@danmoisan/drm-copilot-mcp 1.1.17 → 1.1.19

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-orchestration-preimplementation-gate.ps1

@@ -1,32 +1,38 @@
-
 <#
 .SYNOPSIS
     Blocks implementation operations before orchestration readiness exists.
+.DESCRIPTION
+    Executing shell (issue #735): Codex runs a command through PowerShell by default on native
+    Windows, but the model may choose another shell per call, and the PreToolUse payload carries
+    only the raw command string, so the executing shell is undetermined per command and every
+    shell-divergent command shape denies (research/research.2026-10-08T14-00.md in the issue
+    #732 feature folder). The payload carries no workdir either, so the session root is the
+    default target of a segment without an explicit -C (issue #738, decision D4).
 #>
 [CmdletBinding()]
 param()
+$script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot 'hook-dependency-guard.ps1') } catch { $script:HookDependencyGuardLoadFailed = $true }
 
 # Shared Codex PreToolUse transport: stdin payload parsing and tool_input-to-file
 # mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
-. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
+try { . (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1') } catch { Add-HookDependencyFailure -Name 'codex-pretooluse-file-mapping.ps1' -ErrorRecord $_ }
 
 # Pure pathspec classifier for the issue #539 orchestration-bookkeeping staging exemption.
 # Extracted to a dot-sourced sibling so this file stays inside the 500-line cap, following
 # the headroom-split precedent already used on this side by enforce-completion-helpers.ps1.
-. (Join-Path $PSScriptRoot 'enforce-orchestration-preimplementation-gate-helpers.ps1')
+try { . (Join-Path $PSScriptRoot 'enforce-orchestration-preimplementation-gate-helpers.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-orchestration-preimplementation-gate-helpers.ps1' -ErrorRecord $_ }
 
 # Pure mode dispatch and per-mode readiness predicates for issue #554. A new sibling
 # rather than an addition to the helpers file above, whose header declares a different
 # normative contract and which lacks headroom; leaving that file byte-untouched is the
 # proof the issue #539 exemption is behaviourally unchanged.
-. (Join-Path $PSScriptRoot 'enforce-orchestration-preimplementation-gate-modes.ps1')
+try { . (Join-Path $PSScriptRoot 'enforce-orchestration-preimplementation-gate-modes.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-orchestration-preimplementation-gate-modes.ps1' -ErrorRecord $_ }
 # Epic-scope command and path legs (issue #707, porting issue #663 decision D2), plus the
 # two per-mode read seams relocated from this file to keep it inside the 500-line cap.
-. (Join-Path $PSScriptRoot 'enforce-orchestration-preimplementation-gate-epic-scope.ps1')
+try { . (Join-Path $PSScriptRoot 'enforce-orchestration-preimplementation-gate-epic-scope.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-orchestration-preimplementation-gate-epic-scope.ps1' -ErrorRecord $_ }
 # Shared command-line parser (issue #545): per-segment scan text and structural matching.
-. (Join-Path $PSScriptRoot 'hook-command-scanner.ps1')
-. (Join-Path $PSScriptRoot 'hook-command-invocation.ps1')
-
+try { . (Join-Path $PSScriptRoot 'hook-command-scanner.ps1') } catch { Add-HookDependencyFailure -Name 'hook-command-scanner.ps1' -ErrorRecord $_ }
+try { . (Join-Path $PSScriptRoot 'hook-command-invocation.ps1') } catch { Add-HookDependencyFailure -Name 'hook-command-invocation.ps1' -ErrorRecord $_ }
 # The readiness checkpoint this gate reads and names in its block message.
 $script:CheckpointPath = 'artifacts/orchestration/orchestrator-state.json'
 
