@danmoisan/drm-copilot-mcp 1.0.24 → 1.0.27

package/out/mcp-server.js

@@ -6904,12 +6904,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs9, exportName) {
+    function addFormats(ajv, list, fs10, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs9[f]);
+        ajv.addFormat(f, fs10[f]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -6932,7 +6932,7 @@ __export(mcp_server_exports, {
   main: () => main
 });
 module.exports = __toCommonJS(mcp_server_exports);
-var fs8 = __toESM(require("node:fs"));
+var fs9 = __toESM(require("node:fs"));
 var path10 = __toESM(require("node:path"));
 
 // node_modules/zod/v4/core/core.js
@@ -17260,7 +17260,8 @@ function toMcpToolResult(result) {
     ...result.assetId === void 0 ? {} : { asset_id: result.assetId },
     ...result.bundledSourcePath === void 0 ? {} : { bundled_source_path: result.bundledSourcePath },
     ...result.destinationPath === void 0 ? {} : { destination_path: result.destinationPath },
-    ...result.renderedTree === void 0 ? {} : { rendered_tree: result.renderedTree }
+    ...result.renderedTree === void 0 ? {} : { rendered_tree: result.renderedTree },
+    ...result.warnings === void 0 ? {} : { warnings: result.warnings }
   };
 }
 function toFailureToolResult(tool, workspaceRoot, error2) {
@@ -17907,11 +17908,11 @@ function relativeToPosix(path11, root) {
   }
   return null;
 }
-function enumerateSourceFiles(fs9, sourceRoot, rootFolders) {
+function enumerateSourceFiles(fs10, sourceRoot, rootFolders) {
   const orderedFiles = [];
   for (const root of rootFolders) {
     const rootPath = joinPosix2(sourceRoot, root);
-    const rootFiles = fs9.listFiles(rootPath);
+    const rootFiles = fs10.listFiles(rootPath);
     const sorted = [...rootFiles].sort((left, right) => {
       const leftRel = relativeToPosix(left, rootPath) ?? left;
       const rightRel = relativeToPosix(right, rootPath) ?? right;
@@ -17921,8 +17922,8 @@ function enumerateSourceFiles(fs9, sourceRoot, rootFolders) {
   }
   return orderedFiles;
 }
-function validateDestination(destinationRoot, repoRoot, fs9) {
-  if (!fs9.isDir(destinationRoot)) {
+function validateDestination(destinationRoot, repoRoot, fs10) {
+  if (!fs10.isDir(destinationRoot)) {
     throw new Error(
       `Invalid destination: destination directory does not exist: ${destinationRoot}`
     );
@@ -17985,22 +17986,22 @@ function stringifySorted(value, indent) {
   };
   return JSON.stringify(sortKeys(value), null, indent);
 }
-function writeSummaryArtifact(fs9, summary, artifactRoot, artifactDirectory) {
+function writeSummaryArtifact(fs10, summary, artifactRoot, artifactDirectory) {
   const artifactPath = buildArtifactPath(
     summary.startedAt,
     artifactRoot,
     artifactDirectory
   );
   const parent = artifactPath.slice(0, artifactPath.lastIndexOf("/"));
-  fs9.ensureDir(parent);
-  fs9.writeTextFile(artifactPath, renderPushDownSummary(summary));
+  fs10.ensureDir(parent);
+  fs10.writeTextFile(artifactPath, renderPushDownSummary(summary));
   return artifactPath;
 }
 function pushDownCustomizations(options) {
   const {
     repoRoot,
     destinationRoot,
-    fs: fs9,
+    fs: fs10,
     sourceRoot,
     artifactRoot,
     rootFolders,
@@ -18014,7 +18015,7 @@ function pushDownCustomizations(options) {
   const effectiveArtifactDir = artifactDirectory ?? ARTIFACT_DIRECTORY;
   const rewrite = rewriteReferences ?? rewriteTextReferences;
   const now = clock ?? (() => /* @__PURE__ */ new Date());
-  validateDestination(destinationRoot, repoRoot, fs9);
+  validateDestination(destinationRoot, repoRoot, fs10);
   const startedAt = now();
   let createdCount = 0;
   let overwrittenCount = 0;
@@ -18023,7 +18024,7 @@ function pushDownCustomizations(options) {
   const unmatchedReferences = [];
   const fileResults = [];
   for (const sourcePath of enumerateSourceFiles(
-    fs9,
+    fs10,
     effectiveSource,
     effectiveRoots
   )) {
@@ -18032,7 +18033,7 @@ function pushDownCustomizations(options) {
       continue;
     }
     const destinationPath = joinPosix2(destinationRoot, relativePath2);
-    const destinationStatus = fs9.isFile(
+    const destinationStatus = fs10.isFile(
       destinationPath
     ) ? "overwritten" : "created";
     if (destinationStatus === "created") {
@@ -18040,7 +18041,7 @@ function pushDownCustomizations(options) {
     } else {
       overwrittenCount += 1;
     }
-    const sourceText = fs9.readTextFile(sourcePath);
+    const sourceText = fs10.readTextFile(sourcePath);
     const [rewrittenText, rewrittenDelta, placeholderDelta, unmatched] = rewrite(sourceText);
     rewrittenReferenceCount += rewrittenDelta;
     placeholderRewriteCount += placeholderDelta;
@@ -18053,8 +18054,8 @@ function pushDownCustomizations(options) {
       0,
       destinationPath.lastIndexOf("/")
     );
-    fs9.ensureDir(destParent);
-    fs9.writeTextFile(destinationPath, rewrittenText);
+    fs10.ensureDir(destParent);
+    fs10.writeTextFile(destinationPath, rewrittenText);
     fileResults.push({
       relativePath: relativePath2,
       destinationStatus,
@@ -18078,7 +18079,7 @@ function pushDownCustomizations(options) {
     artifactPath: ""
   };
   const artifactPath = writeSummaryArtifact(
-    fs9,
+    fs10,
     provisionalSummary,
     effectiveArtifact,
     effectiveArtifactDir
@@ -18142,7 +18143,7 @@ function joinPosix3(dir, name) {
   const normalizedDir = dir.replace(/\\/g, "/").replace(/\/+$/, "");
   return normalizedDir === "" ? name : `${normalizedDir}/${name}`;
 }
-function loadPackManifests(manifestDir, selectedPackNames, fs9) {
+function loadPackManifests(manifestDir, selectedPackNames, fs10) {
   const unknown2 = [...selectedPackNames].filter(
     (name) => !MANIFEST_PACK_NAMES.has(name)
   );
@@ -18154,14 +18155,14 @@ function loadPackManifests(manifestDir, selectedPackNames, fs9) {
   const manifests = /* @__PURE__ */ new Map();
   for (const name of [...namesToLoad].sort()) {
     const manifestPath = joinPosix3(manifestDir, `${name}.json`);
-    if (!fs9.isFile(manifestPath)) {
+    if (!fs10.isFile(manifestPath)) {
       throw new ManifestError(
         `Codex pack manifest is missing for pack '${name}': ${manifestPath}`
       );
     }
     manifests.set(
       name,
-      parseManifest(name, manifestPath, fs9.readTextFile(manifestPath))
+      parseManifest(name, manifestPath, fs10.readTextFile(manifestPath))
     );
   }
   return manifests;
@@ -18418,7 +18419,7 @@ var RoutingConfigFileSystem = class {
     this.inner.ensureDir(path11);
   }
 };
-function resolvePublishedPaths(packs, csharpVariant, bundleRoot, fs9) {
+function resolvePublishedPaths(packs, csharpVariant, bundleRoot, fs10) {
   const manifestPacks = resolveManifestPackNames(packs ?? null, csharpVariant);
   if (manifestPacks === null || manifestPacks.size === 0) {
     return null;
@@ -18426,7 +18427,7 @@ function resolvePublishedPaths(packs, csharpVariant, bundleRoot, fs9) {
   const manifests = loadPackManifests(
     joinPosix4(bundleRoot, PACK_MANIFEST_SUBDIR),
     manifestPacks,
-    fs9
+    fs10
   );
   const published = computePublishedPaths(manifestPacks, manifests) ?? /* @__PURE__ */ new Set();
   assertSingleCsharpToolchain(published, manifestPacks);
@@ -18531,18 +18532,18 @@ function joinPosix5(dir, name) {
   const normalizedDir = dir.replace(/\\/g, "/").replace(/\/+$/, "");
   return normalizedDir === "" ? name : `${normalizedDir}/${name}`;
 }
-function loadPackManifests2(manifestDir, selectedPackNames, fs9) {
+function loadPackManifests2(manifestDir, selectedPackNames, fs10) {
   const namesToLoad = new Set(selectedPackNames);
   namesToLoad.add(CORE_PACK_NAME2);
   const manifests = /* @__PURE__ */ new Map();
   for (const name of [...namesToLoad].sort()) {
     const manifestPath = joinPosix5(manifestDir, `${name}.json`);
-    if (!fs9.isFile(manifestPath)) {
+    if (!fs10.isFile(manifestPath)) {
       throw new ManifestError2(
         `Pack manifest is missing for pack '${name}': ${manifestPath}`
       );
     }
-    const rawText = fs9.readTextFile(manifestPath);
+    const rawText = fs10.readTextFile(manifestPath);
     manifests.set(name, parseManifest2(name, manifestPath, rawText));
   }
   return manifests;
@@ -18962,6 +18963,332 @@ var RoutingMergeFileSystem = class {
   }
 };
 
