@danmoisan/drm-copilot-mcp 1.1.0 → 1.1.1

package/resources/claude-customizations/.claude/lib/blast-radius/BlastRadiusTokenShape.psm1

@@ -0,0 +1,187 @@
+<#
+.SYNOPSIS
+    Blast-radius token-shape predicates, ported from the Python reference.
+
+.DESCRIPTION
+    Destination-runtime PowerShell port of
+    scripts/dev_tools/_blast_radius_token_shapes.py. Holds the pure,
+    context-free shape tests that reject an inline-code token before
+    Get-PathTokenKind can record it as a repository path. A token can look like
+    a path and still name no file: a placeholder or interpolation marker makes it
+    a command or artifact shape, and a corpus-wide documentation glob makes it a
+    cross-corpus claim. Neither is evidence that a work item will write anything.
+
+    Test-PlaceholderMarker is new in issue #502.
+    Test-MultipleFeatureFolderSpan was relocated here from
+    BlastRadiusExtraction.psm1 in the same change, and the two module-scoped
+    documentation-corpus variables it reads travelled with it because $script:
+    scope is per module. The relocation exists because the extraction module had
+    two lines of headroom against the 500-line limit when the marker guard was
+    added, so an in-place guard was arithmetically impossible.
+
+    The Python module remains the authoritative reference implementation. This
+    module is a LEAF: it imports no sibling blast-radius module, so the
+    extraction module can import it with no possibility of a cycle. That
+    constraint is why the predicate does not live in BlastRadiusNormalization.psm1,
+    which already imports the extraction module.
+
+    Every function is pure: no filesystem, subprocess, network, or wall-clock
+    access, and no input is mutated.
+
+    Parity notes for maintainers:
+      - The marker array is character-identical to PLACEHOLDER_MARKERS in
+        scripts/dev_tools/_blast_radius_token_shapes.py and to the tuple of the
+        same name in scripts/dev_tools/plan_gate_coverage.py, whose origin is
+        the checkable-literal placeholder guard recorded in
+        .claude/rules/plan-acceptance-gates.md. The marker set is a module
+        constant, not a truth-table key: it describes what a path can never
+        contain rather than a policy a repository could tune.
+      - Every marker literal is single-quoted, and the two dollar forms are
+        built by character concatenation. A double-quoted PowerShell string
+        expands the subexpression form and the delimited-variable form, so a
+        double-quoted marker literal would silently define a DIFFERENT
+        vocabulary than the Python reference and the parity would fail on
+        exactly the two members that matter most.
+      - Substring search uses [System.StringComparison]::Ordinal so the result
+        is culture-independent and matches Python's byte-wise 'in' operator.
+      - Both predicates are total on every string, including the empty string, a
+        token consisting only of a marker, and a bare bracket pair. Neither
+        throws for any input, because the classifier that calls them runs over
+        every inline-code span in a document and a throw would abort an entire
+        derivation over one stray span.
+#>
+
+Set-StrictMode -Version Latest
+
+# Placeholder and interpolation markers. A token carrying any of these was
+# written to document a shape, not to name a file, so it can never be a write
+# claim.
+#
+# The angle brackets are the dominant corpus shape and are also the strongest
+# case: Windows forbids both characters in a filename outright, so an
+# angle-bracketed token cannot name a file on the platform this repository is
+# developed on. The two dollar forms are shell and PowerShell interpolation, and
+# the percent form is the Windows shell's environment-variable syntax; each
+# resolves at run time to text that is not in the token.
+#
+# The two dollar forms are assembled from single characters deliberately. Written
+# as one single-quoted literal they would be correct, but assembling them makes
+# the intent explicit at the definition site and removes any question of what a
