@danmoisan/drm-copilot-mcp 1.1.17 → 1.1.19

package/resources/customizations/.github/agents/csharp-typed-engineer.agent.md

@@ -170,8 +170,8 @@ If any gate fails, revert/fix immediately before proceeding.
 Run the repo-standard C# toolchain in this order:
 
 1) **Format**: `csharpier .`
-2) **Analyze/Lint build**: `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`
-3) **Type-safe nullable build**: `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true`
+2) **Analyze/Lint build**: `msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`
+3) **Type-safe nullable build**: `msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true`
 4) **Test with coverage**: `vstest.console.exe <test-assembly-paths> /EnableCodeCoverage`
 
 If tools cannot run in the environment, STOP implementation and provide plan + proposed diffs marked **unverified**.

package/resources/customizations/.github/instructions/csharp-code-change.instructions.md

@@ -38,8 +38,8 @@ These are the required tools for C# code in this repo:
    - Enforce analyzer diagnostics in build using `EnableNETAnalyzers` and `EnforceCodeStyleInBuild`.
    - Prefer fixing diagnostics over suppressing them.
    - Approved commands (Windows; choose the variant for your shell):
-     - **CMD / Developer Command Prompt:** `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`
-     - **PowerShell:** `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`
+     - **CMD / Developer Command Prompt:** `msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`
+     - **PowerShell:** `msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`
 
 3. **Type Checking — C# compiler + nullable analysis**
 
@@ -47,8 +47,8 @@ These are the required tools for C# code in this repo:
    - Enable nullable reference types and fail builds on warnings for touched code paths.
    - Avoid introducing nullable warnings; fix the root null-state issue instead.
    - Approved commands (Windows; choose the variant for your shell):
-     - **CMD / Developer Command Prompt:** `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true`
-     - **PowerShell:** `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true`
+     - **CMD / Developer Command Prompt:** `msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true`
+     - **PowerShell:** `msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true`
 
 > **Testing tools and behavior are defined in the unit test policies.** Do not define test behavior here; instead, obey `general-unit-test.instructions.md` and `csharp-unit-test.instructions.md`.
 

package/resources/customizations/.github/instructions/csharp-unit-test.instructions.md

@@ -43,8 +43,8 @@ If there is any conflict between these documents, halt and notify the user.
 
 - For C# work, use these concrete commands for the general policy toolchain loop:
   1. `csharpier .`
-  2. `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`
-  3. `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true`
+  2. `msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`
+  3. `msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true`
   4. `vstest.console.exe <test-assembly-paths> /EnableCodeCoverage`
 
 - The loop behavior (restart rules, must-pass requirements, and audit expectations) is defined by `general-code-change.instructions.md` and is intentionally not repeated here.

package/resources/customizations/.github/skills/acceptance-criteria-tracking/SKILL.md

@@ -68,6 +68,14 @@ During plan execution, after completing a task whose work satisfies an acceptanc
 
 Timing: Check off AC items as soon as the corresponding plan task passes verification — do not defer all AC updates to the end of plan execution.
 
+### CI-Dependent Criteria
+
+A CI-dependent criterion is one whose verification requires the result of CI on the PR head. It cannot be verified before the pull request exists, so it stays unchecked and is listed as pending-CI in the AC verification artifact until CI has run.
+
+- Owner: the item's own orchestrator run owns the check-off and performs it at S9; this is the one case in which an orchestrator run checks off AC. A parent or coordinating session never commits the check-off from its own root.
+- Timing: after the CI green gate (S9) records `ci_gate.conclusion` as `success`, and before the run reports DONE.
+- Push and re-verify: the check-off is committed in the item's own worktree and pushed to the PR branch, and the CI green gate is re-run against the new head SHA so that `ci_gate.head_sha` equals the final PR head before DONE.
+
 ### When Reviewers Check Off AC
 
 During feature review (feature-audit phase):
@@ -78,7 +86,7 @@ During feature review (feature-audit phase):
 
