@taiga-ai/mcp-server 0.20.0-dev.454 → 0.21.0-dev.455

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.20.0-dev.454",
+  "version": "0.21.0-dev.455",
   "description": "MCP server for Taiga -- gives AI assistants access to documents and products",
   "type": "module",
   "main": "./dist/index.js",

package/src/server.integration.test.ts

@@ -5,6 +5,7 @@ import { TaigaClient } from './client.js';
 import { createServer } from './server.js';
 import type { WaitOptions } from './tools/wait.js';
 import { inProductWords } from './tools/errors.js';
+import { PAID_WORK } from './tools/index.js';
 
 /** What a tool returns for an API value: its keys in the product's words (PRO-2800). */
 const asSeen = <T>(value: T): T => inProductWords(value) as T;
@@ -38,9 +39,9 @@ const ALL_CAPABILITIES = [
 const ALL_TOOL_NAMES = [
   'taiga_add_knowledge',
   'taiga_approve_plan',
+  'taiga_create_environment',
   'taiga_create_factory',
   'taiga_create_product',
-  'taiga_define_environment',
   'taiga_delete_knowledge',
   'taiga_finish_discovery',
   'taiga_fix_finding',
@@ -55,7 +56,6 @@ const ALL_TOOL_NAMES = [
   'taiga_get_job',
   'taiga_get_knowledge',
   'taiga_get_line',
-  'taiga_get_maintenance',
   'taiga_get_monitoring',
   'taiga_get_plan',
   'taiga_get_policy_standing',
@@ -97,7 +97,6 @@ const ALL_TOOL_NAMES = [
   'taiga_reopen_discovery',
   'taiga_request_initiatives',
   'taiga_resolve_action',
-  'taiga_resolve_product',
   'taiga_resume_initiative',
   'taiga_retry_knowledge',
   'taiga_set_auto_build',
@@ -439,7 +438,6 @@ describe('MCP server integration', () => {
         'taiga_list_products',
         'taiga_get_product',
         'taiga_get_product_context',
-        'taiga_resolve_product',
         'taiga_list_product_documents',
         'taiga_get_product_document',
         'taiga_list_runs',
@@ -448,7 +446,6 @@ describe('MCP server integration', () => {
         'taiga_wait_for_run',
         'taiga_get_job',
         'taiga_wait_for_job',
-        'taiga_get_maintenance',
         'taiga_list_findings',
         'taiga_get_finding',
         'taiga_get_policy_standing',
@@ -504,7 +501,7 @@ describe('MCP server integration', () => {
         'taiga_fix_finding',
         'taiga_fix_policy_violation',
         'taiga_resolve_action',
-        'taiga_define_environment',
+        'taiga_create_environment',
         'taiga_update_environment',
         'taiga_update_product_document',
         'taiga_regenerate_product_document',
@@ -978,24 +975,19 @@ describe('MCP server integration', () => {
     };
     const step = { id: 'step-1', runId: BUILD_ID, stepOrder: 1, title: 'Add the route', status: 'completed' };
 
-    it('should resolve the product from a git remote through the repository filter', async () => {
+    it('should read the product a git remote belongs to through the repository filter', async () => {
       const { client, fetchSpy } = await bootMcpPair({
         capabilities: ['products:read'],
         routes: { '/v1/products': { data: [product], nextCursor: null } },
       });
 
       const result = await client.callTool({
-        name: 'taiga_resolve_product',
+        name: 'taiga_get_product',
         arguments: { remoteUrl: 'git@github.com:Acme/Web.git' },
       });
 
       expect(result.isError).toBeFalsy();
-      expect(parseToolResult(result)).toEqual({
-        repository: 'Acme/Web',
-        host: 'https://github.com',
-        products: [productSummary],
-        truncated: false,
-      });
+      expect(parseToolResult(result)).toMatchObject({ id: PRODUCT_ID, name: product.name });
       const url = sentUrl(fetchSpy, '/v1/products');
       expect(url.searchParams.get('repository')).toBe('Acme/Web');
       expect(url.searchParams.get('repositoryHost')).toBe('https://github.com');
@@ -1016,13 +1008,7 @@ describe('MCP server integration', () => {
       });
     }
 
