@skyramp/mcp 0.3.4 → 0.3.6-rc.1

package/build/prompts/test-recommendation/diffExecutionPlan.js

@@ -1,12 +1,12 @@
-import { roundRobinByType } from "../../recommendation/diversity.js";
+import { CandidateSource, computeCandidateId } from "../../types/Recommendation.js";
+import { fixedNBudgeter } from "../../recommendation/budgeters/fixedNBudgeter.js";
 import { AUTH_MIDDLEWARE_PATTERNS_STR } from "../../utils/workspaceAuth.js";
 import { resolveServiceDetailsRef } from "../../utils/utils.js";
-import { logger } from "../../utils/logger.js";
 import { TEST_CATEGORIES, } from "../../types/TestRecommendation.js";
 import { buildScopeAssessmentSection } from "./scopeAssessment.js";
 import { PromptPlan } from "./promptPlan.js";
 import { buildTestPatternGuidelines, buildTestQualityCriteria, buildGenerationRules, MAX_CRITICAL_TESTS, } from "./recommendationSections.js";
-import { TASK_ANALYZE_MAINTAIN, TESTBOT_TASK1_STEP_CODE_REVIEW, externalDedupKey, isAttackSurfaceSecurityBoundary, isOrdinaryDirectAuthBoundary, scenarioCoverageKey, taskStepRef, } from "./recommendationShared.js";
+import { TASK_ANALYZE_MAINTAIN, TESTBOT_TASK1_STEP_CODE_REVIEW, taskStepRef, } from "./recommendationShared.js";
 // ── Step body functions ───────────────────────────────────────────────────────
 function _execCodeReviewBody(_ctx) {
     const codeReviewRef = taskStepRef(TASK_ANALYZE_MAINTAIN, TESTBOT_TASK1_STEP_CODE_REVIEW);
@@ -69,7 +69,7 @@ INSERT a non-bug source-code-derived candidate into the ranked list **only if AL
 3. It is not already covered by a structural candidate in the list below
 
 If these conditions are not met, add it to ADDITIONAL only — do NOT displace a pre-ranked GENERATE item.
-**CRITICAL-tier items (category: new_endpoint) and attack-surface \`security_boundary\` items should never be displaced by non-bug candidates** — they test the actual endpoints introduced in this PR or sibling destructive endpoints that could bypass the changed auth boundary. However, bug-catching tests CAN displace them only after all lower-value non-bug slots are exhausted.
+**Attack-surface \`security_boundary\` items should never be displaced by non-bug candidates** — they test sibling destructive endpoints that could bypass the changed auth boundary. However, bug-catching tests CAN displace them only after all lower-value non-bug slots are exhausted.
 
 When a qualifying candidate is inserted: place it HIGH before MEDIUM before LOW; within the same priority, source-code-derived candidates go BEFORE structural ones. Re-number ranks after insertion. The top ${ctx.maxGen} ranked items become GENERATE candidates.
 
@@ -80,8 +80,8 @@ When a qualifying candidate is inserted: place it HIGH before MEDIUM before LOW;
 function _execDiversityBody(_ctx) {
     return `**Bug-coverage gate (runs BEFORE dedup):**
 Verify that the highest-severity \`<bug_found>\` flaw from Step ${EXEC_STEP_CODE_REVIEW} has exactly one GENERATE item with category \`bug_caught\` targeting it — meaning the test would FAIL on the current buggy code and PASS once the flaw is fixed. At most one promotion per run (per Step ${EXEC_STEP_CODE_REVIEW} cap). If the promoted flaw has no targeting \`bug_caught\` GENERATE item:
-- Check ADDITIONAL for a matching test → promote it into the lowest-priority non-bug, non-CRITICAL GENERATE slot first (lowest category rank per \`crud > error_handling > workflow > data_validation > data_integrity > business_rule\`; preserve attack-surface \`security_boundary\` and internal \`new_endpoint\` items unless no lower-priority slot exists).
-- If no ADDITIONAL candidate matches, create a new \`bug_caught\` test and insert it, displacing the lowest-priority non-bug, non-CRITICAL GENERATE item first; displace an attack-surface \`security_boundary\` or other CRITICAL item only when every GENERATE slot is higher priority.
+- Check ADDITIONAL for a matching test → promote it into the lowest-priority non-bug, non-CRITICAL GENERATE slot first (lowest category rank per \`crud > error_handling > workflow > data_validation > data_integrity > business_rule\`; preserve attack-surface \`security_boundary\` items unless no lower-priority slot exists).
+- If no ADDITIONAL candidate matches, create a new \`bug_caught\` test and insert it, displacing the lowest-priority non-bug, non-CRITICAL GENERATE item first; displace an attack-surface \`security_boundary\` item only when every GENERATE slot is higher priority.
 A \`bug_caught\` test is NEVER considered a "duplicate" of a non-bug test during the dedup below.
 
