@danmoisan/drm-copilot-mcp 1.0.23 → 1.0.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danmoisan/drm-copilot-mcp",
-  "version": "1.0.23",
+  "version": "1.0.26",
   "description": "Stdio MCP server exposing drm-copilot repo-automation tools.",
   "license": "MIT",
   "type": "commonjs",

package/resources/claude-customizations/.claude/agents/feature-review.md

@@ -109,12 +109,14 @@ Coverage metrics are mandatory for every language that has changed files in the
 
 Coverage thresholds follow the uniform tier rule (Authoritative Decision #2) defined in `.claude/rules/quality-tiers.md`:
 
-- **New code files** (files added in this feature, not previously existing): line coverage >= 85%, branch coverage >= 75%.
-- **Modified files** (files that existed before and were changed): line coverage >= 85%, branch coverage >= 75%, and no regression on changed lines relative to baseline.
-- **Repo-wide per language**: line coverage >= 85%, branch coverage >= 75%.
+- **New code files** (files added in this feature, not previously existing): line coverage >= 85%, branch coverage >= 75% for branch-capable languages.
+- **Modified files** (files that existed before and were changed): line coverage >= 85%, branch coverage >= 75% for branch-capable languages, and no regression on changed lines relative to baseline.
+- **Repo-wide per language**: line coverage >= 85%, branch coverage >= 75% for branch-capable languages.
 
 Tier-specific lower thresholds are not used.
 
+The branch threshold applies only to branch-capable languages — TypeScript, Python, and C#. PowerShell is a coverage language and is fully subject to the line threshold and the no-regression requirement, but Pester measures command (instruction) coverage and line coverage only, so no branch percentage exists to evaluate and no branch threshold applies to it (see `.claude/rules/powershell.md`). Do not record FAIL for an absent PowerShell branch figure.
+
 ### Verification Procedure
 
 For each language that has changed files in the feature branch:

package/resources/claude-customizations/.claude/agents/parallel-orchestrator.md

@@ -187,10 +187,17 @@ Read `cohorts[] { index, generation, item_keys[] }` and schedule from it exactly
 
 Two scheduling rules govern every launch:
 
-1. **Cohort barrier.** Cohort `N+1` branches from `main` only after every cohort-`N` item is
-   `merged` or `worktree_removed`. `current_cohort` increments only on durable confirmation via
-   `git` and `gh` commands, never from in-memory notifications. A blocked item is neither `merged`
-   nor `worktree_removed`, so a blocked item holds the barrier.
+1. **Cohort barrier (per-edge).** An item may start only when every conflicting neighbour
+   (`conflict_edges[]`) that sits in a strictly prior current-generation cohort has `merge_status`
+   of `merged` or `worktree_removed`. `ci_green` does not satisfy the barrier. Same-cohort and
+   later-cohort neighbours do not hold an item back, and an item with no conflicting prior-cohort
+   neighbour may start regardless of other cohorts' progress. Evaluate the predicate only against
+   durable state confirmed by `git` and `gh` commands, never from in-memory notifications. A
+   blocked item is neither `merged` nor `worktree_removed`, so it holds only its own conflicting
+   later-cohort neighbours and, transitively, the tail of its own conflict component; unrelated
+   lanes keep advancing. `current_cohort` is a PROGRESS INDICATOR — the lowest current-generation
+   cohort index still holding a non-terminal, non-withdrawn item, updated only on the same durable
+   confirmation — and gates nothing.
 2. **`max_concurrency` slot filling.** `max_concurrency` caps the number of simultaneously in-flight
    items independently of cohort size. Fill slots in ascending item-key (`issue_num`) order, and
    refill each freed slot with the next unstarted item of the current cohort in the same ascending

