@shiftleftpt/sbd-toe-mcp 0.20.0-beta.23 → 0.20.0-beta.25

package/assets/agent-guide.md

@@ -21,8 +21,10 @@ adjacências do grafo, de forma reproduzível e auditável.
    É a lista **fechada** de valores que aceito e, para cada valor, **o que ele activa**
    (categorias, capítulos, contagens por nível). É ele que substitui a adivinhação de palavras.
 2. **Mapeia e declara** — `select_sbd_toe_requirements(risk_level, concerns=[…], …)`.
-   O `task` podes enviá-lo à mesma: fica **registado para auditoria** (`role:
+   O enunciado podes enviá-lo à mesma em **`task_context`** (nome canónico desde
+   0.20.0-beta.24; `task` continua aceite): fica **registado para auditoria** (`role:
    "recorded_context"`, `affects_selection: false`) e **não influencia o resultado**.
+   O campo mudou de nome porque o nome antigo convidava a acreditar que o texto decide.
 3. **Sem declarações** recebes `needs_input`: o vocabulário aplicável, **candidatos A
    CONFIRMAR** derivados do texto (sugestão, nunca selecção) e um exemplo copiável.
    Nunca devolvo zero em silêncio e nunca invento o teu âmbito.
@@ -46,8 +48,11 @@ SbD-ToE is a **security guidance framework only**. It guides *what security prac
 be applied* at each phase of the development lifecycle. It does **not** impose development
 standards, testing requirements, coding conventions, or any non-security practice.
 
-**Project rules always take precedence.** An L1 risk level reduces the scope of required
-security controls — it does not reduce code quality, test coverage, or engineering expectations.
+**Project rules always take precedence.** An L1 risk level reduces the **DEMAND** on the
+security controls — never the scope: graduated applicability (0.14.0) keeps every chapter
+present at every level, and `map_sbd_toe_applicability` states it outright («nothing is
+excluded by level»). And it does not reduce code quality, test coverage, or engineering
+expectations.
 
 ---
 
@@ -66,7 +71,9 @@ or — on clients without resource support — call `read_sbd_toe_resource(uri="
 It returns the server name/version plus the served knowledge identity from the verified pin:
 `manual {tag, commit}`, `kg {release_tag, sha256, source, consumer_contract_version}`,
 `ontology {tag, commit}`. Every tool response also carries the compact stamp
-`provenance.kg` (the served kg release_tag). The same tool mirrors ANY resource of the
+`provenance.kg` (the served kg release_tag) **and `provenance.server`** (the package version
+that produced the answer — since 0.20.0-beta.23: `kg` is the knowledge served, `server` is
+who served it). The same tool mirrors ANY resource of the
 list below — including the templated ones (e.g. `sbd://toe/codegen-instructions/codegen`,
 the target of `codegen_instructions_ref` in dieted payloads).
 
@@ -81,8 +88,9 @@ This returns the list of active chapters and risk-level specific rules for the p
 > **Verdade do canal:** `setup_sbd_toe_agent` é um **prompt MCP**, não uma tool — clientes
 > sem suporte de prompts (p.ex. Claude Desktop) não o expõem. Alternativa equivalente: já
 > leste este guia (via `read_sbd_toe_resource`); passa `risk_level` e os **activadores
-> estruturados** (`exposure`, `data_sensitivity`, `stack`, `changed_files`) directamente
-> ao `select_sbd_toe_requirements`.
+> DECLARADOS** (`concerns`, `exposure`, `data_sensitivity`, `technologies`, `changed_files`)
+> directamente ao `select_sbd_toe_requirements`. O `stack` é texto livre e só conta quando
+> traz um valor de `technologies` como token exacto — prefere `technologies`.
 
 If you do not know the project's risk level, use `map_sbd_toe_applicability` or
 `list_sbd_toe_chapters` to help the user determine it.
@@ -96,28 +104,40 @@ Use when the user asks *what the manual says*, what applies, how to classify a p
 what controls or artefacts are required, or whether something is aligned with the manual.
