@danmoisan/drm-copilot-mcp 1.0.0 → 1.0.7

package/resources/codex-and-agents-customizations/.agents-variants/csharp-legacy/skills/csharp/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: csharp
+paths:
+  - "**/*.cs"
+  - "**/*.csproj"
+description: C#-specific toolchain and coding standards.
+---
+
+# C# Code Standards
+
+Legacy C# variant resource for Codex push-down.
+
+This rule file summarizes the C#-specific policies for this repository.
+
+## Toolchain
+
+1. **Formatting — CSharpier**: All C# source files must be formatted with CSharpier. Do not use `dotnet format`. Command: `dotnet tool run csharpier .` or `csharpier .`
+2. **Linting — .NET Analyzers**: C# code must pass Roslyn/.NET analyzer diagnostics. Command: `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`
+3. **Type Checking — Nullable Analysis**: Enable nullable reference types and fail on warnings. Command: `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true`
+4. **Testing — MSTest + Moq + FluentAssertions**: Run tests with: `vstest.console.exe <test-assembly-paths> /EnableCodeCoverage`
+
+Run the toolchain in order: format → lint → type-check → test. Restart from step 1 if any step fails or changes files.
+
+## Coding Standards
+
+- **Naming**: `PascalCase` for types and public members. `camelCase` for locals and private fields/parameters.
+- **Null safety**: Keep nullable reference types enabled. Model optional values with nullable annotations and guard clauses.
+- **Composition over inheritance**: Keep classes cohesive and scoped to one responsibility. Favor composition unless polymorphism is a clear requirement.
+- **Async/await**: Use `async`/`await` for I/O-bound operations. Prefer `using`/`await using` for disposable resources.
+- **Exceptions**: Fail fast with explicit exceptions. Avoid broad `catch (Exception)` unless at a defined boundary with added context.
+- **Public surface**: Keep public API surface intentional and minimal. Prefer `internal` for non-public APIs.
+- **XML docs**: Public APIs should include XML documentation comments when behavior or contract is non-obvious.
+
+## Testing Standards
+
+- Use **MSTest** (`Microsoft.VisualStudio.TestTools.UnitTesting`) as the test framework.
+- Use **Moq** for mocking.
+- Prefer **FluentAssertions** for assertions; use MSTest `Assert` only when FluentAssertions is not practical.
+- Use `[TestClass]` and `[TestMethod]` attributes.
+- Follow Arrange–Act–Assert structure.
+- No external dependencies in unit tests.
+- Repository-wide line coverage must remain >= 80%.
+- Any new module, class, or method must reach >= 90% coverage.
+- Coverage regression on changed lines is a blocking finding.
+
+## Deterministic Test Rules
+
+Unit tests must not depend on network, mutable machine PATH or profile state, implicit working-directory assumptions, or external services. Use seam-based mocking for all external boundaries (processes, HTTP, filesystem, clocks). Tests must produce identical results in the IDE test runner and in CLI runs so local and CI behavior agree.
+
+## DI Seams
+
+Introduce the smallest seam that enables reliable unit testing. Apply in this order of preference:
+
+1. **Interface seam (preferred)** — extract boundary calls into narrow purpose-specific interfaces (for example, `IProcessRunner`, `IFileSystem`, `IClock`). Keep interfaces minimal.
+2. **Injectable delegate seam** — use a narrow `Func<>`/`Action<>` delegate for a single call path when a full interface is excessive. Default behavior must remain safe and deterministic.
+3. **Adapter seam for static or third-party APIs** — wrap the static or third-party call behind a small adapter so tests can mock the adapter with Moq.
+
+## Prohibited Behaviors
+
+- Broad refactors across unrelated projects or files.
+- Introducing heavy generic abstraction frameworks without need.
+- Creating analyzer debt and deferring cleanup.
+- Weakening assertions or relaxing test expectations to make tests pass.
+- Adding sleeps, retries, or timing hacks to mask flaky behavior.
+- Reporting success without running the required toolchain.

package/resources/codex-and-agents-customizations/.agents-variants/csharp-legacy/skills/csharp-qa-gate/SKILL.md

