@danmoisan/drm-copilot-mcp 1.1.18 → 1.1.20

package/resources/claude-customizations/.claude/hooks/enforce-feature-folder-order.ps1

@@ -1,32 +1,59 @@
 <#
 .SYNOPSIS
-    Pre-tool-use hook that blocks writes to a feature folder's plan.md when issue.md,
-    spec.md, or user-story.md are not yet present in that same folder.
+    Pre-tool-use hook that blocks writes to a feature folder's plan file until the
+    prerequisite documents its persisted work mode requires exist in that same folder.
 
 .DESCRIPTION
     Invoked by the Claude Code PreToolUse hook on Write or Edit operations. Acquires
     the hook payload through the shared reader and reads file_path from the envelope's
-    nested tool_input. When the
-    target file_path matches a feature-folder plan.md path under
-    docs/features/(active|archive)/<folder>/plan.md, the script verifies that
-    each of issue.md, spec.md, and user-story.md exists in the same folder.
-
-    If any of the three sibling files is missing, the script emits a PreToolUse
-    JSON response with hookSpecificOutput.permissionDecision='deny' and exits 0 so
-    Claude Code surfaces the reason. All other paths pass through with
+    nested tool_input. The gate applies to a feature-folder plan file under
+    docs/features/(active|archive)/<folder>/: a literal plan.md or a timestamped
+    plan.<yyyy-MM-ddTHH-mm>.md (issue #568). Other paths pass through with
     permissionDecision='allow'.
 
-    Filesystem reads go through Get-FeatureFolderFileExistence so tests can
-    inject a fake without touching disk.
+    For a plan file, the script reads the folder's issue.md through
+    Get-FeatureFolderIssueContent, resolves the persisted '- Work Mode:' marker with the
+    shared Resolve-FeatureFolderWorkMode, and takes the required set from the shared
+    Get-FeatureFolderPlanPrerequisite:
+      - minor-audit                  -> issue.md
+      - full-bug                     -> issue.md, spec.md
+      - full-feature and legacy full -> issue.md, spec.md, user-story.md
+    A missing, empty, malformed, or unrecognized marker, or an unreadable issue.md,
+    fails closed to the full-feature set. Because issue.md is in every set, an absent
+    issue.md always denies.
+
+    If any required file is missing, the script emits a PreToolUse JSON response with
+    hookSpecificOutput.permissionDecision='deny' whose reason names the plan file, the
+    resolved work mode, and the missing files, and exits 0 so Claude Code surfaces it.
+
+    Filesystem reads go through Get-FeatureFolderFileExistence and
+    Get-FeatureFolderIssueContent so tests can inject fakes without touching disk.
 
 .NOTES
-    Compatible with PowerShell 7+. Read-only validation gate; no state mutation.
+    Compatible with PowerShell 7+. Read-only validation gate; no state mutation. The pure
+    sibling feature-folder-resolution.ps1 (issue #565) is dot-sourced inside a guard: when
+    it cannot be loaded, every plan-file write denies and every other path stays allowed.
 #>
 [CmdletBinding()]
 param()
+$script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot 'hook-dependency-guard.ps1') } catch { $script:HookDependencyGuardLoadFailed = $true }
+
+
+try { Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'HookPayload.psm1' -ErrorRecord $_ }
+
+# Shared work-mode parser and prerequisite map (issue #565). Guarded so a failed
+# dot-source denies plan writes rather than failing open.
+$script:FeatureFolderOrderResolutionImportFailure = $null
+try {
+    . (Join-Path $PSScriptRoot 'feature-folder-resolution.ps1')
+}
+catch {
+    $script:FeatureFolderOrderResolutionImportFailure = 'feature-folder-resolution.ps1'
+}
 
+# The plan leaf a gated path ends in: plan.md or plan.<yyyy-MM-ddTHH-mm>.md (issue #568).
+$script:FeaturePlanLeafPattern = '/plan(\.\d{4}-\d{2}-\d{2}T\d{2}-\d{2})?\.md$'
 
-Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
 function Get-FeatureFolderFileExistence {
     <#
     .SYNOPSIS
@@ -44,25 +71,57 @@ function Get-FeatureFolderFileExistence {
     return [bool](Test-Path -LiteralPath $Path -PathType Leaf)
 }
 