@@ -357,6 +363,8 @@ function Invoke-OrchestrationPreimplementationGateDecision {
         [AllowEmptyString()]
         [string] $ParallelCheckpointRaw
     )
+    $dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'PREIMPLEMENTATION_GATE_BLOCKED:'
+    if ($null -ne $dependencyDecision) { return $dependencyDecision }
 
     if (-not $ToolInputRaw) {
         return Get-OrchestrationPreimplementationGateAllowDecision
@@ -424,11 +432,13 @@ function Invoke-OrchestrationPreimplementationGateDecision {
             $modeCheckpoint = ConvertFrom-CheckpointJson -Json ([string]$modeRaw)
         } catch { $modeCheckpoint = $null }
         $folder = Find-OrchestrationDelegationTargetFolder -Prompt $prompt
-        $issue = Find-OrchestrationDelegationIssueNumber -Prompt $prompt
+        # Only the keyed issue number breaks a tie among cited folders (#565 CR-1); the bare hash form feeds the D3 record lookup only.
+        $issue = Find-OrchestrationDelegationIssueNumber -Prompt $prompt -KeyedOnly
+        $fallbackIssue = Find-OrchestrationDelegationIssueNumber -Prompt $prompt
         $failure = if ($isEpic) {
-            Get-EpicOrchestrationReadinessFailure -Checkpoint $modeCheckpoint -TargetFolder $folder -IssueNumber $issue
+            Get-EpicOrchestrationReadinessFailure -Checkpoint $modeCheckpoint -TargetFolder $folder -IssueNumber $issue -FallbackIssueNumber $fallbackIssue
         } else {
-            Get-ParallelOrchestrationReadinessFailure -Checkpoint $modeCheckpoint -TargetFolder $folder -IssueNumber $issue
+            Get-ParallelOrchestrationReadinessFailure -Checkpoint $modeCheckpoint -TargetFolder $folder -IssueNumber $issue -FallbackIssueNumber $fallbackIssue
         }
         if (-not $failure) { return Get-OrchestrationPreimplementationGateAllowDecision }
         return Get-OrchestrationPreimplementationGateBlockDecision -Reason (
@@ -453,6 +463,9 @@ function Invoke-OrchestrationPreimplementationGateDecision {
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
+if ($script:HookDependencyGuardLoadFailed) { [Console]::Error.WriteLine('PREIMPLEMENTATION_GATE_BLOCKED: hook-dependency-guard.ps1 failed to load; the gate fails closed.'); exit 2 }
+$dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'PREIMPLEMENTATION_GATE_BLOCKED:'
+if ($null -ne $dependencyDecision) { $dependencyDecision | ConvertTo-Json -Compress -Depth 5 | Write-Output; exit 0 }
 
 try {
     $payload = ConvertFrom-CodexPreToolUsePayload -PayloadRaw ([Console]::In.ReadToEnd()) -HookName 'enforce-orchestration-preimplementation-gate'

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-powershell-batch-budget.ps1

@@ -45,13 +45,14 @@
 #>
 [CmdletBinding()]
 param()
+$script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot 'hook-dependency-guard.ps1') } catch { $script:HookDependencyGuardLoadFailed = $true }
 
 # Shared Codex PreToolUse transport: stdin payload parsing and tool_input-to-file
 # mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
-. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
+try { . (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1') } catch { Add-HookDependencyFailure -Name 'codex-pretooluse-file-mapping.ps1' -ErrorRecord $_ }
 
 # Shared route helpers; this file is byte-identical to the Claude runtime copy.
-. (Join-Path $PSScriptRoot 'enforce-batch-budget-route.ps1')
+try { . (Join-Path $PSScriptRoot 'enforce-batch-budget-route.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-batch-budget-route.ps1' -ErrorRecord $_ }
 
 function Get-PowerShellBatchBudgetState {
     [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', 'TestCap', Justification = 'Accepted and ignored for callers written against the removed test-file cap.')]
@@ -134,6 +135,8 @@ function Invoke-PowerShellBatchBudgetDecision {
         [AllowEmptyString()]
         [string] $ObservedRoute = ''
     )
+    $dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'POWERSHELL_LARGE_PATH_REQUIRED:'
+    if ($null -ne $dependencyDecision) { return $dependencyDecision }
 
     $normalized = $FilePath -replace '\\', '/'
     if ($normalized -notmatch '\.(ps1|psm1|psd1)$') {
@@ -330,6 +333,9 @@ function Invoke-PowerShellBatchBudgetCodexEntryPoint {
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
+if ($script:HookDependencyGuardLoadFailed) { [Console]::Error.WriteLine('POWERSHELL_LARGE_PATH_REQUIRED: hook-dependency-guard.ps1 failed to load; the gate fails closed.'); exit 2 }
+$dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'POWERSHELL_LARGE_PATH_REQUIRED:'
+if ($null -ne $dependencyDecision) { $dependencyDecision | ConvertTo-Json -Compress -Depth 5 | Write-Output; exit 0 }
 
 # The entry point returns its [int] exit code as the last pipeline element and any
 # deny JSON before it, so the JSON is written explicitly before the process exits.