-    const productPageCursors = (fetchSpy: ReturnType<typeof vi.fn>) =>
-      fetchSpy.mock.calls
-        .map((c: unknown[]) => new URL(c[0] as string))
-        .filter((u: URL) => u.pathname === '/v1/products')
-        .map((u: URL) => u.searchParams.get('cursor'));
-
-    it('should follow the pages of a shared repository rather than stop at the first', async () => {
+    it('should refuse a remote shared by several products with their IDs, across pages', async () => {
       const second = { ...product, id: PRODUCT_ID_2, name: 'Web Admin' };
       const { client, fetchSpy } = await bootMcpPair({ capabilities: ['products:read'] });
       serveProductPages(fetchSpy, (cursor) =>
@@ -1030,32 +1016,18 @@ describe('MCP server integration', () => {
       );
 
       const result = await client.callTool({
-        name: 'taiga_resolve_product',
-        arguments: { remoteUrl: 'git@github.com:acme/web.git' },
-      });
-
-      const parsed = parseToolResult(result);
-      expect(parsed.products.map((p: { id: string }) => p.id)).toEqual([PRODUCT_ID, PRODUCT_ID_2]);
-      expect(parsed.truncated).toBe(false);
-      expect(productPageCursors(fetchSpy)).toEqual([null, 'page-2']);
-    });
-
-    it('should stop after ten pages and say the list is truncated', async () => {
-      const { client, fetchSpy } = await bootMcpPair({ capabilities: ['products:read'] });
-      serveProductPages(fetchSpy, () => ({ data: [product], nextCursor: 'more' }));
-
-      const result = await client.callTool({
-        name: 'taiga_resolve_product',
+        name: 'taiga_get_product',
         arguments: { remoteUrl: 'git@github.com:acme/web.git' },
       });
 
-      const parsed = parseToolResult(result);
-      expect(parsed.products).toHaveLength(10);
-      expect(parsed.truncated).toBe(true);
-      expect(productPageCursors(fetchSpy)).toHaveLength(10);
+      expect(result.isError).toBe(true);
+      const said = parseToolResult(result);
+      expect(said.error).toBe('AMBIGUOUS');
+      expect(said.message).toContain(PRODUCT_ID);
+      expect(said.message).toContain(PRODUCT_ID_2);
     });
 
-    it('should fail the whole resolution when a later page fails, not hand back a partial list', async () => {
+    it('should fail the whole resolution when a later page fails, not answer from a partial list', async () => {
       const { client, fetchSpy } = await bootMcpPair({ capabilities: ['products:read'] });
       const router = fetchSpy.getMockImplementation() as (url: string, init: RequestInit) => Promise<unknown>;
       fetchSpy.mockImplementation(async (url: string, init: RequestInit) => {
@@ -1070,7 +1042,7 @@ describe('MCP server integration', () => {
       });
 
       const result = await client.callTool({
-        name: 'taiga_resolve_product',
+        name: 'taiga_get_product',
         arguments: { remoteUrl: 'git@github.com:acme/web.git' },
       });
 
@@ -1085,7 +1057,7 @@ describe('MCP server integration', () => {
       });
 
       const result = await client.callTool({
-        name: 'taiga_resolve_product',
+        name: 'taiga_get_product',
         arguments: { remoteUrl: 'https://github.com/acme/web.git' },
       });
 
@@ -1101,7 +1073,7 @@ describe('MCP server integration', () => {
       const before = fetchSpy.mock.calls.length;
 
       const result = await client.callTool({
-        name: 'taiga_resolve_product',
+        name: 'taiga_get_product',
         arguments: { remoteUrl: '/Users/dev/web' },
       });
 
