secufusion-mcp 1.2.1 → 1.2.3

package/AGENTS.md

@@ -9,7 +9,7 @@ You are an elite Senior Developer and Architect working on the SecuFusion worksp
 
 **DYNAMIC ENFORCEMENT**: You must dynamically adhere to these rules at all times. Whether you are starting a fresh task, resuming an interrupted session, or answering a mid-task prompt, you must strictly respect this sequence and never skip ahead.
 
-1. **Rule 0 (Pre-requisite to all rules) — Load Project DNA First**: Before ANY other action, call `manage_project_spec(action: "read")` then `manage_project_spec(action: "get_golden_rules")`. This is Phase 00. Without the project DNA loaded, you are not allowed to reason, classify, plan, or code. Period.
+1. **Rule 0 (Pre-requisite to all rules) — Load Project DNA First**: Before ANY other action, call `prime_session(work_item_id: <id>)`. This is Phase 00. Without the project DNA loaded, you are not allowed to reason, classify, plan, or code. Period.
 2. **Rule 1 - ReAct (Reason, Observe, Act) First**: After DNA is loaded, you MUST deeply reason about the problem statement. Apply the ReAct framework: analyze the problem, observe context, and formulate a high-level solution hypothesis.
 3. **Rule 2 - Classify Second**: Only after you have reasoned through the problem statement, you MUST call the `classify_task` tool. This will formally categorize the task and lock in architectural boundaries.
 4. **Rule 3 - STRICT YIELD (Stop and Wait)**: Immediately after classifying the task, you MUST YIELD YOUR TURN. **DO NOT CHAIN TOOL CALLS.** Output the classification, ask the user for the "green signal," and STOP.
@@ -29,15 +29,11 @@ You are an elite Senior Developer and Architect working on the SecuFusion worksp
 
 ```
 STEP 1 — ALWAYS, unconditionally:
-  → call manage_project_spec(action: "read")
-  This loads ALL microservices, ports, repos, Kafka topics, auth flow,
-  table ownership, Keycloak config, and inter-service calls into context.
+  → call prime_session(work_item_id: <active_id>)
+  This loads ONLY the relevant microservices, ports, repos, Kafka topics, 
+  table ownership, golden rules, and task progress into your context using Thin Indexes.
 
-STEP 2 — ALWAYS, unconditionally:
-  → call manage_project_spec(action: "get_golden_rules")
-  This loads all non-negotiable architectural guardrails.
-
-STEP 3 — if you are working on a specific service:
+STEP 2 — if you need more details about a specific service not returned by prime_session:
   → call manage_project_spec(action: "get_service", service_name: <that service>)
 ```
 
@@ -72,7 +68,7 @@ There are NO circumstances under which Phase 00 can be skipped, abbreviated, or
 ❌ Write any code  
 ❌ Proceed to Phase 0.5 or any other phase  
 
-The ONLY tool calls permitted before Phase 00 completes are the `manage_project_spec` calls listed above.
+The ONLY tool calls permitted before Phase 00 completes are `prime_session` and `manage_project_spec`.
 
 ---
 
@@ -351,6 +347,9 @@ STEP 3: if implementing anything similar to a past feature:
         call get_pattern_from_task(work_item_id: <matching id>)
         — extract reusable patterns
 
+STEP 3.5: call skill_recommend(query: <task description>)
+        — ALWAYS. Retrieve domain-specific skills and patterns from the skill catalog.
