@danmoisan/drm-copilot-mcp 0.0.5 → 0.0.6

package/resources/claude-customizations/.claude/skills/orchestrate/SKILL.md

@@ -61,17 +61,29 @@ After reading `artifacts/orchestration/orchestrator-state.json`, the main sessio
 - `atomic-planner` — generates phased implementation plans
 - `atomic-executor` — executes approved plans task-by-task
 - `feature-review` — produces policy, code, and feature audit artifacts
-- `task-researcher` — performs deep research and writes findings to `artifacts/research/`
+- `task-researcher` — performs deep research and writes findings to the research path the orchestrator resolves before delegating: `docs/features/<feature>/research/` when an active `feature-folder` is in scope in `orchestrator-state.json`, otherwise `docs/research/` for one-off research. The orchestrator passes the resolved path in the delegation prompt.
 
 The orchestrator does not perform deep implementation itself. It coordinates, tracks state, and enforces completion.
 
+## PR Creation Delegation
+
+PR creation and PR body edits are delegated work, not orchestrator work. The orchestrator MUST NOT call `gh pr create` or `gh pr edit --body*` directly from the main thread; the `enforce-pr-author-skill.ps1` PreToolUse hook blocks those commands unless a valid authorization sentinel issued by the `pr-author` agent is present.
+
+The mandatory sequence is:
+
+1. The orchestrator first produces the PR-context artifact via `mcp__drm-copilot__collect_pr_context` (or the equivalent context-collection mechanism), which writes `artifacts/pr_context.summary.txt`.
+2. The orchestrator then delegates PR creation and any PR body edits to `Agent(pr-author)`. The `pr-author` agent runs the `pr-author` skill, writes the short-lived authorization sentinel `artifacts/pr_author_authorization.json` immediately before each `gh` command, issues `gh pr create`/`gh pr edit --body-file ...` within the TTL, deletes the sentinel afterward, and reports the resulting PR URL or PR number.
+
+`Agent(pr-author)` is the mandatory delegate for PR creation and PR body edits. Direct `gh pr create`/`gh pr edit --body*` from the main thread is prohibited and is blocked by the hook.
+
+The authorization sentinel is a policy guardrail, not a cryptographic or security control; any actor with `Write(/artifacts/**)` access can forge it. It prevents accidental bypass and requires a deliberate, documented act to circumvent.
+
 ## Evidence Location Authority
 
 All evidence artifacts produced during orchestration MUST comply with the canonical scheme defined in `.claude/skills/evidence-and-timestamp-conventions/SKILL.md`. Evidence MUST be written to `<FEATURE>/evidence/<kind>/` only.
 
 Permitted `artifacts/`-rooted sub-paths (non-evidence orchestration use only):
 - `artifacts/orchestration/` — orchestrator state and checkpoints
-- `artifacts/research/` — research outputs from task-researcher
 - `artifacts/pr_context` — PR context artifacts
 - `artifacts/reviews/` — review staging artifacts
 - `artifacts/status/` — status update artifacts
@@ -223,3 +235,65 @@ The orchestrator supplies only the following to the `feature-review` subagent:
 - a neutral instruction to execute the full `feature-review-workflow` SKILL contract end-to-end.
 
