| name | hi-scenario |
| description | Generate comprehensive edge cases and test scenarios by decomposing features across 12 dimensions (user types, input extremes, timing, scale, state, environment, errors, authorization, data integrity, integration, compliance, business logic). Uses mind_mcp for feature requirements context and graph_mcp for code path discovery. Use before implementation, during code review, or when planning test coverage. |
HI Scenario
Edge case and scenario explorer that decomposes features across 12 dimensions with MCP-assisted code path discovery and comprehensive security hardening.
When To Use
- Before implementing complex or stateful features
- Before writing tests — generates concrete test targets
- Risk assessment during planning or code review
- API design review — surface contract edge cases early
- Refactoring critical paths — identify regression risks
- Security review — focus on auth, data integrity, error cascade dimensions
- Onboarding to unfamiliar features — understand edge behavior
Avoid Using When
- Trivial single-line changes or cosmetic UI tweaks
- Already well-tested stable code with no recent modifications
- Pure configuration changes with no logic paths
- Simple CRUD endpoints with no business logic
- Documentation-only changes
Required Inputs
- Target source: file path, glob pattern, or feature description
- Analysis depth:
quick (major paths only) or deep (all branches)
- Optional: focus dimensions (subset of 12)
- Optional: severity threshold filter
Input Validation & Security
Path Validation
path_validation:
- target_path must exist and be readable
- Block path traversal: reject "../" patterns
- Character whitelist: [a-zA-Z0-9_\-./]
- Max length: 1000 characters
Depth Validation
depth_validation:
allowed_values: ["quick", "deep"]
default: "quick"
quick: "Major paths, primary dimensions only"
deep: "All branches, all 12 dimensions"
Performance & Operational Configuration
Timeout Configuration
timeouts:
phase_0_target_analysis_timeout: 120s
phase_1_dimension_filtering_timeout: 30s
phase_2_scenario_generation_timeout: 300s
phase_3_severity_classification_timeout: 60s
phase_4_report_generation_timeout: 60s
total_workflow_timeout: 600s
Progress Feedback
progress_reporting:
phase_start:
- "Phase {N} started: {phase_name}"
- " Target: {target}, Depth: {depth}"
phase_complete:
- "Phase {N} complete: {phase_name}"
dimension_progress:
- "Dimension {current}/{total}: {dimension_name}"
final_summary:
- "Scenario analysis complete"
- "Dimensions: {analyzed}/{total}"
- "Scenarios: Critical={c}, High={h}, Medium={m}, Low={l}"
- "Total: {total} scenarios"
The 12 Decomposition Dimensions
Not all 12 apply to every feature. Filter relevant dimensions first, then generate scenarios only for those.
| # | Dimension | What to Look For |
|---|
| 1 | User Types | admin, guest, banned, new user, power user, bot/scraper |
| 2 | Input Extremes | empty, null, max length, unicode, special chars, SQL/script injection |
| 3 | Timing | concurrent access, race conditions, timeout, slow network, retry storms |
| 4 | Scale | 0 items, 1 item, 1M items, pagination boundary, cursor wrap |
| 5 | State Transitions | first use, mid-flow abort, resume after crash, partial completion |
| 6 | Environment | mobile/low-end CPU, no JS, screen reader, proxy/VPN, different timezone/locale |
| 7 | Error Cascades | DB down, API timeout, disk full, OOM, network partition, partial write |
| 8 | Authorization | expired token, wrong role, shared/public link, CORS, CSRF, privilege escalation |
| 9 | Data Integrity | duplicate entries, orphan references, encoding mismatch, concurrent schema migration |
| 10 | Integration | webhook replay, API version mismatch, third-party outage, contract drift |
| 11 | Compliance | GDPR deletion request, audit logging gap, data retention, accidental PII exposure |
| 12 | Business Logic | edge pricing (zero/negative), coupon stacking, refund after partial delivery, free tier limits |
Full checklist per dimension: references/dimension-checklist.md
Severity Criteria
| Level | Meaning |
|---|
| Critical | Data loss, security breach, auth bypass, silent corruption |
| High | Feature broken for a subset of users, data inconsistency |
