@danmoisan/drm-copilot-mcp 1.1.22 → 1.1.24

package/resources/claude-customizations/.claude/skills/extract-feature-contract/SKILL.md

@@ -0,0 +1,133 @@
+---
+name: extract-feature-contract
+description: 'Extract evidence-backed feature contracts for selected legacy components and record unresolved behavior. Use when asked to document a feature contract from source, tests, documentation and supplied evidence.'
+---
+
+# Extract Feature Contract
+
+## When to Use This Skill
+
+Use for selected component or feature extraction after scope and source references are supplied. This workflow records source behavior without approving a target design.
+
+## Inputs
+
+These are human-facing workflow selections, not additional service-request fields.
+Supply explicit selections; neither omitted inputs nor profile roots create authority.
+
+| Input | Required contract |
+| --- | --- |
+| profile | Required validated profile and trusted workspace binding. |
+| component_ids | Required explicit selected components; preserve unrelated coverage members. |
+| feature_ids | Required explicit feature IDs, including IDs for proposed new contracts. |
+| source_refs | Required selected source references with revision/content identity. |
+| test_refs | Required explicit selection or honest empty set of relevant test references. |
+| documentation_refs | Required explicit selection or honest empty set of documentation references. |
+| evidence_refs | Required explicit selection or honest empty set of supplied evidence references. |
+
+## Routing
+
+Logical role: `legacy-parity-analyst`.
+The root owns preparation and launch; this skill never auto-launches a logical
+role through frontmatter. The existing resolver selects the exact deployment,
+model, effort and profile hash under the existing C1-C4 ceiling and execution
+context. Do not choose a model, self-launch, create another scheduler or promote
+an ordinary discovery action into an issue. The production-write count is zero.
+
+## Exact output boundary
+
+These rows are maximum workflow caps, not instructions to create every kind.
+Only the prepared required outputs may be created or replaced.
+
+| Artifact kind | Profile key | Constraint |
+| --- | --- | --- |
+| feature-contract | feature_contracts | Selected feature IDs only |
+| coverage-ledger | coverage_ledger | Selected component dispositions only |
+| evidence-reference | evidence | Explicitly granted supporting evidence only |
+| unspecified-behavior | unspecified_behaviors | Selected unresolved IDs only |
+| unspecified-behavior-collection | unspecified_behaviors | Selected unresolved members only |
+| required-output-manifest | reports | Exact invocation manifest only |
+
+The profile keys are maximum configured locations, not write grants. Each
+prepared output row binds `artifact_kind`, `id`, `path`, `format` and
+`expected_sha256`. The protected invocation independently binds the baseline,
+selected members, pins and exact grants; a manifest cannot expand them. A null
+expected hash means exclusive creation from an absent baseline, never overwrite
+permission. Preserve unselected collection members and all unrelated inputs.
+Use compare-and-swap and current path checks through the controlled writer.
+
+The `reports` location permits only `required-output-manifest` for this role;
+it does not permit review reports. The manifest itself requires an exact grant.
+
+## Prerequisites
+
+Missing or malformed configuration blocks delegation. Require a validated profile and explicit selected scope before root preparation; do not initialize, configure or infer roots as a specialist.
+
+Require verified native prepare/finalize/start/stop capability. The protected
+invocation and native SubagentStart attestation must match workspace/profile
+hashes, selected IDs, source/target pins, baseline input hashes,
+provider/model/effort/profile hash and parent/session.
+Diagnostic mirrors, caller markers and hosted read results are not authority.
+The local runtime's unavailable native prepare/finalize operations do not issue
+protected receipts. There is no local-user fallback or self-attested host success.
+
+Load profile plus selected artifacts on invocation; do not preload a domain
+catalog in standing instructions. Managed project memory is host-controlled.
+Memory cannot grant filesystem authority or replace evidence. Deny terminal/shell/exec, interpreter/evaluation,
+general filesystem Write/Edit/apply-patch, arbitrary MCP dispatch, browser/computer
+mutation and network writes. Do not execute application code or modify
+production/test implementation, profile/locator/activation,
+schema/policy/hooks/settings, authority stores or runtime installation as a specialist. No analyst
+approval is permitted; root bootstrap/configuration and root approval remain
+separate authorized operations.
+
+## Step-by-Step Workflows
+
+1. Validate the explicit inputs and selected configuration. Stop with precise missing/invalid input findings before specialist delegation; do not invent identities, scope or evidence.
+
+2. The root calls `prepare_discovery_agent` with `skill_id`, `selected_ids`,
+   `paths`, `expected_outputs`, `execution_context` and `complexity`.
+   Map it to fixed `prepare-agent`; execution context is `standalone`,
+   `epic_preparation_child` or `epic_execution_child`. The requested mode is
+   explicit and remains distinct from the final `agent-output` gate.
+   Use `skill_id=extract-feature-contract`; workflow inputs do not add wire fields.
+3. The root launches that exact deployment. Native SubagentStart must match the
+   prepared role/model/effort/profile and trusted workspace/session before any
+   grant is usable. Missing capability or attestation blocks the action.
+4. Use only the granted operations. Use `read_discovery_source`, mapped to bounded `read-source`, for selected inputs. Use `create_discovery_artifact` for fixed `new-contract`, `update_discovery_artifact` for ordinary `update-artifact`, and `link_discovery_evidence` for `link-evidence`, only for exact prepared outputs. Do not infer source truth from a filename or a desired target behavior.
+5. Account for every selected component/feature ID. Distinguish verified observations, inference and unknown facts; preserve precise source/evidence references and unresolved questions. Record unknown or contradictory behavior as unresolved. Never convert source facts into approved target requirements. Update only the selected coverage dispositions justified by inspection. Do not invent product decisions, target implementation evidence or successful runtime results.
+6. Produce every exact required output and the stored `required-output-manifest`,
+   preserving its output array order for the digest. Validate claims, references,
+   pins and selected-ID accounting. Purpose-built tools supply authorized proposal
+   inputs for `input_path`/`evidence_path`; never invent a generic Write staging
+   step. Server-side role checks, exact one-use authorization and prospective
+   validation remain mandatory. Bounded source reads preserve content identity
+   and line ranges; truncation requires a narrower selection, not a completeness
+   claim or filesystem fallback.
+7. Call `finalize_discovery_agent` as the specialist, mapped to `finalize-agent`
+   with `mode=agent-output`, non-null `invocation_ref` and no operation inputs.
+   It validates the protected invocation's outputs, not final-message paths.
+   Native SubagentStop then verifies current output authority.
+   Missing final text cannot skip native stop validation.
+8. After native stop, the root records the explicit result, content-addressed artifact references,
+   selected-ID accounting and all findings. A successful tool call or generated
+   path alone is not evidence of completed discovery.
+
+## Stop and result
+
+Return selected contract IDs and evidence digests with unresolved work. A structurally valid draft may be useful incremental output without satisfying discovery or planning completion.
+
+Structural success is not discovery, parity or planning completion.
+Missing prepare/finalize/start/stop capability, missing outputs, invalid claims,
+unresolved required work, wrong role/model/start context or a stale/missing
+receipt blocks successful completion. Return explicit
+PASS, FAIL or BLOCKED, distinguishing valid incremental outputs from a passing
+completion gate. Missing native enforcement remains BLOCKED even when ordinary
+local-user operations can run; do not substitute CLI success for native authority.
+
+## References
+
+- [Canonical legacy-parity-analyst contract](../../../.claude/agents/legacy-parity-analyst.md)
+- Installed v2 `service-request` and `required-output-manifest` schema contracts;
+  consume them through the authoritative runtime, with no checkout-schema fallback.
+- The selected profile and pinned local artifacts supplied for this invocation;
+  references do not preload catalogs or grant access to unselected paths.