 ### When Orchestrators Enforce AC Tracking
 
-Orchestrators do not directly check off AC items. Instead:
+Orchestrators do not directly check off AC items. The one exception is a CI-dependent criterion, which the item's own orchestrator run checks off at S9 as described in `### CI-Dependent Criteria` above. For every other criterion, orchestrators instead:
 
 1. Ensure delegated executors and reviewers reference this skill.
 2. After executor or reviewer completion, verify that AC source files reflect delivered work (spot-check; do not re-execute verification).

package/resources/customizations/.github/skills/atomic-plan-contract/SKILL.md

@@ -102,6 +102,10 @@ For short-path/minimal-audit plans, Phase 0 evidence is incomplete unless both a
 
 `Output Summary:` is mandatory for each command-step artifact and must concisely summarize the essential result signal (for example: pass/fail status, key counts, coverage headline, or primary diagnostic).
 
+## Evidence Filename Timestamps in Plans
+
+Plans name evidence artifacts `<name>.<timestamp>.md` and never fix a plan-time stamp in an evidence filename. An acceptance condition identifies a consumed evidence artifact by the derivation in `evidence-and-timestamp-conventions` (`### Evidence Filename Timestamp`): the lexicographically greatest file matching `<name>.*.md`, not a pre-stamped literal path. This section governs artifact paths only: asserted search tokens remain concrete.
+
 ## Coverage Evidence Contract (Mandatory when policy requires coverage)
 
 For any language in scope where repository policy requires coverage validation:

package/resources/customizations/.github/skills/evidence-and-timestamp-conventions/SKILL.md

@@ -19,6 +19,17 @@ Use this skill when:
 Use `yyyy-MM-ddTHH-mm` for all audit, remediation, and evidence artifacts.
 Example: `2026-02-06T14-30`.
 
+The `Timestamp` value is UTC read from the host system clock when the recorded command runs (for example `Get-Date -AsUTC -Format yyyy-MM-ddTHH-mm` in PowerShell 7, `(Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH-mm')` in Windows PowerShell 5.1, or `date -u +%Y-%m-%dT%H-%M` in a POSIX shell); the agent never composes or estimates it. The value is written without a zone suffix.
+
+### Evidence Filename Timestamp
+
+The stamp in the filename of every artifact under `<FEATURE>/evidence/<kind>/` is the UTC time at which that file is written, read from the host system clock immediately before the write, in the same `yyyy-MM-ddTHH-mm` shape with no zone suffix. It is never a plan-time stamp, a plan-cycle identifier, or any other value fixed before the write.
+
+- Plans name such an artifact `<name>.<timestamp>.md`, and the executor substitutes the write time. A later loop pass writes a new file with a new stamp.
+- A task that consumes an evidence artifact selects the lexicographically greatest file matching `<name>.*.md`. The fixed-width UTC shape sorts in chronological order, so that file is the most recently written one.
+- Plan files (`plan.<timestamp>.md`, stamped by the feature-folder tooling in America/New_York) and the review artifact set (`policy-audit`, `code-review`, `feature-audit`, `remediation-inputs`, which share one stamp) are outside this rule.
+- Existing evidence files whose names carry a plan-time stamp are not renamed.
+
 ## Canonical Evidence Locations
 
 - Baseline evidence: `evidence/baseline/`
@@ -83,6 +94,8 @@ When evidence artifacts are used for automated checking or plan reconciliation,
 - `Command: <exact command>`
 - `EXIT_CODE: <int>`
 
+The first occurrence of `Timestamp`, `Command`, `EXIT_CODE`, and `ExpectedExitCode` forms the record in both the Python and the TypeScript parser; later occurrences, including empty later values, are ignored. An artifact that records several gates therefore reports its first gate.
+
 One optional field may also be declared:
 - `ExpectedExitCode: <int>` — the exit code the gate is expected to produce.
 

package/resources/customizations/.github/skills/feature-review-workflow/SKILL.md

@@ -123,7 +123,7 @@ Always apply:
      - toolchain checks fail
      - the code review contains blockers
      - required acceptance criteria are FAIL or PARTIAL
-     - coverage regression below policy threshold (< 80% repo-wide or < 90% for new code)
+     - coverage below the governing thresholds (the root `CLAUDE.md` thresholds when stated, otherwise the defaults: line 85%, branch 75% for branch-capable languages; repo-wide per language, modified files including any regression on changed lines, or new files)
    - Create `remediation-inputs.<timestamp>.md` first.
    - Create the target remediation plan file from the canonical plan template.
    - Hand off plan creation through `remediation-handoff-atomic-planner`.

