secufusion-mcp 1.0.41 → 1.0.43

package/AGENTS.md

@@ -17,7 +17,40 @@ You are an elite Senior Developer and Architect working on the SecuFusion worksp
 
 ---
 
-## Phase 00 — Task Classification (The Absolute First Step)
+## Phase 00 — Project Context (The Absolute First Step)
+(TRIGGER: **every session start** — runs BEFORE any problem statement is analyzed)
+
+### MANDATORY sequence — no exceptions
+
+```
+STEP 1: call manage_project_spec(action: "read")
+STEP 2: call manage_project_spec(action: "get_golden_rules")
+STEP 3: if working on a specific service:
+        call manage_project_spec(action: "get_service", service_name: <that service>)
+```
+
+You now know: all service ports, repos, domains, table ownership, inter-service calls,
+Kafka topics, Keycloak config, coding patterns, auth flow, and all golden rules.
+
+### Before any architectural decision — MANDATORY (every time, not just once per session)
+- Call `manage_project_spec(action: "get_golden_rules")` before every architectural decision
+- Call `manage_project_spec(action: "get_coding_patterns")` before writing any new class
+- Call `manage_project_spec(action: "get_service")` before touching any specific microservice
+
+### Hard enforcement — what you are NOT allowed to do before Phase 00 completes
+
+❌ Ask the developer which service owns what  
+❌ Ask what port something runs on  
+❌ Ask how tenantId is extracted  
+❌ Assume any service details from memory  
+❌ Write any code  
+❌ Proceed to any other phase  
+
+The ONLY tool calls permitted in Phase 00 are the `manage_project_spec` calls listed above.
+
+---
+
+## Phase 0.5 — Task Classification
 (TRIGGER: the moment any task, bug, user story, feature, or work item is received)
 
 ### THE RULE — Read, Examine, Then Classify
@@ -200,39 +233,6 @@ even when Azure ticket title is wrong.
 ---
 
 
-## Phase 0.5 — Project Context
-(TRIGGER: **every session start** — runs after classify_task returns PROCEED/CONFIRM, before any architectural decision)
-
-### MANDATORY sequence — no exceptions
-
-```
-STEP 1: call manage_project_spec(action: "read")
-STEP 2: call manage_project_spec(action: "get_golden_rules")
-STEP 3: if working on a specific service:
-        call manage_project_spec(action: "get_service", service_name: <that service>)
-```
-
-You now know: all service ports, repos, domains, table ownership, inter-service calls,
-Kafka topics, Keycloak config, coding patterns, auth flow, and all golden rules.
-
-### Before any architectural decision — MANDATORY (every time, not just once per session)
-- Call `manage_project_spec(action: "get_golden_rules")` before every architectural decision
-- Call `manage_project_spec(action: "get_coding_patterns")` before writing any new class
-- Call `manage_project_spec(action: "get_service")` before touching any specific microservice
-
-### Hard enforcement — what you are NOT allowed to do before Phase 0.5 completes
-
-❌ Ask the developer which service owns what  
-❌ Ask what port something runs on  
-❌ Ask how tenantId is extracted  
-❌ Assume any service details from memory  
-❌ Write any code  
-❌ Proceed to any other phase  
-
-The ONLY tool calls permitted in Phase 0.5 are the `manage_project_spec` calls listed above.
-
----
-
 ## Phase 0.6.6 — Resume
 (TRIGGER: new session, switching branches, or user says "resume" or "continue")
 

