@danmoisan/drm-copilot-mcp 1.1.0 → 1.1.2

package/resources/codex-and-agents-customizations/.agents/skills/orchestrate/SKILL.md

@@ -284,7 +284,7 @@ After reading `artifacts/orchestration/orchestrator-state.json`, the main sessio
 - `atomic-executor` — executes approved plans task-by-task
 - `feature-reviewer` — produces policy, code, and feature audit artifacts by
   applying the `feature-review` workflow skill
-- `task-researcher` — performs deep research and writes findings to `artifacts/research/`
+- `task-researcher` — performs deep research and writes findings to the applicable feature-associated `docs/features/<feature>/research/` or one-off `docs/research/` root
 - `prd-feature` — produces issue, specification, and user-story artifacts when required by the selected workflow
 - `staged-review` — reviews staged changes when a pre-commit review is required
 - `epic-review` — reviews epic-level artifacts when the work item is an epic
@@ -326,7 +326,6 @@ All evidence artifacts produced during orchestration MUST comply with the canoni
 
 Permitted `artifacts/`-rooted sub-paths (non-evidence orchestration use only):
 - `artifacts/orchestration/` — orchestrator state and checkpoints
-- `artifacts/research/` — research outputs from task-researcher
 - `artifacts/pr_context` — PR context artifacts
 - `artifacts/reviews/` — review staging artifacts
 - `artifacts/status/` — status update artifacts
@@ -334,6 +333,8 @@ Permitted `artifacts/`-rooted sub-paths (non-evidence orchestration use only):
 - `artifacts/pester/` — Pester coverage outputs
 - `artifacts/csharp/` — C# coverage outputs
 
+Research outputs from `task-researcher` are written to `docs/features/<feature>/research/` for feature-associated work or `docs/research/` for one-off work.
+
 All other `artifacts/` sub-paths (e.g., `artifacts/baselines/`, `artifacts/qa/`, `artifacts/coverage/`, `artifacts/evidence/`) are FORBIDDEN for evidence output and will be blocked by the `enforce-evidence-locations.ps1` PreToolUse hook.
 
 ## Completion Requirements

package/resources/codex-and-agents-customizations/.agents/skills/policy-audit-template-usage/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: policy-audit-template-usage
-description: 'Policy audit template usage and output requirements. Use when creating policy-audit.<timestamp>.md artifacts from the repo templates.'
+description: Policy audit template usage and output requirements. Use when creating timestamped policy-audit artifacts from the repository templates.
 ---
 
 # Policy Audit Template Usage

package/resources/codex-and-agents-customizations/.agents/skills/powershell/SKILL.md

@@ -1,9 +1,5 @@
 ---
 name: powershell
-paths:
-  - "**/*.ps1"
-  - "**/*.psm1"
-  - "**/*.psd1"
 description: PowerShell-specific toolchain and coding standards.
 ---
 

package/resources/codex-and-agents-customizations/.agents/skills/powershell-change-budget-router/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: powershell-change-budget-router
-description: Budget-first routing contract for PowerShell work: estimate production-file scope, choose small vs large path, enforce direct-mode escalation to orchestrator, and use the VS Code extension command surface for promotion lifecycle steps when available.
+description: 'Budget-first routing contract for PowerShell work: estimate production-file scope, choose small vs large path, enforce direct-mode escalation to orchestrator, and use the VS Code extension command surface for promotion lifecycle steps when available.'
 ---
 
 # PowerShell Change Budget Router

package/resources/codex-and-agents-customizations/.agents/skills/powershell-qa-gate/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: powershell-qa-gate
-description: Final QA gate for PowerShell changes. Executes the full PoshQC format -> analyze -> test toolchain (with coverage where enforced), compares against a captured baseline, enforces zero-regression deltas, and produces the required reporting block before the agent declares the change complete.
+description: Final QA gate for PowerShell changes. Runs PoshQC formatting, analysis, and testing with coverage where enforced; compares a captured baseline, enforces zero-regression deltas, and produces the required reporting block before completion.
 ---
 
 # PowerShell QA Gate

package/resources/codex-and-agents-customizations/.agents/skills/python/SKILL.md

@@ -1,7 +1,5 @@
 ---
 name: python
-paths:
-  - "**/*.py"
 description: Python-specific toolchain and coding standards.
 ---
 

package/resources/codex-and-agents-customizations/.agents/skills/python-qa-gate/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: python-qa-gate
-description: Final QA gate for Python changes. Executes the full Black -> Ruff -> Pyright -> Pytest toolchain, compares against a captured baseline, enforces zero-regression deltas, and produces the required reporting block before the agent declares the change complete.
+description: Final QA gate for Python changes. Runs Black, Ruff, Pyright, and Pytest; compares a captured baseline, enforces zero-regression deltas, and produces the required reporting block before completion.
 ---
 