 
 ```
-search_sbd_toe_manual            ← conceptual questions, narrative context
+search_sbd_toe_manual            ← NÃO-NORMATIVO: ler e localizar passagens, NUNCA caminho
+                                    para um conjunto de requisitos (o que sai daqui não
+                                    selecciona nada e não se cita como selecção)
 map_sbd_toe_applicability        ← which chapters/controls apply to this project
 get_sbd_toe_chapter_brief        ← what a specific chapter covers (phases, artefacts, topics)
 list_sbd_toe_chapters            ← chapter discovery and navigation
 query_sbd_toe_entities           ← specific controls (CTRL-*), artefacts (ART-*), practices
 
 select_sbd_toe_requirements      ← MP1 selection: which requirements apply to THIS task in THIS
-                                    context — baseline (ch. 02, by level) ∪ context-activated
-                                    chapters ⊕ overlay(extend), narrowed by declared task signals;
-                                    params: risk_level (required), task?, changed_files?,
-                                    technologies?, exposure?, data_sensitivity?, concerns?
-                                    returns TWO bands, both always listed:
-                                      selected[]     — the recommendation for the task (each item
-                                                       carries its selection_trace: source/trigger/
-                                                       score, incl. named rules like
-                                                       R1:principal-nao-humano)
-                                      narrowed_out[] — what was ELIGIBLE and why it left (grouped
-                                                       by category, with reason). Nothing is dropped
-                                                       silently: if you need something from there,
-                                                       call again WITH the missing signal (e.g. the
-                                                       SES group returns when the task mentions the
-                                                       user session/login/token surface)
+                                    context — baseline (ch. 02, by level) ∪ chapters activated by
+                                    the DECLARED activators ∪ the categories the vocabulary
+                                    promises ⊕ overlay(extend), narrowed by those same
+                                    declarations. The task text is NEVER an activator here;
+                                    params: risk_level (required), concerns?, exposure?,
+                                    data_sensitivity?, technologies?, changed_files?,
+                                    task_context? (recorded, inert), mode? (declarative|baseline|
+                                    discover)
+                                    returns FOUR bands, all always listed:
+                                      selected[]           — the answer to what you declared (each
+                                                             item carries its selection_trace:
+                                                             layer/source/trigger/score, incl.
+                                                             named rules like R1:principal-nao-humano
+                                                             and declared_category)
+                                      narrowed_out[]       — what was ELIGIBLE and why it left
+                                                             (grouped by category, with reason)
+                                      excluded_by_level[]  — what exists at ANOTHER level (0.15.0)
+                                      out_of_scope_chapters — what NO declaration activated, per
+                                                             chapter, with a copyable activate_with
+                                                             (0.20.0-beta.24)
+                                    Nothing is dropped silently, and the SCOPE of that promise is
+                                    the universe, not just the baseline: if you need something from
+                                    a band, call again DECLARING what brings it (e.g. the SES group
+                                    returns with technologies=["jwt"], not by mentioning tokens in
+                                    the task text)
 consult_security_requirements    ← deterministic: requirements + controls for a risk level
                                     (mode: "index" opt-in returns a per-category id index)
                                     params: risk_level (L1|L2|L3), concerns? (string[])
@@ -130,9 +150,9 @@ resolve_entities                 ← low-level ontology filter engine
                                     listing requirements by category, exploring the ontology
 ```
 
-**Choosing between the three requirement surfaces:** *(ACTIVADORES ESTRUTURADOS primeiro — `task` + `exposure` + `data_sensitivity` + `stack` (+ `changed_files`): qualquer agente os preenche a partir do enunciado, sem léxico — medição da ronda 5: 63 requisitos vs 7 da task sozinha; concerns declarados REFORÇAM e estabilizam vocabulário; a task refina)*
+**Choosing between the three requirement surfaces:** *(DECLARA os activadores do vocabulário fechado — `concerns` + `exposure` + `data_sensitivity` + `technologies` (+ `changed_files`): lês o pedido, o código e a conversa e mapeias para valores publicados. O `task_context` NÃO refina nada no modo declarativo — fica registado para auditoria. Porquê: a mesma feature escrita de cinco maneiras dava de 0 a 58 requisitos quando a prosa decidia; declarada, dá um conjunto, sempre o mesmo.)*
 - `select_sbd_toe_requirements` — *"which requirements apply to THIS task / this change?"*
-  Task-scoped recommendation with declared narrowing (two bands, above). Start here for
+  Task-scoped recommendation with declared narrowing (the four bands, above). Start here for
   any concrete piece of work.
