@skeletiq/mcp 0.4.0 → 0.5.0

package/dist/index.js

@@ -5,7 +5,12 @@ import { serveStdio } from "@modelcontextprotocol/server/stdio";
 
 // src/config.ts
 var SERVER_NAME = "skeletiq";
-var SERVER_VERSION = "0.4.0";
+var SERVER_VERSION = "0.5.0";
+var AGENT_SCHEMA_VERSION = 2;
+function schemaNote(serverVersion) {
+  if (serverVersion === void 0 || serverVersion <= AGENT_SCHEMA_VERSION) return null;
+  return "A newer @skeletiq/mcp understands more of this server; update when you can.";
+}
 var DEFAULT_API_URL = "https://api.skeletiq.com";
 var TOKEN_PREFIX = "skq_";
 var ConfigError = class extends Error {
@@ -33,8 +38,8 @@ function normalizeApiUrl(raw) {
   } catch {
     throw new ConfigError(`SKELETIQ_API_URL is not a valid URL: ${value}`);
   }
-  const path = url.pathname.replace(/\/+$/, "").replace(/\/api\/v1$/, "");
-  return `${url.origin}${path}`;
+  const path2 = url.pathname.replace(/\/+$/, "").replace(/\/api\/v1$/, "");
+  return `${url.origin}${path2}`;
 }
 
 // src/server.ts
@@ -201,14 +206,14 @@ var SkeletiqClient = class {
     this.config = config;
   }
   /** A parsed JSON response, or a thrown `SkeletiqApiError` carrying the server's own words. */
-  async request(path, options = {}) {
-    const response = await this.fetch(path, options);
+  async request(path2, options = {}) {
+    const response = await this.fetch(path2, options);
     const text = await response.text();
     return text ? JSON.parse(text) : void 0;
   }
   /** The raw `Response`, for the one caller that reads a stream rather than a body. */
-  async fetch(path, options = {}) {
-    const url = this.url(path, options.query);
+  async fetch(path2, options = {}) {
+    const url = this.url(path2, options.query);
     const timeout = AbortSignal.timeout(READ_TIMEOUT_MS);
     const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
     let response;
@@ -232,8 +237,8 @@ var SkeletiqClient = class {
     if (!response.ok) throw await this.toError(response);
     return response;
   }
-  url(path, query) {
-    const url = new URL(`${this.config.apiUrl}${API_PREFIX}${path}`);
+  url(path2, query) {
+    const url = new URL(`${this.config.apiUrl}${API_PREFIX}${path2}`);
     for (const [key, value] of Object.entries(query ?? {})) {
       if (value !== void 0 && value !== "") url.searchParams.set(key, String(value));
     }
@@ -290,7 +295,19 @@ var ComponentSchema = z.looseObject({
   role: z.string().nullable().optional(),
   /** Why the component is in the design (`core`, `security`, …) — see the API's `component_concerns`. */
   concern: z.string().nullable().optional(),
-  requirement_ids: z.array(z.string()).nullable().optional()
+  requirement_ids: z.array(z.string()).nullable().optional(),
+  /** Ids of the decision records this component realizes, e.g. `database.primary`. */
+  decision_ids: z.array(z.string()).nullable().optional(),
+  /** `domain` | `platform`. Left as a string: a value this package has not seen is still shown. */
+  layer: z.string().nullish(),
+  /** What a platform part is (`waf`, `api_gateway`, …). Left as a string for the same reason. */
+  platform_role: z.string().nullish(),
+  /** `realized` (the platform added it) | `adopted` (the design drew it and the platform kept it). */
+  platform_origin: z.string().nullish(),
+  /** Ids of the platform obligations this part meets. */
+  satisfies: z.array(z.string()).nullish(),
+  /** Cross-cutting settings realized on the component (encryption, backup, rate limit, …). */
+  policies: z.record(z.string(), z.unknown()).nullish()
 });
 var ConnectionSchema = z.looseObject({
   id: z.string().nullable().optional(),
@@ -298,7 +315,11 @@ var ConnectionSchema = z.looseObject({
   target: z.string(),
   label: z.string().nullable().optional(),
   protocol: z.string().nullable().optional(),
-  is_async: z.boolean().optional()
+  is_async: z.boolean().optional(),
+  /** TLS, timeout and breaker settings on the edge. */
+  policies: z.record(z.string(), z.unknown()).nullish(),
+  /** `realized` on an edge the platform added. */
+  platform_origin: z.string().nullish()
 });
 var GapEntrySchema = z.union([
   z.string(),
@@ -326,7 +347,11 @@ var ArchitectureJsonSchema = z.looseObject({
   trade_offs: z.array(z.string()).nullable().optional(),
   scalability_notes: z.string().nullable().optional(),
   assumptions: z.array(GapEntrySchema).nullable().optional(),
-  open_questions: z.array(GapEntrySchema).nullable().optional()
+  open_questions: z.array(GapEntrySchema).nullable().optional(),
+  /** Drawn connections the platform layer replaced. */
+  bypassed_connections: z.array(ConnectionSchema).nullish(),
+  /** The `design_decisions` entries the platform layer appended. */
+  platform_decisions: z.array(z.string()).nullish()
 });
 var RequirementLedgerRowSchema = z.looseObject({
   id: z.string(),
@@ -367,6 +392,10 @@ var RequirementLedgerRowSchema = z.looseObject({
   cited_by_components: z.array(z.string()).nullable().optional(),
   /** Indices into `architecture_json.grounded_decisions`, the raw array — blanks are not compacted. */
   cited_by_decisions: z.array(z.number()).nullable().optional(),
+  /** `stated` in the person's own words, `proposed` by the analysis, or `accepted` — a proposal a
+   * person confirmed. Absent from older APIs. Left as a string: a value this package has not seen
+   * must not stop the whole design from parsing. */
+  origin: z.string().nullish(),
   added_in_version: z.number().nullable().optional(),
   /** Set only on a row under `RequirementLedger.superseded`: an instruction an earlier analysis
    * recorded as a requirement, now the change request it names (`CR5`). Absent from older APIs. */
@@ -506,6 +535,14 @@ var ReadinessSchema = z.looseObject({
    * caller falls back to the boolean.
