@skyramp/mcp 0.3.7 → 0.3.8

package/build/tools/test-management/registerTestPlanTool.js

@@ -12,7 +12,7 @@ import { CandidateSource, computeCandidateId, scenarioMergeKey, DiscriminatorKin
 import { selectPlan } from "../../recommendation/planRanker.js";
 import { resolveSubjectEndpoints } from "../../utils/subjectEndpoints.js";
 import { collectChangedRouteLines } from "../../utils/changedRoutes.js";
-import { reservedUISlots } from "../../recommendation/budgeters/shared.js";
+import { generateFloors } from "../../recommendation/budgeters/shared.js";
 import { inferScenarioType } from "../../recommendation/diversity.js";
 import { validateDiscriminator } from "../../recommendation/discriminators.js";
 import { isAttackSurfaceSecurityBoundary } from "../../prompts/test-recommendation/recommendationShared.js";
@@ -76,7 +76,7 @@ const discriminatorClaimSchema = z.object({
 const registerCandidateSchema = z.object({
     scenarioName: z.string().min(1).describe("Name for this test/scenario. Reused as the match key against the generation tool's scenarioName — keep it identical when you later call the generation tool."),
     description: z.string().min(1),
-    category: z.enum(SCENARIO_CATEGORIES).describe("Test category — drives ranking (never your own priority tag)."),
+    category: z.enum(SCENARIO_CATEGORIES).describe("Test category — drives ranking (never your own priority tag). `bug_caught` targets a `<bug_found>` flaw from code review. `requirement_conflict` asserts a requirement the PR title/description (or a requirements file it references) states and the implemented behavior contradicts — it fails on the current code by design. Both rank in the top tier but are carved out independently, so a requirement conflict never loses its slot to a code-review bug."),
     priority: z.enum(["high", "medium", "low"]).describe("Your own assessment — recorded, but ranking is derived from category, not this field."),
     testType: z.nativeEnum(TestType).refine((t) => PLAN_TEST_TYPES.has(t), {
         message: `testType must be one of ${[...PLAN_TEST_TYPES].join(", ")}`,
@@ -340,7 +340,26 @@ function renderGenerationDirective(plan) {
             (nonUICount > 0 ? ` Generate the ${tests(nonUICount)} of other types as well.` : ""),
     ];
 }
-function renderPlanText(plan, dropped) {
+/** SKYR-4292: the server cannot count the diff's changed behaviors, so an
+ *  under-budget plan is flagged (not rejected) with what a missing candidate looks
+ *  like. Wipro PR #24 registered 3 candidates against a 20-slot UI-only budget and
+ *  the tool answered "AUTHORITATIVE and FINAL" with no pushback. */
+function renderBudgetCheck(plan, maxTotal) {
+    const filled = plan.generate.length + plan.additional.length;
+    if (filled >= maxTotal)
+        return [];
+    return [
+        "",
+        `### Budget check: ${filled} of ${maxTotal} slots filled`,
+        "Every observable behavior this diff changes — each option value added, removed, renamed or reordered; each label, " +
+            "element, route, state, validation rule, computed value or style value (spacing, size, color, radius, font weight, " +
+            "class name) that renders differently; each removed element, asserted absent — needs a candidate above, however " +
+            "small the change. A change is covered only when an existing test asserts the changed value, not when a test merely " +
+            "reaches the component. If any changed behavior has no candidate, call skyramp_register_test_plan again with your " +
+            "full updated list. If the diff truly changes fewer behaviors than the budget, this plan stands as-is.",
+    ];
+}
+function renderPlanText(plan, dropped, maxTotal) {
     const lines = [];
     lines.push(`## Approved Test Plan (${plan.planId})`);
     lines.push("");
@@ -402,6 +421,7 @@ function renderPlanText(plan, dropped) {
     }
     lines.push("");
     lines.push(...renderGenerationDirective(plan));
+    lines.push(...renderBudgetCheck(plan, maxTotal));
     return lines.join("\n");
 }
 // ── Tool registration ───────────────────────────────────────────────────────
@@ -544,10 +564,11 @@ export function registerRegisterTestPlanTool(server) {
             // changes would silently plan zero UI tests (runs 32419025266,
             // 32431042133, 32431106864) — reject so the agent self-corrects in one
             // step, exactly like the empty-candidates rejection above.
-            if (reservedUISlots(budgetContext) > 0 &&
-                !allCandidates.some((c) => inferScenarioType(c.scenario) === TestType.UI)) {
-                errorResult = toolError("This run has frontend changes, so the plan reserves a UI slot — but no submitted or recovered " +
-                    "candidate has testType 'ui'. Resubmit your full candidate list including at least one UI candidate " +
+            const uiFloor = generateFloors(budgetContext).ui;
+            if (uiFloor > 0 && !allCandidates.some((c) => inferScenarioType(c.scenario) === TestType.UI)) {
+                errorResult = toolError(`This run has frontend changes, so the plan MUST include UI tests — at least ${uiFloor} of the ` +
+                    "GENERATE slots are held for them, and more are open to UI candidates on rank. No submitted or " +
+                    "recovered candidate has testType 'ui'. Resubmit your full candidate list including UI candidates " +
                     "for the changed frontend (see uiContext.changedFrontendFiles).");
                 return errorResult;
             }
@@ -576,7 +597,7 @@ export function registerRegisterTestPlanTool(server) {
                 return errorResult;
             }
             return {
-                content: [{ type: "text", text: renderPlanText(approvedPlan, result.dropped) }],
+                content: [{ type: "text", text: renderPlanText(approvedPlan, result.dropped, budgetContext.maxTotal) }],
             };
         }
         catch (error) {

