@danmoisan/drm-copilot-mcp 1.1.15 → 1.1.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danmoisan/drm-copilot-mcp",
-  "version": "1.1.15",
+  "version": "1.1.16",
   "description": "Stdio MCP server exposing drm-copilot repo-automation tools.",
   "license": "MIT",
   "type": "commonjs",

package/resources/claude-customizations/.claude/agents/powershell-typed-engineer.md

@@ -1,7 +1,7 @@
 ---
 name: powershell-typed-engineer
 model: sonnet
-description: Project-scoped worker that implements and verifies PowerShell changes within typed repository boundaries. Applies PoshQC format -> PSScriptAnalyzer -> Pester toolchain, the 1-2 production-file direct-mode budget, the 3-production + 3-test per-batch cap, and zero-regression quality gates.
+description: Project-scoped worker that implements and verifies PowerShell changes within typed repository boundaries. Applies PoshQC format -> PSScriptAnalyzer -> Pester toolchain, the 1-3 production-file direct-mode budget with routing to the orchestrated large path above it, and zero-regression quality gates.
 tools:
   - Read
   - Grep
@@ -36,7 +36,7 @@ Language standards and toolchain are defined in `.claude/rules/powershell.md` an
 Follow the phased workflow defined by the preloaded skills:
 
 1. **Policy compliance** — apply `policy-compliance-order` to load mandatory repo policies before any change.
-2. **Routing and scope** — apply `powershell-change-budget-router` to estimate scope and select direct mode (1-2 production files) vs `powershell-orchestrator` escalation. Enforce the 3 production + 3 test per-batch cap in all modes.
+2. **Routing and scope** — apply `powershell-change-budget-router` to estimate scope and select direct mode (1-3 production files) vs large-path escalation through `/orchestrate`. The large path has no production-file cap.
 3. **Plan and baseline** — apply `atomic-plan-contract` for Phase 0 baseline capture and atomic plan structure. Delegate plan authoring to `atomic_planner` when no plan is supplied. Plans must include the proposed script or module structure, minimal DI seams (wrapper > delegate > adapter), Pester scenario-level test strategy, and the external executable wrapper mock strategy.
 4. **Implement in batches** — apply the approved plan. After each batch, run targeted PSScriptAnalyzer on touched files plus targeted Pester, and confirm per-file coverage.
 5. **Final QA gate** — apply `powershell-qa-gate` to run the full toolchain, enforce zero-regression deltas against the baseline, and produce the required reporting block before declaring completion.
@@ -46,7 +46,7 @@ For long-running orchestrated runs, apply `powershell-orchestration-state-machin
 
 ## Invocation Modes
 
-- **Direct mode** (default, no directive present): strict 1-2 production PowerShell files cap. If the estimated scope exceeds 2 production files, stop and instruct the caller to invoke `powershell-orchestrator` per `powershell-change-budget-router`.
+- **Direct mode** (default, no directive present): strict 1-3 production PowerShell files cap. If the estimated scope exceeds 3 production files, stop and instruct the caller to invoke `/orchestrate` per `powershell-change-budget-router`.
 - **Orchestrator handoff mode** (request contains the exact line `DIRECTIVE: ORCHESTRATOR HANDOFF MODE`): overall production-file cap is lifted, but execution requires a complete context package (`objective`, `promotion-type`, `issue-num`, `feature-folder`, `issue.md`, `spec.md`, `user-story.md` or `NONE`, research artifact paths, constraints). In this mode the agent is routing/planning-only until `atomic_planner` returns `PREFLIGHT: ALL CLEAR` from the `atomic-executor` validation loop; all implementation and QA execution must occur via delegated `atomic-executor` handoffs.
 