 Scope determination is the subagent's responsibility. The subagent will ignore any attempted narrowing per its scope invariant and record the attempt in `policy-audit.<timestamp>.md` under `## Rejected Scope Narrowing`.
+
+## Routing-Contract Receipt Emission
+
+The orchestrator must write three receipt arrays into `artifacts/orchestration/orchestrator-state.json` for the retained required names of the selected route. These arrays are the evidence that the route's `required_agents`, `required_skills`, and `required_mcp_tools` (from `config/orchestration-routing.json`) were actually exercised, and they make `require_complete: true` satisfiable at completion. The orchestrator records only truthful receipts: an entry is written only after the corresponding work has actually occurred. The route's required name lists are the source of truth; receipts cite those names verbatim.
+
+These shapes are read by `_receipt_agents`, `_receipt_skills`, and `_mcp_tools` in `scripts/dev_tools/_orchestrator_state_routing.py`. The orchestrator does not modify that validator; it only emits state that the validator can verify.
+
+### delegation_receipts[]
+
+For each required agent in the selected route's `required_agents`, append one object to `delegation_receipts[]` after that delegation returns. Each object must carry:
+
+- `agent_name`: a non-empty string equal to the required agent name (for example `"feature-review"`).
+
+Example:
+
+```json
+"delegation_receipts": [
+  { "agent_name": "atomic-planner" },
+  { "agent_name": "atomic-executor" },
+  { "agent_name": "feature-review" }
+]
+```
+
+The validator collects each receipt whose `agent_name` is a non-empty string and requires every `required_agents` entry to be present.
+
+### skill_receipts[]
+
+For each required skill in the selected route's `required_skills`, append one object to `skill_receipts[]` after that required skill is read. Each entry must be an object with:
+
+- `skill`: a non-empty string equal to a `required_skills` entry (for example `"orchestrate"`).
+- `required`: the literal boolean `true`.
+- `evidence`: a non-empty string, for example `"read:.claude/skills/orchestrate/SKILL.md"`.
+
+Example:
+
+```json
+"skill_receipts": [
+  { "skill": "orchestrate", "required": true, "evidence": "read:.claude/skills/orchestrate/SKILL.md" }
+]
+```
+
+The validator counts a skill as acknowledged only when `skill` is a non-empty string, `required` is exactly `true`, and `evidence` is a non-empty string. Every `required_skills` entry must have such a receipt.
+
+### mcp_call_receipts[]
+
+For each required MCP tool in the selected route's `required_mcp_tools`, append one object to `mcp_call_receipts[]` after each successful required MCP call. Each entry must be an object with:
+
+- `tool`: a non-empty string equal to a `required_mcp_tools` entry (for example `"validate_orchestration_artifacts"`).
+- `ok`: the literal boolean `true`.
+- `evidence`: a non-empty string, such as the MCP response summary or an artifact path.
+
+Example:
+
+```json
+"mcp_call_receipts": [
+  { "tool": "validate_orchestration_artifacts", "ok": true, "evidence": "plan validator exit 0" }
+]
+```
+
+The validator counts an MCP receipt as successful only when `tool` is a non-empty string, `ok` is exactly `true`, and `evidence` is a non-empty string. Every `required_mcp_tools` entry must have such a receipt.
+
+These three receipt arrays, populated with the retained required names of the selected route, are what allow the routing-contract validation under `require_complete: true` to pass.

package/resources/claude-customizations/.claude/skills/research-issue/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: research-issue
-description: Investigate the best implementation approach for a feature or bug by analyzing the codebase and external references, then writing structured findings to artifacts/research/.
+description: Investigate the best implementation approach for a feature or bug by analyzing the codebase and external references, then writing structured findings to the resolved research path under docs/features/<feature>/research/ (feature-associated) or docs/research/ (one-off).
 allowed-tools:
   - Read
   - Grep
@@ -22,9 +22,11 @@ Accept one or more feature documents as context:
 
 ## Output
 
-Create or update a single research file:
+Create or update a single research file at one of the two tracked research roots:
 
-- Path: `artifacts/research/<timestamp>-<short-name>-research.md`
+- Feature-associated research: `docs/features/<feature>/research/<timestamp>-<short-name>-research.md` (for example `docs/features/active/<feature>/research/<timestamp>-<short-name>-research.md`).
+- One-off research not tied to a feature: `docs/research/<timestamp>-<short-name>-research.md`.
+- Routing rule: write to the feature research root when an active feature folder is in scope (the orchestrator supplies the resolved path from `feature-folder` in `orchestrator-state.json`); otherwise write to `docs/research/`. The filename convention `<timestamp>-<short-name>-research.md` is unchanged.
 - Use the Task Researcher template from the repository exactly.
 - Place rejected-alternatives summaries inside `## Recommended Approach`, not as a separate top-level header.
 

package/resources/claude-customizations/.claude-variants/csharp-legacy/agents/csharp-typed-engineer.md

