secufusion-mcp 1.0.42 → 1.0.44

package/README.md

@@ -393,36 +393,40 @@ These rules are enforced automatically — the AI will never violate them:
 
 ```
 ┌──────────────┬──────────────────────────────────────────────────────────────┐
-│  Phase 00    │  manage_project_spec (action=read)                            │
-│  Session     │  → Loads full project DNA from .secufusion-project-spec.json  │
-│  Start       │  → AI knows ALL services, ports, patterns, golden rules       │
+│  Phase 00    │  manage_project_spec (action=read + get_golden_rules)         │
+│  Project DNA │  → FIRST step — runs before ANY problem statement is read     │
+│  (Session    │  → AI loaded with ALL services, ports, coding patterns,       │
+│   Start)     │     Kafka topics, golden rules, and tenant isolation config   │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
-│  Phase 0     │  manage_task (action=read_summary)  OR  search_tasks          │
-│  Resume      │  → Token-efficient status view → resume next_step instantly   │
-├──────────────┼──────────────────────────────────────────────────────────────┤
-│  Phase 0.5   │  classify_task → 5-pass deep analysis engine                  │
-│  Ownership   │  Pass 1: Weighted signal scoring (Tier 1-4)                   │
-│  Check       │  Pass 2: Negation detection per sentence                      │
-│              │  Pass 3: Root-cause phrase extraction (fix location, not symptom) │
-│              │  Pass 4: Bug disambiguation matrix                            │
-│              │  Pass 5: Confidence gate (ratio ≥ 1.8× + Tier 1/2 required)  │
+│  Phase 0.5   │  Ultimate Reasoning (ReAct) → classify_task                   │
+│  Task        │  Step 1: AI outputs ### Ultimate Reasoning block              │
+│  Classification  Deconstruction / Observation / Root Cause / Hypothesis    │
+│              │  Step 2: classify_task → 5-pass deep analysis engine          │
+│              │    Pass 1: Weighted signal scoring (Tier 1-4)                 │
+│              │    Pass 2: Negation detection per sentence                    │
+│              │    Pass 3: Root-cause phrase extraction                       │
+│              │    Pass 4: Bug disambiguation matrix                          │
+│              │    Pass 5: Confidence gate (≥ 1.8× + Tier 1/2 required)      │
 │              │  → allowed_next_action: PROCEED / CONFIRM / STOP              │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
+│  Phase 0.6.6 │  manage_task (action=read_summary)  OR  search_tasks          │
+│  Resume      │  → Token-efficient status view → resume next_step instantly   │
+├──────────────┼──────────────────────────────────────────────────────────────┤
 │  Phase 0.7   │  Present full plan (scope, files, ACs, perf, rollback)        │
 │  Plan Gate   │  → STOP and wait for "proceed" / "adjust" / "cancel"          │
 │              │  → manage_task (action=initialize) only after proceed          │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
-│  Phase 1     │  search_tasks → get_task_history → manage_task initialize      │
-│  Planning    │  → Creates dynamic .secufusion/tasks/{id}-{slug}/ with all 5 files │
+│  Phase 1     │  search_tasks → get_task_history → manage_task initialize     │
+│  Planning    │  → Creates .secufusion/tasks/{id}-{slug}/ with all 5 files    │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
 │  Phase 2     │  manage_task: update_spec / log_file_touched /                │
 │  Execution   │              log_decision / add_scenario                       │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
 │  Phase 3     │  log_rejected_pattern                                          │
-│  Correction  │  → Record mistakes to avoid repeat                             │
+│  Correction  │  → Record mistakes permanently to avoid repeat                │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
 │  Phase 4     │  manage_task (action=complete) → pr-summary.md generated      │
-│  PR Handoff  │  generate_ado_comments → outputs Layman & Tech summaries      │
+│  PR Handoff  │  generate_ado_comments → Layman + Technical Deep-Dive for ADO │
 └──────────────┴──────────────────────────────────────────────────────────────┘
 ```
 
@@ -468,9 +472,11 @@ Add this to your MCP client config and restart. That's it.
 
 ---
 
-### Step 2 — Start a new task (Planning phase)
+### Step 2 — Start a new task (Classification phase)
+
+Just paste your Azure DevOps work item ID and description directly into the chat. No special syntax needed.
 
-Just paste your Azure DevOps work item ID and description directly into the chat. A good problem statement includes the raw user story and acceptance criteria. No special syntax needed.
+Before analyzing the problem statement, the AI has already loaded the Project DNA from Phase 00. It now outputs an **Ultimate Reasoning block** — a structured, spec-grounded analysis of the problem — then calls `classify_task`.
 
