@danmoisan/drm-copilot-mcp 1.0.26 → 1.1.0

package/resources/claude-customizations/.claude/hooks/enforce-promotion-mcp-only.ps1

@@ -4,8 +4,8 @@
 
 .DESCRIPTION
     This script is invoked by the Claude Code PreToolUse hook before any Bash
-    command runs. It reads the tool input from the CLAUDE_TOOL_INPUT environment
-    variable, inspects the attempted command text, and blocks direct promotion
+    command runs. It acquires the hook payload through the shared reader and reads
+    the command from the envelope's nested tool_input, then blocks direct promotion
     script execution that would bypass the repository's MCP-only promotion path.
 
     Forbidden command tokens (legacy promotion-script bypass):
@@ -29,6 +29,8 @@
 [CmdletBinding()]
 param()
 
+
+Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
 $script:PromotionMcpOnlyBlockedReason = 'PROMOTION_MCP_ONLY_BLOCKED: Direct Bash promotion-script execution is not allowed in agent sessions. Use the drm-copilot MCP promotion tools instead.'
 
 $script:PromotionMcpOnlyGhIssueBlockedReason = 'PROMOTION_MCP_ONLY_BLOCKED: Direct GitHub issue creation via `gh` bypasses the approved drm-copilot MCP promotion path (`mcp__drm-copilot__new_potential_entry` -> `mcp__drm-copilot__potential_to_issue` -> `mcp__drm-copilot__new_active_feature_folder`). Use those MCP tools instead.'
@@ -70,7 +72,7 @@ function Get-PromotionBypassReason {
         Returns the gh-CLI issue creation reason when a forbidden gh pattern is matched.
         Returns $null when the command is allowed.
     .PARAMETER CommandText
-        The Bash command text extracted from CLAUDE_TOOL_INPUT.
+        The Bash command text extracted from the envelope's tool_input.
     .OUTPUTS
         System.String or $null.
     #>
@@ -118,7 +120,7 @@ function Test-PromotionBypassToken {
     .SYNOPSIS
         Return $true when a Bash command contains a forbidden promotion bypass pattern.
     .PARAMETER CommandText
-        The Bash command text extracted from CLAUDE_TOOL_INPUT.
+        The Bash command text extracted from the envelope's tool_input.
     .OUTPUTS
         System.Boolean
     #>
@@ -183,7 +185,7 @@ function Get-PromotionMcpOnlyAllowDecision {
 function Invoke-PromotionMcpOnlyDecision {
     <#
     .SYNOPSIS
-        Parse CLAUDE_TOOL_INPUT and return an allow-or-block decision.
+        Parse the PreToolUse envelope and return an allow-or-block decision.
     .PARAMETER ToolInputRaw
         The raw JSON tool payload supplied by Claude Code.
     .OUTPUTS
@@ -198,17 +200,15 @@ function Invoke-PromotionMcpOnlyDecision {
         [string] $ToolInputRaw
     )
 
-    if (-not $ToolInputRaw) {
-        return Get-PromotionMcpOnlyAllowDecision
-    }
-
-    try {
-        $toolInput = $ToolInputRaw | ConvertFrom-Json -ErrorAction Stop
-    } catch {
-        throw "enforce-promotion-mcp-only hook received malformed JSON in CLAUDE_TOOL_INPUT: $_"
+    $payload = Resolve-ClaudeHookToolInput -Raw $ToolInputRaw
+    if (-not $payload.IsValid) {
+        return Get-PromotionMcpOnlyBlockDecision -Reason (
+            'PROMOTION_MCP_ONLY_BLOCKED: payload anomaly - ' +
+            (Get-ClaudeHookPayloadAnomalyReason -Anomaly $payload.Anomaly) +
+            '. The gate fails closed on an envelope it cannot read.')
     }
 
-    $commandText = $toolInput.command
+    $commandText = Get-ClaudeHookToolInputString -ToolInput $payload.Value -Name 'command'
     if (-not $commandText) {
         return Get-PromotionMcpOnlyAllowDecision
     }
@@ -221,18 +221,55 @@ function Invoke-PromotionMcpOnlyDecision {
     return Get-PromotionMcpOnlyAllowDecision
 }
 