package/build/types/RepositoryAnalysis.d.ts

@@ -1119,7 +1119,7 @@ export declare const scenarioStepSchema: z.ZodObject<{
 export declare const draftedScenarioSchema: z.ZodObject<{
     scenarioName: z.ZodString;
     description: z.ZodString;
-    category: z.ZodEnum<["new_endpoint", "bug_caught", "business_rule", "security_boundary", "data_integrity", "breaking_change", "auth", "error_handling", "workflow", "data_validation", "crud"]>;
+    category: z.ZodEnum<["new_endpoint", "bug_caught", "requirement_conflict", "business_rule", "security_boundary", "data_integrity", "breaking_change", "auth", "error_handling", "workflow", "data_validation", "crud"]>;
     priority: z.ZodEnum<["high", "medium", "low"]>;
     steps: z.ZodArray<z.ZodObject<{
         order: z.ZodNumber;
@@ -1231,7 +1231,7 @@ export declare const draftedScenarioSchema: z.ZodObject<{
     description: string;
     priority: "high" | "medium" | "low";
     scenarioName: string;
-    category: "new_endpoint" | "bug_caught" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
+    category: "new_endpoint" | "bug_caught" | "requirement_conflict" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
     steps: {
         path: string;
         method: string;
@@ -1268,7 +1268,7 @@ export declare const draftedScenarioSchema: z.ZodObject<{
     description: string;
     priority: "high" | "medium" | "low";
     scenarioName: string;
-    category: "new_endpoint" | "bug_caught" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
+    category: "new_endpoint" | "bug_caught" | "requirement_conflict" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
     steps: {
         path: string;
         method: string;
@@ -1607,7 +1607,7 @@ export declare const repositoryAnalysisSchema: z.ZodObject<{
         draftedScenarios: z.ZodArray<z.ZodObject<{
             scenarioName: z.ZodString;
             description: z.ZodString;
-            category: z.ZodEnum<["new_endpoint", "bug_caught", "business_rule", "security_boundary", "data_integrity", "breaking_change", "auth", "error_handling", "workflow", "data_validation", "crud"]>;
+            category: z.ZodEnum<["new_endpoint", "bug_caught", "requirement_conflict", "business_rule", "security_boundary", "data_integrity", "breaking_change", "auth", "error_handling", "workflow", "data_validation", "crud"]>;
             priority: z.ZodEnum<["high", "medium", "low"]>;
             steps: z.ZodArray<z.ZodObject<{
                 order: z.ZodNumber;
@@ -1719,7 +1719,7 @@ export declare const repositoryAnalysisSchema: z.ZodObject<{
             description: string;
             priority: "high" | "medium" | "low";
             scenarioName: string;
-            category: "new_endpoint" | "bug_caught" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
+            category: "new_endpoint" | "bug_caught" | "requirement_conflict" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
             steps: {
                 path: string;
                 method: string;
@@ -1756,7 +1756,7 @@ export declare const repositoryAnalysisSchema: z.ZodObject<{
             description: string;
             priority: "high" | "medium" | "low";
             scenarioName: string;
-            category: "new_endpoint" | "bug_caught" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
+            category: "new_endpoint" | "bug_caught" | "requirement_conflict" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
             steps: {
                 path: string;
                 method: string;
@@ -1799,7 +1799,7 @@ export declare const repositoryAnalysisSchema: z.ZodObject<{
             description: string;
             priority: "high" | "medium" | "low";
             scenarioName: string;
-            category: "new_endpoint" | "bug_caught" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
+            category: "new_endpoint" | "bug_caught" | "requirement_conflict" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
             steps: {
                 path: string;
                 method: string;
@@ -1842,7 +1842,7 @@ export declare const repositoryAnalysisSchema: z.ZodObject<{
             description: string;
             priority: "high" | "medium" | "low";
             scenarioName: string;
-            category: "new_endpoint" | "bug_caught" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
+            category: "new_endpoint" | "bug_caught" | "requirement_conflict" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
             steps: {
                 path: string;
                 method: string;
@@ -2743,7 +2743,7 @@ export declare const repositoryAnalysisSchema: z.ZodObject<{
             description: string;
             priority: "high" | "medium" | "low";
             scenarioName: string;
-            category: "new_endpoint" | "bug_caught" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
+            category: "new_endpoint" | "bug_caught" | "requirement_conflict" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
             steps: {
                 path: string;
                 method: string;
@@ -2956,7 +2956,7 @@ export declare const repositoryAnalysisSchema: z.ZodObject<{
             description: string;
             priority: "high" | "medium" | "low";
             scenarioName: string;
-            category: "new_endpoint" | "bug_caught" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
+            category: "new_endpoint" | "bug_caught" | "requirement_conflict" | "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
             steps: {
                 path: string;
                 method: string;

