@skyramp/mcp 0.4.0 → 0.4.1-rc.2

package/build/tools/submitReportTool.js

@@ -13,14 +13,15 @@ import { StateManager, runArtifactDir, getTestsRepoDir, resolveRunStatePath, } f
 import { toolError, testFileMatches } from "../utils/utils.js";
 import { isTestbotEnabled, } from "../utils/featureFlags.js";
 import { answerFor, unknownAnswerObjections } from "../recommendation/answers.js";
-import { checkDeliveredMatchesPlan } from "../recommendation/verifiers/deliveredMatchesPlan.js";
+import { checkDeliveredMatchesPlan, checkMaintenanceDelivered } from "../recommendation/verifiers/deliveredMatchesPlan.js";
 import { checkReportedCategoryMatchesPlan, checkRequirementConflictReported, } from "../recommendation/verifiers/reportedCategory.js";
+import { checkDefectsReported, checkIssueTraceability } from "../recommendation/verifiers/issueTraceability.js";
 import { checkExpectedOutcomeAfterExecution, } from "../recommendation/verifiers/expectedOutcome.js";
 import { findInvalidSourceCitations, findUnchangedFileClaims, listChangedFiles, listChangedFilesAcross, listChangedFilesAbs, } from "../utils/reportVerification.js";
 import { isPlanOnlyMode } from "../utils/planOnlyMode.js";
 import { getReportLanguage, isEnforcedReportLanguage, findLanguageViolations, findLanguageNearMisses, reportLanguageDisplayName, } from "../utils/reportLanguage.js";
 import { canonicalTestPath, findAssertionRecordByFileName, rederiveAssertionOutcome, } from "./code-refactor/assertion-state.js";
-import { rederiveReuseOutcome, reuseChainSkipped, samePath, } from "./code-refactor/reuse-state.js";
+import { rederiveReuse, REUSE_SUBMIT_MAX_REFUSALS, reuseChainSkipped, samePath, } from "./code-refactor/reuse-state.js";
 import { retrofitGate, } from "./code-refactor/retrofit-state.js";
 // Mirrors the tools wired to planGuard: UI and E2E are not gated at generation
 // time, so gating them here would be a report-time-only surprise.
@@ -50,6 +51,22 @@ const MAINTENANCE_CHANGE_ACTIONS = new Set([
     DriftAction.Regenerate,
     DriftAction.Delete,
 ]);
+// Narrower than the set above, and for a different question. That one asks whether a
+// row touched a file; this asks whether the row left a test standing that a `maintains`
+// claim can rest on. DELETE touched the file and removed the coverage with it, VERIFY
+// and IGNORE never edited anything — none of the three corroborate a claim that an
+// existing test covers a change.
+const MAINTENANCE_COVERAGE_ACTIONS = new Set([
+    DriftAction.Update,
+    DriftAction.Regenerate,
+]);
+/** The maintenance rows a `maintains` claim may be checked against: an action that leaves
+ *  a test standing, and an edit this run actually made. `reportOnly` is the second half —
+ *  an external test's REGENERATE keeps its real action and touches no file, so counting it
+ *  would credit a claim nothing backs. */
+function rowsLeavingCoverage(rows) {
+    return (rows ?? []).filter((row) => row?.action !== undefined && MAINTENANCE_COVERAGE_ACTIONS.has(row.action) && row?.reportOnly !== true);
+}
 /** Objection ids for an untested declared change, `coverage:change:<id>`. The
  *  change table reads the agent's answer back off them. */
 const CHANGE_OBJECTION_PREFIX = "coverage:change:";
@@ -322,7 +339,15 @@ const issueFoundSchema = z
     plannedTestId: z
         .string()
         .optional()
-        .describe("The `plannedTestId` of the planned test this issue is about, when it is about one. Set it on the issue you record for a `requirement_conflict` test so the conflict is tied to the test that asserts it; otherwise leave it out."),
+        .describe("The `plannedTestId` of the DELIVERED test that proves this issue. Your plan declares that test with `expected.outcome: fail`, so it stays red until the issue is fixed; a `requirement_conflict` test that asserts the requirement is declared the same way. A planned test you did not write proves nothing, and a test the plan declares green proves nothing either. " +
+        "This field is CONDITIONAL, not required on every bug: set it when such a test exists; set `defectId` instead when a plan defect traces the issue; leave both out when no test proves the issue. " +
+        "CHECKED on a `bug` entry: one that neither names a delivered red test here nor traces through `defectId` draws an objection you answer in one line."),
+    defectId: z
+        .string()
+        .optional()
+        .describe("The `id` of the plan defect this issue reports, from the `defects` list you registered with skyramp_register_test_plan. Spell it as that list spells it: an id the plan does not declare traces nothing. " +
+        "Set it on the `category: bug` entry that reports the defect. A `defectId` on a `lint`, `type` or `config` entry does not report the defect — the report renders those in its own Configuration Errors section. " +
+        "CHECKED: every plan defect has a `bug` issue that names it, and a `bug` entry with no `plannedTestId` traces through this defect when a delivered test that expects to fail cites it, or when you answered `defects:untested:<id>` at plan time. Leave it out for an issue the plan did not declare."),
     sourceFile: citationString.describe("Path of the application file whose code is missing or wrong, relative to the repository root (e.g. 'src/crud/products.py'). " +
         "REQUIRED when category is 'bug'. " +
         "For code that is MISSING — an unmounted router, an unregistered route, an import never added — name the file where the line should be, not the file that defines what is unmounted. " +
@@ -484,7 +509,6 @@ export const additionalRecommendationSchema = z.preprocess(stripNullGroundingFie
         // `targetElements: null` is its normal state rather than a lost capture.