package/resources/claude-customizations/.claude/agents/parallel-planner.md

@@ -1,7 +1,7 @@
 ---
 name: parallel-planner
 model: opus
-description: Planning half of the parallel orchestration surface. It performs item intake over issue numbers and potential-entry paths, drives per-item preparation (promotion, research, spec/user-story, atomic plan, preflight clearance) through concurrent preparation-mode Agent(orchestrator) delegations, computes and validates each item's blast radius, seeds the generation-0 cohort table, writes the parallel run manifest and the planner checkpoint, and emits the parallel-orchestrator kickoff prompt artifact. Performs no atomic execution, PR authoring, or CI monitoring.
+description: Planning half of the parallel orchestration surface. It performs item intake over issue numbers and potential-entry paths, drives per-item preparation (promotion, research, spec/user-story, atomic plan, preflight clearance) through preparation-mode Agent(orchestrator) delegations launched in bounded waves of at most max_concurrency, computes and validates each item's blast radius, seeds the generation-0 cohort table, writes the parallel run manifest and the planner checkpoint, and emits the parallel-orchestrator kickoff prompt artifact. Performs no atomic execution, PR authoring, or CI monitoring.
 tools:
   - "Agent(orchestrator)"
   - Read
@@ -90,7 +90,10 @@ On every invocation:
 ## Delegation Model
 
 You delegate exclusively through `Agent(orchestrator)`, one delegation per item, each carrying the
-preparation-mode kickoff line defined in the `parallel-plan` skill. Each child `orchestrator` runs
+preparation-mode kickoff line defined in the `parallel-plan` skill. Delegations are launched in
+BOUNDED WAVES of at most `max_concurrency`, computed with
+`bash .claude/lib/bash/compute-concurrency-batches.sh`, with wave *k+1* launched only after every
+child of wave *k* has terminated. Never launch every item's preparation at once. Each child `orchestrator` runs
 promotion, research, feature documents, atomic planning, and preflight clearance under
 `route_id: preparation`, commits and pushes its own branch, then stops before any execution. You do
 not delegate directly to `atomic-planner`, `atomic-executor`, `task-researcher`, or `prd-feature`;

package/resources/claude-customizations/.claude/hooks/enforce-discovery-artifact-gate.ps1

@@ -25,8 +25,10 @@
     interprets the CLI's exit code and captured output.
 
 .NOTES
-    Compatible with PowerShell 7+. Read-only validation gate; the validator
-    subprocess is the only external process invoked.
+    Requires PowerShell 7.4+ (the shared validation module uses
+    `Test-Json -SchemaFile` Draft 2020-12 support). Read-only validation gate that
+    invokes NO external process: validation runs in-process through
+    `.claude/lib/discovery-validation/DiscoveryValidation.psm1` (issue #475).
 #>
 [CmdletBinding()]
 param()
@@ -34,11 +36,23 @@ param()
 function Invoke-DiscoveryValidatorExe {
     <#
     .SYNOPSIS
-        Wrapper around the discovery-artifact validator CLI. Mockable seam.
+        Wrapper around the discovery-artifact validator. Mockable seam.
     .DESCRIPTION
-        Invokes `python -m scripts.dev_tools.validate_discovery_artifacts` with
-        the supplied arguments and captures both stdout and stderr. Tests mock
-        this function directly; production code must never mock `python`.
+        Delegates to the portable PowerShell implementation in
+        `.claude/lib/discovery-validation/DiscoveryValidation.psm1`, keeping this
+        function's name, its `-ValidatorArgs <string[]>` parameter, and its
+        `@{ ExitCode; Output }` return shape unchanged so existing mocks and
+        `Should -Invoke` assertions continue to bind.
+
+        This no longer invokes a Python interpreter (issue #475). The `.claude/**`
+        payload ships to destinations with no guaranteed Python, Poetry, or
+        `scripts/dev_tools`, where the previous `python -m ...` call failed
+        obscurely or blocked every operation.
+
+        Success is SILENT by contract: a passing validation returns `ExitCode = 0`
+        with an EMPTY `Output`. The caller denies on a non-zero exit code OR on
+        non-empty output, so any success chatter here would deny a passing
+        validation (defect D-2).
     #>
     [CmdletBinding()]
     [OutputType([hashtable])]
@@ -47,8 +61,14 @@ function Invoke-DiscoveryValidatorExe {
         [string[]] $ValidatorArgs
     )
 
-    $output = & python -m scripts.dev_tools.validate_discovery_artifacts @ValidatorArgs 2>&1
-    return @{ ExitCode = $LASTEXITCODE; Output = ($output | Out-String).Trim() }
+    $modulePath = Join-Path -Path $PSScriptRoot `
+        -ChildPath '../lib/discovery-validation/DiscoveryValidation.psm1'
+    if (-not (Test-Path -LiteralPath $modulePath -PathType Leaf)) {
+        return @{ ExitCode = 1; Output = "Discovery-validation module not found: $modulePath" }
+    }
+
+    Import-Module -Name $modulePath -Force -ErrorAction Stop
+    return Invoke-DiscoveryArtifactValidation -ValidatorArgs $ValidatorArgs
 }
 
 function Get-DiscoveryArtifactType {

package/resources/claude-customizations/.claude/hooks/validate-discovery-artifact-gate.ps1

@@ -28,8 +28,10 @@
     captured output.
 
