@danmoisan/drm-copilot-mcp 1.1.2 → 1.1.4

package/out/mcp-server.js

@@ -17261,6 +17261,7 @@ function toMcpToolResult(result) {
     ...result.bundledSourcePath === void 0 ? {} : { bundled_source_path: result.bundledSourcePath },
     ...result.destinationPath === void 0 ? {} : { destination_path: result.destinationPath },
     ...result.renderedTree === void 0 ? {} : { rendered_tree: result.renderedTree },
+    ...result.targetRepository === void 0 ? {} : { target_repository: result.targetRepository },
     ...result.warnings === void 0 ? {} : { warnings: result.warnings }
   };
 }
@@ -31723,12 +31724,17 @@ function splitCombinedOutput(combined) {
 var RealGhClient = class {
   ghPath;
   runner;
+  repo;
   /**
    * Construct a client, resolving and validating the `gh` executable.
    *
    * @param options Optional injected `runner` (defaults to
-   *   {@link SpawnSyncGhCommandRunner}) and `ghPathLookup` (defaults to
-   *   {@link defaultGhPathLookup}) so tests never touch the real PATH.
+   *   {@link SpawnSyncGhCommandRunner}), `ghPathLookup` (defaults to
+   *   {@link defaultGhPathLookup}) so tests never touch the real PATH, and
+   *   `repo` — an explicit `owner/name` target repository. When `repo` is
+   *   supplied, every repository-scoped invocation names it explicitly so the
+   *   process working directory cannot influence repository selection; when it
+   *   is omitted the argument vectors are unchanged.
    * @throws Error With {@link GH_NOT_FOUND_MESSAGE} when `gh` cannot be resolved.
    */
   constructor(options) {
@@ -31739,6 +31745,16 @@ var RealGhClient = class {
     }
     this.ghPath = resolved;
     this.runner = options?.runner ?? new SpawnSyncGhCommandRunner();
+    this.repo = options?.repo;
+  }
+  /**
+   * Repository selector fragment spliced after the subcommand words.
+   *
+   * @returns `["--repo", "<owner/name>"]` when bound, otherwise an empty vector
+   *   so an unbound client keeps its pre-change argument vectors exactly.
+   */
+  repoSelector() {
+    return this.repo === void 0 ? [] : ["--repo", this.repo];
   }
   /**
    * Run a `gh` invocation and build a {@link GhResult} from combined output.
@@ -31771,6 +31787,7 @@ var RealGhClient = class {
     const args = [
       "issue",
       "create",
+      ...this.repoSelector(),
       "--title",
       title,
       "--body-file",
@@ -31790,6 +31807,7 @@ var RealGhClient = class {
     const args = [
       "label",
       "create",
+      ...this.repoSelector(),
       label,
       "--color",
       FEATURE_LABEL_COLOR,
@@ -31808,6 +31826,7 @@ var RealGhClient = class {
     const args = [
       "issue",
       "view",
+      ...this.repoSelector(),
       issueNumber,
       "--json",
       "number,title,url,author,updatedAt"
@@ -32241,6 +32260,78 @@ function promotePotential(options) {
   return { exitCode: 0, messages, destination: destPath };
 }
 