package/resources/powershell/PoshQC/PoshQC.Coverage.psm1

@@ -0,0 +1,314 @@
+<#
+.SYNOPSIS
+Returns the non-blank string entries of one list in a Pester settings table.
+.DESCRIPTION
+Reads Settings[Section][Key] and returns its non-blank string entries in their original order.
+Returns nothing when Settings or the section is not a dictionary or when the key is absent.
+Used for 'CodeCoverage.Path' and 'Run.Path' (issue #527).
+.PARAMETER Settings
+Settings table, normally the hashtable loaded from the Pester runsettings file.
+.PARAMETER Section
+Top-level section name, for example 'CodeCoverage' or 'Run'.
+.PARAMETER Key
+Key inside the section, for example 'Path'.
+#>
+function Get-PoshQCSettingsList {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        $Settings,
+        [string] $Section,
+        [string] $Key
+    )
+
+    if ($Settings -isnot [System.Collections.IDictionary]) {
+        return
+    }
+
+    $sectionValue = $Settings[$Section]
+    if ($sectionValue -isnot [System.Collections.IDictionary]) {
+        return
+    }
+
+    if (-not $sectionValue.Contains($Key)) {
+        return
+    }
+
+    foreach ($entry in @($sectionValue[$Key])) {
+        if ($entry -is [string] -and -not [string]::IsNullOrWhiteSpace($entry)) {
+            [string] $entry
+        }
+    }
+}
+
+<#
+.SYNOPSIS
+Reads and validates the workspace coverage configuration (issue #527).
+.DESCRIPTION
+Resolves the workspace-relative configuration file (default 'config/poshqc-coverage.json')
+against Root. An absent file reports Present = $false. A present file must be a JSON object
+with 'version' equal to 1 and a 'roots' array of workspace-relative paths; every validation
+failure throws a message that names the configuration file. An empty 'roots' array is valid
+and yields an empty coverage population.
+.PARAMETER Root
+Workspace root the configuration path resolves against.
+.PARAMETER ConfigRelativePath
+Workspace-relative path to the configuration file.
+.PARAMETER TestPathExists
+Injectable file-existence seam. Defaults to Test-Path -PathType Leaf.
+.PARAMETER ReadContent
+Injectable read seam returning the raw file text. Defaults to Get-Content -Raw.
+#>
+function Get-PoshQCCoverageConfigRoot {
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [string] $Root,
+        [string] $ConfigRelativePath = 'config/poshqc-coverage.json',
+        [scriptblock] $TestPathExists = { param([string] $Path) Test-Path -LiteralPath $Path -PathType Leaf },
+        [scriptblock] $ReadContent = { param([string] $Path) Get-Content -LiteralPath $Path -Raw }
+    )
+
+    $ErrorActionPreference = 'Stop'
+
+    $configPath = if ([IO.Path]::IsPathRooted($ConfigRelativePath)) {
+        $ConfigRelativePath
+    } else {
+        Join-Path -Path $Root -ChildPath $ConfigRelativePath
+    }
+
+    if (-not (& $TestPathExists $configPath)) {
+        return [pscustomobject]@{ Present = $false; Roots = [string[]] @() }
+    }
+
+    $raw = [string] (& $ReadContent $configPath)
+    if ([string]::IsNullOrWhiteSpace($raw)) {
+        throw "Coverage configuration '$ConfigRelativePath' is empty."
+    }
+
+    try {
+        $parsed = $raw | ConvertFrom-Json -ErrorAction Stop
+    } catch {
+        throw "Invalid JSON in coverage configuration '$ConfigRelativePath': $($_.Exception.Message)"
+    }
+
+    if ($parsed -isnot [System.Management.Automation.PSCustomObject]) {
+        throw "Coverage configuration '$ConfigRelativePath' must contain a JSON object."
+    }
+
+    # Read properties through PSObject so a missing property yields $null under StrictMode.