+function Invoke-PromotionMcpOnlyEntryPoint {
+    <#
+    .SYNOPSIS
+        Runs the hook decision and returns the process exit code.
+    .DESCRIPTION
+        Acquires the payload through the shared reader unless the caller supplies
+        one, emits the compact decision JSON, and returns 0. It never returns 1:
+        exit 1 is non-blocking for PreToolUse, so every anomaly is already a deny
+        decision by the time control reaches here. The function does not call exit;
+        the thin tail converts the returned code into a process exit.
+    .PARAMETER ToolInputRaw
+        Optional pre-acquired payload text. When omitted the ReadPayload seam runs.
+    .PARAMETER ReadPayload
+        Seam for payload acquisition, so tests can drive the empty-on-all-transports
+        case without touching a console.
+    .OUTPUTS
+        System.Int32
+    #>
+    [CmdletBinding()]
+    [OutputType([int])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $ToolInputRaw,
+
+        [scriptblock] $ReadPayload = { Read-ClaudeHookRawPayload }
+    )
+
+    if (-not $PSBoundParameters.ContainsKey('ToolInputRaw')) {
+        $ToolInputRaw = [string](& $ReadPayload)
+    }
+
+    $decision = Invoke-PromotionMcpOnlyDecision -ToolInputRaw $ToolInputRaw
+    $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+
+    return 0
+}
+
 # Allow dot-sourcing in tests without executing the entrypoint.
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
 
-try {
-    $decision = Invoke-PromotionMcpOnlyDecision -ToolInputRaw $env:CLAUDE_TOOL_INPUT
-} catch {
-    Write-Error $_
-    exit 1
+# The entry point returns its [int] exit code as the last pipeline element and the
+# decision JSON before it. `exit (<call>)` would capture BOTH into the exit
+# expression and emit nothing, so the decision is written explicitly here first.
+$entryPointResult = @(Invoke-PromotionMcpOnlyEntryPoint)
+if ($entryPointResult.Count -gt 1) {
+    $entryPointResult[0..($entryPointResult.Count - 2)] | Write-Output
 }
 
-$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
-
-exit 0
+exit ([int]$entryPointResult[-1])

package/resources/claude-customizations/.claude/hooks/enforce-python-batch-budget.ps1

@@ -34,6 +34,8 @@
 [CmdletBinding()]
 param()
 
+
+Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
 function Get-PythonBatchBudgetState {
     [CmdletBinding()]
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
@@ -162,17 +164,15 @@ function Invoke-PythonBatchBudgetHook {
         }
     )
 
-    if (-not $ToolInputRaw) {
-        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
-    }
-
-    try {
-        $toolInput = $ToolInputRaw | ConvertFrom-Json -ErrorAction Stop
-    } catch {
-        return Get-PythonBatchBudgetBlockDecision -Reason 'Python batch-budget hook received malformed JSON in CLAUDE_TOOL_INPUT.'
+    $payload = Resolve-ClaudeHookToolInput -Raw $ToolInputRaw
+    if (-not $payload.IsValid) {
+        return Get-PythonBatchBudgetBlockDecision -Reason (
+            'Python batch-budget hook received an unreadable PreToolUse envelope: ' +
+            (Get-ClaudeHookPayloadAnomalyReason -Anomaly $payload.Anomaly) +
+            '. The gate fails closed on an envelope it cannot read.')
     }
 
-    $filePath = $toolInput.file_path
+    $filePath = Get-ClaudeHookToolInputString -ToolInput $payload.Value -Name 'file_path'
     if (-not $filePath) {
         return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
@@ -211,28 +211,71 @@ function Invoke-PythonBatchBudgetHook {
     return $decision
 }
 
-if ($MyInvocation.InvocationName -eq '.') {
-    return
-}
+function Invoke-PythonBatchBudgetEntryPoint {
+    <#
+    .SYNOPSIS
+        Runs the Python batch-budget decision and returns the process exit code.
+    .DESCRIPTION
+        Wraps the dispatch logic that the hook entry point performs so it can be
+        exercised by unit tests. It acquires the payload through the shared reader
+        unless the caller supplies one, writes the compact JSON decision to the output
+        stream only when the decision is a deny (this hook is deny-only: an allow
+        decision emits nothing), and returns 0. This function does not call exit; the
+        thin entry-point wiring converts the returned code into a process exit.
+    .PARAMETER ToolInputRaw
+        Optional pre-acquired payload text. When omitted the ReadPayload seam runs.
+    .PARAMETER ReadPayload
+        Seam for payload acquisition, so tests can drive the empty-on-all-transports
+        case without touching a console.
+    #>
+    [CmdletBinding()]
+    [OutputType([int])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $ToolInputRaw,
 