+function Get-FeatureFolderIssueContent {
+    <#
+    .SYNOPSIS
+        Reads a feature folder's issue.md, or returns $null when the file is absent or
+        cannot be read. Tests mock this seam; a $null result fails closed to the
+        full-feature prerequisite set.
+    .PARAMETER FeatureFolder
+        Normalized (forward-slash) feature-folder path.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $FeatureFolder
+    )
+
+    $issuePath = "$FeatureFolder/issue.md"
+    if (-not (Test-Path -LiteralPath $issuePath -PathType Leaf)) {
+        return $null
+    }
+
+    try {
+        return Get-Content -LiteralPath $issuePath -Raw -ErrorAction Stop
+    }
+    catch {
+        return $null
+    }
+}
+
 function Get-FeatureFolderMissingFile {
     <#
     .SYNOPSIS
-        Returns the list of required sibling files missing alongside plan.md.
+        Returns the list of required sibling files missing alongside the plan file.
     .PARAMETER PlanFilePath
-        Normalized (forward-slash) path to the plan.md target.
+        Normalized (forward-slash) path to the plan.md or plan.<timestamp>.md target.
+    .PARAMETER RequiredFile
+        The prerequisite file names to probe. Defaults to the full-feature set.
     #>
     [CmdletBinding()]
     [OutputType([string[]])]
     param(
         [Parameter(Mandatory)]
-        [string] $PlanFilePath
+        [string] $PlanFilePath,
+
+        [string[]] $RequiredFile = @('issue.md', 'spec.md', 'user-story.md')
     )
 
-    $folder = $PlanFilePath -replace '/plan\.md$', ''
-    $required = @('issue.md', 'spec.md', 'user-story.md')
+    $folder = $PlanFilePath -replace $script:FeaturePlanLeafPattern, ''
     [System.Collections.Generic.List[string]] $missing = [System.Collections.Generic.List[string]]::new()
 
-    foreach ($name in $required) {
+    foreach ($name in $RequiredFile) {
         $siblingPath = "$folder/$name"
         if (-not (Get-FeatureFolderFileExistence -Path $siblingPath)) {
             $missing.Add($name)
@@ -75,7 +134,9 @@ function Get-FeatureFolderMissingFile {
 function Test-IsFeaturePlanPath {
     <#
     .SYNOPSIS
-        Returns $true if the normalized path targets a feature-folder plan.md.
+        Returns $true if the normalized path targets a feature-folder plan.md or a
+        timestamped plan.<yyyy-MM-ddTHH-mm>.md directly inside an active or archive
+        feature folder.
     #>
     [CmdletBinding()]
     [OutputType([bool])]
@@ -84,7 +145,30 @@ function Test-IsFeaturePlanPath {
         [string] $NormalizedPath
     )
 
-    return $NormalizedPath -match '(^|/)docs/features/(active|archive)/[^/]+/plan\.md$'
+    return $NormalizedPath -match '(^|/)docs/features/(active|archive)/[^/]+/plan(\.\d{4}-\d{2}-\d{2}T\d{2}-\d{2})?\.md$'
+}
+
+function Get-FeatureFolderOrderDenyDecision {
+    <#
+    .SYNOPSIS
+        Builds the PreToolUse deny decision carrying the given reason.
+    .PARAMETER Reason
+        The deny reason, beginning with FEATURE_FOLDER_ORDER_BLOCKED:.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $Reason
+    )
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $Reason
+        }
+    }
 }
 
 function Invoke-FeatureFolderOrderDecision {
@@ -103,18 +187,15 @@ function Invoke-FeatureFolderOrderDecision {
         [AllowEmptyString()]
         [string] $ToolInputRaw
     )
+    $dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'FEATURE_FOLDER_ORDER_BLOCKED:'
+    if ($null -ne $dependencyDecision) { return $dependencyDecision }
 
