@danmoisan/drm-copilot-mcp 1.0.0 → 1.0.7

package/resources/codex-and-agents-customizations/pack-manifests/python.json

@@ -0,0 +1,15 @@
+{
+  "name": "python",
+  "label": "Python",
+  "paths": [
+    ".agents/skills/python/SKILL.md",
+    ".agents/skills/python-suppressions/SKILL.md",
+    ".agents/skills/python-change-budget-router/SKILL.md",
+    ".agents/skills/python-qa-gate/SKILL.md",
+    ".agents/skills/invoke-python-engineer/SKILL.md",
+    ".codex/agents/python-typed-engineer.toml",
+    ".codex/agents/python-orchestrator.toml",
+    ".codex/agents/python-atomic-executor.toml",
+    ".codex/agents/python-atomic-planning.toml"
+  ]
+}

package/resources/codex-and-agents-customizations/pack-manifests/typescript.json

@@ -0,0 +1,9 @@
+{
+  "name": "typescript",
+  "label": "TypeScript",
+  "paths": [
+    ".agents/skills/typescript/SKILL.md",
+    ".agents/skills/typescript-suppressions/SKILL.md",
+    ".codex/agents/typescript-engineer.toml"
+  ]
+}

package/resources/config/orchestration-routing.json

@@ -71,6 +71,98 @@
         "collect_pr_context",
         "validate_orchestration_artifacts"
       ]
+    },
+    "epic": {
+      "description": "Epic path for scheduling a dependency graph of child features across parallel worktrees with fan-in via a shared integration branch.",
+      "requires_pr_gate": true,
+      "required_agents": [
+        "orchestrator",
+        "pr-author"
+      ],
+      "required_skills": [
+        "epic-orchestrate",
+        "orchestrate",
+        "feature-promotion-lifecycle",
+        "atomic-plan-contract",
+        "acceptance-criteria-tracking",
+        "evidence-and-timestamp-conventions",
+        "pr-context-artifacts",
+        "pr-base-branch-merge-base"
+      ],
+      "required_mcp_tools": [
+        "collect_pr_context",
+        "validate_orchestration_artifacts"
+      ]
+    }
+  },
+  "model_policy": {
+    "description": "Judgment-based complexity-band model selection. This block governs only the delegation model tier. It is not a route input, and route is not an input to model selection.",
+    "tier_order": [
+      "haiku",
+      "sonnet",
+      "opus",
+      "fable"
+    ],
+    "complexity": {
+      "scale": "C1 trivial or mechanical change with no behavior effect. C2 localized feature or bug change confined to a small surface. C3 cross-cutting change that alters an invariant, contract, or behavior across module boundaries. C4 novel, ambiguous, or research-heavy change requiring the most capable tier; C4 is reached only by judgment and is never floor-forced.",
+      "signals": [
+        {
+          "name": "classifier_or_model_logic",
+          "floor": true,
+          "anchor": "Changes to classifier engines, scoring, or model-affecting logic (T1 modules)."
+        },
+        {
+          "name": "auth_or_token_handling",
+          "floor": true,
+          "anchor": "Changes to authentication, token handling, or other security-sensitive paths."
+        },
+        {
+          "name": "concurrency_or_ordering",
+          "floor": true,
+          "anchor": "Introduces or modifies concurrency, ordering, or state-transition invariants."
+        },
+        {
+          "name": "cross_module_contract_change",
+          "floor": true,
+          "anchor": "Alters a public contract or schema consumed across module boundaries."
+        },
+        {
+          "name": "single_file_localized_edit",
+          "floor": false,
+          "anchor": "A localized edit confined to one file with no cross-cutting effect."
+        },
+        {
+          "name": "mechanical_rename_or_move",
+          "floor": false,
+          "anchor": "A mechanical rename, move, or formatting change with no behavior change."
+        },
+        {
+          "name": "docs_or_comment_only",
+          "floor": false,
+          "anchor": "A documentation-only or comment-only change."
+        }
+      ]
+    },
+    "complexity_to_model": {
+      "C1": "haiku",
+      "C2": "sonnet",
+      "C3": "opus",
+      "C4": "fable"
+    },
+    "preferred_overlay": {
+      "description": "Applied only under fable_policy preferred. Changes only the C3 cell to fable, and only for the listed agents. No other agent and no other band is affected.",
+      "agents": [
+        "atomic-planner",
+        "prd-feature",
+        "feature-review",
+        "task-researcher"
+      ],
+      "band": "C3",
+      "model": "fable"
     }
+  },
+  "model_budget": {
+    "description": "Session-level model budget. fable_policy is a three-way switch controlling whether the fable tier is disabled (removed and clamped to opus), available (used as-is), or preferred (applies the preferred_overlay).",
+    "fable_policy": "disabled"
   }
 }

package/resources/customizations/.github/agents/pr-author.agent.md

@@ -137,27 +137,33 @@ Use these sections, in this order:
 