     }
 }));
-// TODO(multi-repo maintenance): no `repository` field yet — see readData() TODO below.
 const testMaintenanceSchema = z.object({
     testType: z.nativeEnum(TestType).describe("Type of test."),
     endpoint: z
@@ -514,6 +538,10 @@ const testMaintenanceSchema = z.object({
         "For failing runs: failure name and one-line root cause, e.g. " +
         "'FAILED test_foo — check_schema fails, order_id=1 has discount from prior PATCH test'. " +
         "Empty string for VERIFY/IGNORE/DELETE entries where no after-execution was run."),
+    // Server-populated from the verdict's own state section, falling back to the
+    // run's primary repo. Always set: a consumer that has to treat absence as
+    // "probably the primary" cannot tell a single-repo row from a mis-stamped one.
+    repository: z.string(),
     // Server-populated from stateFile execution records — never supplied by the LLM.
     beforeStatus: z.nativeEnum(TestExecutionStatus),
     afterStatus: z.nativeEnum(TestExecutionStatus),
@@ -592,7 +620,7 @@ function computeReportMetrics(params) {
  *
  * The counts are RE-DERIVED from the delivered spec rather than read back from
  * state: the execution fix-up can restore `<testFile>.raw.bak` over it afterwards
- * by plain `cp`, which this tool never sees. See rederiveReuseOutcome.
+ * by plain `cp`, which this tool never sees. See rederiveReuse.
  *
  * Tests the reuse tool never ran for and specs whose outcome cannot be re-derived
  * get nothing — which consumers already treat as "no reuse summary" — with one
@@ -619,7 +647,12 @@ async function attachAssertionOutcome(test, outcomes, checkouts) {
         return test;
     return { ...test, assertions: await rederiveAssertionOutcome(record) };
 }
-async function attachReuseOutcome(test, outcomes, handOffs, retrofits = []) {
+async function attachReuseOutcome(test, outcomes, handOffs, retrofits, 
+// A blocking verdict measured on the delivered files is collected here rather
+// than written into the row: the caller refuses the report on it. Required, not
+// defaulted — a caller that forgot it would ship the report with no refusal and
+// no compiler error. See the refusal below the row map.
+blocking) {
     // POM records describe browser specs; a basename collision with an API test's
     // fileName must not attach them there. A utils-path record is attachable anywhere.
     const record = outcomes?.[path.basename(test.fileName)];
@@ -629,7 +662,10 @@ async function attachReuseOutcome(test, outcomes, handOffs, retrofits = []) {
     const found = record && typeMatches && (test.testType === TestType.UI || record.utils)
         ? record
         : undefined;
-    const derived = found ? await rederiveReuseOutcome(found) : undefined;
+    const rederived = found ? await rederiveReuse(found) : undefined;
+    const derived = rederived?.outcome;
+    if (rederived?.blocking)
+        blocking.push(rederived.blocking);
     // Pre-existing generated tests this spec's reuse pass rewired (SKYR-4276 A4): the
     // report names each with its recorded execution, so a reviewer sees that the
     // module became a dependency of code they already owned — and that it still runs.
