@danmoisan/drm-copilot-mcp 1.1.0 → 1.1.1

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-orchestration-preimplementation-gate-helpers.ps1

@@ -0,0 +1,349 @@
+<#
+.SYNOPSIS
+    Pathspec classifier for the orchestration-bookkeeping staging exemption (issue #539).
+.DESCRIPTION
+    Pure string logic only: no disk, process, network, or environment access. The single
+    entry predicate `Test-ExemptOrchestrationStagingCommand` answers one question - does
+    this command text parse, in its entirety, as recognized staging or integration
+    invocations whose every pathspec operand resolves inside an orchestration-bookkeeping
+    tree? Every parse ambiguity answers false, so the caller's pre-change deny is the
+    fallback for every unmodeled form.
+
+    The normative contract is the D4 fail-closed rule table in
+    docs/features/active/2026-08-24-preimplementation-gate-blocks-planner-integration-commits-539/spec.md.
+    Rule-table row numbers are cited inline against the code that realizes them.
+
+    This file is dot-sourced by the sibling gate hook, following the headroom-split
+    precedent set by enforce-pr-author-skill.ps1.
+#>
+
+# The five exempt orchestration-bookkeeping trees (D2). Directory prefixes, repo-relative,
+# forward-slash spelled. No glob, no absolute entry, no literal-file entry.
+$script:OrchestrationBookkeepingTrees = @(
+    'docs/features/epics/'
+    'docs/features/parallel/'
+    'docs/features/active/'
+    'docs/features/potential/'
+    'artifacts/orchestration/'
+)
+
+# Characters that make a command line statically unresolvable: shell interpolation and
+# redirection (D4 row 12). Tested across the whole line rather than per operand, because a
+# redirection anywhere in the line moves content the operand list cannot describe.
+$script:UnresolvableCommandCharacters = [char[]]@('$', '`', '>', '<')
+
+# Wildcards that make an operand a glob (D4 row 15). Only the literal prefix before the
+# first of these is prefix-tested.
+$script:PathspecWildcardCharacters = [char[]]@('*', '?', '[')
+
+function Split-OrchestrationCommandLine {
+    <#
+    .SYNOPSIS
+        Splits a command line into segments on chain operators outside quotes.
+    .DESCRIPTION
+        Realizes D4 row 13. Quote state is tracked while scanning so a chain operator
+        inside a quoted span does not split. The returned `Balanced` flag reports whether
+        the scan ended outside every quote; unbalanced text is not splittable and the
+        caller denies (D4 rows 11 and 13). Empty and whitespace-only segments are dropped.
+    .OUTPUTS
+        System.Collections.Hashtable with keys `Balanced` (bool) and `Segments` (string[]).
+    #>
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $CommandText)
+
+    $segments = [System.Collections.Generic.List[string]]::new()
+    $current = [System.Text.StringBuilder]::new()
+    $openQuote = [char]0
+
+    foreach ($character in $CommandText.ToCharArray()) {
+        if ($openQuote -ne [char]0) {
+            if ($character -eq $openQuote) {
+                $openQuote = [char]0
+            }
+            [void]$current.Append($character)
+            continue
+        }
+
+        if ($character -eq '"' -or $character -eq "'") {
+            $openQuote = $character
+            [void]$current.Append($character)
+            continue
+        }
+
+        if ($character -eq ';' -or $character -eq '&' -or $character -eq '|' -or
+            $character -eq "`n" -or $character -eq "`r") {
+            $segments.Add($current.ToString())
+            [void]$current.Clear()
+            continue
+        }
+
+        [void]$current.Append($character)
+    }
+    $segments.Add($current.ToString())
+
+    return @{
+        Balanced = ($openQuote -eq [char]0)
+        Segments = @($segments | Where-Object { $_.Trim() })
+    }
+}
+
+function ConvertTo-OrchestrationCommandToken {
+    <#
+    .SYNOPSIS
+        Splits one segment into whitespace-delimited tokens with balanced quotes stripped.
+    .DESCRIPTION
+        Realizes the quote handling of D4 row 11. A quoted span contributes to the token it
+        sits in, so `-m "epic scaffold"` yields the two tokens `-m` and `epic scaffold`, and
+        a quoted operand arrives at the prefix test unquoted. The caller has already
