@danmoisan/drm-copilot-mcp 1.1.20 → 1.1.22

package/resources/codex-and-agents-customizations/.codex/config.toml

@@ -2,7 +2,7 @@ default_permissions = ":danger-full-access"
 
 [mcp_servers.drm-copilot]
 command = "npx"
-args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.20"]
+args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.22"]
 required = true
 enabled_tools = [
     "collect_commit_context",

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-powershell-batch-budget.ps1

@@ -52,7 +52,7 @@ $script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot
 try { . (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1') } catch { Add-HookDependencyFailure -Name 'codex-pretooluse-file-mapping.ps1' -ErrorRecord $_ }
 
 # Shared route helpers; this file is byte-identical to the Claude runtime copy.
-try { . (Join-Path $PSScriptRoot 'enforce-batch-budget-route.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-batch-budget-route.ps1' -ErrorRecord $_ }
+$script:PowerShellBatchBudgetRouteImportFailure = $null; try { . (Join-Path $PSScriptRoot 'enforce-batch-budget-route.ps1') } catch { $script:PowerShellBatchBudgetRouteImportFailure = 'enforce-batch-budget-route.ps1' }
 
 function Get-PowerShellBatchBudgetState {
     [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', 'TestCap', Justification = 'Accepted and ignored for callers written against the removed test-file cap.')]
@@ -216,6 +216,7 @@ function Invoke-PowerShellBatchBudgetHook {
     if ($normalized -notmatch '\.(ps1|psm1|psd1)$') {
         return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
+    if ($script:PowerShellBatchBudgetRouteImportFailure) { return Get-PowerShellBatchBudgetBlockDecision -Reason "POWERSHELL_LARGE_PATH_REQUIRED: the route helper '$($script:PowerShellBatchBudgetRouteImportFailure)' failed to load, so the batch budget for '$normalized' cannot be evaluated; the gate fails closed." }
 
     $stateDir = Join-Path -Path $Root -ChildPath '.codex/state'
     $stateFile = Join-Path -Path $stateDir -ChildPath ("powershell-batch-budget.$SessionId.json")

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-python-batch-budget.ps1

@@ -52,7 +52,7 @@ $script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot
 try { . (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1') } catch { Add-HookDependencyFailure -Name 'codex-pretooluse-file-mapping.ps1' -ErrorRecord $_ }
 
 # Shared route helpers; this file is byte-identical to the Claude runtime copy.
-try { . (Join-Path $PSScriptRoot 'enforce-batch-budget-route.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-batch-budget-route.ps1' -ErrorRecord $_ }
+$script:PythonBatchBudgetRouteImportFailure = $null; try { . (Join-Path $PSScriptRoot 'enforce-batch-budget-route.ps1') } catch { $script:PythonBatchBudgetRouteImportFailure = 'enforce-batch-budget-route.ps1' }
 
 function Get-PythonBatchBudgetState {
     [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', 'TestCap', Justification = 'Accepted and ignored for callers written against the removed test-file cap.')]
@@ -219,6 +219,7 @@ function Invoke-PythonBatchBudgetHook {
     if ($normalized -notmatch '\.py$') {
         return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
+    if ($script:PythonBatchBudgetRouteImportFailure) { return Get-PythonBatchBudgetBlockDecision -Reason "PYTHON_LARGE_PATH_REQUIRED: the route helper '$($script:PythonBatchBudgetRouteImportFailure)' failed to load, so the batch budget for '$normalized' cannot be evaluated; the gate fails closed." }
 
     $stateDir = Join-Path -Path $Root -ChildPath '.codex/state'
     $stateFile = Join-Path -Path $stateDir -ChildPath ("python-batch-budget.$SessionId.json")

package/resources/codex-and-agents-customizations/.codex/hooks/record-subagent-routing-attestation.ps1

