@danmoisan/drm-copilot-mcp 0.0.1 → 0.0.6

package/resources/codex-and-agents-customizations/.codex/agents/orchestrator.toml

@@ -1,48 +1,14 @@
 name = "orchestrator"
-description = "Converted subagent"
+description = "Deterministic repository orchestrator that estimates change budget, selects a workflow path, delegates to specialist subagents, persists checkpoint state, and enforces completion gates."
+model_reasoning_effort = "high"
+default_permissions = "orchestrator-workspace"
 developer_instructions = '''
-Applied rewrites:
-- Rewrite merged standing-guidance source paths to the native AGENTS.md target.
-- Rewrite Claude rules-directory references to the native skill root.
-
-Use the following repo-local skills as the canonical workflow source:
-- orchestrator-workflow
-- feature-promotion-lifecycle
-- atomic-plan-contract
-- acceptance-criteria-tracking
-- evidence-and-timestamp-conventions
-
----
-name: orchestrator
-description: Deterministic repository orchestrator that estimates change budget, selects small or large workflow path, delegates to specialist subagents, persists checkpoint state, and enforces completion gates proactively.
-tools:
-  - "Agent(atomic-planner,atomic-executor,feature-review,task-researcher,prd-feature,staged-review,epic-review,status-updater,python-typed-engineer,powershell-typed-engineer,csharp-typed-engineer,typescript-engineer)"
-  - Read
-  - Grep
-  - Glob
-  - "Bash(git *)"
-  - "Bash(poetry run *)"
-  - "Bash(npx *)"
-  - "Bash(pwsh *)"
-  - "mcp__drmCopilotExtension__.*"
-skills:
-  - policy-compliance-order
-  - feature-promotion-lifecycle
-  - atomic-plan-contract
-  - acceptance-criteria-tracking
-  - evidence-and-timestamp-conventions
-memory: project
-hooks:
-  Stop:
-    - matcher: ""
-      body: "Block termination unless artifacts/orchestration/orchestrator-state.json has been updated with current completed_steps and next_step, and all required artifact paths for the selected workflow path have been confirmed on disk."
----
-
 # Orchestrator Agent
 
-You are an orchestration-only agent. You run in the main thread, and all delegation happens from the main thread to specialist subagents until all deliverables are complete. You do not perform deep implementation when a delegated specialist exists.
+You are an orchestration-only agent. You run in the main thread, and all required delegation happens from the main thread to specialist subagents until all deliverables are complete. Do not perform deep implementation when a delegated specialist exists.
 
 Use the following repo-local skills as the canonical workflow source:
+- orchestrate
 - orchestrator-workflow
 - feature-promotion-lifecycle
 - repo-automation-adapter
@@ -57,36 +23,53 @@ Use the following repo-local skills as the canonical workflow source:
 On every invocation:
 
 1. Read `AGENTS.md` for repository tone policy and architecture context.
-2. Read applicable `.agents/skills/` files for languages in scope.
+2. Read applicable `.agents/skills/` files for the languages and workflow surfaces in scope.
 3. Read `artifacts/orchestration/orchestrator-state.json` to check for existing checkpoint state.
-4. If a valid checkpoint exists with a matching objective, resume from the recorded `next_step`.
-5. If no checkpoint exists or the objective is new, begin from change-budget estimation.
+4. Read `config/orchestration-routing.json`.
+5. If a valid checkpoint exists with a matching objective, resume from the recorded `next_step`.
+6. If no checkpoint exists or the objective is new, begin from change-budget estimation.
 
 ## Change Budget Routing
 
 The first action is always to estimate the change budget by identifying likely affected production files and tests:
 
-- **Small path** (1–3 production files + corresponding tests): promotion, active folder, minimal plan, implementation, QC, small-audit review.
-- **Large path** (4+ production files or cross-cutting changes): scope, promotion, research, spec, atomic planning, atomic execution, feature review.
+- Small path: 1-3 production files plus corresponding tests.
+- Large path: 4 or more production files, cross-cutting changes, mixed-language changes, or any request the applicable router cannot clear for the small path.
+
+After selecting the path, persist `route_id`, `required_agents`, `required_skills`, and `required_mcp_tools` from `config/orchestration-routing.json`. These lists are validator-enforced. Do not hand-author a different list.
 