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-promotion-mcp-only.ps1

@@ -28,12 +28,13 @@
 #>
 [CmdletBinding()]
 param()
+$script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot 'hook-dependency-guard.ps1') } catch { $script:HookDependencyGuardLoadFailed = $true }
 
 # Shared command-line parser (issue #545). Every forbidden-token scan and both `gh`
 # expressions below run against each segment's clause-ordered scan text, and the
 # structural matcher reaches the relocating `gh` spellings adjacency cannot.
-. (Join-Path $PSScriptRoot 'hook-command-scanner.ps1')
-. (Join-Path $PSScriptRoot 'hook-command-invocation.ps1')
+try { . (Join-Path $PSScriptRoot 'hook-command-scanner.ps1') } catch { Add-HookDependencyFailure -Name 'hook-command-scanner.ps1' -ErrorRecord $_ }
+try { . (Join-Path $PSScriptRoot 'hook-command-invocation.ps1') } catch { Add-HookDependencyFailure -Name 'hook-command-invocation.ps1' -ErrorRecord $_ }
 
 $script:PromotionMcpOnlyBlockedReason = 'PROMOTION_MCP_ONLY_BLOCKED: Direct Bash promotion-script execution is not allowed in agent sessions. Use the drm-copilot MCP promotion tools instead.'
 
@@ -109,9 +110,12 @@ function Get-PromotionBypassReason {
     }
 
     # `gh issue create` and `gh issue new` are direct bypasses of the MCP
-    # promotion path. Tolerate any flags after the subcommand.
+    # promotion path. Tolerate any flags after the subcommand. The adjacency
+    # expression reads the masked text, so a quoted mention is not a match; wrapper
+    # payloads and substitution bodies are covered by the structural check below
+    # (issue #824).
     foreach ($segment in $segments) {
-        if ($segment.ScanText -match '(?i)\bgh\s+issue\s+(?:create|new)\b') {
+        if ($segment.MaskedText -match '(?i)\bgh\s+issue\s+(?:create|new)\b') {
             return (Get-PromotionMcpOnlyGhIssueBlockedReason)
         }
     }
@@ -224,6 +228,8 @@ function Invoke-PromotionMcpOnlyDecision {
     param(
         [string] $ToolInputRaw
     )
+    $dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'PROMOTION_MCP_ONLY_BLOCKED:'
+    if ($null -ne $dependencyDecision) { return $dependencyDecision }
 
     if (-not $ToolInputRaw) {
         return Get-PromotionMcpOnlyAllowDecision
@@ -273,6 +279,9 @@ function ConvertFrom-CodexPromotionHookPayload {
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
+if ($script:HookDependencyGuardLoadFailed) { [Console]::Error.WriteLine('PROMOTION_MCP_ONLY_BLOCKED: hook-dependency-guard.ps1 failed to load; the gate fails closed.'); exit 2 }
+$dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'PROMOTION_MCP_ONLY_BLOCKED:'
+if ($null -ne $dependencyDecision) { $dependencyDecision | ConvertTo-Json -Compress -Depth 5 | Write-Output; exit 0 }
 
 try {
     $payload = ConvertFrom-CodexPromotionHookPayload -PayloadRaw ([Console]::In.ReadToEnd())

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-python-batch-budget.ps1

@@ -45,13 +45,14 @@
 #>
 [CmdletBinding()]
 param()
+$script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot 'hook-dependency-guard.ps1') } catch { $script:HookDependencyGuardLoadFailed = $true }
 