@@ -177,7 +177,7 @@ function Get-CodexSubagentAttestation {
     $profileValidationError = $null
     $routingValid = $true
     if ($isEpic) {
-        $expectedModel = 'gpt-5.6-sol'
+        $expectedModel = 'gpt-6-astra'
         $expectedReasoningEffort = 'ultra'
     } elseif (Test-CodexRoutedAgentType -AgentType $agentType) {
         $routingReceipt = Find-CodexModelRoutingReceipt -AgentType $agentType -Checkpoints $Checkpoints
@@ -246,23 +246,20 @@ function Write-CodexSubagentAttestation {
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)][string] $RepositoryRoot,
-        [Parameter(Mandatory)][System.Collections.IDictionary] $Attestation
+        [Parameter(Mandatory)][System.Collections.IDictionary] $Attestation,
+        [scriptblock] $OpenStream = { param($Path, $Mode, $Access, $Share) [System.IO.File]::Open($Path, $Mode, $Access, $Share) },
+        [scriptblock] $EnsureDirectory = { param($Path) [System.IO.Directory]::CreateDirectory($Path) | Out-Null }
     )
 
     $directory = Get-CodexAuthorityStateRoot `
         -RepositoryRoot $RepositoryRoot `
         -SessionId ([string]$Attestation.session_id)
-    [System.IO.Directory]::CreateDirectory($directory) | Out-Null
+    & $EnsureDirectory $directory
     $path = Get-CodexAuthorityAttestationPath `
         -RepositoryRoot $RepositoryRoot `
         -SessionId ([string]$Attestation.session_id) `
         -AttestationKey ([string]$Attestation.attestation_key)
-    $stream = [System.IO.File]::Open(
-        $path,
-        [System.IO.FileMode]::CreateNew,
-        [System.IO.FileAccess]::Write,
-        [System.IO.FileShare]::None
-    )
+    $stream = & $OpenStream $path ([System.IO.FileMode]::CreateNew) ([System.IO.FileAccess]::Write) ([System.IO.FileShare]::None)
     try {
         $writer = [System.IO.StreamWriter]::new(
             $stream,
@@ -288,7 +285,9 @@ function Get-CodexSubagentAttestationFromAuthority {
         [Parameter(Mandatory)][AllowEmptyCollection()][object[]] $Checkpoints,
         [Parameter(Mandatory)][string] $RepositoryRoot,
         [Parameter(Mandatory)][string] $CurrentHeadSha,
-        [Parameter(Mandatory)][datetimeoffset] $Now
+        [Parameter(Mandatory)][datetimeoffset] $Now,
+        [scriptblock] $OpenStream = { param($Path, $Mode, $Access, $Share) [System.IO.File]::Open($Path, $Mode, $Access, $Share) },
+        [scriptblock] $FlushStream = { param($Stream) $Stream.Flush($true) }
     )
 
     $isEpic = $script:EpicPersonas -contains [string]$Payload.agent_type
@@ -302,12 +301,7 @@ function Get-CodexSubagentAttestationFromAuthority {
             -Now $Now
     }
 
-    $stream = [System.IO.File]::Open(
-        $ReceiptPath,
-        [System.IO.FileMode]::Open,
-        [System.IO.FileAccess]::ReadWrite,
-        [System.IO.FileShare]::None
-    )
+    $stream = & $OpenStream $ReceiptPath ([System.IO.FileMode]::Open) ([System.IO.FileAccess]::ReadWrite) ([System.IO.FileShare]::None)
     try {
         $reader = [System.IO.StreamReader]::new(
             $stream,
@@ -344,7 +338,7 @@ function Get-CodexSubagentAttestationFromAuthority {
             try {
                 $writer.Write(($receipt | ConvertTo-Json -Depth 8))
                 $writer.Flush()
-                $stream.Flush($true)
+                & $FlushStream $stream
             } finally {
                 $writer.Dispose()
             }
@@ -355,60 +349,78 @@ function Get-CodexSubagentAttestationFromAuthority {
     }
 }
 