-$sessionId = $env:CLAUDE_SESSION_ID
-if (-not $sessionId) {
-    $sessionId = 'default'
-}
+        [scriptblock] $ReadPayload = { Read-ClaudeHookRawPayload }
+    )
 
-$prodCap = 3
-$testCap = 3
-if ($env:CLAUDE_PYTHON_BUDGET_PROD -match '^\d+$') {
-    $prodCap = [int]$env:CLAUDE_PYTHON_BUDGET_PROD
+    if (-not $PSBoundParameters.ContainsKey('ToolInputRaw')) {
+        $ToolInputRaw = [string](& $ReadPayload)
+    }
+
+    $sessionId = $env:CLAUDE_SESSION_ID
+    if (-not $sessionId) {
+        $sessionId = 'default'
+    }
+
+    $prodCap = 3
+    $testCap = 3
+    if ($env:CLAUDE_PYTHON_BUDGET_PROD -match '^\d+$') {
+        $prodCap = [int]$env:CLAUDE_PYTHON_BUDGET_PROD
+    }
+    if ($env:CLAUDE_PYTHON_BUDGET_TEST -match '^\d+$') {
+        $testCap = [int]$env:CLAUDE_PYTHON_BUDGET_TEST
+    }
+
+    $decision = Invoke-PythonBatchBudgetHook -ToolInputRaw $ToolInputRaw -SessionId $sessionId -ProdCap $prodCap -TestCap $testCap
+    if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {
+        $decision.Remove('state')
+        $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+    }
+
+    return 0
 }
-if ($env:CLAUDE_PYTHON_BUDGET_TEST -match '^\d+$') {
-    $testCap = [int]$env:CLAUDE_PYTHON_BUDGET_TEST
+
+# Guard allows dot-sourcing in tests without executing the entrypoint.
+if ($MyInvocation.InvocationName -eq '.') {
+    return
 }
 
-$decision = Invoke-PythonBatchBudgetHook -ToolInputRaw $env:CLAUDE_TOOL_INPUT -SessionId $sessionId -ProdCap $prodCap -TestCap $testCap
-if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {
-    $decision.Remove('state')
-    $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+# The entry point returns its [int] exit code as the last pipeline element and the
+# decision JSON before it. `exit (<call>)` would capture BOTH into the exit
+# expression and emit nothing, so the decision is written explicitly here first.
+$entryPointResult = @(Invoke-PythonBatchBudgetEntryPoint)
+if ($entryPointResult.Count -gt 1) {
+    $entryPointResult[0..($entryPointResult.Count - 2)] | Write-Output
 }
 
-exit 0
+exit ([int]$entryPointResult[-1])

package/resources/claude-customizations/.claude/hooks/validate-bash.ps1

@@ -4,13 +4,14 @@
 
 .DESCRIPTION
     This script is invoked by the Claude Code PreToolUse hook before any Bash
-    command is executed. It reads the proposed command string from the
-    CLAUDE_TOOL_INPUT (or CLAUDE_HOOK_INPUT) environment variable (JSON with a
-    'command' field) or falls back to the first positional argument. If the
-    command matches any blocked pattern (destructive operations such as forced
-    deletions, forced pushes, or hard resets), the script writes a PreToolUse
-    deny decision to stdout and exits with code 0. The deny decision uses the
-    Claude Code PreToolUse schema:
+    command is executed. It acquires the hook payload through the shared reader
+    (.claude/lib/hook-payload/HookPayload.psm1: stdin first, then the two
+    environment-variable fallbacks) and reads the proposed command string from the
+    envelope's nested tool_input.command, or falls back to the first positional
+    argument. If the command matches any blocked pattern (destructive operations
+    such as forced deletions, forced pushes, or hard resets), the script writes a
+    PreToolUse deny decision to stdout and exits with code 0. The deny decision
+    uses the Claude Code PreToolUse schema:
 
         {"hookSpecificOutput":{"hookEventName":"PreToolUse",
          "permissionDecision":"deny","permissionDecisionReason":"<reason>"}}
@@ -20,6 +21,13 @@
     deny-path 'exit 1' are intentionally NOT used: PreToolUse fail-opens on both,
     so they would silently fail to block.
 