 That’s it. Produce the PR body.
 
-## Authorization Sentinel Protocol (Documentation-Only in This Ecosystem)
+## PR Body and Receipt Protocol (Documentation-Only in This Ecosystem)
 
 When this agent opens or updates a pull request via `gh pr create` or `gh pr edit --body*`, it follows
-the cross-ecosystem authorization sentinel protocol:
-
-1. Run `git rev-parse HEAD` to obtain `head_sha`.
-2. Write `artifacts/pr_author_authorization.json` with exactly: `issued_by` set to `"pr-author"`,
-   `issued_at` as a UTC ISO-8601 timestamp, `head_sha` from step 1, and `ttl_seconds` set to `120`.
-3. Issue the `gh pr create` / `gh pr edit --body-file ...` command immediately, within the 120-second
-   TTL. Pass the PR body via `--body-file`; inline `--body` is not used.
-4. Delete `artifacts/pr_author_authorization.json` after the command completes (success or failure).
+the cross-ecosystem PR body and receipt protocol:
+
+1. Write the PR body text to `artifacts/pr_body_<N>.md`, where `<N>` is the target issue or PR number.
+2. Compute the SHA-256 of the body file bytes and render it as lowercase hexadecimal.
+3. Write the sibling receipt `artifacts/pr_body_<N>.receipt.json` with exactly: `skill` set to
+   `"pr-author"`, `pr_body_path` set to `"artifacts/pr_body_<N>.md"`, `number` set to `<N>`, `sha256`
+   set to the lowercase-hex SHA-256 from step 2, `context_summary_path` set to
+   `"artifacts/pr_context.summary.txt"`, and `created_at` as a UTC ISO-8601 timestamp strictly newer
+   than the last-write time of `artifacts/pr_context.summary.txt`.
+4. Issue the `gh pr create --body-file artifacts/pr_body_<N>.md` (or
+   `gh pr edit --body-file ...`) command. Pass the PR body via `--body-file`; inline `--body` is not
+   used.
 
 After opening or updating the PR, report the resulting PR URL or PR number.
 
 Enforcement in the GitHub Copilot ecosystem is **documentation-only**: the Copilot ecosystem has no
-PreToolUse hook surface, so the sentinel protocol cannot be mechanically enforced here. The protocol
-is documented for consistency with the Claude and Codex ecosystems, where a PreToolUse hook verifies
-the sentinel.
-
-The authorization sentinel is a **policy guardrail, not a cryptographic or security control.** Any
-actor with write access to `artifacts/` can forge `artifacts/pr_author_authorization.json`, because
-all agents share the same filesystem and the runtime exposes no native agent-identity signal at tool
-pre-use time. The mechanism prevents accidental bypass and requires a deliberate, documented act to
-circumvent. It is not tamper-proof and is not a security boundary.
+PreToolUse hook surface, so the receipt protocol cannot be mechanically enforced here. The protocol is
+documented for consistency with the Claude and Codex ecosystems, where a PreToolUse hook verifies the
+receipt in five ordered checks (canonical body-file path, receipt present, number match, SHA-256
+match, and `created_at` newer than the context summary last-write).
+
+The SHA-256 receipt is a **policy-level integrity check, not a cryptographic or security control.** It
+binds the PR body bytes to the receipt. Any actor with write access to `artifacts/` can replace both
+`artifacts/pr_body_<N>.md` and `artifacts/pr_body_<N>.receipt.json` together with a matching SHA-256,
+because all agents share the same filesystem and the runtime exposes no native agent-identity signal
+at tool pre-use time. The mechanism prevents accidental bypass and requires a deliberate, documented
+act to circumvent. It is not tamper-proof and is not a security boundary.