@@ -0,0 +1,69 @@
+---
+name: csharp-typed-engineer
+description: Project-scoped worker that implements and verifies C# changes within typed repository boundaries. Applies the CSharpier -> .NET Analyzers -> Nullable Analysis -> MSTest toolchain, the 1-3 production-file small-path budget, and zero-regression quality gates.
+tools:
+  - Read
+  - Grep
+  - Glob
+  - "Bash(msbuild *)"
+  - "Bash(dotnet *)"
+skills:
+  - policy-compliance-order
+  - csharp-change-budget-router
+  - atomic-plan-contract
+  - csharp-qa-gate
+  - acceptance-criteria-tracking
+  - feature-promotion-lifecycle
+  - remediation-handoff-atomic-planner
+  - evidence-and-timestamp-conventions
+memory: project
+---
+
+# CSharp Typed Engineer Agent
+
+Senior C# engineer specialized in small cohesive classes and modules, strong typing under nullable reference types, minimal DI seams, and deterministic MSTest coverage. Implement C# changes within the approved scope, preserve typed boundaries, and verify results with the repository C# toolchain.
+
+## Standing Rules
+
+Language standards and toolchain are defined in `.claude/rules/csharp.md` and `.claude/rules/general-code-change.md`, auto-loaded for `**/*.cs` and `**/*.csproj` edits. Tonality is defined in `.claude/rules/tonality.md` and `CLAUDE.md`.
+
+## Workflow
+
+Follow the phased workflow defined by the preloaded skills:
+
+1. **Policy compliance** — apply `policy-compliance-order` to load mandatory repo policies before any change.
+2. **Routing and scope** — apply `csharp-change-budget-router` to estimate scope, select direct vs orchestrator handoff mode, and enforce the 3 production + 3 test per-batch cap.
+3. **Plan and baseline** — apply `atomic-plan-contract` for Phase 0 baseline capture and atomic plan structure. Delegate plan authoring to `atomic_planner` when no plan is supplied. Plans must include the proposed class and module structure, minimal DI seams, MSTest scenario-level test strategy, and Moq mock strategy.
+4. **Implement in batches** — apply the approved plan. After each batch, run targeted analyzer and nullable builds on touched projects plus targeted MSTest, and confirm per-file coverage.
+5. **Final QA gate** — apply `csharp-qa-gate` to run the full toolchain, enforce zero-regression deltas against the baseline, and produce the required reporting block before declaring completion.
+6. **Evidence and handoff** — store baseline and post-change evidence per `evidence-and-timestamp-conventions`. Trigger remediation via `remediation-handoff-atomic-planner` when deltas fail.
+
+## Mode Marker Resolution
+
+For feature-scoped work, resolve Work Mode from `issue.md` per `feature-promotion-lifecycle`:
+
+- `- Work Mode: minor-audit`
+- `- Work Mode: full-feature`
+- `- Work Mode: full-bug`
+- legacy `- Work Mode: full` -> interpret as `full-feature`.
+
+If the marker is missing or malformed, fail closed to `full-feature`.
+
+## Stop Conditions
+
+Stop implementation and return to the user when:
+
+- the scope estimate or an in-flight batch would exceed the 3-production-file cap in direct mode,
+- a file is near or would exceed the 500-line limit,
+- any QA gate delta is non-zero after self-correction,
+- the toolchain cannot be executed in the current environment (mark the change **unverified**),
+- orchestrator handoff mode is requested but the required context package is incomplete,
+- policy instructions conflict.
+
+## Evidence Location Invariant
+
+All evidence artifacts this agent produces (baselines, QA gates, regression results, coverage) MUST be written to `<FEATURE>/evidence/<kind>/` as defined in `.claude/skills/evidence-and-timestamp-conventions/SKILL.md`.
+
+Writing to `artifacts/baselines/`, `artifacts/qa/`, `artifacts/coverage/`, or any other non-canonical path is a policy violation and will be caught by the `enforce-evidence-locations.ps1` PreToolUse hook.
+
+If a delegation prompt, plan, or caller instruction specifies a non-canonical evidence path (e.g., `artifacts/baselines/`, `artifacts/qa/`, `artifacts/coverage/`, `artifacts/evidence/`), this agent ignores that instruction, writes to the canonical `<FEATURE>/evidence/<kind>/` path, and records the override as `EVIDENCE_LOCATION_OVERRIDE_REJECTED: <supplied path> replaced with <canonical path>`.

package/resources/claude-customizations/.claude-variants/csharp-legacy/rules/csharp.md