+    $versionProperty = $parsed.PSObject.Properties['version']
+    $versionIsInteger = $null -ne $versionProperty -and ($versionProperty.Value -is [long] -or $versionProperty.Value -is [int])
+    if (-not $versionIsInteger -or $versionProperty.Value -ne 1) {
+        throw "Coverage configuration '$ConfigRelativePath' must declare 'version' equal to 1."
+    }
+
+    $rootsProperty = $parsed.PSObject.Properties['roots']
+    if ($null -eq $rootsProperty) {
+        throw "Coverage configuration '$ConfigRelativePath' must declare a 'roots' array."
+    }
+    if ($rootsProperty.Value -isnot [System.Array]) {
+        throw "Coverage configuration '$ConfigRelativePath' must declare 'roots' as an array."
+    }
+
+    $validated = [System.Collections.Generic.List[string]]::new()
+    foreach ($entry in $rootsProperty.Value) {
+        if ($entry -isnot [string] -or [string]::IsNullOrWhiteSpace($entry)) {
+            throw "Coverage configuration '$ConfigRelativePath' contains a blank or non-string 'roots' entry."
+        }
+        if ([IO.Path]::IsPathRooted($entry)) {
+            throw "Coverage configuration '$ConfigRelativePath' entry '$entry' must be a workspace-relative path, not an absolute path."
+        }
+        if (@($entry -split '[\\/]+') -contains '..') {
+            throw "Coverage configuration '$ConfigRelativePath' entry '$entry' must not contain '..' segments."
+        }
+        $validated.Add($entry)
+    }
+
+    return [pscustomobject]@{ Present = $true; Roots = [string[]] $validated.ToArray() }
+}
+
+<#
+.SYNOPSIS
+Enumerates the PowerShell production files under a set of coverage roots (issue #527).
+.DESCRIPTION
+Joins each non-rooted root to Root, skips a nonexistent root with one warning, and keeps
+files with a .ps1 or .psm1 extension (case-insensitive) whose name does not match
+'*.Tests.ps1', whose first root-relative segment is not 'tests', and whose root-relative
+directory segments are not in ExcludeDirs. Root-relative paths use forward slashes. The result
+is sorted ordinally on RelativePath and de-duplicated case-insensitively, keeping the
+ordinally smallest variant.
+.PARAMETER Root
+Workspace root that relative roots and relative paths are computed against.
+.PARAMETER Roots
+Coverage roots, workspace-relative or absolute.
+.PARAMETER ExcludeDirs
+Directory names excluded from the population.
+.PARAMETER TestPathExists
+Injectable directory-existence seam. Defaults to Test-Path -PathType Container.
+.PARAMETER EnumerateFiles
+Injectable recursive file enumeration seam. Defaults to Get-ChildItem -Recurse -File -Force.
+.PARAMETER WarningLogger
+Injectable warning seam for skipped roots. Defaults to Write-Warning.
+#>
+function Get-PoshQCCoverageFileSet {
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [string] $Root,
+        [string[]] $Roots,
+        [string[]] $ExcludeDirs = $script:DefaultExcludedDirs,
+        [scriptblock] $TestPathExists = { param([string] $Path) Test-Path -LiteralPath $Path -PathType Container },
+        [scriptblock] $EnumerateFiles = { param([string] $Path) Get-ChildItem -LiteralPath $Path -Recurse -File -Force },
+        [scriptblock] $WarningLogger = { param([string] $Message) Write-Warning $Message }
+    )
+
+    $ErrorActionPreference = 'Stop'
+
+    $rootPrefix = ([string] $Root -replace '\\', '/').TrimEnd('/')
+    $candidates = [System.Collections.Generic.Dictionary[string, object]]::new([StringComparer]::Ordinal)
+    foreach ($coverageRoot in @($Roots | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })) {