@@ -672,6 +708,13 @@ function attachVideoPath(row, videos) {
         videoPath: videos?.[path.basename(row.testFilePath)]?.videoPath,
     };
 }
+/** Two-space indent on every line, so a multi-line verdict reads as one bullet's body. */
+function indent(text) {
+    return text
+        .split("\n")
+        .map((line) => `  ${line}`)
+        .join("\n");
+}
 function deduplicateById(items) {
     const seen = new Set();
     const result = [];
@@ -812,7 +855,10 @@ const PLANNABLE_TEST_TYPES = new Set([
     TestType.E2E,
     TestType.UI,
 ]);
-function runPostExecutionChecks(plan, delivered, results, issues) {
+function runPostExecutionChecks(plan, delivered, results, issues, 
+/** The plan-only lane delivers nothing, so there a planned test is proof
+ *  enough for a bug. Passed in, not read here, so the checks stay pure. */
+planOnly, maintained = []) {
     const shipped = delivered
         // A smoke, fuzz or load entry is filtered out rather than reported as
         // unplanned: a plan cannot hold one, so the objection would name a mistake the
@@ -823,9 +869,16 @@ function runPostExecutionChecks(plan, delivered, results, issues) {
         .map((plannedTestId) => ({ plannedTestId }));
     return [
         ...runPostExecutionCheck("deliveredMatchesPlan", "deliveredMatchesPlan", () => checkDeliveredMatchesPlan(plan, shipped)),
+        // The maintenance mirror: a `maintains` entry credited coverage at plan time,
+        // so something has to check the file was edited.
+        ...runPostExecutionCheck("deliveredMatchesPlan", "deliveredMatchesPlan:maintains", () => checkMaintenanceDelivered(plan, maintained)),
         ...runPostExecutionCheck("expectedOutcome", "expectedOutcome:executed", () => checkExpectedOutcomeAfterExecution(plan, collectExecutionOutcomes(delivered, results), issues)),
         ...runPostExecutionCheck("reportedCategory", "reportedCategory", () => checkReportedCategoryMatchesPlan(plan, delivered)),
         ...runPostExecutionCheck("requirementConflictReported", "requirementConflictReported", () => checkRequirementConflictReported(plan, delivered, issues)),
+        // Both halves of the review's accountability, and neither refuses the report:
+        // a bug with no test behind it, and a plan defect the report never mentions.
+        ...runPostExecutionCheck("issueTraceability", "issueTraceability", () => checkIssueTraceability(plan, shipped, issues, { planOnly })),
+        ...runPostExecutionCheck("defectsReported", "defects:unreported", () => checkDefectsReported(plan, issues)),
     ];
 }
 export function registerSubmitReportTool(server) {
@@ -1044,8 +1097,8 @@ export function registerSubmitReportTool(server) {
         const stateManager = StateManager.fromStatePath(stateFile);
         let stateData;
         try {
-            // Only reads the primary repo — see the related-repo check below for why related
-            // repos' maintenanceVerdicts are never folded in here.
+            // Primary section only; related sections are read where testMaintenance
+            // is built, so each row keeps its own repo's executions.
             stateData = await stateManager.readData();
         }
         catch (err) {
@@ -1111,29 +1164,74 @@ export function registerSubmitReportTool(server) {
                 return errorResult;
             }
         }
-        // TestbotReport.testMaintenance has no repository field, so a related repo's
-        // reconciled verdicts have nowhere to go in this report. Fail loud instead of
-        // silently omitting real maintenance work skyramp_actions already did and persisted.
-        // Multi-repo maintenance reporting is a separate, unscoped feature (would also need
-        // testbot prompt / drift-analysis / test-bot.git renderer changes) — not done here.
-        const relatedReposWithVerdicts = [];
-        for (const repo of await stateManager.listRelatedRepos()) {
-            const relatedData = await stateManager.readRepoData(repo);
-            if ((relatedData?.maintenanceVerdicts?.length ?? 0) > 0)
-                relatedReposWithVerdicts.push(repo);
+        // Every section that can hold verdicts: primary, then each related repo.
+        // Read once — the file can carry a large diffText and readRepoData would
+        // re-parse it twice per repo.
+        const fullMaintenanceState = await stateManager.readFullState();
+        // The state file's root names the primary only when a caller declared one
+        // (or wrote first). GITHUB_REPOSITORY is the trigger event's own repo, so
+        // it names the primary even for a run that passed neither repo argument.