 # Shared Codex PreToolUse transport: stdin payload parsing and tool_input-to-file
 # mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
-. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
+try { . (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1') } catch { Add-HookDependencyFailure -Name 'codex-pretooluse-file-mapping.ps1' -ErrorRecord $_ }
 
 # Shared route helpers; this file is byte-identical to the Claude runtime copy.
-. (Join-Path $PSScriptRoot 'enforce-batch-budget-route.ps1')
+try { . (Join-Path $PSScriptRoot 'enforce-batch-budget-route.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-batch-budget-route.ps1' -ErrorRecord $_ }
 
 function Get-PythonBatchBudgetState {
     [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', 'TestCap', Justification = 'Accepted and ignored for callers written against the removed test-file cap.')]
@@ -137,6 +138,8 @@ function Invoke-PythonBatchBudgetDecision {
         [AllowEmptyString()]
         [string] $ObservedRoute = ''
     )
+    $dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'PYTHON_LARGE_PATH_REQUIRED:'
+    if ($null -ne $dependencyDecision) { return $dependencyDecision }
 
     $normalized = $FilePath -replace '\\', '/'
     if ($normalized -notmatch '\.py$') {
@@ -333,6 +336,9 @@ function Invoke-PythonBatchBudgetCodexEntryPoint {
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
+if ($script:HookDependencyGuardLoadFailed) { [Console]::Error.WriteLine('PYTHON_LARGE_PATH_REQUIRED: hook-dependency-guard.ps1 failed to load; the gate fails closed.'); exit 2 }
+$dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'PYTHON_LARGE_PATH_REQUIRED:'
+if ($null -ne $dependencyDecision) { $dependencyDecision | ConvertTo-Json -Compress -Depth 5 | Write-Output; exit 0 }
 
 # The entry point returns its [int] exit code as the last pipeline element and any
 # deny JSON before it, so the JSON is written explicitly before the process exits.

package/resources/codex-and-agents-customizations/.codex/hooks/feature-folder-resolution.ps1