 .NOTES
-    Compatible with PowerShell 7+. Read-only validation gate; the validator
-    subprocess is the only external process invoked.
+    Requires PowerShell 7.4+ (the shared validation module uses
+    `Test-Json -SchemaFile` Draft 2020-12 support). Read-only validation gate that
+    invokes NO external process: validation runs in-process through
+    `.claude/lib/discovery-validation/DiscoveryValidation.psm1` (issue #475).
 #>
 [CmdletBinding()]
 param()
@@ -37,11 +39,23 @@ param()
 function Invoke-DiscoveryValidatorExe {
     <#
     .SYNOPSIS
-        Wrapper around the discovery-artifact validator CLI. Mockable seam.
+        Wrapper around the discovery-artifact validator. Mockable seam.
     .DESCRIPTION
-        Invokes `python -m scripts.dev_tools.validate_discovery_artifacts` with
-        the supplied arguments and captures both stdout and stderr. Tests mock
-        this function directly; production code must never mock `python`.
+        Delegates to the portable PowerShell implementation in
+        `.claude/lib/discovery-validation/DiscoveryValidation.psm1`, keeping this
+        function's name, its `-ValidatorArgs <string[]>` parameter, and its
+        `@{ ExitCode; Output }` return shape unchanged so existing mocks and
+        `Should -Invoke` assertions continue to bind.
+
+        This no longer invokes a Python interpreter (issue #475). The `.claude/**`
+        payload ships to destinations with no guaranteed Python, Poetry, or
+        `scripts/dev_tools`, where the previous `python -m ...` call failed
+        obscurely or blocked every operation.
+
+        Success is SILENT by contract: a passing validation returns `ExitCode = 0`
+        with an EMPTY `Output`. The caller denies on a non-zero exit code OR on
+        non-empty output, so any success chatter here would deny a passing
+        validation (defect D-2).
     #>
     [CmdletBinding()]
     [OutputType([hashtable])]
@@ -50,8 +64,14 @@ function Invoke-DiscoveryValidatorExe {
         [string[]] $ValidatorArgs
     )
 
-    $output = & python -m scripts.dev_tools.validate_discovery_artifacts @ValidatorArgs 2>&1
-    return @{ ExitCode = $LASTEXITCODE; Output = ($output | Out-String).Trim() }
+    $modulePath = Join-Path -Path $PSScriptRoot `
+        -ChildPath '../lib/discovery-validation/DiscoveryValidation.psm1'
+    if (-not (Test-Path -LiteralPath $modulePath -PathType Leaf)) {
+        return @{ ExitCode = 1; Output = "Discovery-validation module not found: $modulePath" }
+    }
+
+    Import-Module -Name $modulePath -Force -ErrorAction Stop
+    return Invoke-DiscoveryArtifactValidation -ValidatorArgs $ValidatorArgs
 }
 
 function Get-DiscoveryArtifactType {

package/resources/claude-customizations/.claude/hooks/validate-orchestrator-output.ps1

@@ -149,31 +149,94 @@ function Test-HumanInteractionShape {
     return @{ Ok = $true; Message = $null }
 }
 