+        const primaryRepository = fullMaintenanceState?.metadata?.repository?.trim() ||
+            process.env.GITHUB_REPOSITORY?.trim() ||
+            undefined;
+        const maintenanceSections = [{ data: stateData }];
+        for (const [repo, section] of Object.entries(fullMaintenanceState?.relatedRepos ?? {})) {
+            // Only these two keys resolve back to the primary, already collected
+            // above. Any other key — a case variant, or another name over the same
+            // checkout — is a SEPARATE store, so skipping it would discard its
+            // verdicts; duplicates collapse per row below instead.
+            if (!repo.trim())
+                continue;
+            if (repo === primaryRepository)
+                continue;
+            const data = section?.data;
+            if (data)
+                maintenanceSections.push({ repository: repo, data });
+        }
+        // Stamp every row, primary included and single-repo runs included — as the
+        // prompt already requires of the other report sections. A section without
+        // its own name is the primary's, so it takes the run's primary repo.
+        const repositoryOf = (section) => section.repository ?? primaryRepository ?? "";
+        // Required field, so refuse rather than stamp a blank one: nothing named
+        // the primary and the run is not on a GitHub runner either. Only sections
+        // that actually produce rows need a name — a run with no verdicts at all
+        // has nothing to attribute and must still be able to submit.
+        if (!primaryRepository &&
+            maintenanceSections.some((section) => !section.repository &&
+                (section.data.maintenanceVerdicts?.length ?? 0) > 0)) {
+            errorResult = toolError("Cannot name the repository for the maintenance rows: the stateFile records no primary repository " +
+                "and GITHUB_REPOSITORY is unset. Pass `repository` (and `primaryRepository` in a multi-repo run) " +
+                "to skyramp_analyze_changes, then re-run it.");
+            return errorResult;
         }
-        if (relatedReposWithVerdicts.length > 0) {
-            errorResult = toolError(`Related repo(s) have reconciled maintenance verdicts that cannot be included in this report yet ` +
-                `(multi-repo maintenance reporting is not supported — testMaintenance has no repository field): ${relatedReposWithVerdicts.join(", ")}.`);
+        // Reject rather than throw: a non-array here, or a missing testFilePath
+        // below, escapes the handler and loses the analytics event in its `finally`.
+        const malformedSections = maintenanceSections
+            .filter(({ data }) => data.maintenanceVerdicts !== undefined &&
+            !Array.isArray(data.maintenanceVerdicts))
+            .map(({ repository }) => repository ?? "the primary repo");
+        if (malformedSections.length > 0) {
+            errorResult = toolError(`stateFile has a non-array maintenanceVerdicts for: ${malformedSections.join(", ")}. ` +
+                `Re-run skyramp_actions for that repository to rewrite the section.`);
             return errorResult;
         }
-        // action/testType/endpoint/description come entirely from stateData.maintenanceVerdicts
-        // (written by skyramp_actions right after drift analysis) — the LLM never supplies
-        // testMaintenance directly, so there's nothing to re-transcribe here.
+        const badVerdicts = [];
+        // action/testType/endpoint/description come entirely from each section's
+        // maintenanceVerdicts (written by skyramp_actions right after drift analysis) —
+        // the LLM never supplies testMaintenance directly, so there's nothing to
+        // re-transcribe here.
         // `pomFile` rides along per row and is stripped from the wire format below,
         // like testFilePath. It cannot be keyed by spec path: a spec emits one UPDATE
         // verdict PER page object, so a spec-keyed map keeps only the last.
-        const rawMaintenance = (stateData.maintenanceVerdicts ?? []).map((v) => ({
+        const rawMaintenance = maintenanceSections.flatMap((section) => (section.data.maintenanceVerdicts ?? [])
+            .filter((v) => {
+            if (v && typeof v.testFilePath === "string" && v.testFilePath.trim())
+                return true;
+            badVerdicts.push(section.repository ?? "the primary repo");
+            return false;
+        })
+            .map((v) => ({
+            repository: repositoryOf(section),
             testFilePath: v.testFilePath,
             pomFile: v.pomFile,
             testType: v.testType,
@@ -1146,20 +1244,47 @@ export function registerSubmitReportTool(server) {
                 : v.rationale,
             beforeDetails: "",
             afterDetails: "",
-        }));
+        })));
+        // GitHub slugs are case-insensitive, so two sections can name one repo and
+        // repeat a file. Keep the first — the primary's, given the order above.
+        // pomFile is part of the key: one spec emits one UPDATE verdict per page
+        // object, and those rows are distinct, not duplicates.