+    Deliberate exception to the fail-closed envelope policy (issue #501, AC-5): this
+    hook is a dangerous-command denylist, not a receipt gate, so an empty payload
+    remains an allow and unparseable raw text is still treated as the command text
+    for denylist matching. Both behaviours preserve the documented manual/CLI usage
+    'pwsh -NoProfile -File validate-bash.ps1 "<command>"'. Every other PreToolUse
+    hook denies on those two conditions.
+
 .NOTES
     Compatible with PowerShell 7+.
     This script must not modify any state; it is a read-only validation gate.
@@ -30,6 +38,8 @@ param(
     [string]$CommandInput
 )
 
+Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
+
 function Get-BlockedBashPattern {
     [CmdletBinding()]
     [OutputType([string[]])]
@@ -119,14 +129,21 @@ function Get-BashCommandToCheck {
     )
 
     if ($ToolInputRaw) {
-        try {
-            $parsed = $ToolInputRaw | ConvertFrom-Json -ErrorAction Stop
-            if ($parsed.command) {
-                return [string]$parsed.command
+        $parsed = ConvertFrom-ClaudeHookEnvelope -Raw $ToolInputRaw
+        if (-not $parsed.IsValid) {
+            # AC-5 exception: unparseable raw text is still treated as the command
+            # text, which is what the documented manual/CLI usage supplies.
+            if ($parsed.Anomaly -eq 'UnparseableJson') {
+                return [string]$ToolInputRaw
+            }
+        } else {
+            $extracted = Get-ClaudeHookToolInput -Envelope $parsed.Value
+            if ($extracted.IsValid) {
+                $command = Get-ClaudeHookToolInputString -ToolInput $extracted.Value -Name 'command'
+                if ($command) {
+                    return $command
+                }
             }
-        } catch {
-            # If JSON parsing fails, treat the raw input as the command.
-            return $ToolInputRaw
         }
     }
 
@@ -166,10 +183,7 @@ if ($MyInvocation.InvocationName -eq '.') {
     return
 }
 
-$toolInputRaw = $env:CLAUDE_TOOL_INPUT
-if (-not $toolInputRaw) {
-    $toolInputRaw = $env:CLAUDE_HOOK_INPUT
-}
+$toolInputRaw = Read-ClaudeHookRawPayload
 
 $decision = Invoke-ValidateBashDecision -ToolInputRaw $toolInputRaw -PositionalInput $CommandInput
 if ($null -ne $decision -and $decision.hookSpecificOutput.permissionDecision -eq 'deny') {

package/resources/claude-customizations/.claude/lib/blast-radius/BlastRadius.psm1

@@ -54,6 +54,7 @@ Set-StrictMode -Version Latest
 Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusExtraction.psm1') -Force
 Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusGlob.psm1') -Force
 Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusConfig.psm1') -Force
+Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusNormalization.psm1') -Force
 Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusValidation.psm1') -Force
 
 # Feature-folder handling. Every radius contains its own feature folder, and a
@@ -66,6 +67,11 @@ $script:FeatureFolderPrefix = 'docs/features/'
 $script:SourceDerived = 'derived'
 $script:SourceObserved = 'observed'
 
+# A contract identifier names something callable or referenceable, so it must
+# carry at least one ASCII letter (issue #489). Get-NormalizedDeclaredRadius
+# re-applies that rule to identifiers a pre-#489 extractor already recorded.
+$script:ContractLetterPattern = [regex]::new('[A-Za-z]')
+
 # Contention reason kinds, in the fixed order every result reports them. These
 # strings are contract literals consumed by the downstream parallel schema.
 $script:ConflictPathOverlap = 'path_overlap'
@@ -167,10 +173,20 @@ function Get-BlastRadius {
     $entry = [System.Collections.Generic.List[string]]::new()
     $entry.AddRange([string[]]@(Get-PlanPaths -PlanText $PlanText -RootSurface $rootSurface))
     $entry.AddRange([string[]]@(Get-PathFromLine -Line $specLine -RootSurface $rootSurface))
-    $entry.Add((Get-FeatureFolderGlob -FeatureFolder (
+
+    # Read-by-mandate citations are dropped before the feature folder is added: a
+    # plan cites the policy rules because its author was told to read them, not
+    # because the change will write them (issue #489). Test-BlastRadius applies
+    # the same filter, which is what keeps the derived radius passing V1 and V2
+    # against its own plan. The feature-folder glob is added afterwards so it can
+    # never be excluded.
+    $surviving = [System.Collections.Generic.List[string]]::new()
+    $surviving.AddRange([string[]]@(Get-NonMandateReadEntry -Entry $entry.ToArray() `
+                -MandateRead ([string[]]@(Get-ConfigMandateRead -Config $Config))))
+    $surviving.Add((Get-FeatureFolderGlob -FeatureFolder (
                 Get-RequiredText -Value $FeatureFolder -FieldName 'feature_folder')))
 