 - `consult_security_requirements` — *"what does the catalogue hold at this level?"*
   Level-wide, deterministic. `mode: "index"` (opt-in) returns a compact per-category id
@@ -143,30 +163,26 @@ resolve_entities                 ← low-level ontology filter engine
 
 **Prefer `consult_security_requirements` over `search_sbd_toe_manual`** when the question
 is structured ("what requirements apply at L2?", "which controls are active for auth?").
-Use `search_sbd_toe_manual` for narrative/conceptual questions.
-
-**Output size:** L1 ≈ 22k chars, L2 ≈ 36k chars, L3 ≈ 36k chars (may exceed context).
-**Always use `concerns` to scope L2/L3 queries** — reduces to ~9k chars per concern set.
-
-#### Valid `concerns` values (ontology-controlled vocabulary)
-
-| concern | Categories resolved | Meaning |
-|---|---|---|
-| `auth` | AUT, ACC, SES | Authentication, access control, sessions |
-| `logging` | LOG | Audit logging, monitoring |
-| `validation` | VAL, ERR | Input validation, error handling |
-| `api` | API | API security |
-| `config` | CFG | Configuration & environment hardening |
-| `integrity` | INT | Integrity & integration |
-| `distribution` | DST | Supply chain, packaging |
-| `ide` | IDE | Development environment |
-| `requirements` | REQ | Security requirements in SDLC |
-| `architecture` | ARC | Secure architecture |
-| `iac` | IAC | Infrastructure-as-Code |
-| `encryption` | ENC | Cryptography & sensitive data |
-| `agents` | AGN | AI-agent / automation governance — mandate, autonomy A0–A4, kill-switch, intent declaration (`REQ-AGN-001…004`; consult only) |
-
-Pass concerns as exact lowercase strings from the table above.
+Use `search_sbd_toe_manual` for narrative/conceptual questions — **e nunca para decidir
+âmbito**: é NÃO-NORMATIVO por declaração da própria tool. O conjunto de requisitos vem
+sempre de `select_sbd_toe_requirements` com activadores DECLARADOS.
+
+**Output size — medido, não recordado:**
+
+<!-- BEGIN GENERATED: output-sizes -->
+<!-- END GENERATED: output-sizes -->
+
+#### `concerns` — o vocabulário FECHADO desta linha (derivado do bundle)
+
+<!-- BEGIN GENERATED: concerns -->
+<!-- END GENERATED: concerns -->
+
+#### Os restantes activadores declaráveis
+
+<!-- BEGIN GENERATED: activators -->
+<!-- END GENERATED: activators -->
+
+
 
 ### GUIDE mode
 Use when the user asks *how to implement, design, structure, document, or review* something
@@ -192,13 +208,10 @@ get_threat_landscape         ← deterministic: threats relevant to a risk level
                                 use for: threat modelling context, "what threats apply to auth?"
 ```
 
-#### Valid `role` values for `get_guide_by_role`
-
-Canonical role IDs (pass exact or common alias — resolved automatically):
+#### `role` — papéis aceites por `get_guide_by_role`
 
-`developer` · `appsec` · `devops` · `grc` · `qa` · `security_champion` · `software_architect`
-· `product_owner` · `scrum_master` · `team_lead` · `ciso` · `executive_management`
-· `ops` · `compliance` · `auditor` · `ir` · `sre`
+<!-- BEGIN GENERATED: roles -->
+<!-- END GENERATED: roles -->
 
 #### Interpreting tool output
 
@@ -214,8 +227,9 @@ Canonical role IDs (pass exact or common alias — resolved automatically):
 | `match: "declared_gap"` / `meta.declared_gap` (query_sbd_toe_entities, resolve_entities) | Cite `declared_gap.note` verbatim — a legacy / unresolvable citation, not a missing requirement |
 | `citation_note` / `meta.citation_note` (informative) | The id is an illustrative example (`REQ-NNN`) or a non-requirement token (`CWE-`, `SHA-`) cited by the Manual — say so; it is not a requirement and not a gap |
 | `selection.selected[]` (select) | The recommendation for the task — cite each item's `selection_trace` when asked *why* |
+| `selection.out_of_scope_chapters` (select) | O que **nenhuma declaração activou**, por capítulo e por contagem, com `activate_with` copiável. **Não é «não aplicável»** — é não-perguntado: se o capítulo é relevante para a tarefa, re-chama com a declaração indicada. `SEM ACTIVADOR PUBLICADO` significa que o vocabulário não tem forma de o activar — diz-se, não se inventa |
 | `selection.narrowed_out[]` (select) | Eligible-but-narrowed, grouped with reason — never treat as "not applicable"; re-call with the missing signal to recover a group |