@@ -1205,9 +1177,11 @@ describe('MCP server integration', () => {
       expect(parseToolResult(result)).toEqual({
         ...rest,
         initiativeId: ITEM_ID,
-        // Completed with no merge recorded: an older run that settled on an open pull request.
+        // Completed with no merge recorded: an older run that settled on an open pull request. Without
+        // backlog:read the key cannot say whether its initiative still wants it.
         disposition: 'unmerged',
-        outcome: 'Settled without merging: its pull request was left unmerged.',
+        outcome:
+          'Settled without merging: its pull request was left unmerged. Whether its initiative still wants it was not checked.',
         steps: [step],
       });
     });
@@ -2031,9 +2005,7 @@ describe('MCP server integration', () => {
       expect(bundle.documents.notes).toEqual([
         'No published plan architecture; taiga_list_product_documents shows what the product has.',
       ]);
-      expect(bundle.policies).toEqual([
-        { type: 'policy_security', name: 'Security Policy', version: 3, sections: ['summary', 'scope'] },
-      ]);
+      expect(bundle.policies).toEqual([{ type: 'policy_security', name: 'Security Policy', version: 3, sections: 2 }]);
       expect(bundle.initiatives.items.map((row: { id: string }) => row.id)).toEqual([ITEM_ID]);
       expect(bundle.initiatives.items[0]).not.toHaveProperty('description');
       expect(bundle.initiatives.truncated).toBe(false);
@@ -2966,7 +2938,7 @@ describe('MCP server integration', () => {
         'taiga_stop_run',
         'taiga_request_initiatives',
         'taiga_plan_again',
-        'taiga_define_environment',
+        'taiga_create_environment',
         'taiga_add_knowledge',
         'taiga_retry_knowledge',
       ]) {
@@ -4978,7 +4950,7 @@ describe('MCP server integration', () => {
         .filter((c: unknown[]) => ((c[1] as RequestInit | undefined)?.method ?? 'GET') === method)
         .map((c: unknown[]) => new URL(c[0] as string));
 
-    it("should read a product's maintenance standing with its latest sweeps, and say when it was never swept", async () => {
+    it('should open the findings with the sweep overview, and say when the product was never swept', async () => {
       const summary = {
         productId: PRODUCT_ID,
         openFindings: 2,
@@ -4990,6 +4962,7 @@ describe('MCP server integration', () => {
         capabilities: ['products:read'],
         routes: {
           [`/v1/products/${PRODUCT_ID}/maintenance/summary`]: { data: summary },
+          [`/v1/products/${PRODUCT_ID}/maintenance/findings`]: { data: [], nextCursor: null },
           [`/v1/products/${PRODUCT_ID}/maintenance/runs`]: {
             data: [
               { id: 'run-1', trigger: 'event', status: 'completed', scanners: { deps: 'passed' }, agentJobId: 'x' },
@@ -4999,8 +4972,8 @@ describe('MCP server integration', () => {
         },
       });
       const standing = parseToolResult(
-        await swept.client.callTool({ name: 'taiga_get_maintenance', arguments: { productId: PRODUCT_ID } })
-      );
+        await swept.client.callTool({ name: 'taiga_list_findings', arguments: { productId: PRODUCT_ID } })
+      ).sweep;
       expect(standing).toMatchObject({ openFindings: 2, latestSweeps: [{ id: 'run-1', status: 'completed' }] });
       expect(standing.latestSweeps[0]).not.toHaveProperty('agentJobId');
       expect(standing).not.toHaveProperty('note');
@@ -5010,12 +4983,13 @@ describe('MCP server integration', () => {
         capabilities: ['products:read'],
         routes: {
           [`/v1/products/${PRODUCT_ID}/maintenance/summary`]: { data: { ...summary, openFindings: 0 } },
+          [`/v1/products/${PRODUCT_ID}/maintenance/findings`]: { data: [], nextCursor: null },
           [`/v1/products/${PRODUCT_ID}/maintenance/runs`]: { data: [], nextCursor: null },
         },
       });
       const quiet = parseToolResult(
-        await never.client.callTool({ name: 'taiga_get_maintenance', arguments: { productId: PRODUCT_ID } })
-      );
+        await never.client.callTool({ name: 'taiga_list_findings', arguments: { productId: PRODUCT_ID } })
+      ).sweep;
       expect(quiet.note).toMatch(/never been swept/);
     });
 
@@ -5437,7 +5411,7 @@ describe('MCP server integration', () => {
       });
 
       await client.callTool({
-        name: 'taiga_define_environment',
+        name: 'taiga_create_environment',
         arguments: { productId: PRODUCT_ID, name: 'staging', type: 'staging' },
       });
       expect(sentBody(fetchSpy, 'POST', '/environments')).toEqual({ name: 'staging', type: 'staging' });
@@ -7073,11 +7047,15 @@ describe('what the second agent review found (PRO-2778, PRO-2780)', () => {
     for (const tool of tools) {
       const notes = tool.annotations ?? {};
       const description = tool.description ?? '';
-      if (notes.readOnlyHint) expect(description, tool.name).not.toMatch(/^(Writes\.|Ask first:)/);
-      else if (notes.destructiveHint) expect(description, tool.name).toMatch(/^Ask first: paid or shared work\. /);
+      if (notes.readOnlyHint) expect(description, tool.name).not.toMatch(/^(Writes\.|Ask first)/);
+      else if (notes.destructiveHint)
+        expect(description, tool.name).toMatch(/^Ask first \((paid agent work|others see it)\)\. /);
       else expect(description, tool.name).toMatch(/^Writes\. /);
     }
-    expect(tools.find((t) => t.name === 'taiga_queue_initiative')!.description).toMatch(/^Ask first:/);
+    expect(tools.find((t) => t.name === 'taiga_queue_initiative')!.description).toMatch(
+      /^Ask first \(paid agent work\)/
+    );
+    expect(tools.find((t) => t.name === 'taiga_rename_factory')!.description).toMatch(/^Ask first \(others see it\)/);
     expect(tools.find((t) => t.name === 'taiga_create_factory')!.description).toMatch(/^Writes\. /);
   });
 