+// ../../extensions/drm-copilot/src/lib/potential-to-issue/repo-slug.ts
+var REPO_SLUG_UNRESOLVED_PREFIX = "Unable to resolve the target repository from workspace root";
+var REPO_VIEW_ARGS = [
+  "repo",
+  "view",
+  "--json",
+  "nameWithOwner"
+];
+var NAME_WITH_OWNER_FIELD = "nameWithOwner";
+function defaultGhProgramName() {
+  return "gh";
+}
+function unresolved(workspaceRoot, reason) {
+  return new Error(
+    `${REPO_SLUG_UNRESOLVED_PREFIX} ${workspaceRoot}: ${reason}`
+  );
+}
+function extractSlug(stdout, workspaceRoot) {
+  let payload;
+  try {
+    payload = JSON.parse(stdout);
+  } catch (error2) {
+    throw unresolved(
+      workspaceRoot,
+      `the resolution command produced unparseable output (${String(error2)})`
+    );
+  }
+  if (typeof payload !== "object" || payload === null) {
+    throw unresolved(
+      workspaceRoot,
+      "the resolution output is parseable but is not an object"
+    );
+  }
+  if (!(NAME_WITH_OWNER_FIELD in payload)) {
+    throw unresolved(
+      workspaceRoot,
+      `the resolution output carries no ${NAME_WITH_OWNER_FIELD} field`
+    );
+  }
+  const slug = payload[NAME_WITH_OWNER_FIELD];
+  if (typeof slug !== "string") {
+    throw unresolved(
+      workspaceRoot,
+      `the ${NAME_WITH_OWNER_FIELD} field is not a string`
+    );
+  }
+  return slug;
+}
+function resolveRepoSlug(input) {
+  const { runner, workspaceRoot } = input;
+  const ghPath = (input.ghPathLookup ?? defaultGhProgramName)();
+  const result = runner.run([ghPath, ...REPO_VIEW_ARGS], {
+    cwd: workspaceRoot,
+    allowError: true
+  });
+  if (result.code !== 0) {
+    const detail = result.stderr.trim();
+    throw unresolved(
+      workspaceRoot,
+      `the resolution command exited ${String(result.code)}${detail === "" ? "" : `: ${detail}`}`
+    );
+  }
+  const stdout = result.stdout.trim();
+  if (stdout === "") {
+    throw unresolved(
+      workspaceRoot,
+      "the resolution command produced empty output"
+    );
+  }
+  return extractSlug(stdout, workspaceRoot);
+}
+
 // ../../extensions/drm-copilot/src/lib/potential-to-issue/potential-to-issue-service-call.ts
 var CommandRunnerGhAdapter = class {
   constructor(runner) {
@@ -32265,7 +32356,12 @@ var CommandRunnerGhAdapter = class {
   }
 };
 function potentialToIssueServiceCall(input) {
-  const ghClient = input.gh ?? new RealGhClient({ runner: new CommandRunnerGhAdapter(input.runner) });
+  const resolveSlug = input.repoSlugResolver ?? ((workspaceRoot) => resolveRepoSlug({ runner: input.runner, workspaceRoot }));
+  const targetRepository = resolveSlug(input.workspaceRoot);
+  const ghClient = input.gh ?? new RealGhClient({
+    runner: new CommandRunnerGhAdapter(input.runner),
+    repo: targetRepository
+  });
   const fileSystem = input.fileSystem ?? new RealPotentialFileSystem();
   const outcome = promotePotential({
     potentialPath: input.potentialPath,
@@ -32292,6 +32388,7 @@ ${outcome.messages.join("\n")}` : "";
     tool: "potential_to_issue",
     workspaceRoot: input.workspaceRoot,
     summary,
+    targetRepository,
     ...outcome.destination === void 0 ? {} : { destinationPath: normalizeGeneratedPath(outcome.destination) },
     ...issueUrl === null ? {} : { artifacts: [issueUrl] }
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danmoisan/drm-copilot-mcp",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "Stdio MCP server exposing drm-copilot repo-automation tools.",
   "license": "MIT",
   "type": "commonjs",

package/resources/claude-customizations/.claude/agents/epic-orchestrator.md

@@ -19,10 +19,7 @@ tools:
 skills:
   - policy-compliance-order
   - epic-orchestrate
-  - feature-promotion-lifecycle
-  - atomic-plan-contract
   - acceptance-criteria-tracking
-  - evidence-and-timestamp-conventions
 memory: project
 hooks:
   SubagentStop:
@@ -54,15 +51,13 @@ maintenance. This agent frames the *who* and *when*; the skill documents the *ho
 
 On every invocation:
 
-1. Read `CLAUDE.md` for repository tone policy and architecture context.
-2. Read applicable `.claude/rules/` files for languages in scope.
-3. Read `artifacts/orchestration/epic-orchestrator-state.json` to check for existing epic
+1. Read `artifacts/orchestration/epic-orchestrator-state.json` to check for existing epic
    checkpoint state.
-4. If a valid epic checkpoint exists with a matching `epic_feature_folder`, resume from the
+2. If a valid epic checkpoint exists with a matching `epic_feature_folder`, resume from the
    recorded `next_step` (re-deriving durable ground truth via `git worktree list --porcelain`,
    `git branch`, and `gh pr view --json state,mergedAt,headRefOid` per the `epic-orchestrate`
    skill's resume procedure, not from in-memory notifications alone).
-5. If no checkpoint exists or the objective is new, begin from manifest parsing
+3. If no checkpoint exists or the objective is new, begin from manifest parsing
    (`docs/features/epics/<epic-slug>/epic.md`).
 
 ## Invocation Origin
@@ -104,7 +99,8 @@ You delegate exclusively through two channels:
 
 - `Agent(orchestrator)` — one delegation per child feature in the manifest, carrying the epic-mode
   kickoff line and, for dependent features, the upstream-context citation lines (both defined in
-  `spec.md` §4 and §10 of this feature and restated procedurally in the `epic-orchestrate` skill).
+  `.claude/skills/epic-orchestrate/SKILL.md` under `## Merge-on-Green Kickoff Parameter` and
+  `## Context Handoff to Dependent Features`).
   Each child `orchestrator` runs its own full small/large route (including its own delegation to
   `atomic-planner`, `atomic-executor`, `feature-review`, and, on CI-green in epic mode, the
   merge-on-green S9 step 6 extension) inside its own isolated worktree
@@ -133,7 +129,9 @@ at your own `SubagentStop` time.
 ## Checkpoint Persistence
 