+
 STEP 4: call manage_task(action: "initialize",
                          work_item_id: ...,
                          title: ...,

package/README.md

@@ -25,6 +25,19 @@
 | `run_pre_pr_checks_with_reviewer_agent` | **Phase 4** — PR Handoff | **NEW** — Unified 3-tier PR gate. Runs mechanical checks, AI file reviews, and context-aware task evaluation in a single pass. |
 | `get_secufusion_rules` | **Setup** | Returns the `AGENTS.md` rules for AI clients that don't natively support MCP Resources |
 | `classify_task` | **Phase 0.5** — Task Classification | **NEW** — Deep multi-pass analysis engine. Classifies any task as `BACKEND_ONLY`, `FRONTEND_ONLY`, `FULL_STACK`, or `EXTENSION_ONLY` based on root cause (where the fix lives), not surface symptoms. Must be the first tool called on any task. |
+| `prime_session` | **Phase 0** — Session Start | **NEW** — Hyper-efficient session startup. Combines Phase 00 (spec) and Phase 0 (task) into one call using Thin Indexes to optimize context tokens. |
+| `skill_recommend` | **Phase 1** — Planning | **NEW** — Dynamically recommends and retrieves domain-specific coding skills from `skills-catalog.json`. |
+
+---
+
+## 🚀 What's New: MLMCPS Architecture Alignment
+
+The SecuFusion MCP has been refactored to align with the advanced MLMCPS framework principles, bringing massive efficiency and UX improvements:
+
+1. **Persona-Driven Slash Commands**: The monolithic agent prompt has been split. You can now use `/sfn_spec`, `/sfn_code`, and `/sfn_review` in your AI chat to instantly summon the Planner, Coder, or Reviewer persona, ensuring razor-sharp focus per phase.
+2. **Subprocess PR Checks**: Tier 1 mechanical checks (`TENANT_ISOLATION`, `N_PLUS_ONE`, etc.) are now extracted into a standalone CLI script (`scripts/sfn-pr-check.js`), allowing them to be run by the AI *or* natively within your CI/CD pipelines.
+3. **Thin Index Token Discipline**: Context bloat is gone. Tools like `manage_task(read)` and `prime_session` now return lightweight "Thin Indexes"—compact Markdown summaries with absolute file paths—so the AI only reads the full JSON via `view_file` when truly necessary.
+4. **Dynamic Skill Registry**: A new `skill_recommend` tool allows the AI to dynamically discover domain-specific architectural skills without bloating the base prompt.
 
 ---
 

package/index.js

@@ -524,24 +524,32 @@ function generateNewTaskFolder(workItemId, title, tasksRoot) {
     let numericId = workItemId.replace(/\D/g, ''); // Extract just the digits
     if (!numericId)
         numericId = workItemId; // fallback
-    let taskTypeStr = "task";
+    let taskTypeStr = "Task";
     // Try to load the classification to get the true task_type
     const classifPath = path.join(tasksRoot, '..', 'classifications', `${workItemId}.json`);
     const classif = readJson(classifPath);
     if (classif && typeof classif.task_type === 'string') {
         const rawType = classif.task_type.toLowerCase();
         if (rawType === 'user_story')
-            taskTypeStr = 'story';
+            taskTypeStr = 'US';
+        else if (rawType === 'bug')
+            taskTypeStr = 'Bug';
         else
-            taskTypeStr = rawType;
+            taskTypeStr = rawType.charAt(0).toUpperCase() + rawType.slice(1);
     }
     else {
         // Fallback: guess from the workItemId string itself if passed as "BUG-1173"
         const prefixMatch = workItemId.match(/^([a-zA-Z]+)-/);
         if (prefixMatch) {
-            taskTypeStr = prefixMatch[1].toLowerCase();
-            if (taskTypeStr === 'wi')
-                taskTypeStr = 'task'; // Generic WI to task
+            const lowerPrefix = prefixMatch[1].toLowerCase();
+            if (lowerPrefix === 'wi')
+                taskTypeStr = 'Task';
+            else if (lowerPrefix === 'bug')
+                taskTypeStr = 'Bug';
+            else if (lowerPrefix === 'us')
+                taskTypeStr = 'US';
+            else
+                taskTypeStr = lowerPrefix.charAt(0).toUpperCase() + lowerPrefix.slice(1);
         }
     }
     return path.join(tasksRoot, `${taskTypeStr}-${numericId}-${slug}`);