package/README.md

@@ -393,36 +393,40 @@ These rules are enforced automatically — the AI will never violate them:
 
 ```
 ┌──────────────┬──────────────────────────────────────────────────────────────┐
-│  Phase 00    │  manage_project_spec (action=read)                            │
-│  Session     │  → Loads full project DNA from .secufusion-project-spec.json  │
-│  Start       │  → AI knows ALL services, ports, patterns, golden rules       │
+│  Phase 00    │  manage_project_spec (action=read + get_golden_rules)         │
+│  Project DNA │  → FIRST step — runs before ANY problem statement is read     │
+│  (Session    │  → AI loaded with ALL services, ports, coding patterns,       │
+│   Start)     │     Kafka topics, golden rules, and tenant isolation config   │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
-│  Phase 0     │  manage_task (action=read_summary)  OR  search_tasks          │
-│  Resume      │  → Token-efficient status view → resume next_step instantly   │
-├──────────────┼──────────────────────────────────────────────────────────────┤
-│  Phase 0.5   │  classify_task → 5-pass deep analysis engine                  │
-│  Ownership   │  Pass 1: Weighted signal scoring (Tier 1-4)                   │
-│  Check       │  Pass 2: Negation detection per sentence                      │
-│              │  Pass 3: Root-cause phrase extraction (fix location, not symptom) │
-│              │  Pass 4: Bug disambiguation matrix                            │
-│              │  Pass 5: Confidence gate (ratio ≥ 1.8× + Tier 1/2 required)  │
+│  Phase 0.5   │  Ultimate Reasoning (ReAct) → classify_task                   │
+│  Task        │  Step 1: AI outputs ### Ultimate Reasoning block              │
+│  Classification  Deconstruction / Observation / Root Cause / Hypothesis    │
+│              │  Step 2: classify_task → 5-pass deep analysis engine          │
+│              │    Pass 1: Weighted signal scoring (Tier 1-4)                 │
+│              │    Pass 2: Negation detection per sentence                    │
+│              │    Pass 3: Root-cause phrase extraction                       │
+│              │    Pass 4: Bug disambiguation matrix                          │
+│              │    Pass 5: Confidence gate (≥ 1.8× + Tier 1/2 required)      │
 │              │  → allowed_next_action: PROCEED / CONFIRM / STOP              │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
+│  Phase 0.6.6 │  manage_task (action=read_summary)  OR  search_tasks          │
+│  Resume      │  → Token-efficient status view → resume next_step instantly   │
+├──────────────┼──────────────────────────────────────────────────────────────┤
 │  Phase 0.7   │  Present full plan (scope, files, ACs, perf, rollback)        │
 │  Plan Gate   │  → STOP and wait for "proceed" / "adjust" / "cancel"          │
 │              │  → manage_task (action=initialize) only after proceed          │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
-│  Phase 1     │  search_tasks → get_task_history → manage_task initialize      │
-│  Planning    │  → Creates dynamic .secufusion/tasks/{id}-{slug}/ with all 5 files │
+│  Phase 1     │  search_tasks → get_task_history → manage_task initialize     │
+│  Planning    │  → Creates .secufusion/tasks/{id}-{slug}/ with all 5 files    │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
 │  Phase 2     │  manage_task: update_spec / log_file_touched /                │
 │  Execution   │              log_decision / add_scenario                       │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
 │  Phase 3     │  log_rejected_pattern                                          │
-│  Correction  │  → Record mistakes to avoid repeat                             │
+│  Correction  │  → Record mistakes permanently to avoid repeat                │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
 │  Phase 4     │  manage_task (action=complete) → pr-summary.md generated      │
-│  PR Handoff  │  generate_ado_comments → outputs Layman & Tech summaries      │
+│  PR Handoff  │  generate_ado_comments → Layman + Technical Deep-Dive for ADO │
 └──────────────┴──────────────────────────────────────────────────────────────┘
 ```
 
@@ -468,9 +472,11 @@ Add this to your MCP client config and restart. That's it.
 
 ---
 
-### Step 2 — Start a new task (Planning phase)
+### Step 2 — Start a new task (Classification phase)
+
+Just paste your Azure DevOps work item ID and description directly into the chat. No special syntax needed.
 