     $payload = Resolve-ClaudeHookToolInput -Raw $ToolInputRaw
     if (-not $payload.IsValid) {
-        return [ordered]@{
-            hookSpecificOutput = [ordered]@{
-                hookEventName            = 'PreToolUse'
-                permissionDecision       = 'deny'
-                permissionDecisionReason = 'FEATURE_FOLDER_ORDER_BLOCKED: payload anomaly - ' +
-                (Get-ClaudeHookPayloadAnomalyReason -Anomaly $payload.Anomaly) +
-                '. The gate fails closed on an envelope it cannot read.'
-            }
-        }
+        return Get-FeatureFolderOrderDenyDecision -Reason (
+            'FEATURE_FOLDER_ORDER_BLOCKED: payload anomaly - ' +
+            (Get-ClaudeHookPayloadAnomalyReason -Anomaly $payload.Anomaly) +
+            '. The gate fails closed on an envelope it cannot read.')
     }
 
     $filePath = Get-ClaudeHookToolInputString -ToolInput $payload.Value -Name 'file_path'
@@ -128,19 +209,25 @@ function Invoke-FeatureFolderOrderDecision {
         return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
-    $missing = Get-FeatureFolderMissingFile -PlanFilePath $normalized
+    $planLeaf = ($normalized -split '/')[-1]
+    if ($script:FeatureFolderOrderResolutionImportFailure) {
+        return Get-FeatureFolderOrderDenyDecision -Reason (
+            "FEATURE_FOLDER_ORDER_BLOCKED: the shared resolver '$($script:FeatureFolderOrderResolutionImportFailure)' " +
+            "failed to load, so the prerequisite documents for $planLeaf cannot be determined; the gate fails closed.")
+    }
+
+    $folder = $normalized -replace $script:FeaturePlanLeafPattern, ''
+    $workMode = Resolve-FeatureFolderWorkMode -IssueContent (Get-FeatureFolderIssueContent -FeatureFolder $folder)
+    $required = @(Get-FeatureFolderPlanPrerequisite -WorkMode $workMode)
+    $missing = @(Get-FeatureFolderMissingFile -PlanFilePath $normalized -RequiredFile $required)
     if ($missing.Count -eq 0) {
         return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     $list = ($missing -join ', ')
-    return [ordered]@{
-        hookSpecificOutput = [ordered]@{
-            hookEventName            = 'PreToolUse'
-            permissionDecision       = 'deny'
-            permissionDecisionReason = "FEATURE_FOLDER_ORDER_BLOCKED: cannot write plan.md before producing prerequisite documents. Missing in feature folder: $list. Invoke the prd-feature subagent to generate the missing file(s) before authoring plan.md."
-        }
-    }
+    return Get-FeatureFolderOrderDenyDecision -Reason (
+        "FEATURE_FOLDER_ORDER_BLOCKED: cannot write $planLeaf before producing prerequisite documents for work mode '$workMode'. " +
+        "Missing in feature folder: $list. Invoke the prd-feature subagent to generate the missing file(s) before authoring the plan.")
 }
 
 function Invoke-FeatureFolderOrderEntryPoint {
@@ -185,6 +272,9 @@ function Invoke-FeatureFolderOrderEntryPoint {
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
+if ($script:HookDependencyGuardLoadFailed) { [Console]::Error.WriteLine('FEATURE_FOLDER_ORDER_BLOCKED: hook-dependency-guard.ps1 failed to load; the gate fails closed.'); exit 2 }
+$dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'FEATURE_FOLDER_ORDER_BLOCKED:'
+if ($null -ne $dependencyDecision) { $dependencyDecision | ConvertTo-Json -Compress -Depth 5 | Write-Output; exit 0 }
 
 # The entry point returns its [int] exit code as the last pipeline element and the
 # decision JSON before it. `exit (<call>)` would capture BOTH into the exit

package/resources/claude-customizations/.claude/hooks/enforce-mermaid-validation.ps1

@@ -56,10 +56,11 @@
 #>
 [CmdletBinding()]
 param()
+$script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot 'hook-dependency-guard.ps1') } catch { $script:HookDependencyGuardLoadFailed = $true }
 
 Set-StrictMode -Version Latest
 
-Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
+try { Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'HookPayload.psm1' -ErrorRecord $_ }
 