 Update `artifacts/orchestration/epic-orchestrator-state.json` after every completed step, per the
-full schema defined in `spec.md` §6: `objective`, `route_id: "epic"`, `epic_feature_folder`,
+full schema enforced by `validate_epic_orchestrator_state_text`, implemented in
+`scripts/dev_tools/validate_epic_orchestrator_state.py`: `objective`, `route_id: "epic"`,
+`epic_feature_folder`,
 `epic_manifest_path`, `epic_status_doc_path`, `integration_branch`, `completed_steps`, `next_step`,
 `last_updated`, `current_wave`, `waves[]`, `features[]` (including `merge_status` and the four
 lifecycle timestamps), `epic_merge_pr`, and the three receipt arrays

package/resources/claude-customizations/.claude/hooks/enforce-prd-feature-before-planner.ps1

@@ -14,13 +14,31 @@
     Feature folder resolution order:
       1. Scan the prompt text for any path matching
          docs/features/active/<token>, accepting both forward-slash and
-         backslash separators. The longest match wins; when it points at a
-         file (ends with .md), use its parent directory.
-      2. If no candidate was found in the prompt, read the feature-folder field
+         backslash separators. Truncate every match to two segments past the
+         docs/features/active/ prefix -- that is, to exactly four path segments:
+         docs, features, active, and the feature-folder name. Truncation is
+         depth-insensitive, so the feature folder itself, a spec.md path, a
+         research/ artifact path, and an evidence/ artifact path all resolve to
+         the same folder. A match that truncates to fewer than four segments is
+         rejected. Candidates are deduplicated preserving first-occurrence
+         order.
+      2. Select among the distinct candidates: one candidate is used directly;
+         otherwise the candidate equal to the checkpoint's feature-folder field
+         is preferred, because the checkpoint is the orchestrator's own record of
+         which feature is in flight; otherwise the earliest-occurring candidate
+         in the prompt wins, because the orchestrator names the active feature
+         folder before citing artifacts inside it.
+      3. If no candidate was found in the prompt, read the feature-folder field
          from artifacts/orchestration/orchestrator-state.json.
-      3. If neither yields a folder, block with a reason instructing the caller
+      4. If neither yields a folder, block with a reason instructing the caller
          to reference a feature folder explicitly.
 
+    Known limitation: resolution stops at the feature-folder segment, so it does
+    not descend into a version folder (v1/, v2/). No versioned folder exists
+    under docs/features/active/ today, and issue.md sits at the feature root in
+    every case, so the limitation is inert; it is recorded here rather than coded
+    around.
+
     Once the folder is resolved, the hook reads the persisted work-mode marker
     (`- Work Mode: minor-audit|full-feature|full-bug|full`) from that folder's
     issue.md, per the mode contract in
@@ -30,11 +48,16 @@
       - full-bug     -> spec.md only is required.
       - minor-audit  -> neither is required; issue.md carries the acceptance
                         criteria for this mode.
-      - marker absent, unreadable, or unrecognized -> fail closed to the
-        strictest set (spec.md and user-story.md), and the block reason states
-        that the work mode could not be determined so the operator can tell
-        this case apart from a genuine missing prerequisite. The legacy `full`
-        marker normalizes to full-feature's requirement set.
+      - marker absent, unreadable, or unrecognized -> deny on a distinct
+        decision path that names the resolved folder and the issue.md path it
+        probed and states adding or correcting the marker as the remedy. That
+        path does not run the required-file probe and names neither prerequisite
+        document, because when the mode is unknown no prerequisite set is
+        knowable: a set containing user-story.md cannot be satisfied by full-bug
+        or minor-audit work without violating the lifecycle contract, and the
+        empty set would fail open. The delegation is still denied, so the gate
+        remains fail-closed. The legacy `full` marker normalizes to
+        full-feature's requirement set.
 
     If any required file is missing, the script emits a PreToolUse JSON
     response with hookSpecificOutput.permissionDecision='deny' and a reason
@@ -137,9 +160,14 @@ function Get-PrdFeatureRequiredFile {
         allowed.
     .DESCRIPTION
         full-feature requires spec.md and user-story.md; full-bug requires
-        spec.md only; minor-audit requires neither. A $null or unrecognized
-        mode fails closed to the strictest set (spec.md and user-story.md) so
-        an undeterminable mode never becomes permissive.
+        spec.md only; minor-audit requires neither.
+
+        The default arm returns spec.md alone. It is not reached from the
+        decision path for an undeterminable mode, which denies on its own branch
+        without probing at all; the arm exists so a direct caller passing a $null
+        or unrecognized mode never receives a permissive empty set, and it must
+        not name user-story.md, because that document is required to be ABSENT
+        for full-bug and minor-audit work.
     #>
     [CmdletBinding()]
     [OutputType([string[]])]
@@ -154,7 +182,7 @@ function Get-PrdFeatureRequiredFile {
         'full-feature' { return [string[]]@('spec.md', 'user-story.md') }
         'full-bug' { return [string[]]@('spec.md') }
         'minor-audit' { return [string[]]@() }
-        default { return [string[]]@('spec.md', 'user-story.md') }
+        default { return [string[]]@('spec.md') }
     }
 }
 