@@ -630,8 +638,19 @@ server.tool("manage_task", "Manages structured task records in .secufusion/tasks
         return appendTelemetry({ isError: true, content: [{ type: "text", text: `ERROR: Task WI-${work_item_id} not found. Call action=initialize first.\n\nExpected folder: ${dir}` }] }, inputChars);
     }
     if (action === "read") {
-        const full = { spec: readJson(specPath), progress: readJson(progressPath), decisions: readJson(decisionsPath), files_touched: readJson(filesPath), scenarios: readJson(scenariosPath) };
-        return appendTelemetry({ content: [{ type: "text", text: JSON.stringify(full, null, 2) }] }, inputChars);
+        const specObj = readJson(specPath) || {};
+        const decisions = readJson(decisionsPath) || [];
+        const files = readJson(filesPath) || [];
+        const scenarios = readJson(scenariosPath) || [];
+        let out = `## Task ${work_item_id} (Thin Index)\n\n`;
+        out += `**Title:** ${specObj.title || 'unknown'}\n\n`;
+        out += `To optimize context, full task JSON is not returned. Use \`view_file\` on the following absolute paths if you need details:\n`;
+        out += `- **Spec**: ${specPath}\n`;
+        out += `- **Progress**: ${progressPath}\n`;
+        out += `- **Decisions** (${decisions.length}): ${decisionsPath}\n`;
+        out += `- **Files Touched** (${files.length}): ${filesPath}\n`;
+        out += `- **Scenarios** (${scenarios.length}): ${scenariosPath}\n`;
+        return appendTelemetry({ content: [{ type: "text", text: out }] }, inputChars);
     }
     if (action === "read_summary") {
         const spec = readJson(specPath) || {};
@@ -2128,7 +2147,13 @@ server.tool("prime_session", "Hyper-efficient session startup — combines Phase
         if (pending.length > 0) {
             out += `**Pending ACs:**\n${pending.map(ac => `  - [ ] ${ac}`).join("\n")}\n`;
         }
-        out += "\n";
+        out += "\n### Artifact Pointers\n";
+        out += `Use \`view_file\` on these absolute paths to read full task JSON data:\n`;
+        out += `- **Spec**: ${path.join(taskDir, "spec.json")}\n`;
+        out += `- **Progress**: ${path.join(taskDir, "progress.json")}\n`;
+        out += `- **Decisions**: ${path.join(taskDir, "decisions.json")}\n`;
+        out += `- **Files Touched**: ${path.join(taskDir, "files-touched.json")}\n`;
+        out += `- **Scenarios**: ${path.join(taskDir, "scenarios.json")}\n\n`;
     }
     else {
         out += `⚠️ No active task found for ${work_item_id}. Call manage_task(initialize) to create it.\n\n`;
@@ -2790,262 +2815,44 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
             exists: fs.existsSync(abs),
         };
     });
-    const mechanical = [];
+    let mechanical = [];
     const passResults = [];
     const reviewComments = [];
     let aiCost = 0;
     // ══════════════════════════════════════════════════════════════════════
-    // TIER 1 — MECHANICAL CHECKS (P1–P5)
+    // TIER 1 — MECHANICAL CHECKS (P1–P5) Via Subprocess
     // ══════════════════════════════════════════════════════════════════════
-    // ── P1: TENANT_ISOLATION ──────────────────────────────────────────────
-    const p1 = [];
-    const p1Suppressed = [];
-    if (!skip_checks.includes("tenant_isolation")) {
-        for (const f of fileRecords.filter(f => f.isRepo)) {
-            const queryAnnotationLines = [];
-            f.lines.forEach((line, idx) => {
-                if (/@Query\s*\(/i.test(line))
-                    queryAnnotationLines.push(idx);
-            });
-            f.lines.forEach((line, idx) => {
-                const dm = line.match(/(?:find|delete|count|exists)\w+By(\w+)/);
-                if (dm && !dm[1].toLowerCase().includes("tenant")) {
-                    let suppressionReason = "";
-                    const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === dm[0] || s.method.endsWith(`.${dm[0]}`)));
-                    if (explicitSup)
-                        suppressionReason = explicitSup.reason;
-                    else {