@@ -0,0 +1,373 @@
+<#
+.SYNOPSIS
+    Pure feature-folder target resolution shared by the Claude and Codex enforcement hooks
+    (issue #565).
+
+.DESCRIPTION
+    One resolution rule, implemented once and parameterized per gate. A feature folder is
+    identified structurally, as the single path segment immediately below
+    docs/features/active/, and never by string length or prompt position.
+
+      - Find-FeatureFolderCandidate extracts the distinct cited folder basenames (R1).
+      - ConvertTo-FeatureFolderBasename normalizes a record value or token (R2).
+      - Find-FeatureFolderRecord is the union-index record lookup (issue_num or folder).
+      - Select-FeatureFolderTarget applies dependency pruning, the declared-issue-number
+        tie-break, and the fallback issue number, and reports Resolved, NoTarget, or
+        Ambiguous (R3-R6).
+      - Resolve-FeatureFolderWorkMode parses the persisted work-mode marker of issue.md.
+      - Get-FeatureFolderPlanPrerequisite maps a work mode to its plan prerequisites.
+
+    The file is byte-identical in .claude/hooks/ and .codex/hooks/ and is dot-sourced by its
+    callers, each of which guards the dot-source and fails closed when it cannot be loaded.
+
+.NOTES
+    Compatible with PowerShell 7+. PURITY: every function is pure string and object logic.
+    The file opens no file, probes no path, reads no environment value, launches no process,
+    issues no web request, and loads no module. It declares functions only.
+#>
+
+function Find-FeatureFolderCandidate {
+    <#
+    .SYNOPSIS
+        Returns the distinct feature-folder basenames cited in a text, in first-occurrence
+        order (R1).
+    .DESCRIPTION
+        Scans for docs/features/active/ path tokens with any prefix and either separator.
+        Each token is normalized to forward slashes and split into segments; empty and '.'
+        segments are dropped. A token with fewer than four segments yields no candidate.
+        The fourth segment is the folder, with trailing '.', ',', ';', ':', ')', ']', '>', '*', and '_' trimmed.
+        Duplicates are removed ordinally, keeping the first occurrence.
+    .PARAMETER Text
+        The prompt or other text to scan. Null or empty text yields no output.
+    .OUTPUTS
+        System.String[] (no output when no qualifying token is present)
+    #>
+    [CmdletBinding()]
+    [OutputType([string[]])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Text
+    )
+
+    if ([string]::IsNullOrEmpty($Text)) {
+        return
+    }
+
+    $found = [System.Collections.Generic.List[string]]::new()
+    foreach ($match in [regex]::Matches($Text, 'docs[\\/]+features[\\/]+active[\\/]+[^\s"''`]+')) {
+        $segments = @(($match.Value -replace '\\', '/') -split '/' | Where-Object { $_ -and $_ -ne '.' })
+        if ($segments.Count -lt 4) {
+            continue
+        }
+        $folder = $segments[3].TrimEnd('.', ',', ';', ':', ')', ']', '>', '*', '_')
+        if (-not $folder -or $found.Contains($folder)) {
+            continue
+        }
+        $found.Add($folder)
+    }
+    return $found.ToArray()
+}
+
+function ConvertTo-FeatureFolderBasename {
+    <#
+    .SYNOPSIS
+        Normalizes a feature-folder record value or token to its basename (R2).
+    .DESCRIPTION
+        Separators are normalized to forward slashes, surrounding whitespace and trailing
+        slashes are trimmed, and one leading docs/features/<lifecycle>/, active/, or
+        completed/ prefix is stripped. The last remaining segment is returned.
+    .PARAMETER Value
+        The record value or token to normalize.
+    .OUTPUTS
+        System.String, or $null when no folder segment remains.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Value
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Value)) {
+        return $null
+    }
+    $normalized = ($Value -replace '\\', '/').Trim().TrimEnd('/')
+    $normalized = $normalized -replace '^(docs/features/[^/]+(/|$)|active/|completed/)', ''
+    $segment = ($normalized -split '/')[-1]
+    if (-not $segment -or $segment -eq '.') {
+        return $null
+    }
+    return $segment
+}
+
+function Find-FeatureFolderRecord {
+    <#
+    .SYNOPSIS
+        Finds the single record a reference identifies, through a union index of issue_num
+        and normalized feature_folder.
+    .DESCRIPTION
+        A non-string reference, or a string of digits only, matches records whose issue_num
+        string form equals it. Any other string matches records whose normalized
+        feature_folder basename ordinally equals the reference's normalized basename.
+    .PARAMETER Records
+        The checkpoint records (features[] or items[]).
+    .PARAMETER Reference
