@qa-ai-stlc/mcp-server 0.1.2 → 0.2.0

package/README.md

@@ -7,9 +7,13 @@ that into a structured `CallToolResult` carrying a stable `code` and, when there
 `remediation`, never a raw stack trace. The server calls no model itself; it is driven by the
 agent host's own model over the MCP protocol.
 
-`qa-mcp-server` starts the stdio server with the built-in tools (currently `qa.ping`, a health
-check that does not touch `.qa/`). The engine-operation tools (doctor, explore, scope, cases,
-approve, validate, report) are a separate, later task.
+`qa-mcp-server` starts the stdio server with the built-in tools: `qa.ping` (a health check that
+does not touch `.qa/`) and one tool per engine operation — `qa.doctor`, `qa.explore`, `qa.scope`,
+`qa.cases_add`, `qa.approve`, `qa.validate` — each calling the exact same `packages/core` or
+`packages/explorer` function its CLI counterpart calls (P2-05). `qa.explore` does not support
+manual pick-mode capture: opening a headed browser for a human to click through is a CLI-only
+feature, not something an agent can drive over stdio. `report` has no CLI command yet, so it has
+no MCP tool yet either.
 
 Part of [QA-AI-STLC](https://github.com/Klim-101/QA-AI-STLC). See the repository root for
 license, contributing and security information.

package/dist/engine-context.d.ts

@@ -0,0 +1,8 @@
+import { type EngineContext } from '@qa-ai-stlc/core';
+/**
+ * Builds an `EngineContext` from the real Node adapters, freshly on every call rather than once
+ * at import time (AGENTS.md 5.3: no side effects on import), so it always reflects the process's
+ * current working directory and environment.
+ */
+export declare function createNodeEngineContext(): EngineContext;
+//# sourceMappingURL=engine-context.d.ts.map

package/dist/engine-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-context.d.ts","sourceRoot":"","sources":["../src/engine-context.ts"],"names":[],"mappings":"AAGA,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAE1B;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,aAAa,CAWvD"}

package/dist/engine-context.js

@@ -0,0 +1,21 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { fetchHttpClient, nodeFileSystem, nodeProcessRunner, noopLogger, playwrightBrowserLauncher, systemClock, } from '@qa-ai-stlc/core';
+/**
+ * Builds an `EngineContext` from the real Node adapters, freshly on every call rather than once
+ * at import time (AGENTS.md 5.3: no side effects on import), so it always reflects the process's
+ * current working directory and environment.
+ */
+export function createNodeEngineContext() {
+    return {
+        projectRoot: process.cwd(),
+        fs: nodeFileSystem,
+        clock: systemClock,
+        logger: noopLogger,
+        processRunner: nodeProcessRunner,
+        httpClient: fetchHttpClient,
+        browserLauncher: playwrightBrowserLauncher,
+        env: process.env,
+    };
+}
+//# sourceMappingURL=engine-context.js.map

package/dist/engine-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-context.js","sourceRoot":"","sources":["../src/engine-context.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EACL,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,UAAU,EACV,yBAAyB,EACzB,WAAW,GAEZ,MAAM,kBAAkB,CAAC;AAE1B;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE;QAC1B,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,UAAU;QAClB,aAAa,EAAE,iBAAiB;QAChC,UAAU,EAAE,eAAe;QAC3B,eAAe,EAAE,yBAAyB;QAC1C,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC;AACJ,CAAC"}