-Just paste your Azure DevOps work item ID and description directly into the chat. A good problem statement includes the raw user story and acceptance criteria. No special syntax needed.
+Before analyzing the problem statement, the AI has already loaded the Project DNA from Phase 00. It now outputs an **Ultimate Reasoning block** — a structured, spec-grounded analysis of the problem — then calls `classify_task`.
 
 **You type:**
 ```
@@ -488,7 +494,16 @@ So that sensitive dashboard actions are protected against compromised credential
 4. If MFA fails 3 times, the account should be temporarily locked for 15 minutes.
 ```
 
-**The AI automatically classifies the task, presents a plan, and upon approval, calls `manage_task` to initialize the dynamic folder `.secufusion/tasks/2847-add-mfa-enforcement-for-admin-users-on-login/`:**
+**The AI outputs:**
+```
+### Ultimate Reasoning
+- **Deconstruction:** TOTP enforcement is an auth-layer concern. sfn-iam-api owns the login flow.
+- **Observation:** AuthService.java contains the password verification step (line 112). No MFA interceptor exists yet. sfn-iam-api runs on port 9001 per project spec.
+- **Root Cause:** No MFA gate exists between password verification and JWT issuance.
+- **Hypothesis:** Add a MfaVerificationService that validates TOTP after password passes, blocks JWT issuance on failure, and records attempts for lockout logic.
+```
+
+**Then classifies and upon approval initializes:**
 ```json
 {
   "action": "initialize",
@@ -601,25 +616,27 @@ The SecuFusion MCP operates across three complementary layers to prevent AI amne
 ### How it all wires together
 
 ```
-mcp_config.json                →  starts the server (9 tools available)
+mcp_config.json                →  starts the server (tools available)
       +
 .agents/AGENTS.md              →  tells AI when to invoke each tool
       ↓
 ★ SESSION STARTS
       ↓
-Phase 00: manage_project_spec  →  AI loads full project DNA
-      ↓
-Phase 0:  manage_task read_summary  →  resumes active work item
+Phase 00: manage_project_spec (read + get_golden_rules)
+          → AI's brain loaded with full Project DNA BEFORE any task is read
+          → knows all ports, services, patterns, tenant rules from spec
       ↓
 You say: "WI-1042: Add audit log export"
       ↓
-Phase 0.5: classify_task → 5-pass deep analysis (FIRST tool call, no exceptions)
-          → weighted scores + root-cause phrases + negation + bug heuristics
-          → allowed_next_action: PROCEED (backend) / CONFIRM (mixed) / STOP (frontend)
-          + performance risk scan (GREEN/AMBER/RED)
-          + breaking change scan (endpoints/entities/Kafka/extension)
+Phase 0.5: ### Ultimate Reasoning (spec-grounded ReAct)
+           → Deconstruction / Observation / Root Cause / Hypothesis (written to chat)
+           → classify_task: 5-pass deep analysis
+              weighted scores + root-cause phrases + negation + bug heuristics
+              allowed_next_action: PROCEED (backend) / CONFIRM (mixed) / STOP (frontend)
+              + performance risk scan (GREEN/AMBER/RED)
+              + breaking change scan (endpoints/entities/Kafka/extension)
       ↓
-Phase 0.7: plan presented → developer approves ("proceed")
+Phase 0.7: full plan presented → developer approves ("proceed")
       ↓
 Phase 1: search_tasks (always) → get_task_history → manage_task initialize
        → .secufusion/tasks/1042-add-audit-log-export/ created
@@ -627,7 +644,7 @@ Phase 1: search_tasks (always) → get_task_history → manage_task initialize
 Phase 2: code + log_file_touched + log_decision + add_scenario (ALL mandatory)
       ↓
 Phase 4: manage_task complete  →  pr-summary.md generated
-       + run_pre_pr_checks (fix → recheck loop until ZERO errors) → then PR
+       → generate_ado_comments  →  Layman + Technical Deep-Dive for ADO board
 ```
 
 ### Reusing across projects (Global Bundling)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.41",
+  "version": "1.0.43",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",