+// ../../extensions/drm-copilot/src/lib/push-down/claude-blast-radius-derive.ts
+var fs3 = __toESM(require("node:fs"));
+
+// ../../extensions/drm-copilot/src/lib/push-down/claude-blast-radius-derive-core.ts
+var BLAST_RADIUS_RELATIVE_PATH = "config/blast-radius.json";
+var MANIFEST_FILENAMES = /* @__PURE__ */ new Set([
+  "build.gradle",
+  "build.gradle.kts",
+  "Cargo.toml",
+  "go.mod",
+  "package.json",
+  "pom.xml",
+  "pyproject.toml",
+  "setup.py"
+]);
+var MANIFEST_SUFFIXES = [
+  ".csproj",
+  ".fsproj",
+  ".vbproj",
+  ".sln",
+  ".slnx"
+];
+var EXCLUDED_DIR_NAMES = /* @__PURE__ */ new Set([
+  "__pycache__",
+  "artifacts",
+  "bin",
+  "build",
+  "coverage",
+  "dist",
+  "doc",
+  "docs",
+  "node_modules",
+  "obj",
+  "out",
+  "target",
+  "test",
+  "tests",
+  "venv"
+]);
+var SCAN_DEPTH_LIMIT = 3;
+var PAYLOAD_MODULES = {
+  "claude-runtime": [".claude/**"],
+  config: ["config/**"]
+};
+var FORBIDDEN_GLOBS = [
+  "**",
+  "docs/**",
+  "tests/**"
+];
+var CARRIED_KEYS = [
+  "version",
+  "shared_surfaces",
+  "shared_surface_globs",
+  "over_breadth_fraction",
+  "mandate_reads"
+];
+var BlastRadiusDeriveError = class extends Error {
+  /** Destination-relative path of the document that failed to parse. */
+  path;
+  /**
+   * @param path Path named in the message.
+   * @param detail Parser detail appended to the message.
+   */
+  constructor(path11, detail) {
+    super(
+      `Bundled blast-radius document is not valid JSON and was not written: ${path11} (${detail})`
+    );
+    this.name = "BlastRadiusDeriveError";
+    this.path = path11;
+  }
+};
+var BlastRadiusGuardError = class extends Error {
+  /** The forbidden glob that tripped the guard. */
+  glob;
+  /** Name of the module that would have carried the forbidden glob. */
+  moduleName;
+  /**
+   * @param moduleName Module the forbidden glob was assigned to.
+   * @param glob The forbidden glob.
+   */
+  constructor(moduleName, glob) {
+    super(
+      `Derived blast-radius module ${moduleName} would emit the forbidden glob ${glob}; the derivation was aborted before writing.`
+    );
+    this.name = "BlastRadiusGuardError";
+    this.glob = glob;
+    this.moduleName = moduleName;
+  }
+};
+function compareOrdinal(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function isExcludedDirectoryName(name) {
+  return name.startsWith(".") || EXCLUDED_DIR_NAMES.has(name);
+}
+function isManifestFileName(fileName) {
+  if (MANIFEST_FILENAMES.has(fileName)) {
+    return true;
+  }
+  return MANIFEST_SUFFIXES.some((suffix2) => fileName.endsWith(suffix2));
+}
+function classifyProjectDirectories(observations) {
+  const projectPaths = [];
+  for (const observation of observations) {
+    if (observation.relativePath === "") {
+      continue;
+    }
+    if (observation.fileNames.some(isManifestFileName)) {
+      projectPaths.push(observation.relativePath);
+    }
+  }
+  return projectPaths.sort(compareOrdinal);
+}
+function pruneAncestors(paths) {
+  return paths.filter(
+    (candidate) => !paths.some(
+      (other) => other !== candidate && other.startsWith(`${candidate}/`)
+    )
+  );
+}
+function topLevelDirectories(observations) {
+  const names = [];
+  for (const observation of observations) {
+    const relativePath2 = observation.relativePath;
+    if (relativePath2 !== "" && !relativePath2.includes("/")) {
+      names.push(relativePath2);
+    }
+  }
+  return names.sort(compareOrdinal);
+}
+function assembleModules(derivedPaths) {
+  const combined = /* @__PURE__ */ new Map();
+  for (const path11 of derivedPaths) {
+    combined.set(path11, [`${path11}/**`]);
+  }
+  for (const [name, globs] of Object.entries(PAYLOAD_MODULES)) {
+    combined.set(name, [...globs]);
+  }
+  const modules = {};
+  for (const name of [...combined.keys()].sort(compareOrdinal)) {
+    const globs = combined.get(name);
+    if (globs !== void 0) {
+      modules[name] = globs;
+    }
+  }
+  return modules;
+}
+function assertNoForbiddenGlob(modules) {
+  for (const [name, globs] of Object.entries(modules)) {
+    for (const glob of globs) {
+      if (FORBIDDEN_GLOBS.includes(glob)) {
+        throw new BlastRadiusGuardError(name, glob);
+      }
+    }
+  }
+}
+function parseSourceDocument(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error2) {
+    const detail = error2 instanceof Error ? error2.message : String(error2);
+    throw new BlastRadiusDeriveError(BLAST_RADIUS_RELATIVE_PATH, detail);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new BlastRadiusDeriveError(
+      BLAST_RADIUS_RELATIVE_PATH,
+      "document root is not a JSON object"
+    );
+  }
+  return parsed;
+}
+function deriveDestinationModuleMap(observations, sourceDocumentText) {
+  const source = parseSourceDocument(sourceDocumentText);
+  const projectPaths = pruneAncestors(classifyProjectDirectories(observations));
+  const derivedPaths = projectPaths.length > 0 ? projectPaths : topLevelDirectories(observations);
+  const modules = assembleModules(derivedPaths);
+  assertNoForbiddenGlob(modules);
+  const document = {
+    version: source[CARRIED_KEYS[0]],
+    shared_surfaces: source[CARRIED_KEYS[1]],
+    shared_surface_globs: source[CARRIED_KEYS[2]],
+    mandate_reads: source[CARRIED_KEYS[4]],
+    modules,
+    over_breadth_fraction: source[CARRIED_KEYS[3]]
+  };
+  return `${JSON.stringify(document, null, 2)}
+`;
+}
+
+// ../../extensions/drm-copilot/src/lib/push-down/claude-blast-radius-derive.ts
+function normalizePosix5(value) {
+  return value.replace(/\\/g, "/").replace(/\/+$/, "");
+}
+function relativeToPosix5(path11, root) {
+  const normalizedPath = normalizePosix5(path11);
+  const normalizedRoot = normalizePosix5(root);
+  if (normalizedPath === normalizedRoot) {
+    return "";
+  }
+  const prefix = `${normalizedRoot}/`;
+  return normalizedPath.startsWith(prefix) ? normalizedPath.slice(prefix.length) : null;
+}
+var realDirectoryLister = (root) => {
+  let entries;
+  try {
+    entries = fs3.readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.map((entry) => ({ name: entry.name, isDir: entry.isDirectory() })).sort(
+    (left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0
+  );
+};
+function listTolerantly(lister, path11) {
+  try {
+    return lister(path11);
+  } catch {
+    return [];
+  }
+}
+function collectDestinationObservations(destinationRoot, lister) {
+  const root = normalizePosix5(destinationRoot);
+  const observations = [];
+  let queue = [
+    { path: root, relativePath: "" }
+  ];
+  for (let depth = 1; depth <= SCAN_DEPTH_LIMIT && queue.length > 0; depth++) {
+    const nextQueue = [];
+    for (const current of queue) {
+      const entries = listTolerantly(lister, current.path);
+      const fileNames = [];
+      for (const entry of entries) {
+        if (!entry.isDir) {
+          fileNames.push(entry.name);
+          continue;
+        }
+        if (isExcludedDirectoryName(entry.name)) {
+          continue;
+        }
+        nextQueue.push({
+          path: `${current.path}/${entry.name}`,
+          relativePath: current.relativePath === "" ? entry.name : `${current.relativePath}/${entry.name}`
+        });
+      }
+      observations.push({
+        relativePath: current.relativePath,
+        fileNames
+      });
+    }
+    queue = nextQueue;
+  }
+  return observations;
+}
+var BlastRadiusDeriveFileSystem = class {
+  inner;
+  destinationRoot;
+  deriveRelativePath;
+  lister;
+  /**
+   * @param inner The wrapped adapter performing real I/O.
+   * @param destinationRoot Destination workspace root (POSIX path).
+   * @param lister Shallow directory lister; defaults to the real filesystem.
+   * @param deriveRelativePath Destination-relative path to derive; defaults to
+   *   `config/blast-radius.json`.
+   */
+  constructor(inner, destinationRoot, lister = realDirectoryLister, deriveRelativePath = BLAST_RADIUS_RELATIVE_PATH) {
+    this.inner = inner;
+    this.destinationRoot = normalizePosix5(destinationRoot);
+    this.lister = lister;
+    this.deriveRelativePath = deriveRelativePath;
+  }
+  /** @inheritdoc */
+  listFiles(root) {
+    return this.inner.listFiles(root);
+  }
+  /** @inheritdoc */
+  isDir(path11) {
+    return this.inner.isDir(path11);
+  }
+  /** @inheritdoc */
+  isFile(path11) {
+    return this.inner.isFile(path11);
+  }
+  /** @inheritdoc */
+  readTextFile(path11) {
+    return this.inner.readTextFile(path11);
+  }
+  /** @inheritdoc */
+  ensureDir(path11) {
+    this.inner.ensureDir(path11);
+  }
+  /**
+   * Write a file, deriving the one configured blast-radius path.
+   *
+   * @param path Absolute destination POSIX path.
+   * @param content Bundled source content the engine wants to publish, used as
+   *   the derivation's base document rather than written verbatim.
+   * @throws BlastRadiusDeriveError When the bundled document is not parseable.
+   * @throws BlastRadiusGuardError When a forbidden glob would be emitted. Both
+   *   errors are raised before the inner write, so the destination bytes are
+   *   left untouched.
+   */
+  writeTextFile(path11, content) {
+    if (!this.isDeriveTarget(path11)) {
+      this.inner.writeTextFile(path11, content);
+      return;
+    }
+    const observations = collectDestinationObservations(
+      this.destinationRoot,
+      this.lister
+    );
+    const derived = deriveDestinationModuleMap(observations, content);
+    this.inner.writeTextFile(path11, derived);
+  }
+  /**
+   * Return whether a destination path is the configured derivation target.
+   *
+   * @param path Absolute destination POSIX path.
+   * @returns True when the path resolves to the derive-target relative path.
+   */
+  isDeriveTarget(path11) {
+    return relativeToPosix5(path11, this.destinationRoot) === this.deriveRelativePath;
+  }
+};
+
 // ../../extensions/drm-copilot/src/lib/push-down/claude-customizations.ts
 var ARTIFACT_DIRECTORY4 = "artifacts/claude-customizations";
 var ROOT_FOLDERS2 = [".claude", "config"];
@@ -18979,7 +19306,7 @@ function joinPosix7(root, relative2) {
   const normalizedRelative = relative2.replace(/\\/g, "/").replace(/^\/+/, "");
   return normalizedRoot === "" ? normalizedRelative : `${normalizedRoot}/${normalizedRelative}`;
 }
-function resolvePublishedPaths2(packs, bundleRoot, fs9) {
+function resolvePublishedPaths2(packs, bundleRoot, fs10) {
   if (packs === null || packs.size === 0) {
     return null;
   }
@@ -18987,7 +19314,7 @@ function resolvePublishedPaths2(packs, bundleRoot, fs9) {
   const manifests = loadPackManifests2(
     manifestDir,
     packs,
-    fs9
+    fs10
   );
   const published = computePublishedPaths2(packs, manifests);
   const effectivePublished = published ?? /* @__PURE__ */ new Set();
@@ -18998,29 +19325,35 @@ function pushDownCustomizations4(options) {
   const {
     repoRoot,
     destinationRoot,
-    fs: fs9,
+    fs: fs10,
     sourceRoot,
     artifactRoot,
     packs,
     csharpVariant,
     memoryMode,
     bundleRoot,
-    clock
+    clock,
+    listEntries
   } = options;
   const effectiveSource = sourceRoot ?? repoRoot;
   const effectiveBundle = bundleRoot ?? joinPosix7(effectiveSource, BUNDLE_ROOT_RELATIVE_DIR);
   const publishedPaths = resolvePublishedPaths2(
     packs ?? null,
     effectiveBundle,
-    fs9
+    fs10
   );
   const mergingFs = new RoutingMergeFileSystem(
-    fs9,
+    fs10,
     destinationRoot,
     ROUTING_MERGE_RELATIVE_PATH
   );
-  const excludingFs = new ExcludingFileSystem(
+  const derivingFs = listEntries === void 0 ? new BlastRadiusDeriveFileSystem(mergingFs, destinationRoot) : new BlastRadiusDeriveFileSystem(
     mergingFs,
+    destinationRoot,
+    listEntries
+  );
+  const excludingFs = new ExcludingFileSystem(
+    derivingFs,
     repoRoot,
     EXCLUDED_RELATIVE_PATHS,
     {
@@ -19178,7 +19511,7 @@ function runPushDownClaudeCustomizations(input, deps) {
 var path7 = __toESM(require("node:path"));
 
 // ../../extensions/drm-copilot/src/policy-audit-template-assets.ts
-var fs3 = __toESM(require("node:fs"));
+var fs4 = __toESM(require("node:fs"));
 var path5 = __toESM(require("node:path"));
 var POLICY_AUDIT_TEMPLATE_ASSET_METADATA = {
   template: {
@@ -19222,8 +19555,8 @@ function copyBundledPolicyAuditTemplateAsset(bundledSourcePath, targetPath) {
   if (normalizedTargetPath === bundledSourcePath) {
     return normalizedTargetPath;
   }
-  fs3.mkdirSync(path5.dirname(normalizedTargetPath), { recursive: true });
-  fs3.copyFileSync(bundledSourcePath, normalizedTargetPath);
+  fs4.mkdirSync(path5.dirname(normalizedTargetPath), { recursive: true });
+  fs4.copyFileSync(bundledSourcePath, normalizedTargetPath);
   return normalizedTargetPath;
 }
 
@@ -19231,7 +19564,7 @@ function copyBundledPolicyAuditTemplateAsset(bundledSourcePath, targetPath) {
 var path6 = __toESM(require("node:path"));
 