package/dist/tools/approve.d.ts

@@ -0,0 +1,42 @@
+import { z } from 'zod';
+import type { ToolDefinition } from '../tool.js';
+declare const InputSchema: z.ZodObject<{
+    gate: z.ZodEnum<{
+        scope: "scope";
+        cases: "cases";
+    }>;
+    artifactPath: z.ZodString;
+    approvedBy: z.ZodString;
+    note: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const OutputSchema: z.ZodObject<{
+    gate: z.ZodEnum<{
+        scope: "scope";
+        cases: "cases";
+    }>;
+    state: z.ZodObject<{
+        schemaVersion: z.ZodDefault<z.ZodLiteral<1>>;
+        currentPhase: z.ZodEnum<{
+            scope: "scope";
+            cases: "cases";
+        }>;
+        gates: z.ZodRecord<z.ZodEnum<{
+            scope: "scope";
+            cases: "cases";
+        }>, z.ZodObject<{
+            status: z.ZodEnum<{
+                open: "open";
+                satisfied: "satisfied";
+            }>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+/**
+ * `qa.approve` (P2-05, ADR-003): the same `runApprove` core call `qa approve` uses — hashes the
+ * artifact's current content and records the approval, advancing the pipeline when `gate` is the
+ * current phase. Throws GATE_OUT_OF_ORDER for a later phase approved before an earlier one is
+ * satisfied, and GATE_ARTIFACT_MISSING when the artifact does not exist.
+ */
+export declare const approveTool: ToolDefinition<typeof InputSchema, typeof OutputSchema>;
+export {};
+//# sourceMappingURL=approve.d.ts.map

package/dist/tools/approve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve.d.ts","sourceRoot":"","sources":["../../src/tools/approve.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,QAAA,MAAM,WAAW;;;;;;;;iBAKf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;iBAGhB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,cAAc,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,CAe/E,CAAC"}

package/dist/tools/approve.js

@@ -0,0 +1,37 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { runApprove } from '@qa-ai-stlc/core';
+import { PhaseNameSchema, PipelineStateSchema } from '@qa-ai-stlc/schemas';
+import { z } from 'zod';
+import { createNodeEngineContext } from '../engine-context.js';
+const InputSchema = z.object({
+    gate: PhaseNameSchema.describe('The pipeline phase to approve.'),
+    artifactPath: z.string().describe('Project-relative path to the artifact this approval covers.'),
+    approvedBy: z.string().describe('Who or what approved the gate (an operator name or agent identity).'),
+    note: z.string().optional(),
+});
+const OutputSchema = z.object({
+    gate: PhaseNameSchema,
+    state: PipelineStateSchema,
+});
+/**
+ * `qa.approve` (P2-05, ADR-003): the same `runApprove` core call `qa approve` uses — hashes the
+ * artifact's current content and records the approval, advancing the pipeline when `gate` is the
+ * current phase. Throws GATE_OUT_OF_ORDER for a later phase approved before an earlier one is
+ * satisfied, and GATE_ARTIFACT_MISSING when the artifact does not exist.
+ */
+export const approveTool = {
+    name: 'qa.approve',
+    description: 'Approves a pipeline gate (currently "scope" or "cases"), hash-binding the approval to the ' +
+        "artifact's exact current content (ADR-003). Editing the artifact afterwards reopens the " +
+        'gate automatically; re-approve it to satisfy the gate again.',
+    inputSchema: InputSchema,
+    outputSchema: OutputSchema,
+    handler: (input) => runApprove(createNodeEngineContext(), {
+        gate: input.gate,
+        artifactPath: input.artifactPath,
+        approvedBy: input.approvedBy,
+        ...(input.note !== undefined ? { note: input.note } : {}),
+    }),
+};
+//# sourceMappingURL=approve.js.map

package/dist/tools/approve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve.js","sourceRoot":"","sources":["../../src/tools/approve.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;IAChG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;IACtG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,mBAAmB;CAC3B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAA4D;IAClF,IAAI,EAAE,YAAY;IAClB,WAAW,EACT,4FAA4F;QAC5F,0FAA0F;QAC1F,8DAA8D;IAChE,WAAW,EAAE,WAAW;IACxB,YAAY,EAAE,YAAY;IAC1B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,UAAU,CAAC,uBAAuB,EAAE,EAAE;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;CACL,CAAC"}

package/dist/tools/cases-add.d.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+import type { ToolDefinition } from '../tool.js';
+declare const InputSchema: z.ZodObject<{
+    path: z.ZodString;
+}, z.core.$strip>;
+declare const OutputSchema: z.ZodObject<{
+    casePath: z.ZodString;
+    id: z.ZodString;
+    requirementIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * `qa.cases_add` (P2-05): the same `runCasesAdd` core call `qa cases add` uses — validates a test
+ * case a human or an agent wrote as JSON (the engine never authors test-case content itself,
+ * ADR-001), rejects it if any `requirementIds` entry does not resolve in `artifacts/scope.json`,
+ * and only then registers it under `artifacts/cases/<id>.json`.
+ */
+export declare const casesAddTool: ToolDefinition<typeof InputSchema, typeof OutputSchema>;
+export {};
+//# sourceMappingURL=cases-add.d.ts.map