 $script:MermaidModulePath = Join-Path -Path $PSScriptRoot -ChildPath '../lib/mermaid/MermaidValidation.psm1'
 $script:MermaidSkillPointer = 'See .claude/skills/mermaid-diagram/SKILL.md.'
@@ -303,6 +304,8 @@ function Invoke-MermaidValidationDecision {
         [AllowNull()]
         [string] $ToolInputRaw
     )
+    $dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'MERMAID_VALIDATION_BLOCKED:'
+    if ($null -ne $dependencyDecision) { return $dependencyDecision }
 
     # Envelope-level anomaly: fail closed. See the ENVELOPE VERSUS CONTENT note in
     # this file's header before changing this back to a silent allow.
@@ -394,6 +397,9 @@ function Invoke-MermaidValidationEntryPoint {
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
+if ($script:HookDependencyGuardLoadFailed) { [Console]::Error.WriteLine('MERMAID_VALIDATION_BLOCKED: hook-dependency-guard.ps1 failed to load; the gate fails closed.'); exit 2 }
+$dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'MERMAID_VALIDATION_BLOCKED:'
+if ($null -ne $dependencyDecision) { $dependencyDecision | ConvertTo-Json -Compress -Depth 5 | Write-Output; exit 0 }
 
 Invoke-MermaidValidationEntryPoint -ToolInputRaw (Read-ClaudeHookRawPayload)
 

package/resources/claude-customizations/.claude/hooks/enforce-model-routing-receipt.ps1

@@ -45,14 +45,15 @@
 #>
 [CmdletBinding()]
 param()
+$script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot 'hook-dependency-guard.ps1') } catch { $script:HookDependencyGuardLoadFailed = $true }
 
 
-Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
+try { Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'HookPayload.psm1' -ErrorRecord $_ }
 # Portable-identity resolution (issue #673). Unguarded and fail-closed on purpose: a gate
 # that cannot load its resolver must not degrade into the cwd-relative read it replaces.
-Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/WorktreeItemResolution.psm1') -Force -ErrorAction Stop
+try { Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/WorktreeItemResolution.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'WorktreeItemResolution.psm1' -ErrorRecord $_ }
 # Epic scope (issue #663): a delegation for the epic integration branch is gated against the epic checkpoint.
-Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/EpicScopeResolution.psm1') -Force -ErrorAction Stop
+try { Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/EpicScopeResolution.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'EpicScopeResolution.psm1' -ErrorRecord $_ }
 function Get-ModelRoutingCheckpoint {
     <#
     .SYNOPSIS
@@ -207,6 +208,8 @@ function Invoke-ModelRoutingReceiptDecision {
     param(
         [string] $ToolInputRaw
     )
+    $dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'MODEL_ROUTING_RECEIPT_BLOCKED:'
+    if ($null -ne $dependencyDecision) { return $dependencyDecision }
 
     $allow = [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
 
@@ -287,6 +290,9 @@ function Invoke-ModelRoutingReceiptDecision {
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
+if ($script:HookDependencyGuardLoadFailed) { [Console]::Error.WriteLine('MODEL_ROUTING_RECEIPT_BLOCKED: hook-dependency-guard.ps1 failed to load; the gate fails closed.'); exit 2 }
+$dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'MODEL_ROUTING_RECEIPT_BLOCKED:'
+if ($null -ne $dependencyDecision) { $dependencyDecision | ConvertTo-Json -Compress -Depth 5 | Write-Output; exit 0 }
 
 $decision = Invoke-ModelRoutingReceiptDecision -ToolInputRaw (Read-ClaudeHookRawPayload)
 

package/resources/claude-customizations/.claude/hooks/enforce-orchestration-preimplementation-gate-epic-scope.ps1

@@ -6,9 +6,9 @@
     Dot-sourced by enforce-orchestration-preimplementation-gate.ps1. Holds four groups of
     functions:
 