-| `completeness_report.selection` (prepare) | The same two-band summary behind the codegen context — `narrowed_out_ref` names the tool to inspect it |
+| `completeness_report.selection` (prepare) | The same band summary behind the codegen context — `narrowed_out_ref` names the tool to inspect it |
 
 #### Pattern for complex answers (threat model / security plan / checklist)
 
@@ -313,13 +327,13 @@ Always distinguish between:
 
 | Question | Approach |
 |---|---|
-| "What is X?" / "How does Y work?" | `search_sbd_toe_manual` |
+| "What is X?" / "How does Y work?" | `search_sbd_toe_manual` (NÃO-NORMATIVO — leitura, não selecção) |
 | "What applies to my project?" | `map_sbd_toe_applicability` → `get_sbd_toe_chapter_brief` |
 | "What does chapter N cover?" | `get_sbd_toe_chapter_brief` |
 | "List all chapters" | `list_sbd_toe_chapters` |
 | "Find control / artefact / practice" | `query_sbd_toe_entities` |
 | "What requirements apply at L1/L2/L3?" | `consult_security_requirements(risk_level)` |
-| "Which requirements apply to THIS task / this change?" | `select_sbd_toe_requirements(risk_level, concerns=[…], exposure?, data_sensitivity?, technologies?, changed_files?)` — **declara** o que a tua leitura justifica (vocabulário: `sbd://toe/activation-vocabulary`); `selected[]` é a resposta ao declarado, `narrowed_out[]` diz o que ficou de fora e porquê. Sem declarações → `needs_input` (com candidatos a confirmar). O `task` é contexto registado, não motor. |
+| "Which requirements apply to THIS task / this change?" | `select_sbd_toe_requirements(risk_level, concerns=[…], exposure?, data_sensitivity?, technologies?, changed_files?)` — **declara** o que a tua leitura justifica (vocabulário: `sbd://toe/activation-vocabulary`); `selected[]` é a resposta ao declarado, `narrowed_out[]` diz o que ficou de fora e porquê. Sem declarações → `needs_input` (com candidatos a confirmar). O `task_context` (antes `task`, alias mantido) é contexto registado, não motor. |
 | "How do I PROVE these requirements?" | `get_sbd_toe_verification_matrix(risk_level, requirement_ids=[…os selected…])` — o fecho requisito → prova; ids sem EvidencePattern vêm declarados |
 | "Where is the SOURCE of this requirement?" | `trace_sbd_toe_requirement_sources(requirement_ids)` — directas (autoria) vs cadeia compensada (cobertura, NÃO autoria; rótulo coverage_compensated); sem-fonte declarados |
 | "Give me a compact id map of the catalogue by category" | `consult_security_requirements(risk_level, mode="index")` |
@@ -342,54 +356,29 @@ Always distinguish between:
 
 ## Resources
 
-| Resource URI | When to use |
-|---|---|
-| `sbd://toe/agent-guide` | This document — full operational guide |
-| `sbd://toe/index-compact` | Full chapter map as JSON — fast structured lookup |
-| `sbd://toe/chapter-applicability/{riskLevel}` | Graduated applicability: every chapter present, per-chapter demand for the level |
-| `sbd://toe/ontology` | Full ontology YAML — domain_mapping, concerns, inference rules |
-| `sbd://toe/version` | Server identity + served knowledge provenance (manual/kg/ontology, from the pin) — read at session start |
+<!-- BEGIN GENERATED: resources -->
+<!-- END GENERATED: resources -->
 
 ---
 
 ## Prompts
 
-| Prompt | When to use |
-|---|---|
-| `setup_sbd_toe_agent(riskLevel, projectRole)` | Session setup — active chapters + risk-specific rules. **Prompt MCP** (clientes sem prompts: activadores directos no select) |
-| `ask_sbd_toe_manual(question)` | Direct grounded Q&A |
+<!-- BEGIN GENERATED: prompts -->
+<!-- END GENERATED: prompts -->
 
 ---
 
 ## Chapter reference
 
-| chapterId | Title | Min level | Domains |
-|---|---|---|---|
-| `00-fundamentos` | Fundamentos SbD-ToE | L1 | governance, foundation |
-| `01-classificacao-aplicacoes` | Classificação de Aplicações | L1 | governance, risk |
-| `02-requisitos-seguranca` | Requisitos de Segurança | L1 | governance, requirements |
-| `03-threat-modeling` | Threat Modeling | L1 | risk, architecture |
-| `04-arquitetura-segura` | Arquitetura Segura | L1 | architecture, design |
-| `05-dependencias-sbom-sca` | Dependências, SBOM e SCA | L1 | supply-chain |
-| `06-desenvolvimento-seguro` | Desenvolvimento Seguro | L2 | development, coding |
-| `07-cicd-seguro` | CI/CD Seguro | L1 | devops, pipeline |