@@ -191,9 +219,22 @@ function Get-PrdFeatureCheckpointFolder {
 function Find-PrdFeatureFolderFromPrompt {
     <#
     .SYNOPSIS
-        Scans a prompt string for docs/features/active/<...> path tokens and
-        returns the longest unique match resolved to a folder path. Returns
-        $null when no match is found.
+        Scans a prompt string for docs/features/active/<...> path tokens,
+        truncates each to exactly four path segments, and returns the selected
+        feature folder. Returns $null when no token truncates to four segments.
+    .DESCRIPTION
+        Truncation to four segments -- docs, features, active, and the
+        feature-folder name -- is two segments past the docs/features/active/
+        prefix, so the depth at which an artifact is cited cannot change which
+        folder is resolved. Candidates are deduplicated preserving
+        first-occurrence order; selection among two or more distinct candidates
+        prefers the checkpoint's feature-folder field and otherwise takes the
+        earliest occurrence in the prompt.
+
+        The return value is a repo-relative path normalized to forward slashes,
+        or $null. The function reads no file except through the existing
+        checkpoint seam, and it is deterministic for a given prompt and
+        checkpoint value.
     #>
     [CmdletBinding()]
     [OutputType([string])]
@@ -214,22 +255,56 @@ function Find-PrdFeatureFolderFromPrompt {
         return $null
     }
 
-    $unique = @{}
+    # Deduplicate preserving FIRST-OCCURRENCE order. A [hashtable] must not be
+    # used here: PowerShell hashtable key enumeration order is unspecified, so a
+    # first-occurrence selection rule fed by a hashtable is not deterministic.
+    [System.Collections.Generic.List[string]] $candidates = [System.Collections.Generic.List[string]]::new()
     foreach ($m in $matchList) {
         $normalized = ($m.Value -replace '\\', '/').TrimEnd('/')
-        $unique[$normalized] = $true
+
+        # Truncate to exactly two segments past the docs/features/active/ prefix,
+        # that is, to the four segments docs, features, active, and the feature
+        # folder name. Truncation is depth-insensitive, so a folder path, a
+        # spec.md path, a research/ artifact path, and an evidence/ artifact path
+        # all reduce to the same value. A '.' component is a path no-op and is
+        # discarded first, so a degenerate token such as docs/features/active/.
+        # yields three segments and is rejected rather than resolved.
+        $segments = @($normalized -split '/' | Where-Object { $_ -ne '' -and $_ -ne '.' })
+        if ($segments.Count -lt 4) {
+            continue
+        }
+
+        $truncated = ($segments[0..3] -join '/')
+        if (-not $candidates.Contains($truncated)) {
+            $candidates.Add($truncated)
+        }
     }
 
-    $candidates = @(@($unique.Keys) | Sort-Object -Property Length -Descending)
-    $best = $candidates[0]
+    if ($candidates.Count -eq 0) {
+        return $null
+    }
 
-    # If the longest match ends in .md, treat it as a file and use its parent.
-    if ($best -match '\.md$') {
-        $parent = $best -replace '/[^/]+\.md$', ''
-        return $parent
+    # One distinct candidate is used directly, so the common case never consults
+    # the checkpoint.
+    if ($candidates.Count -eq 1) {
+        return $candidates[0]
+    }
+
+    # More than one distinct feature folder was cited. Prefer the folder the
+    # orchestrator itself records as in flight: the checkpoint is the
+    # authoritative disambiguator, and it reuses a seam this hook already owns.
+    $checkpointFolder = Get-PrdFeatureCheckpointFolder
+    if ($checkpointFolder) {
+        $checkpointNormalized = ($checkpointFolder -replace '\\', '/').TrimEnd('/')
+        if ($candidates.Contains($checkpointNormalized)) {
+            return $checkpointNormalized
+        }
     }
 
-    return $best
+    # Tiebreak of last resort: the orchestrator supplies the active feature folder
+    # among its delegation inputs and names it before citing artifacts inside it,
+    # so a cross-reference to another feature appears later in the prompt.
+    return $candidates[0]
 }
 
 function Get-PrdFeatureMissingFile {
@@ -308,10 +383,32 @@ function Invoke-PrdFeatureBeforePlannerDecision {
 