@@ -7132,7 +7110,7 @@ describe('what the third agent review found (PRO-2800)', () => {
     expect(me.role).toBeTypeOf('string');
     expect(me.capabilities).toEqual(expect.arrayContaining(['products:read', 'backlog:write']));
     expect(me.tools.reads).toContain('taiga_get_product_context');
-    expect(me.tools.askFirst).toContain('taiga_queue_initiative');
+    expect(me.tools.askFirstPaid).toContain('taiga_queue_initiative');
     expect(me.tools.reads).not.toContain('taiga_whoami');
   });
 
@@ -7205,7 +7183,9 @@ describe('what the third agent review found (PRO-2800)', () => {
       await client.callTool({ name: 'taiga_list_runs', arguments: { productId: PRODUCT_ID } })
     ).data as Record<string, unknown>[];
 
-    expect(runs[0]!['outcome']).toMatch(/look at what is still running or queued in CI/);
+    expect(runs[0]!['outcome']).toMatch(
+      /look at what is still running or queued in CI on GitHub, then review the pull request/
+    );
     expect(runs[1]!['outcome']).toMatch(/CI is still failing after 1 automatic round\./);
     expect(runs[2]!['outcome']).toBe('Failed: TypeError: boom (2 of 3 steps done).');
     // A row says the handback in its outcome; the full read keeps the record.
@@ -7297,6 +7277,38 @@ describe('what the third agent review found (PRO-2800)', () => {
     expect(got.lifecycle.latestRun.id).toBe(BUILD_ID);
   });
 
+  it('points a control id asked of a product document at the policy', async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ['products:read'],
+      routes: {
+        [`GET /v1/products/${PRODUCT_ID}`]: {
+          data: { id: PRODUCT_ID, name: 'Web', slug: 'web', status: 'active', factoryId: FACTORY_ID, settings: {} },
+        },
+        [`GET /v1/products/${PRODUCT_ID}/documents/threat_model`]: {
+          data: {
+            id: 'd',
+            type: 'threat_model',
+            version: 1,
+            isDraft: false,
+            data: { sections: { risks: { content: 'SEC-5.1 applies.' } } },
+          },
+        },
+      },
+    });
+
+    const doc = parseToolResult(
+      await client.callTool({
+        name: 'taiga_get_product_document',
+        arguments: { productId: PRODUCT_ID, type: 'threat_model', sections: ['SEC-5.1'] },
+      })
+    );
+
+    expect(doc.unknownSections).toEqual(['SEC-5.1']);
+    expect(doc.note).toBe(
+      'SEC-5.1 is a control of policy_security: read it with taiga_get_document (type: policy_security, sections: ["SEC-5.1"]).'
+    );
+  });
+
   it('reads the sections that state a policy control id', async () => {
     const { client } = await bootMcpPair({
       capabilities: ALL_CAPABILITIES,
@@ -7315,6 +7327,7 @@ describe('what the third agent review found (PRO-2800)', () => {
                 logging: { content: '| SEC-5.10 | Log access |' },
                 appendix: { content: 'See SEC-5.1A and SEC-5.1-appendix, and SEC-5.1.2.' },
                 summary: { content: 'Secrets follow SEC-5.1.' },
+                telecom: { content: '| TEL-TIC-1.1 | Lawful intercept |' },
               },
             },
           },
@@ -7325,14 +7338,15 @@ describe('what the third agent review found (PRO-2800)', () => {
     const doc = parseToolResult(
       await client.callTool({
         name: 'taiga_get_document',
-        arguments: { type: 'policy_security', sections: ['SEC-5.1', 'SEC-9.9'] },
+        arguments: { type: 'policy_security', sections: ['SEC-5.1', 'SEC-9.9', 'TEL-TIC-1.1', 'TIC-1.1'] },
       })
     );
 