@@ -0,0 +1,79 @@
+---
+name: csharp-qa-gate
+description: Final QA gate for C# changes. Executes the full CSharpier -> .NET Analyzers -> Nullable Analysis -> MSTest toolchain, compares against a captured baseline, enforces zero-regression deltas, and produces the required reporting block before the agent declares the change complete.
+---
+
+# C# QA Gate
+
+Legacy C# variant resource for Codex push-down.
+
+Canonical procedure for the Phase D final quality gate that every C# change must pass before completion is reported.
+
+## When to Use This Skill
+
+Use this skill when:
+
+- `csharp-typed-engineer` is about to declare a change complete.
+- An executor has finished applying a planned batch and must verify zero regressions against the baseline captured in Phase A.
+- A reviewer needs to confirm the toolchain was actually run and produced a clean pass.
+
+## Required Inputs
+
+Before invoking this gate, the agent must have:
+
+- a baseline record produced in Phase A, containing analyzer findings, compiler/nullable diagnostics, MSTest pass/fail status, and per-file coverage status for the in-scope files,
+- the exact list of touched production and test files,
+- a clean working tree (all planned edits committed to the working copy).
+
+## Toolchain Execution Sequence
+
+Run the full toolchain in this exact order. If any step fails or modifies files, fix the issue and restart from step 1. Do not stop the loop until all four steps complete without errors in a single pass.
+
+1. `dotnet tool run csharpier .`
+2. `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`
+3. `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true`
+4. `vstest.console.exe <test-assembly-paths> /EnableCodeCoverage`
+
+If the environment prevents running any tool, stop and report the change as **unverified**. Do not declare completion.
+
+## Delta Requirements (Zero-Regression Hard Gate)
+
+Compare the final results to the Phase A baseline. All of the following must hold:
+
+- **Analyzer delta**: 0 new findings across the repository.
+- **Compiler / nullable delta**: 0 new diagnostics across the repository.
+- **MSTest delta**: 0 new failing tests.
+- **Per-file coverage delta**: coverage for every touched file is greater than or equal to the baseline for that file.
+- **Overall coverage delta** (when the repo enforces it): overall coverage is greater than or equal to the baseline.
+- **New modules, classes, or methods**: coverage >= 90% for each new unit introduced in the batch.
+
+If any delta check fails, the agent must revert or fix immediately and rerun the full toolchain. Do not proceed to reporting until all deltas are clean.
+
+## Required Reporting Block
+
+Every completion response must include the following sections:
+
+1. **Scope** — exact file list touched in this change.
+2. **Baseline** — analyzer, compiler/nullable, MSTest, and coverage status recorded in Phase A.
+3. **Plan** — design and test-strategy summary, referencing the approved plan.
+4. **Diffs** — patch-style or full-file replacements for scoped files only.
+5. **QA Gate Results** — analyzer, compiler/nullable, MSTest, and coverage deltas. If any step could not be run, mark the corresponding line **unverified** and state why.
+
+## Evidence Storage
+
+Persist toolchain output according to `evidence-and-timestamp-conventions`:
+
+- store baseline outputs under `<FEATURE>/evidence/baseline/<timestamp>/`,
+- store post-change outputs under `<FEATURE>/evidence/qa-gates/<timestamp>/`,
+- use ISO-8601 UTC timestamps in folder names.
+
+This location is canonical per evidence-and-timestamp-conventions and is not overridable.
+See `.agents/skills/evidence-and-timestamp-conventions/SKILL.md` for the canonical evidence path authority.
+
+The evidence paths must be referenced in the agent's completion message to satisfy the `SubagentStop` completion-artifact gate.
+
+## Prohibited Shortcuts
+
+- Do not disable, skip, or narrow any step of the toolchain to reach a clean result.
+- Do not add analyzer suppressions, `#pragma warning disable`, `#nullable disable`, or test `[Ignore]` attributes to suppress new findings introduced by the change.
+- Do not report success based on partial or targeted runs alone. Targeted runs are allowed mid-batch, but the final gate requires a full-solution pass.