package/dist/tools/cases-add.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cases-add.d.ts","sourceRoot":"","sources":["../../src/tools/cases-add.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,QAAA,MAAM,WAAW;;iBAEf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;iBAIhB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAAE,cAAc,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,CAYhF,CAAC"}

package/dist/tools/cases-add.js

@@ -0,0 +1,32 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { runCasesAdd } from '@qa-ai-stlc/core';
+import { z } from 'zod';
+import { createNodeEngineContext } from '../engine-context.js';
+const InputSchema = z.object({
+    path: z.string().describe('Project-relative path to a test case written as JSON (TestCaseSchema).'),
+});
+const OutputSchema = z.object({
+    casePath: z.string(),
+    id: z.string(),
+    requirementIds: z.array(z.string()),
+});
+/**
+ * `qa.cases_add` (P2-05): the same `runCasesAdd` core call `qa cases add` uses — validates a test
+ * case a human or an agent wrote as JSON (the engine never authors test-case content itself,
+ * ADR-001), rejects it if any `requirementIds` entry does not resolve in `artifacts/scope.json`,
+ * and only then registers it under `artifacts/cases/<id>.json`.
+ */
+export const casesAddTool = {
+    name: 'qa.cases_add',
+    description: 'Validates a test case written as JSON at the given path and registers it under ' +
+        'artifacts/cases/<id>.json. Fails with CASE_UNLINKED_REQUIREMENT if any requirementIds entry ' +
+        'does not exist in artifacts/scope.json — run qa.scope first to register it.',
+    inputSchema: InputSchema,
+    outputSchema: OutputSchema,
+    async handler(input) {
+        const result = await runCasesAdd(createNodeEngineContext(), { path: input.path });
+        return { casePath: result.casePath, id: result.id, requirementIds: [...result.requirementIds] };
+    },
+};
+//# sourceMappingURL=cases-add.js.map

package/dist/tools/cases-add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cases-add.js","sourceRoot":"","sources":["../../src/tools/cases-add.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;CACpG,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACpC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAA4D;IACnF,IAAI,EAAE,cAAc;IACpB,WAAW,EACT,iFAAiF;QACjF,8FAA8F;QAC9F,6EAA6E;IAC/E,WAAW,EAAE,WAAW;IACxB,YAAY,EAAE,YAAY;IAC1B,KAAK,CAAC,OAAO,CAAC,KAAK;QACjB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,uBAAuB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;IAClG,CAAC;CACF,CAAC"}

package/dist/tools/doctor.d.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+import type { ToolDefinition } from '../tool.js';
+declare const InputSchema: z.ZodObject<{
+    fix: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+declare const OutputSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    checks: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        status: z.ZodEnum<{
+            pass: "pass";
+            fail: "fail";
+        }>;
+        message: z.ZodString;
+        remediation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * `qa.doctor` (P2-05): the same `runDoctor` core call `qa doctor` uses — Node version, browser
+ * binaries, and, once `config.yaml` exists, every identity's secret and environment's
+ * reachability (ADR-004).
+ */
+export declare const doctorTool: ToolDefinition<typeof InputSchema, typeof OutputSchema>;
+export {};
+//# sourceMappingURL=doctor.d.ts.map

package/dist/tools/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/tools/doctor.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,QAAA,MAAM,WAAW;;iBAEf,CAAC;AASH,QAAA,MAAM,YAAY;;;;;;;;;;;iBAGhB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,cAAc,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,CAc9E,CAAC"}