    */
   verdict: z.enum(["ready", "outstanding", "unanswered"]).optional(),
+  /** The verdict-first summary of the rows. Absent from servers that predate it. */
+  headline: z.looseObject({
+    met: z.number(),
+    total: z.number(),
+    verdict: z.enum(["ready", "outstanding", "unanswered"]),
+    score: z.number(),
+    rules_updated: z.boolean().optional()
+  }).nullable().optional(),
   unknown_gate_count: z.number().optional(),
   /** Keys of advisory rows whose check never ran. Named, never counted. */
   unrun_checks: z.array(z.string()).optional(),
@@ -694,7 +731,71 @@ var DriftSchema = z.looseObject({
   extra_components: z.array(z.looseObject({ name: z.string() })),
   extra_connections: z.array(z.looseObject({ source: z.string(), target: z.string() })),
   counts: z.record(z.string(), z.number()),
-  release: ReleaseFactsSchema
+  release: ReleaseFactsSchema,
+  /** True when the server read the evidence the connector checked. Absent from older servers. */
+  evidence_checked: z.boolean().optional(),
+  /** Covered components reported implemented with no verified citation. */
+  unverified: z.array(ComponentRefSchema).optional(),
+  fitness_failing: z.array(z.string()).optional(),
+  fitness_unverified: z.array(z.string()).optional(),
+  fitness_unknown: z.array(z.string()).optional(),
+  schema_version: z.number().optional()
+});
+var DecisionRequestSchema = z.looseObject({
+  id: z.string(),
+  project_id: z.string(),
+  architecture_id: z.string().nullable(),
+  version: z.number(),
+  decision_id: z.string(),
+  decision_title: z.string(),
+  proposed: z.string(),
+  why: z.string(),
+  status: z.enum(["pending", "accepted", "dismissed"]),
+  resolution_note: z.string().nullable(),
+  accepted_in_version: z.number().nullable(),
+  latest_version: z.number(),
+  decision_current: z.boolean().optional(),
+  schema_version: z.number().optional()
+});
+var FitnessTestSchema = z.looseObject({
+  id: z.string(),
+  source: z.string(),
+  obligation_id: z.string().nullable(),
+  subject_ids: z.array(z.string()),
+  subject_names: z.array(z.string()),
+  assertion: z.string(),
+  check: z.string(),
+  level: z.string(),
+  layer: z.string().nullable()
+});
+var FitnessTestsSchema = z.looseObject({
+  architecture_id: z.string(),
+  version: z.number(),
+  schema_version: z.number().optional(),
+  tests: z.array(FitnessTestSchema),
+  total: z.number(),
+  truncated: z.boolean(),
+  unavailable: z.string().nullable().optional()
+});
+var DecisionOptionSchema = z.looseObject({
+  id: z.string(),
+  label: z.string(),
+  rejected_because: z.string().nullable().optional()
+});
+var DecisionRecordViewSchema = z.looseObject({
+  id: z.string(),
+  title: z.string(),
+  chosen: z.string(),
+  why: z.string(),
+  options: z.array(DecisionOptionSchema),
+  basis_removed: z.array(z.string()).default([])
+});
+var DecisionsViewResponseSchema = z.looseObject({
+  architecture_id: z.string(),
+  version: z.number(),
+  status: z.string(),
+  reason: z.string().nullable().optional(),
+  records: z.array(DecisionRecordViewSchema).default([])
 });
 var ClarifyingOptionDetailSchema = z.looseObject({
   value: z.string(),
@@ -715,7 +816,11 @@ var ClarifyingQuestionSchema = z.looseObject({
   /** Whether more than one option may be picked at once. */
   multiple: z.boolean().optional(),
   /** What leaving the question unanswered does, in the product's words. */
-  skip_effect: z.string().nullable().optional()
+  skip_effect: z.string().nullable().optional(),
+  /** The contract field this question resolves, e.g. `regimes.hipaa`; absent when it is not a fork. */
+  fork: z.string().nullish(),
+  /** Ask only when `question_id` was answered with one of `values`. */
+  asked_if: z.object({ question_id: z.string(), values: z.array(z.string()) }).nullish()
 });
 var IntentDecisionSchema = z.looseObject({
   intent: z.string().optional(),
@@ -896,7 +1001,80 @@ function isUuid(value) {
 }
 
 // src/tools/check-drift.ts
+import * as z3 from "zod/v4";
+
+// src/lib/evidence.ts
+import { realpath, readFile, stat } from "fs/promises";
+import path from "path";
 import * as z2 from "zod/v4";
+var MAX_EVIDENCE_BYTES = 1e6;
+var MAX_REFS_PER_CLAIM = 5;
+var evidenceRef = z2.object({
+  path: z2.string().min(1).max(512).describe("The file, relative to the repo root."),
+  quote: z2.string().min(1).max(2e3).optional().describe("Text that must appear in the file. Checked locally, never sent."),
+  symbol: z2.string().min(1).max(255).optional().describe("An identifier that must appear in the file. Checked locally, never sent.")
+}).refine((ref) => ref.quote !== void 0 || ref.symbol !== void 0, {
+  message: "each evidence entry needs a quote or a symbol"
+});
+async function resolveRepoRoot(requested) {
+  try {
+    const root = await realpath(requested);
+    return (await stat(root)).isDirectory() ? root : null;
+  } catch {
+    return null;
+  }
+}
+var MAX_PATH = 512;
+var MAX_REASON = 200;
+function collapse(text) {
+  return text.replace(/\s+/g, " ").trim();
+}
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function inside(root, target) {
+  const relative = path.relative(root, target);
+  return relative === "" || relative !== ".." && !relative.startsWith(".." + path.sep) && !path.isAbsolute(relative);
+}
+async function verifyEvidence(root, ref) {
+  const shown = ref.path.slice(0, MAX_PATH);
+  const failed = (reason) => ({
+    path: shown,
+    status: "failed",
+    reason: reason.slice(0, MAX_REASON)
+  });
+  try {
+    const realRoot = await realpath(root);
+    const lexical = path.resolve(realRoot, ref.path);
+    if (!inside(realRoot, lexical)) return failed("outside the repository");
+    let target;
+    try {
+      target = await realpath(lexical);
+    } catch (error) {
+      if (error.code === "ENOENT") return failed("file not found");
+      throw error;
+    }
+    if (!inside(realRoot, target)) return failed("outside the repository");
+    const info = await stat(target);
+    if (!info.isFile()) return failed("not a regular file");
+    if (info.size > MAX_EVIDENCE_BYTES) return failed(`file too large (over ${MAX_EVIDENCE_BYTES} bytes)`);
+    const quote = ref.quote === void 0 ? "" : collapse(ref.quote);
+    const symbol = ref.symbol?.trim() ?? "";
+    if (!quote && !symbol) return failed("nothing cited to look for");
+    const content = await readFile(target, "utf8");
+    if (quote && !collapse(content).includes(quote)) {
+      return failed("cited text not found in file");
+    }
+    if (symbol) {
+      const pattern = new RegExp(`(?<![\\w$])${escapeRegExp(symbol)}(?![\\w$])`);
+      if (!pattern.test(content)) return failed("symbol not found in file");
+    }
+    return { path: shown, status: "verified" };
+  } catch (error) {
+    const code = error?.code;
+    return failed(typeof code === "string" ? `file could not be read (${code})` : "file could not be read");
+  }
+}
 
 // src/lib/result.ts
 function ok(structured, text) {
@@ -929,53 +1107,70 @@ function versionLine(facts) {
 }
 
 // src/tools/check-drift.ts
-var input = z2.object({
-  project_id: z2.string().describe("A SkeletIQ project id, or its exact name."),
-  version: z2.number().int().positive().optional().describe(
+var input = z3.object({
+  project_id: z3.string().describe("A SkeletIQ project id, or its exact name."),
+  version: z3.number().int().positive().optional().describe(
     "The version you built from \u2014 the `version=` stamped in the AGENTS.md fence. Defaults to the latest released version. Component ids are only meaningful within one version."
   ),
-  covers: z2.array(z2.string()).max(500).optional().describe(
+  repo_root: z3.string().optional().describe("The repository root that evidence paths are relative to. Defaults to the current directory."),
+  covers: z3.array(z3.string()).max(500).optional().describe(
     "The component ids this repository is responsible for. Omit only when this repo implements the whole design \u2014 otherwise everything you leave out is reported as missing."
   ),
-  components: z2.array(
-    z2.object({
-      id: z2.string().max(200).describe("The component id from the design."),
-      name: z2.string().max(255).optional().describe("The component name, which survives a regeneration when the id does not."),
-      status: z2.enum(["implemented", "partial", "not_started"]),
-      note: z2.string().max(2e3).optional()
+  components: z3.array(
+    z3.object({
+      id: z3.string().max(200).describe("The component id from the design."),
+      name: z3.string().max(255).optional().describe("The component name, which survives a regeneration when the id does not."),
+      status: z3.enum(["implemented", "partial", "not_started"]),
+      note: z3.string().max(2e3).optional(),
+      evidence: z3.array(evidenceRef).max(MAX_REFS_PER_CLAIM).optional().describe("Where in the code this component is built. Verified on this machine; only the path and outcome are sent.")
     })
   ).max(500).describe("What you built. Report every component in `covers`, including the ones not started."),
-  extra_components: z2.array(
-    z2.object({
-      name: z2.string().max(255),
-      type: z2.string().max(64).optional(),
-      technology: z2.string().max(255).optional()
+  extra_components: z3.array(
+    z3.object({
+      name: z3.string().max(255),
+      type: z3.string().max(64).optional(),
+      technology: z3.string().max(255).optional()
     })
   ).max(200).optional().describe("Things in the code that the design does not contain."),
-  extra_connections: z2.array(
-    z2.object({
-      source: z2.string().max(255),
-      target: z2.string().max(255),
-      protocol: z2.string().max(64).optional()
+  extra_connections: z3.array(
+    z3.object({
+      source: z3.string().max(255),
+      target: z3.string().max(255),
+      protocol: z3.string().max(64).optional()
     })
   ).max(500).optional().describe(
     "Edges in the code the design does not have, each from the caller to the callee: the component that holds the client is the source, including a consumer reading a queue. Endpoints may be component ids or names."