package/build/types/TestRecommendation.d.ts

@@ -12,7 +12,7 @@ export declare enum Novelty {
     EXISTING = "existing"
 }
 /** All categories including internal ones. */
-export declare const SCENARIO_CATEGORIES: readonly ["new_endpoint", "bug_caught", "business_rule", "security_boundary", "data_integrity", "breaking_change", "auth", "error_handling", "workflow", "data_validation", "crud"];
+export declare const SCENARIO_CATEGORIES: readonly ["new_endpoint", "bug_caught", "requirement_conflict", "business_rule", "security_boundary", "data_integrity", "breaking_change", "auth", "error_handling", "workflow", "data_validation", "crud"];
 export type ScenarioCategory = typeof SCENARIO_CATEGORIES[number];
 /** Categories valid for tool submissions (excludes internal-only categories). */
 export declare const TEST_CATEGORIES: readonly ["business_rule", "security_boundary", "data_integrity", "breaking_change", "auth", "error_handling", "workflow", "data_validation", "crud"];
@@ -21,3 +21,13 @@ export type TestCategory = typeof TEST_CATEGORIES[number];
 export declare const CATEGORY_PRIORITY: Record<ScenarioCategory, PriorityTier>;
 /** Map internal-only categories to their external equivalent for tool submission. */
 export declare function externalCategory(cat: ScenarioCategory): TestCategory;
+/**
+ * Categories whose scenarios target a specific identified defect — a code flaw
+ * (`bug_caught`) or a stated requirement the code contradicts
+ * (`requirement_conflict`). They survive external-test dedup: an existing test on
+ * the same endpoint exercises the surface, not the flaw, so removing them would
+ * drop the only test that fails on the defect.
+ */
+export declare const FLAW_TARGETING_CATEGORIES: readonly ["bug_caught", "requirement_conflict"];
+/** Whether `category` targets a specific identified defect (see {@link FLAW_TARGETING_CATEGORIES}). */
+export declare function isFlawTargetingCategory(category: ScenarioCategory | undefined): boolean;