package/dist/tools/doctor.js

@@ -0,0 +1,38 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { runDoctor } from '@qa-ai-stlc/core';
+import { z } from 'zod';
+import { createNodeEngineContext } from '../engine-context.js';
+const InputSchema = z.object({
+    fix: z.boolean().optional().describe('Install missing browsers through Playwright before reporting.'),
+});
+const DoctorCheckSchema = z.object({
+    name: z.string(),
+    status: z.enum(['pass', 'fail']),
+    message: z.string(),
+    remediation: z.string().optional(),
+});
+const OutputSchema = z.object({
+    ok: z.boolean(),
+    checks: z.array(DoctorCheckSchema),
+});
+/**
+ * `qa.doctor` (P2-05): the same `runDoctor` core call `qa doctor` uses — Node version, browser
+ * binaries, and, once `config.yaml` exists, every identity's secret and environment's
+ * reachability (ADR-004).
+ */
+export const doctorTool = {
+    name: 'qa.doctor',
+    description: 'Checks the local environment the engine needs: Node version, browser binaries, and, once ' +
+        'config.yaml exists, every configured identity secret and environment URL. Use before ' +
+        'qa.explore to confirm the project is set up correctly. Set fix to install missing browsers.',
+    inputSchema: InputSchema,
+    outputSchema: OutputSchema,
+    async handler(input) {
+        const report = await runDoctor(createNodeEngineContext(), {
+            ...(input.fix !== undefined ? { fix: input.fix } : {}),
+        });
+        return { ok: report.ok, checks: [...report.checks] };
+    },
+};
+//# sourceMappingURL=doctor.js.map

package/dist/tools/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/tools/doctor.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;CACtG,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;CACnC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAA4D;IACjF,IAAI,EAAE,WAAW;IACjB,WAAW,EACT,2FAA2F;QAC3F,uFAAuF;QACvF,6FAA6F;IAC/F,WAAW,EAAE,WAAW;IACxB,YAAY,EAAE,YAAY;IAC1B,KAAK,CAAC,OAAO,CAAC,KAAK;QACjB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,uBAAuB,EAAE,EAAE;YACxD,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACvD,CAAC;CACF,CAAC"}

package/dist/tools/explore.d.ts

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+import type { ToolDefinition } from '../tool.js';
+declare const InputSchema: z.ZodObject<{
+    environment: z.ZodOptional<z.ZodString>;
+    identity: z.ZodOptional<z.ZodString>;
+    cdpEndpointUrl: z.ZodOptional<z.ZodString>;
+    policy: z.ZodOptional<z.ZodEnum<{
+        "playwright-default": "playwright-default";
+        "testid-first": "testid-first";
+        "strict-no-css": "strict-no-css";
+    }>>;
+    static: z.ZodOptional<z.ZodBoolean>;
+    maxPages: z.ZodOptional<z.ZodNumber>;
+    verify: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+declare const OutputSchema: z.ZodObject<{
+    mode: z.ZodEnum<{
+        verify: "verify";
+        explore: "explore";
+    }>;
+    registryPath: z.ZodString;
+    elementCount: z.ZodNumber;
+    added: z.ZodNumber;
+    removed: z.ZodNumber;
+    degraded: z.ZodArray<z.ZodObject<{
+        elementId: z.ZodString;
+        previousScore: z.ZodNumber;
+        currentScore: z.ZodNumber;
+    }, z.core.$strip>>;
+    missingLocatorCount: z.ZodNumber;
+    blockedRequestCount: z.ZodNumber;
+}, z.core.$strip>;
+/**
+ * `qa.explore` (P2-05): the same `runExplore` core call `qa explore` uses for crawling, static
+ * source analysis and `--verify` (development plan section 6.3). Manual pick-mode capture stays a
+ * CLI-only feature (`qa explore --pick <url>`): it opens a headed browser for a human to click
+ * through, which an agent cannot drive over MCP's stdio transport (AGENTS.md 12.4).
+ */
+export declare const exploreTool: ToolDefinition<typeof InputSchema, typeof OutputSchema>;
+export {};
+//# sourceMappingURL=explore.d.ts.map

package/dist/tools/explore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"explore.d.ts","sourceRoot":"","sources":["../../src/tools/explore.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,QAAA,MAAM,WAAW;;;;;;;;;;;;iBAiBf,CAAC;AAQH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;iBAShB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,cAAc,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,CAqB/E,CAAC"}

