules: resolveRulePaths(existingPolicy.rules),
-                listDefinitions: existingPolicy.listDefinitions ?? [],
-                inputHash,
-            };
-        }
+    /**
+     * Compiles policy rules for a single server (initial compilation).
+     * Uses per-server schema with requireServer: true.
+     */
+    async compileServerPolicyRules(unit, system, inputHash) {
+        const stepText = `  ${unit.serverName}: Compiling rules`;
         const session = new ConstitutionCompilerSession({
             system,
             model: this.model,
-            annotations,
+            annotations: unit.annotations,
+            schemaOptions: { requireServer: true },
         });
         const { result: compilationOutput } = await withSpinner(stepText, async (spinner) => {
             const output = await session.compile((msg) => {
@@ -486,7 +692,7 @@ export class PipelineRunner {
             const compiledRules = resolveRulePaths(output.rules);
             validateRulesOrThrow(compiledRules, output.listDefinitions);
             return { rules: compiledRules, listDefinitions: output.listDefinitions };
-        }, (output, elapsed) => `${stepText}: ${output.rules.length} rules compiled (${elapsed.toFixed(1)}s)`);
+        }, (output, elapsed) => `${stepText}: ${output.rules.length} rules (${elapsed.toFixed(1)}s)`);
         return {
             rules: compilationOutput.rules,
             listDefinitions: compilationOutput.listDefinitions,
@@ -494,6 +700,9 @@ export class PipelineRunner {
             session,
         };
     }
+    // -----------------------------------------------------------------------
+    // Private compilation methods
+    // -----------------------------------------------------------------------
     async compilePolicyRulesWithRepair(annotations, protectedPaths, baseInputHash, repairContext, system, session, onProgress) {
         let output;
         if (session) {
@@ -513,25 +722,76 @@ export class PipelineRunner {
             session,
         };
     }
-    async generateTestScenarios(annotations, allowedDirectory, handwrittenScenarios, inputHash, existingScenarios, stepLabel, system) {
+    /**
+     * Attempts point-fix repair via the session, falling back to full recompile.
+     * When a compiler session exists, uses repairPointFix() to emit a minimal
+     * patch instead of regenerating the entire rule set. This avoids oscillation
+     * where fixing one failure breaks previously-passing rules.
+     */
+    async compilePolicyRulesWithPointFix(existingRules, annotations, protectedPaths, baseInputHash, repairContext, system, session, existingListDefinitions, onProgress) {
+        let output;
+        if (session) {
+            output = await session.repairPointFix(existingRules, repairContext, existingListDefinitions, onProgress);
+        }
+        else {
+            // No session available -- fall back to full recompile
+            return this.compilePolicyRulesWithRepair(annotations, protectedPaths, baseInputHash, repairContext, system, session, onProgress);
+        }
+        const compiledRules = resolveRulePaths(output.rules);
+        validateRulesOrThrow(compiledRules, output.listDefinitions);
+        return {
+            rules: compiledRules,
+            listDefinitions: output.listDefinitions,
+            inputHash: `${baseInputHash}-repair`,
+            session,
+        };
+    }
+    /**
+     * Resolves dynamic lists for a single server's list definitions.
+     * Loads existing per-server dynamic-lists.json for cache comparison,
+     * connects MCP servers if needed, and writes results to serverOutputDir.
+     */
+    async resolveServerLists(listDefinitions, serverOutputDir, config, labelPrefix) {
+        this.logContext.stepName = `resolve-lists-${labelPrefix.trim()}`;
+        const existingLists = loadExistingArtifact(serverOutputDir, 'dynamic-lists.json');
+        const needsMcp = listDefinitions.some((d) => d.requiresMcp);
+        let proxy;
+        if (needsMcp && config.mcpServers) {
+            proxy = await connectViaProxy(listDefinitions, config.mcpServers, config.toolAnnotationsDir);
+        }
+        const listStepText = `${labelPrefix}: Resolving dynamic lists`;
+        try {
+            const { result: resolvedLists } = await withSpinner(listStepText, async (spinner) => resolveAllLists(listDefinitions, {
+                model: this.model,
+                proxyConnection: proxy ? { client: proxy.client, tools: proxy.tools } : undefined,
+            }, existingLists, (msg) => {
+                spinner.text = `${listStepText} — ${msg}`;
+            }), (result, elapsed) => {
+                const count = Object.keys(result.lists).length;
+                return `${listStepText}: ${count} list(s) resolved (${elapsed.toFixed(1)}s)`;
+            });
+            writeArtifact(serverOutputDir, 'dynamic-lists.json', resolvedLists);
+            return resolvedLists;
+        }
+        finally {
+            if (proxy) {
+                await proxy.shutdown();
+            }
+        }
+    }
+    async generateTestScenarios(constitutionText, annotations, allowedDirectory, handwrittenScenarios, inputHash, existingScenarios, stepLabel, permittedDirectories, dynamicLists, storedAnnotations) {
         const stepText = `${stepLabel} Generating test scenarios`;
         if (existingScenarios && existingScenarios.inputHash === inputHash) {
             showCached(stepText);
             return { scenarios: existingScenarios.scenarios, inputHash };
         }
-        const session = new ScenarioGeneratorSession({
-            system,
-            model: this.model,
-            annotations,
-            handwrittenScenarios,
-        });
-        const { result: scenarios } = await withSpinner(stepText, async (spinner) => session.generate((msg) => {
+        const { result: scenarios } = await withSpinner(stepText, async (spinner) => generateScenarios(constitutionText, annotations, handwrittenScenarios, allowedDirectory, this.model, permittedDirectories, (msg) => {
             spinner.text = `${stepText} — ${msg}`;
-        }), (scenarios, elapsed) => {
+        }, dynamicLists, (prompt) => this.cacheStrategy.wrapSystemPrompt(prompt), storedAnnotations), (scenarios, elapsed) => {
             const generatedCount = scenarios.length - handwrittenScenarios.length;
             return `${stepText}: ${scenarios.length} scenarios (${handwrittenScenarios.length} handwritten + ${generatedCount} generated) (${elapsed.toFixed(1)}s)`;
         });
-        return { scenarios, inputHash, session };
+        return { scenarios, inputHash };
     }
     logVerboseFailures(result) {
         console.error('');