@danmoisan/drm-copilot-mcp 1.1.17 → 1.1.19

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-root-invocation.ps1

@@ -8,8 +8,9 @@
 #>
 [CmdletBinding()]
 param()
+$script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot 'hook-dependency-guard.ps1') } catch { $script:HookDependencyGuardLoadFailed = $true }
 
-. (Join-Path $PSScriptRoot 'codex-authority-store.ps1')
+try { . (Join-Path $PSScriptRoot 'codex-authority-store.ps1') } catch { Add-HookDependencyFailure -Name 'codex-authority-store.ps1' -ErrorRecord $_ }
 
 function ConvertFrom-EpicRootGatePayload {
     [CmdletBinding()]
@@ -54,6 +55,8 @@ function Invoke-EpicRootInvocationDecision {
         [Parameter(Mandatory)][string] $PayloadRaw,
         [AllowNull()][AllowEmptyString()][string] $AttestationRaw
     )
+    $dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'EPIC_INVOCATION_ORIGIN_BLOCKED:'
+    if ($null -ne $dependencyDecision) { return $dependencyDecision }
 
     $payload = ConvertFrom-EpicRootGatePayload -Raw $PayloadRaw -Name 'PreToolUse input'
     if ([string]::IsNullOrWhiteSpace($AttestationRaw)) {
@@ -87,6 +90,9 @@ function Invoke-EpicRootInvocationDecision {
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
+if ($script:HookDependencyGuardLoadFailed) { [Console]::Error.WriteLine('EPIC_INVOCATION_ORIGIN_BLOCKED: hook-dependency-guard.ps1 failed to load; the gate fails closed.'); exit 2 }
+$dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'EPIC_INVOCATION_ORIGIN_BLOCKED:'
+if ($null -ne $dependencyDecision) { $dependencyDecision | ConvertTo-Json -Compress -Depth 5 | Write-Output; exit 0 }
 
 try {
     $payloadRaw = [Console]::In.ReadToEnd()

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-wave-barrier.ps1

@@ -10,8 +10,9 @@
 #>
 [CmdletBinding()]
 param()
+$script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot 'hook-dependency-guard.ps1') } catch { $script:HookDependencyGuardLoadFailed = $true }
 
-. (Join-Path $PSScriptRoot 'codex-epic-child-launch-attestation.ps1')
+try { . (Join-Path $PSScriptRoot 'codex-epic-child-launch-attestation.ps1') } catch { Add-HookDependencyFailure -Name 'codex-epic-child-launch-attestation.ps1' -ErrorRecord $_ }
 
 $script:AllowedDependencyStatuses = @('merged', 'worktree_removed')
 
@@ -178,6 +179,8 @@ function Invoke-CodexEpicWaveDecision {
         [AllowEmptyString()][string] $RepositoryRoot = '',
         [datetimeoffset] $Now = [datetimeoffset]::UtcNow
     )
+    $dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'EPIC_WAVE_BARRIER_BLOCKED:'
+    if ($null -ne $dependencyDecision) { return $dependencyDecision }
 
     $payload = ConvertFrom-CodexWaveJson -Raw $PayloadRaw -Name 'PreToolUse input'
     if (-not (Test-CodexWaveMutation -Payload $payload)) {
@@ -252,6 +255,9 @@ function Get-CodexPrimaryWorktreeRoot {
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
+if ($script:HookDependencyGuardLoadFailed) { [Console]::Error.WriteLine('EPIC_WAVE_BARRIER_BLOCKED: hook-dependency-guard.ps1 failed to load; the gate fails closed.'); exit 2 }
+$dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'EPIC_WAVE_BARRIER_BLOCKED:'
+if ($null -ne $dependencyDecision) { $dependencyDecision | ConvertTo-Json -Compress -Depth 5 | Write-Output; exit 0 }
 
 try {
     $payloadRaw = [Console]::In.ReadToEnd()