package/dist/tools/explore.js

@@ -0,0 +1,67 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { runExplore } from '@qa-ai-stlc/explorer';
+import { SelectorPolicySchema } from '@qa-ai-stlc/schemas';
+import { z } from 'zod';
+import { createNodeEngineContext } from '../engine-context.js';
+const InputSchema = z.object({
+    environment: z
+        .string()
+        .optional()
+        .describe('Environment name from config.yaml. Required when there is more than one.'),
+    identity: z.string().optional().describe('Identity name from config.yaml to sign in with before crawling.'),
+    cdpEndpointUrl: z
+        .string()
+        .optional()
+        .describe('Required, and only used, when the identity uses cdp-attach.'),
+    policy: SelectorPolicySchema.optional().describe('Overrides config.yaml selectors.policy for this run.'),
+    static: z.boolean().optional().describe('Also scan config.yaml source.path for framework attributes.'),
+    maxPages: z.number().int().positive().optional().describe('Caps how many pages the crawl visits.'),
+    verify: z
+        .boolean()
+        .optional()
+        .describe('Re-checks the stored registry live instead of building a new one; does not crawl.'),
+});
+const DegradedSelectorSchema = z.object({
+    elementId: z.string(),
+    previousScore: z.number(),
+    currentScore: z.number(),
+});
+const OutputSchema = z.object({
+    mode: z.enum(['explore', 'verify']),
+    registryPath: z.string(),
+    elementCount: z.number(),
+    added: z.number(),
+    removed: z.number(),
+    degraded: z.array(DegradedSelectorSchema),
+    missingLocatorCount: z.number(),
+    blockedRequestCount: z.number(),
+});
+/**
+ * `qa.explore` (P2-05): the same `runExplore` core call `qa explore` uses for crawling, static
+ * source analysis and `--verify` (development plan section 6.3). Manual pick-mode capture stays a
+ * CLI-only feature (`qa explore --pick <url>`): it opens a headed browser for a human to click
+ * through, which an agent cannot drive over MCP's stdio transport (AGENTS.md 12.4).
+ */
+export const exploreTool = {
+    name: 'qa.explore',
+    description: 'Builds the selector registry by crawling the configured environment in safe mode, merging ' +
+        'in static source analysis when "static" is set. Set "verify" to instead re-check every ' +
+        'stored, non-deprecated selector against the live page and report which ones degraded. Does ' +
+        'not support manual pick-mode capture — that is a CLI-only, human-driven feature.',
+    inputSchema: InputSchema,
+    outputSchema: OutputSchema,
+    async handler(input) {
+        const report = await runExplore(createNodeEngineContext(), {
+            ...(input.environment !== undefined ? { environment: input.environment } : {}),
+            ...(input.identity !== undefined ? { identity: input.identity } : {}),
+            ...(input.cdpEndpointUrl !== undefined ? { cdpEndpointUrl: input.cdpEndpointUrl } : {}),
+            ...(input.policy !== undefined ? { policy: input.policy } : {}),
+            ...(input.static !== undefined ? { static: input.static } : {}),
+            ...(input.maxPages !== undefined ? { maxPages: input.maxPages } : {}),
+            ...(input.verify !== undefined ? { verify: input.verify } : {}),
+        });
+        return { ...report, degraded: [...report.degraded] };
+    },
+};
+//# sourceMappingURL=explore.js.map

package/dist/tools/explore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"explore.js","sourceRoot":"","sources":["../../src/tools/explore.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;IACvF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;IAC3G,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,MAAM,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IACxG,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;IACtG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAClG,MAAM,EAAE,CAAC;SACN,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,mFAAmF,CAAC;CACjG,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;CAChC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAA4D;IAClF,IAAI,EAAE,YAAY;IAClB,WAAW,EACT,4FAA4F;QAC5F,yFAAyF;QACzF,6FAA6F;QAC7F,kFAAkF;IACpF,WAAW,EAAE,WAAW;IACxB,YAAY,EAAE,YAAY;IAC1B,KAAK,CAAC,OAAO,CAAC,KAAK;QACjB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,uBAAuB,EAAE,EAAE;YACzD,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvD,CAAC;CACF,CAAC"}