 // ../../extensions/drm-copilot/src/lib/file-system.ts
-var fs4 = __toESM(require("node:fs"));
+var fs5 = __toESM(require("node:fs"));
 var nodePath3 = __toESM(require("node:path"));
 function toPosixPath2(value) {
   return value.replace(/\\/g, "/");
@@ -19302,7 +19635,7 @@ var RealFileSystem = class {
     const walk = (currentDir, relativePrefix) => {
       let entries;
       try {
-        entries = fs4.readdirSync(currentDir, { withFileTypes: true });
+        entries = fs5.readdirSync(currentDir, { withFileTypes: true });
       } catch {
         return;
       }
@@ -19325,7 +19658,7 @@ var RealFileSystem = class {
    */
   isFile(path11) {
     try {
-      return fs4.statSync(path11).isFile();
+      return fs5.statSync(path11).isFile();
     } catch {
       return false;
     }
@@ -19335,7 +19668,7 @@ var RealFileSystem = class {
    * @returns True when `path` exists; false on any access error.
    */
   exists(path11) {
-    return fs4.existsSync(path11);
+    return fs5.existsSync(path11);
   }
   /**
    * @param path Path to test.
@@ -19343,7 +19676,7 @@ var RealFileSystem = class {
    */
   isDirectory(path11) {
     try {
-      return fs4.statSync(path11).isDirectory();
+      return fs5.statSync(path11).isDirectory();
     } catch {
       return false;
     }
@@ -19355,7 +19688,7 @@ var RealFileSystem = class {
    */
   listDirectory(path11) {
     try {
-      return fs4.readdirSync(path11).sort((left, right) => left.localeCompare(right));
+      return fs5.readdirSync(path11).sort((left, right) => left.localeCompare(right));
     } catch {
       return [];
     }
@@ -19365,14 +19698,14 @@ var RealFileSystem = class {
    * @returns The file content decoded as UTF-8.
    */
   readTextFile(path11) {
-    return fs4.readFileSync(path11, "utf8");
+    return fs5.readFileSync(path11, "utf8");
   }
   /**
    * @param path File to write.
    * @param content Text content to write as UTF-8.
    */
   writeTextFile(path11, content) {
-    fs4.writeFileSync(path11, content, "utf8");
+    fs5.writeFileSync(path11, content, "utf8");
   }
   /**
    * Create the directory at `path`, including any missing parents.
@@ -19384,7 +19717,7 @@ var RealFileSystem = class {
    * @param path Directory path to create.
    */
   ensureDir(path11) {
-    fs4.mkdirSync(path11, { recursive: true });
+    fs5.mkdirSync(path11, { recursive: true });
   }
 };
 
@@ -19464,7 +19797,7 @@ function buildFallbackReason(issueContent) {
 function resolveTemplateName(templateKind) {
   return templateKind === "execute" ? "execute-hard-lock.prompt.md" : "resume-hard-lock.prompt.md";
 }
-function resolveTemplatePath(templateName, workspaceRoot, templateRoot, fs9) {
+function resolveTemplatePath(templateName, workspaceRoot, templateRoot, fs10) {
   const candidates = [];
   if (templateRoot !== null) {
     candidates.push(joinPosix9(templateRoot, templateName));
@@ -19476,18 +19809,18 @@ function resolveTemplatePath(templateName, workspaceRoot, templateRoot, fs9) {
     )
   );
   for (const candidate of candidates) {
-    if (fs9.isFile(candidate)) {
+    if (fs10.isFile(candidate)) {
       return { path: candidate, checked: candidates };
     }
   }
   return { path: null, checked: candidates };
 }
-function resolveIssueFileForTarget(targetPath, workspaceRoot, fs9) {
+function resolveIssueFileForTarget(targetPath, workspaceRoot, fs10) {
   const normalizedRoot = toPosixPath2(workspaceRoot).replace(/\/+$/, "");
   const relativeTarget = tryRelativeToWorkspace(targetPath, workspaceRoot);
   const planDir = parentOf(relativeTarget);
   const directIssue = joinPosix9(joinPosix9(normalizedRoot, planDir), "issue.md");
-  if (fs9.isFile(directIssue)) {
+  if (fs10.isFile(directIssue)) {
     return directIssue;
   }
   const planDirParts = splitParts(planDir);
@@ -19497,15 +19830,15 @@ function resolveIssueFileForTarget(targetPath, workspaceRoot, fs9) {
       joinPosix9(normalizedRoot, parentOf(planDir)),
       "issue.md"
     );
-    if (fs9.isFile(parentIssue)) {
+    if (fs10.isFile(parentIssue)) {
       return parentIssue;
     }
   }
   return directIssue;
 }
-function resolveWorkModeFromIssue(targetPath, workspaceRoot, fs9) {
-  const issuePath = resolveIssueFileForTarget(targetPath, workspaceRoot, fs9);
-  if (!fs9.isFile(issuePath)) {
+function resolveWorkModeFromIssue(targetPath, workspaceRoot, fs10) {
+  const issuePath = resolveIssueFileForTarget(targetPath, workspaceRoot, fs10);
+  if (!fs10.isFile(issuePath)) {
     return {
       mode: resolveSelectedWorkMode(null),
       fallbackReason: buildFallbackReason(null)
@@ -19513,7 +19846,7 @@ function resolveWorkModeFromIssue(targetPath, workspaceRoot, fs9) {
   }
   let issueContent;
   try {
-    issueContent = fs9.readTextFile(issuePath);
+    issueContent = fs10.readTextFile(issuePath);
   } catch {
     return {
       mode: resolveSelectedWorkMode(null),
@@ -19525,13 +19858,13 @@ function resolveWorkModeFromIssue(targetPath, workspaceRoot, fs9) {
     fallbackReason: buildFallbackReason(issueContent)
   };
 }
-function resolveHardLockPrompt(templateContent, targetPath, workspaceRoot, fs9) {
+function resolveHardLockPrompt(templateContent, targetPath, workspaceRoot, fs10) {
   const relativeTarget = tryRelativeToWorkspace(targetPath, workspaceRoot);
   const planPathValue = toPosixPath2(relativeTarget);
   const { mode, fallbackReason } = resolveWorkModeFromIssue(
     targetPath,
     workspaceRoot,
-    fs9
+    fs10
   );
   let resolved = templateContent.split("${plan-path}").join(planPathValue);
   resolved = resolved.split("${work-mode}").join(mode);
@@ -19789,18 +20122,18 @@ function isAllDigits(value) {
 function resolveSpecPath(folderpath) {
   return joinFolder(folderpath, "spec.md");
 }
-function resolveUserStoryValue(folderpath, workspaceRoot, fs9) {
+function resolveUserStoryValue(folderpath, workspaceRoot, fs10) {
   const relativeStory = joinFolder(folderpath, "user-story.md");
   const fullStory = joinFolder(toPosixPath2(workspaceRoot), relativeStory);
-  if (fs9.isFile(fullStory)) {
+  if (fs10.isFile(fullStory)) {
     return relativeStory;
   }
   return `${relativeStory} (missing)`;
 }
-function resolveResearchValue(folderpath, workspaceRoot, fs9) {
+function resolveResearchValue(folderpath, workspaceRoot, fs10) {
   const relativeResearch = joinFolder(folderpath, "research.md");
   const fullResearch = joinFolder(toPosixPath2(workspaceRoot), relativeResearch);
-  if (fs9.isFile(fullResearch)) {
+  if (fs10.isFile(fullResearch)) {
     return relativeResearch;
   }
   return null;
@@ -19812,12 +20145,12 @@ function joinFolder(folder, leaf) {
   }
   return `${normalizedFolder}/${leaf}`;
 }
-function resolveWorkModeFromIssue2(folderpath, workspaceRoot, fs9) {
+function resolveWorkModeFromIssue2(folderpath, workspaceRoot, fs10) {
   const issuePath = joinFolder(
     joinFolder(toPosixPath2(workspaceRoot), folderpath),
     "issue.md"
   );
-  if (!fs9.isFile(issuePath)) {
+  if (!fs10.isFile(issuePath)) {
     return {
       mode: resolveSelectedWorkMode(null),
       fallbackReason: buildFallbackReason(null)
@@ -19825,7 +20158,7 @@ function resolveWorkModeFromIssue2(folderpath, workspaceRoot, fs9) {
   }
   let issueContent;
   try {
-    issueContent = fs9.readTextFile(issuePath);
+    issueContent = fs10.readTextFile(issuePath);
   } catch {
     return {
       mode: resolveSelectedWorkMode(null),
@@ -19839,7 +20172,7 @@ function resolveWorkModeFromIssue2(folderpath, workspaceRoot, fs9) {
 }
 
 // ../../extensions/drm-copilot/src/lib/resolve/file-prompt-core.ts
-function resolvePrompt(templateContent, targetPath, workspaceRoot, fs9) {
+function resolvePrompt(templateContent, targetPath, workspaceRoot, fs10) {
   let content = stripFrontMatter(templateContent);
   const relativeTarget = tryRelativeToWorkspace2(targetPath, workspaceRoot);
   const fileValue = toPosixPath2(relativeTarget);
@@ -19851,19 +20184,19 @@ function resolvePrompt(templateContent, targetPath, workspaceRoot, fs9) {
     folderpath,
     name,
     spec: resolveSpecPath(folderpath),
-    "user-story": resolveUserStoryValue(folderpath, workspaceRoot, fs9)
+    "user-story": resolveUserStoryValue(folderpath, workspaceRoot, fs10)
   };
   const { mode, fallbackReason } = resolveWorkModeFromIssue2(
     folderpath,
     workspaceRoot,
-    fs9
+    fs10
   );
   variables["work-mode"] = mode;
   variables["fallback-reason"] = fallbackReason;
   if (mode === "minor-audit") {
     content = applyMinorAuditOverrides(content);
   }
-  const researchValue = resolveResearchValue(folderpath, workspaceRoot, fs9);
+  const researchValue = resolveResearchValue(folderpath, workspaceRoot, fs10);
   if (researchValue === null) {
     content = removeLinesReferencingVariable(content, "research");
   } else {
@@ -25518,9 +25851,9 @@ function validatePhaseCompleteness(state) {
     (phase) => `Checkpoint completion validation failed: route ${routeId} is missing mandatory phase ${phase}.`
   );
 }
-function loadRoutingMatrix(fs9, root) {
+function loadRoutingMatrix(fs10, root) {
   const path11 = `${toPosixPath2(root).replace(/\/+$/, "")}/${ROUTING_MATRIX_RELATIVE_PATH}`;
-  return JSON.parse(fs9.readTextFile(path11));
+  return JSON.parse(fs10.readTextFile(path11));
 }
 function stringList(value) {
   if (!Array.isArray(value)) {
@@ -26516,6 +26849,417 @@ function validateParallelKickoffText(text) {
   return parseParallelKickoff(text).errors;
 }
 