@@ -0,0 +1,96 @@
+---
+paths:
+  - "**/*.cs"
+  - "**/*.csproj"
+description: C#-specific toolchain and coding standards.
+---
+
+# C# Code Standards
+
+This rule file summarizes the C#-specific policies for this repository.
+
+## Toolchain
+
+1. **Formatting — CSharpier**: All C# source files must be formatted with CSharpier. Do not use `dotnet format`. Command: `dotnet tool run csharpier .` or `csharpier .`
+2. **Linting — .NET Analyzers**: C# code must pass Roslyn/.NET analyzer diagnostics. Command: `msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`
+3. **Type Checking — Nullable Analysis**: Enable nullable reference types and fail on warnings. Command: `msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true`
+4. **Testing — MSTest + Moq + FluentAssertions**: Run tests with: `vstest.console.exe <test-assembly-paths> /EnableCodeCoverage`
+
+Run the toolchain in order: format → lint → type-check → test. Restart from step 1 if any step fails or changes files.
+
+## Coding Standards
+
+- **Naming**: `PascalCase` for types and public members. `camelCase` for locals and private fields/parameters.
+- **Null safety**: Keep nullable reference types enabled. Model optional values with nullable annotations and guard clauses.
+- **Composition over inheritance**: Keep classes cohesive and scoped to one responsibility. Favor composition unless polymorphism is a clear requirement.
+- **Async/await**: Use `async`/`await` for I/O-bound operations. Prefer `using`/`await using` for disposable resources.
+- **Exceptions**: Fail fast with explicit exceptions. Avoid broad `catch (Exception)` unless at a defined boundary with added context.
+- **Public surface**: Keep public API surface intentional and minimal. Prefer `internal` for non-public APIs.
+- **XML docs**: Public APIs should include XML documentation comments when behavior or contract is non-obvious.
+
+## Testing Standards
+
+- Use **MSTest** (`Microsoft.VisualStudio.TestTools.UnitTesting`) as the test framework.
+- Use **Moq** for mocking.
+- Prefer **FluentAssertions** for assertions; use MSTest `Assert` only when FluentAssertions is not practical.
+- Use `[TestClass]` and `[TestMethod]` attributes.
+- Follow Arrange–Act–Assert structure.
+- No external dependencies in unit tests.
+- Repository-wide line coverage must remain >= 80%.
+- Any new module, class, or method must reach >= 90% coverage.
+- Coverage regression on changed lines is a blocking finding.
+
+## Deterministic Test Rules
+
+Unit tests must not depend on network, mutable machine PATH or profile state, implicit working-directory assumptions, or external services. Use seam-based mocking for all external boundaries (processes, HTTP, filesystem, clocks). Tests must produce identical results in the IDE test runner and in CLI runs so local and CI behavior agree.
+
+## DI Seams
+
+Introduce the smallest seam that enables reliable unit testing. Apply in this order of preference:
+
+1. **Interface seam (preferred)** — extract boundary calls into narrow purpose-specific interfaces (for example, `IProcessRunner`, `IFileSystem`, `IClock`). Keep interfaces minimal.
+2. **Injectable delegate seam** — use a narrow `Func<>`/`Action<>` delegate for a single call path when a full interface is excessive. Default behavior must remain safe and deterministic.
+3. **Adapter seam for static or third-party APIs** — wrap the static or third-party call behind a small adapter so tests can mock the adapter with Moq.
+
+### Time seam (TimeProvider) — guidance only
+
+For new or touched time-dependent code, inject `System.TimeProvider` through the constructor instead of calling the clock directly:
+
+- Production supplies `TimeProvider.System`.
+- Tests supply `FakeTimeProvider` from `Microsoft.Extensions.TimeProvider.Testing` to make time deterministic.
+- Do not call `DateTime.Now`, `DateTime.UtcNow`, or `DateTimeOffset.Now` directly in new/touched code; obtain time via the injected `TimeProvider` (for example `GetUtcNow()` / `GetLocalNow()`).