package/dist/tools/index.d.ts

@@ -1,4 +1,4 @@
 import type { ToolDefinition } from '../tool.js';
-/** Every tool the server registers by default. P2-05 adds the real engine-operation tools here. */
+/** Every tool the server registers by default (P2-05: one MCP counterpart per engine operation). */
 export declare const BUILTIN_TOOLS: readonly ToolDefinition[];
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,mGAAmG;AACnG,eAAO,MAAM,aAAa,EAAE,SAAS,cAAc,EAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,oGAAoG;AACpG,eAAO,MAAM,aAAa,EAAE,SAAS,cAAc,EAQlD,CAAC"}

package/dist/tools/index.js

@@ -1,6 +1,20 @@
 // Copyright The QA-AI-STLC Authors
 // SPDX-License-Identifier: Apache-2.0
+import { approveTool } from './approve.js';
+import { casesAddTool } from './cases-add.js';
+import { doctorTool } from './doctor.js';
+import { exploreTool } from './explore.js';
 import { pingTool } from './ping.js';
-/** Every tool the server registers by default. P2-05 adds the real engine-operation tools here. */
-export const BUILTIN_TOOLS = [pingTool];
+import { scopeTool } from './scope.js';
+import { validateTool } from './validate.js';
+/** Every tool the server registers by default (P2-05: one MCP counterpart per engine operation). */
+export const BUILTIN_TOOLS = [
+    pingTool,
+    doctorTool,
+    exploreTool,
+    scopeTool,
+    casesAddTool,
+    approveTool,
+    validateTool,
+];
 //# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,mGAAmG;AACnG,MAAM,CAAC,MAAM,aAAa,GAA8B,CAAC,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,oGAAoG;AACpG,MAAM,CAAC,MAAM,aAAa,GAA8B;IACtD,QAAQ;IACR,UAAU;IACV,WAAW;IACX,SAAS;IACT,YAAY;IACZ,WAAW;IACX,YAAY;CACb,CAAC"}

package/dist/tools/ping.d.ts

@@ -6,9 +6,9 @@ declare const OutputSchema: z.ZodObject<{
     version: z.ZodString;
 }, z.core.$strip>;
 /**
- * A health check owned by the server itself, not an engine operation (those are P2-05's tools):
- * proves the process is up and the tool-call round trip works, without touching `.qa/` or the
- * engine at all.
+ * A health check owned by the server itself, not an engine operation (those are P2-05's other
+ * tools): proves the process is up and the tool-call round trip works, without touching `.qa/` or
+ * the engine at all.
  */
 export declare const pingTool: ToolDefinition<typeof InputSchema, typeof OutputSchema>;
 export {};

package/dist/tools/ping.js

@@ -8,9 +8,9 @@ const OutputSchema = z.object({
     version: z.string(),
 });
 /**
- * A health check owned by the server itself, not an engine operation (those are P2-05's tools):
- * proves the process is up and the tool-call round trip works, without touching `.qa/` or the
- * engine at all.
+ * A health check owned by the server itself, not an engine operation (those are P2-05's other
+ * tools): proves the process is up and the tool-call round trip works, without touching `.qa/` or
+ * the engine at all.
  */
 export const pingTool = {
     name: 'qa.ping',

package/dist/tools/scope.d.ts

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+import type { ToolDefinition } from '../tool.js';
+declare const InputSchema: z.ZodObject<{
+    from: z.ZodEnum<{
+        text: "text";
+        file: "file";
+    }>;
+    path: z.ZodOptional<z.ZodString>;
+    content: z.ZodOptional<z.ZodString>;
+    label: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const OutputSchema: z.ZodObject<{
+    scopePath: z.ZodString;
+    added: z.ZodNumber;
+    updated: z.ZodNumber;
+    total: z.ZodNumber;
+}, z.core.$strip>;
+/**
+ * `qa.scope` (P2-05): the same `runScope` core call `qa scope` uses — deterministically extracts
+ * `## Heading` requirements from a local Markdown source and upserts them into
+ * `artifacts/scope.json` by id (development plan section 2.4, 2.7 step 4). The framework never
+ * fetches requirements from a tracker (AGENTS.md 2.3).
+ */
+export declare const scopeTool: ToolDefinition<typeof InputSchema, typeof OutputSchema>;
+export {};
+//# sourceMappingURL=scope.d.ts.map

package/dist/tools/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/tools/scope.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,QAAA,MAAM,WAAW;;;;;;;;iBAQf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;iBAKhB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,cAAc,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,CAgB7E,CAAC"}