     # Derive the prerequisite set from the persisted work-mode marker rather
     # than a fixed spec.md/user-story.md pair. A marker that cannot be read or
-    # recognized must fail closed to the strictest set, not fail open.
+    # recognized must fail closed, not fail open: it denies on its own branch
+    # below, naming no prerequisite set and probing for no required file.
     $issueContent = Get-PrdFeatureIssueContent -FeatureFolder $folderNormalized
     $workMode = Resolve-PrdFeatureWorkMode -IssueContent $issueContent
-    $modeDetermined = [bool]$workMode
+
+    # An indeterminate mode is its own decision path, and it deliberately does NOT
+    # run the required-file probe. When the mode is unknown no prerequisite set is
+    # knowable, so any set the gate named would be wrong for at least one mode:
+    # a set containing user-story.md is unsatisfiable for full-bug and minor-audit
+    # without violating the lifecycle contract, and the empty set fails open. The
+    # only remedy true in all three modes is repairing the marker, so that is what
+    # the reason states. This still DENIES, so the gate remains fail-closed.
+    if (-not $workMode) {
+        return [ordered]@{
+            hookSpecificOutput = [ordered]@{
+                hookEventName            = 'PreToolUse'
+                permissionDecision       = 'deny'
+                permissionDecisionReason = "PRD_FEATURE_BLOCKED: resolved feature folder '$folderNormalized', " +
+                "but its work mode could not be determined from '$folderNormalized/issue.md' " +
+                '(the ''- Work Mode:'' marker is absent, unreadable, or unrecognized). ' +
+                'Confirm that is the intended feature folder, then add or correct the ' +
+                '''- Work Mode:'' marker in that file so the prerequisite set can be derived.'
+            }
+        }
+    }
+
     # Force array wrapping: PowerShell unravels a zero-element array return down
     # the pipeline to $null, which would otherwise fail the Mandatory
     # -RequiredFile parameter on Get-PrdFeatureMissingFile for minor-audit mode.
@@ -322,13 +419,13 @@ function Invoke-PrdFeatureBeforePlannerDecision {
         return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
+    # Lead with the resolved folder, not with the remedy: a reader who sees a
+    # folder they did not intend diagnoses a path problem immediately instead of
+    # re-running a step that has already completed correctly.
     $list = ($missing -join ', ')
-    if ($modeDetermined) {
-        $reason = "PRD_FEATURE_BLOCKED: cannot delegate to atomic-planner before prd-feature outputs are present in '$folderNormalized'. Missing: $list (work mode: $workMode). Invoke the prd-feature subagent first."
-    }
-    else {
-        $reason = "PRD_FEATURE_BLOCKED: cannot delegate to atomic-planner before prd-feature outputs are present in '$folderNormalized'. Missing: $list. Work mode could not be determined from '$folderNormalized/issue.md' (marker absent, unreadable, or unrecognized); failing closed to the strictest prerequisite set (spec.md, user-story.md). Invoke the prd-feature subagent first."
-    }
+    $reason = "PRD_FEATURE_BLOCKED: resolved feature folder '$folderNormalized' is missing: " +
+    "$list (work mode: $workMode). Confirm that is the intended feature folder, then " +
+    'invoke the prd-feature subagent to produce the missing output(s).'
 
     return [ordered]@{
         hookSpecificOutput = [ordered]@{

package/resources/claude-customizations/.claude/rules/benchmark-baselines.md

@@ -1,3 +1,10 @@
+---
+paths:
+  - "scripts/benchmarks/**"
+  - "**/baseline*.json"
+description: Runner-environment parity and provenance rules for committed benchmark baselines.
+---
+
 # Benchmark Baseline Provenance
 
 This rule governs performance baselines used by benchmark regression gates. It exists because a baseline captured on a developer workstation was compared against a `windows-latest` runner, producing deterministic latency regressions that the benchmark gate could not survive (issue #26, PR #30).

package/resources/claude-customizations/.claude/rules/ci-workflows.md

@@ -1,3 +1,9 @@
+---
+paths:
+  - ".github/workflows/**"
+description: Exit-code rules for GitHub Actions workflow steps that run pwsh.
+---
+
 # CI Workflow Authoring
 
 This rule governs GitHub Actions workflow steps that run PowerShell (`pwsh`). It exists because a `pwsh` step that intentionally invoked a failing nested command left `$LASTEXITCODE == 1` after its verification logic had already succeeded, leaking a failure to GitHub Actions even though the step's intent was satisfied (issue #26, PR #30).