-                        for (let i = Math.max(0, idx - 5); i < idx; i++) {
-                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
-                            if (match)
-                                suppressionReason = match[1];
-                        }
-                    }
-                    if (suppressionReason) {
-                        p1Suppressed.push({ file: f.file_path, line: idx + 1, reason: suppressionReason, method: dm[0] });
-                    }
-                    else {
-                        p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: idx + 1,
-                            message: `Derived query \`${line.trim()}\` does not filter by tenantId`,
-                            suggestion: "Rename to include AndTenantId, e.g. findByIdAndTenantId(UUID id, UUID tenantId)" });
-                    }
-                }
-            });
-            queryAnnotationLines.forEach(ai => {
-                const block = f.lines.slice(ai, ai + 5).join(" ");
-                if (!/tenantId|tenant_id|:tenantId/i.test(block)) {
-                    let suppressionReason = "";
-                    let queryMethodName = "";
-                    const methodDeclMatch = block.match(/(?:List|Optional|Page|long|int|boolean|void|[A-Z]\w+)\s+(\w+)\s*\(/);
-                    if (methodDeclMatch)
-                        queryMethodName = methodDeclMatch[1];
-                    if (queryMethodName) {
-                        const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === queryMethodName || s.method.endsWith(`.${queryMethodName}`)));
-                        if (explicitSup)
-                            suppressionReason = explicitSup.reason;
-                    }
-                    if (!suppressionReason) {
-                        for (let i = Math.max(0, ai - 5); i < ai; i++) {
-                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
-                            if (match)
-                                suppressionReason = match[1];
-                        }
-                    }
-                    if (suppressionReason) {
-                        p1Suppressed.push({ file: f.file_path, line: ai + 1, reason: suppressionReason, method: queryMethodName || "@Query method" });
-                    }
-                    else {
-                        p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: ai + 1,
-                            message: `@Query at line ${ai + 1} has no tenantId filter`,
-                            suggestion: "Add WHERE e.tenantId = :tenantId to the JPQL/SQL query" });
-                    }
-                }
-            });
-        }
+    let tier1Passed = false;
+    try {
+        const scriptPath = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), "scripts/sfn-pr-check.js");
+        const execResult = require('child_process').execFileSync('node', [scriptPath, '--task', work_item_id, '--workspace', wsRoot], { encoding: 'utf-8' });
+        const jsonStr = execResult.trim().split('\n').pop() || "{}";
+        const parsed = JSON.parse(jsonStr);
+        mechanical = parsed.mechanical || [];
+        tier1Passed = parsed.pass === true;
     }
-    mechanical.push(...p1);
-    passResults.push({ name: "TENANT_ISOLATION", skipped: skip_checks.includes("tenant_isolation"), passed: p1.length === 0, count: p1.length, suppressedCount: p1Suppressed.length });
-    // Auto-log suppressions to decisions.json
-    if (p1Suppressed.length > 0) {
-        const tasksRoot = resolve(TASKS_DIR);
-        const dir = resolveTaskFolder(work_item_id, tasksRoot);
-        if (dir) {
-            const decisionsPath = path.join(dir, "decisions.json");
-            const decisions = readJson(decisionsPath) || [];
-            let modified = false;
-            for (const sup of p1Suppressed) {
-                const desc = `Exempted TENANT_ISOLATION on ${sup.method}`;
-                if (!decisions.some(d => d.decision === desc)) {
-                    decisions.push({
-                        id: decisions.length + 1,
-                        decision: desc,