package/dist/tools/scope.js

@@ -0,0 +1,42 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { runScope } from '@qa-ai-stlc/core';
+import { z } from 'zod';
+import { createNodeEngineContext } from '../engine-context.js';
+const InputSchema = z.object({
+    from: z.enum(['file', 'text']).describe('Where to read requirements from.'),
+    path: z
+        .string()
+        .optional()
+        .describe('Project-relative path to a Markdown file. Required when from is "file".'),
+    content: z.string().optional().describe('Literal Markdown text. Required when from is "text".'),
+    label: z.string().optional().describe('A short label for the text source. Required when from is "text".'),
+});
+const OutputSchema = z.object({
+    scopePath: z.string(),
+    added: z.number(),
+    updated: z.number(),
+    total: z.number(),
+});
+/**
+ * `qa.scope` (P2-05): the same `runScope` core call `qa scope` uses — deterministically extracts
+ * `## Heading` requirements from a local Markdown source and upserts them into
+ * `artifacts/scope.json` by id (development plan section 2.4, 2.7 step 4). The framework never
+ * fetches requirements from a tracker (AGENTS.md 2.3).
+ */
+export const scopeTool = {
+    name: 'qa.scope',
+    description: 'Extracts requirements from a local Markdown file or literal text (one "## Heading" per ' +
+        'requirement) and upserts them by id into artifacts/scope.json. Call again with the same ' +
+        'headings to update requirements instead of duplicating them. Never fetches from an issue ' +
+        'tracker or wiki.',
+    inputSchema: InputSchema,
+    outputSchema: OutputSchema,
+    handler: (input) => runScope(createNodeEngineContext(), {
+        from: input.from,
+        ...(input.path !== undefined ? { path: input.path } : {}),
+        ...(input.content !== undefined ? { content: input.content } : {}),
+        ...(input.label !== undefined ? { label: input.label } : {}),
+    }),
+};
+//# sourceMappingURL=scope.js.map

package/dist/tools/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/tools/scope.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC3E,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,yEAAyE,CAAC;IACtF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IAC/F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;CAC1G,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAA4D;IAChF,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,yFAAyF;QACzF,0FAA0F;QAC1F,2FAA2F;QAC3F,kBAAkB;IACpB,WAAW,EAAE,WAAW;IACxB,YAAY,EAAE,YAAY;IAC1B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,QAAQ,CAAC,uBAAuB,EAAE,EAAE;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;CACL,CAAC"}

package/dist/tools/validate.d.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+import type { ToolDefinition } from '../tool.js';
+declare const InputSchema: z.ZodObject<{}, z.core.$strip>;
+declare const OutputSchema: z.ZodObject<{
+    state: z.ZodObject<{
+        schemaVersion: z.ZodDefault<z.ZodLiteral<1>>;
+        currentPhase: z.ZodEnum<{
+            scope: "scope";
+            cases: "cases";
+        }>;
+        gates: z.ZodRecord<z.ZodEnum<{
+            scope: "scope";
+            cases: "cases";
+        }>, z.ZodObject<{
+            status: z.ZodEnum<{
+                open: "open";
+                satisfied: "satisfied";
+            }>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    reopened: z.ZodArray<z.ZodEnum<{
+        scope: "scope";
+        cases: "cases";
+    }>>;
+    unlinkedCases: z.ZodArray<z.ZodObject<{
+        casePath: z.ZodString;
+        id: z.ZodString;
+        unlinkedRequirementIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * `qa.validate` (P2-05, ADR-003; P2-03 traceability): the same `runValidate` core call `qa
+ * validate` uses — recomputes every gate's status against the approval ledger and the current
+ * artifact content, and re-checks every registered test case's requirement links against the
+ * current scope artifact. A non-empty `reopened` or `unlinkedCases` means the pipeline needs
+ * attention, not a phase simply never approved yet.
+ */
+export declare const validateTool: ToolDefinition<typeof InputSchema, typeof OutputSchema>;
+export {};
+//# sourceMappingURL=validate.d.ts.map

package/dist/tools/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/tools/validate.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,QAAA,MAAM,WAAW,gCAAe,CAAC;AAQjC,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIhB,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,cAAc,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,CAoBhF,CAAC"}