+// ../../extensions/drm-copilot/src/lib/validate/plan-gate-commands.ts
+var SHELL_WHITESPACE = /* @__PURE__ */ new Set([" ", "	", "\r", "\n"]);
+var ESCAPE = "\\";
+var COV_FLAG = "--cov";
+var COV_FLAG_PREFIX = "--cov=";
+var GREP_EXECUTABLES = /* @__PURE__ */ new Set(["grep", "egrep", "fgrep", "rg"]);
+var EXECUTABLE_SCAN_LIMIT = 4;
+var PLAN_GATE_TASK_PATTERN = /^- \[(?<state>[ xX])\] \[P(?<phase>\d+)-T(?<task>\d+)\] (?<title>.+)$/;
+var PLAN_GATE_HEADING_PATTERN = /^#{1,6} /;
+var INLINE_SPAN_RE = /`([^`]+)`/g;
+var FENCE_RE = /^\s*```/;
+var MINIMUM_ARGV_LENGTH = 2;
+function splitShellWords(span) {
+  const words2 = [];
+  let token = null;
+  let quote = null;
+  let index = 0;
+  while (index < span.length) {
+    const char = span[index] ?? "";
+    index += 1;
+    if (quote === null) {
+      if (SHELL_WHITESPACE.has(char)) {
+        if (token !== null) {
+          words2.push(token);
+          token = null;
+        }
+        continue;
+      }
+      if (char === ESCAPE) {
+        const next = span[index];
+        if (next === void 0) {
+          return null;
+        }
+        index += 1;
+        token = (token ?? "") + next;
+        continue;
+      }
+      if (char === '"' || char === "'") {
+        quote = char;
+        token = token ?? "";
+        continue;
+      }
+      token = (token ?? "") + char;
+      continue;
+    }
+    if (char === quote) {
+      quote = null;
+      continue;
+    }
+    if (quote === '"' && char === ESCAPE) {
+      const next = span[index];
+      if (next === void 0) {
+        return null;
+      }
+      index += 1;
+      if (next !== quote && next !== ESCAPE) {
+        token = (token ?? "") + ESCAPE;
+      }
+      token = (token ?? "") + next;
+      continue;
+    }
+    token = (token ?? "") + char;
+  }
+  if (quote !== null) {
+    return null;
+  }
+  if (token !== null) {
+    words2.push(token);
+  }
+  return words2;
+}
+function isCovFlagToken(token) {
+  return token === COV_FLAG || token.startsWith(COV_FLAG_PREFIX);
+}
+function grepExecutableIndex(argv) {
+  const limit = Math.min(argv.length, EXECUTABLE_SCAN_LIMIT);
+  for (let index = 0; index < limit; index += 1) {
+    const word = argv[index];
+    if (word === void 0) {
+      continue;
+    }
+    if (GREP_EXECUTABLES.has(word)) {
+      return index;
+    }
+    if (word === "git" && argv[index + 1] === "grep") {
+      return index + 1;
+    }
+  }
+  return null;
+}
+function classifyKind(argv) {
+  if (grepExecutableIndex(argv) !== null) {
+    return "grep";
+  }
+  if (argv.some((word) => isCovFlagToken(word))) {
+    return "pytest_cov";
+  }
+  return "other";
+}
+function splitLines2(text) {
+  return text.split(/\r\n|\n|\r/);
+}
+function inlineSpans(line) {
+  const spans = [];
+  for (const match of line.matchAll(INLINE_SPAN_RE)) {
+    const body = match[1];
+    if (body !== void 0) {
+      spans.push(body);
+    }
+  }
+  return spans;
+}
+function appendCommand(commands, taskId, sourceLine, rawSpan) {
+  const argv = splitShellWords(rawSpan);
+  if (argv === null || argv.length < MINIMUM_ARGV_LENGTH) {
+    return;
+  }
+  commands.push({
+    taskId,
+    sourceLine,
+    rawSpan,
+    argv,
+    kind: classifyKind(argv)
+  });
+}
+function extractPlanCommands(text) {
+  const commands = [];
+  let currentTask = null;
+  let inFence = false;
+  const lines = splitLines2(text);
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index] ?? "";
+    const lineNumber = index + 1;
+    if (FENCE_RE.test(line)) {
+      inFence = !inFence;
+      continue;
+    }
+    if (inFence) {
+      const fenced = line.trim();
+      if (currentTask !== null && fenced !== "") {
+        appendCommand(commands, currentTask, lineNumber, fenced);
+      }
+      continue;
+    }
+    if (PLAN_GATE_HEADING_PATTERN.test(line)) {
+      currentTask = null;
+      continue;
+    }
+    const taskMatch = PLAN_GATE_TASK_PATTERN.exec(line);
+    if (taskMatch !== null) {
+      const phase = taskMatch.groups?.["phase"] ?? "";
+      const task = taskMatch.groups?.["task"] ?? "";
+      currentTask = `P${phase}-T${task}`;
+    }
+    if (currentTask === null) {
+      continue;
+    }
+    for (const span of inlineSpans(line)) {
+      appendCommand(commands, currentTask, lineNumber, span);
+    }
+  }
+  return commands;
+}
+
+// ../../extensions/drm-copilot/src/lib/validate/plan-gate-rules.ts
+function emptyPlanGateReport() {
+  return { blocking: [], warnings: [] };
+}
+var BLOCKING_CHANNEL = "blocking";
+var PLACEHOLDER_MARKERS = ["<", ">", "${", "$(", "%"];
+var PATH_SEPARATORS = ["/", "\\"];
+var PYTHON_SUFFIX = ".py";
+var PYTEST_NODE_SEPARATOR = "::";
+var REGEX_METACHARACTERS = /* @__PURE__ */ new Set([...".*[]^$\\(){}|+?"]);
+var FIXED_STRING_FLAG = "-F";
+var WINDOW_SIZE = 4;
+function isPlaceholder(value) {
+  return PLACEHOLDER_MARKERS.some((marker) => value.includes(marker));
+}
+function dottedRemedy(value) {
+  const stem2 = value.endsWith(PYTHON_SUFFIX) ? value.slice(0, value.length - PYTHON_SUFFIX.length) : value;
+  return stem2.split("/").join(".").split("\\").join(".");
+}
+function covValues(command) {
+  const values = [];
+  const argv = command.argv;
+  for (let index = 0; index < argv.length; index += 1) {
+    const word = argv[index];
+    if (word === void 0) {
+      continue;
+    }
+    if (word === COV_FLAG) {
+      const next = argv[index + 1];
+      if (next !== void 0) {
+        values.push({ value: next, spaceSeparated: true });
+      }
+      continue;
+    }
+    if (word.startsWith(COV_FLAG_PREFIX)) {
+      values.push({
+        value: word.slice(COV_FLAG_PREFIX.length),
+        spaceSeparated: false
+      });
+    }
+  }
+  return values;
+}
+function evaluateCovValue(report, command, cov, context) {
+  const task = command.taskId;
+  if (cov.spaceSeparated) {
+    report.warnings.push(
+      `[${task}] --cov argument value \`${cov.value}\` is supplied space-separated; the ambiguous form can bind the following positional argument. Use the --cov=<module> form.`
+    );
+  }
+  if (isPlaceholder(cov.value)) {
+    return;
+  }
+  const truncated = cov.value.split(PYTEST_NODE_SEPARATOR)[0] ?? "";
+  if (truncated.endsWith(PYTHON_SUFFIX)) {
+    report.blocking.push(
+      `[${task}] --cov argument \`${cov.value}\` names a filesystem path; coverage.py accepts only directories or importable names. Use --cov=${dottedRemedy(truncated)}.`
+    );
+    return;
+  }
+  if (!PATH_SEPARATORS.some((separator) => cov.value.includes(separator))) {
+    return;
+  }
+  if (context === void 0) {
+    return;
+  }
+  try {
+    evaluateTrackedCovValue(report, task, cov, truncated, context);
+  } catch {
+  }
+}
+function evaluateTrackedCovValue(report, task, cov, truncated, context) {
+  if (context.git.isTrackedFile(truncated + PYTHON_SUFFIX)) {
+    report.blocking.push(
+      `[${task}] --cov argument \`${cov.value}\` names a tracked module file path; coverage.py accepts only directories or importable names. Use --cov=${dottedRemedy(truncated)}.`
+    );
+    return;
+  }
+  if (context.git.isTrackedDirectory(truncated)) {
+    return;
+  }
+  report.warnings.push(
+    `[${task}] --cov argument \`${cov.value}\` contains a path separator but resolves to neither a tracked file nor a tracked directory; coverage may collect no data. Use the importable dotted form or a tracked directory.`
+  );
+}
+function patternOperand(argv) {
+  const executable = grepExecutableIndex(argv);
+  if (executable === null) {
+    return null;
+  }
+  for (let index = executable + 1; index < argv.length; index += 1) {
+    const word = argv[index];
+    if (word === void 0 || word.startsWith("-")) {
+      continue;
+    }
+    return word;
+  }
+  return null;
+}
+function isCheckableLiteral(argv, pattern) {
+  if (isPlaceholder(pattern)) {
+    return false;
+  }
+  if (argv.includes(FIXED_STRING_FLAG)) {
+    return true;
+  }
+  return ![...pattern].some((character) => REGEX_METACHARACTERS.has(character));
+}
+function normalizeWhitespace(value) {
+  return value.split(/\s+/).filter((word) => word !== "").join(" ");
+}
+function planQuotesLiteral(text, literal2, excludeSpan) {
+  const remainder = text.split(excludeSpan).join(" ");
+  const needle = normalizeWhitespace(literal2);
+  if (needle === "") {
+    return false;
+  }
+  return normalizeWhitespace(remainder).includes(needle);
+}
+function windowJoin(lines, size = WINDOW_SIZE) {
+  const dense = lines.filter((line) => line.trim() !== "").map((line) => normalizeWhitespace(line));
+  const windows = [];
+  for (let index = 0; index < dense.length; index += 1) {
+    windows.push(dense.slice(index, index + size).join(" "));
+  }
+  return windows;
+}
+function hasCrossLinePresence(context, literal2) {
+  const words2 = literal2.split(/\s+/).filter((word) => word !== "");
+  if (words2.length < 2) {
+    return false;
+  }
+  const needle = words2.join(" ");
+  const firstWord = words2[0] ?? "";
+  for (const path11 of context.git.filesContaining(firstWord)) {
+    const lines = context.git.readTrackedText(path11).split(/\r\n|\n|\r/);
+    if (lines.some((line) => normalizeWhitespace(line).includes(needle))) {
+      continue;
+    }
+    if (windowJoin(lines).some((window2) => window2.includes(needle))) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// ../../extensions/drm-copilot/src/lib/validate/plan-gate-discrimination.ts
+var G5_SEVERITY = "warning";
+var CommandRunnerPlanGateRepository = class {
+  constructor(workspaceRoot, runner) {
+    this.workspaceRoot = workspaceRoot;
+    this.runner = runner;
+  }
+  workspaceRoot;
+  runner;
+  /** Run one `git` invocation and return its exit code and trimmed stdout. */
+  run(arguments_) {
+    const result = this.runner.run(["git", ...arguments_], {
+      cwd: this.workspaceRoot,
+      allowError: true
+    });
+    return { code: result.code, stdout: result.stdout.trim() };
+  }
+  /** Return tracked paths carrying the literal on a single line. */
+  filesContaining(literal2) {
+    const result = this.run(["grep", "-F", "-l", "--", literal2]);
+    if (result.code !== 0 || result.stdout === "") {
+      return [];
+    }
+    return result.stdout.split(/\r\n|\n|\r/).map((line) => line.trim()).filter((line) => line !== "");
+  }
+  /** Return whether `git ls-files` lists the path itself. */
+  isTrackedFile(path11) {
+    const normalized = path11.split("\\").join("/");
+    const result = this.run(["ls-files", "--", normalized]);
+    if (result.code !== 0 || result.stdout === "") {
+      return false;
+    }
+    return result.stdout.split(/\r\n|\n|\r/).some((line) => line.trim() === normalized);
+  }
+  /** Return whether entries exist beneath the path but none equals it. */
+  isTrackedDirectory(path11) {
+    const normalized = path11.split("\\").join("/").replace(/\/+$/, "");
+    const result = this.run(["ls-files", "--", normalized]);
+    if (result.code !== 0 || result.stdout === "") {
+      return false;
+    }
+    const listed = result.stdout.split(/\r\n|\n|\r/).map((line) => line.trim()).filter((line) => line !== "");
+    return listed.length > 0 && listed.every((entry) => entry !== normalized);
+  }
+  /** Return the committed text of the path at `HEAD`, or an empty string. */
+  readTrackedText(path11) {
+    const normalized = path11.split("\\").join("/");
+    const result = this.run(["show", `HEAD:${normalized}`]);
+    return result.code === 0 ? result.stdout : "";
+  }
+};
+function evaluateLiteral(report, text, command, context) {
+  const pattern = patternOperand(command.argv);
+  if (pattern === null || !isCheckableLiteral(command.argv, pattern)) {
+    return;
+  }
+  if (context.git.filesContaining(pattern).length > 0) {
+    return;
+  }
+  if (planQuotesLiteral(text, pattern, command.rawSpan)) {
+    return;
+  }
+  if (hasCrossLinePresence(context, pattern)) {
+    report.warnings.push(
+      `[${command.taskId}] search literal \`${pattern}\` is present only across adjacent lines of a tracked file and matches no single line; a line-oriented search returns zero matches. Search a shorter single-line token.`
+    );
+    return;
+  }
+  const finding = `[${command.taskId}] search literal \`${pattern}\` is absent from the tracked tree and is not quoted in the plan; the search returns zero matches whatever the executor does. Quote the exact literal the task will create, or assert a literal that exists.`;
+  const channel = G5_SEVERITY === BLOCKING_CHANNEL ? report.blocking : report.warnings;
+  channel.push(finding);
+}
+function evaluateLiteralRules(report, text, commands, context) {
+  const literalFindings = emptyPlanGateReport();
+  try {
+    for (const command of commands) {
+      if (command.kind !== "grep") {
+        continue;
+      }
+      evaluateLiteral(literalFindings, text, command, context);
+    }
+  } catch {
+    return;
+  }
+  report.blocking.push(...literalFindings.blocking);
+  report.warnings.push(...literalFindings.warnings);
+}
+function evaluatePlanGates(text, context) {
+  const report = emptyPlanGateReport();
+  const commands = extractPlanCommands(text);
+  for (const command of commands) {
+    for (const cov of covValues(command)) {
+      evaluateCovValue(report, command, cov, context);
+    }
+  }
+  if (context !== void 0) {
+    evaluateLiteralRules(report, text, commands, context);
+  }
+  return report;
+}
+
 // ../../extensions/drm-copilot/src/lib/validate/parallel-state-shared.ts
 function words(text) {
   return text.split(" ");
@@ -27301,7 +28045,7 @@ function validateReceiptArrays(state, context) {
 var CONTEXT = "Parallel checkpoint";
 var EXPECTED_ROUTE_ID2 = "parallel";
 var MIN_CONCURRENCY = 1;
-var MAX_CONCURRENCY = 8;
+var MAX_CONCURRENCY = 32;
 var REQUIRED_KEYS4 = [
   "objective",
   "completed_steps",
@@ -27451,7 +28195,7 @@ function validateParallelOrchestratorStateText(text, options = {}) {
 // ../../extensions/drm-copilot/src/lib/validate/parallel-planner-state-core.ts
 var CONTEXT2 = "Parallel planner checkpoint";
 var MIN_CONCURRENCY2 = 1;
-var MAX_CONCURRENCY2 = 8;
+var MAX_CONCURRENCY2 = 32;
 var REQUIRED_KEYS5 = [
   "objective",
   "parallel_slug",
@@ -27690,7 +28434,7 @@ var POLICY_AUDIT_REQUIRED_CHECKLIST_LABELS = [
   "Per-language comparison summary:"
 ];
 var POLICY_AUDIT_COMPARISON_HEADING = "### 1.2.1 Per-Language Coverage Comparison";
-var PLACEHOLDER_MARKERS = [
+var PLACEHOLDER_MARKERS2 = [
   "[n]",
   "[path",
   "[artifact",
@@ -27716,7 +28460,7 @@ function isNaValue(value) {
 }
 function hasPlaceholderMarker(value) {
   const lowered = value.toLowerCase();
-  return PLACEHOLDER_MARKERS.some((marker) => lowered.includes(marker));
+  return PLACEHOLDER_MARKERS2.some((marker) => lowered.includes(marker));
 }
 function reportsMissingTemplateResolverSuccess(text) {
   const lowered = text.toLowerCase();
@@ -28023,10 +28767,28 @@ function validatePlanText(text) {
   }
   return errors;
 }
-function validateArtifact(input) {
+function buildPlanGateContext(input) {
+  if (input.fs === void 0 || input.root === void 0 || input.artifactPath === void 0 || input.runner === void 0) {
+    return void 0;
+  }
+  return {
+    workspaceRoot: input.root,
+    fileSystem: input.fs,
+    git: new CommandRunnerPlanGateRepository(input.root, input.runner)
+  };
+}
+function validateArtifactWithWarnings(input) {
+  if (input.artifactType === "plan") {
+    const report = evaluatePlanGates(input.text, buildPlanGateContext(input));
+    return {
+      errors: [...validatePlanText(input.text), ...report.blocking],
+      warnings: report.warnings
+    };
+  }
+  return { errors: dispatchValidatorErrors(input), warnings: [] };
+}
+function dispatchValidatorErrors(input) {
   switch (input.artifactType) {
-    case "plan":
-      return validatePlanText(input.text);
     case "policy-audit":
       return validatePolicyAuditText(input.text);
     case "code-review":
@@ -28089,12 +28851,13 @@ function validateArtifact(input) {
 }
 