package/build/types/TestRecommendation.js

@@ -17,6 +17,14 @@ export var Novelty;
 const INTERNAL_CATEGORIES = [
     "new_endpoint", // MEDIUM - diff-direct scenario; where a test came from, not a guarantee of a slot
     "bug_caught", // CRITICAL - tests targeting a specific <bug_found> flaw identified during enrichment
+    // CRITICAL - tests asserting a requirement the PR title/description (or a
+    // requirements file it references) states, which the implemented behavior
+    // contradicts. Separate from bug_caught deliberately (SKYR-4291): labelled
+    // bug_caught, a requirement-vs-code mismatch competed with the code-review
+    // flaws for the same promotion and lost it on severity. Its own category means
+    // its own carve-out here, first place in the promotion order SKYR-4275's bound
+    // hands out, and its own coverage gate.
+    "requirement_conflict",
 ];
 /** External categories valid for tool submissions, ordered by priority. */
 const CATEGORIES = [
@@ -59,6 +67,12 @@ export const CATEGORY_PRIORITY = {
     // fill GENERATE.
     new_endpoint: PriorityTier.MEDIUM,
     bug_caught: PriorityTier.CRITICAL, // tests targeting a <bug_found> flaw — always in GENERATE
+    // A stated requirement the implementation contradicts is the point of the PR,
+    // so it sits in the same top tier as bug_caught. Being its own category, it is
+    // carved out separately in planRanker and takes the FIRST slot of the promotion
+    // bound SKYR-4275 sets — the code-review flaws promote into what is left, so a
+    // requirement conflict is never the finding that loses on severity.
+    requirement_conflict: PriorityTier.CRITICAL,
     business_rule: PriorityTier.HIGH, // formula/business-logic bugs are high priority
     security_boundary: PriorityTier.HIGH,
     data_integrity: PriorityTier.HIGH,
@@ -75,5 +89,25 @@ export function externalCategory(cat) {
         return "crud";
     if (cat === "bug_caught")
         return "business_rule";
+    // The stated requirement IS the business rule the test asserts — same landing
+    // spot as bug_caught, so a requirement-conflict test reads as a rule check in
+    // the customer-facing report rather than an unrecognised label.
+    if (cat === "requirement_conflict")
+        return "business_rule";
     return cat;
 }
+/**
+ * Categories whose scenarios target a specific identified defect — a code flaw
+ * (`bug_caught`) or a stated requirement the code contradicts
+ * (`requirement_conflict`). They survive external-test dedup: an existing test on
+ * the same endpoint exercises the surface, not the flaw, so removing them would
+ * drop the only test that fails on the defect.
+ */
+export const FLAW_TARGETING_CATEGORIES = [
+    "bug_caught",
+    "requirement_conflict",
+];
+/** Whether `category` targets a specific identified defect (see {@link FLAW_TARGETING_CATEGORIES}). */
+export function isFlawTargetingCategory(category) {
+    return category !== undefined && FLAW_TARGETING_CATEGORIES.includes(category);
+}

package/build/utils/pathSignatures.d.ts

@@ -22,7 +22,10 @@ export declare function isIndexModule(file: string): boolean;
  * (`@/x`, `~/x`, `~~/x`, `#/x`, `src/x`) are accepted when the module directory
  * ends with the aliased path AND the importer lives under the same root that the
  * alias maps to — `packages/store/Page.tsx` importing `@/app/shop/_constants` does
- * not match `packages/admin/app/shop/_constants/index.ts`. All paths are
+ * not match `packages/admin/app/shop/_constants/index.ts`. Prefix-less
+ * multi-segment specifiers (`Components/Foo` under tsconfig `baseUrl: "src"` —
+ * SKYR-4287) go through the same suffix + shared-root check; only single-segment
+ * prefix-less specifiers (`react`) are treated as npm packages. All paths are
  * repo-relative with forward slashes.
  */
 export declare function importsIndexModule(importerFile: string, importerContent: string, indexFile: string): boolean;