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-worktree-removal-gate.ps1

@@ -4,12 +4,13 @@
 #>
 [CmdletBinding()]
 param()
+$script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot 'hook-dependency-guard.ps1') } catch { $script:HookDependencyGuardLoadFailed = $true }
 
 # Shared command-line parser (issue #545). The scope filter and the operand extractor below
 # both run against the segment that structurally invokes `git worktree remove`, which is what
 # keeps the two runtimes on one implementation of the same concern.
-. (Join-Path $PSScriptRoot 'hook-command-scanner.ps1')
-. (Join-Path $PSScriptRoot 'hook-command-invocation.ps1')
+try { . (Join-Path $PSScriptRoot 'hook-command-scanner.ps1') } catch { Add-HookDependencyFailure -Name 'hook-command-scanner.ps1' -ErrorRecord $_ }
+try { . (Join-Path $PSScriptRoot 'hook-command-invocation.ps1') } catch { Add-HookDependencyFailure -Name 'hook-command-invocation.ps1' -ErrorRecord $_ }
 
 $script:SafeWorktreeStatuses = @('merged', 'worktree_removed')
 
@@ -33,40 +34,6 @@ function ConvertFrom-CodexWorktreeJson {
     }
 }
 
-function Get-CodexWorktreeRemovalPath {
-    <#
-    .SYNOPSIS
-        Extract the target worktree path from a git worktree remove command.
-    .DESCRIPTION
-        The operand comes from the segment that structurally invokes git worktree remove, so
-        a chained 'cd <path> &&' segment contributes nothing and a quoted mention of the
-        phrase resolves to no operand. The tokenizer strips balanced double and single
-        quotes, which is what the previous pattern's `double` and `single` alternatives did.
-
-        The previous pattern accepted '--force' only immediately after 'remove'. That
-        spelling is preserved and the trailing spelling now works too, because '--force' is a
-        zero-argument flag that never contributes an operand wherever it is written. Its
-        presence is read structurally through Test-CommandLineFlag rather than by a raw-text
-        search. The empty-string-on-miss contract is unchanged: callers test `if ($target)`.
-    .OUTPUTS
-        System.String
-    #>
-    [CmdletBinding()]
-    [OutputType([string])]
-    param([Parameter(Mandatory)][AllowEmptyString()][string] $Command)
-
-    $hasForce = Test-CommandLineFlag -CommandText $Command -CommandWord 'git' -SubcommandPath @('worktree', 'remove') -FlagName '--force'
-    $operands = @(Get-CommandLineOperand -CommandText $Command -CommandWord 'git' -SubcommandPath @('worktree', 'remove'))
-
-    if ($operands.Count -gt 0) {
-        return [string]$operands[0]
-    }
-    if ($hasForce) {
-        return '--force'
-    }
-    return ''
-}
-
 function Get-NormalizedCodexWorktreePath {
     [CmdletBinding()]
     [OutputType([string])]
@@ -114,6 +81,8 @@ function Invoke-CodexWorktreeRemovalDecision {
         [Parameter(Mandatory)][string] $PayloadRaw,
         [AllowNull()][AllowEmptyString()][string] $EpicCheckpointRaw
     )
+    $dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'EPIC_WORKTREE_REMOVAL_BLOCKED:'
+    if ($null -ne $dependencyDecision) { return $dependencyDecision }
 