-                        rationale: sup.reason,
-                        logged_at: new Date().toISOString()
-                    });
-                    modified = true;
-                }
+    catch (e) {
+        if (e.stdout) {
+            const jsonStr = e.stdout.trim().split('\n').pop() || "{}";
+            try {
+                const parsed = JSON.parse(jsonStr);
+                mechanical = parsed.mechanical || [];
             }
-            if (modified)
-                writeFile(decisionsPath, JSON.stringify(decisions, null, 2));
-        }
-    }
-    // ── P2: N_PLUS_ONE ────────────────────────────────────────────────────
-    const p2 = [];
-    if (!skip_checks.includes("n_plus_one")) {
-        for (const f of fileRecords.filter(f => f.isJava || f.isTS)) {
-            let depth = 0, inLoop = false, loopDepth = -1;
-            f.lines.forEach((line, idx) => {
-                const o = (line.match(/\{/g) || []).length;
-                const c = (line.match(/\}/g) || []).length;
-                if (/\b(for|forEach|stream\(\)|\.map\(|\.forEach\(|while\s*\()/i.test(line) && !inLoop) {
-                    inLoop = true;
-                    loopDepth = depth;
-                }
-                if (inLoop) {
-                    const rm = /\.(findById|findByIdAndTenantId|findAll|findAllBy|save|saveAll|delete|deleteById|existsById|count)\s*\(/.exec(line);
-                    if (rm)
-                        p2.push({ check: "N_PLUS_ONE", severity: "BLOCKING", file: f.file_path, line: idx + 1,
-                            message: `Repository call \`${rm[0]}\` inside a loop`,
-                            suggestion: "Extract IDs first, then use findAllById() / saveAll() outside the loop" });
-                }
-                depth += o - c;
-                if (inLoop && depth <= loopDepth) {
-                    inLoop = false;
-                    loopDepth = -1;
-                }
-            });
+            catch (e2) { }
         }
+        tier1Passed = false;
     }
-    mechanical.push(...p2);
+    const p1 = mechanical.filter(m => m.check === "TENANT_ISOLATION");
+    passResults.push({ name: "TENANT_ISOLATION", skipped: skip_checks.includes("tenant_isolation"), passed: p1.length === 0, count: p1.length });
+    const p2 = mechanical.filter(m => m.check === "N_PLUS_ONE");
     passResults.push({ name: "N_PLUS_ONE", skipped: skip_checks.includes("n_plus_one"), passed: p2.length === 0, count: p2.length });
-    // ── P3: MISSING_INDEX ─────────────────────────────────────────────────
-    const p3 = [];
-    if (!skip_checks.includes("missing_index")) {
-        const queryCols = [];
-        for (const f of fileRecords.filter(f => f.isRepo)) {
-            f.lines.forEach((line, idx) => {
-                const dm = line.match(/(?:find|delete|count|exists)\w+By([\w]+)/);
-                if (dm) {
-                    for (const p of dm[1].replace(/And|Or/g, ",").split(",")) {
-                        const col = p.charAt(0).toLowerCase() + p.slice(1);
-                        if (!["tenantId", "id"].includes(col))
-                            queryCols.push({ col, file: f.file_path, line: idx + 1 });
-                    }
-                }
-                const wm = line.match(/WHERE\s+\w+\.(\w+)\s*=/gi);
-                if (wm)
-                    for (const w of wm) {
-                        const cm = w.match(/\.(\w+)\s*=/i);
-                        if (cm && !["tenantId", "id", "tenant_id"].includes(cm[1]))
-                            queryCols.push({ col: cm[1], file: f.file_path, line: idx + 1 });
-                    }
-            });
-        }
-        const migrationContent = fileRecords.filter(f => f.isMigration).map(f => f.content.toLowerCase()).join("\n");
-        if (fileRecords.some(f => f.isMigration)) {
-            for (const { col, file, line } of queryCols) {
-                const snake = col.replace(/([A-Z])/g, "_$1").toLowerCase();
-                if (!new RegExp(`create.*index.*(${snake}|${col.toLowerCase()})`, "i").test(migrationContent)) {