 Each GENERATE item must exercise a **distinct code path** — not just different input values on the same path.
@@ -98,7 +98,7 @@ Same step sequence with only payload differences (e.g. 10% vs 5% discount both r
 function _execRegisterBody(_ctx) {
     return `Register your complete candidate list — every test you would generate OR recommend — via \`skyramp_register_test_plan\` (\`stateFile\` required). Include a discriminator claim (\`discriminator\` field — valid kinds and anchor rules are in the tool schema) for candidates probing the changed logic identified in Step ${EXEC_STEP_CODE_REVIEW}/Step ${EXEC_STEP_ENRICH}.
 
-The returned GENERATE list is mandatory and final — generation tools reject unregistered scenarios. If the tool demotes a discriminator claim (returned in \`demotions\` with a reason), either strengthen the claim — a step that actually exercises the declared \`kind\`, or a verbatim anchor that occurs in the diff — or drop it; the candidate itself stays in the plan either way.`;
+The returned GENERATE list is mandatory and final — generation tools reject unregistered scenarios. If the tool demotes a discriminator claim (returned in \`demotions\` with a reason), either strengthen the claim — a step that actually exercises the declared \`kind\`, or a verbatim anchor that occurs in the diff — or drop it. A demoted candidate normally stays in the plan. If it also left the plan for another recorded reason, the report lists it under "Demoted AND removed".`;
 }
 function _execExecuteBody(ctx) {
     return `Replace any scenario that pairs unrelated resources with one reflecting actual foreign-key relationships in the codebase.
@@ -149,20 +149,6 @@ export const EXEC_STEP_EXECUTE = _execPlan.labels.EXECUTE; // "4"
 /** "5" — Register test plan (SKYR-3879 Path B checkpoint) */
 export const EXEC_STEP_REGISTER = _execPlan.labels.REGISTER; // "5"
 const SERVICE_REFS = resolveServiceDetailsRef();
-function prioritizeAttackSurfaceBundles(items) {
-    const reordered = [];
-    for (const item of items) {
-        if (isAttackSurfaceSecurityBoundary(item.scenario)) {
-            const firstDirectAuthIndex = reordered.findIndex(candidate => isOrdinaryDirectAuthBoundary(candidate.scenario));
-            if (firstDirectAuthIndex >= 0) {
-                reordered.splice(firstDirectAuthIndex, 0, item);
-                continue;
-            }
-        }
-        reordered.push(item);
-    }
-    return reordered;
-}
 export function buildExecutionPlan(scored, maxGen, topN, baseUrl, authHeaderValue, authSchemeSnippet, authTypeValue, seed, endpointCount, isUIOnlyPR, hasFrontendChanges = false, hasTraces = false, externalCoverage = new Set(), relevantExternalTestPaths = [], 
 /**
  * Whether the diff classified at least one new/modified/removed endpoint.
@@ -184,40 +170,58 @@ hasApiChanges = true) {
         : hasFrontendChanges
             ? Math.max(0, maxGen - 1)
             : maxGen;
-    // Filter out scenarios whose primary method + resource + test type is already covered by external tests.
-    // Method-aware: an external test covering GET /orders won't block PUT /orders scenarios.
-    // This is the programmatic complement to the prompt-level Step ${EXEC_STEP_COVERAGE} dedup instructions.
-    const scoredAfterExternalDedup = externalCoverage.size > 0
-        ? scored.filter((item) => {
-            const key = externalDedupKey(item.scenario);
-            if (externalCoverage.has(key)) {
-                if (item.scenario.category === "bug_caught" || isAttackSurfaceSecurityBoundary(item.scenario)) {
-                    logger.info(`External dedup: preserving "${item.scenario.scenarioName}" (${key}) — protected bug/attack-surface scenario requires semantic flaw coverage`);
-                    return true;
-                }
-                logger.info(`External dedup: skipping "${item.scenario.scenarioName}" (${key}) — covered by external test`);
-                return false;
-            }
-            return true;
-        })
-        : scored;
-    const slotOrderedItems = prioritizeAttackSurfaceBundles(scoredAfterExternalDedup);
-    // Distribute the backend GENERATE slots evenly across the test types present
-    // (contract vs integration) with spillover, instead of a pure top-N rank slice —
-    // so a backend change isn't starved of (say) integration coverage just because
-    // contract scenarios out-ranked it. See roundRobinByType.