-  )
+  ),
+  fitness: z3.array(
+    z3.object({
+      test_id: z3.string().max(300).describe("The id of a fitness test."),
+      status: z3.enum(["pass", "fail", "not_written"]),
+      test_path: z3.string().min(1).max(512).optional().describe("The file holding the test."),
+      quote: z3.string().min(1).max(2e3).optional().describe("Text that must appear in that file. Checked locally, never sent.")
+    })
+  ).max(500).optional().describe("Your result for each fitness test you wrote or could not write.")
 });
-var refs = z2.array(z2.object({ id: z2.string(), name: z2.string(), type: z2.string() }));
-var output = z2.object({
-  architecture_id: z2.string(),
-  version: z2.number(),
-  is_released: z2.boolean(),
-  newer_release_exists: z2.boolean(),
-  resolved_by: z2.string(),
-  in_sync: z2.boolean(),
+var refs = z3.array(z3.object({ id: z3.string(), name: z3.string(), type: z3.string() }));
+var output = z3.object({
+  architecture_id: z3.string(),
+  version: z3.number(),
+  is_released: z3.boolean(),
+  newer_release_exists: z3.boolean(),
+  resolved_by: z3.string(),
+  in_sync: z3.boolean(),
   missing: refs,
   unreported: refs,
   partial: refs,
   elsewhere: refs,
-  unknown_ids: z2.array(z2.object({ id: z2.string(), suggestions: refs })),
-  counts: z2.record(z2.string(), z2.number())
+  unknown_ids: z3.array(z3.object({ id: z3.string(), suggestions: refs })),
+  counts: z3.record(z3.string(), z3.number()),
+  evidence_checked: z3.boolean(),
+  unverified: refs,
+  fitness_failing: z3.array(z3.string()),
+  fitness_unverified: z3.array(z3.string()),
+  fitness_unknown: z3.array(z3.string()),
+  checked_against: z3.string(),
+  schema_version: z3.number().nullable()
 });
 function registerCheckDrift(server, client, resolver) {
   server.registerTool(
@@ -987,7 +1182,23 @@ function registerCheckDrift(server, client, resolver) {
       outputSchema: output,
       annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true }
     },
-    async ({ project_id, version, covers, components, extra_components, extra_connections }) => guard(async () => {
+    async ({ project_id, version, repo_root, covers, components, extra_components, extra_connections, fitness }) => guard(async () => {
+      const requested = repo_root ?? process.cwd();
+      const root = await resolveRepoRoot(requested);
+      if (root === null) return failure(`repo_root ${requested} cannot be read`);
+      const checked = await Promise.all(
+        components.map(async ({ evidence, ...component }) => ({
+          ...component,
+          ...evidence ? { evidence: await Promise.all(evidence.map((ref) => verifyEvidence(root, ref))) } : {}
+        }))
+      );
+      const fitnessChecked = fitness ? await Promise.all(
+        fitness.map(async (entry) => ({
+          test_id: entry.test_id,
+          status: entry.status,
+          evidence: entry.test_path && entry.quote ? [await verifyEvidence(root, { path: entry.test_path, quote: entry.quote })] : []
+        }))
+      ) : null;
       const project = await resolver.resolveProject(project_id);
       const resolved = await resolver.resolveVersion(project.id, version);
       const report = DriftSchema.parse(
@@ -995,9 +1206,10 @@ function registerCheckDrift(server, client, resolver) {
           method: "POST",
           body: {
             covers: covers ?? null,
-            components,
+            components: checked,
             extra_components: extra_components ?? null,
-            extra_connections: extra_connections ?? null
+            extra_connections: extra_connections ?? null,
+            fitness: fitnessChecked
           }
         })
       );
@@ -1014,15 +1226,34 @@ function registerCheckDrift(server, client, resolver) {
           id: entry.id,
           suggestions: entry.suggestions ?? []
         })),
-        counts: report.counts
+        counts: report.counts,
+        evidence_checked: report.evidence_checked === true,
+        unverified: report.unverified ?? [],
+        fitness_failing: report.fitness_failing ?? [],
+        fitness_unverified: report.fitness_unverified ?? [],
+        fitness_unknown: report.fitness_unknown ?? [],
+        checked_against: root,
+        schema_version: report.schema_version ?? null
       };
       const lines = [];
       lines.push(
         report.in_sync ? "In sync \u2014 everything this repository covers is built as designed." : "Drift found:"
       );
       push(lines, "Not started", report.missing, report.counts.missing);
+      push(lines, "Unverified", structured.unverified, report.counts.unverified);
       push(lines, "Half built", report.partial, report.counts.partial);
       push(lines, "You did not mention", report.unreported, report.counts.unreported);
+      if (structured.fitness_failing.length) {
+        lines.push(`Fitness failing (${structured.fitness_failing.length}): ${structured.fitness_failing.join(", ")}`);
+      }
+      if (structured.fitness_unverified.length) {
+        lines.push(
+          `Fitness unverified (${structured.fitness_unverified.length}): ${structured.fitness_unverified.join(", ")}`
+        );
+      }
+      if (structured.fitness_unknown.length) {
+        lines.push(`Fitness unknown (${structured.fitness_unknown.length}): ${structured.fitness_unknown.join(", ")}`);
+      }
       if (report.extra_components.length) {
         lines.push(`In the code but not the design: ${report.extra_components.map((c) => c.name).join(", ")}`);
       }
@@ -1048,6 +1279,12 @@ function registerCheckDrift(server, client, resolver) {
         );
       }
       lines.push("");
+      if (!structured.evidence_checked) {
+        lines.push("This SkeletIQ server does not check evidence yet; these are unverified claims.");
+      }
+      lines.push(`Checked against ${root}`);
+      const note = schemaNote(report.schema_version);
+      if (note) lines.push(note);
       lines.push(versionLine(facts));
       return ok(structured, lines.join("\n"));
     })
@@ -1060,53 +1297,174 @@ function push(lines, label, refs2, total) {
   lines.push(`${label} (${total ?? refs2.length}): ${shown}${more}`);
 }
 
+// src/tools/request-decision-change.ts
+import * as z4 from "zod/v4";
+var REVIEW_LINE = "A person on the project reviews this in To-do; nothing changes until they accept.";
+var UNSUPPORTED_LINE = "This SkeletIQ server does not take decision requests yet.";
+var input2 = z4.object({
+  request_id: z4.string().optional().describe("A request you filed earlier. Give this alone to read where it stands."),
+  project_id: z4.string().optional().describe("A SkeletIQ project id, or its exact name. Needed to file a request."),
+  version: z4.number().int().positive().optional().describe("The version you built from. Defaults to the latest released version."),
+  decision_id: z4.string().max(64).optional().describe("The decision's topic id, e.g. database.primary. Needed to file a request."),
+  proposed: z4.string().min(1).max(500).optional().describe("What you propose instead. Needed to file a request."),
+  why: z4.string().min(1).max(2e3).optional().describe("Why the code needs the change. Needed to file a request."),
+  evidence: z4.array(evidenceRef).max(MAX_REFS_PER_CLAIM).optional().describe("Where in the code the need shows. Verified on this machine; only the path and outcome are sent."),
+  repo_root: z4.string().optional().describe("The repository root that evidence paths are relative to. Defaults to the current directory.")
+});
+var output2 = z4.object({
+  request_id: z4.string(),
+  status: z4.enum(["pending", "accepted", "dismissed"]),
+  decision_id: z4.string(),
+  decision_title: z4.string(),
+  proposed: z4.string(),
+  version: z4.number(),
+  latest_version: z4.number(),
+  accepted_in_version: z4.number().nullable(),
+  resolution_note: z4.string().nullable()
+});
+function registerRequestDecisionChange(server, client, resolver) {
+  server.registerTool(
+    "request_decision_change",
+    {
+      title: "Ask a person to change a design decision",
+      description: `Ask for one of the design's decisions to change, with what you propose and why the code needs it. ${REVIEW_LINE} Call again with only \`request_id\` to see the answer. This never changes the design.`,
+      inputSchema: input2,
+      outputSchema: output2,
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true }
+    },
+    async ({ request_id, project_id, version, decision_id, proposed, why, evidence, repo_root }) => guard(async () => {
+      if (request_id !== void 0) return poll(client, request_id);
+      if (!project_id || !decision_id || !proposed || !why) {
+        return failure(
+          "To file a request give project_id, decision_id, proposed and why. To read an answer, give only request_id."