 ## Mode Marker Resolution
@@ -64,8 +64,7 @@ If the marker is missing or malformed, fail closed to `full-feature`.
 
 Stop implementation and return to the user when:
 
-- the scope estimate exceeds the 2-production-file cap in direct mode,
-- an in-flight batch would exceed the 3-production-file or 3-test-file per-batch cap,
+- the scope estimate exceeds the 3-production-file cap in direct mode,
 - a file is near or would exceed the 500-line limit,
 - any QA gate delta is non-zero after self-correction,
 - the toolchain cannot be executed in the current environment (mark the change **unverified**),

package/resources/claude-customizations/.claude/hooks/enforce-powershell-batch-budget-route.ps1

@@ -0,0 +1,137 @@
+<#
+.SYNOPSIS
+    Pure route helpers for the PowerShell batch-budget hook.
+
+.DESCRIPTION
+    Defines the functions that read the selected route from orchestrator checkpoint
+    text and decide whether that checkpoint selects the uncapped orchestrated large
+    path. The file is dot-sourced by enforce-powershell-batch-budget.ps1 and has no
+    entry point. None of the functions reads a file or an environment variable; the
+    checkpoint text is supplied by the caller.
+
+.NOTES
+    Compatible with PowerShell 7+.
+#>
+
+function ConvertFrom-PowerShellBatchBudgetCheckpoint {
+    <#
+    .SYNOPSIS
+        Parses orchestrator checkpoint text into a checkpoint object.
+    .DESCRIPTION
+        Returns the parsed object only when the text is a JSON object. Null or
+        whitespace text, text that is not parseable JSON, and JSON whose root is not
+        an object all return $null. Performs no file or environment access.
+    .PARAMETER CheckpointText
+        Raw text of the orchestrator checkpoint file.
+    #>
+    [CmdletBinding()]
+    [OutputType([psobject])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $CheckpointText
+    )
+
+    if ([string]::IsNullOrWhiteSpace($CheckpointText)) {
+        return $null
+    }
+
+    try {
+        $parsed = ConvertFrom-Json -InputObject $CheckpointText -ErrorAction Stop
+    } catch {
+        Write-Verbose "Ignoring unparseable orchestrator checkpoint text: $($_.Exception.Message)"
+        return $null
+    }
+
+    if ($parsed -is [System.Management.Automation.PSCustomObject]) {
+        return $parsed
+    }
+
+    return $null
+}
+
+function Get-PowerShellBatchBudgetSelectedRoute {
+    <#
+    .SYNOPSIS
+        Returns the route selected by an orchestrator checkpoint.
+    .DESCRIPTION
+        Uses route_id when the checkpoint has that key, otherwise path_selected. The
+        value is returned only when it is a non-blank string; every other case,
+        including unparseable text, returns an empty string.
+    .PARAMETER CheckpointText
+        Raw text of the orchestrator checkpoint file.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $CheckpointText
+    )
+
+    $checkpoint = ConvertFrom-PowerShellBatchBudgetCheckpoint -CheckpointText $CheckpointText
+    if ($null -eq $checkpoint) {
+        return ''
+    }
+
+    $propertyNames = @($checkpoint.PSObject.Properties.Name)
+    $rawRoute = $null
+    if ($propertyNames -contains 'route_id') {
+        $rawRoute = $checkpoint.route_id
+    } elseif ($propertyNames -contains 'path_selected') {
+        $rawRoute = $checkpoint.path_selected
+    }
+
+    if ($rawRoute -is [string] -and -not [string]::IsNullOrWhiteSpace($rawRoute)) {
+        return $rawRoute
+    }
+
+    return ''
+}
+
+function Test-PowerShellBatchBudgetLargePathRoute {
+    <#
+    .SYNOPSIS
+        Reports whether an orchestrator checkpoint selects the uncapped large path.
+    .DESCRIPTION
+        Returns $true only when the checkpoint parses to an object, its selected route
+        is large, remediation, or preparation (case-sensitive), next_step is not
+        complete, and completed_steps does not contain S12_complete. No input causes
+        an exception; any failure returns $false.
+    .PARAMETER CheckpointText
+        Raw text of the orchestrator checkpoint file.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $CheckpointText
+    )
+
+    try {
+        $checkpoint = ConvertFrom-PowerShellBatchBudgetCheckpoint -CheckpointText $CheckpointText
+        if ($null -eq $checkpoint) {
+            return $false
+        }
+
+        $route = Get-PowerShellBatchBudgetSelectedRoute -CheckpointText $CheckpointText
+        if (-not (@('large', 'remediation', 'preparation') -ccontains $route)) {
+            return $false
+        }
+
+        $propertyNames = @($checkpoint.PSObject.Properties.Name)
+        if ($propertyNames -contains 'next_step' -and $checkpoint.next_step -is [string] -and $checkpoint.next_step -ceq 'complete') {
+            return $false
+        }
+
+        if ($propertyNames -contains 'completed_steps' -and (@($checkpoint.completed_steps) -ccontains 'S12_complete')) {
+            return $false
+        }
+
+        return $true
+    } catch {
+        Write-Verbose "Treating the orchestrator checkpoint as direct mode: $($_.Exception.Message)"
+        return $false
+    }
+}

package/resources/claude-customizations/.claude/hooks/enforce-powershell-batch-budget.ps1