+        $rootPath = if ([IO.Path]::IsPathRooted($coverageRoot)) { $coverageRoot } else { Join-Path -Path $Root -ChildPath $coverageRoot }
+        if (-not (& $TestPathExists $rootPath)) {
+            & $WarningLogger "Coverage root '$coverageRoot' does not exist under '$Root'; skipping."
+            continue
+        }
+
+        foreach ($file in @(& $EnumerateFiles $rootPath)) {
+            if ($null -eq $file) { continue }
+            $extension = [string] $file.Extension
+            if (-not ($extension -ieq '.ps1' -or $extension -ieq '.psm1')) { continue }
+            if ([string] $file.Name -like '*.Tests.ps1') { continue }
+
+            $fullPath = [string] $file.FullName
+            $normalizedPath = $fullPath -replace '\\', '/'
+            $relativePath = $normalizedPath
+            if ($rootPrefix -and $normalizedPath.StartsWith("$rootPrefix/", [StringComparison]::OrdinalIgnoreCase)) {
+                $relativePath = $normalizedPath.Substring($rootPrefix.Length + 1)
+            }
+
+            $segments = @($relativePath -split '/' | Where-Object { $_ -ne '' })
+            if ($segments.Count -gt 0 -and $segments[0] -ieq 'tests') { continue }
+            $directorySegments = if ($segments.Count -gt 1) { @($segments[0..($segments.Count - 2)]) } else { @() }
+            $excludedSegments = @($directorySegments | Where-Object { $ExcludeDirs -contains $_ })
+            if ($excludedSegments.Count -gt 0) { continue }
+
+            if (-not $candidates.ContainsKey($relativePath)) {
+                $candidates[$relativePath] = [pscustomobject]@{ RelativePath = $relativePath; FullPath = $fullPath }
+            }
+        }
+    }
+
+    [string[]] $keys = @($candidates.Keys)
+    [Array]::Sort($keys, [StringComparer]::Ordinal)
+    $seen = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+    foreach ($key in $keys) {
+        if ($seen.Add($key)) {
+            $candidates[$key]
+        }
+    }
+}
+
+<#
+.SYNOPSIS
+Resolves the code-coverage population for one Invoke-PoshQCTest run (issue #527).
+.DESCRIPTION
+Applies the coverage precedence and returns the source name and the absolute file paths:
+(1) 'settings': a caller-supplied settings file (one whose full path differs from the
+module-default settings file) with a non-empty CodeCoverage.Path; relative entries are joined
+to Root, rooted entries are kept as written, and each nonexistent entry is pruned and logged.
+A non-empty CodeCoverage.Path in the module-default settings file is ignored and logged.
+(2) 'config': the workspace coverage configuration reports Present.
+(3) 'fallback': the effective scan-folder roots when non-empty, else the settings Run.Path.
+.PARAMETER Root
+Absolute workspace root.
+.PARAMETER Settings
+Settings table loaded from the Pester runsettings file.
+.PARAMETER SettingsFile
+Path of the settings file the table was loaded from.
+.PARAMETER ScanFolderRoots
+Effective test scan folders of the run (explicit -ScanFolders or the scan configuration).
+.PARAMETER ExcludeDirs
+Directory names excluded from the population.
+.PARAMETER DefaultSettingsFile
+The module-default settings file; a list in it is not honored.
+.PARAMETER SettingsPathExists
+Injectable existence seam for caller-supplied settings entries. Defaults to Test-Path.
+.PARAMETER Logger
+Injectable information seam. Defaults to Write-Information.
+.PARAMETER WarningLogger
+Injectable warning seam passed to the file-set seam. Defaults to Write-Warning.
+.PARAMETER ReadConfig
+Injectable configuration seam. Defaults to Get-PoshQCCoverageConfigRoot.
+.PARAMETER GetFileSet
+Injectable file-set seam. Defaults to Get-PoshQCCoverageFileSet.