package/resources/claude-customizations/.claude/rules/orchestrator-state.md

@@ -1,3 +1,27 @@
+---
+paths:
+  - "artifacts/orchestration/*orchestrator-state.json"
+  - "artifacts/orchestration/*planner-state.json"
+  - "scripts/dev_tools/*orchestrator_state*"
+  - "extensions/drm-copilot/src/lib/validate/orchestrator-state-*"
+  - "scripts/dev_tools/compute_complexity_floor.py"
+  - "scripts/dev_tools/resolve_delegation_model.py"
+  - ".claude/hooks/validate-orchestrator-output.ps1"
+  - ".claude/hooks/enforce-model-routing-receipt.ps1"
+  - "config/orchestration-routing.json"
+  - ".claude/agents/orchestrator.md"
+  - ".claude/agents/epic-orchestrator.md"
+  - ".claude/agents/parallel-orchestrator.md"
+  - ".claude/agents/epic-planner.md"
+  - ".claude/agents/parallel-planner.md"
+  - ".claude/skills/orchestrate/SKILL.md"
+  - ".claude/skills/epic-orchestrate/SKILL.md"
+  - ".claude/skills/parallel-orchestrate/SKILL.md"
+  - ".claude/skills/epic-plan/SKILL.md"
+  - ".claude/skills/parallel-plan/SKILL.md"
+description: Checkpoint invariants for the orchestration state artifact and the surfaces that write or validate it.
+---
+
 # Orchestrator-State Remediation-Cycle and Human-Interaction Invariants
 
 This rule governs remediation-cycle records and the optional `human_interaction` block in the orchestrator-state checkpoint at `artifacts/orchestration/orchestrator-state.json`. It documents three invariants that must hold for each remediation cycle, plus three invariants for the `human_interaction` block, so that resume and review workflows do not depend on a structurally invalid checkpoint.

package/resources/claude-customizations/.claude/rules/parallel-orchestration.md

@@ -1,3 +1,24 @@
+---
+paths:
+  - "artifacts/orchestration/parallel-*"
+  - "docs/features/parallel/**"
+  - "scripts/dev_tools/*parallel*"
+  - "extensions/drm-copilot/src/lib/validate/parallel-*"
+  - "scripts/dev_tools/*blast_radius*"
+  - "config/blast-radius.json"
+  - "**/config/blast-radius.json"
+  - "extensions/drm-copilot/src/lib/push-down/claude-blast-radius-derive-core.ts"
+  - ".claude/lib/blast-radius/**"
+  - ".claude/lib/bash/parallel-yaml-scan.sh"
+  - "scripts/dev_tools/validate_orchestration_artifacts.py"
+  - "extensions/drm-copilot/src/lib/validate/orchestration-artifacts.ts"
+  - ".claude/hooks/enforce-epic-merge-gate.ps1"
+  - ".claude/agents/parallel-orchestrator.md"
+  - ".claude/agents/parallel-planner.md"
+  - ".claude/skills/parallel-*/SKILL.md"
+description: Artifact invariants and blast-radius contention doctrine for the parallel orchestration surface.
+---
+
 # Parallel Orchestration Artifact Invariants
 
 This rule governs the three artifacts of the `parallel` orchestration surface: the parallel-run manifest at `docs/features/parallel/<slug>/parallel.md`, the parallel-orchestrator checkpoint at `artifacts/orchestration/parallel-orchestrator-state.json`, and the parallel-planner checkpoint at `artifacts/orchestration/parallel-planner-state.json`. It records the invariants those artifacts must satisfy as numbered prose so that downstream features consume a fixed schema and add behavior only.

package/resources/claude-customizations/.claude/rules/plan-acceptance-gates.md

@@ -1,3 +1,15 @@
+---
+paths:
+  - "scripts/dev_tools/plan_gate_*"
+  - "scripts/dev_tools/validate_orchestration_artifacts.py"
+  - "extensions/drm-copilot/src/lib/validate/plan-gate-*"
+  - "extensions/drm-copilot/src/lib/validate/orchestration-artifacts.ts"
+  - "docs/features/**/plan.*.md"
+  - "docs/features/**/remediation-plan.*.md"
+  - ".claude/skills/atomic-plan-contract/SKILL.md"
+description: Acceptance-gate rules G1 through G6 applied to the shell commands an atomic plan states as acceptance conditions.
+---
+
 # Atomic-Plan Acceptance Gates (G1 through G6)
 
 This rule governs the acceptance-gate rules the plan validator applies to the shell commands an atomic plan states as acceptance conditions. It exists because a plan can state an acceptance condition that cannot fail: a coverage argument that collects no data, or a search for a literal that returns zero matches whatever the executor does. Such a condition reads as a verification step and gates nothing (issue #486).

package/resources/claude-customizations/.claude/settings.json

@@ -9,9 +9,8 @@
       "Bash(bash .claude/lib/bash/compute-concurrency-batches.sh*)",
       "Bash(bash .claude/lib/bash/validate-parallel-manifest.sh*)",
       "Read",
-      "Edit(/docs/**)",
-      "Write(/docs/**)",
-      "Write(/artifacts/**)",
+      "Edit(docs/**)",
+      "Edit(artifacts/**)",
       "mcp__drm-copilot__run_poshqc_format",
       "mcp__drm-copilot__run_poshqc_analyze",
       "mcp__drm-copilot__run_poshqc_test",
@@ -64,17 +63,13 @@
       "Skill(execute-hard-lock *)",
       "Skill(identify-session-id *)",
       "Skill(show-my-agent-tree *)",
-      "Skill(mermaid-diagram *)",
-      "Edit(/.claude/skills/execute-hard-lock/**)",
-      "Edit(/.claude/skills/feature-review-workflow/**)",
-      "Edit(/.claude/skills/csharp-qa-gate/**)"
+      "Skill(mermaid-diagram *)"
     ],
     "deny": [
       "Read(./.env)",
       "Read(./.env.*)",
       "Read(./secrets/**)",
-      "Edit(./secrets/**)",
-      "Write(./secrets/**)"
+      "Edit(./secrets/**)"
     ],
     "additionalDirectories": [
       "c:\\Users\\DanMoisan\\repos\\drm-copilot\\.claude\\skills\\execute-hard-lock"