     $payload = ConvertFrom-CodexWorktreeJson -Raw $PayloadRaw -Name 'PreToolUse input'
     if ([string]$payload.tool_name -ne 'Bash') {
@@ -126,18 +95,59 @@ function Invoke-CodexWorktreeRemovalDecision {
     if (-not (Test-CommandLineInvocation -CommandText $command -CommandWord 'git' -SubcommandPath @('worktree', 'remove'))) {
         return $null
     }
-    $target = Get-CodexWorktreeRemovalPath -Command $command
+    # Issue #824: the removal targets are derived structurally from every invocation. A
+    # target that cannot be derived denies before the checkpoint is read, and every derived
+    # target must be authorized on its own.
+    $resolution = Resolve-CommandLineInvocationTarget -CommandText $command -CommandWord 'git' -SubcommandPath @('worktree', 'remove')
+    if ($resolution.Status -eq 'NoMatch') {
+        return $null
+    }
+    if ($resolution.Status -ne 'Targets') {
+        return [ordered]@{
+            hookSpecificOutput = [ordered]@{
+                hookEventName            = 'PreToolUse'
+                permissionDecision       = 'deny'
+                permissionDecisionReason = 'EPIC_WORKTREE_REMOVAL_BLOCKED: TARGET_WORKTREE_NOT_DERIVABLE: the git worktree remove target cannot be derived from the command text. No checkpoint can authorize this removal.'
+            }
+        }
+    }
     $checkpoint = ConvertFrom-CodexWorktreeJson -Raw $EpicCheckpointRaw -Name 'epic checkpoint' -Optional
     $workingDirectory = if ([string]::IsNullOrWhiteSpace([string]$payload.cwd)) {
         (Get-Location).Path
     } else {
         [string]$payload.cwd
     }
-    $feature = if ($target) {
-        Find-CodexWorktreeFeature -Checkpoint $checkpoint -TargetPath $target -WorkingDirectory $workingDirectory
-    } else {
-        $null
+    foreach ($target in @($resolution.Targets)) {
+        $denial = Get-CodexWorktreeRemovalTargetDenial -Target $target -Checkpoint $checkpoint -WorkingDirectory $workingDirectory
+        if ($null -ne $denial) {
+            return $denial
+        }
     }
+    return $null
+}
+
+function Get-CodexWorktreeRemovalTargetDenial {
+    <#
+    .SYNOPSIS
+        Evaluate one derived removal target and return its deny decision, or $null when authorized.
+    .PARAMETER Target
+        One removal target derived by Resolve-CommandLineInvocationTarget.
+    .PARAMETER Checkpoint
+        The parsed epic checkpoint, or $null when absent or unreadable.
+    .PARAMETER WorkingDirectory
+        The directory a relative target resolves against.
+    .OUTPUTS
+        System.Collections.Specialized.OrderedDictionary or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)][string] $Target,
+        [AllowNull()] $Checkpoint,
+        [Parameter(Mandatory)][string] $WorkingDirectory
+    )
+
+    $feature = Find-CodexWorktreeFeature -Checkpoint $Checkpoint -TargetPath $Target -WorkingDirectory $WorkingDirectory
     if ($null -ne $feature -and
         @($feature.PSObject.Properties.Name) -contains 'merge_status' -and
         $script:SafeWorktreeStatuses -contains [string]$feature.merge_status) {
@@ -156,6 +166,9 @@ function Invoke-CodexWorktreeRemovalDecision {
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
+if ($script:HookDependencyGuardLoadFailed) { [Console]::Error.WriteLine('EPIC_WORKTREE_REMOVAL_BLOCKED: hook-dependency-guard.ps1 failed to load; the gate fails closed.'); exit 2 }
+$dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'EPIC_WORKTREE_REMOVAL_BLOCKED:'
+if ($null -ne $dependencyDecision) { $dependencyDecision | ConvertTo-Json -Compress -Depth 5 | Write-Output; exit 0 }
 
 try {
     $payloadRaw = [Console]::In.ReadToEnd()

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-evidence-locations.ps1

@@ -40,10 +40,11 @@
 #>
 [CmdletBinding()]
 param()
+$script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot 'hook-dependency-guard.ps1') } catch { $script:HookDependencyGuardLoadFailed = $true }
 