+#>
+function Resolve-PoshQCCoveragePopulation {
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [string] $Root,
+        $Settings,
+        [string] $SettingsFile,
+        [string[]] $ScanFolderRoots,
+        [string[]] $ExcludeDirs = $script:DefaultExcludedDirs,
+        [string] $DefaultSettingsFile = $script:PesterSettings,
+        [scriptblock] $SettingsPathExists = { param([string] $Path) Test-Path $Path },
+        [scriptblock] $Logger = { param([string] $Message) Write-Information $Message -InformationAction Continue },
+        [scriptblock] $WarningLogger = { param([string] $Message) Write-Warning $Message },
+        [scriptblock] $ReadConfig = { param([string] $RootPath) Get-PoshQCCoverageConfigRoot -Root $RootPath },
+        [scriptblock] $GetFileSet = {
+            param([string] $RootPath, [string[]] $Roots, [string[]] $Excluded, [scriptblock] $Warn)
+            Get-PoshQCCoverageFileSet -Root $RootPath -Roots $Roots -ExcludeDirs $Excluded -WarningLogger $Warn
+        }
+    )
+
+    $ErrorActionPreference = 'Stop'
+
+    $settingsPaths = @(Get-PoshQCSettingsList -Settings $Settings -Section 'CodeCoverage' -Key 'Path')
+    if ($settingsPaths.Count -gt 0) {
+        # A settings file is caller-supplied custom when its full path differs from the module default.
+        $isCustomSettingsFile = $false
+        if (-not [string]::IsNullOrWhiteSpace($SettingsFile)) {
+            $settingsFullPath = [IO.Path]::GetFullPath([IO.Path]::Combine($PWD.ProviderPath, $SettingsFile))
+            $defaultFullPath = ''
+            if (-not [string]::IsNullOrWhiteSpace($DefaultSettingsFile)) {
+                $defaultFullPath = [IO.Path]::GetFullPath([IO.Path]::Combine($PWD.ProviderPath, $DefaultSettingsFile))
+            }
+            $isCustomSettingsFile = -not [string]::Equals($settingsFullPath, $defaultFullPath, [StringComparison]::OrdinalIgnoreCase)
+        }
+
+        if ($isCustomSettingsFile) {
+            $survivingPaths = [System.Collections.Generic.List[string]]::new()
+            foreach ($entry in $settingsPaths) {
+                # Rooted entries are kept and tested as written; they are never re-joined to Root.
+                $candidate = if ([IO.Path]::IsPathRooted($entry)) { $entry } else { Join-Path -Path $Root -ChildPath $entry }
+                if (& $SettingsPathExists $candidate) {
+                    $survivingPaths.Add($candidate)
+                } else {
+                    & $Logger "Pruned nonexistent code coverage path: $candidate"
+                }
+            }
+
+            return [pscustomobject]@{ Source = 'settings'; Paths = [string[]] $survivingPaths.ToArray() }
+        }
+
+        & $Logger 'Ignored CodeCoverage.Path from the module-default settings file; the coverage population is derived from the workspace.'
+    }
+
+    $configRoot = & $ReadConfig $Root
+    if ($null -ne $configRoot -and $configRoot.Present) {
+        $source = 'config'
+        $coverageRoots = @($configRoot.Roots)
+    } else {
+        $source = 'fallback'
+        $coverageRoots = @($ScanFolderRoots | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+        if ($coverageRoots.Count -eq 0) {
+            $coverageRoots = @(Get-PoshQCSettingsList -Settings $Settings -Section 'Run' -Key 'Path')
+        }
+    }
+
+    $files = @(& $GetFileSet $Root ([string[]] $coverageRoots) $ExcludeDirs $WarningLogger)
+    $paths = [string[]] @($files | Where-Object { $null -ne $_ } | ForEach-Object { $_.FullPath })
+    return [pscustomobject]@{ Source = $source; Paths = $paths }
+}