-    const generateItems = roundRobinByType(slotOrderedItems, Math.min(backendGenerateCount, slotOrderedItems.length));
-    // ADDITIONAL = everything not chosen for GENERATE, in original rank order, capped
-    // at the remaining budget. Computed by set-difference (not a positional slice)
-    // because round-robin may pick items that aren't the first backendGenerateCount by
-    // rank — a positional slice would double-list a generated item or drop one.
-    const generateSet = new Set(generateItems);
-    const rawAdditionalItems = slotOrderedItems
-        .filter((it) => !generateSet.has(it))
-        .slice(0, Math.max(0, topN - backendGenerateCount));
-    // Filter additional items whose primary resource + test type already appear in GENERATE
-    const generatedCoverage = new Set(generateItems.map((item) => scenarioCoverageKey(item.scenario)));
-    const additionalItems = rawAdditionalItems.filter((item) => !generatedCoverage.has(scenarioCoverageKey(item.scenario)));
+    // Both this renderer and the register-plan path run the SAME selection
+    // pipeline — `runBudget` — instead of two copies of it (SKYR-4214 item 7).
+    // This file used to hold its own external dedup, attack-surface ordering,
+    // round-robin GENERATE pick and ADDITIONAL set-difference, so a fix in one
+    // copy left the other wrong.
+    //
+    // The two are NOT guaranteed to produce the same GENERATE set, and this
+    // comment must not claim they are: `selectPlan` re-ranks and calls
+    // `diversityBalancedBudgeter` (planRanker.ts:96) where this calls
+    // `fixedNBudgeter`, and the two differ in the `pick` step —
+    // diversityBalancedBudgeter.test.ts covers that divergence. What is now
+    // shared is the dedup rule, the ordering and the ADDITIONAL cap.
+    //
+    // `runBudget` needs a Candidate, which carries provenance and a stable id
+    // that only the register-plan path fills. Everything reaching this renderer
+    // is server-drafted, and `computeCandidateId` is a pure function of the
+    // scenario, so both fields are derivable here.
+    //
+    // The context deliberately reports no frontend work, whatever this PR
+    // contains: this renderer never had the UI-promotion loop, and the backend
+    // count it computed above already applied the UI reservation. Passing the
+    // real flags would introduce UI slots into the prompt's GENERATE list, which
+    // is a behaviour change this item does not carry.
+    const candidates = scored.map((item) => ({
+        ...item,
+        source: CandidateSource.SERVER,
+        candidateId: computeCandidateId(item.scenario),
+    }));
+    const selection = fixedNBudgeter.select(candidates, {
+        maxGenerate: backendGenerateCount,
+        maxTotal: topN,
+        isUIOnlyPR: false,
+        hasFrontendChanges: false,
+        externalCoverage,
+        // This renderer never receives the branch diff, so it cannot tell whether the
+        // PR wrote tests of its own. `true` is the same abstain direction the analyze
+        // end takes for an unknown (SKYR-4024): the covered-candidate reserve stays
+        // shut here, and those candidates are reported in the Removed section below
+        // rather than promoted to ADDITIONAL.
+        diffChangesTestFiles: true,
+    });
+    const generateItems = selection.generate;
+    const additionalItems = selection.additional;
+    // A candidate the selection stage removed — covered by an external test, or
+    // past the maxTotal cap — leaves no trace in the two lists above. In the
+    // recommendation-only flow (analyze_changes plus this prompt, with no
+    // register call) this section is the ONLY place the agent can read that a
+    // candidate existed and why it went, which is what SKYR-4214 exists to fix.
+    const scenarioNameById = new Map(candidates.map((c) => [c.candidateId, c.scenario.scenarioName]));
+    const removedLines = selection.dropped
+        .map((drop) => `- ${scenarioNameById.get(drop.candidateId) ?? drop.candidateId}: ${drop.reason}`)
+        .join("\n");
     const hasWorkspaceAuthType = !!authTypeValue && authTypeValue !== "none";
     // For skyramp_integration_test_generation with scenarioFile:
     // - If workspace has authType set: omit auth entirely — workspace handles Bearer prefix.
@@ -432,7 +436,9 @@ ${isUIOnlyPR
 ### ADDITIONAL (list in additionalRecommendations in this order after Step ${EXEC_STEP_ENRICH} insertion)
 