 # Python QA Gate

package/resources/codex-and-agents-customizations/.agents/skills/python-suppressions/SKILL.md

@@ -1,7 +1,5 @@
 ---
 name: python-suppressions
-paths:
-  - "**/*.py"
 description: Python suppression policy for linting and type-checking exceptions.
 ---
 

package/resources/codex-and-agents-customizations/.agents/skills/quality-tiers/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: quality-tiers
 description: Module rigor tier system and uniform coverage thresholds.
-paths:
-  - "**"
 ---
 
 # Converted rule

package/resources/codex-and-agents-customizations/.agents/skills/research-issue/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: research-issue
-description: Investigate the best implementation approach for a feature or bug by analyzing the codebase and external references, then writing structured findings to artifacts/research/.
+description: Investigate the best implementation approach for a feature or bug by analyzing the codebase and external references, then writing structured findings to the applicable tracked research folder.
 ---
 
 # Research Issue Skill
@@ -17,9 +17,10 @@ Accept one or more feature documents as context:
 
 ## Output
 
-Create or update a single research file:
+Create or update a single research file in the applicable tracked research root:
 
-- Path: `artifacts/research/<timestamp>-<short-name>-research.md`
+- Feature-associated path: `docs/features/<feature>/research/<timestamp>-<short-name>-research.md`
+- One-off path: `docs/research/<timestamp>-<short-name>-research.md`
 - Use the Task Researcher template from the repository exactly.
 - Place rejected-alternatives summaries inside `## Recommended Approach`, not as a separate top-level header.
 

package/resources/codex-and-agents-customizations/.agents/skills/self-explanatory-code-commenting/SKILL.md

@@ -1,7 +1,5 @@
 ---
 name: self-explanatory-code-commenting
-paths:
-  - "**/*.py"
 description: Intent-first docstring and commenting standards.
 ---
 

package/resources/codex-and-agents-customizations/.agents/skills/tonality/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: tonality
 description: Required communication tone policy for all files and responses.
-paths:
-  - "**"
 ---
 
 # Converted rule

package/resources/codex-and-agents-customizations/.agents/skills/translate-claude-to-codex/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: translate-claude-to-codex
-description: Translate the native Claude Code runtime (CLAUDE.md, .claude/rules/*.md, .claude/skills/<name>/SKILL.md, .claude/agents/*.md, .claude/hooks/*.ps1, .claude/settings.json) into the native Codex ecosystem (AGENTS.md, .codex/config.toml, .codex/agents/*.toml, .agents/skills/<name>/SKILL.md, .codex/hooks.json). Classify each Claude surface into its Codex-native equivalent, preserve mechanical enforceability of every hardening element, diff against existing Codex state, produce a translation plan with an enforceability-preservation ledger for user approval, then apply.
+description: Translate the native Claude Code runtime, including Claude rules, skills, agents, hooks, and settings, into the native Codex ecosystem. Preserve mechanical enforceability, diff against existing Codex state, produce an approval plan with an enforceability ledger, then apply it.
 ---
 
 # Translate Claude to Codex
@@ -21,7 +21,7 @@ Use this skill when:
 
 ## Authoritative Inputs
 
-This skill consumes the Codex ecosystem mapping recorded in `artifacts/research/codex-native-ecosystem.2026-06-16T13-32.md`. That artifact is the source of truth for Codex primitive behavior, discovery order, and enforceability. Do not restate Codex documentation from memory; cite the research artifact.
+This skill consumes the Codex ecosystem mapping recorded in `docs/research/20260616-codex-native-ecosystem.2026-06-16T13-32.md`. That artifact is the source of truth for Codex primitive behavior, discovery order, and enforceability. Do not restate Codex documentation from memory; cite the research artifact.
 