-                    p3.push({ check: "MISSING_INDEX", severity: "WARNING", file, line,
-                        message: `Query on column \`${col}\` has no CREATE INDEX in migration`,
-                        suggestion: `Add: CREATE INDEX idx_<table>_${snake} ON <table>(${snake});` });
-                }
-            }
-        }
-    }
-    mechanical.push(...p3);
+    const p3 = mechanical.filter(m => m.check === "MISSING_INDEX");
     passResults.push({ name: "MISSING_INDEX", skipped: skip_checks.includes("missing_index"), passed: p3.length === 0, count: p3.length });
-    // ── P4: KAFKA_SYNC ────────────────────────────────────────────────────
-    const p4 = [];
-    if (!skip_checks.includes("kafka_sync")) {
-        for (const f of fileRecords.filter(f => f.isKafka)) {
-            let inListener = false, lDepth = 0;
-            f.lines.forEach((line, idx) => {
-                if (/@KafkaListener/.test(line)) {
-                    inListener = true;
-                    lDepth = 0;
-                }
-                if (inListener) {
-                    lDepth += (line.match(/\{/g) || []).length;
-                    lDepth -= (line.match(/\}/g) || []).length;
-                    const sm = /\.(save|saveAll|findById|findAll|delete|deleteById|restTemplate|webClient|getForObject|postForObject|exchange)\s*\(/.exec(line);
-                    if (sm) {
-                        const isAsync = /@Async|CompletableFuture|executorService|threadPool/i.test(f.lines.slice(Math.max(0, idx - 3), idx + 1).join(" "));
-                        if (!isAsync)
-                            p4.push({ check: "KAFKA_SYNC", severity: "BLOCKING", file: f.file_path, line: idx + 1,
-                                message: `Sync call \`${sm[0]}\` inside @KafkaListener — blocks consumer thread`,
-                                suggestion: "Offload to @Async method or a dedicated ExecutorService" });
-                    }
-                    if (lDepth <= 0 && lDepth !== 0)
-                        inListener = false;
-                }
-            });
-        }
-    }
-    mechanical.push(...p4);
+    const p4 = mechanical.filter(m => m.check === "KAFKA_SYNC");
     passResults.push({ name: "KAFKA_SYNC", skipped: skip_checks.includes("kafka_sync"), passed: p4.length === 0, count: p4.length });
-    // ── P5: EARLY_RETURN ──────────────────────────────────────────────────
-    // Algorithm: collect all return lines per method via flush-on-close.
-    // Every return except the last in a method body is an early return.
-    const p5 = [];
-    if (!skip_checks.includes("early_return")) {
-        for (const f of fileRecords.filter(f => f.isJava || f.isTS)) {
-            let depth = 0, methodDepth = -1, methodStart = -1, inMethod = false, mName = "";
-            let mReturns = [], mBody = [];
-            const flush = () => {
-                if (mReturns.length > 1) {
-                    for (const ri of mReturns.slice(0, -1)) {
-                        p5.push({ check: "EARLY_RETURN", severity: "BLOCKING", file: f.file_path, line: ri + 1,
-                            message: `Early return in \`${mName}()\` — violates single-exit rule`,
-                            suggestion: "Declare result at top, use nested if blocks, single return at method end" });
-                    }
-                }
-                else if (mReturns.length === 1) {
-                    const ri = mReturns[0];
-                    const after = f.lines.slice(ri + 1).map((l, o) => ({ l: l.trim(), ai: ri + 1 + o })).filter(({ l }) => l.length > 0 && l !== "}" && l !== "};" && !l.startsWith("//"));
-                    if (after.length > 0 && mBody.length > 0 && after[0].ai <= mBody[mBody.length - 1]) {
-                        p5.push({ check: "EARLY_RETURN", severity: "BLOCKING", file: f.file_path, line: ri + 1,
-                            message: `Early return in \`${mName}()\` — violates single-exit rule`,
-                            suggestion: "Declare result at top, use nested if blocks, single return at method end" });