@@ -1,18 +1,35 @@
 <#
 .SYNOPSIS
-    Pre-tool-use hook that enforces the PowerShell per-batch change budget.
+    Pre-tool-use hook that routes PowerShell changes of more than three production files to the orchestrated large path.
 
 .DESCRIPTION
     This script is invoked by the Claude Code PreToolUse hook before any Write or Edit
     operation. When the target file is a PowerShell source file (.ps1, .psm1, .psd1),
-    it classifies the file as either production or test and checks the running count
-    against the per-batch cap:
-      - 3 production PowerShell files per batch
-      - 3 test PowerShell files per batch
+    it decides whether the change may proceed in direct mode.
+
+    Direct mode counts distinct production PowerShell paths per Claude Code session.
+    The running set is persisted under .claude/state/powershell-batch-budget.<session_id>.json,
+    and repeated edits to the same file are counted once. The 4th distinct production
+    path is denied with a POWERSHELL_LARGE_PATH_REQUIRED reason that instructs the
+    caller to route the change through /orchestrate.
+
+    The orchestrated large path is detected from
+    <root>/artifacts/orchestration/orchestrator-state.json. The selected route is the
+    route_id value when that key is present, otherwise the path_selected value, and it
+    is usable only as a non-blank string. When the selected route is large,
+    remediation, or preparation and the checkpoint is not terminal (next_step is not
+    complete and completed_steps does not contain S12_complete), no path is denied for
+    count and no state is written. Every other checkpoint outcome, including an absent,
+    unreadable, or malformed checkpoint, enforces direct mode.
+
+    Test files are never counted. They are those matching:
+      - tests/**/*.ps1
+      - *.Tests.ps1
 
-    A "batch" is scoped to the current Claude Code session. The running count is
-    persisted under .claude/state/powershell-batch-budget.<session_id>.json. Only
-    distinct file paths are counted; repeated edits to the same file consume one slot.
+    All other .ps1/.psm1/.psd1 files are production files. Non-PowerShell paths pass
+    through. The threshold of three production files is a routing constant and is not
+    configurable at runtime. Legacy prodCap, testCap, and testFiles keys in a persisted
+    state file are ignored when the state is loaded.
 
     The session id is resolved from the first non-empty of: the CLAUDE_SESSION_ID
     environment variable; the contents of <root>/.claude/state/current-session-id;
@@ -27,22 +44,13 @@
     dropped when state is rehydrated, so a state file carried between worktrees
     cannot spend this worktree's budget.
 
-    Test files are those matching:
-      - tests/**/*.ps1
-      - *.Tests.ps1
-
-    All other .ps1/.psm1/.psd1 files are treated as production files. Non-PowerShell
-    paths pass through.
-
-    The cap may be overridden per session by setting the environment variable
-    CLAUDE_POWERSHELL_BUDGET_PROD or CLAUDE_POWERSHELL_BUDGET_TEST to a positive integer
-    before the session starts, or by writing {"prodCap": N, "testCap": M} into the
-    state file.
+    When a production path is denied, the script emits a PreToolUse JSON response with
+    hookSpecificOutput.permissionDecision = 'deny' and exits 0. Files already counted
+    are always allowed through.
 
-    When the cap would be exceeded by a new file, the script emits a PreToolUse JSON
-    response with hookSpecificOutput.permissionDecision = 'deny' and exits 0. The session
-    must explicitly reset the counter by deleting the state file before starting a new
-    batch. Files already counted are always allowed through.
+    Known limitation: a stale non-terminal large-path checkpoint left at the root
+    exempts a later direct-mode session at that root. Orchestrator checkpoint hygiene
+    (issue #673) moves foreign checkpoints aside before a new run.
 