package/resources/powershell/PoshQC/PoshQC.Testing.psm1

@@ -147,6 +147,9 @@ Custom path for Koverage-compatible coverage XML output.
 Skip creation of Koverage-friendly coverage copy.
 .PARAMETER ScanFolders
 Optional workspace-relative or workspace-contained folders to scan instead of the entire root.
+.PARAMETER ResolveCoveragePopulation
+Injectable seam that derives the code-coverage file population from the workspace (issue #527).
+Defaults to Resolve-PoshQCCoveragePopulation.
 #>
 function Invoke-PoshQCTest {
     [CmdletBinding()]
@@ -282,6 +285,10 @@ function Invoke-PoshQCTest {
         [scriptblock] $CopyCoverage = {
             param([string] $CoveragePath, [string] $RepoRoot, [string] $KoveragePath)
             Convert-PoshQCCoverageToRelative -InputPath $CoveragePath -OutputPath $KoveragePath -RepoRoot $RepoRoot
+        },
+        [scriptblock] $ResolveCoveragePopulation = {
+            param([string] $RootPath, $Settings, [string] $SettingsFile, [string[]] $ScanFolderRoots, [string[]] $Excluded, [scriptblock] $PathExists, [scriptblock] $Log)
+            Resolve-PoshQCCoveragePopulation -Root $RootPath -Settings $Settings -SettingsFile $SettingsFile -ScanFolderRoots $ScanFolderRoots -ExcludeDirs $Excluded -SettingsPathExists $PathExists -Logger $Log
         }
     )
 
@@ -290,6 +297,10 @@ function Invoke-PoshQCTest {
     if (-not $Root) {
         $Root = $PWD.ProviderPath
     }
+    # Resolve a relative -Root once so run, coverage, and output paths are absolute (issue #527).
+    if (-not [IO.Path]::IsPathRooted($Root)) {
+        $Root = [IO.Path]::GetFullPath([IO.Path]::Combine($PWD.ProviderPath, $Root))
+    }
 
     & $EnsureModule 'Pester' "Pester is not installed. Run Install-PoshQCTool (alias Install-PoshQCTools) first."
 
@@ -336,34 +347,20 @@ function Invoke-PoshQCTest {
     }
 
     if ($coverageEnabled -and $config.CodeCoverage) {
-        if ($config.CodeCoverage.Path.Value) {
-            $resolvedCoveragePaths = @(
-                $config.CodeCoverage.Path.Value |
-                    ForEach-Object {
-                        if ([IO.Path]::IsPathRooted($_)) { $_ } else { Join-Path $Root $_ }
-                    }
-            )
-
-            # Prune coverage paths that do not exist under the resolved root before Pester sees
-            # them. Pester's Resolve-CoverageInfo discards the whole set and raises a terminating
-            # error on the first unresolvable entry, which aborts the run at RunStart in any
-            # workspace that does not contain this repository's coverage layout (issue #409).
-            # Rooted entries are tested as-is; they are never re-joined to $Root.
-            $survivingCoveragePaths = @($resolvedCoveragePaths | Where-Object { & $TestPathExists $_ })
-            foreach ($prunedPath in @($resolvedCoveragePaths | Where-Object { $survivingCoveragePaths -notcontains $_ })) {
-                # Log every prune individually so coverage removal is never silent.
-                & $Logger "Pruned nonexistent code coverage path: $prunedPath"
-            }
-
-            if ($survivingCoveragePaths.Count -gt 0) {
-                $config.CodeCoverage.Path = $survivingCoveragePaths
-            } else {
-                # An enabled-but-empty path set makes Pester instrument every Run.Path directory,
-                # so disable coverage for this invocation instead and continue with the test run.
-                $config.CodeCoverage.Enabled = $false
-                $coverageEnabled = $false
-                & $Logger "Code coverage disabled for this invocation: no configured coverage path exists under root '$Root'."
-            }
+        # The coverage population is derived from the workspace, not from a list shipped with the
+        # module, so the measured set does not depend on which module copy was loaded (issue #527).
+        # Nonexistent caller-supplied entries are pruned and logged by the resolver (issue #409).
+        $population = & $ResolveCoveragePopulation $Root $settings $SettingsPath $effectiveScanFolders $ExcludeDirs $TestPathExists $Logger
+        $populationPaths = @($population.Paths | Where-Object { $_ })
+        & $Logger "Code coverage population: source=$($population.Source); files=$($populationPaths.Count)"
+        if ($populationPaths.Count -gt 0) {
+            $config.CodeCoverage.Path = $populationPaths
+        } else {
+            # An enabled-but-empty path set makes Pester instrument every Run.Path directory,
+            # so disable coverage for this invocation instead and continue with the test run.
+            $config.CodeCoverage.Enabled = $false
+            $coverageEnabled = $false
+            & $Logger "Code coverage disabled for this invocation: no configured coverage path exists under root '$Root'."
         }
 