| Medium | Degraded UX, recoverable error not surfaced to user |
| Low | Minor visual glitch, non-blocking warning |
Orchestration Workflow
Phase 0: Target Analysis (2min)
steps:
1. Validate target (file path or feature description)
2. Read target source files
3. Query graph_mcp for code structure and call paths
4. Query mind_mcp for feature requirements context
5. Identify entry points, state mutations, external calls
6. Report: "Phase 0 complete: Target analyzed"
mcp_functions:
- graph_mcp.explore_graph [optional]
params:
query: "{target_function_or_module}"
limit: 50
output:
- nodes: related functions
- edges: call relationships
expected: "Code path discovery"
- graph_mcp.trace_flow [optional]
params:
start_node: "{entry_point_id}"
max_depth: 5
output:
- flow: execution path
expected: "Full execution flow for scenario generation"
- graph_mcp.find_paths [optional]
params:
start_node: "{entry_point_id}"
end_node: "{error_handler_id}"
max_paths: 10
output:
- paths: error handling paths
expected: "Error cascade paths"
- mind_mcp.hybrid_search [optional]
params:
query: "{feature_name} requirements use cases edge cases"
collection: "{collection}"
limit: 10
output:
- results: feature documentation
expected: "Feature requirements and use case docs"
Phase 1: Dimension Filtering (30s)
steps:
1. Evaluate each of 12 dimensions against target
2. Mark dimensions as applicable or skipped
3. Document reason for each skipped dimension
4. Prioritize applicable dimensions by risk
5. Report: "Phase 1 complete: {applicable}/{total} dimensions applicable"
dimension_applicability:
user_types: "Applicable if feature has role-based behavior"
input_extremes: "Applicable if feature accepts user input"
timing: "Applicable if concurrent access or async operations"
scale: "Applicable if feature processes collections"
state_transitions: "Applicable if feature has multi-step flows"
environment: "Applicable if feature runs in browser or client"
error_cascades: "Always applicable for server-side code"
authorization: "Applicable if feature has access control"
data_integrity: "Applicable if feature writes to database"
integration: "Applicable if feature calls external services"
compliance: "Applicable if feature handles user data"
business_logic: "Applicable if feature has pricing/rules"
Phase 2: Scenario Generation (5min)
steps:
1. For each applicable dimension, generate 3-5 scenarios
2. Use graph_mcp call paths to discover error branches
3. Use mind_mcp requirements to validate business logic scenarios
4. Describe expected behavior for each scenario
5. Report: "Phase 2 complete: {count} scenarios generated"
scenario_template:
- dimension: "Which of the 12 dimensions"
- scenario: "Concrete description of the edge case"
- trigger: "How to reproduce"
- expected: "What should happen"
- evidence: "mind_mcp | graph_mcp | filesystem"
generation_rules:
- Each scenario must be concrete and reproducible
- Scenario descriptions must be implementation-agnostic
- Do not generate scenarios for skipped dimensions
- Prioritize dimensions with highest risk first
- Use graph_mcp flow traces to identify real error paths
Phase 3: Severity Classification (1min)
steps:
1. Classify each scenario as Critical / High / Medium / Low
2. Critical: data loss, security breach, auth bypass, silent corruption
3. High: feature broken for user subset, data inconsistency
4. Medium: degraded UX, recoverable error
5. Low: minor visual glitch, non-blocking warning
6. Report: "Phase 3 complete: Scenarios classified"
classification_rules:
- Auth bypass or data exposure → always Critical
- Unhandled errors → High or Medium based on impact
- UI-only issues with no data impact → Low
- Silent corruption → always Critical
Phase 4: Report Generation (1min)
steps:
1. Aggregate scenarios by dimension and severity
2. Format as structured table
3. Include dimension applicability summary
4. Add recommended test priorities
5. Report: "Phase 4 complete: Report generated"
report_sections:
- header: "Target, depth, timestamp"
- dimension_summary: "Applicable vs skipped dimensions with reasons"
- scenario_table: "#, Dimension, Scenario, Severity, Expected Behavior"
- severity_summary: "Count by severity"
- test_priorities: "Critical scenarios → test immediately"
Output Contract
Report Format