 Required source paths under `.claude/` (one or more). Accepted types:
 
@@ -172,7 +172,7 @@ Plan structure:
 
 Generated: <timestamp>
 Mode: <plan-only | apply>
-Research basis: artifacts/research/codex-native-ecosystem.2026-06-16T13-32.md
+Research basis: docs/research/20260616-codex-native-ecosystem.2026-06-16T13-32.md
 
 ## Inputs
 - <source path 1>

package/resources/codex-and-agents-customizations/.agents/skills/translate-copilot-to-claude/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: translate-copilot-to-claude
-description: Translate one or more GitHub Copilot native files (AGENTS.md, .agents/skills/*.instructions.md, .codex/agents/*.agent.md, .agents/skills/*.prompt.md, .agents/skills/<name>/SKILL.md) into the native Claude runtime. Classify each section into agent/rule/skill/hook surfaces, diff against existing .claude/ state, produce a translation plan for user approval, and then apply the plan.
+description: Translate GitHub Copilot native files, including instructions, agents, prompts, and skills, into the native Claude runtime. Classify each section, diff against existing Claude state, produce a translation plan for approval, then apply it.
 ---
 
 # Translate Copilot to Claude

package/resources/codex-and-agents-customizations/.agents/skills/typescript/SKILL.md

@@ -1,7 +1,5 @@
 ---
 name: typescript
-paths:
-  - "**/*.ts"
 description: TypeScript-specific toolchain and coding standards.
 ---
 

package/resources/codex-and-agents-customizations/.agents/skills/typescript-suppressions/SKILL.md

@@ -1,7 +1,5 @@
 ---
 name: typescript-suppressions
-paths:
-  - "**/*.ts"
 description: TypeScript suppression policy for linting and type-checking exceptions.
 ---
 

package/resources/codex-and-agents-customizations/.codex/config.toml

@@ -2,7 +2,7 @@ default_permissions = ":danger-full-access"
 
 [mcp_servers.drm-copilot]
 command = "npx"
-args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.0"]
+args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.2"]
 required = true
 enabled_tools = [
     "collect_commit_context",

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-orchestration-preimplementation-gate-helpers.ps1

