@danmoisan/drm-copilot-mcp 1.0.1 → 1.0.8

package/resources/codex-and-agents-customizations/.codex-variants/csharp-legacy/agents/csharp-typed-engineer.toml

@@ -0,0 +1,98 @@
+name = "csharp-typed-engineer"
+description = "Converted subagent"
+variant = "legacy"
+developer_instructions = '''
+Canonical migration source: .github/agents/csharp-typed-engineer.agent.md
+Read the canonical source agent file first and follow it exactly.
+Preserve all mandatory sequencing, artifact, validation, remediation, and completion gates from the source agent.
+If the source agent defines handoffs, preserve those handoffs with the same degree of process gating in Codex.
+Treat .agents/skills, .codex/agents, and .codex/prompts as the Codex runtime surfaces for migrated behavior.
+Do not weaken validation-only preflight loops, QA gates, remediation triggers, review gates, acceptance-criteria tracking, or evidence requirements that exist in the source agent.
+
+Applied rewrites:
+- Rewrite merged standing-guidance source paths to the native AGENTS.md target.
+- Rewrite merged standing-guidance source paths to the native AGENTS.md target.
+- Rewrite merged standing-guidance source paths to the native AGENTS.md target.
+- Rewrite Claude skill paths to shared skill paths.
+- Rewrite Claude rule paths to shared skill paths.
+
+Canonical migration source:
+- .github/agents/csharp-typed-engineer.agent.md
+
+Migration contract:
+- Read the canonical source agent file first and follow it exactly.
+- Preserve all mandatory sequencing, artifact, validation, remediation, and completion gates from the source agent.
+- If the source agent defines handoffs, preserve those handoffs with the same degree of process gating and do not mark a delegated step complete until the delegated output contract and required on-disk artifacts exist.
+- Treat .agents/skills, .codex/agents, and .codex/prompts as the Codex runtime surfaces for migrated behavior, but do not relax any source-agent requirements during that translation.
+- Do not weaken validation-only preflight loops, QA gates, remediation triggers, review gates, acceptance-criteria tracking, or evidence requirements that exist in the source agent.
+
+---
+name: csharp-typed-engineer
+description: Project-scoped worker that implements and verifies C# changes within typed repository boundaries. Applies the CSharpier -> .NET Analyzers -> Nullable Analysis -> MSTest toolchain, the 1-3 production-file small-path budget, and zero-regression quality gates.
+tools:
+  - Read
+  - Grep
+  - Glob
+  - "Bash(msbuild *)"
+  - "Bash(dotnet *)"
+skills:
+  - policy-compliance-order
+  - csharp-change-budget-router
+  - atomic-plan-contract
+  - csharp-qa-gate
+  - acceptance-criteria-tracking
+  - feature-promotion-lifecycle
+  - remediation-handoff-atomic-planner
+  - evidence-and-timestamp-conventions
+memory: project
+---
+
+# CSharp Typed Engineer Agent
+
+Senior C# engineer specialized in small cohesive classes and modules, strong typing under nullable reference types, minimal DI seams, and deterministic MSTest coverage. Implement C# changes within the approved scope, preserve typed boundaries, and verify results with the repository C# toolchain.
+
+## Standing Rules
+
+Language standards and toolchain are defined in `.agents/skills/csharp/SKILL.md` and `AGENTS.md`, auto-loaded for `**/*.cs` and `**/*.csproj` edits. Tonality is defined in `AGENTS.md` and `AGENTS.md`.
+
+## Workflow
+
+Follow the phased workflow defined by the preloaded skills:
+
+1. **Policy compliance** — apply `policy-compliance-order` to load mandatory repo policies before any change.
+2. **Routing and scope** — apply `csharp-change-budget-router` to estimate scope, select direct vs orchestrator handoff mode, and enforce the 3 production + 3 test per-batch cap.
+3. **Plan and baseline** — apply `atomic-plan-contract` for Phase 0 baseline capture and atomic plan structure. Delegate plan authoring to `atomic_planner` when no plan is supplied. Plans must include the proposed class and module structure, minimal DI seams, MSTest scenario-level test strategy, and Moq mock strategy.
+4. **Implement in batches** — apply the approved plan. After each batch, run targeted analyzer and nullable builds on touched projects plus targeted MSTest, and confirm per-file coverage.
+5. **Final QA gate** — apply `csharp-qa-gate` to run the full toolchain, enforce zero-regression deltas against the baseline, and produce the required reporting block before declaring completion.
+6. **Evidence and handoff** — store baseline and post-change evidence per `evidence-and-timestamp-conventions`. Trigger remediation via `remediation-handoff-atomic-planner` when deltas fail.
+
+## Mode Marker Resolution
+
+For feature-scoped work, resolve Work Mode from `issue.md` per `feature-promotion-lifecycle`:
+
+- `- Work Mode: minor-audit`
+- `- Work Mode: full-feature`
+- `- Work Mode: full-bug`
+- legacy `- Work Mode: full` -> interpret as `full-feature`.
+
+If the marker is missing or malformed, fail closed to `full-feature`.
+
+## Stop Conditions
+
+Stop implementation and return to the user when:
+
+- the scope estimate or an in-flight batch would exceed the 3-production-file cap in direct mode,
+- a file is near or would exceed the 500-line limit,
+- any QA gate delta is non-zero after self-correction,
+- the toolchain cannot be executed in the current environment (mark the change **unverified**),
+- orchestrator handoff mode is requested but the required context package is incomplete,
+- policy instructions conflict.
+
+## Evidence Location Invariant
+
+All evidence artifacts this agent produces (baselines, QA gates, regression results, coverage) MUST be written to `<FEATURE>/evidence/<kind>/` as defined in `.agents/skills/evidence-and-timestamp-conventions/SKILL.md`.
+
+Writing to `artifacts/baselines/`, `artifacts/qa/`, `artifacts/coverage/`, or any other non-canonical path is a policy violation and will be caught by the `enforce-evidence-locations.ps1` PreToolUse hook.
+
+If a delegation prompt, plan, or caller instruction specifies a non-canonical evidence path (e.g., `artifacts/baselines/`, `artifacts/qa/`, `artifacts/coverage/`, `artifacts/evidence/`), this agent ignores that instruction, writes to the canonical `<FEATURE>/evidence/<kind>/` path, and records the override as `EVIDENCE_LOCATION_OVERRIDE_REJECTED: <supplied path> replaced with <canonical path>`.
+'''