+        An issue number, a folder basename, or a folder path.
+    .OUTPUTS
+        The matching record, or $null when zero or several records match.
+    #>
+    [CmdletBinding()]
+    [OutputType([object])]
+    param(
+        [AllowNull()]
+        [AllowEmptyCollection()]
+        [object[]] $Records,
+
+        [AllowNull()]
+        [object] $Reference
+    )
+
+    if ($null -eq $Records -or $null -eq $Reference) {
+        return $null
+    }
+
+    $byIssue = (-not ($Reference -is [string])) -or ($Reference -match '^\d+$')
+    $key = if ($byIssue) { [string]$Reference } else { ConvertTo-FeatureFolderBasename -Value $Reference }
+    if (-not $key) {
+        return $null
+    }
+    $field = if ($byIssue) { 'issue_num' } else { 'feature_folder' }
+
+    $matched = @(foreach ($record in $Records) {
+            if ($null -eq $record) {
+                continue
+            }
+            $property = $record.PSObject.Properties[$field]
+            if ($null -eq $property -or $null -eq $property.Value) {
+                continue
+            }
+            $value = if ($byIssue) { [string]$property.Value } else { ConvertTo-FeatureFolderBasename -Value ([string]$property.Value) }
+            if ($value -ceq $key) {
+                $record
+            }
+        })
+    if ($matched.Count -ne 1) {
+        return $null
+    }
+    return $matched[0]
+}
+
+function Select-FeatureFolderTarget {
+    <#
+    .SYNOPSIS
+        Selects the target feature folder from the cited candidates and the run records
+        (R2-R6).
+    .DESCRIPTION
+        Each candidate maps to at most one record. Unmatched candidates stay in the set.
+        With -DependencyAware, a matched candidate is removed when its record lies in the
+        transitive depends_on closure of another cited candidate's record and that record
+        does not lie in its own closure, so a cycle removes neither. One remaining candidate
+        is Resolved. Several remaining candidates are Resolved only when
+        -DeclaredIssueNumber names exactly one remaining record. Zero candidates resolve
+        through -FallbackIssueNumber when it names a record. Otherwise the result is
+        NoTarget for zero and Ambiguous for several. Neither string length nor candidate
+        position affects the status.
+    .PARAMETER Records
+        The checkpoint records (features[] or items[]).
+    .PARAMETER Candidate
+        The cited folder basenames, in first-occurrence order.
+    .PARAMETER DeclaredIssueNumber
+        Optional tie-break from the canonical issue-number line.
+    .PARAMETER FallbackIssueNumber
+        Optional issue number used only when no candidate is cited.
+    .PARAMETER DependencyAware
+        Removes cited candidates that are dependencies of another cited candidate.
+    .OUTPUTS
+        System.Management.Automation.PSCustomObject with Status, Record, Basename,
+        Remaining, and Detail.
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [AllowNull()]
+        [AllowEmptyCollection()]
+        [object[]] $Records,
+
+        [AllowNull()]
+        [AllowEmptyCollection()]
+        [string[]] $Candidate,
+
+        [int] $DeclaredIssueNumber,
+
+        [int] $FallbackIssueNumber,
+
+        [switch] $DependencyAware
+    )
+
+    $recordList = @($Records | Where-Object { $null -ne $_ })
+    $entries = @(foreach ($name in @($Candidate | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })) {
+            [pscustomobject]@{ Basename = $name; Record = Find-FeatureFolderRecord -Records $recordList -Reference $name }
+        })
+
+    if ($DependencyAware -and $entries.Count -gt 1) {
+        # Transitive depends_on closure of each matched candidate's record.
+        $closures = @(foreach ($entry in $entries) {
+                $closure = [System.Collections.Generic.List[object]]::new()
+                $pending = [System.Collections.Generic.Stack[object]]::new()
+                if ($null -ne $entry.Record) {
+                    $pending.Push($entry.Record)
+                }
+                while ($pending.Count -gt 0) {
+                    $dependsOn = $pending.Pop().PSObject.Properties['depends_on']
+                    if ($null -eq $dependsOn) {
+                        continue
+                    }
+                    foreach ($reference in @($dependsOn.Value)) {
+                        $dependency = Find-FeatureFolderRecord -Records $recordList -Reference $reference
+                        if ($null -ne $dependency -and -not $closure.Contains($dependency)) {
+                            $closure.Add($dependency)
+                            $pending.Push($dependency)
+                        }
+                    }
+                }