-    // A whole id only, and a sentence's full stop after it is still the id.
-    expect(Object.keys(doc.data.sections).sort()).toEqual(['secretsManagement', 'summary']);
-    expect(doc.controls).toEqual({ 'SEC-5.1': ['secretsManagement', 'summary'] });
-    expect(doc.unknownSections).toEqual(['SEC-9.9']);
+    // A whole id only, and a sentence's full stop after it is still the id; an overlay family's id resolves,
+    // and its tail (TIC-1.1) is not the same control.
+    expect(Object.keys(doc.data.sections).sort()).toEqual(['secretsManagement', 'summary', 'telecom']);
+    expect(doc.controls).toEqual({ 'SEC-5.1': ['secretsManagement', 'summary'], 'TEL-TIC-1.1': ['telecom'] });
+    expect(doc.unknownSections).toEqual(['SEC-9.9', 'TIC-1.1']);
   });
 
   it('loads the three entry tools upfront in Claude Code, and only those', async () => {
@@ -7609,7 +7623,7 @@ describe('what the third agent review found (PRO-2800)', () => {
       [
         'gated',
         'Handed back to a person: CI is still failing on secret-scan, and the last fix round changed nothing. ' +
-          'PR #29, still a draft, waits for them to fix it by hand or review it back to the agent.',
+          'PR #29, still a draft, waits for them to fix it by hand, or review the pull request on GitHub, which hands it back to the agent.',
       ],
       [
         'failed',
@@ -7751,3 +7765,276 @@ describe('what the third agent review found (PRO-2800)', () => {
     expect(instructions).toContain('taiga_get_product_context');
   });
 });
+
+describe('what the fourth agent review found (PRO-2800)', () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('says a run whose initiative was canceled or deleted is abandoned, not waiting on anyone', async () => {
+    const GONE = '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4f01';
+    const base = { productId: PRODUCT_ID, status: 'needs_review', prState: 'open', completedSteps: 3, totalSteps: 3 };
+    const { client } = await bootMcpPair({
+      capabilities: ['products:read', 'backlog:read'],
+      routes: {
+        [`/v1/products/${PRODUCT_ID}/builds`]: {
+          data: [
+            {
+              ...base,
+              id: 'r1',
+              backlogItemId: ITEM_ID,
+              prNumber: 10,
+              prUrl: 'https://x/10',
+              actions: ['retry_from_failed_step'],
+            },
+            { ...base, id: 'r2', backlogItemId: GONE, prNumber: 11, prUrl: 'https://x/11' },
+          ],
+          nextCursor: null,
+        },
+        [`GET /v1/backlog/${ITEM_ID}`]: { data: { id: ITEM_ID, status: 'canceled', state: 'canceled' } },
+        [`GET /v1/backlog/${GONE}`]: refusal(404, 'NOT_FOUND', 'Backlog item not found'),
+      },
+    });
+
+    const runs = parseToolResult(
+      await client.callTool({ name: 'taiga_list_runs', arguments: { productId: PRODUCT_ID } })
+    ).data as Record<string, unknown>[];
+
+    expect(runs.map((run) => [run['disposition'], run['outcome']])).toEqual([
+      [
+        'abandoned',
+        'Its initiative was canceled, so nobody is waiting on this run. PR #10 is still open on the forge.',
+      ],
+      ['abandoned', 'Its initiative was deleted, so nobody is waiting on this run. PR #11 is still open on the forge.'],
+    ]);
+    expect(runs[0]!['actions']).toEqual([]);
+  });
+
+  it('refuses a factory or product name already taken, unless the person wants a second', async () => {
+    const { client, fetchSpy } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        'GET /v1/factories': { data: [{ id: FACTORY_ID, name: 'Platform', slug: 'platform' }], nextCursor: null },
+        'POST /v1/factories': { data: { id: 'new', name: 'platform', slug: 'platform-2', isDefault: false } },
+      },
+    });
+
+    const refused = await client.callTool({ name: 'taiga_create_factory', arguments: { name: ' platform ' } });
+    const made = await client.callTool({
+      name: 'taiga_create_factory',
+      arguments: { name: 'platform', allowDuplicateName: true },
+    });
+
+    expect(parseToolResult(refused)).toMatchObject({ error: 'DUPLICATE_NAME', details: { existingId: FACTORY_ID } });