-if ($MyInvocation.InvocationName -eq '.') {
-    return
-}
-
-try {
-    $payload = ConvertFrom-SubagentAttestationJson -Raw ([Console]::In.ReadToEnd()) -Name 'SubagentStart input'
-    $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
-    $stateRoot = Join-Path $repositoryRoot 'artifacts/orchestration'
-    $receiptPath = Get-CodexAuthorityReceiptPath `
-        -RepositoryRoot $repositoryRoot `
-        -SessionId ([string]$payload.session_id) `
-        -TurnId ([string]$payload.turn_id)
-    $checkpoints = @()
-    foreach ($name in @('epic-planner-state.json', 'epic-orchestrator-state.json', 'orchestrator-state.json')) {
-        $path = Join-Path $stateRoot $name
-        if (Test-Path -LiteralPath $path -PathType Leaf) {
-            $parsed = ConvertFrom-SubagentAttestationJson -Raw (Get-Content -Raw -LiteralPath $path) -Name $name -Optional
-            if ($null -ne $parsed) {
-                $checkpoints += $parsed
+<#
+.SYNOPSIS
+    Evaluates SubagentStart input while leaving console output and process exit to the entry wrapper.
+#>
+function Invoke-CodexSubagentAttestationCommand {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [string] $RepositoryRoot = (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent),
+        [scriptblock] $ReadInput = { [Console]::In.ReadToEnd() },
+        [scriptblock] $ReadCheckpoint = { param($Path) Get-Content -Raw -LiteralPath $Path },
+        [scriptblock] $ReadHead = { param($Root) $sha = [string](& git -C $Root rev-parse HEAD 2>$null); @{ sha = $sha; exit_code = $LASTEXITCODE } },
+        [scriptblock] $GetNow = { [datetimeoffset]::UtcNow }
+    )
+    try {
+        $payload = ConvertFrom-SubagentAttestationJson -Raw (& $ReadInput) -Name 'SubagentStart input'
+        $stateRoot = Join-Path $repositoryRoot 'artifacts/orchestration'
+        $receiptPath = Get-CodexAuthorityReceiptPath `
+            -RepositoryRoot $repositoryRoot `
+            -SessionId ([string]$payload.session_id) `
+            -TurnId ([string]$payload.turn_id)
+        $checkpoints = @()
+        foreach ($name in @('epic-planner-state.json', 'epic-orchestrator-state.json', 'orchestrator-state.json')) {
+            $path = Join-Path $stateRoot $name
+            if (Test-Path -LiteralPath $path -PathType Leaf) {
+                $parsed = ConvertFrom-SubagentAttestationJson -Raw (& $ReadCheckpoint $path) -Name $name -Optional
+                if ($null -ne $parsed) {
+                    $checkpoints += $parsed
+                }
             }
         }
+        $now = & $GetNow
+        $head = & $ReadHead $repositoryRoot
+        $headSha = [string]$head.sha
+        if ($head.exit_code -ne 0 -or $headSha -notmatch '^[0-9a-fA-F]{40,64}$') {
+            throw 'EPIC_INVOCATION_ORIGIN_BLOCKED: repository HEAD could not be resolved.'
+        }
+        $attestation = Get-CodexSubagentAttestationFromAuthority `
+            -Payload $payload `
+            -ReceiptPath $receiptPath `
+            -Checkpoints $checkpoints `
+            -RepositoryRoot $repositoryRoot `
+            -CurrentHeadSha $headSha `
+            -Now $now
+        $attestationPath = Write-CodexSubagentAttestation -RepositoryRoot $repositoryRoot -Attestation $attestation
+        $stdout = if (-not $attestation.provenance_valid) {
+            [ordered]@{
+                systemMessage      = "EPIC_INVOCATION_ORIGIN_BLOCKED: $($payload.agent_type) requires a fresh root-session epic invocation receipt."
+                hookSpecificOutput = [ordered]@{
+                    hookEventName     = 'SubagentStart'
+                    additionalContext = 'Do not mutate state. Report EPIC_INVOCATION_ORIGIN_BLOCKED and stop.'
+                }
+            } | ConvertTo-Json -Compress -Depth 5
+        } elseif (-not $attestation.routing_valid) {
+            [ordered]@{
+                systemMessage      = "MODEL_ROUTING_ATTESTATION_BLOCKED: actual model/profile does not match the persisted routing receipt. Attestation: $attestationPath"
+                hookSpecificOutput = [ordered]@{
+                    hookEventName     = 'SubagentStart'
+                    additionalContext = 'Do not mutate state until the parent corrects the deployment profile and routing receipt.'
+                }
+            } | ConvertTo-Json -Compress -Depth 5
+        }
+        return [ordered]@{ exit_code = 0; stdout = $stdout; stderr = $null }
+    } catch {
+        return [ordered]@{ exit_code = 2; stdout = $null; stderr = [string]$_ }
     }
-    $now = [datetimeoffset]::UtcNow
-    $headSha = [string](& git -C $repositoryRoot rev-parse HEAD 2>$null)
-    if ($LASTEXITCODE -ne 0 -or $headSha -notmatch '^[0-9a-fA-F]{40,64}$') {
-        throw 'EPIC_INVOCATION_ORIGIN_BLOCKED: repository HEAD could not be resolved.'
-    }
-    $attestation = Get-CodexSubagentAttestationFromAuthority `
-        -Payload $payload `
-        -ReceiptPath $receiptPath `
-        -Checkpoints $checkpoints `
-        -RepositoryRoot $repositoryRoot `
-        -CurrentHeadSha $headSha `
-        -Now $now
-    $attestationPath = Write-CodexSubagentAttestation -RepositoryRoot $repositoryRoot -Attestation $attestation
-    if (-not $attestation.provenance_valid) {
-        [ordered]@{
-            systemMessage      = "EPIC_INVOCATION_ORIGIN_BLOCKED: $($payload.agent_type) requires a fresh root-session epic invocation receipt."
-            hookSpecificOutput = [ordered]@{
-                hookEventName     = 'SubagentStart'
-                additionalContext = 'Do not mutate state. Report EPIC_INVOCATION_ORIGIN_BLOCKED and stop.'
-            }
-        } | ConvertTo-Json -Compress -Depth 5 | Write-Output
-    } elseif (-not $attestation.routing_valid) {
-        [ordered]@{
-            systemMessage      = "MODEL_ROUTING_ATTESTATION_BLOCKED: actual model/profile does not match the persisted routing receipt. Attestation: $attestationPath"
-            hookSpecificOutput = [ordered]@{
-                hookEventName     = 'SubagentStart'
-                additionalContext = 'Do not mutate state until the parent corrects the deployment profile and routing receipt.'
-            }
-        } | ConvertTo-Json -Compress -Depth 5 | Write-Output
-    }
-    exit 0
-} catch {
-    [Console]::Error.WriteLine([string]$_)
-    exit 2
 }
+
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+$commandResult = Invoke-CodexSubagentAttestationCommand
+if ($null -ne $commandResult.stdout) { Write-Output $commandResult.stdout }
+if ($null -ne $commandResult.stderr) { [Console]::Error.WriteLine($commandResult.stderr) }
+exit $commandResult.exit_code