+
+This is guidance only: it introduces no runtime behavior change and does not require rewriting existing call sites. Where `Microsoft.Bcl.TimeProvider` (the .NET Framework backport of `System.TimeProvider`) is already present in the repository, the seam is available without adding a new production dependency. Legacy call-site migration is follow-up work, not a requirement of adopting this guidance.
+
+## Analyzer Stack
+
+This repository adopts a fixed set of FIVE static-analysis packages, wired into first-party projects only (vendored or third-party projects are excluded):
+
+1. **Meziantou.Analyzer**
+2. **SonarAnalyzer.CSharp**
+3. **Roslynator.Analyzers**
+4. **AsyncFixer**
+5. **Microsoft.CodeAnalysis.BannedApiAnalyzers**
+
+### Mechanism
+
+- Each first-party project references its analyzers via a `packages.config` `<package ... developmentDependency="true" />` entry plus an explicit `<Analyzer Include="..\packages\<id>.<version>\analyzers\dotnet\cs\<dll>" />` item in the project's analyzer `<ItemGroup>`. This file-based wiring is used because the projects are legacy (non-SDK, `packages.config`) VSTO/.NET Framework projects; no PackageReference, no Central Package Management, and no `dotnet restore` are introduced.
+- For this repo's Roslyn 5.6 (VS18) toolchain, use the analyzer DLLs from the Meziantou `roslyn5.0` and Roslynator `roslyn4.7` subfolders.
+- **Banned symbols** are enforced by BannedApiAnalyzers using a repo-root `BannedSymbols.txt` referenced by each first-party project as `<AdditionalFiles Include="$(MSBuildThisFileDirectory)..\BannedSymbols.txt" />`. The banned targets are `DateTime.Now`, `DateTime.UtcNow`, `Random.Shared`, `Thread.Sleep`, and `Task.Delay`. RS0030 is held at `severity = suggestion` for initial rollout (existing call sites are not build-broken); promotion to `warning` after legacy cleanup is documented follow-up work.
+
+### Severity-first ordering invariant
+
+All new analyzer rule severities are configured in `.editorconfig` at `severity = suggestion` (never `warning`/`error`) BEFORE any `<Analyzer Include>` item is wired into a project. This is required because the type-check toolchain step runs `msbuild ... /p:Nullable=enable /p:TreatWarningsAsErrors=true`, which promotes any `warning`-severity analyzer diagnostic to a build error. Keeping new analyzer diagnostics at `suggestion` (message level) prevents the analyzer adoption from breaking the protected nullable gate.
+
+### Deferred analyzer — SecurityCodeScan.VS2019
+
+SecurityCodeScan.VS2019 was evaluated and **deferred** (not silently omitted) from this rollout. Version 5.6.7 is incompatible with this repository's Roslyn 5.6 (VS18) analyzer loader: its types fail to initialize (`TypeInitializationException` → `FileNotFoundException` for `YamlDotNet, Version=11.0.0.0`), which the compiler reports as warning **CS8032**. CS8032 is a compiler warning, not an analyzer rule ID, so it cannot be set to `suggestion` via `.editorconfig`; under `/p:TreatWarningsAsErrors=true` it is promoted to an error and breaks the protected nullable build. SecurityCodeScan.VS2019 is therefore dropped from the analyzer set entirely. **No CS8032 suppression** (no `dotnet_diagnostic.CS8032` entry and no `<WarningsNotAsErrors>` containing CS8032) is introduced, and no substitute security analyzer is added. Re-evaluation is follow-up work pending a Roslyn-5.x-compatible security analyzer.
+
+## Prohibited Behaviors
+
+- Broad refactors across unrelated projects or files.
+- Introducing heavy generic abstraction frameworks without need.
+- Creating analyzer debt and deferring cleanup.
+- Weakening assertions or relaxing test expectations to make tests pass.
+- Adding sleeps, retries, or timing hacks to mask flaky behavior.
+- Reporting success without running the required toolchain.