 # Shared Codex PreToolUse transport: stdin payload parsing and tool_input-to-file
 # mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
-. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
+try { . (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1') } catch { Add-HookDependencyFailure -Name 'codex-pretooluse-file-mapping.ps1' -ErrorRecord $_ }
 
 function Test-EvidenceLocationForbidden {
     <#
@@ -122,6 +123,8 @@ function Invoke-EvidenceLocationDecision {
     param(
         [string] $ToolInputRaw
     )
+    $dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'EVIDENCE_LOCATION_BLOCKED:'
+    if ($null -ne $dependencyDecision) { return $dependencyDecision }
 
     if (-not $ToolInputRaw) {
         return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
@@ -192,5 +195,8 @@ function Invoke-EvidenceLocationEntryPoint {
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
+if ($script:HookDependencyGuardLoadFailed) { [Console]::Error.WriteLine('EVIDENCE_LOCATION_BLOCKED: hook-dependency-guard.ps1 failed to load; the gate fails closed.'); exit 2 }
+$dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'EVIDENCE_LOCATION_BLOCKED:'
+if ($null -ne $dependencyDecision) { $dependencyDecision | ConvertTo-Json -Compress -Depth 5 | Write-Output; exit 0 }
 
 exit (Invoke-EvidenceLocationEntryPoint -PayloadRaw ([Console]::In.ReadToEnd()))

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-orchestration-preimplementation-gate-epic-scope.ps1

@@ -26,12 +26,16 @@
     Get-OrchestrationDelegationCheckpointPath (modes file), and the gate's allow and block
     decision constructors Get-OrchestrationPreimplementationGateAllowDecision and
     Get-OrchestrationPreimplementationGateBlockDecision. The resolver and its seams come
-    from the resolution sibling dot-sourced below.
+    from the resolution sibling dot-sourced below. The per-segment target resolver comes
+    from the targets file dot-sourced below (issue #738), which calls
+    Read-CommandLineSegment, Get-CommandLineGlobalOption, and Get-CommandLineInvocation,
+    loaded by the gate's dot-source of hook-command-invocation.ps1.
     Mirrored byte-identically under extensions/drm-copilot/resources/codex-and-agents-customizations/.
     AUTHORITY: PowerShell-authoritative. The epic readiness predicate has no reference implementation in another language, and this hook starts no interpreter process (issue #707, D15).
 #>
 
 . (Join-Path $PSScriptRoot 'enforce-orchestration-preimplementation-gate-epic-resolution.ps1')
+. (Join-Path $PSScriptRoot 'enforce-orchestration-preimplementation-gate-targets.ps1')
 