 // ../../extensions/drm-copilot/src/lib/validate/validate-orchestration-service-call.ts
+var PLAN_GATE_WARNING_PREFIX = "PLAN GATE WARNING: ";
 function validateOrchestrationServiceCall(input) {
   const artifactFullPath = toPosixPath2(
     path9.join(input.workspaceRoot, input.artifactPath)
   );
   const text = input.fileSystem.readTextFile(artifactFullPath);
-  const errors = validateArtifact({
+  const { errors, warnings } = validateArtifactWithWarnings({
     artifactType: input.artifactType,
     text,
     ...input.requireComplete === void 0 ? {} : { requireComplete: input.requireComplete },
@@ -28108,15 +28871,17 @@ function validateOrchestrationServiceCall(input) {
     root: input.workspaceRoot
   });
   if (errors.length > 0) {
+    const warningBlock = warnings.length === 0 ? "" : "\n" + warnings.map((warning) => `${PLAN_GATE_WARNING_PREFIX}${warning}`).join("\n");
     throw new Error(
       `Validation failed for ${input.artifactType} artifact at '${input.artifactPath}':
-${errors.join("\n")}`
+${errors.join("\n")}${warningBlock}`
     );
   }
   return {
     tool: "validate_orchestration_artifacts",
     workspaceRoot: input.workspaceRoot,
-    summary: `Validated ${input.artifactType} artifact at '${input.artifactPath}'.`
+    summary: `Validated ${input.artifactType} artifact at '${input.artifactPath}'.`,
+    ...warnings.length === 0 ? {} : { warnings }
   };
 }
 
@@ -28137,7 +28902,7 @@ function buildValidateOrchestrationServiceCallInput(fileSystem, input, runner) {
 }
 
 // ../../extensions/drm-copilot/src/lib/new-potential-bug-entry.ts
-var fs5 = __toESM(require("node:fs"));
+var fs6 = __toESM(require("node:fs"));
 var nodePath4 = __toESM(require("node:path"));
 var SHORT_NAME_PATTERN2 = /^[a-z0-9]+(-[a-z0-9]+)*$/;
 var INSIDERS_SIGNAL_NAMES = [
@@ -28210,7 +28975,7 @@ function defaultWhichLookup(executable) {
         directory,
         process.platform === "win32" ? `${executable}${extension}` : executable
       );
-      if (fs5.existsSync(candidate)) {
+      if (fs6.existsSync(candidate)) {
         return candidate;
       }
     }
@@ -28339,7 +29104,7 @@ function truncate(text, limit = 800) {
   }
   return rstrip3(text.slice(0, limit - 3)) + "...";
 }
-function splitLines2(value) {
+function splitLines3(value) {
   if (value === "") {
     return [];
   }
@@ -28350,7 +29115,7 @@ function splitLines2(value) {
   return lines;
 }
 function truncateLines(text, limit) {
-  const lines = splitLines2(text);
+  const lines = splitLines3(text);
   if (lines.length <= limit) {
     return text;
   }
@@ -29114,7 +29879,7 @@ function convertNumstat(numstatText) {
   let adds = 0;
   let dels = 0;
   const files = [];
-  for (const rawLine of splitLines3(numstatText)) {
+  for (const rawLine of splitLines4(numstatText)) {
     if (!rawLine.trim()) {
       continue;
     }
@@ -29177,7 +29942,7 @@ function summarizeConventionalCommits(subjects) {
   }
   counts.set("other", 0);
   const typePattern = /^(feat|fix|refactor|perf|docs|test|chore|build|ci|style)(\(|!|:)/u;
-  for (const rawLine of splitLines3(subjects)) {
+  for (const rawLine of splitLines4(subjects)) {
     const line = rawLine.trim();
     if (!line) {
       continue;
@@ -29232,7 +29997,7 @@ function buildIssuesToAutocloseSection(params) {
 function extractChangedPaths(contextText) {
   const paths = [];
   let capture = false;
-  for (const line of splitLines3(contextText)) {
+  for (const line of splitLines4(contextText)) {
     if (line.startsWith("===== Changed files")) {
       capture = true;
       continue;
@@ -29278,7 +30043,7 @@ function compareCodePoint2(left, right) {
   }
   return 0;
 }
-function splitLines3(value) {
+function splitLines4(value) {
   if (value === "") {
     return [];
   }
@@ -29348,7 +30113,7 @@ function buildPrContext(options) {
     const subjects = git.log("--pretty=%s", revRange);
     const authors = git.log("--format=%an <%ae>", revRange);
     const authorsList = sortedSet2(
-      splitLines4(authors).map((line) => line.trim()).filter((line) => line)
+      splitLines5(authors).map((line) => line.trim()).filter((line) => line)
     );
     const nameStatus = git.diffRange(["--name-status", mergeBase, headSha]);
     const numstat = git.diffRange(["--numstat", mergeBase, headSha]);
@@ -29356,7 +30121,7 @@ function buildPrContext(options) {
     const stat = git.diffRange(["--stat", mergeBase, headSha]);
     const [additions, deletions, files] = convertNumstat(numstat);
     const extSummary = extensionSummary(files);
-    const mergePrs = extractMergePrNumbers(splitLines4(oneline));
+    const mergePrs = extractMergePrNumbers(splitLines5(oneline));
     const issueCandidates = extractIssueReferences(
       oneline + "\n" + subjects
     ).filter((ref) => !mergePrs.includes(ref));
@@ -29515,7 +30280,7 @@ function compareCodePoint3(left, right) {
   }
   return 0;
 }
-function splitLines4(value) {
+function splitLines5(value) {
   if (value === "") {
     return [];
   }
@@ -29541,7 +30306,7 @@ function parseSection2(markdown, heading) {
 }
 function completedPlanTasks2(markdown, limit = 10) {
   const tasks = [];
-  for (const line of splitLines2(markdown)) {
+  for (const line of splitLines3(markdown)) {
     if (/\[x\]/iu.test(line)) {
       const cleaned = line.replace(/^[-*]\s*\[[xX]\]\s*/u, "").trim();
       tasks.push(cleaned);
@@ -29567,9 +30332,9 @@ function extractIssueReferences2(text) {
   }
   return ordered;
 }
-function resolveFeatureDir2(fs9, baseDir, feature) {
+function resolveFeatureDir2(fs10, baseDir, feature) {
   const direct = `${baseDir}/${feature}`;
-  if (fs9.exists(direct)) {
+  if (fs10.exists(direct)) {
     return direct;
   }
   const pattern = new RegExp(
@@ -29578,9 +30343,9 @@ function resolveFeatureDir2(fs9, baseDir, feature) {
   );
   const strongMatches = [];
   const weakMatches = [];
-  for (const name of fs9.listDirectory(baseDir)) {
+  for (const name of fs10.listDirectory(baseDir)) {
     const candidate = `${baseDir}/${name}`;
-    if (!fs9.isDirectory(candidate)) {
+    if (!fs10.isDirectory(candidate)) {
       continue;
     }
     if (pattern.test(name)) {
@@ -29597,11 +30362,11 @@ function resolveFeatureDir2(fs9, baseDir, feature) {
   }
   return null;
 }
-function readText(fs9, path11) {
-  return fs9.exists(path11) ? fs9.readTextFile(path11) : "";
+function readText(fs10, path11) {
+  return fs10.exists(path11) ? fs10.readTextFile(path11) : "";
 }
-function latestGlobPath(fs9, directory, pattern) {
-  const matches = [...fs9.glob(directory, pattern)].sort(compareCodePoint4);
+function latestGlobPath(fs10, directory, pattern) {
+  const matches = [...fs10.glob(directory, pattern)].sort(compareCodePoint4);
   return matches.length > 0 ? matches[matches.length - 1] : null;
 }
 function verificationText(planText) {
@@ -29620,7 +30385,7 @@ function parsePrimaryIssueFromMetadata(params) {
     params.storyText,
     params.issueText
   ]) {
-    for (const line of splitLines2(sourceText)) {
+    for (const line of splitLines3(sourceText)) {
       const match = pattern.exec(line);
       if (match) {
         return match[1];
@@ -29643,20 +30408,20 @@ function parseReadinessValue(text) {
   }
   return null;
 }
-function resolveReadinessSignal(fs9, featureDir) {
-  const auditFiles = [...fs9.glob(featureDir, "feature-audit.*.md")].sort(
+function resolveReadinessSignal(fs10, featureDir) {
+  const auditFiles = [...fs10.glob(featureDir, "feature-audit.*.md")].sort(
     compareCodePoint4
   );
   for (let index = auditFiles.length - 1; index >= 0; index -= 1) {
     const auditPath = auditFiles[index];
-    const readiness = parseReadinessValue(readText(fs9, auditPath));
+    const readiness = parseReadinessValue(readText(fs10, auditPath));
     if (readiness) {
       return [readiness, auditPath];
     }
   }
   return [null, null];
 }
-function relativeToPosix5(root, path11) {
+function relativeToPosix6(root, path11) {
   const normalizedRoot = toPosixPath2(root).replace(/\/+$/u, "");
   const normalized = toPosixPath2(path11);
   if (normalized.startsWith(`${normalizedRoot}/`)) {
@@ -29679,22 +30444,26 @@ function escapeRegExp4(value) {
 