# Scenario Report — {target}
**Date**: {timestamp}
**Depth**: {quick|deep}
**Source**: {file_path or feature_description}
## Dimensions Analyzed
{applicable_dimensions_list}
## Dimensions Skipped
| Dimension | Reason |
|-----------|--------|
| {dim} | {reason} |
## Scenarios
| # | Dimension | Scenario | Severity | Expected Behavior |
|---|-----------|----------|----------|-------------------|
| 1 | Input Extremes | Empty string for required field | High | Return 400 with field error |
| 2 | Authorization | Expired JWT on protected route | Critical | Redirect to login, clear session |
| 3 | Timing | Two users submit same form simultaneously | High | Idempotency key or 409 conflict |
## Severity Summary
| Level | Count |
|-------|-------|
| Critical | {c} |
| High | {h} |
| Medium | {m} |
| Low | {l} |
| **Total** | **{total}** |
## Test Priorities
1. **Immediate**: All Critical scenarios ({c})
2. **This sprint**: All High scenarios ({h})
3. **Backlog**: Medium/Low scenarios ({m+l})
## Evidence Sources
- mind_mcp: `{refs}`
- graph_mcp: `{node_ids}`
- filesystem: `{file_paths}`
Non-Negotiable Rules
- ✅ Every scenario must be concrete and reproducible
- ✅ Filter dimensions before generating — do not generate noise
- ✅ Critical findings must have specific expected behavior described
- ✅ Auth bypass or data exposure always classified as Critical
- ✅ Never skip error cascades dimension for server-side code
- ✅ Provide reason for every skipped dimension
- ✅ Graph-derived scenarios must reference actual code paths
Error Handling & Fallback Strategy
preflight:
- check: "target_validation"
verify: [target_exists, target_readable or valid_feature_description]
action_on_failure: "abort_with_error"
- check: "mcp_capability_check"
graph_mcp_functions: [explore_graph, trace_flow, find_paths]
mind_mcp_functions: [hybrid_search]
action_on_failure: "continue_with_filesystem_only"
fallback:
when: "mcp_unavailable"
mode: "manual_code_reading"
steps:
1. Skip MCP queries
2. Read target files manually
3. Derive call paths from static code analysis
4. Skip mind_mcp business context
5. Mark graph-derived scenarios as lower confidence
error_recovery:
phase_0_target_analysis:
on_mcp_timeout: "continue_with_filesystem_analysis"
phase_2_scenario_generation:
on_dimension_timeout: "skip_dimension_and_continue"
phase_4_report_generation:
on_partial_data: "generate_partial_report"
Observability & Metrics
metrics:
scenario_stats:
- total_scenarios: "all generated scenarios"
- dimensions_analyzed: "count of applicable dimensions"
- dimensions_skipped: "count of skipped dimensions"
- scenarios_per_dimension_avg: "average scenarios per dimension"
severity_distribution:
- critical_count
- high_count
- medium_count
- low_count
evidence_coverage:
- mcp_sourced_scenarios: "scenarios from MCP evidence"
- filesystem_sourced_scenarios: "scenarios from manual analysis"
Version History & Changelog
Version 1.0.0 (2026-05-12)
Initial Release:
- ✅ 12-dimension edge case decomposition framework
- ✅ MCP-assisted code path discovery (graph_mcp explore/trace/find_paths)
- ✅ mind_mcp feature requirements context for business logic validation
- ✅ Severity classification (Critical/High/Medium/Low)
- ✅ Automatic dimension filtering with skip reasons
- ✅ Structured scenario report with test priorities
- ✅ MCP fallback with filesystem-only analysis
- ✅ Dimension checklist reference document
Known Limitations
limitations:
analysis_scope:
- "Static code analysis only — cannot simulate runtime conditions"
- "Scenario quality depends on code path completeness from graph_mcp"
- "Business logic scenarios limited by mind_mcp documentation quality"
dimension_coverage:
- "Not all 12 dimensions apply to every feature"
- "Rare edge cases may be missed if not covered by analysis paths"
- "Concurrent access scenarios require runtime verification"
mcp_dependent:
- "Deep analysis requires graph_mcp for call paths"
- "Business context requires mind_mcp for requirements"
- "Filesystem-only mode produces simpler scenarios"
Deliverables
scenario_report_{target}_{timestamp}.md — Full scenario report with dimension analysis
References
Skill-Specific References
references/dimension-checklist.md — Detailed checklist per dimension with example scenarios