+        rejected unbalanced text, so an unterminated quote simply ends the final token.
+    .OUTPUTS
+        System.String[]
+    #>
+    [CmdletBinding()]
+    [OutputType([string[]])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $Segment)
+
+    $tokens = [System.Collections.Generic.List[string]]::new()
+    $current = [System.Text.StringBuilder]::new()
+    $hasToken = $false
+    $openQuote = [char]0
+
+    foreach ($character in $Segment.ToCharArray()) {
+        if ($openQuote -ne [char]0) {
+            if ($character -eq $openQuote) {
+                $openQuote = [char]0
+            } else {
+                [void]$current.Append($character)
+            }
+            continue
+        }
+
+        if ($character -eq '"' -or $character -eq "'") {
+            $openQuote = $character
+            $hasToken = $true
+            continue
+        }
+
+        if ([char]::IsWhiteSpace($character)) {
+            if ($hasToken) {
+                $tokens.Add($current.ToString())
+                [void]$current.Clear()
+                $hasToken = $false
+            }
+            continue
+        }
+
+        $hasToken = $true
+        [void]$current.Append($character)
+    }
+
+    if ($hasToken) {
+        $tokens.Add($current.ToString())
+    }
+
+    return $tokens.ToArray()
+}
+
+function Test-ExemptOrchestrationOperand {
+    <#
+    .SYNOPSIS
+        Tests one pathspec operand against the five exempt orchestration trees.
+    .DESCRIPTION
+        Realizes D4 rows 3, 9, 15, 16, 17, and 18. Backslashes normalize to forward slashes
+        before the prefix test (row 18); pathspec magic, absolute spellings, parent-directory
+        segments, and globs whose literal prefix escapes the exempt set all deny.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $Operand)
+
+    if (-not $Operand) {
+        return $false
+    }
+
+    # Row 3b and row 9: any leading colon is pathspec magic, which can escape or invert the
+    # tree scope, so no colon-led operand is ever resolvable by a prefix test.
+    if ($Operand.StartsWith(':')) {
+        return $false
+    }
+
+    # Row 18: separator normalization precedes every prefix comparison below.
+    $normalized = $Operand -replace '\\', '/'
+
+    # Row 16: rooted, drive-lettered, and UNC spellings all deny; the exempt prefixes stay
+    # repo-relative (this is the posture issue #516 later composes with).
+    if ($normalized.StartsWith('/')) {
+        return $false
+    }
+    if ($normalized -match '^[A-Za-z]:') {
+        return $false
+    }
+
+    # Rows 15c and 17: any parent-directory component escapes the prefix.
+    if (($normalized -split '/') -contains '..') {
+        return $false
+    }
+
+    # Row 15: only the literal prefix before the first wildcard is prefix-tested, so a glob
+    # whose wildcard occupies or truncates an ancestor segment cannot pass.
+    $literalPrefix = $normalized
+    $wildcardIndex = $normalized.IndexOfAny($script:PathspecWildcardCharacters)
+    if ($wildcardIndex -ge 0) {
+        $literalPrefix = $normalized.Substring(0, $wildcardIndex)
+    }
+
+    foreach ($tree in $script:OrchestrationBookkeepingTrees) {
+        if ($literalPrefix.StartsWith($tree)) {
+            return $true
+        }
+    }
+    return $false
+}
+
+function Test-ExemptOrchestrationSegmentToken {
+    <#
+    .SYNOPSIS
+        Tests one already-tokenized segment as a recognized all-exempt invocation.
+    .DESCRIPTION
+        Realizes D4 rows 1, 2, 4, 5, 6, 7, 8, 10, 14, and 19. The command name must lead the
+        segment and the subcommand must follow it immediately (row 14), the option table is
+        modelled positively so any unmodelled dash-leading token denies (rows 2, 5, 6, 8, 10),
+        tokens after the double-dash separator are pathspecs (row 7), at least one operand is
+        required (rows 1, 4, 7), and every operand must pass (row 19).
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory)][AllowEmptyCollection()][string[]] $Token)
+
+    if ($Token.Count -lt 2) {
+        return $false
+    }
+
+    # Row 14: the command name leads and the subcommand follows immediately. Anything in
+    # between - a relocating option or an env-style prefix - moves the pathspec base and is
+    # rejected here rather than modelled.
+    if ($Token[0] -cne 'git') {
+        return $false