+        );
+      }
+      let checked = [];
+      if (evidence?.length) {
+        const requested = repo_root ?? process.cwd();
+        const root = await resolveRepoRoot(requested);
+        if (root === null) return failure(`repo_root ${requested} cannot be read`);
+        checked = await Promise.all(evidence.map((ref) => verifyEvidence(root, ref)));
+      }
+      const project = await resolver.resolveProject(project_id);
+      const resolved = await resolver.resolveVersion(project.id, version);
+      let raw;
+      try {
+        raw = await client.request(`/architectures/${resolved.architectureId}/decision-requests`, {
+          method: "POST",
+          body: { decision_id, proposed, why, evidence: checked }
+        });
+      } catch (error) {
+        return refused(error);
+      }
+      return answer(DecisionRequestSchema.parse(raw), true);
+    })
+  );
+}
+async function poll(client, requestId) {
+  let raw;
+  try {
+    raw = await client.request(`/decision-requests/${encodeURIComponent(requestId)}`);
+  } catch (error) {
+    if (error instanceof SkeletiqApiError && error.status === 404 && error.message === "Decision request not found") {
+      return failure(
+        `There is no decision request ${requestId} on this server. Check the id; a request is removed when its project is deleted.`
+      );
+    }
+    return refused(error);
+  }
+  return answer(DecisionRequestSchema.parse(raw), false);
+}
+function refused(error) {
+  if (error instanceof SkeletiqApiError) {
+    if (error.status === 404) return failure(UNSUPPORTED_LINE);
+    if (error.status === 409) return failure(error.message);
+    return failure(describeApiError(error));
+  }
+  throw error;
+}
+function answer(request, filed) {
+  const structured = {
+    request_id: request.id,
+    status: request.status,
+    decision_id: request.decision_id,
+    decision_title: request.decision_title,
+    proposed: request.proposed,
+    version: request.version,
+    latest_version: request.latest_version,
+    accepted_in_version: request.accepted_in_version,
+    resolution_note: request.resolution_note
+  };
+  const lines = [];
+  const subject = `"${request.decision_title}" (${request.decision_id}, version ${request.version}) \u2192 ${request.proposed}`;
+  if (request.status === "pending") {
+    lines.push(`${filed ? "Request filed" : "Request pending"} (${request.id}): ${subject}`);
+    lines.push(REVIEW_LINE);
+    lines.push(`Poll it with request_decision_change(request_id: "${request.id}").`);
+  } else if (request.status === "accepted") {
+    lines.push(`Request ${request.id} accepted: ${subject}`);
+    lines.push(
+      request.accepted_in_version === null ? `accepted; the server did not say which version it landed in (latest is v${request.latest_version})` : request.latest_version > request.accepted_in_version ? (
+        // The server does not record which version the follow-up turn produced, so a newer one
+        // is a reason to look, not proof the change is in it.
+        `accepted at v${request.accepted_in_version}; v${request.latest_version} is newer \u2014 read its decisions with get_design (mode "decisions") to see whether it carries the change`
+      ) : `accepted at v${request.accepted_in_version}; the design changes when the follow-up turn completes (latest is v${request.latest_version})`
+    );
+  } else {
+    lines.push(`Request ${request.id} dismissed: ${subject}`);
+    lines.push("The design stays as it is.");
+  }
+  if (request.resolution_note) lines.push(`Note from the reviewer: ${request.resolution_note}`);
+  return ok(structured, lines.join("\n"));
+}
+
 // src/tools/critique.ts
-import * as z3 from "zod/v4";
-var input2 = z3.object({
-  architecture_json: z3.looseObject({
-    title: z3.string(),
-    description: z3.string(),
-    components: z3.array(z3.looseObject({ id: z3.string(), name: z3.string(), type: z3.string() })),
-    connections: z3.array(z3.looseObject({ source: z3.string(), target: z3.string() }))
+import * as z5 from "zod/v4";
+var input3 = z5.object({
+  architecture_json: z5.looseObject({
+    title: z5.string(),
+    description: z5.string(),
+    components: z5.array(z5.looseObject({ id: z5.string(), name: z5.string(), type: z5.string() })),
+    connections: z5.array(z5.looseObject({ source: z5.string(), target: z5.string() }))
   }).optional().describe(
     "A design to check. Free and deterministic \u2014 no model call. The shape SkeletIQ uses: title, description, components[{id,name,type,technology?}], connections[{source,target,protocol?}]."
   ),
-  domain: z3.string().optional().describe(
+  domain: z5.string().optional().describe(
     "The design's domain \u2014 e-commerce, fintech, healthcare, saas, social, iot, gaming, infrastructure, streaming, logistics, ai-ml, search, data-analytics, content-platform, internal-tool. Worth sending: the domain is what selects the compliance frameworks to check against, and without it none apply, so no compliance finding is possible and the score comes back higher than the SkeletIQ app would show for the same design \u2014 by up to 15 points."
   ),
-  secondary_domains: z3.array(z3.string()).max(8).optional().describe(
+  secondary_domains: z5.array(z5.string()).max(8).optional().describe(
     "Further domains the design spans, when it spans more than one \u2014 a multi-tenant shop that takes payments is e-commerce plus fintech and saas. These add the design checks that domain usually needs, as advice; they select no compliance frameworks. Only the primary domain's frameworks and the ones the user named are checked, so name a framework in the prompt when it must apply. frameworks_checked says which were used."
   ),
-  exposure: z3.enum(["public_internet", "private_network", "air_gapped"]).optional().describe(
+  exposure: z5.enum(["public_internet", "private_network", "air_gapped"]).optional().describe(
     "Where the design runs. Worth sending: four checks \u2014 CDN, WAF, rate limiting and multi-region \u2014 ask whether traffic arriving from the public internet is handled safely, and they only apply to a system that takes any. Left unset, the design is assessed as internet-facing, which is why an air-gapped design comes back told to add a CDN. exposure_assessed says which exposure was actually used."
   )
 });
 var SCORE_BASIS_FINDINGS_ONLY = "findings_only";
 var SCORE_BASIS_NOTE = "This score is findings only. It is not held to a traceability ceiling, because this tool is given a design and no requirement set to trace it against. The app can show a lower number for the same stored design for exactly that reason.";
-var output2 = z3.object({
-  architecture_score: z3.number(),
-  score_basis: z3.literal(SCORE_BASIS_FINDINGS_ONLY).describe(SCORE_BASIS_NOTE),
-  security_score: z3.number(),
-  performance_score: z3.number(),
-  resilience_score: z3.number(),
-  data_score: z3.number(),
-  findings: z3.array(
-    z3.object({
-      severity: z3.string(),
-      category: z3.string(),
-      message: z3.string(),
-      affected_components: z3.array(z3.string()),
-      remediation: z3.string(),
-      advisory_only: z3.boolean().describe(
+var output3 = z5.object({
+  architecture_score: z5.number(),
+  score_basis: z5.literal(SCORE_BASIS_FINDINGS_ONLY).describe(SCORE_BASIS_NOTE),
+  security_score: z5.number(),
+  performance_score: z5.number(),
+  resilience_score: z5.number(),
+  data_score: z5.number(),
+  findings: z5.array(
+    z5.object({
+      severity: z5.string(),
+      category: z5.string(),
+      message: z5.string(),
+      affected_components: z5.array(z5.string()),
+      remediation: z5.string(),
+      advisory_only: z5.boolean().describe(
         "True for advice: reported and never charged against the score \u2014 a framework nobody named, or a check too uncertain to count. Not a problem to fix."
       )
     })
   ),
-  finding_count: z3.number(),
-  compliance_assessed: z3.boolean().describe("False means no compliance framework was checked, so no compliance finding was possible."),
-  frameworks_checked: z3.array(z3.string()),
-  compliance_note: z3.string().nullable(),
-  exposure_assessed: z3.string().describe(
+  finding_count: z5.number(),
+  compliance_assessed: z5.boolean().describe("False means no compliance framework was checked, so no compliance finding was possible."),
+  frameworks_checked: z5.array(z5.string()),
+  compliance_note: z5.string().nullable(),
+  exposure_assessed: z5.string().describe(
     "The exposure this critique was actually run under. An absent or unreadable exposure is assessed as public_internet, so a value the server could not read shows up here rather than arriving silently as four extra security findings."