package/resources/codex-and-agents-customizations/pack-manifests/core.json

@@ -0,0 +1,24 @@
+{
+  "name": "core",
+  "label": "Core (always included)",
+  "paths": [
+    ".agents/README.md",
+    ".agents/skills/README.md",
+    ".agents/skills/acceptance-criteria-tracking/SKILL.md",
+    ".agents/skills/atomic-executor/SKILL.md",
+    ".agents/skills/atomic-plan-contract/SKILL.md",
+    ".agents/skills/atomic-planner/SKILL.md",
+    ".agents/skills/evidence-and-timestamp-conventions/SKILL.md",
+    ".agents/skills/orchestrate/SKILL.md",
+    ".agents/skills/orchestrator-workflow/SKILL.md",
+    ".agents/skills/policy-compliance-order/SKILL.md",
+    ".agents/skills/repo-automation-adapter/SKILL.md",
+    ".agents/skills/repo-automation-adapter/agents/openai.yaml",
+    ".codex/config.toml",
+    ".codex/agents/atomic-executor.toml",
+    ".codex/agents/atomic-planner.toml",
+    ".codex/agents/orchestrator.toml",
+    ".codex/prompts/generate-pr.md",
+    ".codex/prompts/orchestrate-work.md"
+  ]
+}

package/resources/codex-and-agents-customizations/pack-manifests/csharp-legacy.json

@@ -0,0 +1,11 @@
+{
+  "name": "csharp-legacy",
+  "label": "C# (legacy)",
+  "source_prefix": ".agents-variants/csharp-legacy;.codex-variants/csharp-legacy",
+  "paths": [
+    ".agents/skills/csharp/SKILL.md",
+    ".agents/skills/csharp-qa-gate/SKILL.md",
+    ".agents/skills/invoke-csharp-engineer/SKILL.md",
+    ".codex/agents/csharp-typed-engineer.toml"
+  ]
+}

package/resources/codex-and-agents-customizations/pack-manifests/csharp-modern.json