 ${additionalLines || "  (none pre-ranked)"}
-${uiGroundingGuidance}
+${removedLines
+        ? `\n### Removed (${selection.dropped.length}) — candidates the selection stage dropped before ranking. They are NOT in the lists above; do not re-add them.\n\n${removedLines}\n`
+        : ""}${uiGroundingGuidance}
 ${uiGuidance}
 ${supplementNote}
 

package/build/prompts/test-recommendation/fullRepoCatalog.js

@@ -1,6 +1,6 @@
 import { logger } from "../../utils/logger.js";
 import { buildTestQualityCriteria } from "./recommendationSections.js";
-import { externalDedupKey } from "./recommendationShared.js";
+import { externalDedupKeys, isAttackSurfaceSecurityBoundary } from "./recommendationShared.js";
 export function buildFullRepoRecommendations(scored, topN, baseUrl, authHeaderValue, authSchemeSnippet, authTypeValue, isFrontendProject = false, isFrontendOnlyProject = false, externalCoverage = new Set()) {
     // Full-repo mode only — percentage-based UI/E2E slot targets (15% each, floor 1).
     const rawE2E = isFrontendProject ? Math.max(1, Math.round(topN * 0.15)) : 0;
@@ -17,22 +17,29 @@ export function buildFullRepoRecommendations(scored, topN, baseUrl, authHeaderVa
         : authHeaderValue
             ? `, authHeader: "${authHeaderValue}"`
             : `, authHeader: <check OpenAPI securitySchemes or auth middleware; "" if confirmed unauthenticated>`;
-    // Supplement count for full-repo mode
-    const supplementCount = topN - Math.min(scored.length, topN);
     const toTitle = (name) => name.replace(/-/g, " ").replace(/\b\w/g, c => c.toUpperCase());
     const TYPE_ORDER = ["e2e", "ui", "integration", "contract"];
     const TYPE_LABEL = {
         e2e: "E2E", ui: "UI", integration: "Integration", contract: "Contract",
     };
     // Filter out scenarios already covered by external tests before slicing.
+    // The bug/attack-surface exemption matches applyExternalDedup in
+    // budgeters/shared.ts: those scenarios cover a semantic flaw that a
+    // same-endpoint external test does not, so an external match must not
+    // remove them here either.
     const scoredFiltered = externalCoverage.size > 0
         ? scored.filter(item => {
-            const key = externalDedupKey(item.scenario);
-            if (externalCoverage.has(key)) {
-                logger.info(`External dedup (full-repo): skipping "${item.scenario.scenarioName}" (${key})`);
-                return false;
+            const keys = externalDedupKeys(item.scenario);
+            if (keys.length === 0)
+                return true;
+            if (!keys.every((key) => externalCoverage.has(key)))
+                return true;
+            if (item.scenario.category === "bug_caught" || isAttackSurfaceSecurityBoundary(item.scenario)) {
+                logger.info(`External dedup (full-repo): preserving "${item.scenario.scenarioName}" (${keys.join(", ")}) — protected bug/attack-surface scenario requires semantic flaw coverage`);
+                return true;
             }
-            return true;
+            logger.info(`External dedup (full-repo): skipping "${item.scenario.scenarioName}" (${keys.join(", ")})`);
+            return false;
         })
         : scored;
     // For full-stack repos, carve out E2E and UI slots before filling with backend tests.
@@ -40,6 +47,10 @@ export function buildFullRepoRecommendations(scored, topN, baseUrl, authHeaderVa
         ? Math.max(0, topN - minE2ESlots - minUISlots)
         : topN;
     const allItems = scoredFiltered.slice(0, backendSlotCount);
+    // Count the supplements against what this prompt actually lists. Reading the
+    // pre-filter `scored.length` claimed more pre-ranked items than the sections
+    // below render, so a pool thinned by external dedup asked for no supplements.
+    const supplementCount = topN - Math.min(allItems.length, topN);
     const byType = new Map();
     for (const t of TYPE_ORDER)
         byType.set(t, []);

