# Requirement Trace Checker

Requirement Trace Checker is an independent OpenAI App project for building traceability from explicitly supplied project materials.

It analyzes only text that the user provides. The supported chain is:

```text
Requirement -> Acceptance Criteria -> Implementation Evidence -> Test Evidence -> Coverage Status -> Gap
```

## Project Identity

- App Name: `Requirement Trace Checker`
- App Slug: `requirement-trace-checker`
- Version: `1.0.0`
- Cloudflare Worker name: `requirement-trace-checker`
- MCP endpoint: `POST /mcp`
- Support email: `sidcraigau@gmail.com`
- Current status: not deployed, not in Developer Mode

Do not commit secrets, tokens, or passwords. This Gate 2 project does not include public deployment URLs.

## Architecture

- Cloudflare Workers
- TypeScript
- JSON-RPC MCP route at `POST /mcp`
- Tool schemas and annotations in `src/schemas.ts`
- Tool runtime logic in `src/tools.ts`
- Unified response builders in `src/response.ts`
- Runtime validation in `src/validation.ts`
- Reserved future page directory in `src/pages/`

## Validation And Response Boundary

Input schemas define object shape, field types, required fields, enums, array items, and `additionalProperties: false`.

Runtime validation handles direct MCP calls that bypass client-side schema checks, including missing required fields, wrong types, `null`, arrays, objects, numbers, booleans, enum values, and extra fields.

Business validation handles empty strings, whitespace-only text, out-of-scope execution requests, and inputs where no explicit requirement can be identified.

All tool success and error outputs are built through `src/response.ts`. `tools/call` always returns `structuredContent`; `content` is only a compatible display summary.

## Tools

Exactly three tools are exposed:

- `extract_project_requirements`
- `build_requirements_traceability`
- `check_requirements_coverage`

Unsupported capabilities include repository access, real code execution, external APIs, deployment approval, delivery approval, OAuth, login, databases, email sending, and any external write operation.

## Routes

- `GET /`: minimal accessible HTML page containing the app name
- `GET /health`
- `POST /mcp`

This project does not use `/sse` or `/{app-slug}/mcp`.

## Local Commands

```bash
npm install
npm run typecheck
npm run test
npm run test:mcp:local
npm run dev
```

`npm run test:mcp:local` starts a local Worker, checks HTTP routes and MCP JSON-RPC methods, then stops the process it started. It does not rely on public internet, external APIs, or Developer Mode.