-    - The import guard for the worktree-resolution modules (issue #690). A failed import
-      is recorded in $script:OrchestrationGateResolutionImportFailure, and
-      Get-OrchestrationGateImportFailureDecision turns that record into a deny, so a
+    - The import guards for the worktree-resolution modules (issue #690). A failed import
+      is recorded in $script:HookDependencyFailures, and the gate's call to
+      Get-HookDependencyFailureDecision turns that record into a deny, so a
       missing module cannot make the gate exit non-zero and fail open.
     - The three checkpoint read seams, Get-CheckpointContent, Get-EpicCheckpointContent,
       and Get-ParallelCheckpointContent. Each takes a mandatory absolute path, so no
@@ -31,44 +31,22 @@
 .NOTES
     PowerShell 7+. Depends on functions the gate defines or dot-sources before any call:
     Split-OrchestrationCommandLine and ConvertTo-OrchestrationCommandToken (helpers file),
-    Get-OrchestrationDelegationCheckpointPath (modes file), and the gate's allow and block
-    decision constructors. Imports WorktreeItemResolution.psm1 and WorktreeRunResolution.psm1
-    before EpicScopeResolution.psm1, so the nested import inside EpicScopeResolution reuses
-    the same module instance. Mirrored byte-identically under
+    Get-OrchestrationDelegationCheckpointPath (modes file), the gate's allow and block
+    decision constructors, and, through the targets file this file dot-sources (issue #738),
+    Read-CommandLineSegment, Get-CommandLineGlobalOption, and Get-CommandLineInvocation
+    (loaded by the gate's dot-source of hook-command-invocation.ps1). Imports
+    WorktreeItemResolution.psm1 and WorktreeRunResolution.psm1 before
+    EpicScopeResolution.psm1, so the nested import inside EpicScopeResolution reuses the
+    same module instance. Mirrored byte-identically under
     extensions/drm-copilot/resources/claude-customizations/.
 #>
 
-# Import guard (issue #690). Each worktree-resolution import is attempted in order; the
-# first failure is recorded by file name and the decision function denies on it.
-$script:OrchestrationGateResolutionImportFailure = $null
-foreach ($resolutionModule in @('WorktreeItemResolution.psm1', 'WorktreeRunResolution.psm1', 'EpicScopeResolution.psm1')) {
-    try {
-        Import-Module (Join-Path $PSScriptRoot "../lib/worktree-resolution/$resolutionModule") -Force -ErrorAction Stop
-    }
-    catch {
-        if (-not $script:OrchestrationGateResolutionImportFailure) { $script:OrchestrationGateResolutionImportFailure = $resolutionModule }
-    }
-}
-Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/EpicScopeReadiness.psm1') -Force -ErrorAction Stop
-
-function Get-OrchestrationGateImportFailureDecision {
-    <#
-    .SYNOPSIS
-        Returns the deny for a failed worktree-resolution import, or $null.
-    .OUTPUTS
-        System.Collections.Specialized.OrderedDictionary, or $null when every import succeeded.
-    #>
-    [CmdletBinding()]
-    [OutputType([System.Collections.Specialized.OrderedDictionary])]
-    param()
-
-    if (-not $script:OrchestrationGateResolutionImportFailure) {
-        return $null
-    }
-    return Get-OrchestrationPreimplementationGateBlockDecision -Reason (
-        "PREIMPLEMENTATION_GATE_BLOCKED: the worktree-resolution module '$($script:OrchestrationGateResolutionImportFailure)' " +
-        'failed to import, so the checkpoint that governs this call cannot be located; the gate fails closed.')
-}
+try { Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/WorktreeItemResolution.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'WorktreeItemResolution.psm1' -ErrorRecord $_ }
+try { Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/WorktreeRunResolution.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'WorktreeRunResolution.psm1' -ErrorRecord $_ }
+try { Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/EpicScopeResolution.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'EpicScopeResolution.psm1' -ErrorRecord $_ }
+try { Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/EpicScopeReadiness.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'EpicScopeReadiness.psm1' -ErrorRecord $_ }
+# Per-segment target resolution for the epic-scope decision (issue #738).
+. (Join-Path $PSScriptRoot 'enforce-orchestration-preimplementation-gate-targets.ps1')
 