+    expect(made.isError).toBeFalsy();
+    expect(
+      fetchSpy.mock.calls.filter((call: unknown[]) => (call[1] as RequestInit | undefined)?.method === 'POST')
+    ).toHaveLength(1);
+  });
+
+  it('refuses a product name already taken, unless the person wants a second', async () => {
+    const { client, fetchSpy } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        'GET /v1/products': {
+          data: [{ id: PRODUCT_ID, name: 'Web', slug: 'web', factoryId: FACTORY_ID }],
+          nextCursor: null,
+        },
+        'POST /v1/products': {
+          data: { id: PRODUCT_ID_2, name: 'web', slug: 'web-2', status: 'active', factoryId: FACTORY_ID, settings: {} },
+        },
+      },
+    });
+
+    const refused = await client.callTool({
+      name: 'taiga_create_product',
+      arguments: { factoryId: FACTORY_ID, name: 'WEB', start: 'scratch' },
+    });
+    const made = await client.callTool({
+      name: 'taiga_create_product',
+      arguments: { factoryId: FACTORY_ID, name: 'web', start: 'scratch', allowDuplicateName: true },
+    });
+
+    expect(parseToolResult(refused)).toMatchObject({ error: 'DUPLICATE_NAME', details: { existingId: PRODUCT_ID } });
+    expect(made.isError).toBeFalsy();
+    const posts = fetchSpy.mock.calls.filter(
+      (call: unknown[]) =>
+        (call[1] as RequestInit | undefined)?.method === 'POST' && String(call[0]).endsWith('/v1/products')
+    );
+    expect(posts).toHaveLength(1);
+  });
+
+  it('bounds the full policy standing and reads one violation whole', async () => {
+    const long = 'x'.repeat(5_000);
+    const V1 = '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4f02';
+    const { client } = await bootMcpPair({
+      capabilities: ['products:read'],
+      routes: {
+        [`GET /v1/products/${PRODUCT_ID}/maintenance/policies`]: {
+          data: {
+            productId: PRODUCT_ID,
+            controls: [{ controlId: 'SEC-1', divergenceCount: 1 }],
+            divergences: [{ id: V1, controlId: 'SEC-1', severity: 'high', evidence: long }],
+            resolvedDivergences: Array.from({ length: 25 }, (_, n) => ({ id: `r${n}` })),
+          },
+        },
+      },
+    });
+
+    const full = parseToolResult(
+      await client.callTool({ name: 'taiga_get_policy_standing', arguments: { productId: PRODUCT_ID, full: true } })
+    );
+    const one = parseToolResult(
+      await client.callTool({
+        name: 'taiga_get_policy_standing',
+        arguments: { productId: PRODUCT_ID, violationId: V1 },
+      })
+    );
+
+    expect(full.divergences[0].evidence.length).toBeLessThan(1_700);
+    expect(full.divergences[0].evidence).toMatch(/cut at 1500 of 5000 characters/);
+    expect(full.resolvedDivergences).toHaveLength(20);
+    expect(full.resolvedNote).toBe('The first 20 of 25 resolved violations.');
+    expect(one.evidence).toHaveLength(5_000);
+  });
+
+  it('lists the initiatives in one board column, across pages', async () => {
+    const row = (id: string, state: string) => ({ id, title: id, state, status: 'in_progress' });
+    const { client } = await bootMcpPair({
+      capabilities: ['backlog:read'],
+      routes: {
+        [`/v1/products/${PRODUCT_ID}/backlog`]: (url: string) => {
+          const second = new URL(url).searchParams.get('cursor') === 'p2';
+          const body = second
+            ? { data: [row('c', 'queue')], nextCursor: null }
+            : { data: [row('a', 'queue'), row('b', 'build')], nextCursor: 'p2' };
+          return { ok: true, status: 200, json: async () => body, text: async () => JSON.stringify(body) };
+        },
+      },
+    });
+
+    const queued = parseToolResult(
+      await client.callTool({ name: 'taiga_list_initiatives', arguments: { productId: PRODUCT_ID, state: 'queue' } })
+    );
+
+    expect(queued.data.map((item: { id: string }) => item.id)).toEqual(['a', 'c']);
+  });
+
+  it('lists only registered ask-first tools as paid agent work', async () => {
+    const { client } = await bootMcpPair({ capabilities: ALL_CAPABILITIES });
+    const { tools } = await client.listTools();
+    const byName = new Map(tools.map((tool) => [tool.name, tool]));
+
+    for (const name of PAID_WORK) {