+        const seenRows = new Set();
+        const dedupedMaintenance = rawMaintenance.filter((row) => {
+            const key = `${(row.repository ?? "").trim().toLowerCase()}\u0000${row.testFilePath}\u0000${row.pomFile ?? ""}`;
+            if (seenRows.has(key))
+                return false;
+            seenRows.add(key);
+            return true;
+        });
+        if (badVerdicts.length > 0) {
+            errorResult = toolError(`${badVerdicts.length} maintenance verdict(s) in the stateFile have no testFilePath ` +
+                `(sections: ${[...new Set(badVerdicts)].join(", ")}). ` +
+                `Re-run skyramp_actions for those repositories to rewrite the section.`);
+            return errorResult;
+        }
+        // Keyed by the row's own repo, so executions come from its own section.
+        const sectionByRepository = new Map(maintenanceSections.map((section) => [
+            repositoryOf(section),
+            section.data,
+        ]));
         let testMaintenance;
         // Rows missing a required detail (a real execution happened but the LLM didn't
         // draft a summary for it) — collected here and rejected below, rather than
         // silently shipping a blank field.
         const missingDetails = [];
-        if (rawMaintenance.length > 0) {
+        if (dedupedMaintenance.length > 0) {
             // beforeStatus/afterStatus are always stateFile-authoritative. beforeDetails/
             // afterDetails come from the LLM's drafted summary (testMaintenanceDetails) —
             // required whenever the stateFile shows a matching execution actually ran.
-            testMaintenance = rawMaintenance.map((m) => {
-                const recorded = stateData.existingTests?.find((t) => testFileMatches(t.testFile, m.testFilePath));
+            testMaintenance = dedupedMaintenance.map((m) => {
+                const recorded = sectionByRepository
+                    .get(m.repository)
+                    ?.existingTests?.find((t) => testFileMatches(t.testFile, m.testFilePath));
                 const detail = params.testMaintenanceDetails?.find((d) => d.testFilePath === m.testFilePath);
-                const displayName = path.basename(m.testFilePath);
+                // Two repos can hold the same basename; name the repo so the agent
+                // knows which row to draft for.
+                const displayName = `${path.basename(m.testFilePath)} (${m.repository})`;
                 const defaultBeforeStatus = MAINTENANCE_CHANGE_ACTIONS.has(m.action)
                     ? TestExecutionStatus.Unknown
                     : TestExecutionStatus.Skipped;
@@ -1189,7 +1314,8 @@ export function registerSubmitReportTool(server) {
             });
         }
         if (missingDetails.length > 0) {
-            errorResult = toolError(`${missingDetails.length} maintenance row(s) have a recorded execution but no drafted summary: ${missingDetails.join(", ")}. ` +
+            const uniqueMissing = [...new Set(missingDetails)];
+            errorResult = toolError(`${uniqueMissing.length} maintenance row(s) have a recorded execution but no drafted summary: ${uniqueMissing.join(", ")}. ` +
                 "Add a testMaintenanceDetails entry with the missing field(s), drafted from the execution output you already saw.");
             return errorResult;
         }
@@ -1227,6 +1353,11 @@ export function registerSubmitReportTool(server) {
                             ...Object.values(fullState?.relatedRepos ?? {}).map((section) => section.repositoryPath),
                         ])),
                     ];
+                    // Primary verdicts only, by design: this checks UPDATEs, and
+                    // skyramp_actions downgrades every actionable related-repo verdict to
+                    // VERIFY (actionsTool.ts). If that changes, pass each section's
+                    // verdicts with its OWN checkout root — isBacked relativizes against
+                    // `repoRoot` and would otherwise exempt them all.
                     const unbacked = findUnchangedFileClaims({
                         repoRoot,
                         changedFiles,
@@ -1315,10 +1446,70 @@ export function registerSubmitReportTool(server) {
         const assertionCheckouts = await stateManager
             .listRepoCheckouts()
             .catch(() => []);
+        const reuseBlocking = [];
         const sanitizedNewTests = await Promise.all(dedupedNewTests.map(async ({ scenarioFile: _sf, traceFile: _tf, frontendTrace: _ft, ...rest }) => {
-            const row = await attachReuseOutcome(normalizeRepository(rest), stateData.reuseOutcomes, stateData.reuseHandOffs, retrofitViews);
+            const row = await attachReuseOutcome(normalizeRepository(rest), stateData.reuseOutcomes, stateData.reuseHandOffs, retrofitViews, reuseBlocking);
             return attachAssertionOutcome(row, stateData.assertionOutcomes ?? {}, assertionCheckouts);
         }));
+        // A blocking reuse verdict on the delivered files refuses the report. The
+        // live verify pass is a one-time checkpoint on a file that keeps changing —
+        // the execution fix loop and a post-verification rewrite both edit after it —
+        // and the verdict re-derived here is the only one measured on what ships. It
+        // used to become a row field, so the run committed the fault, detected it,
+        // disclosed it, and delivered it. Reject rather than publish it, exactly like
+        // the maintenanceVerdicts check above: this is a repair loop, not an abort —
+        // the agent fixes the file (or documents the decline the check names) and
+        // calls again. Advisories never reach this list, so a report-time advisory
+        // stays reportable.