   )
 });
@@ -1117,8 +1475,8 @@ function registerCritique(server, client) {
     {
       title: "Critique an architecture",
       description: "Check a design against SkeletIQ's architecture rules and get scored findings back. Deterministic and free \u2014 no model call, no credits, nothing stored. Useful on a design you drafted yourself before committing to it.",
-      inputSchema: input2,
-      outputSchema: output2,
+      inputSchema: input3,
+      outputSchema: output3,
       annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true }
     },
     async ({ architecture_json, domain, secondary_domains, exposure }) => guard(async () => {
@@ -1159,7 +1517,7 @@ function registerCritique(server, client) {
         exposure_assessed: exposureAssessed
       };
       const lines = [
-        `Architecture ${round(critique.architecture_score)}/100 \xB7 security ${round(critique.security_score)} \xB7 performance ${round(critique.performance_score)} \xB7 resilience ${round(critique.resilience_score)} \xB7 data ${round(critique.data_score)}`,
+        `Design quality ${round(critique.architecture_score)}/100 \xB7 security ${round(critique.security_score)} \xB7 performance ${round(critique.performance_score)} \xB7 resilience ${round(critique.resilience_score)} \xB7 data ${round(critique.data_score)}`,
         SCORE_BASIS_NOTE,
         "",
         // An agent that reads only the text has to see this too. Without it, "the app
@@ -1209,7 +1567,7 @@ function round(value) {
 
 // src/tools/generate.ts
 import { randomUUID } from "crypto";
-import * as z4 from "zod/v4";
+import * as z6 from "zod/v4";
 
 // src/http/sse.ts
 async function* readSseFrames(response) {
@@ -1285,65 +1643,65 @@ function frameDetail(frame) {
   }
   return parts.length > 0 ? parts.join(", ") : void 0;
 }
-var constraintsInput = z4.strictObject({
-  budget: z4.enum(["low", "medium", "high", "unlimited"]).optional(),
-  max_latency_ms: z4.number().int().positive().optional(),
+var constraintsInput = z6.strictObject({
+  budget: z6.enum(["low", "medium", "high", "unlimited"]).optional(),
+  max_latency_ms: z6.number().int().positive().optional(),
   // Free strings, not an enum, and the description has to say why. SkeletIQ assesses five
   // frameworks; naming anything else is still worth doing, because an unassessed regime is
   // recorded and reaches the design brief as a requirement the agent still has to satisfy.
   // The old text read 'e.g. HIPAA, SOC2, PCI-DSS, GDPR' — it omitted SOX, which is the one
   // an agent is least likely to guess, and said nothing about what happens to the rest.
-  compliance: z4.array(z4.string()).optional().describe(
+  compliance: z6.array(z6.string()).optional().describe(
     "Regimes the design must satisfy. SOC2, HIPAA, PCI-DSS, GDPR and SOX are checked against requirement catalogues; any other regime is recorded and carried into the design brief as a requirement to satisfy, rather than checked."
   ),
-  preferred_cloud: z4.enum(["aws", "gcp", "azure", "any"]).optional(),
-  preferred_technologies: z4.array(z4.string()).optional(),
-  max_components: z4.number().int().positive().optional(),
-  read_write_mix: z4.enum(["read_heavy", "balanced", "write_heavy"]).optional().describe(
+  preferred_cloud: z6.enum(["aws", "gcp", "azure", "any"]).optional(),
+  preferred_technologies: z6.array(z6.string()).optional(),
+  max_components: z6.number().int().positive().optional(),
+  read_write_mix: z6.enum(["read_heavy", "balanced", "write_heavy"]).optional().describe(
     "Wins over any share stated in the prompt, which the server also reads. Unset and unstated, the design assumes 80% reads. It sizes components and weights read replicas, so on a read-heavy design it changes the instance counts and the cost."
   ),
-  burstiness: z4.enum(["steady", "daily_peaks", "spiky"]).optional().describe(
+  burstiness: z6.enum(["steady", "daily_peaks", "spiky"]).optional().describe(
     'Wins over a peak the prompt states ("peaking at 2,000 per second"), which the server also reads. Unset and unstated, the design assumes a typical peak for its scale.'
   ),
-  data_retention: z4.enum(["days", "months", "years", "indefinite"]).optional(),
-  consistency: z4.enum(["strict", "eventual", "mixed"]).optional(),
-  data_residency: z4.enum(["any", "us", "eu"]).optional(),
-  transfer_band: z4.enum(["light", "moderate", "heavy", "very_heavy", "massive"]).optional().describe(
+  data_retention: z6.enum(["days", "months", "years", "indefinite"]).optional(),
+  consistency: z6.enum(["strict", "eventual", "mixed"]).optional(),
+  data_residency: z6.enum(["any", "us", "eu"]).optional(),
+  transfer_band: z6.enum(["light", "moderate", "heavy", "very_heavy", "massive"]).optional().describe(
     "How much data the system sends out to its users a month: light ~100 GB, moderate ~1 TB, heavy ~10 TB, very_heavy ~100 TB, massive ~1 PB. Priced at the cloud's published per-GB rates. Unset, data transfer is left out of the price and the estimate says so. Set this or monthly_transfer_gb, not both."
   ),
-  monthly_transfer_gb: z4.number().min(0).max(1e8).optional().describe(
+  monthly_transfer_gb: z6.number().min(0).max(1e8).optional().describe(
     "The same thing as a figure: GB a month sent out to users. Set this or transfer_band, not both."
   )
 });
-var generateInput = z4.object({
-  prompt: z4.string().min(1).max(2e4).describe("What to design. Describe the system, its scale and its constraints in prose."),
-  project_id: z4.string().optional().describe("An existing SkeletIQ project id to add a version to. Omit to start a new project."),
-  wait: z4.boolean().optional().describe(
+var generateInput = z6.object({
+  prompt: z6.string().min(1).max(2e4).describe("What to design. Describe the system, its scale and its constraints in prose."),
+  project_id: z6.string().optional().describe("An existing SkeletIQ project id to add a version to. Omit to start a new project."),
+  wait: z6.boolean().optional().describe(
     "Default true: run inline and return the finished design (this takes several minutes). False queues it as a background job and returns a job_id to poll \u2014 not available on every deployment."
   ),
-  clarification_answers: z4.record(z4.string(), z4.string()).optional().describe(
+  clarification_answers: z6.record(z6.string(), z6.string()).optional().describe(
     'Answers to the questions a previous call returned with status "clarification_required", keyed by their ids. Treated as authoritative requirements, so send what the user told you \u2014 ask them rather than guessing. "Not sure yet" is a real answer to the load question and to the data-sent-out question when they do not know the figure.'
   ),
   constraints: constraintsInput.optional().describe(
     "Facts about the design that the prose does not have to carry. Anything omitted is assumed by SkeletIQ, and the design says which values were assumed."
   )
 });
-var generateOutput = z4.object({
-  status: z4.string().describe("completed | clarification_required, or the queue state on wait: false"),
-  project_id: z4.string().nullable(),
-  architecture_id: z4.string().nullable(),
-  version: z4.number().nullable(),
-  job_id: z4.string().nullable(),
-  title: z4.string().nullable(),
-  component_count: z4.number().nullable(),
-  assistant_message: z4.string().nullable(),
-  degradations: z4.array(z4.string()),
+var generateOutput = z6.object({
+  status: z6.string().describe("completed | clarification_required, or the queue state on wait: false"),
+  project_id: z6.string().nullable(),
+  architecture_id: z6.string().nullable(),
+  version: z6.number().nullable(),
+  job_id: z6.string().nullable(),
+  title: z6.string().nullable(),
+  component_count: z6.number().nullable(),
+  assistant_message: z6.string().nullable(),
+  degradations: z6.array(z6.string()),
   /**
    * The server's sentence when part of what the model was given had to be cut to fit its input
    * window — a source left out, or the current design summarised — and null otherwise. The design
    * is still complete; this says what it was written without.