 // ../../extensions/drm-copilot/src/lib/pr-context/verification-evidence.ts
 var REQUIRED_FIELDS = ["Timestamp", "Command", "EXIT_CODE"];
+var EXPECTED_EXIT_CODE_FIELD = "ExpectedExitCode";
 var CANONICAL_GLOBS = [
   "evidence/qa-gates/**/*.md",
   "evidence/regression-testing/**/*.md",
   "evidence/other/**/*.md"
 ];
-function discoverCanonicalEvidenceFiles(fs9, root, feature) {
+function normalizeResult(exitCode, expectedExitCode) {
+  return exitCode === expectedExitCode ? "pass" : "fail";
+}
+function discoverCanonicalEvidenceFiles(fs10, root, feature) {
   const normalizedRoot = toPosixPath2(root).replace(/\/+$/u, "");
   const featureRoot = `${normalizedRoot}/docs/features/active/${feature}`;
-  if (!fs9.exists(featureRoot) || !fs9.isDirectory(featureRoot)) {
+  if (!fs10.exists(featureRoot) || !fs10.isDirectory(featureRoot)) {
     return [];
   }
   const discovered = /* @__PURE__ */ new Set();
   for (const pattern of CANONICAL_GLOBS) {
-    for (const candidate of fs9.glob(featureRoot, pattern)) {
-      if (fs9.isFile(candidate)) {
-        discovered.add(relativeToPosix6(normalizedRoot, candidate));
+    for (const candidate of fs10.glob(featureRoot, pattern)) {
+      if (fs10.isFile(candidate)) {
+        discovered.add(relativeToPosix7(normalizedRoot, candidate));
       }
     }
   }
@@ -29703,7 +30472,7 @@ function discoverCanonicalEvidenceFiles(fs9, root, feature) {
 function parseVerificationEvidenceMarkdown(params) {
   const { feature, sourceFile, markdown } = params;
   const parsed = /* @__PURE__ */ new Map();
-  for (const rawLine of splitLines5(markdown)) {
+  for (const rawLine of splitLines6(markdown)) {
     const colonIndex = rawLine.indexOf(":");
     if (colonIndex === -1) {
       continue;
@@ -29713,10 +30482,14 @@ function parseVerificationEvidenceMarkdown(params) {
     if (REQUIRED_FIELDS.includes(key) && !parsed.has(key)) {
       parsed.set(key, value);
     }
+    if (key === EXPECTED_EXIT_CODE_FIELD && !parsed.has(key)) {
+      parsed.set(key, value);
+    }
   }
   const timestamp = parsed.get("Timestamp") ?? null;
   const command = parsed.get("Command") ?? null;
   const exitCodeRaw = parsed.get("EXIT_CODE");
+  const expectedExitCodeRaw = parsed.get(EXPECTED_EXIT_CODE_FIELD);
   if (!timestamp || !command || exitCodeRaw === void 0) {
     return {
       feature,
@@ -29724,7 +30497,8 @@ function parseVerificationEvidenceMarkdown(params) {
       timestamp,
       command,
       exitCode: null,
-      normalizedResult: "unparseable"
+      normalizedResult: "unparseable",
+      expectedExitCode: 0
     };
   }
   const exitCode = parseIntegerStrict(exitCodeRaw);
@@ -29735,24 +30509,41 @@ function parseVerificationEvidenceMarkdown(params) {
       timestamp,
       command,
       exitCode: null,
-      normalizedResult: "unparseable"
+      normalizedResult: "unparseable",
+      expectedExitCode: 0
+    };
+  }
+  const expectedExitCode = expectedExitCodeRaw === void 0 ? 0 : parseIntegerStrict(expectedExitCodeRaw);
+  if (expectedExitCode === null) {
+    return {
+      feature,
+      sourceFile,
+      timestamp,
+      command,
+      exitCode: null,
+      normalizedResult: "unparseable",
+      expectedExitCode: 0
     };
   }
-  const normalizedResult = exitCode === 0 ? "pass" : "fail";
+  const normalizedResult = normalizeResult(
+    exitCode,
+    expectedExitCode
+  );
   return {
     feature,
     sourceFile,
     timestamp,
     command,
     exitCode,
-    normalizedResult
+    normalizedResult,
+    expectedExitCode
   };
 }
 function parseVerificationEvidenceFile(params) {
-  const { fs: fs9, root, feature, relativePath: relativePath2 } = params;
+  const { fs: fs10, root, feature, relativePath: relativePath2 } = params;
   const normalizedRoot = toPosixPath2(root).replace(/\/+$/u, "");
   const relPosix = toPosixPath2(relativePath2).replace(/^\/+/u, "");
-  const markdown = fs9.readTextFile(`${normalizedRoot}/${relPosix}`);
+  const markdown = fs10.readTextFile(`${normalizedRoot}/${relPosix}`);
   return parseVerificationEvidenceMarkdown({
     feature,
     sourceFile: relPosix,
@@ -29765,7 +30556,7 @@ function parseIntegerStrict(value) {
   }
   return Number.parseInt(value, 10);
 }
-function relativeToPosix6(root, absolute) {
+function relativeToPosix7(root, absolute) {
   const normalized = toPosixPath2(absolute);
   if (normalized.startsWith(`${root}/`)) {
     return normalized.slice(root.length + 1);
@@ -29781,7 +30572,7 @@ function compareCodePoint5(left, right) {
   }
   return 0;
 }
-function splitLines5(value) {
+function splitLines6(value) {
   if (value === "") {
     return [];
   }
@@ -29814,15 +30605,15 @@ function extractFeatures3(changedFiles) {
   }
   return features;
 }
-function gatherFeatureExcerpts2(fs9, root, changedFiles) {
+function gatherFeatureExcerpts2(fs10, root, changedFiles) {
   const normalizedRoot = toPosixPath2(root).replace(/\/+$/u, "");
   const features = extractFeatures3(changedFiles);
   const excerpts = [];
   const baseDir = `${normalizedRoot}/docs/features/active`;
   const promotedDir = `${normalizedRoot}/docs/features/potential/promoted`;
   for (const feature of [...features].sort(compareCodePoint4)) {
-    const featureDir = resolveFeatureDir2(fs9, baseDir, feature);
-    const promotedFeatureDir = resolveFeatureDir2(fs9, promotedDir, feature);
+    const featureDir = resolveFeatureDir2(fs10, baseDir, feature);
+    const promotedFeatureDir = resolveFeatureDir2(fs10, promotedDir, feature);
     if (featureDir === null && promotedFeatureDir === null) {
       continue;
     }
@@ -29833,33 +30624,33 @@ function gatherFeatureExcerpts2(fs9, root, changedFiles) {
     const specPath = `${activeDir}/spec.md`;
     const issuePath = `${activeDir}/issue.md`;
     let planPath = `${activeDir}/plan.md`;
-    if (!fs9.exists(planPath)) {
-      const latestPlan = latestGlobPath(fs9, activeDir, "plan.*.md");
+    if (!fs10.exists(planPath)) {
+      const latestPlan = latestGlobPath(fs10, activeDir, "plan.*.md");
       if (latestPlan !== null) {
         planPath = latestPlan;
       }
     }
     let userStoryPath = `${activeDir}/user-story.md`;
     const promotedStoryPath = promotedFeatureDir !== null ? `${promotedFeatureDir}/user-story.md` : null;
-    const promotedStoryText = promotedStoryPath !== null ? readText(fs9, promotedStoryPath) : "";
-    if (promotedStoryPath !== null && !fs9.exists(userStoryPath)) {
+    const promotedStoryText = promotedStoryPath !== null ? readText(fs10, promotedStoryPath) : "";
+    if (promotedStoryPath !== null && !fs10.exists(userStoryPath)) {
       userStoryPath = promotedStoryPath;
     }
-    let userStoryText = readText(fs9, userStoryPath);
+    let userStoryText = readText(fs10, userStoryPath);
     if (!userStoryText && promotedStoryText && promotedStoryPath !== null) {
       userStoryText = promotedStoryText;
       userStoryPath = promotedStoryPath;
     }
-    const specText = readText(fs9, specPath);
-    const issueText = readText(fs9, issuePath);
-    const planText = readText(fs9, planPath);
+    const specText = readText(fs10, specPath);
+    const issueText = readText(fs10, issuePath);
+    const planText = readText(fs10, planPath);
     const primaryIssueRef = parsePrimaryIssueFromMetadata({
       specText,
       storyText: userStoryText,
       issueText
     });
     const [readinessSignal, readinessSource] = resolveReadinessSignal(
-      fs9,
+      fs10,
       activeDir
     );
     const specParts = buildSpecParts(specText);
@@ -29874,7 +30665,7 @@ function gatherFeatureExcerpts2(fs9, root, changedFiles) {
       verificationBlock
     );
     const contextFiles = buildContextFiles({
-      fs: fs9,
+      fs: fs10,
       root: normalizedRoot,
       feature,
       candidatePaths: [specPath, issuePath, planPath, userStoryPath],
@@ -29958,18 +30749,18 @@ function buildExcerpt(feature, storyParts, specParts, planSection, verificationB
   return lines.join("\n");
 }
 function buildContextFiles(params) {
-  const { fs: fs9, root, feature, candidatePaths, readinessSource } = params;
+  const { fs: fs10, root, feature, candidatePaths, readinessSource } = params;
   const contextFiles = [];
   for (const path11 of candidatePaths) {
-    if (fs9.exists(path11)) {
-      contextFiles.push(relativeToPosix5(root, path11));
+    if (fs10.exists(path11)) {
+      contextFiles.push(relativeToPosix6(root, path11));
     }
   }
   if (readinessSource !== null) {
-    contextFiles.push(relativeToPosix5(root, readinessSource));
+    contextFiles.push(relativeToPosix6(root, readinessSource));
   }
   const evidenceContextFiles = discoverCanonicalEvidenceFiles(
-    fs9,
+    fs10,
     root,
     feature
   );
@@ -30003,7 +30794,7 @@ function extractDigestBullets(body, headings, limit) {
     if (!sectionText) {
       continue;
     }
-    for (const line of splitLines2(sectionText)) {
+    for (const line of splitLines3(sectionText)) {
       if (!line.trim()) {
         continue;
       }
@@ -30144,7 +30935,7 @@ function parseNumstatDetailed(numstatText) {
   let addsTotal = 0;
   let delsTotal = 0;
   const perFile = /* @__PURE__ */ new Map();
-  for (const rawLine of splitLines2(numstatText)) {
+  for (const rawLine of splitLines3(numstatText)) {
     if (!rawLine.trim()) {
       continue;
     }
@@ -30163,7 +30954,7 @@ function parseNumstatDetailed(numstatText) {
 }
 function parseNameStatusMap(nameStatusText) {
   const mapping = /* @__PURE__ */ new Map();
-  for (const rawLine of splitLines2(nameStatusText)) {
+  for (const rawLine of splitLines3(nameStatusText)) {
     if (!rawLine.trim()) {
       continue;
     }
@@ -30182,7 +30973,7 @@ function isScopingDoc(path11) {
   return lowered.startsWith("docs/features/") && (lowered.endsWith("/spec.md") || lowered.endsWith("/plan.md") || lowered.endsWith("/bug-remediation-plan.md") || lowered.endsWith("/user-story.md") || lowered.endsWith("/readme.md"));
 }
 function scopingDocChanges(options) {
-  const { git, fs: fs9, mergeBase, headSha, root, nameStatusText, numstatDetails } = options;
+  const { git, fs: fs10, mergeBase, headSha, root, nameStatusText, numstatDetails } = options;
   if (!mergeBase || !headSha) {
     return [];
   }
@@ -30211,7 +31002,7 @@ function scopingDocChanges(options) {
       path11
     ]);
     let headingTouched = false;
-    for (const line of splitLines2(diffText)) {
+    for (const line of splitLines3(diffText)) {
       if (!line.startsWith("+") || line.startsWith("+++")) {
         continue;
       }
@@ -30227,7 +31018,7 @@ function scopingDocChanges(options) {
       material = true;
       reasons.push("key section touched");
     }
-    const addedLines = splitLines2(diffText).filter((line) => line.startsWith("+") && !line.startsWith("+++")).map((line) => line.replace(/^\++/u, "").trim());
+    const addedLines = splitLines3(diffText).filter((line) => line.startsWith("+") && !line.startsWith("+++")).map((line) => line.replace(/^\++/u, "").trim());
     if (addedLines.length > 0 && addedLines.every(
       (line) => !line || line.startsWith("[") || line.startsWith("http")
     )) {
@@ -30238,8 +31029,8 @@ function scopingDocChanges(options) {
     }
     let excerpt = null;
     const docPath = `${stripTrailingSlash(root)}/${path11}`;
-    if (material && fs9.exists(docPath)) {
-      const content = fs9.readTextFile(docPath);
+    if (material && fs10.exists(docPath)) {
+      const content = fs10.readTextFile(docPath);
       const excerptParts = [];
       for (const heading of SCOPING_EXCERPT_HEADINGS) {
         const sectionText = parseSection3(content, heading);
@@ -30315,16 +31106,16 @@ function isDigits2(value) {
 var SUMMARY_CHAR_BUDGET = 16e4;
 var APPENDIX_CHAR_BUDGET = 48e4;
 function collectPrContext(options) {
-  const { base, repoRoot, includeUntracked, fs: fs9, runner } = options;
+  const { base, repoRoot, includeUntracked, fs: fs10, runner } = options;
   const head = options.head ?? null;
   const whichGh = options.whichGh;
-  let git = new GitClient(runner, repoRoot, fs9);
+  let git = new GitClient(runner, repoRoot, fs10);
   const resolvedRoot = git.resolveRoot();
-  git = new GitClient(runner, resolvedRoot, fs9);
+  git = new GitClient(runner, resolvedRoot, fs10);
   const gh = new GhClient({
     runner,
     cwd: resolvedRoot,
-    fileSystem: fs9,
+    fileSystem: fs10,
     ...whichGh === void 0 ? {} : { whichGh }
   });
   let ghAvailable = true;
@@ -30347,7 +31138,7 @@ function collectPrContext(options) {
     ghAvailable
   });
   const changedPaths = extractChangedPaths(contextResult.text);
-  const featureDocs = gatherFeatureExcerpts2(fs9, resolvedRoot, changedPaths);
+  const featureDocs = gatherFeatureExcerpts2(fs10, resolvedRoot, changedPaths);
   const additionalContextFiles = sortedSet3(
     featureDocs.flatMap((doc) => doc.contextFiles).filter((path11) => path11)
   );
@@ -30460,7 +31251,7 @@ function collectPrContext(options) {
   const statusMap = parseNameStatusMap(nameStatusText);
   const scopingChanges = scopingDocChanges({
     git,
-    fs: fs9,
+    fs: fs10,
     mergeBase: contextResult.mergeBase,
     headSha: contextResult.headSha,
     root: resolvedRoot,
@@ -30594,7 +31385,7 @@ function compareCodePoint6(left, right) {
 }
 