+    }
+    $subcommand = $Token[1]
+    if ($subcommand -cne 'add' -and $subcommand -cne 'commit') {
+        return $false
+    }
+
+    $operands = [System.Collections.Generic.List[string]]::new()
+    $afterSeparator = $false
+    $index = 2
+
+    while ($index -lt $Token.Count) {
+        $candidate = $Token[$index]
+
+        if (-not $afterSeparator) {
+            if ($candidate -ceq '--') {
+                # Row 7: every remaining token is a pathspec, dash-leading or not.
+                $afterSeparator = $true
+                $index++
+                continue
+            }
+
+            if ($candidate.StartsWith('-')) {
+                # The message option is the only modelled option on either subcommand. Rows
+                # 2, 5, 6, 8, and 10 all land here and deny, including a dash-leading
+                # operand supplied without a preceding separator.
+                if ($subcommand -cne 'commit') {
+                    return $false
+                }
+                if ($candidate -ceq '-m' -or $candidate -ceq '--message') {
+                    # The message value is the following token and is not a pathspec.
+                    $index += 2
+                    if ($index -gt $Token.Count) {
+                        return $false
+                    }
+                    continue
+                }
+                if ($candidate.StartsWith('--message=') -or
+                    ($candidate.Length -gt 2 -and $candidate.StartsWith('-m'))) {
+                    $index++
+                    continue
+                }
+                return $false
+            }
+        }
+
+        $operands.Add($candidate)
+        $index++
+    }
+
+    # Rows 1, 4, and 7: an invocation with no pathspec operand claims no path, so there is
+    # nothing for the prefix test to scope and the exemption is not available.
+    if ($operands.Count -eq 0) {
+        return $false
+    }
+
+    # Row 19: all-operands-exempt is the invariant; one non-exempt operand denies the set.
+    foreach ($operand in $operands) {
+        if (-not (Test-ExemptOrchestrationOperand -Operand $operand)) {
+            return $false
+        }
+    }
+    return $true
+}
+
+function Test-ExemptOrchestrationStagingCommand {
+    <#
+    .SYNOPSIS
+        Reports whether a command line is an orchestration-bookkeeping staging invocation.
+    .DESCRIPTION
+        The entry predicate of the issue #539 exemption. Returns true only when the whole
+        command line splits cleanly into segments and EVERY segment parses as a complete,
+        recognized staging or integration invocation carrying at least one pathspec operand,
+        with every operand resolving inside one of the five exempt orchestration-bookkeeping
+        trees after balanced-quote stripping and separator normalization.
+
+        The all-segments reading is deliberate and fail-closed: a chained line denies unless
+        each of its segments is independently a recognized all-exempt invocation, so a
+        relocating spelling or a prose fragment anywhere in the line withholds the exemption
+        even when another segment on the same line would have qualified on its own.
+
+        Consumed allow-side only. A false result restores the caller's unchanged
+        classification; it never suppresses the trigger.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $CommandText)
+
+    if (-not $CommandText) {
+        return $false
+    }
+
+    # Row 12: interpolation and redirection are not statically resolvable, so the operand
+    # list cannot be trusted to describe what the line actually touches.
+    if ($CommandText.IndexOfAny($script:UnresolvableCommandCharacters) -ge 0) {
+        return $false
+    }
+
+    $split = Split-OrchestrationCommandLine -CommandText $CommandText
+    if (-not $split.Balanced) {
+        # Rows 11 and 13: unbalanced quoting makes the segment boundaries ambiguous.
+        return $false
+    }
+
+    $segments = @($split.Segments)
+    if ($segments.Count -eq 0) {
+        return $false
+    }
+
+    foreach ($segment in $segments) {
+        $tokens = @(ConvertTo-OrchestrationCommandToken -Segment $segment)
+        if (-not (Test-ExemptOrchestrationSegmentToken -Token $tokens)) {
+            return $false
+        }
+    }
+    return $true
+}