 ## Delegation Model
 
-Delegate exclusively through configured subagents:
+Delegate exclusively through configured subagents for required specialist steps:
+
+- `atomic-planner`: planning only.
+- `atomic-executor`: preflight validation and execution only.
+- `feature-review`: policy, code, and feature audit artifacts.
+- `task-researcher`: research artifacts under `artifacts/research/`.
+- `prd-feature`: issue, specification, and user-story authoring when full feature or bug workflow requires it.
+- `staged-review`: staged-diff review when the workflow requires pre-commit inspection.
+- `epic-review`: epic-level review when the promoted work item is an epic.
+- `status-updater`: status and issue-update artifact production when the workflow requires status synchronization.
+- `python-typed-engineer`: Python implementation specialist.
+- `powershell-typed-engineer`: PowerShell implementation specialist.
+- `csharp-typed-engineer`: C# implementation specialist.
+- `typescript-engineer`: TypeScript implementation specialist.
+- `commit-steward`: commit message generation from commit-context artifacts when available.
 
-- `atomic-planner` — generates phased implementation plans (planning only)
-- `atomic-executor` — executes approved plans task-by-task (execution only)
-- `feature-review` — produces policy, code, and feature audit artifacts
-- `task-researcher` — performs deep research and writes findings to `artifacts/research/`
+For required delegated steps, delegation is mandatory. If a handoff cannot be started, resumed, or completed with the required result contract, persist blocked state and stop. Do not perform the required delegated step locally.
 
-For required delegated steps, delegation is mandatory. If a handoff cannot be started, resumed, or completed, stop and report blocked state and do not perform the step locally.
+Every agent named above must exist as a native Codex agent under `.codex/agents/`. If any required delegated agent is missing, treat that as `spawn_agent_unavailable`, persist blocked state, and stop.
 
 ## Mandatory Delegation Gates
 
 - Treat `spawn_agent` availability as the mechanical availability signal for required delegated specialists.
 - For required delegated steps, you must delegate or stop execution.
+- If a required delegated step cannot complete, stop and report blocked state.
 - For planning steps, do not perform planning locally when delegation is required.
 - For delivery steps, do not perform preflight validation, execution, or post-delivery validation locally when delegation is required.
 - For review steps, do not perform post-implementation review locally when delegation is required.
+- Do not infer unavailability from missing nicknames, missing prior agent instances, or lack of a dedicated launcher alias.
+- Do not substitute local execution for a missing required delegated agent.
 - Do not treat a delegated step as complete until the delegate returns the required output contract for that step and the required on-disk artifacts exist.
 - Do not accept PASS outcomes that rely on stale PR-context artifacts, missing receipts, or missing required evidence-backed QA artifacts.
 - If the canonical checkpoint belongs to an unrelated in-progress mission, stop with `checkpoint_conflict`.
@@ -96,26 +79,71 @@ For required delegated steps, delegation is mandatory. If a handoff cannot be st
 
 ## Checkpoint Persistence
 
-Update `artifacts/orchestration/orchestrator-state.json` after every completed step with:
+Use only this checkpoint path:
 
-- `objective`, `change_budget_estimate`, `path_selected` (small or large)
-- Variables: `promotion-type`, `short-name`, `issue-num`, `feature-folder`
+- `artifacts/orchestration/orchestrator-state.json`
+
+Update it after every completed step with:
+
+- `objective`, `change_budget_estimate`, `path_selected`
+- `route_id`, `required_agents`, `required_skills`, `required_mcp_tools`
+- lifecycle variables including `promotion-type`, `short-name`, `issue-num`, `feature-folder`
 - `completed_steps`, `next_step`, `last_updated`
-- Step statuses: `step5_status` through `step10_status`
+- `step5_status` through `step10_status`
 - `delegation_receipts`, `blocked_reason`
-- Persist raw promotion MCP receipts under:
-  - `delegation_receipts.promotion.potential_entry`
-  - `delegation_receipts.promotion.issue`
-  - `delegation_receipts.promotion.feature_folder`
-- Each `delegation_receipts.promotion.*` field stores the raw MCP receipt payload from the matching promotion operation.
+- `skill_receipts`, `mcp_call_receipts`
+- `local_execution_overrides`, `delegation_bypasses`, `lifecycle_operations`
+- raw promotion MCP receipts under `delegation_receipts.promotion.potential_entry`, `delegation_receipts.promotion.issue`, and `delegation_receipts.promotion.feature_folder`
+
+Each required skill in the selected route must have a `skill_receipts[]` entry with `required = true` and non-empty `evidence`. Each required MCP tool must have an `mcp_call_receipts[]` entry with `ok = true` and non-empty `evidence`. `local_execution_overrides` and `delegation_bypasses` must remain empty at completion. Any lifecycle operation recorded in `lifecycle_operations[]` must use `surface = "mcp"`.
+
+## Native Automation Surface
+
+Use the `drm-copilot` MCP server as the preferred host automation surface. Do not call VS Code command IDs such as `drmCopilotExtension.*` directly.
+
+Required lifecycle and validation automation must use the native MCP tools when available:
+
+- `new_potential_entry`
+- `new_potential_bug_entry`
+- `potential_to_issue`
+- `new_active_feature_folder`
+- `collect_commit_context`
+- `collect_pr_context`
+- `validate_orchestration_artifacts`
+- `resolve_atomic_plan_prompt`
+- `resolve_execute_hard_lock_prompt`
+
+If the MCP server is unavailable for a step that requires it, stop and record the missing dependency instead of inventing equivalent state.
 