+function Test-OrchestratorCheckpointStructure {
+    <#
+    .SYNOPSIS
+        Type-scoped structural check for the epic and parallel checkpoint types.
+    .DESCRIPTION
+        PD-3 implementation. The Python reference exposes no validation surface for
+        `epic-orchestrator-state` or `parallel-orchestrator-state` under this hook's
+        flag pair: argparse rejects the pair and exits 2 without running a single
+        check, so parity is UNDEFINED in this region. Rather than inherit an
+        undefined behavior, this hook defines it: the checkpoint must exist, parse
+        as JSON, and have an object root. That is the largest assertion that holds
+        for every checkpoint type without importing a schema this hook does not own.
+
+        Deliberately NOT applied here:
+          - the standard-checkpoint REQUIRED_STATE_KEYS presence block, whose key
+            set belongs to the standard checkpoint and would produce false
+            ROUTING_CONTRACT_BLOCKED verdicts against a well-formed epic or
+            parallel checkpoint (defect D-1),
+          - the model-routing gate, whose receipts live on the standard checkpoint.
+
+        The check fails closed: a missing file, unreadable content, invalid JSON, or
+        a non-object root all yield ExitCode 1 with the load error as Output.
+    .PARAMETER CheckpointPath
+        The path to the checkpoint JSON file.
+    .OUTPUTS
+        System.Collections.Hashtable with keys ExitCode (int, 0 or 1) and Output (string).
+    #>
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string] $CheckpointPath
+    )
+
+    # Get-OrchestratorStateCheckpoint already implements exactly the three
+    # structural conditions (exists, parses, object root) and reports each as a
+    # fail-closed Error string, so the structural leg reuses it rather than
+    # duplicating the load contract.
+    $loaded = Get-OrchestratorStateCheckpoint -CheckpointPath $CheckpointPath
+    if (-not $loaded.Ok) {
+        return @{ ExitCode = 1; Output = $loaded.Error }
+    }
+
+    return @{ ExitCode = 0; Output = '' }
+}
+
 function Invoke-RoutingContractValidation {
     <#
     .SYNOPSIS
-        Runs the authoritative Python routing-contract validator against the
-        on-disk checkpoint and reports whether it emitted errors.
+        Runs the portable routing-contract validation against the on-disk
+        checkpoint and reports whether it emitted errors.
     .DESCRIPTION
-        Invokes the validator through an injectable subprocess scriptblock seam.
-        The default Invoker runs the authoritative Python CLI:
-          python -m scripts.dev_tools.validate_orchestration_artifacts \
-              <ArtifactType> <CheckpointPath> --require-complete
-        Tests inject a mock scriptblock so no Python process runs. The function
-        does not reimplement routing logic; it delegates to the Python validator.
-        ArtifactType defaults to 'orchestrator-state' so the default invocation
-        string is unchanged for every existing caller of this hook.
+        Invokes the validation through an injectable scriptblock seam. As of issue
+        #475 the default Invoker names no interpreter and starts no subprocess: the
+        portable PowerShell path is the ONLY path, so the hook behaves identically
+        in this repository and in every destination that received only the
+        pushed-down `.claude` pack. The former capability-detection probe and the
+        interpreter-subprocess leg it guarded are both gone.
+
+        The default Invoker dispatches on ArtifactType:
+
+          orchestrator-state
+              the COMPLETE-PARITY completion validation
+              (Test-OrchestratorStateCompletionReadiness), a row-by-row port of the
+              Python call surface `--require-complete --require-model-routing`.
+
+          epic-orchestrator-state, parallel-orchestrator-state
+              the type-scoped structural check
+              (Test-OrchestratorCheckpointStructure): exists, parses as JSON,
+              object root. PD-3: this is DEFINED behavior in a region where Python
+              parity is UNDEFINED (argparse exit 2, zero checks run). It is a
+              design decision, not a deferral. The standard-checkpoint
+              REQUIRED_STATE_KEYS block and the model-routing gate are deliberately
+              not applied, which is the D-1 fix.
+
+          anything else
+              fail closed, naming the unsupported type. An unrecognized type must
+              never read as a clean pass.
+
+        ArtifactType defaults to 'orchestrator-state' so every existing caller of
+        this hook keeps its current behavior.
 