package/build/prompts/test-recommendation/recommendationShared.d.ts

@@ -3,14 +3,36 @@
  * full-repo mode (fullRepoCatalog.ts). Extracted here to avoid circular imports.
  */
 import { DraftedScenario } from "../../types/RepositoryAnalysis.js";
-export declare function scenarioCoverageKey(scenario: DraftedScenario): string;
 /**
- * Method-aware coverage key for external test dedup.
- * Unlike scenarioCoverageKey (resource::testType), this includes the HTTP method
- * so that e.g. an external test covering "GET /orders" doesn't block generating
- * a test for "PUT /orders" — a different operation on the same resource.
+ * The one spelling of a coverage key, `METHOD::resource::testType`. Both
+ * operands of the dedup comparison call it: a proposed test through
+ * `externalDedupKeys`, and an existing test through `buildExternalCoverageSet`.
+ * They used to build the same string in two places from two different inputs —
+ * a typed step list on one side, regex-scraped prose on the other — so a fix to
+ * one side left the other producing keys that could never match (SKYR-4214).
  */
-export declare function externalDedupKey(scenario: DraftedScenario): string;
+export declare function coverageKey(input: {
+    method: string;
+    path: string;
+    testType: string;
+}): string;
+/**
+ * Method-aware coverage keys for external test dedup — one per recorded subject
+ * endpoint. Method-aware so that an external test covering "GET /orders" does
+ * not block a test for "PUT /orders", a different operation on the same
+ * resource.
+ *
+ * A caller must remove a candidate ONLY when the coverage set holds EVERY key
+ * returned here. Removing it on one match would discard the coverage of its
+ * other endpoints. An empty list must never remove anything.
+ */
+export declare function externalDedupKeys(scenario: DraftedScenario): string[];
+/**
+ * Resource+type keys (no method) for the GENERATE/ADDITIONAL overlap filter —
+ * one per recorded subject endpoint. Same rule as `externalDedupKeys`: remove
+ * only on ALL keys, never on an empty list.
+ */
+export declare function scenarioCoverageKeys(scenario: DraftedScenario): string[];
 export declare function isAttackSurfaceSecurityBoundary(scenario: DraftedScenario): boolean;
 export declare function isOrdinaryDirectAuthBoundary(scenario: DraftedScenario): boolean;
 /**