 # The three checkpoint read seams. Each takes the absolute path composed beneath a
 # resolved worktree root; an absent file returns an empty string, which the readiness
@@ -242,11 +220,13 @@ function Get-OrchestrationEpicScopeDecision {
     .SYNOPSIS
         Returns the epic-scope decision for an implementation-classified command or path, or $null.
     .DESCRIPTION
-        Resolves epic scope with worktree-HEAD matching and the command's -C selector. When
-        the call is not epic scope, returns $null so the caller's single-feature path runs
-        unchanged. In epic scope, returns an allow decision when the epic command-leg
-        readiness predicate passes, and otherwise a deny naming the epic checkpoint and the
-        failed conjunct.
+        Resolves the target of every command segment and path (issue #738) with
+        Get-OrchestrationCommandTarget, then the epic scope of the session root and of each
+        target with worktree-HEAD matching. When neither is epic scope, returns $null so the
+        caller's single-feature path runs unchanged. In epic scope, denies an unresolvable,
+        ambiguous, or out-of-scope target, and otherwise evaluates the epic command-leg
+        readiness predicate against every target: the first failure denies (the session-root
+        wording is unchanged), and no failure allows.
     .PARAMETER Command
         The Bash command line; empty for a path leg.
     .PARAMETER FilePath
@@ -265,15 +245,23 @@ function Get-OrchestrationEpicScopeDecision {
     if (-not $Command -and -not $FilePath) {
         return $null
     }
-    $selector = if ($Command) { Get-OrchestrationEpicScopeSelector -Command $Command } else { $null }
-    $scope = Resolve-EpicScopeCheckpoint -Text ([string]$Command) -SessionRoot (Get-Location).Path -WorktreeSelector $selector -MatchWorktreeHead
-    if (-not $scope.IsEpicScope) {
+    $epicScopeSessionRoot = (Get-Location).Path
+    $epicScopeText = [string]$Command
+    $targetResult = Get-OrchestrationCommandTarget -Command $epicScopeText -FilePath @($FilePath) -SessionRoot $epicScopeSessionRoot
+    $scopeResolver = {
+        param([string] $Selector)
+        Resolve-EpicScopeCheckpoint -Text $epicScopeText -SessionRoot $epicScopeSessionRoot -WorktreeSelector $Selector -MatchWorktreeHead
+    }
+    $verdict = Resolve-OrchestrationEpicTargetVerdict -SessionRoot $epicScopeSessionRoot -TargetResult $targetResult -ScopeResolver $scopeResolver
+    $outcome = Resolve-OrchestrationEpicTargetOutcome -Verdict $verdict -ReadinessFailure {
+        param($Scope)
+        Get-EpicCommandLegReadinessFailure -Checkpoint $Scope.Checkpoint -MergeInProgress $Scope.MergeInProgress
+    }
+    if ($outcome.Outcome -eq 'none') {
         return $null
     }
-
-    $failure = Get-EpicCommandLegReadinessFailure -Checkpoint $scope.Checkpoint -MergeInProgress $scope.MergeInProgress
-    if (-not $failure) {
-        return Get-OrchestrationPreimplementationGateAllowDecision
+    if ($outcome.Outcome -eq 'deny') {
+        return Get-OrchestrationPreimplementationGateBlockDecision -Reason $outcome.Reason
     }
-    return Get-OrchestrationPreimplementationGateBlockDecision -Reason ("PREIMPLEMENTATION_GATE_BLOCKED: this epic-scope operation was evaluated against $($scope.CheckpointPath), and the failed readiness predicate is '$failure'. Implementation operations in epic scope require that checkpoint to satisfy every readiness predicate, and a production path may be staged or edited only while a merge is in progress.")
+    return Get-OrchestrationPreimplementationGateAllowDecision
 }

package/resources/claude-customizations/.claude/hooks/enforce-orchestration-preimplementation-gate-helpers.ps1

@@ -9,6 +9,11 @@
     tree? Every parse ambiguity answers false, so the caller's pre-change deny is the
     fallback for every unmodeled form.
 
