secufusion-mcp 2.1.0 → 2.1.1

package/agents/planner.md

@@ -60,6 +60,24 @@ There are NO circumstances under which Phase 00 can be skipped, abbreviated, or
 
 The ONLY tool calls permitted before Phase 00 completes are `prime_session`, `manage_project_spec`, and `spec_read_intent`.
 
+---
+
+## Phase 0.25 — Clarify and Capture Business Intent (The WHY Layer)
+(TRIGGER: when a **NEW** task, feature, or bug is received that has no existing tracking)
+
+Before thinking about *how* to implement the task, you must understand *why* it is needed.
+1. **Analyze** the requested task.
+2. **Ask** the user clarifying questions if the following are not completely clear:
+   - Why is this being built? What user or business problem does it solve?
+   - What is already there, and is this actually needed?
+   - What is the business risk if not delivered?
+3. **YIELD** and wait for the user to clarify the business intent. Do not proceed until the intent is clear.
+
+Once the intent is clarified:
+1. Call `manage_task(action: "initialize", ...)` to initialize the task tracking (The HOW layer).
+2. Call `spec_create_intent(...)` to capture the clarified business intent (The WHY layer).
+
+Only after both of these are created may you proceed to Phase 0.5.
 
 ---
 

package/commands/sfn-plan.md

@@ -1,5 +1,5 @@
 ---
-description: Architect a solution for a task or Jira ticket using the loaded DNA. Creates a dedicated task workspace, classifies the work, and produces a strict implementation plan awaiting your approval.
+description: Architect a solution for a task or Jira ticket using the loaded DNA. Clarifies business intent, creates a dedicated task workspace, classifies the work, and produces a strict implementation plan awaiting your approval.
 argument-hint: <ticket-id or feature description>  e.g. WI-123 or "add user login endpoint"
 ---
 
@@ -15,33 +15,42 @@ Task / Ticket: **$ARGUMENTS**
 2. If `DNA_LOADED` is `false` or `null`, **ABORT immediately** and tell the user:
    > ❌ Project DNA is not loaded. Please run `/sfn:init` first.
 
-## Phase 1 — Initialize the Task Workspace
+## Phase 1 — Clarify and Capture Business Intent (The WHY Layer)
 
+Before thinking about *how* to implement the task, you must understand *why* it is needed.
+1. Analyze the requested task. 
+2. Ask the user clarifying questions if the following are not completely clear:
+   - Why is this being built? What user or business problem does it solve?
+   - What is already there, and is this actually needed?
+   - What is the business risk if not delivered?
+3. **YIELD** and wait for the user to clarify the business intent. Do not proceed to Phase 2 until the intent is clear.
+
+Once the intent is clarified, call `spec_create_intent` with:
+- `work_item_id`: the ticket ID or a slugified version of the description
+- `title`: short human-readable title
+- `business_goal`: The clarified business problem it solves.
+- `acceptance_criteria`: Given/When/Then ACs gathered from the ticket/clarification.
+- `services_involved`: **Polyglot service map** — list every service this touches, regardless of language (Java, Go, Python, TypeScript).
+- `risk`: business risk if not delivered.
+
+> 💡 This creates `.secufusion/intents/<num>-WI-<id>-<slug>.md` — a human-readable file capturing the WHY.
+
+## Phase 2 — Initialize the Task Workspace (The HOW Layer)
+
+Now that the *why* is captured, initialize the *how* tracking.
 Call `manage_task` with:
 ```
 action: "initialize"
-work_item_id: <the ticket ID or a slugified version of the description>
+work_item_id: <same ID as above>
 ```
 This creates the dedicated workspace folder at `.secufusion/tasks/<id>/` and begins tracking progress. Do not proceed until this call succeeds.
 
-## Phase 1.5 — Capture Business Intent (The WHY Layer)
-
-Immediately after `manage_task` initializes, call `spec_create_intent` with:
-- `work_item_id`: same ID as above
-- `title`: short human-readable title
-- `business_goal`: **Ask the user** if not provided — "Why is this being built? What user or business problem does it solve?"
-- `acceptance_criteria`: Given/When/Then ACs gathered from the ticket
-- `services_involved`: **Polyglot service map** — list every service this touches, regardless of language (Java, Go, Python, TypeScript). This is how Go/Rust/Python services are tracked even without AST parsers.
-- `risk`: business risk if not delivered
-
-> 💡 This creates `.secufusion/intents/<num>-WI-<id>-<slug>.md` — a human-readable file capturing the WHY. The JSON task folder captures the HOW. Together they give a complete picture.
-
-## Phase 2 — Load Context
+## Phase 3 — Load Context
 
 1. Call `prime_session(work_item_id: <id>)` to efficiently load the project DNA state and relevant architectural context for this specific task.
 2. Read the `.secufusion-project-spec.json` from the project root to understand the golden rules, constraints, and acceptance criteria boundaries for this project.
 
-## Phase 3 — Classify the Task
+## Phase 4 — Classify the Task
 
 Call `classify_task` with the task description: **$ARGUMENTS**
 
@@ -51,7 +60,7 @@ This formally categorizes the work (Feature, Bug, Refactor, Security, Performanc
 
 Wait for explicit approval before continuing.
 
-## Phase 4 — Write the Implementation Plan (After Approval)
+## Phase 5 — Write the Implementation Plan (After Approval)
 
 Read `.agents/planner.md` for the Planner Persona instructions and produce a strict, step-by-step implementation plan that includes:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "mcp/dist/server.js",