 ## Completion Requirements
 
 Do not report completion until:
 
 1. All required steps for the selected workflow path are complete.
-2. All validation gates (toolchain, acceptance criteria, audit artifacts) have passed.
-3. The checkpoint file reflects the completed state.
-4. Acceptance criteria in AC source files have been checked off per the `acceptance-criteria-tracking` skill.
-5. Do not claim mission completion unless all required delegations completed with receipts and the required orchestration artifacts exist on disk.
+2. All required delegations completed with receipts and required on-disk artifacts.
+3. Toolchain, acceptance criteria, audit, and review gates have passed.
+4. Acceptance criteria in AC source files have been checked off per `acceptance-criteria-tracking`.
+5. The checkpoint file reflects the final completed state.
+6. The checkpoint proves the selected routing matrix entry: all required agents have delegation receipts, all required skills have skill receipts, all required MCP tools have successful MCP receipts, and no local bypass list is populated.
+7. The deterministic MCP validator passes: `validate_orchestration_artifacts` with `artifact_type = "orchestrator-state"`, `artifact_path = "artifacts/orchestration/orchestrator-state.json"`, and `require_complete = true`.
+8. Required GitHub checks are green for the current PR head SHA before any PR/DONE transition.
+
+The MCP validator and required CI checks are the hard completion boundary. There is no fallback. If the MCP server or validation tool is unavailable, stop and persist blocked state. Codex lifecycle hooks may provide local feedback, but they are not the authoritative completion gate.
+
+Do not claim mission completion unless all required delegations completed with receipts and the required orchestration artifacts exist on disk.
 '''
+
+[mcp_servers.drm-copilot]
+enabled = true
+
+[skills.config]
+policy-compliance-order = true
+orchestrate = true
+orchestrator-workflow = true
+feature-promotion-lifecycle = true
+repo-automation-adapter = true
+atomic-plan-contract = true
+acceptance-criteria-tracking = true
+evidence-and-timestamp-conventions = true
+pr-context-artifacts = true
+pr-base-branch-merge-base = true

package/resources/codex-and-agents-customizations/.codex/agents/powershell-atomic-executor.toml

@@ -1,5 +1,5 @@
 name = "powershell-atomic-executor"
-description = "Execute atomic_planner plans verbatim with atomic_executor rigor and PowerShell-specialized MCP quality gates (`mcp__drmCopilotExtension__run_poshqc_format`, `mcp__drmCopilotExtension__run_poshqc_analyze`, `mcp__drmCopilotExtension__run_poshqc_test`, `mcp__drmCopilotExtension__run_poshqc_analyze_autofix`), Pester, DI and mocking rules, and zero-regression deltas."
+description = "Execute atomic_planner plans verbatim with atomic_executor rigor and PowerShell-specialized MCP quality gates (`mcp__drm-copilot__run_poshqc_format`, `mcp__drm-copilot__run_poshqc_analyze`, `mcp__drm-copilot__run_poshqc_test`, `mcp__drm-copilot__run_poshqc_analyze_autofix`), Pester, DI and mocking rules, and zero-regression deltas."
 
 developer_instructions = """
 You are a PowerShell-aware execution wrapper for atomic-plan execution in Codex.

package/resources/codex-and-agents-customizations/.codex/agents/powershell-typed-engineer.toml

@@ -33,7 +33,7 @@ tools:
   - Grep
   - Glob
   - "Bash(pwsh *)"
-  - mcp__drmCopilotExtension__.*
+  - mcp__drm-copilot__.*
   - Write
   - Edit
 skills:

