@danmoisan/drm-copilot-mcp 1.1.17 → 1.1.19

package/resources/claude-customizations/.claude/lib/blast-radius/BlastRadiusTokenShape.psm1

@@ -44,11 +44,17 @@
         exactly the two members that matter most.
       - Substring search uses [System.StringComparison]::Ordinal so the result
         is culture-independent and matches Python's byte-wise 'in' operator.
-      - Both predicates are total on every string, including the empty string, a
-        token consisting only of a marker, and a bare bracket pair. Neither
-        throws for any input, because the classifier that calls them runs over
-        every inline-code span in a document and a throw would abort an entire
-        derivation over one stray span.
+      - Every predicate is total on every string, including the empty string, a
+        token consisting only of a marker, a bare bracket pair, and a lone dot.
+        None throws for any input, because the classifier that calls them runs
+        over every inline-code span in a document and a throw would abort an
+        entire derivation over one stray span.
+      - Test-FileShapedComponent (issue #797) ports is_file_shaped_component.
+        Its extension pattern text is identical to FILE_EXTENSION_PATTERN_TEXT
+        and its known-name set equals KNOWN_FILE_NAMES; a Pester test reads both
+        from the Python source and pins them equal. A non-ASCII extension is
+        rejected before lower-casing (issue #903); ToLowerInvariant then matches
+        Python's str.lower on ASCII input, and known-name membership is ordinal.
     CONVENTION: this module fails fast at module scope and imports its siblings with -ErrorAction Stop.
 #>
 
@@ -84,6 +90,30 @@ $script:PlaceholderMarker = [string[]]@(
 $script:FeatureCorpusPrefix = 'docs/features/'
 $script:FeatureFolderSegmentIndex = 1
 
+# File-shape extension pattern (issue #797). A final component names a file when
+# the text after its last dot, lower-cased, is an ASCII letter followed by ASCII
+# letters or digits. The pattern text is identical to FILE_EXTENSION_PATTERN_TEXT
+# in the Python reference; \A and \z anchor the whole string without admitting a
+# trailing newline, which matches Python's re.fullmatch. The regex is built with
+# no options, so matching is case-sensitive and the explicit ASCII classes match
+# exactly the inputs the Python pattern matches.
+$script:FileExtensionPatternText = '[a-z][a-z0-9]*'
+$script:FileExtensionPattern = [regex]::new('\A' + $script:FileExtensionPatternText + '\z')
+$script:NonAsciiPattern = [regex]::new('[^\x00-\x7F]')
+
+# Known extensionless file names and dotfiles (issue #797). Membership is exact
+# and ordinal, matching Python's frozenset membership. The set is closed and is
+# pinned equal to KNOWN_FILE_NAMES in the Python reference by a Pester parity
+# test that reads the Python source, so edit both files together.
+$script:KnownFileName = [System.Collections.Generic.HashSet[string]]::new(
+    [string[]] @(
+        'Dockerfile', 'Makefile', 'LICENSE', 'CODEOWNERS', 'NOTICE', '.gitignore',
+        '.gitattributes', '.gitkeep', '.gitmodules', '.vscodeignore', '.npmignore',
+        '.npmrc', '.nvmrc', '.editorconfig', '.prettierrc', '.prettierignore',
+        '.eslintignore', '.shellcheckrc'
+    ),
+    [StringComparer]::Ordinal)
+
 function Test-PlaceholderMarker {
     <#
     .SYNOPSIS
@@ -184,6 +214,56 @@ function Test-MultipleFeatureFolderSpan {
     return $false
 }
 
+function Test-FileShapedComponent {
+    <#
+    .SYNOPSIS
+        Report whether a final path component names a file (issue #797).
+
+    .DESCRIPTION
+        Port of is_file_shaped_component. The classifier formerly admitted a
+        wildcard-free token only when its extension appeared in a fixed
+        allowlist, so files a plan writes with an unlisted extension, dotfiles,
+        and extensionless names were dropped from the derived radius. This
+        predicate replaces the allowlist with a structural rule that still
+        rejects the directory-shaped tokens of issue #489: a component with no
+        dot, a dot-leading component outside the known-name set, a digit-led
+        tail, and a trailing dot all report false.
+
+    .PARAMETER Component
+        The final path component, after any :<line> suffix has been stripped.
+        The empty string is accepted and reports false.
+
+    .OUTPUTS
+        System.Boolean. True when the component is an ordinal member of the
+        known-name set, or when it has a non-empty stem before its last dot and
+        the lower-cased text after that dot fully matches the extension pattern;
+        otherwise false.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string] $Component
+    )
+
+    if ($script:KnownFileName.Contains($Component)) {
+        return $true
+    }
+
+    # LastIndexOf returns -1 when there is no dot and 0 when the dot leads the
+    # component; both leave no stem, so neither names a file by this rule.
+    $dotIndex = $Component.LastIndexOf('.')
+    if ($dotIndex -le 0) {
+        return $false
+    }
+
+    $extension = $Component.Substring($dotIndex + 1)
+    if ($script:NonAsciiPattern.IsMatch($extension)) { return $false }
+    return $script:FileExtensionPattern.IsMatch($extension.ToLowerInvariant())
+}
+
 Export-ModuleMember -Function `
     Test-PlaceholderMarker, `
-    Test-MultipleFeatureFolderSpan
+    Test-MultipleFeatureFolderSpan, `
+    Test-FileShapedComponent