 # An epic manifest lives under the epics tree; the pattern is tested after backslash
 # normalisation so either separator spelling is accepted.
@@ -152,11 +156,14 @@ function Get-OrchestrationEpicScopeDecision {
     .SYNOPSIS
         Returns the epic-scope decision for an implementation-classified command or path, or $null.
     .DESCRIPTION
-        Resolves epic scope with worktree-HEAD matching and the command's -C selector. When
-        the call is not epic scope, returns $null so the caller's single-feature path runs
-        unchanged. In epic scope, returns an allow decision when the epic command-leg
-        readiness predicate passes, and otherwise a deny naming the epic checkpoint and the
-        failed conjunct.
+        Resolves the target of every command segment, apply_patch file marker, and path
+        (issue #738), then the epic scope of the session root and of each target. A command
+        whose text is an apply_patch body is decided as a path leg over its marker paths.
+        When neither is epic scope, returns $null so the caller's single-feature path runs
+        unchanged. In epic scope, denies an unresolvable, ambiguous, or out-of-scope target,
+        and otherwise evaluates the epic command-leg readiness predicate against every
+        target: the first failure denies (the session-root wording is unchanged), and no
+        failure allows.
     .PARAMETER Command
         The command line of a command or apply_patch leg; empty for a path leg.
     .PARAMETER FilePath
@@ -175,15 +182,29 @@ function Get-OrchestrationEpicScopeDecision {
     if (-not $Command -and -not $FilePath) {
         return $null
     }
-    $selector = if ($Command) { Get-OrchestrationEpicScopeSelector -Command $Command } else { $null }
-    $scope = Resolve-EpicScopeCheckpoint -SessionRoot (Get-Location).Path -WorktreeSelector $selector
-    if (-not $scope.IsEpicScope) {
+    $epicScopeSessionRoot = (Get-Location).Path
+    $legCommand = [string]$Command
+    $legPaths = @($FilePath)
+    $markerPaths = @(Get-OrchestrationPatchMarkerPath -PatchText $legCommand)
+    if ($markerPaths.Count -gt 0) {
+        $legCommand = ''
+        $legPaths = $markerPaths
+    }
+    $targetResult = Get-OrchestrationCommandTarget -Command $legCommand -FilePath $legPaths -SessionRoot $epicScopeSessionRoot
+    $scopeResolver = {
+        param([string] $Selector)
+        Resolve-EpicScopeCheckpoint -SessionRoot $epicScopeSessionRoot -WorktreeSelector $Selector
+    }
+    $verdict = Resolve-OrchestrationEpicTargetVerdict -SessionRoot $epicScopeSessionRoot -TargetResult $targetResult -ScopeResolver $scopeResolver
+    $outcome = Resolve-OrchestrationEpicTargetOutcome -Verdict $verdict -ReadinessFailure {
+        param($Scope)
+        Get-EpicCommandLegReadinessFailure -Checkpoint $Scope.Checkpoint -MergeInProgress $Scope.MergeInProgress
+    }
+    if ($outcome.Outcome -eq 'none') {
         return $null
     }
-
-    $failure = Get-EpicCommandLegReadinessFailure -Checkpoint $scope.Checkpoint -MergeInProgress $scope.MergeInProgress
-    if (-not $failure) {
-        return Get-OrchestrationPreimplementationGateAllowDecision
+    if ($outcome.Outcome -eq 'deny') {
+        return Get-OrchestrationPreimplementationGateBlockDecision -Reason $outcome.Reason
     }
-    return Get-OrchestrationPreimplementationGateBlockDecision -Reason ("PREIMPLEMENTATION_GATE_BLOCKED: this epic-scope operation was evaluated against $($scope.CheckpointPath), and the failed readiness predicate is '$failure'. Implementation operations in epic scope require that checkpoint to satisfy every readiness predicate, and a production path may be staged or edited only while a merge is in progress.")
+    return Get-OrchestrationPreimplementationGateAllowDecision
 }

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-orchestration-preimplementation-gate-helpers.ps1

@@ -9,6 +9,11 @@
     tree? Every parse ambiguity answers false, so the caller's pre-change deny is the
     fallback for every unmodeled form.
 
+    Shell-agnostic parsing (issue #735): the shell that executes a hooked command is
+    undetermined per command, so every shape whose meaning differs between a POSIX shell
+    and PowerShell denies - a backslash anywhere, and { } , ( ) @ outside quotes. Evidence:
+    research/research.2026-10-08T14-00.md (Q1) in the issue #732 feature folder.
+
     The normative contract is the D4 fail-closed rule table in
     docs/features/active/2026-08-24-preimplementation-gate-blocks-planner-integration-commits-539/spec.md.
     Rule-table row numbers are cited inline against the code that realizes them.
@@ -28,15 +33,15 @@ $script:OrchestrationBookkeepingTrees = @(
 )
 