+        //
+        // BOUNDED, per spec: after REUSE_SUBMIT_MAX_REFUSALS refusals of one spec the
+        // report is accepted and its row ships `verification: failed` with the
+        // reasons. A loop with no exit at the last step of a run delivers nothing when
+        // the agent cannot reach a pass, and a customer with no pull request is worse
+        // off than one with a disclosed fault (see REUSE_SUBMIT_MAX_REFUSALS). The
+        // count is persisted per spec path; a count that cannot be persisted cannot
+        // bound anything, so a failed write accepts rather than refuses forever.
+        // `reuseOutcomes` is keyed by basename, so two rows sharing a file name find
+        // one record and push one verdict twice — deduplicated by path here, as
+        // pendingReuseVerification skips that case on its side. Sorted by file so the
+        // text is stable across calls.
+        if (reuseBlocking.length > 0) {
+            const verdicts = [
+                ...new Map(reuseBlocking.map((v) => [v.file, v])).values(),
+            ].sort((a, b) => a.file.localeCompare(b.file));
+            const refusals = { ...(stateData.reuseRefusals ?? {}) };
+            const owed = verdicts.filter((v) => (refusals[v.file] ?? 0) < REUSE_SUBMIT_MAX_REFUSALS);
+            let persisted = owed.length > 0;
+            if (owed.length > 0) {
+                for (const v of owed)
+                    refusals[v.file] = (refusals[v.file] ?? 0) + 1;
+                try {
+                    await stateManager.writeData({ ...stateData, reuseRefusals: refusals });
+                }
+                catch (err) {
+                    persisted = false;
+                    logger.warning("Could not persist the reuse refusal count — accepting the report rather than refusing without a bound", { error: String(err) });
+                }
+            }
+            if (owed.length > 0 && persisted) {
+                errorResult = toolError(`${owed.length} delivered test${owed.length === 1 ? "" : "s"} fail${owed.length === 1 ? "s" : ""} a blocking code-reuse check on the file as it stands now — the same check skyramp_reuse_code runs with verify: true, and a report cannot ship work that does not pass it:\n` +
+                    owed
+                        .map((v) => `\n- ${v.file} · ${v.failures.map((f) => f.kind).join(", ")} · refusal ${refusals[v.file]} of ${REUSE_SUBMIT_MAX_REFUSALS}\n${indent(v.detail)}\n  Then call ${v.verifyCall} so the repaired files are re-checked.`)
+                        .join("\n") +
+                    // The bound is stated as a counter only. What happens when it is
+                    // reached is not — an agent told that two more calls ship the report
+                    // may wait instead of repair, and the sanctioned exits (repair, or the
+                    // documented decline) are already named.
+                    `\n\nRepair each file above (or document a deliberate decline with the exact marker the check names), re-verify it, and call skyramp_submit_report again.`);
+                return errorResult;
+            }
+            logger.warning("Accepting a report whose delivered files fail a blocking code-reuse check — the refusal bound is reached, the rows record the failure", {
+                files: verdicts.map((v) => ({
+                    file: v.file,
+                    kinds: v.failures.map((f) => f.kind),
+                })),
+            });
+        }
         // The report enum has no `bug_caught` value, so which failure was on purpose
         // is derived from the plan rather than from agent prose. Read defensively:
         // the plan comes off disk.
@@ -1357,7 +1548,13 @@ export function registerSubmitReportTool(server) {
         let objections;
         let changeTable;
         {
-            const postExecution = runPostExecutionChecks(stateData.plan ?? { plannedTests: [], registrationNumber: 0, answers: [], openObjections: [], answeredObjections: [] }, dedupedNewTests, params.testResults, params.issuesFound ?? []);
+            const postExecution = runPostExecutionChecks(stateData.plan ?? { plannedTests: [], registrationNumber: 0, answers: [], openObjections: [], answeredObjections: [] }, dedupedNewTests, params.testResults, params.issuesFound ?? [], isPlanOnlyMode(), 
+            // The triage's own verdicts, not this tool's input, so the join is against
+            // what the run is recorded as having edited — and only the rows that left a
+            // test standing and were actually applied, so a no-op assessment, a deletion
+            // or a report-only recommendation cannot corroborate. The verdicts rather
+            // than the published rows because `reportOnly` lives here.