package/dist/tools/validate.js

@@ -0,0 +1,45 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { runValidate } from '@qa-ai-stlc/core';
+import { PhaseNameSchema, PipelineStateSchema } from '@qa-ai-stlc/schemas';
+import { z } from 'zod';
+import { createNodeEngineContext } from '../engine-context.js';
+const InputSchema = z.object({});
+const UnlinkedCaseSchema = z.object({
+    casePath: z.string(),
+    id: z.string(),
+    unlinkedRequirementIds: z.array(z.string()),
+});
+const OutputSchema = z.object({
+    state: PipelineStateSchema,
+    reopened: z.array(PhaseNameSchema),
+    unlinkedCases: z.array(UnlinkedCaseSchema),
+});
+/**
+ * `qa.validate` (P2-05, ADR-003; P2-03 traceability): the same `runValidate` core call `qa
+ * validate` uses — recomputes every gate's status against the approval ledger and the current
+ * artifact content, and re-checks every registered test case's requirement links against the
+ * current scope artifact. A non-empty `reopened` or `unlinkedCases` means the pipeline needs
+ * attention, not a phase simply never approved yet.
+ */
+export const validateTool = {
+    name: 'qa.validate',
+    description: "Recomputes every pipeline gate's status and re-checks every registered test case's " +
+        'requirement links against the current scope artifact. Call after editing an approved ' +
+        'artifact or a test case to see whether a gate reopened or a link broke.',
+    inputSchema: InputSchema,
+    outputSchema: OutputSchema,
+    async handler() {
+        const report = await runValidate(createNodeEngineContext());
+        return {
+            state: report.state,
+            reopened: [...report.reopened],
+            unlinkedCases: report.unlinkedCases.map((unlinkedCase) => ({
+                casePath: unlinkedCase.casePath,
+                id: unlinkedCase.id,
+                unlinkedRequirementIds: [...unlinkedCase.unlinkedRequirementIds],
+            })),
+        };
+    },
+};
+//# sourceMappingURL=validate.js.map

package/dist/tools/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/tools/validate.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEjC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,mBAAmB;IAC1B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAClC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;CAC3C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAA4D;IACnF,IAAI,EAAE,aAAa;IACnB,WAAW,EACT,qFAAqF;QACrF,uFAAuF;QACvF,yEAAyE;IAC3E,WAAW,EAAE,WAAW;IACxB,YAAY,EAAE,YAAY;IAC1B,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC5D,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC9B,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;gBACzD,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,EAAE,EAAE,YAAY,CAAC,EAAE;gBACnB,sBAAsB,EAAE,CAAC,GAAG,YAAY,CAAC,sBAAsB,CAAC;aACjE,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qa-ai-stlc/mcp-server",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Local stdio MCP server over the core engine API: a tool registry with Zod input/output schemas and coded errors. Calls no model itself.",
   "type": "module",
   "license": "Apache-2.0",
@@ -21,18 +21,19 @@
     ".": "./dist/index.js"
   },
   "scripts": {
-    "pretypecheck": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/core --workspace @qa-ai-stlc/test-utils",
+    "pretypecheck": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/core --workspace @qa-ai-stlc/explorer --workspace @qa-ai-stlc/test-utils",
     "typecheck": "tsc --noEmit -p .",
-    "pretest": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/core --workspace @qa-ai-stlc/test-utils",
+    "pretest": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/core --workspace @qa-ai-stlc/explorer --workspace @qa-ai-stlc/test-utils",
     "test": "vitest run",
-    "pretest:coverage": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/core --workspace @qa-ai-stlc/test-utils",
+    "pretest:coverage": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/core --workspace @qa-ai-stlc/explorer --workspace @qa-ai-stlc/test-utils",
     "test:coverage": "vitest run --coverage",
     "build": "tsc -b tsconfig.build.json",
     "clean": "node ../../scripts/clean-dir.mjs dist"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",
-    "@qa-ai-stlc/core": "0.8.0",
+    "@qa-ai-stlc/core": "0.9.0",
+    "@qa-ai-stlc/explorer": "0.7.0",
     "@qa-ai-stlc/schemas": "0.8.0",
     "zod": "4.6.5"
   },