@@ -0,0 +1,10 @@
+{
+  "name": "csharp-modern",
+  "label": "C# (modern)",
+  "paths": [
+    ".agents/skills/csharp/SKILL.md",
+    ".agents/skills/csharp-qa-gate/SKILL.md",
+    ".agents/skills/invoke-csharp-engineer/SKILL.md",
+    ".codex/agents/csharp-typed-engineer.toml"
+  ]
+}

package/resources/codex-and-agents-customizations/pack-manifests/powershell.json

@@ -0,0 +1,15 @@
+{
+  "name": "powershell",
+  "label": "PowerShell",
+  "paths": [
+    ".agents/skills/powershell/SKILL.md",
+    ".agents/skills/powershell-change-budget-router/SKILL.md",
+    ".agents/skills/powershell-orchestration-state-machine/SKILL.md",
+    ".agents/skills/powershell-qa-gate/SKILL.md",
+    ".agents/skills/invoke-powershell-engineer/SKILL.md",
+    ".codex/agents/powershell-typed-engineer.toml",
+    ".codex/agents/powershell-orchestrator.toml",
+    ".codex/agents/powershell-atomic-executor.toml",
+    ".codex/agents/powershell-atomic-planning.toml"
+  ]
+}

package/resources/codex-and-agents-customizations/pack-manifests/python.json

@@ -0,0 +1,15 @@
+{
+  "name": "python",
+  "label": "Python",
+  "paths": [
+    ".agents/skills/python/SKILL.md",
+    ".agents/skills/python-suppressions/SKILL.md",
+    ".agents/skills/python-change-budget-router/SKILL.md",
+    ".agents/skills/python-qa-gate/SKILL.md",
+    ".agents/skills/invoke-python-engineer/SKILL.md",
+    ".codex/agents/python-typed-engineer.toml",
+    ".codex/agents/python-orchestrator.toml",
+    ".codex/agents/python-atomic-executor.toml",
+    ".codex/agents/python-atomic-planning.toml"
+  ]
+}

package/resources/codex-and-agents-customizations/pack-manifests/typescript.json

@@ -0,0 +1,9 @@
+{
+  "name": "typescript",
+  "label": "TypeScript",
+  "paths": [
+    ".agents/skills/typescript/SKILL.md",
+    ".agents/skills/typescript-suppressions/SKILL.md",
+    ".codex/agents/typescript-engineer.toml"
+  ]
+}

package/resources/config/orchestration-routing.json

@@ -71,6 +71,98 @@
         "collect_pr_context",
         "validate_orchestration_artifacts"
       ]
+    },
+    "epic": {
+      "description": "Epic path for scheduling a dependency graph of child features across parallel worktrees with fan-in via a shared integration branch.",
+      "requires_pr_gate": true,
+      "required_agents": [
+        "orchestrator",
+        "pr-author"
+      ],
+      "required_skills": [
+        "epic-orchestrate",
+        "orchestrate",
+        "feature-promotion-lifecycle",
+        "atomic-plan-contract",
+        "acceptance-criteria-tracking",
+        "evidence-and-timestamp-conventions",
+        "pr-context-artifacts",
+        "pr-base-branch-merge-base"
+      ],
+      "required_mcp_tools": [
+        "collect_pr_context",
+        "validate_orchestration_artifacts"
+      ]
+    }
+  },
+  "model_policy": {
+    "description": "Judgment-based complexity-band model selection. This block governs only the delegation model tier. It is not a route input, and route is not an input to model selection.",
+    "tier_order": [
+      "haiku",
+      "sonnet",
+      "opus",
+      "fable"
+    ],
+    "complexity": {
+      "scale": "C1 trivial or mechanical change with no behavior effect. C2 localized feature or bug change confined to a small surface. C3 cross-cutting change that alters an invariant, contract, or behavior across module boundaries. C4 novel, ambiguous, or research-heavy change requiring the most capable tier; C4 is reached only by judgment and is never floor-forced.",
+      "signals": [
+        {
+          "name": "classifier_or_model_logic",
+          "floor": true,
+          "anchor": "Changes to classifier engines, scoring, or model-affecting logic (T1 modules)."
+        },
+        {
+          "name": "auth_or_token_handling",
+          "floor": true,
+          "anchor": "Changes to authentication, token handling, or other security-sensitive paths."
+        },
+        {
+          "name": "concurrency_or_ordering",
+          "floor": true,
+          "anchor": "Introduces or modifies concurrency, ordering, or state-transition invariants."
+        },
+        {
+          "name": "cross_module_contract_change",
+          "floor": true,
+          "anchor": "Alters a public contract or schema consumed across module boundaries."
+        },
+        {
+          "name": "single_file_localized_edit",
+          "floor": false,
+          "anchor": "A localized edit confined to one file with no cross-cutting effect."
+        },
+        {
+          "name": "mechanical_rename_or_move",
+          "floor": false,
+          "anchor": "A mechanical rename, move, or formatting change with no behavior change."
+        },
+        {
+          "name": "docs_or_comment_only",
+          "floor": false,
+          "anchor": "A documentation-only or comment-only change."
+        }
+      ]
+    },
+    "complexity_to_model": {
+      "C1": "haiku",
+      "C2": "sonnet",
+      "C3": "opus",
+      "C4": "fable"
+    },
+    "preferred_overlay": {
+      "description": "Applied only under fable_policy preferred. Changes only the C3 cell to fable, and only for the listed agents. No other agent and no other band is affected.",
+      "agents": [
+        "atomic-planner",
+        "prd-feature",
+        "feature-review",
+        "task-researcher"
+      ],
+      "band": "C3",
+      "model": "fable"
     }
+  },
+  "model_budget": {
+    "description": "Session-level model budget. fable_policy is a three-way switch controlling whether the fable tier is disabled (removed and clamped to opus), available (used as-is), or preferred (applies the preferred_overlay).",
+    "fable_policy": "disabled"
   }
 }