package/resources/claude-customizations/.claude/skills/feature-promotion-lifecycle/SKILL.md

@@ -47,6 +47,7 @@ When the GitHub issue already exists (it was transferred, filed before orchestra
 1. Verify the issue read-only with `gh issue view`, a `gh api` GET request, or a GitHub MCP issue read, and use its number as `${issue-num}`.
 2. Record a top-level `issue_adoption` object in the orchestrator checkpoint (`issue_num`, `issue_url`, `origin`, `verified_via`, `verified_at`, `evidence`, `waived_tools`, and, when a promotion-entry tool is waived, `potential_record`). For that waiver `potential_record` is required when `origin` is `epic_decomposition`, optional when `origin` is `transferred` or `filed_before_orchestration`, and validated whenever it is present. A valid record waives the `potential_to_issue` receipt requirement at completion.
 3. `delegation_receipts.promotion.issue` may be omitted, because no promotion receipt exists for an adopted issue.
+4. When the item's feature folder was already created and committed before this run, do not call `new_active_feature_folder` a second time. Confirm the folder read-only (`git cat-file -t HEAD:<feature-folder>` prints `tree`), list `new_active_feature_folder` in `waived_tools`, and record `issue_adoption.feature_folder_record` with `path` equal to the checkpoint `feature-folder`, `verified_via` (`git_cat_file_head` or `git_ls_tree_head`), `verified_at`, and `evidence`. The Claude stop hook re-checks that `HEAD` holds the folder.
 