 # Characters that make a command line statically unresolvable (D4 row 12, as narrowed by
-# issues #663 and #713): interpolation characters outside single quotes; outside-quote
-# characters (`<`, `>`, and the `#` comment introducer) outside any quote; and typographic
-# quotes (U+2018 to U+201E) anywhere, because a PowerShell host reads them as quotes.
+# issues #663, #713, #732, and #735): interpolation characters outside single quotes;
+# outside-quote characters (`<`, `>`, the `#` comment introducer, and the shell-divergent
+# `{ } , ( ) @`) outside any quote; and typographic quotes (U+2018 to U+201E) anywhere.
 $script:InterpolationCommandCharacters = [char[]]@('$', '`')
-$script:OutsideQuoteCommandCharacters = [char[]]@('>', '<', '#')
+$script:OutsideQuoteCommandCharacters = [char[]]@('>', '<', '#', '{', '}', ',', '(', ')', '@')
 $script:TypographicQuoteCharacters = [char[]]@(0x2018, 0x2019, 0x201A, 0x201B, 0x201C, 0x201D, 0x201E)
 
-# Wildcards that make an operand a glob (D4 row 15). Only the literal prefix before the
-# first of these is prefix-tested.
+# Wildcards a selector value may not carry (LACS L6). An operand carrying one fails the
+# operand allowlist (issue #732).
 $script:PathspecWildcardCharacters = [char[]]@('*', '?', '[')
 
 # The single repository selector modelled between the command name and the subcommand: D4
@@ -112,12 +117,12 @@ function Test-OrchestrationCommandTextUnresolvable {
     .SYNOPSIS
         Reports whether a command line carries a statically unresolvable character.
     .DESCRIPTION
-        Realizes D4 row 12 as narrowed by issues #663 and #713, with quote state tracked as in
-        Split-OrchestrationCommandLine. `$` or backtick answers true outside quotes or inside
-        double quotes (single quotes keep it literal); `<`, `>`, or a `#` comment answers true
-        only outside a quoted span. A typographic quote (U+2018 to U+201E), a backslash before
-        any quote character, or a backslash inside a double-quoted span answers true anywhere:
-        a shell may end the span where this scan does not (fail closed).
+        Realizes D4 row 12 as narrowed by issues #663, #713, #732, and #735, with quote state
+        tracked as in Split-OrchestrationCommandLine. `$` or backtick answers true outside
+        quotes or inside double quotes (single quotes keep it literal); `<`, `>`, `#`, and
+        `{ } , ( ) @` answer true only outside a quoted span. A typographic quote (U+2018 to
+        U+201E) or a backslash answers true anywhere, because POSIX shells and PowerShell read
+        them differently and the executing shell is undetermined (fail closed).
     .PARAMETER CommandText
         The full command line as the shell would receive it.
     .OUTPUTS
@@ -127,8 +132,8 @@ function Test-OrchestrationCommandTextUnresolvable {
     [OutputType([bool])]
     param([Parameter(Mandatory)][AllowEmptyString()][string] $CommandText)
 
-    # An escaped or typographic quote moves a span boundary the scan cannot model (#663, #713).
-    if ($CommandText.Contains('\"') -or $CommandText.Contains("\'") -or $CommandText.IndexOfAny($script:TypographicQuoteCharacters) -ge 0) {
+    # A backslash or typographic quote is read differently by POSIX shells and PowerShell (#735).
+    if ($CommandText.Contains('\') -or $CommandText.IndexOfAny($script:TypographicQuoteCharacters) -ge 0) {
         return $true
     }
 
@@ -141,13 +146,9 @@ function Test-OrchestrationCommandTextUnresolvable {
             return $true
         }
 