 .NOTES
     Compatible with PowerShell 7+.
@@ -52,6 +60,7 @@ param()
 
 
 Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
+. (Join-Path $PSScriptRoot 'enforce-powershell-batch-budget-route.ps1')
 
 function Test-PowerShellBatchBudgetPathInRoot {
     <#
@@ -174,25 +183,24 @@ function Get-PowerShellBatchBudgetSessionId {
 }
 
 function Get-PowerShellBatchBudgetState {
+    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', 'TestCap', Justification = 'Accepted and ignored for callers written against the removed test-file cap.')]
     [CmdletBinding()]
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
     param(
         [Parameter(Mandatory)]
         [int] $ProdCap,
 
-        [Parameter(Mandatory)]
-        [int] $TestCap
+        [int] $TestCap = 0
     )
 
     [ordered]@{
         prodCap   = $ProdCap
-        testCap   = $TestCap
         prodFiles = @()
-        testFiles = @()
     }
 }
 
 function ConvertTo-PowerShellBatchBudgetState {
+    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', 'TestCap', Justification = 'Accepted and ignored for callers written against the removed test-file cap.')]
     [CmdletBinding()]
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
     param(
@@ -202,17 +210,16 @@ function ConvertTo-PowerShellBatchBudgetState {
         [Parameter(Mandatory)]
         [int] $ProdCap,
 
-        [Parameter(Mandatory)]
-        [int] $TestCap,
+        [int] $TestCap = 0,
 
         [AllowNull()]
         [AllowEmptyString()]
         [string] $Root = (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent)
     )
 
-    $state = Get-PowerShellBatchBudgetState -ProdCap $ProdCap -TestCap $TestCap
-    if ($null -ne $InputObject.prodCap) { $state.prodCap = [int]$InputObject.prodCap }
-    if ($null -ne $InputObject.testCap) { $state.testCap = [int]$InputObject.testCap }
+    # Only prodFiles is carried over. Persisted prodCap, testCap, and testFiles keys
+    # come from the removed test-file cap and runtime overrides and are ignored.
+    $state = Get-PowerShellBatchBudgetState -ProdCap $ProdCap
 
     # Persisted entries that resolve outside this root belong to another worktree
     # and are dropped, so a state file carried across worktrees cannot spend this
@@ -220,9 +227,6 @@ function ConvertTo-PowerShellBatchBudgetState {
     if ($null -ne $InputObject.prodFiles) {
         $state.prodFiles = @(@($InputObject.prodFiles) | Where-Object { Test-PowerShellBatchBudgetPathInRoot -Path $_ -Root $Root })
     }
-    if ($null -ne $InputObject.testFiles) {
-        $state.testFiles = @(@($InputObject.testFiles) | Where-Object { Test-PowerShellBatchBudgetPathInRoot -Path $_ -Root $Root })
-    }
 
     return $state
 }
@@ -261,12 +265,17 @@ function Invoke-PowerShellBatchBudgetDecision {
         [Parameter(Mandatory)]
         [System.Collections.IDictionary] $State,
 
-        [Parameter(Mandatory)]
-        [string] $StateFile,
+        [AllowEmptyString()]
+        [string] $StateFile = '',
 
         [AllowNull()]
         [AllowEmptyString()]
-        [string] $Root = (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent)
+        [string] $Root = (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent),
+
+        [switch] $LargePathRoute,
+
+        [AllowEmptyString()]
+        [string] $ObservedRoute = ''
     )
 
     $normalized = $FilePath -replace '\\', '/'
@@ -281,27 +290,32 @@ function Invoke-PowerShellBatchBudgetDecision {
         return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' }; state = $State; shouldWriteState = $false }
     }
 
+    # The orchestrated large path has no production-file cap, so nothing is counted.
+    if ($LargePathRoute) {
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' }; state = $State; shouldWriteState = $false }
+    }
+
+    # Test files never count toward the routing threshold.
     $isTestFile = ($normalized -match '(^|/)tests/.*\.ps1$') -or ($normalized -match '\.Tests\.ps1$')
-    $targetList = if ($isTestFile) { @($State.testFiles) } else { @($State.prodFiles) }
-    $cap = if ($isTestFile) { [int]$State.testCap } else { [int]$State.prodCap }
-    $kind = if ($isTestFile) { 'test' } else { 'production' }
+    if ($isTestFile) {
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' }; state = $State; shouldWriteState = $false }
+    }
 