package/build/prompts/test-recommendation/recommendationShared.js

@@ -10,22 +10,96 @@ function resolvePrimaryStep(scenario) {
     const primaryStep = mutatingSteps[mutatingSteps.length - 1] ?? scenario.steps[scenario.steps.length - 1];
     return { primaryStep, testType };
 }
-export function scenarioCoverageKey(scenario) {
-    const { primaryStep, testType } = resolvePrimaryStep(scenario);
-    const resource = extractResourceFromPath(primaryStep?.path ?? "");
-    return `${resource}::${testType}`;
+/**
+ * The one spelling of a coverage key, `METHOD::resource::testType`. Both
+ * operands of the dedup comparison call it: a proposed test through
+ * `externalDedupKeys`, and an existing test through `buildExternalCoverageSet`.
+ * They used to build the same string in two places from two different inputs —
+ * a typed step list on one side, regex-scraped prose on the other — so a fix to
+ * one side left the other producing keys that could never match (SKYR-4214).
+ */
+export function coverageKey(input) {
+    const method = (input.method ?? "GET").toUpperCase();
+    return `${method}::${extractResourceFromPath(input.path ?? "")}::${input.testType}`;
+}
+/** Test type of a scenario: its own label, else one step means a contract test. */
+function resolveTestType(scenario) {
+    return scenario.testType ?? (scenario.steps.length === 1 ? "contract" : "integration");
+}
+/**
+ * Method-aware coverage keys for external test dedup — one per recorded subject
+ * endpoint. Method-aware so that an external test covering "GET /orders" does
+ * not block a test for "PUT /orders", a different operation on the same
+ * resource.
+ *
+ * A caller must remove a candidate ONLY when the coverage set holds EVERY key
+ * returned here. Removing it on one match would discard the coverage of its
+ * other endpoints. An empty list must never remove anything.
+ */
+export function externalDedupKeys(scenario) {
+    const testType = resolveTestType(scenario);
+    const subjects = scenario.subjectEndpoints;
+    if (subjects && subjects.length > 0) {
+        return subjects.map((s) => coverageKey({ ...s, testType }));
+    }
+    if (subjects)
+        return [];
+    const { primaryStep } = resolvePrimaryStep(scenario);
+    if (!primaryStep)
+        return [];
+    return [coverageKey({ method: primaryStep.method, path: primaryStep.path, testType })];
+}
+/**
+ * Resource+type keys (no method) for the GENERATE/ADDITIONAL overlap filter —
+ * one per recorded subject endpoint. Same rule as `externalDedupKeys`: remove
+ * only on ALL keys, never on an empty list.
+ */
+export function scenarioCoverageKeys(scenario) {
+    const testType = resolveTestType(scenario);
+    const steps = scenario.steps ?? [];
+    const subjects = scenario.subjectEndpoints;
+    // No recorded subject: fall back to the primary step, as externalDedupKeys does.
+    if (!subjects) {
+        const { primaryStep } = resolvePrimaryStep(scenario);
+        if (!primaryStep)
+            return [];
+        return [
+            overlapKey(primaryStep.method, extractResourceFromPath(primaryStep.path ?? ""), testType, primaryStep),
+        ];
+    }
+    return subjects.map((subject) => {
+        const step = steps.find((s) => s.method === subject.method && s.path === subject.path);
+        return overlapKey(subject.method, extractResourceFromPath(subject.path ?? ""), testType, step);
+    });
 }
 /**
- * Method-aware coverage key for external test dedup.
- * Unlike scenarioCoverageKey (resource::testType), this includes the HTTP method
- * so that e.g. an external test covering "GET /orders" doesn't block generating
- * a test for "PUT /orders" — a different operation on the same resource.
+ * The overlap key names the endpoint AND what the test asserts about it.
+ *
+ * It deliberately does NOT reuse `coverageKey`. That key's other operand comes
+ * from `buildExternalCoverageSet`, which scrapes prose and can only ever know a
+ * method and a path — adding a status there would stop every external key from
+ * matching. Both operands of the OVERLAP comparison are drafted candidates with
+ * a step list, so both sides know the method, the interaction type and the
+ * status.
+ *
+ * The method is part of the key because `extractResourceFromPath` maps
+ * `/api/orders` and `/api/orders/{id}` to the same resource. Without it a
+ * GENERATE `PATCH /api/orders/{id}` (success, 200) removed an ADDITIONAL
+ * `GET /api/orders/{id}` (success, 200) as a duplicate — a read test and an
+ * update test on one resource are not duplicates.
+ *
+ * Measured on 839 nightly fixtures: 781 of them change exactly ONE route, so
+ * every candidate resolves to the same subject and `resource::testType` yields
+ * 2 keys for the whole pool. In 11 fixtures that removed EVERY ADDITIONAL
+ * candidate — `01-site-stats-endpoint` lost all 18. Adding the interaction type
+ * and the status roughly doubles the distinct keys on those pools. It does not
+ * make the key complete: two tests that assert different things about the same
+ * 200 response still collide, and no key built from a route can separate them.
  */
-export function externalDedupKey(scenario) {
-    const { primaryStep, testType } = resolvePrimaryStep(scenario);
-    const method = primaryStep?.method ?? "GET";
-    const resource = extractResourceFromPath(primaryStep?.path ?? "");
-    return `${method}::${resource}::${testType}`;
+function overlapKey(method, resource, testType, step) {
+    const interaction = step?.interactionType ?? "any";
+    const status = step?.expectedStatusCode ?? 0;
+    return `${(method ?? "ANY").toUpperCase()}::${resource}::${testType}::${interaction}::${status}`;
 }
 export function isAttackSurfaceSecurityBoundary(scenario) {
     return scenario.category === "security_boundary" &&
@@ -60,11 +134,11 @@ export function buildExternalCoverageSet(testLocations) {
                 const resource = extractResourceFromPath(epPath);
                 if (resource !== "unknown") {
                     if (testType === "unknown") {
-                        coverage.add(`${method}::${resource}::integration`);
-                        coverage.add(`${method}::${resource}::contract`);
+                        coverage.add(coverageKey({ method, path: epPath, testType: "integration" }));
+                        coverage.add(coverageKey({ method, path: epPath, testType: "contract" }));
                     }
                     else {
-                        coverage.add(`${method}::${resource}::${testType}`);
+                        coverage.add(coverageKey({ method, path: epPath, testType }));
                     }
                 }
             }