-| `08-iac-infraestrutura` | IaC e Infraestrutura | L1 | infrastructure |
-| `09-containers-imagens` | Containers e Imagens | L1 | containers |
-| `10-testes-seguranca` | Testes de Segurança | L1 | testing |
-| `11-deploy-seguro` | Deploy Seguro | L2 | deploy |
-| `12-monitorizacao-operacoes` | Monitorização e Operações | L1 | monitoring |
-| `13-formacao-onboarding` | Formação e Onboarding | L3 | training |
-| `14-governanca-contratacao` | Governança e Contratação | L1 | governance |
+<!-- BEGIN GENERATED: chapters -->
+<!-- END GENERATED: chapters -->
 
 ---
 
 ## Risk levels
 
-| Level | Scope | Unlocks |
-|---|---|---|
-| `L1` | Low risk — internal, no sensitive data | ALL chapters — demand mostly recomendado/opcional |
-| `L2` | Medium risk — public APIs, user data | + chapters 06, 11 |
-| `L3` | High risk — PII, regulated systems | + chapter 13 |
+<!-- BEGIN GENERATED: risk-levels -->
+<!-- END GENERATED: risk-levels -->
 
 ---
 

package/dist/index.js

@@ -38,6 +38,8 @@ const DECLARED_CONCERNS = buildActivationVocabulary().concerns.values.map((c) =>
 const CONCERNS_VOCABULARY_NOTE = `Conjunto FECHADO de ${DECLARED_CONCERNS.length} valores, gerado do mesmo vocabulário que sbd://toe/activation-vocabulary publica (com o que cada valor activa e quantos requisitos traz por nível). Valores fora do conjunto são DECLARADOS na resposta (unknown_concerns), nunca descartados em silêncio.`;
 import { buildCodegenInstructionsResourceContent, handlePrepareCodegenContext } from "./tools/prepare-codegen-context.js";
 import { buildChapterApplicabilityJson, buildGroundedCodegenPrompt, buildSetupAgentPrompt, readGroundedCodegenGuide } from "./resources/sbd-toe-resources.js";
+import { RESOURCE_CATALOG, PROMPT_CATALOG } from "./serving/server-surface.js";
+import { buildAgentGuide } from "./serving/agent-guide.js";
 const PROTOCOL_VERSION = "2025-03-26";
 let cachedPackageMetadata;
 const LOG_LEVELS = [
@@ -70,83 +72,6 @@ function loadPackageMetadata() {
     };
     return cachedPackageMetadata;
 }
-/** The single source of the resource surface — resources/list AND the
- * read_sbd_toe_resource tool derive from THIS list (never hardcoded twice). */
-const RESOURCE_CATALOG = [
-    {
-        uri: "sbd://toe/agent-guide",
-        name: "SbD-ToE Agent Guide",
-        description: "ENTRY POINT — READ THIS FIRST. Operational guide for AI agents: SbD-ToE identity (Security by Design — Theory of Everything), CONSULT/GUIDE modes, routing by SDLC phase and domain, tool selection, epistemic standards, chapter map, risk levels, identifier conventions.",
-        mimeType: "text/markdown"
-    },
-    {
-        uri: "sbd://toe/chapter-applicability/{riskLevel}",
-        name: "SbD-ToE Chapter Applicability",
-        description: "Graduated chapter applicability for a risk level (L1/L2/L3): presence always, demand scales — derived from authored assignment proportionality (0.14.0).",
-        mimeType: "application/json"
-    },
-    {
-        uri: "sbd://toe/activation-vocabulary",
-        name: "SbD-ToE Activation Vocabulary",
-        description: "DECLARATIVE-FIRST (0.20-beta): the CLOSED vocabulary this server accepts and what each value activates — concerns, exposure, data_sensitivity, technologies, changed_files path table, roles, phases, risk levels. Derived from the served bundle and the engine's own tables, never hand-written. Read it, map your reading of the request onto these values, and DECLARE them: the server answers the declared, it does not interpret prose.",
-        mimeType: "application/json"
-    },
-    {
-        uri: "sbd://toe/index-compact",
-        name: "SbD-ToE Index Compact",
-        description: "Compact JSON index of the manual, DERIVED at read-time from the served bundle (graduated demand_by_level; no minLevel). Injectable into system prompt to eliminate exploratory discovery.",
-        mimeType: "application/json"
-    },
-    {
-        uri: "sbd://toe/ontology",
-        name: "SbD-ToE Ontology",
-        description: "Full SbD-ToE ontology YAML: domain_mapping (requirement category → control domains), " +
-            "inference rules with priorities, resolution pipelines (consult/guide/threats/review), " +
-            "and entity schemas. Read once per session to understand the deterministic resolution model " +