+            rowsLeavingCoverage(stateData.maintenanceVerdicts));
             // Read defensively, like the crash-contained checks above: the plan comes
             // off disk, so its declared array type holds only on the validated path.
             const stillOpen = Array.isArray(stateData.plan?.openObjections)
@@ -1501,6 +1698,46 @@ export function registerSubmitReportTool(server) {
                         changesByCandidate.set(id, cited.map((entry) => String(entry ?? "").trim()));
                     }
                 }
+                // A change an existing test covers raises no `coverage:change:` objection
+                // and ships no planned test, so neither `testedBy` nor `answer` would say
+                // anything about it. Without this the table reads as untested for a change
+                // `coverage` counts as covered.
+                //
+                // Only what a maintenance row corroborates: publishing a claim on its own
+                // would let the table assert coverage the verifier refused — `coverage`
+                // declines to credit an entry whose file does not resolve, and this row
+                // would still have named it. An uncorroborated claim draws
+                // `deliveredMatchesPlan:maintains:` instead of a table entry.
+                //
+                // `testFileMatches` rather than a basename, so a spec under one directory
+                // cannot lend its coverage to a same-named spec under another; and only the
+                // rows that left a test standing, so DELETE and the no-op actions cannot
+                // corroborate a claim that an existing test covers the change.
+                const editedPaths = [];
+                for (const row of rowsLeavingCoverage(stateData.maintenanceVerdicts)) {
+                    for (const full of [row?.testFilePath, row?.pomFile]) {
+                        const path = typeof full === "string" ? full.trim() : "";
+                        if (path)
+                            editedPaths.push(path);
+                    }
+                }
+                const maintainedByChange = new Map();
+                for (const entry of Array.isArray(stateData.plan?.maintains) ? stateData.plan.maintains : []) {
+                    const file = String(entry?.file ?? "").trim();
+                    if (!file || !Array.isArray(entry?.changes))
+                        continue;
+                    if (!editedPaths.some((full) => testFileMatches(full, file)))
+                        continue;
+                    for (const cited of entry.changes) {
+                        const changeId = String(cited ?? "").trim();
+                        if (!changeId)
+                            continue;
+                        const files = maintainedByChange.get(changeId) ?? [];
+                        if (!files.includes(file))
+                            files.push(file);
+                        maintainedByChange.set(changeId, files);
+                    }
+                }
                 const answerByChange = new Map();
                 for (const objection of objections) {
                     if (!objection.objectionId.startsWith(CHANGE_OBJECTION_PREFIX))
@@ -1515,11 +1752,13 @@ export function registerSubmitReportTool(server) {
                         .map((test) => (test.plannedTestId ?? "").trim())
                         .filter((plannedTestId) => plannedTestId && (changesByCandidate.get(plannedTestId) ?? []).includes(id));
                     const answer = answerByChange.get(id);
+                    const maintainedBy = maintainedByChange.get(id) ?? [];
                     return {
                         id,
                         text: String(change?.text ?? ""),
                         source: String(change?.source ?? ""),
                         testedBy,
+                        ...(maintainedBy.length > 0 ? { maintainedBy } : {}),
                         ...(answer ? { answer } : {}),
                     };
                 });
@@ -1565,8 +1804,6 @@ export function registerSubmitReportTool(server) {
             additionalRecommendations: dedupedRecommendations.map(normalizeRepository),
             // Report wire format keeps main's original `fileName` (basename) — testFilePath is
             // an internal-only field, needed for matching but never meant to reach the report.