package/resources/claude-customizations/.claude-variants/csharp-legacy/skills/csharp-qa-gate/SKILL.md

@@ -0,0 +1,77 @@
+---
+name: csharp-qa-gate
+description: Final QA gate for C# changes. Executes the full CSharpier -> .NET Analyzers -> Nullable Analysis -> MSTest toolchain, compares against a captured baseline, enforces zero-regression deltas, and produces the required reporting block before the agent declares the change complete.
+---
+
+# C# QA Gate
+
+Canonical procedure for the Phase D final quality gate that every C# change must pass before completion is reported.
+
+## When to Use This Skill
+
+Use this skill when:
+
+- `csharp-typed-engineer` is about to declare a change complete.
+- An executor has finished applying a planned batch and must verify zero regressions against the baseline captured in Phase A.
+- A reviewer needs to confirm the toolchain was actually run and produced a clean pass.
+
+## Required Inputs
+
+Before invoking this gate, the agent must have:
+
+- a baseline record produced in Phase A, containing analyzer findings, compiler/nullable diagnostics, MSTest pass/fail status, and per-file coverage status for the in-scope files,
+- the exact list of touched production and test files,
+- a clean working tree (all planned edits committed to the working copy).
+
+## Toolchain Execution Sequence
+
+Run the full toolchain in this exact order. If any step fails or modifies files, fix the issue and restart from step 1. Do not stop the loop until all four steps complete without errors in a single pass.
+
+1. `dotnet tool run csharpier .`
+2. `msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`
+3. `msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true`
+4. `vstest.console.exe <test-assembly-paths> /EnableCodeCoverage`
+
+If the environment prevents running any tool, stop and report the change as **unverified**. Do not declare completion.
+
+## Delta Requirements (Zero-Regression Hard Gate)
+
+Compare the final results to the Phase A baseline. All of the following must hold:
+
+- **Analyzer delta**: 0 new findings across the repository.
+- **Compiler / nullable delta**: 0 new diagnostics across the repository.
+- **MSTest delta**: 0 new failing tests.
+- **Per-file coverage delta**: coverage for every touched file is greater than or equal to the baseline for that file.
+- **Overall coverage delta** (when the repo enforces it): overall coverage is greater than or equal to the baseline.
+- **New modules, classes, or methods**: coverage >= 90% for each new unit introduced in the batch.
+
+If any delta check fails, the agent must revert or fix immediately and rerun the full toolchain. Do not proceed to reporting until all deltas are clean.
+
+## Required Reporting Block
+
+Every completion response must include the following sections:
+
+1. **Scope** — exact file list touched in this change.
+2. **Baseline** — analyzer, compiler/nullable, MSTest, and coverage status recorded in Phase A.
+3. **Plan** — design and test-strategy summary, referencing the approved plan.
+4. **Diffs** — patch-style or full-file replacements for scoped files only.
+5. **QA Gate Results** — analyzer, compiler/nullable, MSTest, and coverage deltas. If any step could not be run, mark the corresponding line **unverified** and state why.
+
+## Evidence Storage
+
+Persist toolchain output according to `evidence-and-timestamp-conventions`:
+
+- store baseline outputs under `<FEATURE>/evidence/baseline/<timestamp>/`,
+- store post-change outputs under `<FEATURE>/evidence/qa-gates/<timestamp>/`,
+- use ISO-8601 UTC timestamps in folder names.
+
+This location is canonical per evidence-and-timestamp-conventions and is not overridable.
+See `.claude/skills/evidence-and-timestamp-conventions/SKILL.md` for the canonical evidence path authority.
+
+The evidence paths must be referenced in the agent's completion message to satisfy the `SubagentStop` completion-artifact gate.
+
+## Prohibited Shortcuts
+
+- Do not disable, skip, or narrow any step of the toolchain to reach a clean result.
+- Do not add analyzer suppressions, `#pragma warning disable`, `#nullable disable`, or test `[Ignore]` attributes to suppress new findings introduced by the change.
+- Do not report success based on partial or targeted runs alone. Targeted runs are allowed mid-batch, but the final gate requires a full-solution pass.