package/build/prompts/test-recommendation/registerRecommendTestsPrompt.js

@@ -5,6 +5,18 @@ import { buildRecommendationPrompt } from "./test-recommendation-prompt.js";
 import { ScenarioSource, AnalysisScope } from "../../types/RepositoryAnalysis.js";
 import { SCENARIO_CATEGORIES } from "../../types/TestRecommendation.js";
 import { inferExpectedStatus } from "../../utils/httpDefaults.js";
+/**
+ * True when two step lists name the same method+path sequence, ignoring
+ * everything else (body, description, ...). Used to decide whether a
+ * previously-resolved `subjectEndpoints` still applies to an enriched
+ * replacement — this function has no PR diff in scope, so it cannot call
+ * `resolveSubjectEndpoints` itself (SKYR-4214).
+ */
+function sameStepRouteSequence(a, b) {
+    if (a.length !== b.length)
+        return false;
+    return a.every((step, i) => (step.method ?? "").toUpperCase() === (b[i].method ?? "").toUpperCase() && step.path === b[i].path);
+}
 export function mergeEnrichedScenarios(serverScenarios, raw) {
     const rejectionNotes = [];
     let parsed;
@@ -72,6 +84,16 @@ export function mergeEnrichedScenarios(serverScenarios, raw) {
     }
     const merged = new Map(serverScenarios.map(s => [s.scenarioName, s]));
     for (const s of agentScenarios) {
+        const replaced = merged.get(s.scenarioName);
+        // The agent-submitted copy never carries subjectEndpoints — it is built
+        // fresh from the enriched JSON, not through resolveSubjectEndpoints. When
+        // the replaced server scenario had one and the steps still name the same
+        // endpoints, carry it forward so this candidate keeps the one recorded
+        // subject instead of falling back to a fresh last-mutating-step guess
+        // that could disagree with its siblings (SKYR-4214).
+        if (replaced?.subjectEndpoints && sameStepRouteSequence(replaced.steps, s.steps)) {
+            s.subjectEndpoints = replaced.subjectEndpoints;
+        }
         merged.set(s.scenarioName, s);
     }
     logger.info("Merged agent-enriched scenarios", {