+      expect(byName.get(name)?.annotations?.destructiveHint, name).toBe(true);
+      expect(byName.get(name)?.description, name).toMatch(/^Ask first \(paid agent work\)/);
+    }
+  });
+
+  it('says when the sweep overview could not be read, so an empty findings list is no all-clear', async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ['products:read'],
+      routes: { [`/v1/products/${PRODUCT_ID}/maintenance/findings`]: { data: [], nextCursor: null } },
+    });
+
+    const findings = parseToolResult(
+      await client.callTool({ name: 'taiga_list_findings', arguments: { productId: PRODUCT_ID } })
+    );
+
+    expect(findings.sweep).toBeNull();
+    expect(findings.sweepNote).toMatch(/not an all-clear/);
+  });
+
+  it("says a waiting run's initiative was not checked when the key cannot read it", async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ['products:read'],
+      routes: {
+        [`/v1/products/${PRODUCT_ID}/builds`]: {
+          data: [
+            {
+              id: 'r1',
+              productId: PRODUCT_ID,
+              backlogItemId: ITEM_ID,
+              status: 'needs_review',
+              prNumber: 4,
+              prUrl: 'https://x/4',
+            },
+          ],
+          nextCursor: null,
+        },
+      },
+    });
+
+    const runs = parseToolResult(
+      await client.callTool({ name: 'taiga_list_runs', arguments: { productId: PRODUCT_ID } })
+    ).data as Record<string, unknown>[];
+
+    expect(runs[0]!['disposition']).toBe('gated');
+    expect(runs[0]!['outcome']).toMatch(/Whether its initiative still wants it was not checked\.$/);
+  });
+
+  it('reads a control id only in a policy, not in other company documents', async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        'GET /v1/tenants/current/documents/design_standards': {
+          data: {
+            id: 'd',
+            type: 'design_standards',
+            version: 1,
+            isDraft: false,
+            data: { sections: { forms: { content: 'Store secrets per SEC-5.1.' } } },
+          },
+        },
+      },
+    });
+
+    const doc = parseToolResult(
+      await client.callTool({
+        name: 'taiga_get_document',
+        arguments: { type: 'design_standards', sections: ['SEC-5.1'] },
+      })
+    );
+    const overlay = parseToolResult(
+      await client.callTool({
+        name: 'taiga_get_document',
+        arguments: { type: 'design_standards', sections: ['HC-FI-DATA-1.1'] },
+      })
+    );
+
+    expect(doc).not.toHaveProperty('controls');
+    expect(doc.unknownSections).toEqual(['SEC-5.1']);
+    expect(doc.note).toMatch(/^SEC-5\.1 is a control of policy_security: /);
+    // An overlay family's control belongs to the policy its rightmost prefix names.
+    expect(overlay.note).toMatch(/^HC-FI-DATA-1\.1 is a control of policy_data: /);
+  });
+
+  it('leaves a run still executing as it is, whatever its initiative', async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ['products:read', 'backlog:read'],
+      routes: {
+        [`/v1/products/${PRODUCT_ID}/builds`]: {
+          data: [{ id: 'r1', productId: PRODUCT_ID, backlogItemId: ITEM_ID, status: 'implementing', prUrl: null }],
+          nextCursor: null,
+        },
+        [`GET /v1/backlog/${ITEM_ID}`]: { data: { id: ITEM_ID, status: 'canceled', state: 'canceled' } },
+      },
+    });
+
+    const runs = parseToolResult(
+      await client.callTool({ name: 'taiga_list_runs', arguments: { productId: PRODUCT_ID } })
+    ).data as Record<string, unknown>[];
+
+    expect(runs[0]!['disposition']).toBe('in_flight');
+  });
+
+  it('splits the ask-first notice into paid agent work and what others see, in whoami too', async () => {
+    const { client } = await bootMcpPair({ capabilities: ALL_CAPABILITIES });
+
+    const me = parseToolResult(await client.callTool({ name: 'taiga_whoami', arguments: {} }));
+
+    expect(me.tools.askFirstPaid).toContain('taiga_start_import');
+    expect(me.tools.askFirstShared).toContain('taiga_rename_factory');
+    expect(me.capabilities.some((capability: string) => /^(projects|teams):/.test(capability))).toBe(false);
+  });
+});