-            "before calling consult_security_requirements, get_threat_landscape or get_guide_by_role.",
-        mimeType: "application/yaml"
-    },
-    {
-        uri: "sbd://toe/skill/{role}",
-        name: "SbD-ToE Role Skill",
-        description: "Role-specialised SbD-ToE skill for a canonical role — RISK LEVEL FIXED AT L2 neste URI; " +
-            "para outro nível usa generate_sbd_toe_skill(role, risk_level=…). Same output as generate_sbd_toe_skill(role, format=skill).",
-        mimeType: "text/markdown"
-    },
-    {
-        uri: "sbd://toe/subagent/{role}",
-        name: "SbD-ToE Role Sub-agent Definition",
-        description: "Installable sub-agent definition for a canonical role (default risk L2, harnessed flavour — " +
-            "grants mcp__sbd-toe__* tools). Same output as generate_sbd_toe_skill(role, format=subagent).",
-        mimeType: "text/markdown"
-    },
-    {
-        uri: "sbd://toe/codegen-instructions/{mode}",
-        name: "SbD-ToE Codegen Instructions (per mode)",
-        description: "Static per-mode boilerplate of prepare_sbd_toe_codegen_context (mode: codegen, review or " +
-            "test-plan): llm_codegen_instructions slots + security_rationale_template skeleton — " +
-            "byte-identical to the detail=full inline content when assembled per the embedded rules — " +
-            "plus the detail_encoding legend for detail=standard/minimal payloads (v2 token diet). " +
-            "Referenced by codegen_instructions_ref in dieted payloads.",
-        mimeType: "application/json"
-    },
-    {
-        uri: "sbd://toe/version",
-        name: "SbD-ToE MCP Version",
-        description: "Version of the running SbD-ToE MCP server (name, version, description) plus the provenance of the served knowledge: manual {version, commit}, kg {release_tag, substrate_version, consumer_contract_version} and ontology {tag, commit}, read from the consumed-bundle pin.",
-        mimeType: "application/json"
-    },
-    {
-        uri: "sbd://toe/grounded-codegen-guide",
-        name: "SbD-ToE Grounded Codegen Guide",
-        description: "Agent-facing guide for using prepare_sbd_toe_codegen_context. " +
-            "Covers workflow, branching by status (ready_for_codegen / needs_clarification / " +
-            "needs_decomposition / unsupported_scope), output discipline (cite citation_map, fill " +
-            "security_rationale, distinguish code/tests/evidence), and explicit prohibitions " +
-            "(no invented IDs, no compliance claims, no rastreabilidade-noise inside source files).",
-        mimeType: "text/markdown"
-    }
-];
 /** Declared resource-read failure (never-silent): carries the JSON-RPC code. */
 /**
  * Materialize any resource of RESOURCE_CATALOG by concrete URI (templated URIs
@@ -195,7 +120,7 @@ async function materializeResource(uri) {
     }
     if (uri === "sbd://toe/agent-guide") {
         try {
-            return { mimeType: "text/markdown", text: readFileSync(resolveAppPath("assets/agent-guide.md"), "utf-8") };
+            return { mimeType: "text/markdown", text: buildAgentGuide() };
         }
         catch {
             throw new ResourceReadError(-32603, "Could not read SbD-ToE agent guide.");
@@ -1035,16 +960,21 @@ class McpRuntime {
                     title: "Select SbD-ToE Requirements (MP1)",
                     description: "START HERE — para qualquer tarefa concreta esta é a 1ª tool. Arranque: lê sbd://toe/agent-guide (read_sbd_toe_resource); setup_sbd_toe_agent é um PROMPT MCP — clientes sem prompts (p.ex. Desktop) não o expõem: segue directo por aqui. DECLARATIVO PRIMEIRO (contrato v1.18-beta, linha 0.20): TU tens o contexto — lê o pedido, o código e a conversa e DECLARA o que interpretaste (risk_level, concerns, exposure, data_sensitivity, technologies, changed_files). EU NÃO INTERPRETO PROSA: respondo com o que o KG sabe sobre o declarado, mais as adjacências do grafo, de forma reproduzível. Vocabulário fechado em sbd://toe/activation-vocabulary. O `task` fica REGISTADO para auditoria e NÃO influencia o resultado; sem nenhuma declaração devolvo needs_input com o vocabulário e candidatos A CONFIRMAR (nunca adivinho, nunca devolvo zero em silêncio); a baseline do nível pede-se explicitamente (mode='baseline'); o motor inferencial antigo fica em mode='discover' (exploratório). The MP1 selection operation (Classificar → Seleccionar): which requirements apply to THIS task in THIS " +