package/resources/powershell/PoshQC/settings/pester.runsettings.psd1

@@ -26,6 +26,9 @@
             '.claude/hooks/check-powershell-test-purity.ps1'
             '.claude/hooks/enforce-python-batch-budget.ps1'
             '.claude/hooks/enforce-powershell-batch-budget.ps1'
+            # Issue #272 hardened this PreToolUse hook with a new orchestrator-state preflight
+            # check; measured here so the change produces real per-file coverage evidence.
+            '.claude/hooks/enforce-pr-author-skill.ps1'
             # Issue #214 added/changed these four release scripts and provided dedicated
             # Pester suites; they are measured here to produce real per-file changed-line
             # coverage rather than relying on behavioral-only evidence.
@@ -33,6 +36,14 @@
             'scripts/dev-tools/Invoke-FullRelease.ps1'
             'scripts/dev-tools/Invoke-MarketplacePublish.ps1'
             'scripts/dev-tools/Invoke-ReleaseTagPush.ps1'
+            # Issue #275 remediation cycle 1 (fix #3): measure the epic-orchestrate hook set and
+            # its dot-sourced sibling module so no production hook is excluded from coverage.
+            '.claude/hooks/enforce-epic-merge-gate.ps1'
+            '.claude/hooks/enforce-epic-wave-barrier.ps1'
+            '.claude/hooks/enforce-epic-worktree-removal-gate.ps1'
+            '.claude/hooks/enforce-pr-author-skill.ps1'
+            '.claude/hooks/validate-orchestrator-output.ps1'
+            '.claude/hooks/enforce-pr-author-skill.epic-base-branch.ps1'
         )
         ExcludedPath          = @(
             '.claude/hooks/validate-feature-review-coverage.ps1' # Feature-review wrapper around repository evidence; not deterministic in normal unit-test execution.

package/resources/codex-and-agents-customizations/.github/workflows/_validate-orchestrator-state.yml

@@ -1,68 +0,0 @@
-name: Validate Orchestrator State
-
-on:
-  workflow_call:
-    inputs:
-      state-path:
-        description: Repository-relative orchestrator checkpoint path.
-        required: false
-        type: string
-        default: artifacts/orchestration/orchestrator-state.json
-      require-checkpoint:
-        description: Fail when the checkpoint file is absent.
-        required: false
-        type: boolean
-        default: true
-  workflow_dispatch:
-    inputs:
-      state-path:
-        description: Repository-relative orchestrator checkpoint path.
-        required: false
-        type: string
-        default: artifacts/orchestration/orchestrator-state.json
-      require-checkpoint:
-        description: Fail when the checkpoint file is absent.
-        required: false
-        type: boolean
-        default: true
-
-jobs:
-  validate-orchestrator-state:
-    name: Validate orchestrator checkpoint
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.13"
-
-      - name: Install Poetry
-        uses: snok/install-poetry@v1
-        with:
-          version: latest
-          virtualenvs-create: true
-          virtualenvs-in-project: true
-
-      - name: Install dependencies
-        run: poetry install --no-interaction
-
-      - name: Validate checkpoint
-        env:
-          STATE_PATH: ${{ inputs.state-path }}
-          REQUIRE_CHECKPOINT: ${{ inputs.require-checkpoint }}
-        run: |
-          if [ ! -f "$STATE_PATH" ]; then
-            if [ "$REQUIRE_CHECKPOINT" = "true" ]; then
-              echo "ERROR: orchestrator checkpoint is required but was not found: $STATE_PATH" >&2
-              exit 1
-            fi
-            echo "No orchestrator checkpoint found at $STATE_PATH; validation skipped."
-            exit 0
-          fi
-
-          poetry run python -m scripts.dev_tools.validate_orchestration_artifacts \
-            orchestrator-state "$STATE_PATH" --require-complete

package/resources/codex-and-agents-customizations/.github/workflows/validate-orchestrator-state.yml

@@ -1,15 +0,0 @@
-name: Orchestrator State Gate
-
-on:
-  pull_request:
-    branches: [main, development]
-  push:
-    branches: [main, development]
-  workflow_dispatch:
-
-jobs:
-  validate-orchestrator-state:
-    uses: ./.github/workflows/_validate-orchestrator-state.yml
-    with:
-      state-path: artifacts/orchestration/orchestrator-state.json
-      require-checkpoint: false