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-orchestration-preimplementation-gate.ps1

@@ -10,8 +10,37 @@ param()
 # mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
 . (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
 
+# Pure pathspec classifier for the issue #539 orchestration-bookkeeping staging exemption.
+# Extracted to a dot-sourced sibling so this file stays inside the 500-line cap, following
+# the headroom-split precedent already used on this side by enforce-completion-helpers.ps1.
+. (Join-Path $PSScriptRoot 'enforce-orchestration-preimplementation-gate-helpers.ps1')
+
+# The readiness checkpoint this gate reads and names in its block message.
 $script:CheckpointPath = 'artifacts/orchestration/orchestrator-state.json'
 
+# Every orchestration checkpoint a planner or orchestrator surface writes. Writing one
+# of these is orchestration bookkeeping, not implementation, so the gate must not
+# require a ready checkpoint before the checkpoint itself can be created. The set is a
+# list of repo-relative literals behind a single membership check: no directory prefix,
+# no glob, and no absolute-path entry.
+$script:CheckpointPaths = @(
+    'artifacts/orchestration/orchestrator-state.json'
+    'artifacts/orchestration/parallel-planner-state.json'
+    'artifacts/orchestration/parallel-orchestrator-state.json'
+    'artifacts/orchestration/epic-planner-state.json'
+    'artifacts/orchestration/epic-orchestrator-state.json'
+    'artifacts/orchestration/powershell-orchestrator-state.json'
+    'artifacts/orchestration/csharp-orchestrator-state.json'
+)
+
+# Both markers must appear in the field-scoped prompt for a delegation to qualify as a
+# preparation-mode kickoff. The literals are reused verbatim from
+# .claude/skills/parallel-plan/SKILL.md and .claude/skills/epic-plan/SKILL.md.
+$script:PreparationModeMarkers = @(
+    'Preparation mode: true.'
+    'route_id: preparation.'
+)
+
 function ConvertFrom-CheckpointJson {
     [CmdletBinding()]
     param([Parameter(Mandatory)][string] $Json)
@@ -38,7 +67,13 @@ function Test-FeatureDocumentationOrEvidencePath {
     [OutputType([bool])]
     param([Parameter(Mandatory)][string] $NormalizedPath)
 
-    return $NormalizedPath.StartsWith('docs/features/active/')
+    # The segment anchor (^|/) admits both the repo-relative spelling and an
+    # absolute spelling of the same feature document, which the Write tool
+    # supplies by contract. -cmatch is deliberate and must not be normalized into
+    # -match: String.StartsWith is case-sensitive, so the case-sensitive operator
+    # is what preserves the previous semantics exactly. PowerShell -match is
+    # case-insensitive and would widen this predicate.
+    return $NormalizedPath -cmatch '(^|/)docs/features/active/'
 }
 
 function Test-ImplementationPath {
@@ -49,8 +84,33 @@ function Test-ImplementationPath {
     if (Test-FeatureDocumentationOrEvidencePath -NormalizedPath $NormalizedPath) {
         return $false
     }
-    if ($NormalizedPath -eq $script:CheckpointPath) {
-        return $false
+    # Segment-anchored and end-anchored, so an absolute spelling of a checkpoint is
+    # exempt exactly as its repo-relative spelling already was. -match is
+    # deliberate here and must not be narrowed into -cmatch: -contains was
+    # case-insensitive, so the case-insensitive operator is what preserves the
+    # previous semantics exactly.
+    #
+    # Accepted widening: this also exempts a path OUTSIDE the workspace whose tail
+    # is an artifacts/orchestration/ segment followed by one of the seven names.
+    # Measured exposure in this repository is one matching file, the real
+    # checkpoint; there is no nested or vendored second copy. The same widening is
+    # already accepted for the identical literal in four other hooks. Resolving a
+    # workspace root instead would reintroduce every root-resolution failure mode
+    # (8.3 short names, drive-letter case, symlinks, linked worktrees), and a strip
+    # that failed to match would leave the path absolute and deny, reinstating the
+    # reported defect in a subtler form.
+    #
+    # Known deliberate miss: a path reaching a checkpoint name only through a '..'
+    # hop stays denied. The Write tool does not emit '..' segments, and a
+    # canonicalizer would reintroduce filesystem dependence for no measured gain.
+    #
+    # Idempotence for the apply_patch call site: (^|/) matches at ^, so a
+    # repo-relative path harvested from a file marker by Test-ImplementationCommand
+    # classifies exactly as it does today.
+    foreach ($checkpoint in $script:CheckpointPaths) {
+        if ($NormalizedPath -match ('(^|/)' + [regex]::Escape($checkpoint) + '$')) {
+            return $false
+        }
     }
     return $NormalizedPath -match '\.(py|ps1|psm1|ts|tsx|js|jsx|cs|json|yml|yaml)$'
 }
@@ -86,14 +146,60 @@ function Test-ImplementationCommand {
         '(^|\s)pwsh\s+.*(Invoke-Pester|tests/scripts/)'
     )
 