+                , $closure
+            })
+
+        $kept = for ($i = 0; $i -lt $entries.Count; $i++) {
+            $pruned = $false
+            for ($j = 0; $j -lt $entries.Count -and $null -ne $entries[$i].Record; $j++) {
+                if ($i -eq $j -or $null -eq $entries[$j].Record) {
+                    continue
+                }
+                if ($closures[$j].Contains($entries[$i].Record) -and -not $closures[$i].Contains($entries[$j].Record)) {
+                    $pruned = $true
+                    break
+                }
+            }
+            if (-not $pruned) {
+                $entries[$i]
+            }
+        }
+        $entries = @($kept)
+    }
+
+    $remaining = [string[]]@($entries | ForEach-Object { $_.Basename })
+    $selected = $null
+    if ($entries.Count -eq 1) {
+        $selected = $entries[0]
+    }
+    elseif ($entries.Count -gt 1 -and $PSBoundParameters.ContainsKey('DeclaredIssueNumber')) {
+        $declared = [string]$DeclaredIssueNumber
+        $byIssue = @($entries | Where-Object {
+                $null -ne $_.Record -and $null -ne $_.Record.PSObject.Properties['issue_num'] -and
+                ([string]$_.Record.issue_num) -ceq $declared
+            })
+        if ($byIssue.Count -eq 1) {
+            $selected = $byIssue[0]
+        }
+    }
+    elseif ($entries.Count -eq 0 -and $PSBoundParameters.ContainsKey('FallbackIssueNumber')) {
+        $fallback = Find-FeatureFolderRecord -Records $recordList -Reference $FallbackIssueNumber
+        if ($null -ne $fallback) {
+            $folder = $fallback.PSObject.Properties['feature_folder']
+            $basename = if ($null -ne $folder) { ConvertTo-FeatureFolderBasename -Value ([string]$folder.Value) } else { $null }
+            $selected = [pscustomobject]@{ Basename = $basename; Record = $fallback }
+        }
+    }
+
+    if ($null -ne $selected) {
+        return [pscustomobject]@{
+            Status    = 'Resolved'
+            Record    = $selected.Record
+            Basename  = $selected.Basename
+            Remaining = $remaining
+            Detail    = "resolved target feature folder '$($selected.Basename)'"
+        }
+    }
+    if ($entries.Count -eq 0) {
+        return [pscustomobject]@{
+            Status    = 'NoTarget'
+            Record    = $null
+            Basename  = $null
+            Remaining = $remaining
+            Detail    = 'no target feature folder is cited'
+        }
+    }
+    return [pscustomobject]@{
+        Status    = 'Ambiguous'
+        Record    = $null
+        Basename  = $null
+        Remaining = $remaining
+        Detail    = 'ambiguous target feature folder; remaining candidates: ' + ($remaining -join ', ')
+    }
+}
+
+function Resolve-FeatureFolderWorkMode {
+    <#
+    .SYNOPSIS
+        Parses the persisted '- Work Mode:' marker out of issue.md content.
+    .DESCRIPTION
+        Returns minor-audit, full-bug, or full-feature. The legacy full marker normalizes to
+        full-feature. Missing, empty, malformed, or unrecognized content returns
+        -UnresolvedMode.
+    .PARAMETER IssueContent
+        The raw issue.md text, or $null when it could not be read.
+    .PARAMETER UnresolvedMode
+        The value returned when no recognized marker is present. Defaults to full-feature.
+    .OUTPUTS
+        System.String
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $IssueContent,
+
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $UnresolvedMode = 'full-feature'
+    )
+
+    if ([string]::IsNullOrWhiteSpace($IssueContent)) {
+        return $UnresolvedMode
+    }
+    $match = [regex]::Match($IssueContent, '(?im)^-\s*Work Mode:\s*(minor-audit|full-feature|full-bug|full)\s*$')
+    if (-not $match.Success) {
+        return $UnresolvedMode
+    }
+    $rawMode = $match.Groups[1].Value
+    if ($rawMode -eq 'full') {
+        return 'full-feature'
+    }
+    return $rawMode
+}
+
+function Get-FeatureFolderPlanPrerequisite {
+    <#
+    .SYNOPSIS
+        Maps a work mode to the files a feature folder must contain before a plan is written.
+    .DESCRIPTION
+        minor-audit requires issue.md; full-bug requires issue.md and spec.md; full-feature
+        and every other value require issue.md, spec.md, and user-story.md.
+    .PARAMETER WorkMode
+        The resolved work mode.
+    .OUTPUTS
+        System.String[]
+    #>
+    [CmdletBinding()]
+    [OutputType([string[]])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $WorkMode
+    )
+
+    switch ($WorkMode) {
+        'minor-audit' { return [string[]]@('issue.md') }
+        'full-bug' { return [string[]]@('issue.md', 'spec.md') }
+        default { return [string[]]@('issue.md', 'spec.md', 'user-story.md') }
+    }
+}