                         "context. Composes the reference semantics the published ontology declares — baseline (cap. 02 base " +
-                        "catalogue, by risk level) ∪ domain chapters activated by the context (changed_files, technologies, stack, " +
-                        "task) ⊕ regulatory overlay (extend) — then narrows deterministically by the task's declared signals. " +
-                        "Returns BOTH bands: selected[] (each with its selection_trace: source/trigger/score) and narrowed_out[] " +
-                        "(eligible-without-signal, grouped by category, with reason) — never silent. Paginated. " +
+                        "catalogue, by risk level) ∪ domain chapters activated by the DECLARED activators (concerns, exposure, " +
+                        "data_sensitivity, technologies, changed_files) ∪ the categories the published vocabulary promises " +
+                        "⊕ regulatory overlay (extend) — then narrows deterministically by those same declarations. The task " +
+                        "text is NEVER an activator in declarative mode (it is recorded context; it is only an engine in " +
+                        "mode='discover'). Returns the bands: selected[] (each with its selection_trace: source/trigger/score), " +
+                        "narrowed_out[] (eligible-without-signal, grouped by category, with reason), excluded_by_level[] and " +
+                        "out_of_scope_chapters (what no declaration activated, by chapter and count, with how to bring it in) — " +
+                        "never silent, and the SCOPE of that promise is the universe, not just the baseline. Paginated. " +
                         "All data from the published deterministic runtime bundle — nothing is invented.",
                     inputSchema: {
                         type: "object",
                         properties: {
                             risk_level: { type: "string", enum: ["L1", "L2", "L3"], description: "Application risk level (drives the baseline)." },
-                            task: { type: "string", description: "RECORDED CONTEXT (auditoria): o enunciado da tarefa. NÃO influencia a selecção no modo declarativo — o servidor não interpreta prosa. Só é motor em mode='discover'." },
+                            task_context: { type: "string", description: "CONTEXTO REGISTADO (auditoria): o enunciado da tarefa. NOME CANÓNICO desde 0.20.0-beta.24 — um campo chamado `task` convidava a ser o motor, e não é: NÃO influencia a selecção no modo declarativo. Alias `task` continua aceite (aditivo, nunca renomeámos nada); em mode='discover' o texto é motor e `task` é o nome a usar." },
+                            task: { type: "string", description: "ALIAS de `task_context` (compatibilidade). Em mode='discover' é o MOTOR (casamento lexical, exploratório); no modo declarativo é apenas contexto registado." },
                             mode: { type: "string", enum: ["declarative", "baseline", "discover"], description: "declarative (default): responde ao DECLARADO; sem declarações devolve needs_input com vocabulário e candidatos a confirmar. baseline: baseline completa do nível, por pedido EXPLÍCITO (nunca fallback). discover: motor inferencial histórico (casamento lexical da prosa), exploratório — investigação e estudo de paráfrase." },
                             stack: { type: "string", description: "Texto livre da stack. No modo declarativo só conta quando traz, como TOKEN EXACTO, um valor de `technologies` (normalizar o declarado é legítimo; adivinhar prosa não). Preferir `technologies`." },
                             exposure: { type: "string", enum: ["local", "internal", "authenticated", "public"], description: "Declared activator: authenticated/public activate auth+logging (+api/validation/architecture for public)." },
@@ -1437,88 +1367,10 @@ class McpRuntime {
         });
     }
     getPromptDefinition() {
-        return {
-            name: "ask_sbd_toe_manual",
-            title: "Ask SbD-ToE Manual",
-            description: "MCP prompt to guide the AI chat to answer questions about the SbD-ToE manual with grounding.",