         Returns a hashtable with keys:
-          - HasErrors:  $true only when the validator reported a non-zero exit
+          - HasErrors:  $true only when the validation reported a non-zero exit
                         code; $false when it exited 0. The exit code is the sole
-                        discriminator, because the validator prints its success
-                        line to stdout on a clean pass and the default Invoker
-                        captures with 2>&1, so output text is present on success.
-          - ErrorText:  the validator's combined captured output text, carried
-                        through unchanged: the error lines on a failure, and the
-                        success line (Python CLI) or empty (portable fallback)
-                        on a clean pass.
+                        discriminator.
+          - ErrorText:  the validation's output text, carried through unchanged:
+                        the error lines on a failure, empty on a clean pass.
     #>
     [CmdletBinding()]
     [OutputType([hashtable])]
@@ -187,29 +250,36 @@ function Invoke-RoutingContractValidation {
         [Parameter(Mandatory = $false)]
         [scriptblock] $Invoker = {
             param($Path, $Type)
-            # Capability detection: use the authoritative Python CLI when
-            # scripts.dev_tools is importable (drm-copilot); otherwise fall back to
-            # the portable PowerShell completion module that travels with the
-            # pushed-down pack. The portable path performs the presence-level
-            # required-once-delegated existence gate and still fails closed.
-            if (Test-PythonOrchestratorValidatorAvailable) {
-                $output = & python -m scripts.dev_tools.validate_orchestration_artifacts `
-                    $Type $Path --require-complete --require-model-routing 2>&1
-                [pscustomobject]@{
-                    ExitCode = $LASTEXITCODE
-                    Output   = ($output | Out-String)
+            switch ($Type) {
+                'orchestrator-state' {
+                    # Import the portable completion module only when its function is not
+                    # already available, so a repeated call (or a test that pre-imports and
+                    # mocks the function) does not reload the module and reset the seam.
+                    if (-not (Get-Command -Name Test-OrchestratorStateCompletionReadiness -ErrorAction SilentlyContinue)) {
+                        Import-Module (Join-Path $PSScriptRoot '../lib/orchestrator-state/OrchestratorStateCompletion.psm1') -Force
+                    }
+                    $portable = Test-OrchestratorStateCompletionReadiness -CheckpointPath $Path
+                    [pscustomobject]@{
+                        ExitCode = $portable.ExitCode
+                        Output   = $portable.Output
+                    }
                 }
-            } else {
-                # Import the portable completion module only when its function is not
-                # already available, so a repeated call (or a test that pre-imports and
-                # mocks the function) does not reload the module and reset the seam.
-                if (-not (Get-Command -Name Test-OrchestratorStateCompletionReadiness -ErrorAction SilentlyContinue)) {
-                    Import-Module (Join-Path $PSScriptRoot '../lib/orchestrator-state/OrchestratorStateCompletion.psm1') -Force
+                { $_ -in @('epic-orchestrator-state', 'parallel-orchestrator-state') } {
+                    # PD-3: defined fail-closed structural behavior in an
+                    # undefined-parity region. See Test-OrchestratorCheckpointStructure.
+                    $structural = Test-OrchestratorCheckpointStructure -CheckpointPath $Path
+                    [pscustomobject]@{
+                        ExitCode = $structural.ExitCode
+                        Output   = $structural.Output
+                    }
                 }
-                $portable = Test-OrchestratorStateCompletionReadiness -CheckpointPath $Path
-                [pscustomobject]@{
-                    ExitCode = $portable.ExitCode
-                    Output   = $portable.Output
+                default {
+                    # Fail closed on an unwired type: an unrecognized artifact type is
+                    # not a clean pass.
+                    [pscustomobject]@{
+                        ExitCode = 1
+                        Output   = "orchestrator hook: unsupported artifact type '$Type'; no validation surface is wired for it. Supported types: orchestrator-state, epic-orchestrator-state, parallel-orchestrator-state."
+                    }
                 }
             }
         }
@@ -225,10 +295,10 @@ function Invoke-RoutingContractValidation {
         $outputText = ([string]$result.Output).Trim()
     }
 
-    # The exit code is the complete failure discriminator: the validator prints every
-    # error to stderr and returns non-zero, and prints its success line to stdout and
-    # returns 0. Because the default invoker captures with 2>&1, the success line lands
-    # in $outputText on a clean pass, so output text must not influence this decision.
+    # The exit code is the complete failure discriminator: every dispatch leg
+    # returns a non-zero ExitCode with its error text on failure and ExitCode 0
+    # with empty Output on a clean pass, so output text must not influence this
+    # decision.
     $hasErrors = ($exitCode -ne 0)
     return @{ HasErrors = $hasErrors; ErrorText = $outputText }
 }
@@ -313,9 +383,10 @@ function Invoke-OrchestratorOutputValidation {
         return @{ Ok = $false; Message = $hiResult.Message }
     }
 