+    Shell-agnostic parsing (issue #735): the shell that executes a hooked command is
+    undetermined per command, so every shape whose meaning differs between a POSIX shell
+    and PowerShell denies - a backslash anywhere, and { } , ( ) @ outside quotes. Evidence:
+    research/research.2026-10-08T14-00.md (Q1) in the issue #732 feature folder.
+
     The normative contract is the D4 fail-closed rule table in
     docs/features/active/2026-08-24-preimplementation-gate-blocks-planner-integration-commits-539/spec.md.
     Rule-table row numbers are cited inline against the code that realizes them.
@@ -28,15 +33,15 @@ $script:OrchestrationBookkeepingTrees = @(
 )
 
 # Characters that make a command line statically unresolvable (D4 row 12, as narrowed by
-# issues #663 and #713): interpolation characters outside single quotes; outside-quote
-# characters (`<`, `>`, and the `#` comment introducer) outside any quote; and typographic
-# quotes (U+2018 to U+201E) anywhere, because a PowerShell host reads them as quotes.
+# issues #663, #713, #732, and #735): interpolation characters outside single quotes;
+# outside-quote characters (`<`, `>`, the `#` comment introducer, and the shell-divergent
+# `{ } , ( ) @`) outside any quote; and typographic quotes (U+2018 to U+201E) anywhere.
 $script:InterpolationCommandCharacters = [char[]]@('$', '`')
-$script:OutsideQuoteCommandCharacters = [char[]]@('>', '<', '#')
+$script:OutsideQuoteCommandCharacters = [char[]]@('>', '<', '#', '{', '}', ',', '(', ')', '@')
 $script:TypographicQuoteCharacters = [char[]]@(0x2018, 0x2019, 0x201A, 0x201B, 0x201C, 0x201D, 0x201E)
 
-# Wildcards that make an operand a glob (D4 row 15). Only the literal prefix before the
-# first of these is prefix-tested.
+# Wildcards a selector value may not carry (LACS L6). An operand carrying one fails the
+# operand allowlist (issue #732).
 $script:PathspecWildcardCharacters = [char[]]@('*', '?', '[')
 
 # The single repository selector modelled between the command name and the subcommand: D4
@@ -112,12 +117,12 @@ function Test-OrchestrationCommandTextUnresolvable {
     .SYNOPSIS
         Reports whether a command line carries a statically unresolvable character.
     .DESCRIPTION
-        Realizes D4 row 12 as narrowed by issues #663 and #713, with quote state tracked as in
-        Split-OrchestrationCommandLine. `$` or backtick answers true outside quotes or inside
-        double quotes (single quotes keep it literal); `<`, `>`, or a `#` comment answers true
-        only outside a quoted span. A typographic quote (U+2018 to U+201E), a backslash before
-        any quote character, or a backslash inside a double-quoted span answers true anywhere:
-        a shell may end the span where this scan does not (fail closed).
+        Realizes D4 row 12 as narrowed by issues #663, #713, #732, and #735, with quote state
+        tracked as in Split-OrchestrationCommandLine. `$` or backtick answers true outside
+        quotes or inside double quotes (single quotes keep it literal); `<`, `>`, `#`, and
+        `{ } , ( ) @` answer true only outside a quoted span. A typographic quote (U+2018 to
+        U+201E) or a backslash answers true anywhere, because POSIX shells and PowerShell read
+        them differently and the executing shell is undetermined (fail closed).
     .PARAMETER CommandText
         The full command line as the shell would receive it.
     .OUTPUTS
@@ -127,8 +132,8 @@ function Test-OrchestrationCommandTextUnresolvable {
     [OutputType([bool])]
     param([Parameter(Mandatory)][AllowEmptyString()][string] $CommandText)
 
-    # An escaped or typographic quote moves a span boundary the scan cannot model (#663, #713).
-    if ($CommandText.Contains('\"') -or $CommandText.Contains("\'") -or $CommandText.IndexOfAny($script:TypographicQuoteCharacters) -ge 0) {
+    # A backslash or typographic quote is read differently by POSIX shells and PowerShell (#735).
+    if ($CommandText.Contains('\') -or $CommandText.IndexOfAny($script:TypographicQuoteCharacters) -ge 0) {
         return $true
     }
 
@@ -141,13 +146,9 @@ function Test-OrchestrationCommandTextUnresolvable {
             return $true
         }
 