package/resources/codex-and-agents-customizations/.agents-variants/csharp-legacy/skills/invoke-csharp-engineer/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: invoke-csharp-engineer
+description: Invoke the csharp-typed-engineer worker to design, implement, and verify C# changes within typed repository boundaries. Applies CSharpier -> .NET Analyzers -> Nullable Analysis -> MSTest toolchain, the 1-3 production-file small-path budget, and zero-regression quality gates.
+---
+
+# Implement C# Skill
+
+Legacy C# variant resource for Codex push-down.
+
+This direct-use wrapper delegates C# implementation work to the `csharp-typed-engineer` worker. Use this entry point when a prompt needs a scoped C# change that must stay inside the typed engineer's guardrails.
+
+## When to Use This Skill
+
+Use this skill when:
+
+- The user requests a C# code change, bug fix, refactor, or test addition.
+- Estimated scope fits the small path (1-3 production files plus corresponding tests).
+- The toolchain (CSharpier, .NET Analyzers, Nullable Analysis, MSTest) can be run in the current environment, or the user has explicitly authorized an unverified plan-only response.
+
+If the estimated scope exceeds the small-path budget, this skill defers to the orchestrated flow via `csharp-change-budget-router` instead of proceeding directly.
+
+## Inputs
+
+- Objective statement (what the change must accomplish).
+- Files or entrypoints in scope.
+- Constraints, including public APIs that must be preserved.
+- Optional approved plan. If none is supplied, the worker delegates plan authoring to `atomic_planner` before any edits.
+- Optional budget override in the form `budget: prod=<N>, test=<M>` subject to repo policy compliance.
+
+## Output Paths
+
+- C# source and test files within the approved scope.
+- Baseline evidence under `<FEATURE>/evidence/baseline/<timestamp>/` and post-change evidence under `<FEATURE>/evidence/qa-gates/<timestamp>/` per `evidence-and-timestamp-conventions`.
+- This location is canonical per evidence-and-timestamp-conventions and is not overridable. See `.agents/skills/evidence-and-timestamp-conventions/SKILL.md` for the canonical evidence path authority.
+- Plan artifacts under the active feature folder when the task is feature-scoped.
+
+## Required Reporting Block
+
+The worker must return the following reporting block:
+
+1. Scope (exact file list).
+2. Baseline (CSharpier, .NET Analyzers, Nullable Analysis, MSTest, coverage status).
+3. Plan (design and test strategy).
+4. Diffs (patch-style or full-file replacements).
+5. QA Gate Results (CSharpier, .NET Analyzers, Nullable Analysis, MSTest, and coverage deltas, or clearly marked **unverified**).
+
+## Worker Routing
+
+- Worker: `csharp-typed-engineer`
+
+## Preloaded Contracts
+
+The worker operates under the following preloaded skills and rules:
+
+- `policy-compliance-order`
+- `csharp-change-budget-router`
+- `atomic-plan-contract`
+- `csharp-qa-gate`
+- `acceptance-criteria-tracking`
+- `feature-promotion-lifecycle`
+- `remediation-handoff-atomic-planner`
+- `evidence-and-timestamp-conventions`
+- `.agents/skills/csharp/SKILL.md` (path-scoped for `**/*.cs` and `**/*.csproj`)
+- `AGENTS.md`
+- `AGENTS.md`
+- `AGENTS.md`

package/resources/codex-and-agents-customizations/.codex/config.toml

@@ -84,28 +84,4 @@ command = "pwsh -NoProfile -File .codex/hooks/enforce-orchestration-preimplement
 
 [[hooks.SubagentStop]]
 matcher = "feature-review|feature-reviewer"
-command = "pwsh -NoProfile -File .codex/hooks/validate-feature-review-coverage.ps1"
-
-[permissions.orchestrator-workspace]
-description = "Workspace editing for deterministic orchestration with secret-path deny rules."
-extends = ":workspace"
-
-[permissions.orchestrator-workspace.filesystem]
-glob_scan_max_depth = 4
-
-[permissions.orchestrator-workspace.filesystem.":workspace_roots"]
-"**/.env" = "deny"
-"**/.env.*" = "deny"
-"secrets" = "deny"
-"secrets/**" = "deny"
-
-[permissions.orchestrator-workspace.network]
-enabled = true
-
-[permissions.orchestrator-workspace.network.domains]
-"github.com" = "allow"
-"api.github.com" = "allow"
-"objects.githubusercontent.com" = "allow"
-"registry.npmjs.org" = "allow"
-"pypi.org" = "allow"
-"files.pythonhosted.org" = "allow"
+command = "pwsh -NoProfile -File .codex/hooks/validate-feature-review-coverage.ps1"