package/resources/codex-and-agents-customizations/.codex-variants/csharp-legacy/agents/csharp-typed-engineer.toml

@@ -1,6 +1,6 @@
 name = "csharp-typed-engineer"
 description = "Converted subagent"
-model = "gpt-5.6-terra"
+model = "gpt-6.1-sol"
 model_reasoning_effort = "high"
 developer_instructions = '''
 Canonical migration source: .github/agents/csharp-typed-engineer.agent.md

package/resources/codex-and-agents-customizations/pack-manifests/core.json

@@ -79,6 +79,7 @@
     ".codex/scripts/codex-routing-cli-common.ps1",
     ".codex/scripts/Resolve-CodexDeployment.ps1",
     ".codex/scripts/Resolve-CodexTopology.ps1",
+    ".codex/scripts/post-codex-worktree-session.ps1",
     ".codex/prompts/generate-pr.md",
     ".codex/prompts/orchestrate-work.md",
     ".codex/agents/feature-reviewer.toml",

package/resources/config/orchestration-routing.json

@@ -289,28 +289,28 @@
     "complexity_to_profile": {
       "C1": {
         "suffix": "c1",
-        "model": "gpt-5.6-luna",
+        "model": "gpt-6-luna",
         "model_reasoning_effort": "low"
       },
       "C2": {
         "suffix": "c2",
-        "model": "gpt-5.6-terra",
+        "model": "gpt-6.1-sol",
         "model_reasoning_effort": "medium"
       },
       "C3": {
         "suffix": "c3",
-        "model": "gpt-5.6-terra",
+        "model": "gpt-6.1-sol",
         "model_reasoning_effort": "high"
       },
       "C4": {
         "suffix": "c4",
-        "model": "gpt-5.6-sol",
+        "model": "gpt-6-astra",
         "model_reasoning_effort": "max"
       }
     },
       "c3_elevated_profile": {
       "suffix": "c3-elevated",
-      "model": "gpt-5.6-sol",
+      "model": "gpt-6-astra",
       "model_reasoning_effort": "high",
       "activation": {
         "operator": "any",
@@ -329,12 +329,12 @@
       "forced_personas": {
       "epic-planner": {
         "suffix": "",
-        "model": "gpt-5.6-sol",
+        "model": "gpt-6-astra",
         "model_reasoning_effort": "ultra"
       },
       "epic-orchestrator": {
         "suffix": "",
-        "model": "gpt-5.6-sol",
+        "model": "gpt-6-astra",
         "model_reasoning_effort": "ultra"
       }
     },