@@ -0,0 +1,349 @@
+<#
+.SYNOPSIS
+    Pathspec classifier for the orchestration-bookkeeping staging exemption (issue #539).
+.DESCRIPTION
+    Pure string logic only: no disk, process, network, or environment access. The single
+    entry predicate `Test-ExemptOrchestrationStagingCommand` answers one question - does
+    this command text parse, in its entirety, as recognized staging or integration
+    invocations whose every pathspec operand resolves inside an orchestration-bookkeeping
+    tree? Every parse ambiguity answers false, so the caller's pre-change deny is the
+    fallback for every unmodeled form.
+
+    The normative contract is the D4 fail-closed rule table in
+    docs/features/active/2026-08-24-preimplementation-gate-blocks-planner-integration-commits-539/spec.md.
+    Rule-table row numbers are cited inline against the code that realizes them.
+
+    This file is dot-sourced by the sibling gate hook, following the headroom-split
+    precedent set by enforce-pr-author-skill.ps1.
+#>
+
+# The five exempt orchestration-bookkeeping trees (D2). Directory prefixes, repo-relative,
+# forward-slash spelled. No glob, no absolute entry, no literal-file entry.
+$script:OrchestrationBookkeepingTrees = @(
+    'docs/features/epics/'
+    'docs/features/parallel/'
+    'docs/features/active/'
+    'docs/features/potential/'
+    'artifacts/orchestration/'
+)
+
+# Characters that make a command line statically unresolvable: shell interpolation and
+# redirection (D4 row 12). Tested across the whole line rather than per operand, because a
+# redirection anywhere in the line moves content the operand list cannot describe.
+$script:UnresolvableCommandCharacters = [char[]]@('$', '`', '>', '<')
+
+# Wildcards that make an operand a glob (D4 row 15). Only the literal prefix before the
+# first of these is prefix-tested.
+$script:PathspecWildcardCharacters = [char[]]@('*', '?', '[')
+
+function Split-OrchestrationCommandLine {
+    <#
+    .SYNOPSIS
+        Splits a command line into segments on chain operators outside quotes.
+    .DESCRIPTION
+        Realizes D4 row 13. Quote state is tracked while scanning so a chain operator
+        inside a quoted span does not split. The returned `Balanced` flag reports whether
+        the scan ended outside every quote; unbalanced text is not splittable and the
+        caller denies (D4 rows 11 and 13). Empty and whitespace-only segments are dropped.
+    .OUTPUTS
+        System.Collections.Hashtable with keys `Balanced` (bool) and `Segments` (string[]).
+    #>
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $CommandText)
+
+    $segments = [System.Collections.Generic.List[string]]::new()
+    $current = [System.Text.StringBuilder]::new()
+    $openQuote = [char]0
+
+    foreach ($character in $CommandText.ToCharArray()) {
+        if ($openQuote -ne [char]0) {
+            if ($character -eq $openQuote) {
+                $openQuote = [char]0
+            }
+            [void]$current.Append($character)
+            continue
+        }
+
+        if ($character -eq '"' -or $character -eq "'") {
+            $openQuote = $character
+            [void]$current.Append($character)
+            continue
+        }
+
+        if ($character -eq ';' -or $character -eq '&' -or $character -eq '|' -or
+            $character -eq "`n" -or $character -eq "`r") {
+            $segments.Add($current.ToString())
+            [void]$current.Clear()
+            continue
+        }
+
+        [void]$current.Append($character)
+    }
+    $segments.Add($current.ToString())
+
+    return @{
+        Balanced = ($openQuote -eq [char]0)
+        Segments = @($segments | Where-Object { $_.Trim() })
+    }
+}
+
+function ConvertTo-OrchestrationCommandToken {
+    <#
+    .SYNOPSIS
+        Splits one segment into whitespace-delimited tokens with balanced quotes stripped.
+    .DESCRIPTION
+        Realizes the quote handling of D4 row 11. A quoted span contributes to the token it
+        sits in, so `-m "epic scaffold"` yields the two tokens `-m` and `epic scaffold`, and
+        a quoted operand arrives at the prefix test unquoted. The caller has already
+        rejected unbalanced text, so an unterminated quote simply ends the final token.
+    .OUTPUTS
+        System.String[]
+    #>
+    [CmdletBinding()]
+    [OutputType([string[]])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $Segment)
+
+    $tokens = [System.Collections.Generic.List[string]]::new()
+    $current = [System.Text.StringBuilder]::new()
+    $hasToken = $false
+    $openQuote = [char]0
+
+    foreach ($character in $Segment.ToCharArray()) {
+        if ($openQuote -ne [char]0) {
+            if ($character -eq $openQuote) {
+                $openQuote = [char]0
+            } else {
+                [void]$current.Append($character)
+            }
+            continue
+        }
+
+        if ($character -eq '"' -or $character -eq "'") {
+            $openQuote = $character
+            $hasToken = $true
+            continue
+        }
+
+        if ([char]::IsWhiteSpace($character)) {
+            if ($hasToken) {
+                $tokens.Add($current.ToString())
+                [void]$current.Clear()
+                $hasToken = $false
+            }
+            continue
+        }
+
+        $hasToken = $true
+        [void]$current.Append($character)
+    }
+
+    if ($hasToken) {
+        $tokens.Add($current.ToString())
+    }
+
+    return $tokens.ToArray()
+}
+
+function Test-ExemptOrchestrationOperand {
+    <#
+    .SYNOPSIS
+        Tests one pathspec operand against the five exempt orchestration trees.
+    .DESCRIPTION
+        Realizes D4 rows 3, 9, 15, 16, 17, and 18. Backslashes normalize to forward slashes
+        before the prefix test (row 18); pathspec magic, absolute spellings, parent-directory
+        segments, and globs whose literal prefix escapes the exempt set all deny.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $Operand)
+
+    if (-not $Operand) {
+        return $false
+    }
+
+    # Row 3b and row 9: any leading colon is pathspec magic, which can escape or invert the
+    # tree scope, so no colon-led operand is ever resolvable by a prefix test.
+    if ($Operand.StartsWith(':')) {
+        return $false
+    }
+
+    # Row 18: separator normalization precedes every prefix comparison below.
+    $normalized = $Operand -replace '\\', '/'
+