package/resources/codex-and-agents-customizations/.codex/hooks/feature-review-coverage-thresholds.ps1

@@ -0,0 +1,85 @@
+<#
+.SYNOPSIS
+    Resolve the coverage thresholds that govern the feature-review coverage validation.
+.DESCRIPTION
+    Implements the threshold precedence of the pushed quality-tiers rule for the
+    feature-review SubagentStop hook (issue #824, follow-up FU-823-1). When the
+    repository's root CLAUDE.md states a line or branch coverage threshold, that threshold
+    governs; otherwise the default governs (85 percent line, 75 percent branch). Each
+    metric is resolved on its own, so a root CLAUDE.md that states only a line threshold
+    leaves the branch default in force.
+
+    Pure string logic only: the caller supplies the CLAUDE.md text. No disk, process,
+    network, clock, or environment access. It is dot-sourced by
+    validate-feature-review-coverage.ps1 as:
+    . (Join-Path $PSScriptRoot 'feature-review-coverage-thresholds.ps1')
+#>
+
+
+function Get-FeatureReviewCoverageThreshold {
+    <#
+    .SYNOPSIS
+        Return the governing line and branch coverage thresholds for a root CLAUDE.md text.
+    .DESCRIPTION
+        For each metric M in 'line' and 'branch', a figure is read only when a comparator
+        or floor phrase links it to the metric on the same line as 'M coverage'. Two forms
+        are accepted, and any text without a percent sign may sit between 'M coverage' and
+        the comparator or the figure:
+
+          - Comparator before the figure: one of '>=', the U+2265 sign, 'at least',
+            'minimum', 'minimum of', or 'no less than', an optional colon, and the figure
+            followed by a percent sign (for example 'line coverage >= 85%').
+          - Trailing floor phrase after the figure: the figure followed by a percent sign,
+            then one of 'minimum', 'at least', 'or more', 'or higher', 'or above', or
+            'or greater' (for example 'line coverage: 70% minimum').
+
+        Prose such as 'line coverage was 62% last release' is not read. The first match in
+        text order across both forms whose value parses (invariant culture) to a number
+        from 0 to 100 sets that metric and its source to 'claude-md'. Otherwise the metric
+        keeps its default (line 85, branch 75) and its source is 'default'.
+
+        Known limitation: a combined statement such as 'line and branch coverage >= 70%'
+        matches neither metric, because the metric name must be followed directly by
+        'coverage' and must not be joined to the other metric name by 'and', 'or', '&',
+        or '/'. Both metrics then keep their defaults, which is the stricter direction.
+    .PARAMETER ClaudeMdText
+        The text of the repository's root CLAUDE.md; $null or empty when it is absent.
+    .OUTPUTS
+        System.Management.Automation.PSCustomObject - Line, Branch, LineSource, BranchSource.
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [Parameter(Mandatory)][AllowNull()][AllowEmptyString()][string] $ClaudeMdText
+    )
+
+    $defaults = [ordered]@{ line = 85.0; branch = 75.0 }
+    $resolved = @{}
+    $culture = [System.Globalization.CultureInfo]::InvariantCulture
+    $style = [System.Globalization.NumberStyles]::Float
+
+    foreach ($metric in $defaults.Keys) {
+        $value = [double]$defaults[$metric]
+        $source = 'default'
+        if (-not [string]::IsNullOrEmpty($ClaudeMdText)) {
+            $pattern = '(?im)(?<!\b(?:line|branch)\s*(?:and|or|&|/)\s*)\b' + $metric + '\s+coverage\b[^\r\n%]*?(?:(?:>=|' + [char]0x2265 + '|\bat\s+least\b|\bminimum(?:\s+of)?\b|\bno\s+less\s+than\b)\s*:?\s*(?<![\d.])(?<pct>\d{1,3}(?:\.\d+)?)\s*%|(?<![\d.])(?<pct>\d{1,3}(?:\.\d+)?)\s*%\s*(?:minimum|at\s+least|or\s+(?:more|higher|above|greater))\b)'
+            foreach ($match in [regex]::Matches($ClaudeMdText, $pattern)) {
+                $parsed = 0.0
+                $isNumber = [double]::TryParse($match.Groups['pct'].Value, $style, $culture, [ref]$parsed)
+                if ($isNumber -and $parsed -ge 0 -and $parsed -le 100) {
+                    $value = $parsed
+                    $source = 'claude-md'
+                    break
+                }
+            }
+        }
+        $resolved[$metric] = [pscustomobject]@{ Value = $value; Source = $source }
+    }
+
+    return [pscustomobject]@{
+        Line         = $resolved['line'].Value
+        Branch       = $resolved['branch'].Value
+        LineSource   = $resolved['line'].Source
+        BranchSource = $resolved['branch'].Source
+    }
+}