package/resources/customizations/.github/skills/execution-environment/SKILL.md

@@ -60,7 +60,7 @@ Two separate mechanisms restrict Bash command text. They are kept apart here bec
 - `.github/workflows/ci.yml` triggers on `push` to `main` and `development`, on `pull_request` to `main`, `development`, and `epic/**`, on `workflow_dispatch`, and on `merge_group` (`types: [checks_requested]`, added by issue #952), with no path filters. When the merge queue on `main` is enabled, every required check is produced by a `merge_group` run of `ci.yml` as well as by the pull-request run; `.github/workflows/README.md` (`## Triggers`) records the trigger set.
 - Jobs in `ci.yml` and their check names: `Change scope` (job `changes`, the change-scope decision below); `CI full run` (job `full-run-marker`, which runs only on a full run, marks that run as a valid base for later decisions, and is not a required check); `quality-checks7 / Code Quality & Tests (<python-version>)` on Python 3.10, 3.11, 3.12, and 3.13 (`_quality-checks.yml`: Black check, Ruff, Pyright, the Codex generator `--check`, the tier classification, Pytest with line and branch coverage, and the coverage-threshold check on the JSON report totals); `security-scan / Security Scanning` (its `safety check` step carries `continue-on-error: true` and does not fail the check); `docs-validation / Documentation Validation`; `build-check / Build Package`; `shell-coverage / Shell Coverage (Bats + kcov)`; `drm-copilot-extension-tests / drm-copilot Extension Tests (<os>)` on `ubuntu-latest` and `windows-latest`; `root-typescript-tests / Root TypeScript Tests (<os>)` on `ubuntu-latest` and `windows-latest`; `NPM Audit Gate / npm audit (<manifest>)` (the calling job carries the name `NPM Audit Gate`); and the `poshqc` group below.
 - PowerShell CI (`_poshqc.yml`): `poshqc / PowerShell QC static` (format and analyze on `windows-latest`); the shard matrix `poshqc / PowerShell QC shard 1`, `shard 2`, and `shard 3` (`Invoke-PoshQCTest -ShardIndex -ShardCount` over the scan folders of `config/poshqc-scan.json`, with coverage, on `windows-latest`); the aggregator `poshqc / PowerShell QC`, which requires the static and shard jobs to succeed, verifies shard completeness against a Pester discovery count, and merges shard coverage; and `poshqc / PowerShell hook suites (Linux)`, which runs only `tests/scripts/claude-hooks` and `tests/scripts/codex-hooks` on `ubuntu-latest` with coverage disabled. A new test file under a scanned folder is assigned to a shard automatically and is counted by the completeness check.
-- Change-scope decision (issue #962): the `Change scope` job runs `scripts/ci/Invoke-CiChangeScope.ps1` and publishes the job output `code`. The decision is `code=false` (docs-only) only on a `pull_request` event from this repository when every file changed since the newest successful `ci.yml` run on the pull-request branch whose `CI full run` job succeeded, and whose head commit is an ancestor of the current head, is on the allowlist `config/ci-docs-only-paths.json`. A path is allowlisted when it starts with `docs/features/active/`, `docs/features/completed/`, `docs/features/potential/`, or `docs/research/`, does not start with `docs/features/templates/` or `docs/features/potential/template.md`, and ends in `.md`, `.txt`, `.log`, `.json`, or `.xml`; the allowlist file itself is not allowlisted. Every other case is a full run (`code=true`): `push`, `merge_group`, and `workflow_dispatch` events, a fork pull request, unreadable run or job data, no earlier full green run, a missing or non-ancestor base, an empty diff, any path outside the allowlist, and any error. The decision step carries `continue-on-error: true` and the callers compare the output with `!= 'false'`, so a failed or missing decision also gives a full run.