package/resources/customizations/.github/agents/pr-author.agent.md

@@ -137,27 +137,33 @@ Use these sections, in this order:
 
 That’s it. Produce the PR body.
 
-## Authorization Sentinel Protocol (Documentation-Only in This Ecosystem)
+## PR Body and Receipt Protocol (Documentation-Only in This Ecosystem)
 
 When this agent opens or updates a pull request via `gh pr create` or `gh pr edit --body*`, it follows
-the cross-ecosystem authorization sentinel protocol:
-
-1. Run `git rev-parse HEAD` to obtain `head_sha`.
-2. Write `artifacts/pr_author_authorization.json` with exactly: `issued_by` set to `"pr-author"`,
-   `issued_at` as a UTC ISO-8601 timestamp, `head_sha` from step 1, and `ttl_seconds` set to `120`.
-3. Issue the `gh pr create` / `gh pr edit --body-file ...` command immediately, within the 120-second
-   TTL. Pass the PR body via `--body-file`; inline `--body` is not used.
-4. Delete `artifacts/pr_author_authorization.json` after the command completes (success or failure).
+the cross-ecosystem PR body and receipt protocol:
+
+1. Write the PR body text to `artifacts/pr_body_<N>.md`, where `<N>` is the target issue or PR number.
+2. Compute the SHA-256 of the body file bytes and render it as lowercase hexadecimal.
+3. Write the sibling receipt `artifacts/pr_body_<N>.receipt.json` with exactly: `skill` set to
+   `"pr-author"`, `pr_body_path` set to `"artifacts/pr_body_<N>.md"`, `number` set to `<N>`, `sha256`
+   set to the lowercase-hex SHA-256 from step 2, `context_summary_path` set to
+   `"artifacts/pr_context.summary.txt"`, and `created_at` as a UTC ISO-8601 timestamp strictly newer
+   than the last-write time of `artifacts/pr_context.summary.txt`.
+4. Issue the `gh pr create --body-file artifacts/pr_body_<N>.md` (or
+   `gh pr edit --body-file ...`) command. Pass the PR body via `--body-file`; inline `--body` is not
+   used.
 
 After opening or updating the PR, report the resulting PR URL or PR number.
 
 Enforcement in the GitHub Copilot ecosystem is **documentation-only**: the Copilot ecosystem has no
-PreToolUse hook surface, so the sentinel protocol cannot be mechanically enforced here. The protocol
-is documented for consistency with the Claude and Codex ecosystems, where a PreToolUse hook verifies
-the sentinel.
-
-The authorization sentinel is a **policy guardrail, not a cryptographic or security control.** Any
-actor with write access to `artifacts/` can forge `artifacts/pr_author_authorization.json`, because
-all agents share the same filesystem and the runtime exposes no native agent-identity signal at tool
-pre-use time. The mechanism prevents accidental bypass and requires a deliberate, documented act to
-circumvent. It is not tamper-proof and is not a security boundary.
+PreToolUse hook surface, so the receipt protocol cannot be mechanically enforced here. The protocol is
+documented for consistency with the Claude and Codex ecosystems, where a PreToolUse hook verifies the
+receipt in five ordered checks (canonical body-file path, receipt present, number match, SHA-256
+match, and `created_at` newer than the context summary last-write).
+
+The SHA-256 receipt is a **policy-level integrity check, not a cryptographic or security control.** It
+binds the PR body bytes to the receipt. Any actor with write access to `artifacts/` can replace both
+`artifacts/pr_body_<N>.md` and `artifacts/pr_body_<N>.receipt.json` together with a matching SHA-256,
+because all agents share the same filesystem and the runtime exposes no native agent-identity signal
+at tool pre-use time. The mechanism prevents accidental bypass and requires a deliberate, documented
+act to circumvent. It is not tamper-proof and is not a security boundary.