package/resources/claude-customizations/.claude/lib/ci-gate/Invoke-CiGateParser.ps1

@@ -5,7 +5,7 @@
 
 .DESCRIPTION
     Consumes the JSON array emitted by
-    `gh pr checks --required --json bucket,name,state,link,workflow` and produces
+    `gh pr checks --json bucket,name,state,link,workflow` and produces
     the `ci_gate` object the orchestrator writes to its checkpoint. The object
     carries the five contract fields: head_sha, pr_pipeline_run_id,
     pr_pipeline_run_url, conclusion, and verified_at.
@@ -17,25 +17,33 @@
     the logic is deterministically testable.
 
     Conclusion derivation (per the documented bucket mapping):
-      - Any required check with bucket 'fail' or 'cancel'  -> conclusion 'failure'
-      - Else any required check with bucket 'pending'       -> conclusion 'pending'
+      - Any check with bucket 'fail' or 'cancel'  -> conclusion 'failure'
+      - Else any check with bucket 'pending'       -> conclusion 'pending'
       - Else (all checks 'pass' or 'skipping', or empty set) -> conclusion 'success'
-    An empty required-check set is treated as 'success' (vacuously satisfied: no
-    required check can fail or be in progress). An unrecognized bucket value is a
+    An empty check set is treated as 'success' (vacuously satisfied: no
+    check can fail or be in progress). An unrecognized bucket value is a
     fail-fast error so the parser never silently passes an enum it does not
     understand.
 
+    Epic-child guard (-RequireWorkflow): when -RequireWorkflow names a workflow
+    (S9 passes 'CI' when the checkpoint epic_mode is true), the empty-set rule
+    above does not apply. Failure and pending precedence is unchanged over every
+    observed check; the conclusion is 'success' only when at least one observed
+    check whose workflow property equals the name (case-sensitive) has bucket
+    'pass', and 'pending' otherwise. An empty or null check set therefore yields
+    'pending'. The default value ('') keeps the behavior described above.
+
     The verified_at timestamp is produced through an injectable clock delegate
     (-NowProvider) so tests can assert an exact deterministic value without
     reading the wall clock.
 
 .PARAMETER ChecksJson
-    The JSON array string emitted by `gh pr checks --required --json ...`. Each
+    The JSON array string emitted by `gh pr checks --json ...`. Each
     element is expected to expose at least a `bucket` property. Accepts pipeline
     / stdin input so the orchestrator can pipe the `gh` output directly.
 
 .PARAMETER HeadSha
-    The PR head SHA the required checks were observed against. Recorded verbatim
+    The PR head SHA the queried checks were observed against. Recorded verbatim
     as ci_gate.head_sha.
 
 .PARAMETER PrPipelineRunId
@@ -51,15 +59,26 @@
     ci_gate.verified_at. Defaults to a UTC Get-Date formatted as ISO-8601. Tests
     inject a fixed delegate to make verified_at deterministic.
 
+.PARAMETER RequireWorkflow
+    Optional workflow name (default ''). When non-empty, the conclusion is
+    'success' only after at least one check whose `workflow` property equals
+    this value (case-sensitive) has bucket 'pass'; an empty or null check set
+    yields 'pending'. S9 passes 'CI' for an epic-child PR. A whitespace-only
+    value is rejected with an error.
+
 .PARAMETER AsJson
     When set, emits the ci_gate object as a JSON string instead of a PowerShell
     object. The default (object) output is convenient for in-process callers; the
     JSON output is convenient for checkpoint serialization.
 