+    # Row 16: rooted, drive-lettered, and UNC spellings all deny; the exempt prefixes stay
+    # repo-relative (this is the posture issue #516 later composes with).
+    if ($normalized.StartsWith('/')) {
+        return $false
+    }
+    if ($normalized -match '^[A-Za-z]:') {
+        return $false
+    }
+
+    # Rows 15c and 17: any parent-directory component escapes the prefix.
+    if (($normalized -split '/') -contains '..') {
+        return $false
+    }
+
+    # Row 15: only the literal prefix before the first wildcard is prefix-tested, so a glob
+    # whose wildcard occupies or truncates an ancestor segment cannot pass.
+    $literalPrefix = $normalized
+    $wildcardIndex = $normalized.IndexOfAny($script:PathspecWildcardCharacters)
+    if ($wildcardIndex -ge 0) {
+        $literalPrefix = $normalized.Substring(0, $wildcardIndex)
+    }
+
+    foreach ($tree in $script:OrchestrationBookkeepingTrees) {
+        if ($literalPrefix.StartsWith($tree)) {
+            return $true
+        }
+    }
+    return $false
+}
+
+function Test-ExemptOrchestrationSegmentToken {
+    <#
+    .SYNOPSIS
+        Tests one already-tokenized segment as a recognized all-exempt invocation.
+    .DESCRIPTION
+        Realizes D4 rows 1, 2, 4, 5, 6, 7, 8, 10, 14, and 19. The command name must lead the
+        segment and the subcommand must follow it immediately (row 14), the option table is
+        modelled positively so any unmodelled dash-leading token denies (rows 2, 5, 6, 8, 10),
+        tokens after the double-dash separator are pathspecs (row 7), at least one operand is
+        required (rows 1, 4, 7), and every operand must pass (row 19).
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory)][AllowEmptyCollection()][string[]] $Token)
+
+    if ($Token.Count -lt 2) {
+        return $false
+    }
+
+    # Row 14: the command name leads and the subcommand follows immediately. Anything in
+    # between - a relocating option or an env-style prefix - moves the pathspec base and is
+    # rejected here rather than modelled.
+    if ($Token[0] -cne 'git') {
+        return $false
+    }
+    $subcommand = $Token[1]
+    if ($subcommand -cne 'add' -and $subcommand -cne 'commit') {
+        return $false
+    }
+
+    $operands = [System.Collections.Generic.List[string]]::new()
+    $afterSeparator = $false
+    $index = 2
+
+    while ($index -lt $Token.Count) {
+        $candidate = $Token[$index]
+
+        if (-not $afterSeparator) {
+            if ($candidate -ceq '--') {
+                # Row 7: every remaining token is a pathspec, dash-leading or not.
+                $afterSeparator = $true
+                $index++
+                continue
+            }
+
+            if ($candidate.StartsWith('-')) {
+                # The message option is the only modelled option on either subcommand. Rows
+                # 2, 5, 6, 8, and 10 all land here and deny, including a dash-leading
+                # operand supplied without a preceding separator.
+                if ($subcommand -cne 'commit') {
+                    return $false
+                }
+                if ($candidate -ceq '-m' -or $candidate -ceq '--message') {
+                    # The message value is the following token and is not a pathspec.
+                    $index += 2
+                    if ($index -gt $Token.Count) {
+                        return $false
+                    }
+                    continue
+                }
+                if ($candidate.StartsWith('--message=') -or
+                    ($candidate.Length -gt 2 -and $candidate.StartsWith('-m'))) {
+                    $index++
+                    continue
+                }
+                return $false
+            }
+        }
+
+        $operands.Add($candidate)
+        $index++
+    }
+
+    # Rows 1, 4, and 7: an invocation with no pathspec operand claims no path, so there is
+    # nothing for the prefix test to scope and the exemption is not available.
+    if ($operands.Count -eq 0) {
+        return $false
+    }
+
+    # Row 19: all-operands-exempt is the invariant; one non-exempt operand denies the set.
+    foreach ($operand in $operands) {
+        if (-not (Test-ExemptOrchestrationOperand -Operand $operand)) {
+            return $false
+        }
+    }
+    return $true
+}
+
+function Test-ExemptOrchestrationStagingCommand {
+    <#
+    .SYNOPSIS
+        Reports whether a command line is an orchestration-bookkeeping staging invocation.
+    .DESCRIPTION
+        The entry predicate of the issue #539 exemption. Returns true only when the whole
+        command line splits cleanly into segments and EVERY segment parses as a complete,
+        recognized staging or integration invocation carrying at least one pathspec operand,
+        with every operand resolving inside one of the five exempt orchestration-bookkeeping
+        trees after balanced-quote stripping and separator normalization.
+
+        The all-segments reading is deliberate and fail-closed: a chained line denies unless
+        each of its segments is independently a recognized all-exempt invocation, so a
+        relocating spelling or a prose fragment anywhere in the line withholds the exemption
+        even when another segment on the same line would have qualified on its own.
+
+        Consumed allow-side only. A false result restores the caller's unchanged
+        classification; it never suppresses the trigger.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $CommandText)
+
+    if (-not $CommandText) {
+        return $false
+    }
+
+    # Row 12: interpolation and redirection are not statically resolvable, so the operand
+    # list cannot be trusted to describe what the line actually touches.
+    if ($CommandText.IndexOfAny($script:UnresolvableCommandCharacters) -ge 0) {
+        return $false
+    }
+
+    $split = Split-OrchestrationCommandLine -CommandText $CommandText
+    if (-not $split.Balanced) {
+        # Rows 11 and 13: unbalanced quoting makes the segment boundaries ambiguous.
+        return $false
+    }
+
+    $segments = @($split.Segments)
+    if ($segments.Count -eq 0) {
+        return $false
+    }
+
+    foreach ($segment in $segments) {
+        $tokens = @(ConvertTo-OrchestrationCommandToken -Segment $segment)
+        if (-not (Test-ExemptOrchestrationSegmentToken -Token $tokens)) {
+            return $false
+        }
+    }
+    return $true
+}