 // ../../extensions/drm-copilot/src/lib/pr-context/collector-output.ts
-function renderVerificationEvidenceSection(fs9, resolvedRoot, featureDocs) {
+function renderVerificationEvidenceSection(fs10, resolvedRoot, featureDocs) {
   const records = [];
   for (const doc of featureDocs) {
     for (const rawPath of doc.contextFiles) {
@@ -30605,7 +31396,7 @@ function renderVerificationEvidenceSection(fs9, resolvedRoot, featureDocs) {
       try {
         records.push(
           parseVerificationEvidenceFile({
-            fs: fs9,
+            fs: fs10,
             root: resolvedRoot,
             feature: doc.feature,
             relativePath: normalized
@@ -30627,18 +31418,21 @@ function renderVerificationEvidenceSection(fs9, resolvedRoot, featureDocs) {
     (left, right) => left.sourceFile < right.sourceFile ? -1 : left.sourceFile > right.sourceFile ? 1 : 0
   );
   for (const record2 of sorted) {
+    const expected = record2.expectedExitCode;
+    const expectedRows = expected === 0 ? [] : [`  - Expected EXIT_CODE: ${String(expected)}`];
     lines.push(
       `- Feature: ${record2.feature}`,
       `  - Source: ${record2.sourceFile}`,
       `  - Timestamp: ${record2.timestamp}`,
       `  - Command: ${record2.command}`,
       `  - EXIT_CODE: ${record2.exitCode}`,
+      ...expectedRows,
       `  - Normalized result: ${record2.normalizedResult}`
     );
   }
   return lines.join("\n");
 }
-function buildSummaryText(collected, fs9, appendixPath) {
+function buildSummaryText(collected, fs10, appendixPath) {
   const ctx = collected.contextResult;
   const ghStatusText = resolveGhStatusText(collected);
   const intentBlock = [
@@ -30668,7 +31462,7 @@ function buildSummaryText(collected, fs9, appendixPath) {
   const prDigests = collected.prDetailsList.map((detail) => prDigest(detail)).join("\n\n");
   const featureSummary = buildFeatureSummary(collected.featureDocs);
   const verificationEvidenceSection = renderVerificationEvidenceSection(
-    fs9,
+    fs10,
     collected.resolvedRoot,
     collected.featureDocs
   );
@@ -30753,16 +31547,16 @@ function buildAppendixText(collected, clock) {
   }
   return appendixText;
 }
-function writeOutput(fs9, text, outPath, append) {
+function writeOutput(fs10, text, outPath, append) {
   const parent = parentDir(outPath);
   if (parent) {
-    fs9.ensureDir(parent);
+    fs10.ensureDir(parent);
   }
-  if (append && fs9.isFile(outPath)) {
-    const existing = fs9.readTextFile(outPath);
-    fs9.writeTextFile(outPath, existing + text);
+  if (append && fs10.isFile(outPath)) {
+    const existing = fs10.readTextFile(outPath);
+    fs10.writeTextFile(outPath, existing + text);
   } else {
-    fs9.writeTextFile(outPath, text);
+    fs10.writeTextFile(outPath, text);
   }
 }
 function collectAndWrite(options) {
@@ -31206,7 +32000,7 @@ function normalizeSmartPunctuation(text) {
 var nodePath7 = __toESM(require("node:path"));
 
 // ../../extensions/drm-copilot/src/lib/potential-to-issue/promotion-filesystem.ts
-var fs6 = __toESM(require("node:fs"));
+var fs7 = __toESM(require("node:fs"));
 var nodeOs = __toESM(require("node:os"));
 var nodePath6 = __toESM(require("node:path"));
 var RealPotentialFileSystem = class {
@@ -31223,24 +32017,24 @@ var RealPotentialFileSystem = class {
   }
   /** @returns True when `path` exists. */
   exists(path11) {
-    return fs6.existsSync(path11);
+    return fs7.existsSync(path11);
   }
   /** @returns The UTF-8 file content. */
   readText(path11) {
-    return fs6.readFileSync(path11, "utf8");
+    return fs7.readFileSync(path11, "utf8");
   }
   /** Write `lines` joined with `\n` as UTF-8 text. */
   writeLines(path11, lines) {
-    fs6.writeFileSync(path11, lines.join("\n"), "utf8");
+    fs7.writeFileSync(path11, lines.join("\n"), "utf8");
   }
   /** Create `path` and any missing parents (idempotent). */
   ensureDir(path11) {
-    fs6.mkdirSync(path11, { recursive: true });
+    fs7.mkdirSync(path11, { recursive: true });
   }
   /** Move `src` to `dest`, ensuring the destination parent exists first. */
   move(src, dest) {
-    fs6.mkdirSync(nodePath6.dirname(dest), { recursive: true });
-    fs6.renameSync(src, dest);
+    fs7.mkdirSync(nodePath6.dirname(dest), { recursive: true });
+    fs7.renameSync(src, dest);
   }
 };
 
@@ -31465,12 +32259,13 @@ var CommandRunnerGhAdapter = class {
 };
 function potentialToIssueServiceCall(input) {
   const ghClient = input.gh ?? new RealGhClient({ runner: new CommandRunnerGhAdapter(input.runner) });
+  const fileSystem = input.fileSystem ?? new RealPotentialFileSystem();
   const outcome = promotePotential({
     potentialPath: input.potentialPath,
     promotionType: input.promotionType,
     workMode: input.workMode,
     workspace: input.workspaceRoot,
-    fs: input.fileSystem ?? new RealPotentialFileSystem(),
+    fs: fileSystem,
     gh: ghClient,
     ...input.log === void 0 ? {} : { emit: input.log }
   });
@@ -31481,6 +32276,11 @@ ${outcome.messages.join("\n")}` : "";
   }
   const summary = `Promoted '${input.potentialPath}' as a ${input.promotionType} workflow in ${input.workMode} mode.`;
   const [issueUrl] = parseIssueReference(outcome.messages);
+  if (outcome.destination !== void 0 && !fileSystem.exists(outcome.destination)) {
+    throw new Error(
+      `potential_to_issue reported a path that does not exist: ${outcome.destination}`
+    );
+  }
   return {
     tool: "potential_to_issue",
     workspaceRoot: input.workspaceRoot,
@@ -31667,12 +32467,12 @@ function validateFeatureName2(featureName) {
 function escapeRegExp6(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function splitLines6(text) {
+function splitLines7(text) {
   return text.split(/\r\n|\r|\n/);
 }
 function formatChecklist(text) {
   const lines = [];
-  for (const rawLine of splitLines6(text)) {
+  for (const rawLine of splitLines7(text)) {
     const trimmed = rawLine.trim();
     if (!trimmed) {
       continue;
@@ -31701,7 +32501,7 @@ function getSection2(content, name) {
 function upsertWorkModeMarker(content, mode) {
   const markerLine = `- Work Mode: ${mode}`;
   const markerPattern = /^- Work Mode:\s*(minor-audit|full-feature|full-bug|full)\s*$/;
-  const lines = splitLines6(content).filter((line) => !markerPattern.test(line));
+  const lines = splitLines7(content).filter((line) => !markerPattern.test(line));
   for (let idx = 0; idx < lines.length; idx += 1) {
     const line = lines[idx] ?? "";
     if (line.replace(/^\s+/, "").startsWith("## ")) {
@@ -31886,7 +32686,7 @@ function replaceRegexLiteral(source, pattern, replacement) {
 }
 