-    if ($targetList -contains $normalized) {
+    $countedFiles = @($State.prodFiles)
+    if ($countedFiles -contains $normalized) {
         return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' }; state = $State; shouldWriteState = $false }
     }
 
-    if ($targetList.Count -ge $cap) {
-        $currentFiles = ($targetList -join ', ')
-        $kindUpper = $kind.ToUpperInvariant()
-        $reason = "PowerShell per-batch budget exceeded: $kind file cap is $cap and is already full ($currentFiles). Requested new file: $normalized. Split the work into a new batch, raise the cap via CLAUDE_POWERSHELL_BUDGET_$kindUpper environment variable with approved scope, or reset the batch by deleting $StateFile."
+    $cap = [int]$State.prodCap
+    if ($countedFiles.Count -ge $cap) {
+        Write-Verbose "Denying production PowerShell path '$normalized' in direct mode; counted paths are recorded in '$StateFile'."
+        $counted = $countedFiles -join ', '
+        $route = if ([string]::IsNullOrWhiteSpace($ObservedRoute)) { 'none' } else { $ObservedRoute }
+        $reason = "POWERSHELL_LARGE_PATH_REQUIRED: this change touches more than $cap production PowerShell files (already counted: $counted; requested: $normalized). A change of this size belongs on the orchestrated large path, which has no production-file cap. Route the change through /orchestrate. Checkpoint route observed: $route."
         return Get-PowerShellBatchBudgetBlockDecision -Reason $reason -State $State
     }
 
-    if ($isTestFile) {
-        $State.testFiles = @($State.testFiles) + @($normalized)
-    } else {
-        $State.prodFiles = @($State.prodFiles) + @($normalized)
-    }
+    $State.prodFiles = $countedFiles + @($normalized)
 
     return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' }; state = $State; shouldWriteState = $true }
 }
@@ -314,7 +328,6 @@ function Invoke-PowerShellBatchBudgetHook {
         [string] $SessionId = '',
         [string] $Root = (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent),
         [int] $ProdCap = 3,
-        [int] $TestCap = 3,
         [scriptblock] $ReadSessionIdFile = {
             param([string] $Path)
             if (Test-Path -LiteralPath $Path -PathType Leaf) {
@@ -322,6 +335,13 @@ function Invoke-PowerShellBatchBudgetHook {
             }
             return ''
         },
+        [scriptblock] $ReadCheckpoint = {
+            param([string] $Path)
+            if (Test-Path -LiteralPath $Path -PathType Leaf) {
+                return (Get-Content -LiteralPath $Path -Raw)
+            }
+            return ''
+        },
         [scriptblock] $TestPathExists = { param([string] $Path) Test-Path -Path $Path },
         [scriptblock] $EnsureDirectory = { param([string] $Path) New-Item -ItemType Directory -Path $Path -Force | Out-Null },
         [scriptblock] $ReadState = { param([string] $Path) Get-Content -Path $Path -Raw },
@@ -359,23 +379,41 @@ function Invoke-PowerShellBatchBudgetHook {
         -SessionIdFilePath (Join-Path -Path $stateDir -ChildPath 'current-session-id') `
         -ReadSessionIdFile $ReadSessionIdFile
 
+    $stateFile = Join-Path -Path $stateDir -ChildPath ("powershell-batch-budget.$resolvedSessionId.json")
+
+    # The checkpoint is read before any state operation, so the large path neither
+    # creates the state directory nor reads or writes the state file.
+    $checkpointPath = Join-Path -Path $Root -ChildPath 'artifacts/orchestration/orchestrator-state.json'
+    $checkpointText = ''
+    try {
+        $checkpointText = [string](& $ReadCheckpoint $checkpointPath)
+    } catch {
+        Write-Verbose "Treating unreadable orchestrator checkpoint '$checkpointPath' as direct mode: $($_.Exception.Message)"
+        $checkpointText = ''
+    }
+
+    $isLargePath = Test-PowerShellBatchBudgetLargePathRoute -CheckpointText $checkpointText
+    $observedRoute = Get-PowerShellBatchBudgetSelectedRoute -CheckpointText $checkpointText
+    if ($isLargePath) {
+        return Invoke-PowerShellBatchBudgetDecision -FilePath $filePath -State (Get-PowerShellBatchBudgetState -ProdCap $ProdCap) -StateFile $stateFile -Root $Root -LargePathRoute
+    }
+
     if (-not (& $TestPathExists $stateDir)) {
         & $EnsureDirectory $stateDir
     }
 