-    # Delegate to the authoritative Python routing-contract validator. The
-    # optional RoutingInvoker seam lets tests inject a mock; the default seam
-    # produces the real subprocess call.
+    # Delegate to the portable routing-contract validation, dispatched on
+    # ArtifactType. The optional RoutingInvoker seam lets tests inject a mock; the
+    # default seam runs the in-process PowerShell validation and starts no
+    # subprocess.
     $routingArgs = @{ CheckpointPath = $CheckpointPath; ArtifactType = $ArtifactType }
     if ($PSBoundParameters.ContainsKey('RoutingInvoker') -and $null -ne $RoutingInvoker) {
         $routingArgs['Invoker'] = $RoutingInvoker

package/resources/claude-customizations/.claude/lib/bash/parallel-manifest-validate.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # parallel-manifest-validate.sh: sourceable bash port of
 # scripts/dev_tools/parallel_manifest_contract.py. Validates a parallel-run
-# manifest document against invariants M1 through M7 and exposes the two
+# manifest document against invariants M1 through M8 and exposes the two
 # default-resolving accessors that every consumer uses instead of reading
 # `mode` and `max_concurrency` directly.
 #
@@ -9,7 +9,8 @@
 # frontmatter checks short-circuit with a single error; then run identity
 # (M2 parallel, M3 mode, M4 max_concurrency, M5 created_at) in schema field
 # order; then the M7 prohibited-key scan, deep results in document order
-# followed by the top-level results; then the M6 items collection.
+# followed by the top-level results; then the M6 items collection; then the
+# key-gated M8 expected_conflict_components assertion.
 #
 # Every error string begins with the literal prefix `Parallel manifest` and
 # ends with a period. The Python module remains the repository authority.
@@ -43,7 +44,7 @@ PM_DEFAULT_MAX_CONCURRENCY=4
 
 # Inclusive bounds on a present `max_concurrency` (invariant M4, A7).
 PM_MIN_CONCURRENCY=1
-PM_MAX_CONCURRENCY=8
+PM_MAX_CONCURRENCY=32
 
 # Keys the manifest rejects at any nesting level (invariant M7).
 PM_DEEP_PROHIBITED_KEYS="depends_on"
@@ -54,6 +55,11 @@ PM_TOP_LEVEL_PROHIBITED_KEYS="integration_branch"
 # Detail recorded when the parser refuses an out-of-subset construct.
 PM_SUBSET_DETAIL=""
 
+# Issue numbers already claimed by an earlier expected_conflict_components
+# entry (invariant M8). Threaded across components so cross-component duplicate
+# membership is decided in one pass; reset by pm_validate_text.
+PM_CLAIMED=""
+
 pm_parse_manifest() {
 	# Parse manifest text into the shared node table (invariant M1).
 	#
@@ -128,6 +134,108 @@ pm_validate_identity() {
 	fi
 }
 