 // ../../extensions/drm-copilot/src/lib/new-active-feature-folder/io-launcher.ts
-var fs7 = __toESM(require("node:fs"));
+var fs8 = __toESM(require("node:fs"));
 var nodePath9 = __toESM(require("node:path"));
 var INSIDERS_SIGNAL_NAMES2 = [
   "TERM_PROGRAM_VERSION",
@@ -31904,7 +32704,7 @@ function defaultWhichLookup2(executable) {
         directory,
         process.platform === "win32" ? `${executable}${extension}` : executable
       );
-      if (fs7.existsSync(candidate)) {
+      if (fs8.existsSync(candidate)) {
         return candidate;
       }
     }
@@ -31973,14 +32773,14 @@ function stem(path11) {
   const ext = suffix(path11);
   return ext ? name.slice(0, name.length - ext.length) : name;
 }
-function findPotentialFile(featureName, workspace2, fs9) {
+function findPotentialFile(featureName, workspace2, fs10) {
   const normalized = featureName.replace(/_/g, "-");
   const potentialDirs = [
     joinPosix13(workspace2, "docs/features/potential"),
     joinPosix13(workspace2, "docs/features/potential/promoted")
   ];
   for (const directory of potentialDirs) {
-    const candidates = fs9.listFiles(directory).filter(
+    const candidates = fs10.listFiles(directory).filter(
       (file) => suffix(file) === ".md" && baseName(file).includes(normalized) && !EXCLUDED_POTENTIAL_NAMES.has(baseName(file))
     );
     if (candidates.length > 0) {
@@ -32011,12 +32811,12 @@ function buildFolderSlug(featureName, potentialFile, issueNumber) {
   }
   return slug;
 }
-function copyTemplate(featureType, templateDir, targetDir, fs9) {
+function copyTemplate(featureType, templateDir, targetDir, fs10) {
   if (featureType === "bug") {
     for (const name of ["spec.md", PLAN_TIMESTAMP_TEMPLATE_NAME, "plan.md"]) {
       const src = joinPosix13(templateDir, name);
-      if (fs9.exists(src)) {
-        fs9.copyFile(src, joinPosix13(targetDir, name));
+      if (fs10.exists(src)) {
+        fs10.copyFile(src, joinPosix13(targetDir, name));
         if (name === PLAN_TIMESTAMP_TEMPLATE_NAME) {
           break;
         }
@@ -32025,35 +32825,35 @@ function copyTemplate(featureType, templateDir, targetDir, fs9) {
   } else if (featureType === "epic") {
     for (const name of ["epic.md", "epic-status.md"]) {
       const src = joinPosix13(templateDir, name);
-      if (fs9.exists(src)) {
-        fs9.copyFile(src, joinPosix13(targetDir, name));
+      if (fs10.exists(src)) {
+        fs10.copyFile(src, joinPosix13(targetDir, name));
       }
     }
   } else {
-    fs9.copyTree(templateDir, targetDir);
+    fs10.copyTree(templateDir, targetDir);
   }
 }
-function copyFeatureTemplateForMinorAudit(templateDir, targetDir, fs9) {
+function copyFeatureTemplateForMinorAudit(templateDir, targetDir, fs10) {
   const timestampedPlan = joinPosix13(templateDir, PLAN_TIMESTAMP_TEMPLATE_NAME);
-  if (fs9.exists(timestampedPlan)) {
-    fs9.copyFile(
+  if (fs10.exists(timestampedPlan)) {
+    fs10.copyFile(
       timestampedPlan,
       joinPosix13(targetDir, PLAN_TIMESTAMP_TEMPLATE_NAME)
     );
     return;
   }
   const legacyPlan = joinPosix13(templateDir, "plan.md");
-  if (fs9.exists(legacyPlan)) {
-    fs9.copyFile(legacyPlan, joinPosix13(targetDir, "plan.md"));
+  if (fs10.exists(legacyPlan)) {
+    fs10.copyFile(legacyPlan, joinPosix13(targetDir, "plan.md"));
   }
 }
-function materializePlanFile(featureType, targetDir, featureName, issueField, ownerField, parentField, statusField, versionField, planTimestamp, fs9) {
+function materializePlanFile(featureType, targetDir, featureName, issueField, ownerField, parentField, statusField, versionField, planTimestamp, fs10) {
   void featureType;
   const templatePlan = joinPosix13(targetDir, PLAN_TIMESTAMP_TEMPLATE_NAME);
-  if (fs9.exists(templatePlan)) {
+  if (fs10.exists(templatePlan)) {
     const targetPlan = joinPosix13(targetDir, `plan.${planTimestamp}.md`);
-    fs9.move(templatePlan, targetPlan);
-    let content = fs9.readText(targetPlan);
+    fs10.move(templatePlan, targetPlan);
+    let content = fs10.readText(targetPlan);
     const updatedField = planTimestamp;
     content = setHeaderPlaceholder(
       content,
@@ -32065,11 +32865,11 @@ function materializePlanFile(featureType, targetDir, featureName, issueField, ow
       parentField,
       versionField
     );
-    fs9.writeText(targetPlan, content);
+    fs10.writeText(targetPlan, content);
     return targetPlan;
   }
   const legacy = joinPosix13(targetDir, "plan.md");
-  if (fs9.exists(legacy)) {
+  if (fs10.exists(legacy)) {
     return legacy;
   }
   return null;
@@ -32114,11 +32914,11 @@ function defaultIssueFetcher(issueNumber, runner, ghLookup = defaultGhLookup) {
 }
 
 // ../../extensions/drm-copilot/src/lib/new-active-feature-folder/docs.ts
-function applyHeaderAndSections(path11, featureName, issueField, ownerField, updatedField, parentField, statusField, versionField, fs9, updates) {
-  if (!fs9.exists(path11)) {
+function applyHeaderAndSections(path11, featureName, issueField, ownerField, updatedField, parentField, statusField, versionField, fs10, updates) {
+  if (!fs10.exists(path11)) {
     return;
   }
-  let content = fs9.readText(path11);
+  let content = fs10.readText(path11);
   content = setHeaderPlaceholder(
     content,
     featureName,
@@ -32132,9 +32932,9 @@ function applyHeaderAndSections(path11, featureName, issueField, ownerField, upd
   for (const [sectionName, body] of updates) {
     content = setSection(content, sectionName, body);
   }
-  fs9.writeText(path11, content);
+  fs10.writeText(path11, content);
 }
-function updateFeatureDocs(featureType, featureName, targetDir, issueField, ownerField, updatedField, parentField, statusField, versionField, planUpdatedField, fs9, sections, planPath) {
+function updateFeatureDocs(featureType, featureName, targetDir, issueField, ownerField, updatedField, parentField, statusField, versionField, planUpdatedField, fs10, sections, planPath) {
   const filesToOpen = [];
   const get = (key) => sections[key] ?? "";
   if (featureType === "feature") {
@@ -32150,7 +32950,7 @@ function updateFeatureDocs(featureType, featureName, targetDir, issueField, owne
       parentField,
       statusField,
       versionField,
-      fs9,
+      fs10,
       [
         ["Problem / Why", get("problem")],
         ["Acceptance Criteria", formatChecklist(get("criteria"))]
@@ -32165,7 +32965,7 @@ function updateFeatureDocs(featureType, featureName, targetDir, issueField, owne
       parentField,
       statusField,
       versionField,
-      fs9,
+      fs10,
       [
         ["Overview", get("problem")],
         ["Behavior", get("behavior")],
@@ -32185,7 +32985,7 @@ function updateFeatureDocs(featureType, featureName, targetDir, issueField, owne
       parentField,
       statusField,
       versionField,
-      fs9,
+      fs10,
       []
     );
     filesToOpen.push(userStory, spec, plan);
@@ -32201,7 +33001,7 @@ function updateFeatureDocs(featureType, featureName, targetDir, issueField, owne
       parentField,
       statusField,
       versionField,
-      fs9,
+      fs10,
       [
         ["Intent & Outcomes", get("problem")],
         ["Scope (structural changes)", get("behavior")],
@@ -32221,7 +33021,7 @@ function updateFeatureDocs(featureType, featureName, targetDir, issueField, owne
       parentField,
       statusField,
       versionField,
-      fs9,
+      fs10,
       []
     );
     filesToOpen.push(spec, plan);
@@ -32236,7 +33036,7 @@ function updateFeatureDocs(featureType, featureName, targetDir, issueField, owne
       parentField,
       statusField,
       versionField,
-      fs9,
+      fs10,
       []
     );
     filesToOpen.push(epic);
@@ -32298,11 +33098,11 @@ ${get("bug_logs")}`);
       parentField,
       statusField,
       versionField,
-      fs9,
+      fs10,
       updates
     );
     if (bugValidation) {
-      let specContent = fs9.readText(spec);
+      let specContent = fs10.readText(spec);
       const updateTestStrategy = (body) => prependToSectionBody(body, `Seeded from issue:
 
 ${bugValidation}`);
@@ -32311,7 +33111,7 @@ ${bugValidation}`);
         "Test Strategy",
         updateTestStrategy
       );
-      fs9.writeText(spec, specContent);
+      fs10.writeText(spec, specContent);
     }
     applyHeaderAndSections(
       plan,
@@ -32322,7 +33122,7 @@ ${bugValidation}`);
       parentField,
       statusField,
       versionField,
-      fs9,
+      fs10,
       []
     );
     filesToOpen.push(spec, plan);
@@ -32393,6 +33193,7 @@ function createActiveFolder(options) {
     filesystem
   );
   const potentialContent = potentialFile ? filesystem.readText(potentialFile) : "";
+  const retainsPotentialSource = potentialFile !== null && isPromotedPotentialSource(potentialFile, workspacePath);
   const selectedWorkMode = normalizeRequestedWorkMode(workMode, featureType);
   const [useMinorAudit, fallbackReason] = shouldUseMinorAuditMode(
     selectedWorkMode,
@@ -32480,7 +33281,11 @@ function createActiveFolder(options) {
   if (useMinorAudit) {
     if (potentialFile) {
       potentialIssuePath = joinPosix13(targetDir, "issue.md");
-      filesystem.move(potentialFile, potentialIssuePath);
+      if (retainsPotentialSource) {
+        filesystem.copyFile(potentialFile, potentialIssuePath);
+      } else {
+        filesystem.move(potentialFile, potentialIssuePath);
+      }
       const movedContent = filesystem.readText(potentialIssuePath);
       filesystem.writeText(
         potentialIssuePath,
@@ -32536,17 +33341,25 @@ function createActiveFolder(options) {
   if (potentialFile) {
     if (useMinorAudit) {
       if (potentialIssuePath !== null) {
-        emit(`Moved potential file to ${potentialIssuePath}`);
+        emit(
+          retainsPotentialSource ? `Copied potential file to ${potentialIssuePath}` : `Moved potential file to ${potentialIssuePath}`
+        );
       }
     } else {
       potentialIssuePath = joinPosix13(targetDir, "issue.md");
-      filesystem.move(potentialFile, potentialIssuePath);
+      if (retainsPotentialSource) {
+        filesystem.copyFile(potentialFile, potentialIssuePath);
+      } else {
+        filesystem.move(potentialFile, potentialIssuePath);
+      }
       const movedContent = filesystem.readText(potentialIssuePath);
       filesystem.writeText(
         potentialIssuePath,
         upsertWorkModeMarker(movedContent, selectedWorkMode)
       );
-      emit(`Moved potential file to ${potentialIssuePath}`);
+      emit(
+        retainsPotentialSource ? `Copied potential file to ${potentialIssuePath}` : `Moved potential file to ${potentialIssuePath}`
+      );
     }
   }
   if (potentialFile) {
@@ -32585,6 +33398,12 @@ function isRelativeTo(child, root) {
   const normalizedRoot = toPosixPath2(root);
   return normalizedChild === normalizedRoot || normalizedChild.startsWith(`${normalizedRoot}/`);
 }
+function isPromotedPotentialSource(potentialPath, workspacePath) {
+  return isRelativeTo(
+    potentialPath,
+    joinPosix13(workspacePath, "docs/features/potential/promoted")
+  );
+}
 function posixBaseName(path11) {
   const normalized = toPosixPath2(path11).replace(/\/+$/, "");
   const slash = normalized.lastIndexOf("/");
@@ -32597,7 +33416,15 @@ function posixStem2(path11) {
 }
 
 // ../../extensions/drm-copilot/src/lib/new-active-feature-folder/new-active-feature-folder-service-call.ts
+function requireReportedPathExists(fileSystem, path11) {
+  if (!fileSystem.exists(path11)) {
+    throw new Error(
+      `new_active_feature_folder reported a path that does not exist: ${path11}`
+    );
+  }
+}
 function newActiveFeatureFolderServiceCall(input) {
+  const fileSystem = input.fileSystem ?? new RealFolderFileSystem();
   const result = createActiveFolder({
     featureName: input.featureName,
     featureType: input.type,
@@ -32605,13 +33432,17 @@ function newActiveFeatureFolderServiceCall(input) {
     workMode: input.workMode,
     workspace: input.workspaceRoot,
     templateRoot: input.templateRoot,
-    fs: input.fileSystem ?? new RealFolderFileSystem(),
+    fs: fileSystem,
     // Route the guarded gh issue fetch through the injected F1 runner.
     issueFetcher: (issueNumber) => defaultIssueFetcher(issueNumber, input.runner),
     // No-op launcher: the MCP/non-interactive path must never open an editor.
     codeLauncher: () => false,
     ...input.log === void 0 ? {} : { emit: input.log }
   });
+  requireReportedPathExists(fileSystem, result.target);
+  if (result.potentialIssuePath !== null) {
+    requireReportedPathExists(fileSystem, result.potentialIssuePath);
+  }
   return {
     tool: "new_active_feature_folder",
     workspaceRoot: input.workspaceRoot,
@@ -33388,7 +34219,7 @@ function readPackageVersion(extensionRoot) {
   const packageJsonPath = path10.join(extensionRoot, "package.json");
   try {
     const packageJson = JSON.parse(
-      fs8.readFileSync(packageJsonPath, "utf-8")
+      fs9.readFileSync(packageJsonPath, "utf-8")
     );
     return packageJson.version ?? "0.0.1";
   } catch {