-    $stateFile = Join-Path -Path $stateDir -ChildPath ("powershell-batch-budget.$resolvedSessionId.json")
-    $state = Get-PowerShellBatchBudgetState -ProdCap $ProdCap -TestCap $TestCap
+    $state = Get-PowerShellBatchBudgetState -ProdCap $ProdCap
 
     if (& $TestPathExists $stateFile) {
         try {
             $loaded = & $ReadState $stateFile | ConvertFrom-Json -ErrorAction Stop
-            $state = ConvertTo-PowerShellBatchBudgetState -InputObject $loaded -ProdCap $ProdCap -TestCap $TestCap -Root $Root
+            $state = ConvertTo-PowerShellBatchBudgetState -InputObject $loaded -ProdCap $ProdCap -Root $Root
         } catch {
             Write-Verbose "Ignoring unreadable PowerShell batch-budget state file '$stateFile': $($_.Exception.Message)"
         }
     }
 
-    $decision = Invoke-PowerShellBatchBudgetDecision -FilePath $filePath -State $state -StateFile $stateFile -Root $Root
+    $decision = Invoke-PowerShellBatchBudgetDecision -FilePath $filePath -State $state -StateFile $stateFile -Root $Root -ObservedRoute $observedRoute
     if ($decision.shouldWriteState) {
         try {
             & $WriteState $stateFile $decision.state
@@ -423,16 +461,7 @@ function Invoke-PowerShellBatchBudgetEntryPoint {
     # worktree-derived identifier.
     $sessionId = [string]$env:CLAUDE_SESSION_ID
 
-    $prodCap = 3
-    $testCap = 3
-    if ($env:CLAUDE_POWERSHELL_BUDGET_PROD -match '^\d+$') {
-        $prodCap = [int]$env:CLAUDE_POWERSHELL_BUDGET_PROD
-    }
-    if ($env:CLAUDE_POWERSHELL_BUDGET_TEST -match '^\d+$') {
-        $testCap = [int]$env:CLAUDE_POWERSHELL_BUDGET_TEST
-    }
-
-    $decision = Invoke-PowerShellBatchBudgetHook -ToolInputRaw $ToolInputRaw -SessionId $sessionId -ProdCap $prodCap -TestCap $testCap
+    $decision = Invoke-PowerShellBatchBudgetHook -ToolInputRaw $ToolInputRaw -SessionId $sessionId
     if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {
         $decision.Remove('state')
         $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output

package/resources/claude-customizations/.claude/rules/powershell.md

@@ -36,9 +36,9 @@ Run the toolchain in order: format → analyze → test. Restart from step 1 if
 
 ## Change Budget
 
-- Direct-mode overall scope: up to 2 production PowerShell files (plus corresponding tests). Requests exceeding this must be routed to `powershell-orchestrator` per `powershell-change-budget-router`.
-- Per-batch cap in all modes: at most 3 production files and 3 test files unless an explicit override has been approved.
-- If a batch would exceed the cap, split the work into smaller batches.
+- Direct-mode scope: 1-3 production PowerShell files (plus corresponding tests). A change that touches more than 3 production PowerShell files belongs on the orchestrated large path: route it through `/orchestrate` (the `orchestrator` agent) per `powershell-change-budget-router`.
+- The orchestrated large path has no production-file cap. Test files are not counted toward the routing threshold.
+- `.claude/hooks/enforce-powershell-batch-budget.ps1` enforces the threshold outside the large path: it denies the 4th distinct production PowerShell file with a routing instruction.
 