-        # Decide by quote state: inside a span only the closing quote matters, and any
-        # backslash inside a double-quoted span is an unmodelled escape; outside a span a
-        # quote opens one and a redirection character is unresolvable.
+        # Decide by quote state: inside a span only the closing quote matters; outside a
+        # span a quote opens one and an outside-quote character is unresolvable.
         if ($openQuote -ne [char]0) {
-            if ($openQuote -eq '"' -and $character -eq '\') {
-                return $true
-            }
             if ($character -eq $openQuote) {
                 $openQuote = [char]0
             }
@@ -222,9 +223,10 @@ function Test-ExemptOrchestrationOperand {
     .SYNOPSIS
         Tests one pathspec operand against the five exempt orchestration trees.
     .DESCRIPTION
-        Realizes D4 rows 3, 9, 15, 16, 17, and 18. Backslashes normalize to forward slashes
-        before the prefix test (row 18); pathspec magic, absolute spellings, parent-directory
-        segments, and globs whose literal prefix escapes the exempt set all deny.
+        Realizes D4 rows 3, 9, 15, 16, and 17 as narrowed by issues #732 and #735. An operand
+        is exempt only when it matches the plain ASCII allowlist A-Z a-z 0-9 . _ / - (which
+        excludes pathspec magic, drive letters, backslashes, globs, braces, and non-ASCII
+        look-alikes), is not rooted, carries no '..' segment, and starts with an exempt tree.
     .OUTPUTS
         System.Boolean
     #>
@@ -232,43 +234,14 @@ function Test-ExemptOrchestrationOperand {
     [OutputType([bool])]
     param([Parameter(Mandatory)][AllowEmptyString()][string] $Operand)
 
-    if (-not $Operand) {
-        return $false
-    }
-
-    # Row 3b and row 9: any leading colon is pathspec magic, which can escape or invert the
-    # tree scope, so no colon-led operand is ever resolvable by a prefix test.
-    if ($Operand.StartsWith(':')) {
+    if ($Operand -cnotmatch '^[A-Za-z0-9._/-]+$' -or $Operand.StartsWith('/')) {
         return $false
     }
-
-    # Row 18: separator normalization precedes every prefix comparison below.
-    $normalized = $Operand -replace '\\', '/'
-
-    # Row 16: rooted, drive-lettered, and UNC spellings all deny; the exempt prefixes stay
-    # repo-relative (this is the posture issue #516 later composes with).
-    if ($normalized.StartsWith('/')) {
+    if (($Operand -split '/') -contains '..') {
         return $false
     }
-    if ($normalized -match '^[A-Za-z]:') {
-        return $false
-    }
-
-    # Rows 15c and 17: any parent-directory component escapes the prefix.
-    if (($normalized -split '/') -contains '..') {
-        return $false
-    }
-
-    # Row 15: only the literal prefix before the first wildcard is prefix-tested, so a glob
-    # whose wildcard occupies or truncates an ancestor segment cannot pass.
-    $literalPrefix = $normalized
-    $wildcardIndex = $normalized.IndexOfAny($script:PathspecWildcardCharacters)
-    if ($wildcardIndex -ge 0) {
-        $literalPrefix = $normalized.Substring(0, $wildcardIndex)
-    }
-
     foreach ($tree in $script:OrchestrationBookkeepingTrees) {
-        if ($literalPrefix.StartsWith($tree)) {
+        if ($Operand.StartsWith($tree)) {
             return $true
         }
     }
@@ -444,7 +417,7 @@ function Test-ExemptOrchestrationStagingCommand {
         command line splits cleanly into segments and EVERY segment parses as a complete,
         recognized staging or integration invocation carrying at least one pathspec operand,
         with every operand resolving inside one of the five exempt orchestration-bookkeeping
-        trees after balanced-quote stripping and separator normalization.
+        trees after balanced-quote stripping.
 
         The all-segments reading is deliberate and fail-closed: a chained line denies unless
         each of its segments is independently a recognized all-exempt invocation, so a
@@ -464,8 +437,8 @@ function Test-ExemptOrchestrationStagingCommand {
         return $false
     }
 
-    # Row 12: `$` or backtick outside single quotes, `<`, `>`, or `#` outside quotes, any
-    # typographic quote, and unmodelled backslash escapes make the operand list untrustworthy.
+    # Row 12: `$` or backtick outside single quotes, `< > # { } , ( ) @` outside quotes, and
+    # any typographic quote or backslash make the operand list untrustworthy (#732, #735).
     if (Test-OrchestrationCommandTextUnresolvable -CommandText $CommandText) {
         return $false
     }