-                    }
-                }
-                mReturns = [];
-                mBody = [];
-            };
-            f.lines.forEach((line, idx) => {
-                const trimmed = line.trim();
-                const o = (line.match(/\{/g) || []).length;
-                const c = (line.match(/\}/g) || []).length;
-                const jm = line.match(/(?:public|private|protected|static)\s+\S+\s+(\w+)\s*\(/);
-                const tm = line.match(/(?:function\s+(\w+)|(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s*)?\(|async\s+(\w+)\s*\()/);
-                if ((f.isJava ? jm : tm) && !inMethod) {
-                    inMethod = true;
-                    methodDepth = depth;
-                    methodStart = idx;
-                    mReturns = [];
-                    mBody = [];
-                    mName = jm?.[1] || tm?.[1] || tm?.[2] || tm?.[3] || "unknown";
-                }
-                depth += o - c;
-                if (inMethod && idx > methodStart) {
-                    if (trimmed.length > 0)
-                        mBody.push(idx);
-                    if (/\breturn\b/.test(line) && !/^\s*\/\//.test(line))
-                        mReturns.push(idx);
-                    if (depth <= methodDepth) {
-                        flush();
-                        inMethod = false;
-                        methodDepth = -1;
-                    }
-                }
-            });
-        }
-    }
-    mechanical.push(...p5);
+    const p5 = mechanical.filter(m => m.check === "EARLY_RETURN");
     passResults.push({ name: "EARLY_RETURN", skipped: skip_checks.includes("early_return"), passed: p5.length === 0, count: p5.length });
-    // ── Tier 1 gate ────────────────────────────────────────────────────────
     const blockingMechanical = mechanical.filter(f => f.severity === "BLOCKING");
-    const tier1Passed = blockingMechanical.length === 0;
     // ══════════════════════════════════════════════════════════════════════
     // TIER 2 — AI FILE REVIEWER (Pass 6)
     // Reads each changed file, applies architectural heuristics.
@@ -4696,48 +4503,70 @@ server.tool("reviewer_agent", "Context-aware architectural review agent — call
     }
     return appendTelemetry({ content: [{ type: "text", text: out }] }, inputChars);
 });
-// ─── Resource & Prompt for AGENTS.md ──────────────────────────────────────────
-const AGENTS_MD_PATH = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), "AGENTS.md");
-server.resource("secufusion_rules", "secufusion://rules", async (uri) => {
-    const content = readFileSafe(AGENTS_MD_PATH);
-    if (!content) {
-        throw new Error(`Rules file not found at ${AGENTS_MD_PATH}`);
-    }
+// ─── Resource & Prompt for Personas ──────────────────────────────────────────
+const AGENTS_DIR = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), "../.agents");
+const PLANNER_MD_PATH = path.join(AGENTS_DIR, "planner.md");
+const CODER_MD_PATH = path.join(AGENTS_DIR, "coder.md");
+const REVIEWER_MD_PATH = path.join(AGENTS_DIR, "reviewer.md");
+const SKILLS_CATALOG_PATH = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), "skills-catalog.json");
+server.prompt("secufusion_planner", "Starts a conversation with the SecuFusion planner workflow rules loaded (Phase 00 - Phase 1).", async () => {
+    const content = readFileSafe(PLANNER_MD_PATH);
+    if (!content)
+        throw new Error(`Rules file not found at ${PLANNER_MD_PATH}`);
     return {
-        contents: [{
-                uri: uri.href,
-                text: content
-            }]
+        messages: [{ role: "user", content: { type: "text", text: `You are now the SecuFusion Planner. Here are your rules:\n\n${content}` } }]
     };
 });
-server.prompt("secufusion_developer", "Starts a conversation with the SecuFusion developer workflow rules loaded.", async () => {
-    const content = readFileSafe(AGENTS_MD_PATH);
-    if (!content) {
-        throw new Error(`Rules file not found at ${AGENTS_MD_PATH}`);
-    }
+server.prompt("secufusion_coder", "Starts a conversation with the SecuFusion coder workflow rules loaded (Phase 2 - Phase 3).", async () => {