package/resources/claude-customizations/.claude-variants/csharp-legacy/skills/invoke-csharp-engineer/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: invoke-csharp-engineer
+description: Invoke the csharp-typed-engineer worker to design, implement, and verify C# changes within typed repository boundaries. Applies CSharpier -> .NET Analyzers -> Nullable Analysis -> MSTest toolchain, the 1-3 production-file small-path budget, and zero-regression quality gates.
+---
+
+# Implement C# Skill
+
+This direct-use wrapper delegates C# implementation work to the `csharp-typed-engineer` worker. Use this entry point when a prompt needs a scoped C# change that must stay inside the typed engineer's guardrails.
+
+## When to Use This Skill
+
+Use this skill when:
+
+- The user requests a C# code change, bug fix, refactor, or test addition.
+- Estimated scope fits the small path (1-3 production files plus corresponding tests).
+- The toolchain (CSharpier, .NET Analyzers, Nullable Analysis, MSTest) can be run in the current environment, or the user has explicitly authorized an unverified plan-only response.
+
+If the estimated scope exceeds the small-path budget, this skill defers to the orchestrated flow via `csharp-change-budget-router` instead of proceeding directly.
+
+## Inputs
+
+- Objective statement (what the change must accomplish).
+- Files or entrypoints in scope.
+- Constraints, including public APIs that must be preserved.
+- Optional approved plan. If none is supplied, the worker delegates plan authoring to `atomic_planner` before any edits.
+- Optional budget override in the form `budget: prod=<N>, test=<M>` subject to repo policy compliance.
+
+## Output Paths
+
+- C# source and test files within the approved scope.
+- Baseline evidence under `<FEATURE>/evidence/baseline/<timestamp>/` and post-change evidence under `<FEATURE>/evidence/qa-gates/<timestamp>/` per `evidence-and-timestamp-conventions`.
+- This location is canonical per evidence-and-timestamp-conventions and is not overridable. See `.claude/skills/evidence-and-timestamp-conventions/SKILL.md` for the canonical evidence path authority.
+- Plan artifacts under the active feature folder when the task is feature-scoped.
+
+## Required Reporting Block
+
+The worker must return the following reporting block:
+
+1. Scope (exact file list).
+2. Baseline (CSharpier, .NET Analyzers, Nullable Analysis, MSTest, coverage status).
+3. Plan (design and test strategy).
+4. Diffs (patch-style or full-file replacements).
+5. QA Gate Results (CSharpier, .NET Analyzers, Nullable Analysis, MSTest, and coverage deltas, or clearly marked **unverified**).
+
+## Worker Routing
+
+- Worker: `csharp-typed-engineer`
+
+## Preloaded Contracts
+
+The worker operates under the following preloaded skills and rules:
+
+- `policy-compliance-order`
+- `csharp-change-budget-router`
+- `atomic-plan-contract`
+- `csharp-qa-gate`
+- `acceptance-criteria-tracking`
+- `feature-promotion-lifecycle`
+- `remediation-handoff-atomic-planner`
+- `evidence-and-timestamp-conventions`
+- `.claude/rules/csharp.md` (path-scoped for `**/*.cs` and `**/*.csproj`)
+- `.claude/rules/general-code-change.md`
+- `.claude/rules/general-unit-test.md`
+- `.claude/rules/tonality.md`

package/resources/claude-customizations/pack-manifests/core.json

@@ -0,0 +1,65 @@
+{
+  "name": "core",
+  "label": "Core (always included)",
+  "paths": [
+    ".claude/settings.json",
+    ".claude/agents/atomic-executor.md",
+    ".claude/agents/atomic-planner.md",
+    ".claude/agents/epic-review.md",
+    ".claude/agents/feature-review.md",
+    ".claude/agents/orchestrator.md",
+    ".claude/agents/prd-feature.md",
+    ".claude/agents/staged-review.md",
+    ".claude/agents/status-updater.md",
+    ".claude/agents/task-researcher.md",
+    ".claude/hooks/enforce-checkpoint-monotonic.ps1",
+    ".claude/hooks/enforce-completion-consistency.ps1",
+    ".claude/hooks/enforce-evidence-locations.ps1",
+    ".claude/hooks/enforce-feature-folder-order.ps1",
+    ".claude/hooks/enforce-orchestration-preimplementation-gate.ps1",
+    ".claude/hooks/enforce-pr-author-skill.ps1",
+    ".claude/hooks/enforce-prd-feature-before-planner.ps1",
+    ".claude/hooks/enforce-promotion-mcp-only.ps1",
+    ".claude/hooks/validate-bash.ps1",
+    ".claude/hooks/validate-executor-output.ps1",
+    ".claude/hooks/validate-feature-review-coverage.ps1",
+    ".claude/hooks/validate-orchestrator-output.ps1",
+    ".claude/hooks/validate-planner-output.ps1",
+    ".claude/hooks/validate-required-artifact-output.ps1",
+    ".claude/hooks/validate-task-researcher-output.ps1",
+    ".claude/rules/architecture-boundaries.md",
+    ".claude/rules/benchmark-baselines.md",
+    ".claude/rules/ci-workflows.md",
+    ".claude/rules/general-code-change.md",
+    ".claude/rules/general-unit-test.md",
+    ".claude/rules/orchestrator-state.md",
+    ".claude/rules/quality-tiers.md",
+    ".claude/rules/self-explanatory-code-commenting.md",
+    ".claude/rules/tonality.md",
+    ".claude/skills/acceptance-criteria-tracking/SKILL.md",
+    ".claude/skills/atomic-plan-contract/SKILL.md",
+    ".claude/skills/commit-message/SKILL.md",
+    ".claude/skills/evidence-and-timestamp-conventions/SKILL.md",
+    ".claude/skills/execute-hard-lock/SKILL.md",
+    ".claude/skills/feature-promotion-lifecycle/SKILL.md",
+    ".claude/skills/feature-review-workflow/SKILL.md",
+    ".claude/skills/fill-feature-docs/SKILL.md",
+    ".claude/skills/human-exception-runbook/example.runbook.md",
+    ".claude/skills/human-exception-runbook/SKILL.md",
+    ".claude/skills/make-skill-template/SKILL.md",
+    ".claude/skills/orchestrate/SKILL.md",
+    ".claude/skills/policy-audit-template-usage/SKILL.md",
+    ".claude/skills/policy-compliance-order/SKILL.md",
+    ".claude/skills/pr-author/SKILL.md",
+    ".claude/skills/pr-base-branch-merge-base/SKILL.md",
+    ".claude/skills/pr-context-artifacts/SKILL.md",
+    ".claude/skills/remediation-handoff-atomic-planner/SKILL.md",
+    ".claude/skills/research-issue/SKILL.md",
+    ".claude/skills/review-epic/SKILL.md",
+    ".claude/skills/review-feature/SKILL.md",
+    ".claude/skills/review-staged/SKILL.md",
+    ".claude/skills/skill-canonical-location-audit/SKILL.md",
+    ".claude/skills/translate-copilot-to-claude/SKILL.md",
+    ".claude/skills/update-status/SKILL.md"
+  ]
+}