-            // TODO(multi-repo maintenance): map(normalizeRepository) once testMaintenanceSchema
-            // has a repository field (see TODO above).
             testMaintenance: testMaintenance
                 ? await Promise.all(testMaintenance.map(async ({ testFilePath, pomFile, ...row }) => {
                     // `pomFile` is the file skyramp_actions told the agent to edit;
@@ -1582,7 +1819,7 @@ export function registerSubmitReportTool(server) {
                     const assertions = record
                         ? await rederiveAssertionOutcome(record)
                         : undefined;
-                    return {
+                    return normalizeRepository({
                         ...row,
                         fileName: path.basename(testFilePath),
                         ...(pomFile &&
@@ -1590,7 +1827,7 @@ export function registerSubmitReportTool(server) {
                             ? { editedFileName: path.basename(pomFile) }
                             : {}),
                         ...(assertions ? { assertions } : {}),
-                    };
+                    });
                 }))
                 : undefined,
             // videoPath is filled from the run's execution records; testFilePath is the

package/build/tools/test-management/actionsTool.js

@@ -410,6 +410,11 @@ export function registerActionsTool(server) {
                         ...(r.rebaselineSnapshots?.length
                             ? { rebaselineSnapshots: r.rebaselineSnapshots, rebaselineOnly: r.rebaselineOnly === true }
                             : {}),
+                        // Persisted so maintenance coverage can tell a REGENERATE that rewrote a
+                        // file from one that only advised the developer to: an external test's
+                        // REGENERATE/DELETE keeps its real action and touches nothing, so without
+                        // this the report credits a `maintains` claim no edit backs.
+                        ...(r.reportOnly ? { reportOnly: true } : {}),
                     })),
                 }, { repo: args.repository, repositoryPath, step: "actions" });
             }

package/build/tools/test-management/analyzeChangesTool.d.ts

@@ -1,5 +1,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
+import { AuthFinding } from "../../utils/workspaceAuth.js";
 import { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import { TraceFile } from "../../types/RepositoryAnalysis.js";
 import { ChangedFileName } from "../../utils/branchDiff.js";
@@ -58,6 +59,10 @@ export interface AnalyzeChangesData {
         openApiSpecPath?: string;
         /** Whether the spec loaded and carried usable path entries. */
         openApiSpecLoaded: boolean;
+        /** What the agent has to decide about this repository's auth, when the
+         *  workspace and the code disagree. Each carries the sentence the agent acts
+         *  on; the server changes no value on the strength of one. */
+        authFindings?: AuthFinding[];
     };
     /**
      * Identifying `data-*` attributes the diff removed from files that survive it
@@ -116,18 +121,66 @@ export declare const analyzeChangesOutputSchema: {
         authHeader: z.ZodOptional<z.ZodString>;
         openApiSpecPath: z.ZodOptional<z.ZodString>;
         openApiSpecLoaded: z.ZodBoolean;
+        authFindings: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            kind: z.ZodLiteral<"workspace-disagreement">;
+            message: z.ZodString;
+            serviceName: z.ZodString;
+            field: z.ZodEnum<["authType", "authHeader", "authScheme"]>;
+            primary: z.ZodString;
+            analysed: z.ZodString;
+            primaryWorkspaceFile: z.ZodString;
+            analysedWorkspaceFile: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            message: string;
+            kind: "workspace-disagreement";
+            serviceName: string;
+            field: "authHeader" | "authScheme" | "authType";
+            primaryWorkspaceFile: string;
+            analysedWorkspaceFile: string;
+            primary: string;
+            analysed: string;
+        }, {
+            message: string;
+            kind: "workspace-disagreement";
+            serviceName: string;
+            field: "authHeader" | "authScheme" | "authType";
+            primaryWorkspaceFile: string;
+            analysedWorkspaceFile: string;
+            primary: string;
+            analysed: string;
+        }>, "many">>;
     }, "strip", z.ZodTypeAny, {
         baseUrl: string;
         authMethod: string;
         openApiSpecLoaded: boolean;
         authHeader?: string | undefined;
         openApiSpecPath?: string | undefined;
+        authFindings?: {
+            message: string;
+            kind: "workspace-disagreement";
+            serviceName: string;
+            field: "authHeader" | "authScheme" | "authType";
+            primaryWorkspaceFile: string;
+            analysedWorkspaceFile: string;
+            primary: string;
+            analysed: string;
+        }[] | undefined;
     }, {
         baseUrl: string;
         authMethod: string;
         openApiSpecLoaded: boolean;
         authHeader?: string | undefined;
         openApiSpecPath?: string | undefined;
+        authFindings?: {
+            message: string;
+            kind: "workspace-disagreement";
+            serviceName: string;
+            field: "authHeader" | "authScheme" | "authType";
+            primaryWorkspaceFile: string;
+            analysedWorkspaceFile: string;
+            primary: string;
+            analysed: string;
+        }[] | undefined;
     }>>;
     uiContext: z.ZodOptional<z.ZodObject<{
         removedElements: z.ZodOptional<z.ZodArray<z.ZodObject<{