package/build/utils/pathSignatures.js

@@ -60,7 +60,10 @@ export function isIndexModule(file) {
  * (`@/x`, `~/x`, `~~/x`, `#/x`, `src/x`) are accepted when the module directory
  * ends with the aliased path AND the importer lives under the same root that the
  * alias maps to — `packages/store/Page.tsx` importing `@/app/shop/_constants` does
- * not match `packages/admin/app/shop/_constants/index.ts`. All paths are
+ * not match `packages/admin/app/shop/_constants/index.ts`. Prefix-less
+ * multi-segment specifiers (`Components/Foo` under tsconfig `baseUrl: "src"` —
+ * SKYR-4287) go through the same suffix + shared-root check; only single-segment
+ * prefix-less specifiers (`react`) are treated as npm packages. All paths are
  * repo-relative with forward slashes.
  */
 export function importsIndexModule(importerFile, importerContent, indexFile) {
@@ -76,7 +79,16 @@ export function importsIndexModule(importerFile, importerContent, indexFile) {
             continue;
         }
         const aliased = spec.replace(/^(@\/|~~\/|~\/|#\/|src\/)/, "");
-        if (aliased === spec)
+        // A prefix-less specifier is only a bare npm package when it has a single
+        // segment ('react'). Multi-segment prefix-less specifiers are how tsconfig
+        // `baseUrl` repos import internal modules ('Components/Foo' with
+        // baseUrl: "src" — SKYR-4287: every folder-per-component index.tsx in such
+        // repos was misreported as no-importers). Those flow into the same
+        // suffix + shared-root check as aliases; a deep npm import ('lodash/get')
+        // is unlikely to match unless the repo actually contains a `lodash/get`
+        // directory under the same root, and a scoped package ('@scope/pkg') would
+        // require a source directory literally named '@scope'.
+        if (aliased === spec && !spec.includes("/"))
             continue; // bare package specifier — not a repo path
         if (moduleDir === aliased)
             return true; // alias maps to the repo root

package/build/utils/planOnlyMode.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Plan-only mode capture for `skyramp_submit_report` (SKYR-4250).
+ *
+ * A plan-only eval run (SKYR-3879) writes no test files: `newTestsCreated`
+ * DECLARES the approved GENERATE selection instead of recording generated
+ * files, and the declaration itself is the deliverable. The SKYR-3883 guard
+ * (`findUnchangedFileClaims`) verifies every `newTestsCreated` claim against
+ * the working tree, so in that lane EVERY declaration is unbacked by
+ * construction and the report is rejected.
+ *
+ * That rejection is not evenly distributed. `findUnchangedFileClaims` exempts a
+ * claim attributed to a non-primary repo, so on a cross-repo fixture the
+ * related repo's declarations pass and only the primary repo's are checked.
+ * On a frontend-primary pair that makes the mandatory UI item (SKYR-4204's
+ * floor) the one claim that always fails, and the agent's only compliant move
+ * is to demote it to `additionalRecommendations` — which is exactly the
+ * under-declaration SKYR-4250 exists to fix (run 32903633247).
+ *
+ * `planOnly` reaches the server only as a testbot prompt/resource arg, so this
+ * mirrors the SKYR-4185 report-language capture: the prompt render is the
+ * single capture point, and the report tool reads the captured mode later in
+ * the same process.
+ *
+ * Capture is fail-open by design: if the testbot prompt was never served, the
+ * mode stays false and the guard behaves exactly as it does today.
+ */
+/** Capture plan-only mode at prompt-serve time. Last render wins: a later
+ *  non-plan-only render disarms a mode captured earlier in a long-lived server
+ *  process, so an ordinary run never silently skips the guard. */
+export declare function setPlanOnlyMode(planOnly: boolean): void;
+export declare function isPlanOnlyMode(): boolean;
+/** Test isolation only — module state persists across tests in one process. */
+export declare function resetPlanOnlyMode(): void;

package/build/utils/planOnlyMode.js

@@ -0,0 +1,40 @@
+/**
+ * Plan-only mode capture for `skyramp_submit_report` (SKYR-4250).
+ *
+ * A plan-only eval run (SKYR-3879) writes no test files: `newTestsCreated`
+ * DECLARES the approved GENERATE selection instead of recording generated
+ * files, and the declaration itself is the deliverable. The SKYR-3883 guard
+ * (`findUnchangedFileClaims`) verifies every `newTestsCreated` claim against
+ * the working tree, so in that lane EVERY declaration is unbacked by
+ * construction and the report is rejected.
+ *
+ * That rejection is not evenly distributed. `findUnchangedFileClaims` exempts a
+ * claim attributed to a non-primary repo, so on a cross-repo fixture the
+ * related repo's declarations pass and only the primary repo's are checked.
+ * On a frontend-primary pair that makes the mandatory UI item (SKYR-4204's
+ * floor) the one claim that always fails, and the agent's only compliant move
+ * is to demote it to `additionalRecommendations` — which is exactly the
+ * under-declaration SKYR-4250 exists to fix (run 32903633247).
+ *
+ * `planOnly` reaches the server only as a testbot prompt/resource arg, so this
+ * mirrors the SKYR-4185 report-language capture: the prompt render is the
+ * single capture point, and the report tool reads the captured mode later in
+ * the same process.
+ *
+ * Capture is fail-open by design: if the testbot prompt was never served, the
+ * mode stays false and the guard behaves exactly as it does today.
+ */
+let sessionPlanOnly = false;
+/** Capture plan-only mode at prompt-serve time. Last render wins: a later
+ *  non-plan-only render disarms a mode captured earlier in a long-lived server
+ *  process, so an ordinary run never silently skips the guard. */
+export function setPlanOnlyMode(planOnly) {
+    sessionPlanOnly = planOnly;
+}
+export function isPlanOnlyMode() {
+    return sessionPlanOnly;
+}
+/** Test isolation only — module state persists across tests in one process. */
+export function resetPlanOnlyMode() {
+    sessionPlanOnly = false;
+}