 **You type:**
 ```
@@ -488,7 +494,16 @@ So that sensitive dashboard actions are protected against compromised credential
 4. If MFA fails 3 times, the account should be temporarily locked for 15 minutes.
 ```
 
-**The AI automatically classifies the task, presents a plan, and upon approval, calls `manage_task` to initialize the dynamic folder `.secufusion/tasks/2847-add-mfa-enforcement-for-admin-users-on-login/`:**
+**The AI outputs:**
+```
+### Ultimate Reasoning
+- **Deconstruction:** TOTP enforcement is an auth-layer concern. sfn-iam-api owns the login flow.
+- **Observation:** AuthService.java contains the password verification step (line 112). No MFA interceptor exists yet. sfn-iam-api runs on port 9001 per project spec.
+- **Root Cause:** No MFA gate exists between password verification and JWT issuance.
+- **Hypothesis:** Add a MfaVerificationService that validates TOTP after password passes, blocks JWT issuance on failure, and records attempts for lockout logic.
+```
+
+**Then classifies and upon approval initializes:**
 ```json
 {
   "action": "initialize",
@@ -601,25 +616,27 @@ The SecuFusion MCP operates across three complementary layers to prevent AI amne
 ### How it all wires together
 
 ```
-mcp_config.json                →  starts the server (9 tools available)
+mcp_config.json                →  starts the server (tools available)
       +
 .agents/AGENTS.md              →  tells AI when to invoke each tool
       ↓
 ★ SESSION STARTS
       ↓
-Phase 00: manage_project_spec  →  AI loads full project DNA
-      ↓
-Phase 0:  manage_task read_summary  →  resumes active work item
+Phase 00: manage_project_spec (read + get_golden_rules)
+          → AI's brain loaded with full Project DNA BEFORE any task is read
+          → knows all ports, services, patterns, tenant rules from spec
       ↓
 You say: "WI-1042: Add audit log export"
       ↓
-Phase 0.5: classify_task → 5-pass deep analysis (FIRST tool call, no exceptions)
-          → weighted scores + root-cause phrases + negation + bug heuristics
-          → allowed_next_action: PROCEED (backend) / CONFIRM (mixed) / STOP (frontend)
-          + performance risk scan (GREEN/AMBER/RED)
-          + breaking change scan (endpoints/entities/Kafka/extension)
+Phase 0.5: ### Ultimate Reasoning (spec-grounded ReAct)
+           → Deconstruction / Observation / Root Cause / Hypothesis (written to chat)
+           → classify_task: 5-pass deep analysis
+              weighted scores + root-cause phrases + negation + bug heuristics
+              allowed_next_action: PROCEED (backend) / CONFIRM (mixed) / STOP (frontend)
+              + performance risk scan (GREEN/AMBER/RED)
+              + breaking change scan (endpoints/entities/Kafka/extension)
       ↓
-Phase 0.7: plan presented → developer approves ("proceed")
+Phase 0.7: full plan presented → developer approves ("proceed")
       ↓
 Phase 1: search_tasks (always) → get_task_history → manage_task initialize
        → .secufusion/tasks/1042-add-audit-log-export/ created
@@ -627,7 +644,7 @@ Phase 1: search_tasks (always) → get_task_history → manage_task initialize
 Phase 2: code + log_file_touched + log_decision + add_scenario (ALL mandatory)
       ↓
 Phase 4: manage_task complete  →  pr-summary.md generated
-       + run_pre_pr_checks (fix → recheck loop until ZERO errors) → then PR
+       → generate_ado_comments  →  Layman + Technical Deep-Dive for ADO board
 ```
 
 ### Reusing across projects (Global Bundling)

package/index.js

@@ -1688,8 +1688,14 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
             finalDeveloperMessage += "\n────────────────────────────────────────\n";
         }
         else if (validationVerdict === "NEEDS_CLARIFICATION") {
-            finalDeveloperMessage += `❓ NEEDS CLARIFICATION — ${work_item_id}\n\nI cannot implement this correctly without answers to these questions:\n`;
-            finalDeveloperMessage += scopeQuestions.join("\n") + "\n\nPlease answer before I proceed.\n";
+            finalDeveloperMessage += `❓ NEEDS CLARIFICATION — ${work_item_id}\n\nI cannot implement this correctly without clarification on the following:\n`;
+            if (scopeQuestions.length > 0)
+                finalDeveloperMessage += scopeQuestions.join("\n") + "\n";
+            if (completenessIssues.length > 0)
+                finalDeveloperMessage += completenessIssues.map(i => `• ${i}`).join("\n") + "\n";
+            if (secufusionFlags.length > 0)
+                finalDeveloperMessage += secufusionFlags.map(f => `• ${f}`).join("\n") + "\n";
+            finalDeveloperMessage += "\nPlease clarify before I proceed.\n";
             finalDeveloperMessage += "\n────────────────────────────────────────\n";
         }
         else if (validationVerdict === "MISLEADING") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.42",
+  "version": "1.0.44",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",