    */
-  prompt_trim_note: z4.string().nullable(),
+  prompt_trim_note: z6.string().nullable(),
   /**
    * Present, and non-empty, only on `status: "clarification_required"`. A refusal is a
    * *result* here rather than an error: an error result may carry no `structuredContent` at
@@ -1351,38 +1709,46 @@ var generateOutput = z4.object({
    * hand the agent the one thing it cannot act on — a sentence saying detail is missing,
    * without saying which.
    */
-  clarifying_questions: z4.array(
-    z4.object({
-      id: z4.string(),
-      question: z4.string(),
-      why: z4.string(),
-      options: z4.array(z4.string())
+  clarifying_questions: z6.array(
+    z6.object({
+      id: z6.string(),
+      question: z6.string(),
+      why: z6.string(),
+      options: z6.array(z6.string()),
+      /** The contract field the answer resolves; null when the question is not a fork. */
+      fork: z6.string().nullable(),
+      /** Ask only once `question_id` is answered with one of `values`; null when always asked. */
+      asked_if: z6.object({ question_id: z6.string(), values: z6.array(z6.string()) }).nullable()
     })
   )
 });
-var statusInput = z4.object({
-  job_id: z4.string().describe("The job_id returned by generate_architecture with wait: false.")
+var statusInput = z6.object({
+  job_id: z6.string().describe("The job_id returned by generate_architecture with wait: false.")
 });
-var statusOutput = z4.object({
-  job_id: z4.string(),
-  status: z4.string(),
-  project_id: z4.string().nullable(),
-  architecture_id: z4.string().nullable(),
-  error: z4.string().nullable(),
-  queue_state: z4.string().nullable(),
+var statusOutput = z6.object({
+  job_id: z6.string(),
+  status: z6.string(),
+  project_id: z6.string().nullable(),
+  architecture_id: z6.string().nullable(),
+  error: z6.string().nullable(),
+  queue_state: z6.string().nullable(),
   /**
    * Set when the run was *declined* rather than broken — the same three refusals the inline
    * path answers with a 409. Nothing ran and nothing was charged, so the next call is a
    * normal one, not a retry.
    */
-  refusal_code: z4.string().nullable(),
+  refusal_code: z6.string().nullable(),
   /** Non-empty only for a `CLARIFICATION_REQUIRED` refusal. */
-  clarifying_questions: z4.array(
-    z4.object({
-      id: z4.string(),
-      question: z4.string(),
-      why: z4.string(),
-      options: z4.array(z4.string())
+  clarifying_questions: z6.array(
+    z6.object({
+      id: z6.string(),
+      question: z6.string(),
+      why: z6.string(),
+      options: z6.array(z6.string()),
+      /** The contract field the answer resolves; null when the question is not a fork. */
+      fork: z6.string().nullable(),
+      /** Ask only once `question_id` is answered with one of `values`; null when always asked. */
+      asked_if: z6.object({ question_id: z6.string(), values: z6.array(z6.string()) }).nullable()
     })
   )
 });
@@ -1453,7 +1819,7 @@ function decisionRefusal(progress) {
   return refusal.success ? refusal.data : void 0;
 }
 function refusalQuestions(refusal) {
-  return (refusal?.clarifying_questions ?? []).map(offeredQuestion);
+  return orderQuestions(refusal?.clarifying_questions ?? []).map(offeredQuestion);
 }
 function offeredQuestion(question) {
   const options = answerOptions(question);
@@ -1469,18 +1835,50 @@ function offeredQuestion(question) {
       const said = detail.label && detail.label !== option ? `${option} (${detail.label})` : option;
       return [detail.detail ? `${said}: ${detail.detail}` : said];
     }),
-    skipEffect: question.skip_effect ?? ""
+    skipEffect: question.skip_effect ?? "",
+    fork: question.fork ?? "",
+    askedIf: question.asked_if ?? void 0
   };
 }
+function orderQuestions(questions) {
+  const ids = new Set(questions.map((question) => question.id));
+  const placed = /* @__PURE__ */ new Set();
+  const ordered = [];
+  const place = (question) => {
+    if (placed.has(question)) return;
+    placed.add(question);
+    ordered.push(question);
+    for (const child of questions) {
+      if (child.asked_if?.question_id === question.id) place(child);
+    }
+  };
+  for (const question of questions) {
+    if (!question.asked_if) place(question);
+  }
+  for (const question of questions) {
+    if (question.asked_if && !ids.has(question.asked_if.question_id)) place(question);
+  }
+  for (const question of questions) place(question);
+  return ordered;
+}
 function structuredQuestion(question) {
-  return { id: question.id, question: question.question, why: question.why, options: question.options };
+  return {
+    id: question.id,
+    question: question.question,
+    why: question.why,
+    options: question.options,
+    fork: question.fork || null,
+    asked_if: question.askedIf ?? null
+  };
 }
 function questionLines(questions) {
   return questions.flatMap((question) => [
     `${question.id}: ${question.question}`,
     ...question.why ? [`  Why it matters: ${question.why}`] : [],
     ...question.explained.length > 0 ? ["  Answers:", ...question.explained.map((line) => `  - ${line}`)] : question.options.length > 0 ? [`  For example: ${question.options.join(" \xB7 ")}`] : [],
-    ...question.skipEffect ? [`  If it is left unanswered: ${question.skipEffect}`] : []
+    ...question.skipEffect ? [`  If it is left unanswered: ${question.skipEffect}`] : [],
+    ...question.fork ? [`  Resolves: ${question.fork}`] : [],
+    ...question.askedIf ? [`  Ask only if ${question.askedIf.question_id} is answered ${question.askedIf.values.join(" or ")}`] : []
   ]);
 }
 function answerOptions(question) {
@@ -1519,7 +1917,7 @@ function clarifyingQuestions(error) {
   return questions && questions.length > 0 ? questions : void 0;
 }
 function clarificationResult(questions) {
-  const offered = questions.map(offeredQuestion);
+  const offered = orderQuestions(questions).map(offeredQuestion);
   const structured = offered.map(structuredQuestion);
   const lines = [
     "SkeletIQ will not design from this prompt yet \u2014 it is missing something the design would otherwise have to invent, such as the system itself or the load it carries. Nothing was generated and nothing was charged.",
@@ -1651,7 +2049,7 @@ async function describeCreated(resolver, architectureId) {
 }
 
 // src/tools/get-design.ts
-import * as z5 from "zod/v4";
+import * as z7 from "zod/v4";
 
 // src/lib/slice.ts
 function sliceComponent(design, componentId, ledger) {
@@ -1773,6 +2171,8 @@ function overview(design, ledger) {
     // strings every existing caller reads.
     assumed_decisions: assumedAmong(design, decisions),
     trade_offs: design.trade_offs ?? [],
+    bypassed_connections: design.bypassed_connections ?? [],
+    platform_decisions: design.platform_decisions ?? [],
     // Carried verbatim, rows in the server's order, and only when the version has one. This is
     // a rebuild from named keys, so anything not named here is dropped without a trace — which
     // is how `grounded_decisions` went missing for two releases. Re-sorting the rows on the way
@@ -1780,37 +2180,69 @@ function overview(design, ledger) {
     ...ledger ? { requirement_ledger: ledger } : {}
   };
 }
+var MAX_REPLACED_SHOWN = 10;
+function policySummary(policies) {
+  return Object.entries(policies).filter(([, value]) => value !== null && value !== void 0).map(([key, value]) => `${key}=${typeof value === "object" ? JSON.stringify(value) : String(value)}`).join(", ");
+}
+function platformPartLines(component) {
+  const lines = [];
+  const role = component.platform_role;
+  const satisfies = component.satisfies ?? [];
+  if (role || component.platform_origin || component.layer === "platform" || satisfies.length > 0) {
+    const origin = component.platform_origin === "realized" ? "added for you" : component.platform_origin === "adopted" ? "adopted" : component.platform_origin;
+    const label = origin ? ` (${origin})` : "";
+    const satisfied = satisfies.length > 0 ? `; satisfies ${satisfies.join(", ")}` : "";
+    lines.push(`Platform part${label}: ${role ?? "unspecified"}${satisfied}`);
+  }
+  const summary = component.policies ? policySummary(component.policies) : "";
+  if (summary) lines.push(`Policies: ${summary}`);
+  return lines;
+}
+function platformReplacedLines(design) {
+  const bypassed = design.bypassed_connections ?? [];
+  if (bypassed.length === 0) return [];
+  const shown = bypassed.slice(0, MAX_REPLACED_SHOWN).map((c) => `- ${c.source} \u2192 ${c.target}`);
+  const more = bypassed.length - MAX_REPLACED_SHOWN;
+  return [
+    "Connections the platform layer replaced:",
+    ...shown,
+    ...more > 0 ? [`and ${more} more`] : []
+  ];
+}
 function normalize(value) {
   return value.toLowerCase().replace(/[^a-z0-9]+/g, "");
 }
 
 // src/tools/get-design.ts
-var MODES = ["overview", "component", "brief", "todo", "readiness", "build_order", "gaps"];
-var input3 = z5.object({
-  project_id: z5.string().describe("A SkeletIQ project id, or its exact name."),
-  mode: z5.enum(MODES).describe(
-    "overview: the whole design and, where the version records them, the requirements it was built from with what became of each. component: one component, its connections in both directions (the source calls the target), the decisions that mention it, and the requirements the design cites it for. brief: the fenced markdown block to write into AGENTS.md. todo: everything still to do on this version, one card per problem \u2014 what blocks a handoff, what is recommended, and what is waiting to be accepted. readiness: the verdict, gate by gate, on whether this design is worth building yet. build_order: the order to build components in, and why. gaps: the open questions and unconfirmed assumptions in the design."