+- Change-scope decision (issue #962): the `Change scope` job runs `scripts/ci/Invoke-CiChangeScope.ps1` and publishes the job output `code`. The decision is `code=false` (docs-only) only on a `pull_request` event from this repository, through one of two comparisons. Green-run base: every file changed since the newest successful `ci.yml` run on the pull-request branch whose `CI full run` job succeeded, and whose head commit is present and an ancestor of the current head, is on the allowlist `config/ci-docs-only-paths.json`; the reason is `DOCS_ONLY_SINCE_<green head sha>`. Merge-base fallback (issue #973): when the green-run step ends with no earlier full green run (`NO_FULL_GREEN_RUN`), a missing base (`BASE_NOT_PRESENT`), or a non-ancestor base (`BASE_NOT_ANCESTOR`), and the pull request's base ref is exactly `main`, the script computes `git merge-base` of the payload base SHA (`BASE_SHA`, from `github.event.pull_request.base.sha`; the base ref arrives as `BASE_REF`) and the head, lists the files changed since that merge base with the same diff arguments, and decides `DOCS_ONLY_SINCE_MERGE_BASE_<merge base sha>` when every changed file is allowlisted. Both comparisons run the diff with rename detection off, so both the old and the new path of a rename are classified. A path is allowlisted when it starts with `docs/features/active/`, `docs/features/archive/`, `docs/features/completed/`, `docs/features/epics/`, `docs/features/parallel/`, `docs/features/potential/`, or `docs/research/`, does not start with `docs/features/templates/` or `docs/features/potential/template.md`, and ends in `.md`, `.txt`, `.log`, `.json`, or `.xml`; the allowlist file itself is not allowlisted. Every other case is a full run (`code=true`): `push`, `merge_group`, and `workflow_dispatch` events, a fork pull request, unreadable run or job data, no earlier full green run or a missing or non-ancestor base when the base ref is not `main`, a merge base that cannot be resolved (`MERGE_BASE_UNRESOLVED`, for example a blank base SHA or a base commit missing from the checkout), a failed ancestry check, an empty diff, any path outside the allowlist, and any error. The decision step carries `continue-on-error: true` and the callers compare the output with `!= 'false'`, so a failed or missing decision also gives a full run.
 - Docs-only behavior (`code=false`): `ci.yml` passes `run-heavy: false` to `_quality-checks.yml`, `_security-scan.yml`, `_build-check.yml`, `_poshqc.yml`, `_shell-coverage.yml`, and `_drm-copilot-extension-tests.yml`. Each required job still starts under its full-run check name with every step skipped, so every required context reports `success` without running its suite. In `_poshqc.yml` the aggregator `poshqc / PowerShell QC` runs with every step gated, and `poshqc / PowerShell QC static`, the shard jobs, and `poshqc / PowerShell hook suites (Linux)` are skipped at job level. `docs-validation / Documentation Validation` runs in full. `root-typescript-tests`, `NPM Audit Gate`, and `CI full run` are skipped at job level. A `success` on a docs-only commit is therefore not evidence that the heavy suites pass for that commit; that evidence is the newest run whose `CI full run` job succeeded.
 - A commit that changes any path outside the allowlist (any code, workflow, configuration, script, test, or customization file) runs the full set of jobs, and its `CI full run` job marks it as a base for later docs-only decisions. A standalone `workflow_dispatch` of a reusable workflow, or a caller that omits `run-heavy`, also runs in full. `.github/workflows/README.md` (`## Change-Scope Decision (Issue #962)`) records the reason codes and the per-context behavior table.
 - Required contexts of ruleset 15241672, confirmed by the orchestrator through `gh api` on 2026-10-16: `drm-copilot-extension-tests / drm-copilot Extension Tests (ubuntu-latest)`, `drm-copilot-extension-tests / drm-copilot Extension Tests (windows-latest)`, `docs-validation / Documentation Validation`, `poshqc / PowerShell QC`, `shell-coverage / Shell Coverage (Bats + kcov)`, `security-scan / Security Scanning`, `quality-checks7 / Code Quality & Tests (3.10)`, `quality-checks7 / Code Quality & Tests (3.11)`, `quality-checks7 / Code Quality & Tests (3.12)`, `quality-checks7 / Code Quality & Tests (3.13)`, `build-check / Build Package`.
@@ -83,6 +83,7 @@ Run these after editing any mirrored or bundled file; each is under `tests/scrip
 