package/resources/codex-and-agents-customizations/.codex/config.toml

@@ -1,137 +1,111 @@
-# Review and merge native MCP, hook, and approval settings intentionally.
-
-{
-  "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "agent": "orchestrator",
-  "permissions": {
-    "allow": [
-      "Bash(git *)",
-      "Bash(poetry run *)",
-      "Bash(pwsh *)",
-      "Read",
-      "Edit(/docs/**)",
-      "Write(/docs/**)",
-      "Write(/artifacts/**)",
-      "mcp__drmCopilotExtension__run_poshqc_format",
-      "mcp__drmCopilotExtension__run_poshqc_analyze",
-      "mcp__drmCopilotExtension__run_poshqc_test",
-      "mcp__drmCopilotExtension__run_poshqc_analyze_autofix",
-      "mcp__drmCopilotExtension__resolve_execute_hard_lock_prompt",
-      "mcp__drmCopilotExtension__collect_pr_context",
-      "mcp__drmCopilotExtension__new_potential_entry",
-      "mcp__drmCopilotExtension__new_potential_bug_entry",
-      "mcp__drmCopilotExtension__potential_to_issue",
-      "mcp__drmCopilotExtension__new_active_feature_folder",
-      "mcp__drmCopilotExtension__validate_orchestration_artifacts",
-      "mcp__drmCopilotExtension__resolve_atomic_plan_prompt",
-      "Agent(atomic-planner)",
-      "Agent(atomic-executor)",
-      "Agent(feature-review)",
-      "Agent(task-researcher)",
-      "Agent(prd-feature)",
-      "Agent(staged-review)",
-      "Agent(epic-review)",
-      "Agent(status-updater)",
-      "Agent(python-typed-engineer)",
-      "Agent(powershell-typed-engineer)",
-      "Agent(csharp-typed-engineer)",
-      "Agent(typescript-engineer)",
-      "Skill(orchestrate *)",
-      "Skill(commit-message *)",
-      "Skill(pr-author *)",
-      "Skill(research-issue *)",
-      "Skill(review-feature *)",
-      "Skill(review-staged *)",
-      "Skill(review-epic *)",
-      "Skill(update-status *)",
-      "Skill(fill-feature-docs *)",
-      "Skill(python-change-budget-router *)",
-      "Skill(python-qa-gate *)",
-      "Skill(invoke-python-engineer *)",
-      "Skill(powershell-change-budget-router *)",
-      "Skill(powershell-qa-gate *)",
-      "Skill(invoke-powershell-engineer *)",
-      "Skill(translate-copilot-to-claude *)",
-      "Skill(execute-hard-lock *)",
-      "Edit(/.agents/skills/execute-hard-lock/**)",
-      "Edit(/.agents/skills/feature-review-workflow/**)",
-      "Edit(/.agents/skills/csharp-qa-gate/**)"
-    ],
-    "deny": [
-      "Read(./.env)",
-      "Read(./.env.*)",
-      "Read(./secrets/**)",
-      "Edit(./secrets/**)",
-      "Write(./secrets/**)"
-    ],
-    "additionalDirectories": [
-      "c:\\Users\\DanMoisan\\repos\\drm-copilot\\.claude\\skills\\execute-hard-lock"
-    ]
-  },
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Bash",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "pwsh -NoProfile -File .codex/hooks/validate-bash.ps1"
-          },
-          {
-            "type": "command",
-            "command": "pwsh -NoProfile -File .codex/hooks/enforce-promotion-mcp-only.ps1"
-          }
-        ]
-      },
-      {
-        "matcher": "Write|Edit",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "pwsh -NoProfile -File .codex/hooks/check-python-test-purity.ps1"
-          },
-          {
-            "type": "command",
-            "command": "pwsh -NoProfile -File .codex/hooks/enforce-python-batch-budget.ps1"
-          },
-          {
-            "type": "command",
-            "command": "pwsh -NoProfile -File .codex/hooks/check-powershell-test-purity.ps1"
-          },
-          {
-            "type": "command",
-            "command": "pwsh -NoProfile -File .codex/hooks/enforce-powershell-batch-budget.ps1"
-          },
-          {
-            "type": "command",
-            "command": "pwsh -NoProfile -File .codex/hooks/enforce-evidence-locations.ps1"
-          }
-        ]
-      }
-    ],
-    "SubagentStop": [
-      {