+var MODES = ["overview", "component", "brief", "todo", "readiness", "build_order", "gaps", "fitness", "decisions"];
+var input4 = z7.object({
+  project_id: z7.string().describe("A SkeletIQ project id, or its exact name."),
+  mode: z7.enum(MODES).describe(
+    "overview: the whole design and, where the version records them, the requirements it was built from with what became of each. component: one component, its connections in both directions (the source calls the target), the decisions that mention it, and the requirements the design cites it for. brief: the fenced markdown block to write into AGENTS.md. todo: everything still to do on this version, one card per problem \u2014 what blocks a handoff, what is recommended, and what is waiting to be accepted. readiness: the verdict, gate by gate, on whether this design is worth building yet. build_order: the order to build components in, and why. gaps: the open questions and unconfirmed assumptions in the design. fitness: the tests to write in your own repo, each with the id to report back through check_drift. decisions: the design's decisions, each with its id, choice, reasons and any removed basis."
   ),
-  component_id: z5.string().optional().describe('Required for mode "component". The component id, or its name.'),
-  version: z5.number().int().positive().optional().describe("A specific version. Defaults to the latest released version, or the latest version if none is released.")
+  component_id: z7.string().optional().describe('Required for mode "component". The component id, or its name.'),
+  version: z7.number().int().positive().optional().describe("A specific version. Defaults to the latest released version, or the latest version if none is released.")
 });
-var output3 = z5.object({
-  project_id: z5.string(),
-  architecture_id: z5.string(),
-  version: z5.number(),
-  is_released: z5.boolean(),
-  newer_release_exists: z5.boolean(),
-  resolved_by: z5.string(),
-  mode: z5.string(),
+var output4 = z7.object({
+  project_id: z7.string(),
+  architecture_id: z7.string(),
+  version: z7.number(),
+  is_released: z7.boolean(),
+  newer_release_exists: z7.boolean(),
+  resolved_by: z7.string(),
+  mode: z7.string(),
   /** Mode-shaped. Deliberately loose: six modes cannot share one strict schema honestly. */
-  data: z5.unknown()
+  data: z7.unknown()
 });
 function decisionsHeading(assumed, settled, withAssumptions) {
   return assumed.length > 0 ? withAssumptions : settled;
 }
-function decisionLines(decisions, assumed) {
+function decisionLines(decisions, assumed, platform = []) {
   const marked = new Set(assumed);
-  return decisions.map((decision) => `- ${decision}${marked.has(decision) ? " (assumption)" : ""}`);
+  const added = new Set(platform.map((text) => text.trim()));
+  return decisions.map(
+    (decision) => `- ${decision}${marked.has(decision) ? " (assumption)" : ""}${added.has(decision.trim()) ? " (platform)" : ""}`
+  );
 }
 function registerGetDesign(server, client, resolver) {
   server.registerTool(
@@ -1818,8 +2250,8 @@ function registerGetDesign(server, client, resolver) {
     {
       title: "Read a SkeletIQ design",
       description: 'Read a SkeletIQ architecture. Start with mode "brief" to orient \u2014 it returns a fenced block to write into AGENTS.md \u2014 then "todo" for what the design still needs, "build_order" for the sequence and "component" for each piece as you build it. Where a version records its requirements, "overview" and "component" also resolve the R-ids the design carries to the requirements they name, and say what became of each. Every answer states which version it came from and whether that version is a release.',
-      inputSchema: input3,
-      outputSchema: output3,
+      inputSchema: input4,
+      outputSchema: output4,
       annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true }
     },
     async ({ project_id, mode, component_id, version }) => guard(async () => {
@@ -1843,6 +2275,7 @@ function registerGetDesign(server, client, resolver) {
             ...data.components.map(
               (c) => `- ${c.id} \u2014 ${c.name} (${c.type}${c.technology ? `, ${c.technology}` : ""})`
             ),
+            ...data.bypassed_connections.length ? ["", ...platformReplacedLines(data)] : [],
             // Above the decisions because the two answer different questions, in
             // this order: requirements are what was asked for, decisions are how
             // the design answered.
@@ -1859,7 +2292,7 @@ function registerGetDesign(server, client, resolver) {
                 "Decisions taken \u2014 these are settled, build to them:",
                 "Decisions taken \u2014 build to them; confirm the ones marked (assumption) first, they rest on no cited source:"
               ),
-              ...decisionLines(data.design_decisions, data.assumed_decisions)
+              ...decisionLines(data.design_decisions, data.assumed_decisions, data.platform_decisions)
             ] : [],
             ...data.trade_offs.length ? [
               "",
@@ -1888,6 +2321,7 @@ function registerGetDesign(server, client, resolver) {
             `## ${component.name} (${component.id})`,
             `Type: ${component.type}${component.technology ? ` \xB7 ${component.technology}` : ""}`,
             component.description ?? "",
+            ...platformPartLines(component),
             "",
             outgoing.length ? `Calls: ${outgoing.map((c) => `${c.target}${c.protocol ? ` (${c.protocol})` : ""}`).join(", ")}` : "Calls nothing.",
             incoming.length ? `Called by: ${incoming.map((c) => c.source).join(", ")}` : "Called by nothing in the design.",
@@ -1986,10 +2420,16 @@ function registerGetDesign(server, client, resolver) {
           );
           const unrun = new Set(readiness.unrun_checks ?? []);
           const verdict = readiness.verdict ?? (readiness.ready ? "ready" : "outstanding");
-          const headline = verdict === "ready" ? "Every gate is clear \u2014 this design is ready to build." : verdict === "unanswered" ? `Nothing is undecided, but ${unanswered.length} check(s) could not be answered for this version:` : `${open.length} of ${gates.length} gate(s) still open:`;
+          const gateLine = verdict === "ready" ? "Every gate is clear \u2014 this design is ready to build." : verdict === "unanswered" ? `Nothing is undecided, but ${unanswered.length} check(s) could not be answered for this version:` : `${open.length} of ${gates.length} gate(s) still open:`;
           const listed = verdict === "unanswered" ? unanswered : open;
+          const summary = readiness.headline;
           return ok({ ...base, ...facts, data: readiness }, [
-            headline,
+            ...summary ? [
+              `${summary.met} of ${summary.total} met \xB7 ${summary.verdict.charAt(0).toUpperCase()}${summary.verdict.slice(1)} \xB7 score ${Math.round(summary.score)}`,
+              ...summary.rules_updated ? ["Rules updated since this check"] : [],
+              ""
+            ] : [],
+            gateLine,
             ...listed.map((row) => `- ${row.label}: ${describeRow(row)}`),
             ...unconfirmedGates.length ? [
               "",
@@ -2045,6 +2485,80 @@ function registerGetDesign(server, client, resolver) {
             versionLine(facts)
           ].join("\n"));
         }
+        case "fitness": {
+          const facts = factsFrom(resolved);
+          let body;
+          try {
+            body = await client.request(`/architectures/${resolved.architectureId}/fitness-tests`);
+          } catch (error) {
+            if (error instanceof SkeletiqApiError && error.status === 404) {
+              return ok({ ...base, ...facts, data: { tests: [] } }, [
+                "This SkeletIQ server does not serve fitness tests yet.",
+                versionLine(facts)
+              ].join("\n"));
+            }
+            throw error;
+          }
+          const fitness = FitnessTestsSchema.parse(body);
+          if (fitness.unavailable) {