-    foreach ($pattern in $implementationCommandPatterns) {
-        if ($normalizedCommand -match $pattern) {
-            return $true
+    for ($index = 0; $index -lt $implementationCommandPatterns.Count; $index++) {
+        if ($normalizedCommand -notmatch $implementationCommandPatterns[$index]) {
+            continue
+        }
+        # Allow-side only (issue #539). Index 0 is the git staging trigger, whose pattern
+        # text is unchanged. It is the sole leg the orchestration-bookkeeping exemption may
+        # clear, and only when no other implementation pattern matches the same line: the
+        # loop continues rather than returning, so a chained line carrying any non-git
+        # implementation segment still classifies as implementation. The apply_patch marker
+        # legs above are upstream of this loop and are unmodified.
+        if ($index -eq 0 -and (Test-ExemptOrchestrationStagingCommand -CommandText $normalizedCommand)) {
+            continue
         }
+        return $true
     }
     return $false
 }
 
+function Test-PreparationModeDelegation {
+    <#
+    .SYNOPSIS
+        Identifies an orchestrator delegation that is a preparation-mode kickoff.
+    .DESCRIPTION
+        Returns true only when all three conjuncts hold: the payload is present, the
+        delegated agent is exactly 'orchestrator', and the field-scoped prompt carries
+        both preparation markers. The prompt is read as a named field via this file's
+        own Get-StringProperty helper rather than from the serialized payload, so that
+        marker text planted in an unrelated field cannot exempt an implementation
+        delegation.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory)][AllowNull()] $ToolInput)
+
+    if ($null -eq $ToolInput) {
+        return $false
+    }
+
+    $subagentType = Get-StringProperty -Value $ToolInput -Name 'subagent_type'
+    if ($subagentType -ne 'orchestrator') {
+        return $false
+    }
+
+    $prompt = Get-StringProperty -Value $ToolInput -Name 'prompt'
+    foreach ($marker in $script:PreparationModeMarkers) {
+        if (-not $prompt.Contains($marker)) {
+            return $false
+        }
+    }
+    return $true
+}
+
 function Test-ImplementationDelegation {
     [CmdletBinding()]
     [OutputType([bool])]
@@ -103,6 +209,17 @@ function Test-ImplementationDelegation {
         return $false
     }
 
+    try {
+        if (Test-PreparationModeDelegation -ToolInput $ToolInput) {
+            return $false
+        }
+    } catch {
+        # An envelope the field reader cannot probe falls through to the unchanged
+        # whole-payload regex below. An extraction failure must never become an
+        # exemption, so the gate stays closed on the stricter classifier.
+        Write-Debug "Preparation-mode probe failed: $($_.Exception.Message)"
+    }
+
     $payloadText = ($ToolInput | ConvertTo-Json -Depth 20 -Compress)
     return $payloadText -match '(python-typed-engineer|powershell-typed-engineer|typescript-engineer|csharp-typed-engineer|atomic-executor|implementation|execute)'
 }