         if ($config.CodeCoverage.OutputPath.Value) {

package/resources/powershell/PoshQC/PoshQC.psm1

@@ -113,6 +113,7 @@ if (-not $subModuleCache) {
 foreach ($subModuleName in @(
         'PoshQC.FileDiscovery.psm1',
         'PoshQC.ScanConfig.psm1',
+        'PoshQC.Coverage.psm1',
         'PoshQC.Analyzer.psm1',
         'PoshQC.Testing.psm1'
     )) {

package/resources/powershell/PoshQC/README.md

@@ -65,8 +65,14 @@ PoshQC is a lightweight PowerShell quality gate that wraps Invoke-Formatter, PSS
 - PSScriptAnalyzer settings: `./settings/pssa.settings.psd1`
    - Enforces compatible syntax for 5.1 and 7.6, 4-space indentation, ShouldProcess for state-changing functions, and safety guards (no Invoke-Expression, no global vars, etc.).
 - Pester settings: `./settings/pester.runsettings.psd1`
-  - Runs tests under `scripts` and `tests/powershell`, outputs JUnit XML and CoverageGutters coverage, and enables coverage over `scripts/dev-tools/*.ps1`, `scripts/powershell/**/*.psm1`, and `src/**/*.ps1`.
+  - Runs tests under `scripts` and `tests/powershell`, outputs JUnit XML and CoverageGutters coverage, and enables coverage. The shipped runsettings carry no `CodeCoverage.Path` list; `Invoke-PoshQCTest` derives the coverage population from the workspace (see Coverage population below).
   - When `-ScanFolders` is supplied to `Invoke-PoshQCSuite` or the lower-level commands, the suite narrows discovery to those workspace-relative or workspace-contained folders.
+- Coverage population (issue #527): `Invoke-PoshQCTest` measures the same file set for the same workspace whichever module copy is loaded.
+  - Workspace configuration: `config/poshqc-coverage.json` with the schema `{"version": 1, "roots": [...]}`. Each root is a workspace-relative folder. The file is validated fail-fast, and every error names `config/poshqc-coverage.json`: empty content, invalid JSON, a `version` other than 1, a missing or non-array `roots`, and a blank, absolute, or `..`-segment entry are rejected. An empty `roots` array yields an empty population.
+  - Precedence, reported as the source name: (1) `settings` - a caller-supplied settings file (`-SettingsPath` other than the module's own `settings/pester.runsettings.psd1`) with a non-empty `CodeCoverage.Path` is honored, and each entry that does not exist is pruned and logged; a `CodeCoverage.Path` list in the module's own settings file is ignored and the ignore is logged. (2) `config` - `config/poshqc-coverage.json` exists. (3) `fallback` - the effective test scan folders: explicit `-ScanFolders`, else `config/poshqc-scan.json`, else the settings `Run.Path`.
+  - Built-in exclusions: `.ps1` and `.psm1` files only; files named `*.Tests.ps1` are excluded, as are files whose first root-relative segment is `tests` and files under any root-relative directory named in `DefaultExcludedDirs` (for example `node_modules`, `artifacts`, `.venv`). A nonexistent root is skipped with a warning.
+  - An empty population disables coverage for that invocation, logs `Code coverage disabled for this invocation`, and still runs the tests.
+  - Each run logs `Code coverage population: source=<source>; files=<count>` before Pester starts.
 
 ## Typical workflow
 
@@ -77,4 +83,4 @@ PoshQC is a lightweight PowerShell quality gate that wraps Invoke-Formatter, PSS
 ## Notes for standalone use
 
 - Place `PoshQC.psm1`, `PoshQC.psd1`, and the `settings/` folder together; import the module from that directory.
-- Adjust `settings/pester.runsettings.psd1` and `settings/pssa.settings.psd1` to match your repo paths and policies.
+- Adjust `settings/pester.runsettings.psd1` and `settings/pssa.settings.psd1` to match your repo paths and policies. Declare coverage roots in `config/poshqc-coverage.json` at the workspace root rather than in the runsettings.