 ## Design Seams (Minimal DI)
 

package/resources/claude-customizations/.claude/skills/invoke-powershell-engineer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: invoke-powershell-engineer
-description: Invoke the powershell-typed-engineer worker to design, implement, and verify PowerShell changes within typed repository boundaries. Applies PoshQC format -> analyze -> test toolchain, the 1-2 production-file direct-mode budget, the 3-production + 3-test per-batch cap, and zero-regression quality gates.
+description: Invoke the powershell-typed-engineer worker to design, implement, and verify PowerShell changes within typed repository boundaries. Applies PoshQC format -> analyze -> test toolchain, the 1-3 production-file direct-mode budget with routing to the orchestrated large path above it, and zero-regression quality gates.
 ---
 
 # Implement PowerShell Skill
@@ -12,10 +12,10 @@ This direct-use wrapper delegates PowerShell implementation work to the `powersh
 Use this skill when:
 
 - The user requests a PowerShell code change, bug fix, refactor, or test addition.
-- Estimated scope fits the direct-mode path (1-2 production PowerShell files plus corresponding tests).
+- Estimated scope fits the direct-mode path (1-3 production PowerShell files plus corresponding tests).
 - The toolchain (PoshQC format, PSScriptAnalyzer, Pester with coverage where enforced) can be run in the current environment, or the user has explicitly authorized an unverified plan-only response.
 
-If the estimated scope exceeds the direct-mode budget, this skill defers to the orchestrated flow via `powershell-change-budget-router` instead of proceeding directly.
+If the estimated scope exceeds the direct-mode budget, this skill defers to the orchestrated large path (`/orchestrate`) via `powershell-change-budget-router` instead of proceeding directly.
 
 ## Inputs
 
@@ -23,7 +23,6 @@ If the estimated scope exceeds the direct-mode budget, this skill defers to the
 - Files or entrypoints in scope (exact script or module paths and corresponding `*.Tests.ps1` paths).
 - Constraints, including public function or module contracts that must be preserved.
 - Optional approved plan. If none is supplied, the worker delegates plan authoring to `atomic_planner` before any edits.
-- Optional budget override in the form `budget: prod=<N>, test=<M>` subject to repo policy compliance.
 
 ## Output Paths
 

package/resources/claude-customizations/.claude/skills/powershell-change-budget-router/SKILL.md

@@ -5,7 +5,7 @@ description: Budget-first routing contract for PowerShell work: estimate product
 
 # PowerShell Change Budget Router
 
-Canonical guidance for deciding whether work should execute directly in `powershell-typed-engineer` or be escalated to `powershell-orchestrator`.
+Canonical guidance for deciding whether work should execute directly in `powershell-typed-engineer` or be escalated to the orchestrated large path through `/orchestrate` (the `orchestrator` agent).
 
 ## When to Use This Skill
 
@@ -18,12 +18,12 @@ Use this skill when:
 
 1) Estimate rough change budget first based on likely **production PowerShell files** touched.
 2) Route:
-- `1-2` production files (+ corresponding tests) → **small path** (`powershell-typed-engineer` direct mode).
-- `>2` production files → **large path** (`powershell-orchestrator`).
+- `1-3` production files (+ corresponding tests) → **small path** (`powershell-typed-engineer` direct mode).
+- More than 3 production files → **large path** (`/orchestrate`, the `orchestrator` agent). The large path has no production-file cap.
 
 ## Orchestrated Small-Path Requirements
 
-When routed through `powershell-orchestrator`, small path still requires lifecycle scaffolding before implementation:
+When routed through `/orchestrate`, small path still requires lifecycle scaffolding before implementation:
 - invoke promotion/folder lifecycle steps through `vscode/runCommand` + extension access per `feature-promotion-lifecycle` when available; use script/CLI fallback only when direct extension command execution is unavailable,
 - promote potential item to GitHub issue with `--work-mode minor-audit`,
 - create active feature folder with `--work-mode minor-audit`,
@@ -36,9 +36,9 @@ Direct invocation of `powershell-typed-engineer` remains implementation-focused
 
 ## Direct-Mode Rejection Rule
 
-If `powershell-typed-engineer` is invoked directly and estimated scope is `>2` production files:
+If `powershell-typed-engineer` is invoked directly and estimated scope is more than 3 production files:
 - Stop before implementation.
-- Return explicit routing instruction to invoke `powershell-orchestrator`.
+- Return explicit routing instruction to invoke `/orchestrate`.
 