 - `test_push_down_claude_resource_contracts.py` and `test_push_down_codex_and_agents_resource_contracts.py`: every distributable `.claude`, `.agents`, and `.codex` file exists in the bundle with equal text.
 - `test_push_down_claude_pack_manifest_completeness.py` and `test_push_down_codex_and_agents_pack_manifest_completeness.py`: every bundled file is listed in a pack manifest.
+- `test_push_down_pack_manifest_dependency_closure.py`: every `$PSScriptRoot` dependency of a manifested PowerShell file, and every hook script named by `.claude/settings.json`, manifested agent frontmatter, or `.codex/config.toml`, is in core plus the owning pack.
 - The Codex generator check: `scripts/dev_tools/generate_codex_agent_variants.py` run in module form with `--check` (base agents are hand-edited; variants, bundle copies, and the Codex `core.json` are generated).
 - `test_codex_agent_wrapper_contracts.py` and `test_codex_handoff_contract_parity.py`: pinned Codex agent fragments and handoff parity.
 - `test_claude_rules_frontmatter.py`: rule `paths:` scopes and that every preloaded skill exists.

package/resources/lib/codex-routing/CodexDeployment.psm1

@@ -7,9 +7,9 @@
     `scripts/dev_tools/resolve_codex_deployment.py`. It resolves the exact Codex
     deployment agent, model, and reasoning effort for one delegation from the
     logical agent, the assessed complexity band, the execution context, and the
-    orchestration complexity ceiling. C3 defaults to Terra/high and elevates to
-    Sol/high only for an epic child or a C4 orchestration ceiling; the epic
-    planner and epic orchestrator personas are always forced to Sol/ultra. No
+    orchestration complexity ceiling. C3 defaults to Sol/high and elevates to
+    Astra/high only for an epic child or a C4 orchestration ceiling; the epic
+    planner and epic orchestrator personas are always forced to Astra/ultra. No
     model alias and no silent fallback is accepted.
 
     SINGLE-IMPLEMENTATION RULE. The orchestrator-state U6.X checks
@@ -81,20 +81,20 @@ $script:LOGICAL_AGENT_ALIASES = @{ 'feature-review' = 'feature-reviewer' }
 
 # The per-band deployment profiles (suffix, model, reasoning effort).
 $script:BASE_PROFILES = @{
-    C1 = @{ suffix = 'c1'; model = 'gpt-5.6-luna'; model_reasoning_effort = 'low' }
-    C2 = @{ suffix = 'c2'; model = 'gpt-5.6-terra'; model_reasoning_effort = 'medium' }
-    C3 = @{ suffix = 'c3'; model = 'gpt-5.6-terra'; model_reasoning_effort = 'high' }
-    C4 = @{ suffix = 'c4'; model = 'gpt-5.6-sol'; model_reasoning_effort = 'max' }
+    C1 = @{ suffix = 'c1'; model = 'gpt-6-luna'; model_reasoning_effort = 'low' }
+    C2 = @{ suffix = 'c2'; model = 'gpt-6.1-sol'; model_reasoning_effort = 'medium' }
+    C3 = @{ suffix = 'c3'; model = 'gpt-6.1-sol'; model_reasoning_effort = 'high' }
+    C4 = @{ suffix = 'c4'; model = 'gpt-6-astra'; model_reasoning_effort = 'max' }
 }
 
 # The profile a C3 delegation elevates to when the overlay applies.
-$script:C3_ELEVATED_PROFILE = @{ suffix = 'c3-elevated'; model = 'gpt-5.6-sol'; model_reasoning_effort = 'high' }
+$script:C3_ELEVATED_PROFILE = @{ suffix = 'c3-elevated'; model = 'gpt-6-astra'; model_reasoning_effort = 'high' }
 
 # The personas whose profile is forced regardless of band, context, or ceiling.
 # Their deployment agent is the logical agent itself (empty suffix).
 $script:FORCED_PERSONA_PROFILES = @{
-    'epic-planner'      = @{ suffix = ''; model = 'gpt-5.6-sol'; model_reasoning_effort = 'ultra' }
-    'epic-orchestrator' = @{ suffix = ''; model = 'gpt-5.6-sol'; model_reasoning_effort = 'ultra' }
+    'epic-planner'      = @{ suffix = ''; model = 'gpt-6-astra'; model_reasoning_effort = 'ultra' }
+    'epic-orchestrator' = @{ suffix = ''; model = 'gpt-6-astra'; model_reasoning_effort = 'ultra' }
 }