-    $paths = [string[]]@(Get-OrdinalSortedEntry -Entry $entry.ToArray())
+    $paths = [string[]]@(Get-OrdinalSortedEntry -Entry $surviving.ToArray())
     $concrete = [string[]]@(Get-ConcreteEntry -Entry $paths)
 
     return ConvertTo-NormalizedBlastRadius -Radius @{
@@ -183,6 +199,92 @@ function Get-BlastRadius {
     }
 }
 
+function Get-NormalizedDeclaredRadius {
+    <#
+    .SYNOPSIS
+        Re-apply the current extraction rules to an already-recorded radius.
+
+    .DESCRIPTION
+        Port of normalize_declared_radius. A radius recorded by an older
+        extractor can carry entries the current rules reject: directory-shaped
+        tokens, cross-corpus documentation globs, read-by-mandate citations, and
+        letterless contract tokens. Re-deriving from the plan text is not always
+        possible, so this function re-filters the recorded radius in place of a
+        fresh derivation and re-resolves the levels that depend on the surviving
+        paths (issue #489). source and computed_at are preserved and the input is
+        never mutated.
+
+    .PARAMETER Radius
+        A derived or declared radius hashtable to re-filter.
+
+    .PARAMETER Config
+        Parsed config/blast-radius.json. The root-surface set, the mandate-read
+        list, the module map, and the shared-surface list are all read from this
+        one value.
+
+    .OUTPUTS
+        System.Collections.Hashtable. A new radius carrying the surviving paths,
+        contracts re-filtered by the ASCII-letter rule, and modules and shared
+        surfaces re-resolved from the surviving paths. Throws when the radius
+        source is observed: an observed radius records a diff listing rather than
+        a plan-text harvest, so the plan-text acceptance rules do not apply to it
+        and re-filtering one would silently discard genuine evidence.
+    #>
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowNull()]
+        [object] $Radius,
+        [Parameter(Mandatory = $true)]
+        [AllowNull()]
+        [object] $Config
+    )
+
+    $normalized = ConvertTo-NormalizedBlastRadius -Radius $Radius
+
+    # Fail fast, before any other work, so the prohibition is unambiguous and no
+    # partially-filtered value can escape.
+    if ($normalized['source'] -eq $script:SourceObserved) {
+        throw ("Get-NormalizedDeclaredRadius rejects a radius whose source is " +
+            "'$($script:SourceObserved)': an observed radius records a diff listing, " +
+            'not a plan-text harvest, so the plan-text acceptance rules must not ' +
+            'be applied to it.')
+    }
+
+    $rootSurface = [string[]]@(Get-ConfigRootSurface -Config $Config)
+
+    # Re-run the classifier over each recorded entry. An entry the current rules
+    # reject is dropped; the mandate-read filter then removes the citations that
+    # are evidence of a read rather than of a write.
+    $accepted = [System.Collections.Generic.List[string]]::new()
+    foreach ($entry in @($normalized['paths'])) {
+        if ($null -ne (Get-PathTokenKind -Token $entry -RootSurface $rootSurface)) {
+            $accepted.Add([string]$entry)
+        }
+    }
+
+    $paths = [string[]]@(Get-NonMandateReadEntry -Entry $accepted.ToArray() `
+            -MandateRead ([string[]]@(Get-ConfigMandateRead -Config $Config)))
+    $concrete = [string[]]@(Get-ConcreteEntry -Entry $paths)
+
+    $contract = [System.Collections.Generic.List[string]]::new()
+    foreach ($identifier in @($normalized['contracts'])) {
+        if ($script:ContractLetterPattern.IsMatch([string]$identifier)) {
+            $contract.Add([string]$identifier)
+        }
+    }
+
+    return ConvertTo-NormalizedBlastRadius -Radius @{
+        paths           = $paths
+        modules         = @(Resolve-BlastRadiusModule -PathEntry $paths -Config $Config)
+        shared_surfaces = @(Resolve-BlastRadiusSharedSurface -ConcretePath $concrete -Config $Config)
+        contracts       = @($contract.ToArray())
+        source          = $normalized['source']
+        computed_at     = $normalized['computed_at']
+    }
+}
+
 function Get-BlastRadiusFromObservedPaths {
     <#
     .SYNOPSIS
@@ -374,6 +476,7 @@ function Test-BlastRadiusConflict {
 Export-ModuleMember -Function `
     Get-PlanPaths, `
     Get-BlastRadius, `
+    Get-NormalizedDeclaredRadius, `
     Get-BlastRadiusFromObservedPaths, `
     Test-BlastRadius, `
     Test-BlastRadiusConflict

package/resources/claude-customizations/.claude/lib/blast-radius/BlastRadiusConfig.psm1