+# future edit to the quoting style would do.
+$script:PlaceholderMarker = [string[]]@(
+    '<',
+    '>',
+    '$' + '{',
+    '$' + '(',
+    '%'
+)
+
+# Documentation-corpus root and the index, counted after that prefix, of the
+# segment that names one feature folder. A glob whose wildcard reaches this
+# segment or any earlier one claims every feature folder in the corpus.
+$script:FeatureCorpusPrefix = 'docs/features/'
+$script:FeatureFolderSegmentIndex = 1
+
+function Test-PlaceholderMarker {
+    <#
+    .SYNOPSIS
+        Report whether a token carries a placeholder or interpolation marker.
+
+    .DESCRIPTION
+        Port of contains_placeholder_marker. A marker-bearing token documents a
+        shape rather than naming a file. Two work items that cite the same
+        mandated artifact shape therefore acquired a path-level conflict edge on
+        a string that resolves to nothing, which made thematically unrelated
+        items contend and serialized runs that had no reason to serialize
+        (issue #502).
+
+        The test is a plain substring scan over a fixed vocabulary, deliberately
+        context-free: it needs no repository lookup, no configuration, and no
+        knowledge of which segment the marker sits in. A marker anywhere in the
+        token is disqualifying, including in the filename position, because an
+        interpolated filename is as unresolvable as an interpolated directory.
+
+    .PARAMETER Token
+        A single whitespace-free inline-code token. The empty string is accepted
+        and reports false.
+
+    .OUTPUTS
+        System.Boolean. True when any configured marker appears anywhere in the
+        token, otherwise false.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string] $Token
+    )
+
+    # Ordinal comparison keeps the result culture-independent and byte-wise, so
+    # it agrees with Python's 'in' operator on every input.
+    foreach ($marker in $script:PlaceholderMarker) {
+        if ($Token.IndexOf($marker, [System.StringComparison]::Ordinal) -ge 0) {
+            return $true
+        }
+    }
+
+    return $false
+}
+
+function Test-MultipleFeatureFolderSpan {
+    <#
+    .SYNOPSIS
+        Report whether a glob claims more than one documentation feature folder.
+
+    .DESCRIPTION
+        Port of spans_multiple_feature_folders. The documentation corpus is laid
+        out as docs/features/<bucket>/<feature-folder>/..., so a glob whose
+        wildcard occupies or truncates the feature-folder segment claims every
+        feature folder in the corpus. That made two unrelated work items contend
+        purely because both wrote documentation (issue #489). A glob carrying a
+        complete, wildcard-free feature-folder segment claims one folder and is
+        retained.
+
+    .PARAMETER Token
+        A wildcard-bearing token already accepted by the shape rules of
+        Get-PathTokenKind.
+
+    .OUTPUTS
+        System.Boolean. True when the token is rooted in the documentation corpus
+        and its wildcard reaches the feature-folder segment or any earlier one.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string] $Token
+    )
+
+    if (-not $Token.StartsWith($script:FeatureCorpusPrefix,
+            [System.StringComparison]::Ordinal)) {
+        return $false
+    }
+
+    $segment = @($Token.Substring($script:FeatureCorpusPrefix.Length) -split '/')
+
+    # A token that stops at or before the feature-folder segment has had that
+    # segment truncated away by the wildcard, so it spans the whole corpus.
+    if ($segment.Count -le $script:FeatureFolderSegmentIndex) {
+        return $true
+    }
+
+    # Every segment up to and including the feature-folder name must be a literal
+    # for the claim to resolve to exactly one folder.
+    for ($index = 0; $index -le $script:FeatureFolderSegmentIndex; $index++) {
+        if ($segment[$index].IndexOf('*') -ge 0) {
+            return $true
+        }
+    }
+
+    return $false
+}
+
+Export-ModuleMember -Function `
+    Test-PlaceholderMarker, `
+    Test-MultipleFeatureFolderSpan