 ## Documentation Expectations
 

package/resources/claude-customizations/pack-manifests/powershell.json

@@ -6,6 +6,7 @@
     ".claude/agents/powershell-typed-engineer.md",
     ".claude/hooks/check-powershell-test-purity.ps1",
     ".claude/hooks/enforce-powershell-batch-budget.ps1",
+    ".claude/hooks/enforce-powershell-batch-budget-route.ps1",
     ".claude/skills/invoke-powershell-engineer/SKILL.md",
     ".claude/skills/powershell-change-budget-router/SKILL.md",
     ".claude/skills/powershell-orchestration-state-machine/SKILL.md",

package/resources/codex-and-agents-customizations/.agents/skills/invoke-powershell-engineer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: invoke-powershell-engineer
-description: Invoke the powershell-typed-engineer worker to design, implement, and verify PowerShell changes within typed repository boundaries. Applies PoshQC formatting, analysis, and testing with a one-to-two production-file direct-mode budget, a three-production plus three-test batch cap, and zero-regression quality gates.
+description: Invoke the powershell-typed-engineer worker to design, implement, and verify PowerShell changes within typed repository boundaries. Applies PoshQC formatting, analysis, and testing with a one-to-two production-file direct-mode budget and zero-regression quality gates.
 ---
 
 # Implement PowerShell Skill

package/resources/codex-and-agents-customizations/.agents/skills/powershell/SKILL.md

@@ -34,8 +34,7 @@ Run the toolchain in order: format → analyze → test. Restart from step 1 if
 ## Change Budget
 
 - Direct-mode overall scope: up to 2 production PowerShell files (plus corresponding tests). Requests exceeding this must be routed to `powershell-orchestrator` per `powershell-change-budget-router`.
-- Per-batch cap in all modes: at most 3 production files and 3 test files unless an explicit override has been approved.
-- If a batch would exceed the cap, split the work into smaller batches.
+- The orchestrated large path has no production-file cap, and test files are not counted toward the routing threshold.
 
 ## Design Seams (Minimal DI)
 

package/resources/codex-and-agents-customizations/.codex/agents/powershell-typed-engineer-c1.toml

@@ -29,7 +29,7 @@ Migration contract:
 
 ---
 name: powershell-typed-engineer
-description: Project-scoped worker that implements and verifies PowerShell changes within typed repository boundaries. Applies PoshQC format -> PSScriptAnalyzer -> Pester toolchain, the 1-2 production-file direct-mode budget, the 3-production + 3-test per-batch cap, and zero-regression quality gates.
+description: Project-scoped worker that implements and verifies PowerShell changes within typed repository boundaries. Applies PoshQC format -> PSScriptAnalyzer -> Pester toolchain, the 1-2 production-file direct-mode budget, and zero-regression quality gates.
 tools:
   - Read
   - Grep
@@ -64,7 +64,7 @@ Language standards and toolchain are defined in `.agents/skills/powershell/SKILL
 Follow the phased workflow defined by the preloaded skills:
 
 1. **Policy compliance** — apply `policy-compliance-order` to load mandatory repo policies before any change.
-2. **Routing and scope** — apply `powershell-change-budget-router` to estimate scope and select direct mode (1-2 production files) vs `powershell-orchestrator` escalation. Enforce the 3 production + 3 test per-batch cap in all modes.
+2. **Routing and scope** — apply `powershell-change-budget-router` to estimate scope and select direct mode (1-2 production files) vs `powershell-orchestrator` escalation. The large path has no production-file cap.
 3. **Plan and baseline** — apply `atomic-plan-contract` for Phase 0 baseline capture and atomic plan structure. Delegate plan authoring to `atomic_planner` when no plan is supplied. Plans must include the proposed script or module structure, minimal DI seams (wrapper > delegate > adapter), Pester scenario-level test strategy, and the external executable wrapper mock strategy.
 4. **Implement in batches** — apply the approved plan. After each batch, run targeted PSScriptAnalyzer on touched files plus targeted Pester, and confirm per-file coverage.
 5. **Final QA gate** — apply `powershell-qa-gate` to run the full toolchain, enforce zero-regression deltas against the baseline, and produce the required reporting block before declaring completion.
@@ -93,7 +93,6 @@ If the marker is missing or malformed, fail closed to `full-feature`.
 Stop implementation and return to the user when:
 
 - the scope estimate exceeds the 2-production-file cap in direct mode,
-- an in-flight batch would exceed the 3-production-file or 3-test-file per-batch cap,
 - a file is near or would exceed the 500-line limit,
 - any QA gate delta is non-zero after self-correction,
 - the toolchain cannot be executed in the current environment (mark the change **unverified**),