@@ -39,6 +39,7 @@ Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusGlob.psm1')
 $script:ConfigSharedSurfaceKey = 'shared_surfaces'
 $script:ConfigSharedSurfaceGlobKey = 'shared_surface_globs'
 $script:ConfigModuleKey = 'modules'
+$script:ConfigMandateReadKey = 'mandate_reads'
 $script:ConfigOverBreadthKey = 'over_breadth_fraction'
 
 # Numeric types a JSON or literal truth table may carry for the V3 threshold.
@@ -279,6 +280,36 @@ function Get-ConfigRootSurface {
     return @($rootSurface.ToArray())
 }
 
+function Get-ConfigMandateRead {
+    <#
+    .SYNOPSIS
+        Read the read-by-mandate exclusion list from the truth table.
+
+    .DESCRIPTION
+        Port of config_mandate_reads. Mandate reads are the paths every agent is
+        instructed to read before doing any work, so a citation of one of them is
+        evidence that the author obeyed the reading order rather than evidence
+        that the change will write the file (issue #489).
+
+    .PARAMETER Config
+        Parsed config/blast-radius.json. Only the mandate_reads key is read.
+
+    .OUTPUTS
+        System.Object[]. Entries sorted and deduplicated by the underlying
+        reader. A config with no mandate_reads key yields an empty array, which
+        excludes nothing and reproduces pre-change behavior.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Object[]])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowNull()]
+        [object] $Config
+    )
+
+    return @(Get-ConfigStringList -Config $Config -Key $script:ConfigMandateReadKey)
+}
+
 function Get-ConfigModuleEntry {
     <#
     .SYNOPSIS
@@ -374,57 +405,6 @@ function Get-ConfigOverBreadthFraction {
     return $fraction
 }
 
-function Resolve-BlastRadiusModule {
-    <#
-    .SYNOPSIS
-        Resolve path entries to the module names of the truth-table map.
-
-    .DESCRIPTION
-        Port of resolve_modules. A module joins the radius as soon as one of its
-        globs covers one entry, so the search stops at the first hit per module.
-        A path matching no glob resolves to no module.
-
-    .PARAMETER PathEntry
-        Concrete paths and globs of a radius. An empty collection is accepted.
-
-    .PARAMETER Config
-        Parsed config/blast-radius.json.
-
-    .OUTPUTS
-        System.Object[]. Matched module names, deduplicated and ordinally sorted.
-    #>
-    [CmdletBinding()]
-    [OutputType([System.Object[]])]
-    param(
-        [Parameter(Mandatory = $true)]
-        [AllowEmptyCollection()]
-        [AllowEmptyString()]
-        [string[]] $PathEntry,
-        [Parameter(Mandatory = $true)]
-        [AllowNull()]
-        [object] $Config
-    )
-
-    $matched = [System.Collections.Generic.List[string]]::new()
-    foreach ($pair in @(Get-ConfigModuleEntry -Config $Config)) {
-        foreach ($pattern in $pair['globs']) {
-            $hit = $false
-            foreach ($entry in $PathEntry) {
-                if (Test-GlobMatch -Pattern $pattern -Candidate $entry) {
-                    $matched.Add([string]$pair['name'])
-                    $hit = $true
-                    break
-                }
-            }
-            if ($hit) {
-                break
-            }
-        }
-    }
-
-    return @(Get-OrdinalSortedEntry -Entry $matched.ToArray())
-}
-
 function Resolve-BlastRadiusSharedSurface {
     <#
     .SYNOPSIS
@@ -485,7 +465,7 @@ Export-ModuleMember -Function `
     Get-RequiredMapping, `
     Get-ConfigStringList, `
     Get-ConfigRootSurface, `
+    Get-ConfigMandateRead, `
     Get-ConfigModuleEntry, `
     Get-ConfigOverBreadthFraction, `
-    Resolve-BlastRadiusModule, `
     Resolve-BlastRadiusSharedSurface