package/resources/claude-customizations/.claude/rules/parallel-orchestration.md

@@ -233,11 +233,69 @@ Three constraints bound the mandate-read exclusion:
    detection compares the declared radius against the paths a diff actually touched, so an item that
    wrote an excluded path is caught against observed evidence rather than against prose.
 
-The extractor additionally rejects three token shapes that were never write claims: a wildcard-free
+The extractor additionally rejects four token shapes that were never write claims: a wildcard-free
 token whose final component names a directory rather than a file, a `docs/features/` glob whose
-wildcard occupies or truncates the feature-folder segment, and a contract token carrying no ASCII
-letter. `artifacts/` is not a known top-level segment, so a bare `artifacts/**` subtree claim no
-longer satisfies the shape rules.
+wildcard occupies or truncates the feature-folder segment, a contract token carrying no ASCII
+letter, and a token containing a placeholder or interpolation marker. `artifacts/` is not a known
+top-level segment, so a bare `artifacts/**` subtree claim no longer satisfies the shape rules.
+
+### Placeholder-shape rejection (issue #502)
+
+The fourth shape is a token containing any member of the marker set
+
+```text
+<    >    ${    $(    %
+```
+
+The set is not a configuration key and is not read from `config/blast-radius.json`. It originates in
+the checkable-literal placeholder guard defined in `.claude/rules/plan-acceptance-gates.md`, which
+uses the identical five markers to decide that a plan operand documents a command *shape* rather
+than stating a real assertion. Both subsystems answer the same question about the same text, so the
+two vocabularies are pinned equal by test rather than left to convention.
+
+**A marker-bearing token never matches a tracked path.** A placeholder or interpolation form
+resolves at run time to text that is not in the token, so the token as written names nothing. For
+the two angle brackets the claim is stronger than a heuristic: Windows forbids both characters in a
+filename outright, so an angle-bracketed token cannot name a file on the platform this repository is
+developed on. Admitting such a token recorded a `paths` entry that no diff could ever touch, and two
+items citing the identical shape then acquired a `path_overlap` edge on a string that resolves to
+nothing.
+
+**The dominant token is a mandated artifact shape, which is why the exposure was corpus-wide rather
+than incidental.** Every agent in this repository is instructed to write its evidence to the
+canonical scheme defined in `.claude/skills/evidence-and-timestamp-conventions/SKILL.md`, and that
+scheme is non-overridable, so a well-formed plan quotes the same feature-relative artifact shape
+that every other well-formed plan quotes. The shape is therefore the most widely shared token in the
+corpus, and admitting it made compliance with the evidence-path scheme a source of contention. The
+same reasoning applies to the feature-document shapes and to the session-keyed state-file shape.
+
+**The planner remains obliged to enumerate a genuine write explicitly.** This rejection describes a
+plan that documents a shape, not a permanent ban on the paths a shape resembles. When an item's plan
+will actually write a path it expressed as a shape, the planner appends that exact concrete path to
+the declared radius after normalization. This is the same obligation constraint 1 of the
+mandate-read exclusion imposes, and `detect_escaped_paths` is the same backstop: drift detection
+compares the declared radius against the paths a diff actually touched, so an item that wrote a path
+it expressed only as a shape is caught against observed evidence rather than against prose.
+
+**Accepted fail-open trade.** The rejection runs inside the classifier, upstream of shared-surface
+resolution, so a marker-bearing token whose shape matches a configured `shared_surface_globs`
+pattern is dropped before it can be reported as a touched shared surface. The trade is inherent to
+that placement: a guard downstream of surface resolution would leave the token in `paths` and
+reintroduce the path-level false edge it exists to remove. Corpus exposure was measured empty — no
+plan in the 58-plan corpus examined for issue #502 cited a marker-bearing token whose shape matched a
+configured shared-surface glob — and the planner obligation above is what keeps a genuine write
+visible. A later change that widens the marker set must re-take that measurement.
+
+**Known residual: the whitespace split.** Extraction harvests whitespace-free inline-code tokens, so
+a placeholder form written with internal whitespace is split into fragments before the marker test
+ever runs. Each fragment is then judged on its own shape and is normally rejected for an unrelated
+reason, most often for carrying no separator. The residual is therefore benign in the accepting
+direction but is recorded here because it means the rejection is not a complete guard against every
+way a shape can be written; it is a guard against the whitespace-free forms the extractor actually
+admits.
+
+Enforcement of this rejection is prose plus validator logic, exactly as for the three shapes above.
+No JSON Schema is authored, imported, or read for it, and `config/blast-radius.json` gains no key.
 
 ### Module-map granularity criterion
 

package/resources/claude-customizations/.claude/skills/epic-plan/SKILL.md

@@ -173,6 +173,33 @@ integration-to-main PR.
 The `## Invocation Prompt` section is the exact text the user replays (from the main session,
 never from an `orchestrator` agent) to launch execution.
 