+            return ok({ ...base, ...facts, data: fitness }, [fitness.unavailable, versionLine(facts)].join("\n"));
+          }
+          const note = schemaNote(fitness.schema_version);
+          return ok({ ...base, ...facts, data: fitness }, [
+            ...note ? [note, ""] : [],
+            fitness.tests.length === 0 ? "This version has no fitness tests to write." : "Write these tests in your own repo. Each is a spec, not code. Report each result through check_drift, in `fitness`, under its test_id.",
+            ...fitness.truncated ? [`Showing ${fitness.tests.length} of ${fitness.total}.`] : [],
+            ...fitness.tests.flatMap((test) => [
+              "",
+              `- ${test.subject_names.join(", ") || test.subject_ids.join(", ") || "whole design"} [${test.level}]`,
+              `  assert: ${test.assertion}`,
+              `  check: ${test.check}`,
+              `  test_id: ${test.id}`
+            ]),
+            "",
+            versionLine(facts)
+          ].join("\n"));
+        }
+        case "decisions": {
+          const facts = factsFrom(resolved);
+          let body;
+          try {
+            body = await client.request(`/architectures/${resolved.architectureId}/decisions`);
+          } catch (error) {
+            if (error instanceof SkeletiqApiError && error.status === 403) {
+              return ok({ ...base, ...facts, data: { records: [] } }, [
+                "This SkeletIQ server does not share decisions with tokens yet.",
+                versionLine(facts)
+              ].join("\n"));
+            }
+            throw error;
+          }
+          const decisions = DecisionsViewResponseSchema.parse(body);
+          if (decisions.records.length === 0) {
+            return ok({ ...base, ...facts, data: decisions }, [
+              decisions.status === "unavailable" ? `This version's decisions could not be read (${decisions.reason ?? "unknown"}).` : "This version records no decisions.",
+              versionLine(facts)
+            ].join("\n"));
+          }
+          return ok({ ...base, ...facts, data: decisions }, [
+            ...decisions.records.flatMap((record4) => {
+              const chosen = record4.options.find((option) => option.id === record4.chosen);
+              const rejected = record4.options.filter((option) => option.id !== record4.chosen);
+              return [
+                "",
+                `- ${record4.id}: ${record4.title}`,
+                `  chosen: ${chosen?.label ?? record4.chosen}`,
+                `  why: ${record4.why}`,
+                ...rejected.map(
+                  (option) => `  rejected: ${option.label}${option.rejected_because ? ` (${option.rejected_because})` : ""}`
+                ),
+                ...record4.basis_removed.length > 0 ? [`  cites removed requirement ${record4.basis_removed.join(", ")}; ask before building on it`] : []
+              ];
+            }),
+            "",
+            versionLine(facts)
+          ].join("\n"));
+        }
         case "gaps": {
           const body = await client.request(`/projects/${project.id}/design-gaps`, {
             query: { architecture_id: resolved.architectureId }
@@ -2070,7 +2584,7 @@ function registerGetDesign(server, client, resolver) {
             ...orphaned.length ? [
               "",
               `${orphaned.length} earlier answer(s) do not match any question in this version \u2014 re-worded or dropped when it was generated, or asked only in a different version. Any Decision they minted still stands.`,
-              ...orphaned.filter((answer) => answer.adr_id).map((answer) => `- [${answer.kind}] ${answer.action} \u2192 Decision ${answer.adr_id}`)
+              ...orphaned.filter((answer2) => answer2.adr_id).map((answer2) => `- [${answer2.kind}] ${answer2.action} \u2192 Decision ${answer2.adr_id}`)
             ] : [],
             "",
             "The unresolved ones are questions for a person, not for you to answer. Raise",
@@ -2103,6 +2617,7 @@ function requirementBlock(ledger) {
     "established either way, and neither is fine. `cited by nothing` means no component and no",
     "decision in the design claims to address it.",
     ...unconfirmedLegend(rows),
+    ...proposedLegend(rows),
     // Two facts about how far the statuses can be trusted, said only when the server states
     // them. An absent `verification_state` is an older server, not a verifier that did not run,
     // and claiming the second would be this package inventing a fact about someone's design.
@@ -2120,6 +2635,9 @@ function requirementBlock(ledger) {
     ...ledger.analysis_degraded ? ["The requirements analysis for this version ran degraded. Treat the list as incomplete."] : []
   ];
 }
+function proposedLegend(rows) {
+  return rows.some((row) => row.origin === "proposed") ? ["[proposed] = suggested by the design, not asked for; treat as optional."] : [];
+}
 function unconfirmedLegend(rows) {
   const words = new Set(rows.filter(isUnconfirmedRequirement).map(requirementVerdict));
   const reasons = new Set(
@@ -2156,7 +2674,8 @@ function requirementsServed(rows) {
     ...rows.map(requirementLine),
     "`fails` \u2014 a named check measured the design as not meeting it; `not_checked` \u2014 nobody",
     "established either way; `no_gap_found` \u2014 nothing contradicted it, which is not the same as proven.",
-    ...unconfirmedLegend(rows)
+    ...unconfirmedLegend(rows),
+    ...proposedLegend(rows)
   ];
 }
 function requirementsWithdrawn(rows) {
@@ -2178,7 +2697,8 @@ function requirementLine(row) {
   const reason = (row.verdict_reason ?? "").replace(/\s+/g, " ").trim();
   const by = (row.checked_by ?? "").trim();
   const because = reason ? ` \u2014 ${reason}${by ? ` (checked by ${by})` : ""}` : by ? ` \u2014 checked by ${by}` : "";
-  return `- ${row.id}${label} ${text || "(no text recorded for this requirement)"}${because}`;
+  const proposed = row.origin === "proposed" ? "[proposed] " : "";
+  return `- ${row.id}${label} ${proposed}${text || "(no text recorded for this requirement)"}${because}`;
 }
 function settledAnswer(gap) {
   const note = (gap.note ?? "").trim();
@@ -2217,21 +2737,21 @@ function describeRow(row) {
 }
 
 // src/tools/list-projects.ts
-import * as z6 from "zod/v4";
-var input4 = z6.object({
-  query: z6.string().optional().describe("Filter by name or description. Omit to list everything the token can see.")
+import * as z8 from "zod/v4";
+var input5 = z8.object({
+  query: z8.string().optional().describe("Filter by name or description. Omit to list everything the token can see.")
 });
-var output4 = z6.object({
-  projects: z6.array(
-    z6.object({
-      id: z6.string(),
-      title: z6.string(),
-      description: z6.string().nullable(),
-      architecture_count: z6.number(),
-      updated_at: z6.string().nullable()
+var output5 = z8.object({
+  projects: z8.array(
+    z8.object({
+      id: z8.string(),
+      title: z8.string(),
+      description: z8.string().nullable(),
+      architecture_count: z8.number(),
+      updated_at: z8.string().nullable()
     })
   ),
-  total: z6.number()
+  total: z8.number()
 });
 function registerListProjects(server, resolver) {
   server.registerTool(
@@ -2239,8 +2759,8 @@ function registerListProjects(server, resolver) {
     {
       title: "List SkeletIQ projects",
       description: "List the SkeletIQ projects this token can see, optionally filtered by name. Use this first to turn a project a person named in conversation into an id. If more than one project matches, ask which \u2014 do not pick one.",
-      inputSchema: input4,
-      outputSchema: output4,
+      inputSchema: input5,
+      outputSchema: output5,
       annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true }
     },
     async ({ query }) => guard(async () => {
@@ -2302,6 +2822,7 @@ function buildServer(client, resolver) {
   registerGenerate(server, client, resolver);
   registerCritique(server, client);
   registerCheckDrift(server, client, resolver);
+  registerRequestDecisionChange(server, client, resolver);
   return server;
 }