+    const content = readFileSafe(CODER_MD_PATH);
+    if (!content)
+        throw new Error(`Rules file not found at ${CODER_MD_PATH}`);
     return {
-        messages: [
-            {
-                role: "user",
-                content: {
-                    type: "text",
-                    text: `You are now the SecuFusion Senior Architect. Here are your rules:\n\n${content}`
-                }
-            }
-        ]
+        messages: [{ role: "user", content: { type: "text", text: `You are now the SecuFusion Coder. Here are your rules:\n\n${content}` } }]
     };
 });
-// ─────────────────────────────────────────────
-//  Start transport
-// ─────────────────────────────────────────────
-server.tool("get_secufusion_rules", "Fetches the mandatory AGENTS.md workflow rules for the SecuFusion project. Call this before starting any work.", {}, async () => {
-    const content = readFileSafe(AGENTS_MD_PATH);
-    if (!content) {
-        throw new Error(`Rules file not found at ${AGENTS_MD_PATH}`);
+server.prompt("secufusion_reviewer", "Starts a conversation with the SecuFusion reviewer workflow rules loaded (Phase 4 - Phase 5).", async () => {
+    const content = readFileSafe(REVIEWER_MD_PATH);
+    if (!content)
+        throw new Error(`Rules file not found at ${REVIEWER_MD_PATH}`);
+    return {
+        messages: [{ role: "user", content: { type: "text", text: `You are now the SecuFusion Reviewer. Here are your rules:\n\n${content}` } }]
+    };
+});
+// ─── Slash Commands (Aliases for Personas / Workflows) ───────────────────────
+server.prompt("sfn_spec", "Slash command to start Phase 0.5 (Classification) and Phase 1 (Planning)", async () => {
+    const content = readFileSafe(PLANNER_MD_PATH);
+    return { messages: [{ role: "user", content: { type: "text", text: `[Command: /sfn_spec]\nYou are in Spec/Planning mode. Execute Phase 00, Phase 0.5, and Phase 1 rules:\n\n${content}` } }] };
+});
+server.prompt("sfn_code", "Slash command to start Phase 2 (Execution) and Phase 3 (Course Correction)", async () => {
+    const content = readFileSafe(CODER_MD_PATH);
+    return { messages: [{ role: "user", content: { type: "text", text: `[Command: /sfn_code]\nYou are in Coder mode. Execute Phase 2 and Phase 3 rules:\n\n${content}` } }] };
+});
+server.prompt("sfn_review", "Slash command to start Phase 4 (PR Checks) and Phase 5 (Retrospective)", async () => {
+    const content = readFileSafe(REVIEWER_MD_PATH);
+    return { messages: [{ role: "user", content: { type: "text", text: `[Command: /sfn_review]\nYou are in Review mode. Execute Phase 4 and Phase 5 rules:\n\n${content}` } }] };
+});
+// ─── Tools ─────────────────────────────────────────────
+server.tool("skill_recommend", "Searches the skill catalog for matching domain skills based on keywords.", {
+    keywords: z.array(z.string()).describe("Keywords to search for (e.g., 'kafka', 'react')")
+}, async ({ keywords }) => {
+    const content = readFileSafe(SKILLS_CATALOG_PATH);
+    if (!content)
+        return appendTelemetry({ content: [{ type: "text", text: "No skills catalog found." }] }, 0);
+    try {
+        const catalog = JSON.parse(content);
+        const matches = catalog.skills.filter((skill) => keywords.some(kw => skill.tags.includes(kw.toLowerCase())));
+        if (matches.length === 0)
+            return appendTelemetry({ content: [{ type: "text", text: "No matching skills found." }] }, content.length);
+        let out = "Found the following relevant skills:\n";
+        matches.forEach((s) => {
+            out += `- **${s.name}**: ${s.description}\n  *Read file:* \`${s.path}\`\n`;
+        });
+        return appendTelemetry({ content: [{ type: "text", text: out }] }, content.length);
+    }
+    catch (e) {
+        return appendTelemetry({ content: [{ type: "text", text: "Error parsing skills catalog." }] }, 0);
     }
-    return appendTelemetry({
-        content: [{ type: "text", text: content }]
-    }, 0);
 });
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",