-        # Decide by quote state: inside a span only the closing quote matters, and any
-        # backslash inside a double-quoted span is an unmodelled escape; outside a span a
-        # quote opens one and a redirection character is unresolvable.
+        # Decide by quote state: inside a span only the closing quote matters; outside a
+        # span a quote opens one and an outside-quote character is unresolvable.
         if ($openQuote -ne [char]0) {
-            if ($openQuote -eq '"' -and $character -eq '\') {
-                return $true
-            }
             if ($character -eq $openQuote) {
                 $openQuote = [char]0
             }
@@ -222,9 +223,10 @@ function Test-ExemptOrchestrationOperand {
     .SYNOPSIS
         Tests one pathspec operand against the five exempt orchestration trees.
     .DESCRIPTION
-        Realizes D4 rows 3, 9, 15, 16, 17, and 18. Backslashes normalize to forward slashes
-        before the prefix test (row 18); pathspec magic, absolute spellings, parent-directory
-        segments, and globs whose literal prefix escapes the exempt set all deny.
+        Realizes D4 rows 3, 9, 15, 16, and 17 as narrowed by issues #732 and #735. An operand
+        is exempt only when it matches the plain ASCII allowlist A-Z a-z 0-9 . _ / - (which
+        excludes pathspec magic, drive letters, backslashes, globs, braces, and non-ASCII
+        look-alikes), is not rooted, carries no '..' segment, and starts with an exempt tree.
     .OUTPUTS
         System.Boolean
     #>
@@ -232,43 +234,14 @@ function Test-ExemptOrchestrationOperand {
     [OutputType([bool])]
     param([Parameter(Mandatory)][AllowEmptyString()][string] $Operand)
 
-    if (-not $Operand) {
-        return $false
-    }
-
-    # Row 3b and row 9: any leading colon is pathspec magic, which can escape or invert the
-    # tree scope, so no colon-led operand is ever resolvable by a prefix test.
-    if ($Operand.StartsWith(':')) {
+    if ($Operand -cnotmatch '^[A-Za-z0-9._/-]+$' -or $Operand.StartsWith('/')) {
         return $false
     }
-
-    # Row 18: separator normalization precedes every prefix comparison below.
-    $normalized = $Operand -replace '\\', '/'
-
-    # Row 16: rooted, drive-lettered, and UNC spellings all deny; the exempt prefixes stay
-    # repo-relative (this is the posture issue #516 later composes with).
-    if ($normalized.StartsWith('/')) {
+    if (($Operand -split '/') -contains '..') {
         return $false
     }
-    if ($normalized -match '^[A-Za-z]:') {
-        return $false
-    }
-
-    # Rows 15c and 17: any parent-directory component escapes the prefix.
-    if (($normalized -split '/') -contains '..') {
-        return $false
-    }
-
-    # Row 15: only the literal prefix before the first wildcard is prefix-tested, so a glob
-    # whose wildcard occupies or truncates an ancestor segment cannot pass.
-    $literalPrefix = $normalized
-    $wildcardIndex = $normalized.IndexOfAny($script:PathspecWildcardCharacters)
-    if ($wildcardIndex -ge 0) {
-        $literalPrefix = $normalized.Substring(0, $wildcardIndex)
-    }
-
     foreach ($tree in $script:OrchestrationBookkeepingTrees) {
-        if ($literalPrefix.StartsWith($tree)) {
+        if ($Operand.StartsWith($tree)) {
             return $true
         }
     }
@@ -444,7 +417,7 @@ function Test-ExemptOrchestrationStagingCommand {
         command line splits cleanly into segments and EVERY segment parses as a complete,
         recognized staging or integration invocation carrying at least one pathspec operand,
         with every operand resolving inside one of the five exempt orchestration-bookkeeping
-        trees after balanced-quote stripping and separator normalization.
+        trees after balanced-quote stripping.
 
         The all-segments reading is deliberate and fail-closed: a chained line denies unless
         each of its segments is independently a recognized all-exempt invocation, so a
@@ -464,8 +437,8 @@ function Test-ExemptOrchestrationStagingCommand {
         return $false
     }
 
-    # Row 12: `$` or backtick outside single quotes, `<`, `>`, or `#` outside quotes, any
-    # typographic quote, and unmodelled backslash escapes make the operand list untrustworthy.
+    # Row 12: `$` or backtick outside single quotes, `< > # { } , ( ) @` outside quotes, and
+    # any typographic quote or backslash make the operand list untrustworthy (#732, #735).
     if (Test-OrchestrationCommandTextUnresolvable -CommandText $CommandText) {
         return $false
     }