package/resources/claude-customizations/.claude/skills/epic-orchestrate/SKILL.md

@@ -19,14 +19,6 @@ checkpoint handling, wave computation, integration-branch lifecycle, wave barrie
 merge-conflict handling, worktree cleanup, and documentation-maintenance procedures so the
 procedure is not re-derived ad hoc on each epic run.
 
-## Prerequisites
-
-Before proceeding, `epic-orchestrator` must:
-
-1. Read `CLAUDE.md` for repository tone policy and architectural context.
-2. Read applicable `.claude/rules/` files for the languages in scope.
-3. Read the policy files listed in the compliance reading order section of `CLAUDE.md`.
-
 ## Epic Dependency Manifest
 
 The epic manifest is the YAML frontmatter of the single epic home
@@ -123,7 +115,7 @@ function of the DAG.
 When `epic-orchestrator` delegates a child feature to `Agent(orchestrator)`, the prompt includes
 the literal epic-mode kickoff line:
 
-> `Epic mode: true. epic_feature_folder: <epic-slug>. integration_branch: epic/<epic-slug>-integration. epic_checkpoint_path: artifacts/orchestration/epic-orchestrator-state.json. PR base branch MUST be <integration_branch>, not main; pass --base <integration_branch> to gh pr create.`
+> `Epic mode: true. epic_feature_folder: <epic-slug>. integration_branch: epic/<epic-slug>-integration. epic_checkpoint_path: artifacts/orchestration/epic-orchestrator-state.json. PR base branch MUST be <integration_branch>, not main; pass --base <integration_branch> to gh pr create. Your final report MUST be exactly the bounded return shape (issue_num, feature_folder, merge_status, pr_number, merge_commit_sha, blocked_reason, branch_name, worktree_path) and nothing else; any additional narrative is discarded because the parent re-derives authoritative state regardless.`
 
 The child's own `orchestrator`, on reading this line, records `epic_mode: true` and
 `epic_context: { epic_feature_folder, integration_branch, epic_checkpoint_path }` at its first
@@ -131,6 +123,31 @@ checkpoint write, and on CI-green (S9 step 6) merges its own PR into the integra
 recording `epic_merge: { merge_commit_sha, target_branch, merged_at }`. Standalone (non-epic)
 orchestration is unchanged: `epic_mode` absent or `false` makes S9 step 6 a no-op.
 
+## Bounded Child Return Contract
+
+A child `orchestrator`'s final report is consumed as a fixed eight-field shape and nothing else:
+
+- `issue_num` — the child's GitHub issue number.
+- `feature_folder` — the child's feature-folder path.
+- `merge_status` — the child's terminal merge-status enum value.
+- `pr_number` — the child's pull-request number, or null when none was opened.
+- `merge_commit_sha` — the merge commit, or null when the child did not merge.
+- `blocked_reason` — a short reason string when the child is blocked, otherwise null.
+- `branch_name` — the child's feature branch.
+- `worktree_path` — the child's isolated worktree path.
+
+Content beyond these eight fields is **discarded**. A child that returns a longer narrative is not
+in error; the excess is simply not read into the parent's context, which is what keeps the parent's
+footprint flat as the child count grows.
+
+Discarding is safe because the parent re-derives authoritative state regardless, from
+`git worktree list --porcelain`, `git branch`, and
+`gh pr view --json state,mergedAt,headRefOid`. `branch_name` and `worktree_path` are carried in the
+shape only to spare the parent a re-parse of porcelain output per child before
+`git worktree remove`; they are not authoritative and are re-derived like every other field. The
+governing argument is the cache doctrine already recorded in
+`.claude/rules/parallel-orchestration.md`, which is cited here rather than restated.
+
 ## Model Selection
 