package/build/utils/reportVerification.d.ts

@@ -50,6 +50,11 @@ export interface UnchangedFileClaimsInput {
     /** owner/repo of the primary repo — used to exempt cross-repo newTest claims
      *  whose files live in a different checkout. */
     primaryRepository?: string;
+    /** SKYR-4250: a plan-only eval run generates nothing — `newTestsCreated`
+     *  declares the approved GENERATE list — so no declaration can be backed by
+     *  a working-tree change. Exempts the declaration half only; a maintenance
+     *  UPDATE still claims a real edit and is still verified. */
+    planOnly?: boolean;
 }
 /**
  * Cross-check report claims against files that actually changed in the working

package/build/utils/reportVerification.js

@@ -124,7 +124,7 @@ export async function listChangedFiles(repoRoot) {
  *    absolute path resolving outside `repoRoot`) — a different checkout owns them.
  */
 export function findUnchangedFileClaims(input) {
-    const { repoRoot, changedFiles, newTests, verdicts, primaryRepository } = input;
+    const { repoRoot, changedFiles, newTests, verdicts, primaryRepository, planOnly, } = input;
     const unbacked = [];
     const isBacked = (claimedPath) => {
         let candidate = claimedPath;
@@ -137,7 +137,12 @@ export function findUnchangedFileClaims(input) {
         }
         return changedFiles.some((c) => testFileMatches(c, candidate));
     };
-    for (const t of newTests) {
+    // A plan-only run declares its GENERATE list instead of writing files, so
+    // skip the claim scan wholesale rather than per-claim: checking it rejects
+    // every declaration the guard can see, and the ones it CANNOT see (cross-repo
+    // claims, exempted below) would pass — demoting the primary repo's items
+    // alone. Uneven enforcement is worse than none here.
+    for (const t of planOnly ? [] : newTests) {
         if (!t.fileName)
             continue;
         // Cross-repo finding — its file lives in a different checkout, not this tree.

package/build/utils/scenarioDrafting.d.ts

@@ -46,7 +46,7 @@ export declare function draftScenariosFromEndpoints(endpoints: Array<EndpointInp
 /**
  * Enforce a global cap on drafted scenarios while preserving category diversity.
  *
- * 1. CRITICAL (bug_caught) scenarios prioritized first.
+ * 1. CRITICAL (bug_caught, requirement_conflict) scenarios prioritized first.
  * 2. One scenario per non-empty category guaranteed (breadth).
  * 3. Remaining budget filled by priority tier (HIGH > MEDIUM > LOW).
  * 4. Hard cap at MAX_TOTAL_SCENARIOS — applied to the combined output.

package/build/utils/scenarioDrafting.js

@@ -226,7 +226,7 @@ const TIER_ORDER = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1 };
 /**
  * Enforce a global cap on drafted scenarios while preserving category diversity.
  *
- * 1. CRITICAL (bug_caught) scenarios prioritized first.
+ * 1. CRITICAL (bug_caught, requirement_conflict) scenarios prioritized first.
  * 2. One scenario per non-empty category guaranteed (breadth).
  * 3. Remaining budget filled by priority tier (HIGH > MEDIUM > LOW).
  * 4. Hard cap at MAX_TOTAL_SCENARIOS — applied to the combined output.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyramp/mcp",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "main": "build/index.js",
   "exports": {
     ".": "./build/index.js",