 .EXAMPLE
-    gh pr checks --required --json bucket,name,state,link,workflow |
+    gh pr checks --json bucket,name,state,link,workflow |
         ./.claude/lib/ci-gate/Invoke-CiGateParser.ps1 -HeadSha $sha
 
+.EXAMPLE
+    gh pr checks --json bucket,name,state,link,workflow |
+        ./.claude/lib/ci-gate/Invoke-CiGateParser.ps1 -HeadSha $sha -RequireWorkflow CI
+
 .OUTPUTS
     A PSCustomObject (or JSON string when -AsJson is set) with properties
     head_sha, pr_pipeline_run_id, pr_pipeline_run_url, conclusion, verified_at.
@@ -84,6 +103,9 @@ param(
     [ValidateNotNull()]
     [ScriptBlock]$NowProvider = { (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') },
 
+    [Parameter(Mandatory = $false)]
+    [string]$RequireWorkflow = '',
+
     [Parameter(Mandatory = $false)]
     [switch]$AsJson
 )
@@ -96,7 +118,7 @@ begin {
     function Get-CiGateConclusion {
         <#
     .SYNOPSIS
-        Pure derivation of ci_gate.conclusion from a parsed required-check set.
+        Pure derivation of ci_gate.conclusion from a parsed check set.
 
     .DESCRIPTION
         Implements the documented bucket precedence with no I/O and no external
@@ -109,9 +131,20 @@ begin {
         bucket value outside the known enum throws a fail-fast error naming the
         unrecognized value, preventing a silent pass on an unknown state.
 
+        With -RequireWorkflow set, one rule follows the pending rule: when no
+        check whose `workflow` property equals the name (case-sensitive) has
+        bucket 'pass', the result is 'pending'. An empty or null set then yields
+        'pending' instead of 'success'.
+
     .PARAMETER Checks
-        The parsed required-check collection (each element exposing a `bucket`
-        property). May be $null or empty, which yields 'success'.
+        The parsed check collection (each element exposing a `bucket`
+        property). May be $null or empty, which yields 'success' unless
+        -RequireWorkflow is set.
+
+    .PARAMETER RequireWorkflow
+        Optional workflow name; '' (default) disables the guard. A
+        whitespace-only value throws. An element without a `workflow` property
+        never matches.
 
     .OUTPUTS
         One of the strings 'success', 'failure', or 'pending'.
@@ -124,12 +157,27 @@ begin {
         param(
             [Parameter(Mandatory = $false)]
             [AllowNull()]
-            [object[]]$Checks
+            [object[]]$Checks,
+
+            [Parameter(Mandatory = $false)]
+            [string]$RequireWorkflow = ''
         )
 
-        # Empty or null required-check set is vacuously satisfied: there is no check
-        # that can fail or be in progress, so the gate concludes 'success'.
+        # A non-empty, whitespace-only workflow name is invalid input. Reject it
+        # rather than silently disabling the guard and restoring vacuous success.
+        if ($RequireWorkflow.Length -gt 0 -and [string]::IsNullOrWhiteSpace($RequireWorkflow)) {
+            throw "Invoke-CiGateParser: -RequireWorkflow must be '' or a workflow name; a whitespace-only value is not accepted."
+        }
+
+        $requireWorkflowGuard = $RequireWorkflow.Length -gt 0
+
+        # Empty or null check set. Without the guard it is vacuously satisfied (no
+        # check can fail or be in progress); with the guard no passing check from
+        # the named workflow was observed, so the gate stays 'pending'.
         if ($null -eq $Checks -or $Checks.Count -eq 0) {
+            if ($requireWorkflowGuard) {
+                return 'pending'
+            }
             return 'success'
         }
 
@@ -137,7 +185,10 @@ begin {
         # decision until after confirming nothing failed (failure outranks pending).
         $anyPending = $false
 
-        # Inspect each required check once, classifying by its bucket value. Failure
+        # Track whether a passing check from the named workflow was observed.
+        $requiredWorkflowPassed = $false
+
+        # Inspect each check once, classifying by its bucket value. Failure
         # short-circuits immediately because it is the highest-precedence outcome.
         foreach ($check in $Checks) {
             # A check element must expose a bucket; absence is an undefined state and
@@ -152,10 +203,19 @@ begin {
             # change semantics because failure short-circuits via return; pending is
             # only recorded (not returned) so a later failure can still take priority.
             switch ($bucket) {
-                'fail' { return 'failure' }       # a failed required check is terminal-non-success
-                'cancel' { return 'failure' }       # a cancelled required check is treated conservatively as failure
+                'fail' { return 'failure' }       # a failed check is terminal-non-success
+                'cancel' { return 'failure' }       # a cancelled check is treated conservatively as failure
                 'pending' { $anyPending = $true }     # in-progress; defer until failures are ruled out
-                'pass' { }                        # passing check contributes to success; no state change
+                'pass' {
+                    # Under the guard, record a pass from the named workflow. The
+                    # property test keeps an element without `workflow` from
+                    # throwing under Set-StrictMode; such an element never matches.
+                    if ($requireWorkflowGuard -and
+                        ($check.PSObject.Properties.Name -contains 'workflow') -and
+                        ([string]$check.workflow -ceq $RequireWorkflow)) {
+                        $requiredWorkflowPassed = $true
+                    }
+                }
                 'skipping' { }                        # skipped check is non-blocking; neither failure nor pending
                 default {
                     # Unknown bucket: fail fast and name the value so the unsupported
@@ -171,6 +231,12 @@ begin {
             return 'pending'
         }
 