+pm_declared_issue_nums() {
+	# Echo the space-separated issue_num values the items collection declares.
+	#
+	# Supplies the resolution target for invariant M8 without re-running the M6
+	# item validation: a malformed entry is reported once by M6 and simply
+	# contributes no resolvable key here.
+	local declared="" count index entry_path issue_type issue_value
+	[[ $(yp_type_of "items") == seq ]] || return 0
+	count=$(yp_count_of "items")
+	# Accept only entries whose primary key is already well formed; admitting a
+	# malformed one would produce a second, confusing M8 error for one defect.
+	for ((index = 0; index < count; index++)); do
+		entry_path="items[${index}]"
+		[[ $(yp_type_of "$entry_path") == map ]] || continue
+		issue_type=$(yp_type_of "${entry_path}.issue_num")
+		issue_value=$(yp_value_of "${entry_path}.issue_num")
+		pc_is_positive_integer "$issue_type" "$issue_value" || continue
+		declared="$declared $issue_value"
+	done
+	printf '%s' "$declared"
+}
+
+pm_validate_component_members() {
+	# Validate one component's members list against invariant M8.
+	#
+	# Args: $1 = node path of the members list, $2 = component-scoped context
+	# prefix, $3 = space-separated declared issue_num values. Appends every
+	# accepted key to PM_CLAIMED so the caller's running set enforces the
+	# no-duplicate-membership rule across components.
+	local path="$1" ctx="$2" declared="$3"
+	local members_type count=0 index slot entry_path member_type member_value
+	members_type=$(yp_type_of "$path")
+	if [[ $members_type == seq ]]; then
+		count=$(yp_count_of "$path")
+	fi
+	# A missing key, a scalar, and an empty list are one violation: the
+	# component asserts no membership and therefore carries no information.
+	if [[ $members_type != seq ]] || ((count == 0)); then
+		pc_error_add "$ctx members must be a non-empty list of positive integers."
+		return 0
+	fi
+
+	# Three successive gates per member; the first failure ends that member's
+	# checks, because an unusable value cannot be resolved and an unresolved key
+	# cannot meaningfully duplicate another.
+	for ((index = 0; index < count; index++)); do
+		entry_path="${path}[${index}]"
+		slot="$ctx members[${index}]"
+		member_type=$(yp_type_of "$entry_path")
+		member_value=$(yp_value_of "$entry_path")
+		if ! pc_is_positive_integer "$member_type" "$member_value"; then
+			pc_error_add "$slot must be a positive integer; found: $(pi_repr_at "$entry_path")."
+			continue
+		fi
+		if ! pc_contains_word "$declared" "$member_value"; then
+			pc_error_add "$slot does not resolve to an items[] issue_num; found: $member_value."
+			continue
+		fi
+		if pc_contains_word "$PM_CLAIMED" "$member_value"; then
+			pc_error_add "$slot repeats issue_num $member_value, already claimed by an earlier component."
+			continue
+		fi
+		PM_CLAIMED="$PM_CLAIMED $member_value"
+	done
+}
+
+pm_validate_expected_components() {
+	# Validate the optional expected_conflict_components key (invariant M8).
+	#
+	# Key gated: absence is the overwhelmingly common shape and must cost the
+	# caller nothing, so the whole invariant is skipped rather than defaulted
+	# and a pre-M8 manifest's error list is unchanged.
+	local root="expected_conflict_components"
+	yp_has "$root" || return 0
+	if [[ $(yp_type_of "$root") != seq ]]; then
+		pc_error_add "$PM_CONTEXT $root must be a list."
+		return 0
+	fi
+
+	local declared total position comp_path ctx name_type name_value
+	declared=$(pm_declared_issue_nums)
+	total=$(yp_count_of "$root")
+	for ((position = 0; position < total; position++)); do
+		comp_path="${root}[${position}]"
+		ctx="$PM_CONTEXT ${root}[${position}]"
+		if [[ $(yp_type_of "$comp_path") != map ]]; then
+			pc_error_add "$ctx must be an object."
+			continue
+		fi
+		# Field order follows the documented authoring order: the optional
+		# diagnostic label first, then the required membership list.
+		if yp_has "${comp_path}.name"; then
+			name_type=$(yp_type_of "${comp_path}.name")
+			name_value=$(yp_value_of "${comp_path}.name")
+			if ! pc_is_non_empty_string "$name_type" "$name_value"; then
+				pc_error_add "$ctx name must be a non-empty string."
+			fi
+		fi
+		pm_validate_component_members "${comp_path}.members" "$ctx" "$declared"
+	done
+}
+
 pm_validate_text() {
 	# Validate a manifest document against invariants M1 to M7.
 	#
@@ -139,6 +247,7 @@ pm_validate_text() {
 	local text="$1" parse_status=0
 	pc_errors_reset
 	PM_SUBSET_DETAIL=""
+	PM_CLAIMED=""
 	pm_parse_manifest "$text" || parse_status=$?
 	# An out-of-subset refusal propagates so the caller can distinguish it from
 	# a validation verdict; an M1 failure returns the single-element error list
@@ -156,6 +265,9 @@ pm_validate_text() {
 	# The manifest carries `kind` on every item, unlike the orchestrator
 	# checkpoint, so the shared item validator is asked to require it (S1).
 	pi_validate_items "items" "$PM_CONTEXT" 1
+	# M8 runs last because its membership check resolves against the same items
+	# collection the previous call validated.
+	pm_validate_expected_components
 	return 0
 }