package/resources/codex-and-agents-customizations/pack-manifests/core.json

@@ -37,6 +37,7 @@
     ".codex/hooks/enforce-epic-root-invocation.ps1",
     ".codex/hooks/enforce-epic-wave-barrier.ps1",
     ".codex/hooks/enforce-epic-worktree-removal-gate.ps1",
+    ".codex/hooks/enforce-orchestration-preimplementation-gate-helpers.ps1",
     ".codex/hooks/record-subagent-routing-attestation.ps1",
     ".codex/hooks/validate-codex-subagent-routing.ps1",
     ".codex/scripts/epic-child-launch-contract.ps1",

package/resources/powershell/PoshQC/settings/pester.runsettings.psd1

@@ -129,6 +129,10 @@
             '.codex/hooks/enforce-evidence-locations.ps1'
             '.codex/hooks/enforce-checkpoint-monotonic.ps1'
             '.codex/hooks/enforce-orchestration-preimplementation-gate.ps1'
+            # Issue #539 extracted the command-branch pathspec classifier into this
+            # dot-sourced sibling for headroom; registered so the new production file stays
+            # in the coverage denominator per the Coverage Exclusion Policy.
+            '.codex/hooks/enforce-orchestration-preimplementation-gate-helpers.ps1'
             # Issue #415 remediation cycle 2 (R-COV): the detached-HEAD null-guard fix changed
             # these two Codex PreToolUse hooks. Both were absent from this list, so the changed
             # production surface was outside the coverage denominator. Measured here so the
@@ -137,7 +141,7 @@
             '.codex/hooks/enforce-epic-planning-only.ps1'
             # Issue #447 added the .claude-resident PowerShell blast-radius library, the
             # two-language mirror of scripts/dev_tools/compute_blast_radius.py and its
-            # helper modules. The set is split across six files only to satisfy the
+            # helper modules. The set is split across seven files only to satisfy the
             # 500-line limit; measured here so no new production module is excluded from
             # coverage.
             # Issue #489 added BlastRadiusNormalization.psm1, which holds the
@@ -145,12 +149,20 @@
             # Resolve-BlastRadiusModule relocated out of the two modules that had run
             # out of headroom. The relocation moves already-measured lines, so the new
             # file is registered here to keep them in the coverage denominator.
+            # Issue #502 added BlastRadiusTokenShape.psm1, the seventh file. It holds the
+            # new placeholder-marker predicate plus Test-MultipleFeatureFolderSpan
+            # relocated out of BlastRadiusExtraction.psm1, which had two lines of
+            # headroom left. CodeCoverage.Path is an explicit per-file allow-list, so
+            # without this entry the new production module and the relocated
+            # already-measured lines would both sit outside the coverage denominator,
+            # which the Coverage Exclusion Policy forbids.
             '.claude/lib/blast-radius/BlastRadiusExtraction.psm1'
             '.claude/lib/blast-radius/BlastRadiusGlob.psm1'
             '.claude/lib/blast-radius/BlastRadiusConfig.psm1'
             '.claude/lib/blast-radius/BlastRadiusValidation.psm1'
             '.claude/lib/blast-radius/BlastRadius.psm1'
             '.claude/lib/blast-radius/BlastRadiusNormalization.psm1'
+            '.claude/lib/blast-radius/BlastRadiusTokenShape.psm1'
             # Issue #440 added the two parallel enforcement hooks (the Layer 1 cohort
             # barrier and the worktree removal gate) and extended the invocation-origin
             # hook with the parallel-agent family; measured here so no new or changed
@@ -188,6 +200,10 @@
             '.claude/lib/hook-payload/HookPayload.psm1'
             '.claude/hooks/enforce-promotion-mcp-only.ps1'
             '.claude/hooks/enforce-orchestration-preimplementation-gate.ps1'
+            # Issue #539 extracted the command-branch pathspec classifier into this
+            # dot-sourced sibling for headroom; registered so the new production file stays
+            # in the coverage denominator per the Coverage Exclusion Policy.
+            '.claude/hooks/enforce-orchestration-preimplementation-gate-helpers.ps1'
             '.claude/hooks/enforce-evidence-locations.ps1'
             '.claude/hooks/enforce-feature-folder-order.ps1'
             '.claude/hooks/enforce-checkpoint-monotonic.ps1'