+### Integration Commit Form (issue #539)
+
+The epic planner's own version-control operations — committing the epic manifest, the fanned-in
+child feature folders and approved plans, and the durable kickoff copy — are orchestration
+bookkeeping, not implementation. The preimplementation gate
+(`.claude/hooks/enforce-orchestration-preimplementation-gate.ps1`) exempts them only when the
+invocation is **pathspec-bearing**: every staging or integration invocation must name at least one
+explicit path operand, and every operand must resolve inside one of the five exempt
+orchestration-bookkeeping trees:
+
+- `docs/features/epics/`
+- `docs/features/parallel/`
+- `docs/features/active/`
+- `docs/features/potential/`
+- `artifacts/orchestration/`
+
+Use one of the two pathspec-bearing spellings:
+
+- the message option followed by a double-dash separator and then the exempt path operands, or
+- the exempt path operands named directly before the message option.
+
+A pathless integration invocation — a message option with no path operand — is denied (D4 row 4),
+as are whole-tree operands, tree-wide flags, pathspec-from-file options, history-rewriting or
+content-widening options, and any operand that resolves outside the five exempt trees. Mixing one
+exempt operand with one production operand denies the whole invocation. Name each exempt path
+explicitly; the exemption is allow-side only and every parse ambiguity denies.
+
 ## Checkpoint Handling
 
 Persist `artifacts/orchestration/epic-planner-state.json` after every completed step with the

package/resources/claude-customizations/.claude/skills/parallel-plan/SKILL.md

@@ -522,6 +522,34 @@ Validate the artifact through `mcp__drm-copilot__validate_orchestration_artifact
 `artifact_type: "parallel-kickoff"`. That artifact type dispatches to
 `scripts/dev_tools/parallel_kickoff_contract.py`, which this feature delivers.
 
+### Integration Commit Form (issue #539)
+
+The parallel planner's own version-control operations — committing the run manifest
+`docs/features/parallel/<slug>/parallel.md`, each item's prepared feature folder and approved
+plan-path, and the durable kickoff copy `docs/features/parallel/<slug>/parallel-kickoff.md` — are
+orchestration bookkeeping, not implementation. The preimplementation gate
+(`.claude/hooks/enforce-orchestration-preimplementation-gate.ps1`) exempts them only when the
+invocation is **pathspec-bearing**: every staging or integration invocation must name at least one
+explicit path operand, and every operand must resolve inside one of the five exempt
+orchestration-bookkeeping trees:
+
+- `docs/features/epics/`
+- `docs/features/parallel/`
+- `docs/features/active/`
+- `docs/features/potential/`
+- `artifacts/orchestration/`
+
+Use one of the two pathspec-bearing spellings:
+
+- the message option followed by a double-dash separator and then the exempt path operands, or
+- the exempt path operands named directly before the message option.
+
+A pathless integration invocation — a message option with no path operand — is denied (D4 row 4),
+as are whole-tree operands, tree-wide flags, pathspec-from-file options, history-rewriting or
+content-widening options, and any operand that resolves outside the five exempt trees. Mixing one
+exempt operand with one production operand denies the whole invocation. Name each exempt path
+explicitly; the exemption is allow-side only and every parse ambiguity denies.
+
 ## Completion Report
 
 The final report to the operator must include:

package/resources/claude-customizations/pack-manifests/core.json

@@ -33,6 +33,7 @@
     ".claude/hooks/enforce-feature-folder-order.ps1",
     ".claude/hooks/enforce-model-routing-receipt.ps1",
     ".claude/hooks/enforce-orchestration-preimplementation-gate.ps1",
+    ".claude/hooks/enforce-orchestration-preimplementation-gate-helpers.ps1",
     ".claude/hooks/enforce-parallel-abandon-gate.ps1",
     ".claude/hooks/enforce-parallel-cohort-barrier.ps1",
     ".claude/hooks/enforce-parallel-cohort-barrier-helpers.ps1",
@@ -129,6 +130,7 @@
     ".claude/lib/blast-radius/BlastRadiusValidation.psm1",
     ".claude/lib/blast-radius/BlastRadius.psm1",
     ".claude/lib/blast-radius/BlastRadiusNormalization.psm1",
+    ".claude/lib/blast-radius/BlastRadiusTokenShape.psm1",
     ".claude/rules/parallel-orchestration.md",
     ".claude/rules/shell.md",
     ".claude/lib/bash/compute-cohorts.sh",

package/resources/codex-and-agents-customizations/.codex/config.toml

@@ -2,7 +2,7 @@ default_permissions = ":danger-full-access"
 
 [mcp_servers.drm-copilot]
 command = "npx"
-args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.0"]
+args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.1"]
 required = true
 enabled_tools = [
     "collect_commit_context",