+        # With the guard, nothing failed or is pending, but success also requires
+        # at least one passing check from the named workflow.
+        if ($requireWorkflowGuard -and -not $requiredWorkflowPassed) {
+            return 'pending'
+        }
+
         return 'success'
     }
 
@@ -241,6 +307,8 @@ begin {
         See script-level parameter of the same name.
     .PARAMETER NowProvider
         See script-level parameter of the same name.
+    .PARAMETER RequireWorkflow
+        See script-level parameter of the same name.
     .PARAMETER AsJson
         See script-level parameter of the same name.
 
@@ -269,6 +337,9 @@ begin {
             [ValidateNotNull()]
             [ScriptBlock]$NowProvider = { (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') },
 
+            [Parameter(Mandatory = $false)]
+            [string]$RequireWorkflow = '',
+
             [Parameter(Mandatory = $false)]
             [switch]$AsJson
         )
@@ -288,7 +359,7 @@ begin {
         # downstream Count/foreach logic uniform for the empty, single, and many cases.
         $checks = @($parsed)
 
-        $conclusion = Get-CiGateConclusion -Checks $checks
+        $conclusion = Get-CiGateConclusion -Checks $checks -RequireWorkflow $RequireWorkflow
 
         # Resolve the timestamp through the injected delegate so tests can pin an
         # exact value; the default delegate reads UTC wall-clock time.
@@ -324,6 +395,7 @@ process {
             -PrPipelineRunId $PrPipelineRunId `
             -PrPipelineRunUrl $PrPipelineRunUrl `
             -NowProvider $NowProvider `
+            -RequireWorkflow $RequireWorkflow `
             -AsJson:$AsJson
     }
 }

package/resources/claude-customizations/.claude/lib/orchestrator-state/OrchestratorState.psm1

@@ -93,17 +93,10 @@ $script:STEP_SPECIFIC_EXTRA_STATUS = @{
     step9_status = @('passed', 'failed_remediation_required', 'blocked_ci_loop_limit')
 }
 
-# The allowed blocked_reason vocabulary. Pinned to VALID_BLOCKED_REASONS in the
-# primary validator.
-$script:VALID_BLOCKED_REASONS = @(
-    'none',
-    'spawn_agent_unavailable',
-    'delegation_launch_failed',
-    'delegate_no_receipt',
-    'delegate_contract_incomplete',
-    'validator_failed',
-    'user_requested_stop'
-)
+# blocked_reason vocabulary; mirrors scripts/dev_tools/_orchestrator_state_blocked_reason.py.
+$script:MECHANICAL_BLOCKED_REASONS = @('spawn_agent_unavailable', 'delegation_launch_failed', 'delegate_no_receipt', 'delegate_contract_incomplete', 'validator_failed', 'user_requested_stop')
+$script:NON_MECHANICAL_BLOCKED_REASONS = @('premise_falsified', 'external_dependency', 'policy_hold', 'awaiting_ci', 'human_decision_required')
+$script:VALID_BLOCKED_REASONS = @('none') + $script:MECHANICAL_BLOCKED_REASONS + $script:NON_MECHANICAL_BLOCKED_REASONS
 
 # The upstream steps that must not be pending/blocked before the first PR creation
 # of a branch. Pinned to PR_CREATION_READY_STEP_KEYS in
@@ -290,7 +283,7 @@ function Get-OrchestratorStateBasePresenceError {
     # A present, non-null blocked_reason must be a member of the allowed vocabulary.
     $blocked = Get-OrchestratorStateField -State $State -Name 'blocked_reason'
     if ($blocked.Present -and $null -ne $blocked.Value -and
-        ($script:VALID_BLOCKED_REASONS -notcontains [string]$blocked.Value)) {
+        ($script:VALID_BLOCKED_REASONS -cnotcontains [string]$blocked.Value)) {
         $errors.Add("Checkpoint has invalid blocked_reason: $($blocked.Value)")
     }
 
@@ -333,7 +326,7 @@ function Get-OrchestratorStatePrCreationReadinessError {
     # blocked_reason must read as clear: absent, null, or the literal 'none'. Any
     # other recorded reason means the branch is not ready for PR creation.
     $blocked = Get-OrchestratorStateField -State $State -Name 'blocked_reason'
-    if ($blocked.Present -and $null -ne $blocked.Value -and ([string]$blocked.Value -ne 'none')) {
+    if ($blocked.Present -and $null -ne $blocked.Value -and ([string]$blocked.Value -cne 'none')) {
         $errors.Add('Checkpoint PR-creation readiness validation failed: blocked_reason is not `none`.')
     }