-        "matcher": "atomic-planner|atomic-executor|feature-review|task-researcher|prd-feature|staged-review|epic-review|status-updater|python-typed-engineer|powershell-typed-engineer|csharp-typed-engineer|typescript-engineer",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "pwsh -NoProfile -Command \"$input = $env:CLAUDE_HOOK_INPUT | ConvertFrom-Json; $output = $input.output; if (-not ($output -match '(plan-path|research-path|review-artifact|PREFLIGHT|evidence/)')) { Write-Error 'Subagent stopped without required completion artifact path'; exit 1 }; exit 0\""
-          }
-        ]
-      },
-      {
-        "matcher": "feature-review",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "pwsh -NoProfile -File .codex/hooks/validate-feature-review-coverage.ps1"
-          }
-        ]
-      }
-    ]
-  },
-  "enabledPlugins": {
-    "skill-creator@claude-plugins-official": true
-  },
-  "defaultPermissionMode": "bypassPermissions"
-}
+default_permissions = ":danger-full-access"
+
+[mcp_servers.drm-copilot]
+command = "npx"
+args = ["-y", "@danmoisan/drm-copilot-mcp"]
+required = true
+enabled_tools = [
+    "collect_commit_context",
+    "collect_pr_context",
+    "run_codex_native_converter",
+    "push_down_copilot_customizations",
+    "push_down_codex_and_agents_customizations",
+    "push_down_claude_customizations",
+    "new_potential_bug_entry",
+    "new_potential_entry",
+    "link_parent_child",
+    "potential_to_issue",
+    "new_active_feature_folder",
+    "run_poshqc_format",
+    "run_poshqc_analyze",
+    "run_poshqc_test",
+    "run_poshqc_analyze_autofix",
+    "run_poshqc_suite",
+    "resolve_policy_audit_template_asset",
+    "resolve_execute_hard_lock_prompt",
+    "resolve_atomic_plan_prompt",
+    "validate_orchestration_artifacts",
+]
+default_tools_approval_mode = "prompt"
+
+[mcp_servers.drm-copilot.tools.validate_orchestration_artifacts]
+approval_mode = "approve"
+
+[features]
+multi_agent = true
+
+[[hooks.PreToolUse]]
+matcher = "Bash"
+command = "pwsh -NoProfile -File .codex/hooks/validate-bash.ps1"
+
+[[hooks.PreToolUse]]
+matcher = "Bash"
+command = "pwsh -NoProfile -File .codex/hooks/enforce-promotion-mcp-only.ps1"
+
+[[hooks.PreToolUse]]
+matcher = "Bash"
+command = "pwsh -NoProfile -File .codex/hooks/enforce-orchestration-preimplementation-gate.ps1"
+
+[[hooks.PreToolUse]]
+matcher = "Write|Edit"
+command = "pwsh -NoProfile -File .codex/hooks/check-python-test-purity.ps1"
+
+[[hooks.PreToolUse]]
+matcher = "Write|Edit"
+command = "pwsh -NoProfile -File .codex/hooks/enforce-python-batch-budget.ps1"
+
+[[hooks.PreToolUse]]
+matcher = "Write|Edit"
+command = "pwsh -NoProfile -File .codex/hooks/check-powershell-test-purity.ps1"
+
+[[hooks.PreToolUse]]
+matcher = "Write|Edit"
+command = "pwsh -NoProfile -File .codex/hooks/enforce-powershell-batch-budget.ps1"
+
+[[hooks.PreToolUse]]
+matcher = "Write|Edit"
+command = "pwsh -NoProfile -File .codex/hooks/enforce-evidence-locations.ps1"
+
+[[hooks.PreToolUse]]
+matcher = "Write|Edit"
+command = "pwsh -NoProfile -File .codex/hooks/enforce-orchestration-preimplementation-gate.ps1"
+
+[[hooks.PreToolUse]]
+matcher = "Write|Edit"
+command = "pwsh -NoProfile -File .codex/hooks/enforce-checkpoint-monotonic.ps1"
+
+[[hooks.PreToolUse]]
+matcher = "Write|Edit"
+command = "pwsh -NoProfile -File .codex/hooks/enforce-completion-consistency.ps1"
+
+[[hooks.PreToolUse]]
+matcher = "Agent"
+command = "pwsh -NoProfile -File .codex/hooks/enforce-orchestration-preimplementation-gate.ps1"
+
+[[hooks.SubagentStop]]
+matcher = "feature-review|feature-reviewer"
+command = "pwsh -NoProfile -File .codex/hooks/validate-feature-review-coverage.ps1"
+
+[permissions.orchestrator-workspace]
+description = "Workspace editing for deterministic orchestration with secret-path deny rules."
+extends = ":workspace"
+
+[permissions.orchestrator-workspace.filesystem]
+glob_scan_max_depth = 4
+
+[permissions.orchestrator-workspace.filesystem.":workspace_roots"]
+"**/.env" = "deny"
+"**/.env.*" = "deny"
+"secrets" = "deny"
+"secrets/**" = "deny"
+
+[permissions.orchestrator-workspace.network]
+enabled = true
+
+[permissions.orchestrator-workspace.network.domains]
+"github.com" = "allow"
+"api.github.com" = "allow"
+"objects.githubusercontent.com" = "allow"
+"registry.npmjs.org" = "allow"
+"pypi.org" = "allow"
+"files.pythonhosted.org" = "allow"