package/resources/powershell/PoshQC/settings/pester.runsettings.psd1

@@ -26,6 +26,9 @@
             '.claude/hooks/check-powershell-test-purity.ps1'
             '.claude/hooks/enforce-python-batch-budget.ps1'
             '.claude/hooks/enforce-powershell-batch-budget.ps1'
+            # Issue #272 hardened this PreToolUse hook with a new orchestrator-state preflight
+            # check; measured here so the change produces real per-file coverage evidence.
+            '.claude/hooks/enforce-pr-author-skill.ps1'
             # Issue #214 added/changed these four release scripts and provided dedicated
             # Pester suites; they are measured here to produce real per-file changed-line
             # coverage rather than relying on behavioral-only evidence.
@@ -33,6 +36,14 @@
             'scripts/dev-tools/Invoke-FullRelease.ps1'
             'scripts/dev-tools/Invoke-MarketplacePublish.ps1'
             'scripts/dev-tools/Invoke-ReleaseTagPush.ps1'
+            # Issue #275 remediation cycle 1 (fix #3): measure the epic-orchestrate hook set and
+            # its dot-sourced sibling module so no production hook is excluded from coverage.
+            '.claude/hooks/enforce-epic-merge-gate.ps1'
+            '.claude/hooks/enforce-epic-wave-barrier.ps1'
+            '.claude/hooks/enforce-epic-worktree-removal-gate.ps1'
+            '.claude/hooks/enforce-pr-author-skill.ps1'
+            '.claude/hooks/validate-orchestrator-output.ps1'
+            '.claude/hooks/enforce-pr-author-skill.epic-base-branch.ps1'
         )
         ExcludedPath          = @(
             '.claude/hooks/validate-feature-review-coverage.ps1' # Feature-review wrapper around repository evidence; not deterministic in normal unit-test execution.

package/resources/codex-and-agents-customizations/.github/workflows/_validate-orchestrator-state.yml

@@ -1,68 +0,0 @@
-name: Validate Orchestrator State
-
-on:
-  workflow_call:
-    inputs:
-      state-path:
-        description: Repository-relative orchestrator checkpoint path.
-        required: false
-        type: string
-        default: artifacts/orchestration/orchestrator-state.json
-      require-checkpoint:
-        description: Fail when the checkpoint file is absent.
-        required: false
-        type: boolean
-        default: true
-  workflow_dispatch:
-    inputs:
-      state-path:
-        description: Repository-relative orchestrator checkpoint path.
-        required: false
-        type: string
-        default: artifacts/orchestration/orchestrator-state.json
-      require-checkpoint:
-        description: Fail when the checkpoint file is absent.
-        required: false
-        type: boolean
-        default: true
-
-jobs:
-  validate-orchestrator-state:
-    name: Validate orchestrator checkpoint
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.13"
-
-      - name: Install Poetry
-        uses: snok/install-poetry@v1
-        with:
-          version: latest
-          virtualenvs-create: true
-          virtualenvs-in-project: true
-
-      - name: Install dependencies
-        run: poetry install --no-interaction
-
-      - name: Validate checkpoint
-        env:
-          STATE_PATH: ${{ inputs.state-path }}
-          REQUIRE_CHECKPOINT: ${{ inputs.require-checkpoint }}
-        run: |
-          if [ ! -f "$STATE_PATH" ]; then
-            if [ "$REQUIRE_CHECKPOINT" = "true" ]; then
-              echo "ERROR: orchestrator checkpoint is required but was not found: $STATE_PATH" >&2
-              exit 1
-            fi
-            echo "No orchestrator checkpoint found at $STATE_PATH; validation skipped."
-            exit 0
-          fi
-
-          poetry run python -m scripts.dev_tools.validate_orchestration_artifacts \
-            orchestrator-state "$STATE_PATH" --require-complete

package/resources/codex-and-agents-customizations/.github/workflows/validate-orchestrator-state.yml

@@ -1,15 +0,0 @@
-name: Orchestrator State Gate
-
-on:
-  pull_request:
-    branches: [main, development]
-  push:
-    branches: [main, development]
-  workflow_dispatch:
-
-jobs:
-  validate-orchestrator-state:
-    uses: ./.github/workflows/_validate-orchestrator-state.yml
-    with:
-      state-path: artifacts/orchestration/orchestrator-state.json
-      require-checkpoint: false