package/build/prompts/test-recommendation/test-recommendation-prompt.d.ts

@@ -2,8 +2,8 @@ import { RepositoryAnalysis, AnalysisScope, DraftedScenario } from "../../types/
 import { WorkspaceAuthType } from "../../utils/workspaceAuth.js";
 import { PRTestContext } from "../../utils/pr-comment-parser.js";
 import { Novelty, PriorityTier } from "../../types/TestRecommendation.js";
-import { buildExternalCoverageSet, externalDedupKey } from "./recommendationShared.js";
-export { buildExternalCoverageSet, externalDedupKey };
+import { buildExternalCoverageSet, externalDedupKeys } from "./recommendationShared.js";
+export { buildExternalCoverageSet, externalDedupKeys };
 /** Result of {@link computeScoredCandidates} — the scoring/classification
  *  inputs shared between prompt rendering and the SKYR-3879 register-plan
  *  pre-seed (analyzeChangesTool.ts), so both derive the exact same numbers. */

package/build/prompts/test-recommendation/test-recommendation-prompt.js

@@ -8,9 +8,9 @@ import { buildScopeAssessmentSection, isFrontendFile } from "./scopeAssessment.j
 import { buildExecutionPlan, EXEC_STEP_CODE_REVIEW, EXEC_STEP_ENRICH } from "./diffExecutionPlan.js";
 import { buildFullRepoRecommendations } from "./fullRepoCatalog.js";
 import { ANALYSIS_STEP_EXTRACT } from "./analysisOutputPrompt.js";
-import { TASK_GENERATE, buildExternalCoverageSet, externalDedupKey, isAttackSurfaceSecurityBoundary, taskRef, } from "./recommendationShared.js";
+import { TASK_GENERATE, buildExternalCoverageSet, externalDedupKeys, isAttackSurfaceSecurityBoundary, taskRef, } from "./recommendationShared.js";
 // Re-export for backward compatibility (tests and external callers import these from this module)
-export { buildExternalCoverageSet, externalDedupKey };
+export { buildExternalCoverageSet, externalDedupKeys };
 function formatTestLocations(locs) {
     const entries = Object.entries(locs || {});
     if (entries.length === 0)
@@ -23,7 +23,7 @@ function formatTestLocations(locs) {
         "**Deduplication rule (apply this table before generating anything):**\n" +
         "- `[external]` tests: if a resource is covered by an `[external]` test, do NOT create a new parallel test for the same HTTP method + resource + test type. These tests still break when the API changes — Task 1 maintenance applies to them the same as Skyramp tests (in-place UPDATE only; do not regenerate or delete).\n" +
         "- `[skyramp]` contract test: if the HTTP method + path already appears in a `[skyramp]` `covers:` entry of type `contract` → UPDATE that file, do NOT create a new one.\n" +
-        "- `[skyramp]` integration test: if the primary (last mutating) step's method + path already appears in a `[skyramp]` `covers:` entry of type `integration` → UPDATE, do NOT create a new one.\n" +
+        "- `[skyramp]` integration test: use the endpoints this PR changed. A setup step or a cleanup step is not an endpoint under test. A scenario can test more than one changed endpoint. UPDATE an existing `[skyramp]` `covers:` entry of type `integration` only when it already covers EVERY changed endpoint the scenario tests. If it covers some but not all of them, the scenario is not a duplicate — create it.\n" +
         "- UI/E2E test: always create a new file — traces are distinct recordings.\n" +
         "For `[skyramp]` contract and integration tests: if in doubt, prefer UPDATE over creating a duplicate.");
 }