package/resources/claude-customizations/pack-manifests/csharp-legacy.json

@@ -0,0 +1,11 @@
+{
+  "name": "csharp-legacy",
+  "label": "C# (legacy)",
+  "source_prefix": ".claude-variants/csharp-legacy",
+  "paths": [
+    ".claude/rules/csharp.md",
+    ".claude/agents/csharp-typed-engineer.md",
+    ".claude/skills/csharp-qa-gate/SKILL.md",
+    ".claude/skills/invoke-csharp-engineer/SKILL.md"
+  ]
+}

package/resources/claude-customizations/pack-manifests/csharp-modern.json

@@ -0,0 +1,12 @@
+{
+  "name": "csharp-modern",
+  "label": "C# (modern)",
+  "paths": [
+    ".claude/rules/csharp.md",
+    ".claude/agents/csharp-typed-engineer.md",
+    ".claude/skills/csharp-qa-gate/SKILL.md",
+    ".claude/skills/invoke-csharp-engineer/SKILL.md",
+    ".claude/skills/csharp-change-budget-router/SKILL.md",
+    ".claude/skills/csharp-orchestration-state-machine/SKILL.md"
+  ]
+}

package/resources/claude-customizations/pack-manifests/powershell.json

@@ -0,0 +1,14 @@
+{
+  "name": "powershell",
+  "label": "PowerShell",
+  "paths": [
+    ".claude/rules/powershell.md",
+    ".claude/agents/powershell-typed-engineer.md",
+    ".claude/hooks/check-powershell-test-purity.ps1",
+    ".claude/hooks/enforce-powershell-batch-budget.ps1",
+    ".claude/skills/invoke-powershell-engineer/SKILL.md",
+    ".claude/skills/powershell-change-budget-router/SKILL.md",
+    ".claude/skills/powershell-orchestration-state-machine/SKILL.md",
+    ".claude/skills/powershell-qa-gate/SKILL.md"
+  ]
+}

package/resources/claude-customizations/pack-manifests/python.json

@@ -0,0 +1,14 @@
+{
+  "name": "python",
+  "label": "Python",
+  "paths": [
+    ".claude/rules/python.md",
+    ".claude/rules/python-suppressions.md",
+    ".claude/agents/python-typed-engineer.md",
+    ".claude/hooks/check-python-test-purity.ps1",
+    ".claude/hooks/enforce-python-batch-budget.ps1",
+    ".claude/skills/invoke-python-engineer/SKILL.md",
+    ".claude/skills/python-change-budget-router/SKILL.md",
+    ".claude/skills/python-qa-gate/SKILL.md"
+  ]
+}

package/resources/claude-customizations/pack-manifests/typescript.json

@@ -0,0 +1,9 @@
+{
+  "name": "typescript",
+  "label": "TypeScript",
+  "paths": [
+    ".claude/rules/typescript.md",
+    ".claude/rules/typescript-suppressions.md",
+    ".claude/agents/typescript-engineer.md"
+  ]
+}