 When `epic-orchestrator` delegates a child feature to `Agent(orchestrator)`, the prompt appends the
@@ -265,7 +282,7 @@ checkpoint JSON remains the durable, machine-authoritative source.
 `docs/features/epics/<epic-slug>/epic.md`), `epic_status_doc_path`, `integration_branch`,
 `completed_steps`, `next_step`, `last_updated`, `current_wave`, `waves[]`, `features[]`,
 `epic_merge_pr`, and the three receipt arrays (`delegation_receipts[]`, `skill_receipts[]`,
-`mcp_call_receipts[]`) — the full schema is defined in `spec.md` §6 of this feature. The
+`mcp_call_receipts[]`). The
 `merge_status` enum is: `not_started`, `worktree_created`, `pr_open`, `ci_green`,
 `merge_conflict`, `blocked_conflict_loop_limit`, `merged`, `worktree_removed`. The optional
 `intent` object (projection of the `epic.md` intent block) is validated presence-gated.

package/resources/claude-customizations/.claude/skills/orchestrate/SKILL.md

@@ -96,6 +96,16 @@ A delegation prompt carrying the literal marker `Preparation mode: true` (issued
 - **Terminal checkpoint.** Stop with `completed_steps` containing `S3_promotion` and `S4_atomic_planning`, `next_step: "S5_atomic_execution"`, out-of-scope step statuses set to `not-applicable`, and `blocked_reason: "none"`. Do NOT assert completion (`next_step: "complete"`, `S12_complete`, or a `completed` step8/9/10 status): the run has no PR or CI evidence, and the route's `requires_ci_gate: false` exempts it from `ci_gate` at the completion validator instead.
 - **Commit.** Commit the prepared feature folder and plan to the current branch (the worktree branch created off the epic integration branch) before stopping, and report the `plan-path` and preflight status in the final output.
 
+## Epic Mode Bounded Return
+
+Under `Epic mode: true`, your final report must be exactly this eight-field shape and nothing else:
+`issue_num`, `feature_folder`, `merge_status`, `pr_number`, `merge_commit_sha`, `blocked_reason`,
+`branch_name`, `worktree_path`.
+
+Content beyond those fields is discarded unread, so spend no effort on it. The parent
+`epic-orchestrator` re-derives authoritative state from git and `gh` regardless, per
+`## Bounded Child Return Contract` in `.claude/skills/epic-orchestrate/SKILL.md`.
+
 ## Model Selection
 
 Model selection is a second axis, strictly separate from `route`. `route` (`small | large | remediation | preparation | epic`) is deterministic — file-count driven for `small`/`large`, marker-driven for `preparation` (the `Preparation mode: true` kickoff line) and `epic`; it governs `required_agents`, `required_skills`, and `required_mcp_tools` only. `route` is NOT an input to model selection anywhere. The sole feature-level input to the delegation model tier is a judgment-based `complexity_band` (`C1 | C2 | C3 | C4`). The authoritative values live in the `model_policy` block of `config/orchestration-routing.json`.

package/resources/codex-and-agents-customizations/.codex/config.toml

@@ -2,7 +2,7 @@ default_permissions = ":danger-full-access"
 
 [mcp_servers.drm-copilot]
 command = "npx"
-args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.2"]
+args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.4"]
 required = true
 enabled_tools = [
     "collect_commit_context",

package/resources/powershell/PoshQC/settings/pester.runsettings.psd1

@@ -210,6 +210,28 @@
             '.claude/hooks/enforce-prd-feature-before-planner.ps1'
             '.claude/hooks/enforce-parallel-cohort-barrier-helpers.ps1'
             '.claude/hooks/enforce-pr-author-skill-helpers.ps1'
+            # Issue #526 added this out-of-band release-verification module (Layer B of the
+            # missed-npm-publish defence). CodeCoverage.Path is an explicit per-file
+            # allow-list, so the new production file is registered here; without it the file
+            # would sit outside the coverage denominator, which the Coverage Exclusion Policy
+            # forbids. Its Pester suite dot-sources the file (guarded entry-point body), so
+            # line attribution is valid.
+            'scripts/dev-tools/Invoke-ReleaseVerification.ps1'
+            # Issue #526 split the pure helpers of the verification module into this sibling
+            # file, because the parent stood one line under the 500-line cap. CodeCoverage.Path
+            # is an explicit per-file allow-list, so the new production file must be registered
+            # here to stay inside the coverage denominator; without it the relocated lines would
+            # leave the denominator entirely, which the Coverage Exclusion Policy forbids. Its
+            # Pester suite dot-sources the file, and the file declares no entry-point block, so
+            # line attribution is valid.
+            'scripts/dev-tools/Invoke-ReleaseVerificationHelpers.ps1'
+            # Issue #526 added this release-reconciliation module (Layer C of the
+            # missed-npm-publish defence). CodeCoverage.Path is an explicit per-file
+            # allow-list, so the new production file is registered here; without it the file
+            # would sit outside the coverage denominator, which the Coverage Exclusion Policy
+            # forbids. Its Pester suite dot-sources the file (guarded entry-point body), so
+            # line attribution is valid.
+            'scripts/dev-tools/Invoke-ReleaseReconciliation.ps1'
         )
         # Optional: don't fail the run on coverage percentage
         CoveragePercentTarget = 0