-            arguments: [
-                {
-                    name: "question",
-                    description: "Question about the SbD-ToE manual.",
-                    required: true
-                }
-            ]
-        };
+        return PROMPT_CATALOG[0];
     }
     handlePromptsList(request) {
-        this.sendResponse(request.id, {
-            prompts: [
-                this.getPromptDefinition(),
-                {
-                    name: "setup_sbd_toe_agent",
-                    title: "Setup SbD-ToE Agent",
-                    description: "START HERE — entry point (2ª chamada, após leres sbd://toe/agent-guide): MCP PROMPT (clientes sem suporte de prompts não o expõem — alternativa: activadores estruturados directos no select) to configure an agent with SbD-ToE manual context and rules for a given risk level.",
-                    arguments: [
-                        {
-                            name: "riskLevel",
-                            description: "Project risk level: L1, L2 or L3.",
-                            required: true
-                        },
-                        {
-                            name: "projectRole",
-                            description: "Project role or description (optional).",
-                            required: false
-                        }
-                    ]
-                },
-                {
-                    name: "prepare_grounded_codegen",
-                    title: "Prepare Grounded Codegen (SbD-ToE)",
-                    description: "MCP prompt that bundles the grounded-codegen guide with a user task and instructs the " +
-                        "agent to call prepare_sbd_toe_codegen_context before producing code. Forces citation of " +
-                        "citation_map IDs, fills security_rationale_template, distinguishes code/tests/evidence, " +
-                        "blocks compliance claims, and routes needs_clarification / needs_decomposition / " +
-                        "unsupported_scope to user dialog instead of silent guessing.",
-                    arguments: [
-                        {
-                            name: "task",
-                            description: "Concrete coding task (e.g. 'Add payload validation to PATCH /users/:id/email').",
-                            required: true
-                        },
-                        {
-                            name: "mode",
-                            description: "codegen | review | test-plan. Defaults to codegen.",
-                            required: false
-                        },
-                        {
-                            name: "riskLevel",
-                            description: "Project risk level: L1, L2 or L3.",
-                            required: false
-                        },
-                        {
-                            name: "concerns",
-                            description: "Optional explicit concerns (comma-separated string or array). Otherwise inferred by the activation engine.",
-                            required: false
-                        },
-                        {
-                            name: "stack",
-                            description: "Stack hint (e.g. 'Node.js/Express'). Informational.",
-                            required: false
-                        },
-                        {
-                            name: "regulatoryFrameworks",
-                            description: "Optional regulatory framework short codes or IDs (e.g. 'GDPR', 'EXT-DORA'). Comma-separated string or array.",
-                            required: false
-                        },
-                        {
-                            name: "includeRegulatoryOverlay",
-                            description: "When true, asks the tool to surface regulatory overlay context.",
-                            required: false
-                        }
-                    ]
-                }
-            ]
-        });
+        this.sendResponse(request.id, { prompts: [...PROMPT_CATALOG] });
     }
     handlePromptGet(request) {
         const name = typeof request.params?.name === "string" ? request.params.name : "";