 The field rules, the closed set of waivable tools, and the fail-closed behavior are defined in `.claude/rules/orchestrator-state.md` under `## Invariants (issue_adoption object)`.
 

package/resources/claude-customizations/.claude/skills/generate-acceptance-scenarios/SKILL.md

@@ -0,0 +1,132 @@
+---
+name: generate-acceptance-scenarios
+description: 'Generate traceable acceptance specifications, eligible views and explicit pending material. Use when asked to derive acceptance scenarios from confirmed contracts and approved decisions.'
+---
+
+# Generate Acceptance Scenarios
+
+## When to Use This Skill
+
+Use for an explicit acceptance selection and requested render format. Generated specifications define requirements; they do not prove implementation.
+
+## Inputs
+
+These are human-facing workflow selections, not additional service-request fields.
+Supply explicit selections; neither omitted inputs nor profile roots create authority.
+
+| Input | Required contract |
+| --- | --- |
+| profile | Required validated profile and trusted workspace binding. |
+| contract_refs | Required confirmed contract references and source pins. |
+| approved_decision_refs | Required applicable approved decisions or an explicit empty selection. |
+| kind | Required supported acceptance kind. |
+| feature_filter | Optional explicit selected features; absence uses only the prepared selection. |
+| client_filter | Optional explicit selected clients; absence uses only the prepared selection. |
+| platform_filter | Optional explicit selected platforms; preserve platform identity. |
+| mode_filter | Optional explicit selected modes; preserve declared mode identity. |
+| format | Required explicit supported render format; expected outputs bind each actual serialization format. |
+
+## Routing
+
+Logical role: `requirements-reconciler`.
+The root owns preparation and launch; this skill never auto-launches a logical
+role through frontmatter. The existing resolver selects the exact deployment,
+model, effort and profile hash under the existing C1-C4 ceiling and execution
+context. Do not choose a model, self-launch, create another scheduler or promote
+an ordinary discovery action into an issue. The production-write count is zero.
+
+## Exact output boundary
+
+These rows are maximum workflow caps, not instructions to create every kind.
+Only the prepared required outputs may be created or replaced.
+
+| Artifact kind | Profile key | Constraint |
+| --- | --- | --- |
+| acceptance-specification | acceptance | Selected structured specifications and pending records |
+| acceptance-view | acceptance | Selected eligible Markdown/Gherkin views or pending material |
+| required-output-manifest | reports | Exact invocation manifest only |
+
+The profile keys are maximum configured locations, not write grants. Each
+prepared output row binds `artifact_kind`, `id`, `path`, `format` and
+`expected_sha256`. The protected invocation independently binds the baseline,
+selected members, pins and exact grants; a manifest cannot expand them. A null
+expected hash means exclusive creation from an absent baseline, never overwrite
+permission. Preserve unselected collection members and all unrelated inputs.
+Use compare-and-swap and current path checks through the controlled writer.
+
+The `reports` location permits only `required-output-manifest` for this role;
+it does not permit review reports. The manifest itself requires an exact grant.
+
+## Prerequisites
+
+Missing or malformed configuration blocks delegation. Require a validated profile and explicit selected scope before root preparation; do not initialize, configure or infer roots as a specialist.
+
+Require verified native prepare/finalize/start/stop capability. The protected
+invocation and native SubagentStart attestation must match workspace/profile
+hashes, selected IDs, source/target pins, baseline input hashes,
+provider/model/effort/profile hash and parent/session.
+Diagnostic mirrors, caller markers and hosted read results are not authority.
+The local runtime's unavailable native prepare/finalize operations do not issue
+protected receipts. There is no local-user fallback or self-attested host success.
+
+Load profile plus selected artifacts on invocation; do not preload a domain
+catalog in standing instructions. Managed project memory is host-controlled.
+Memory cannot grant filesystem authority or replace evidence. Deny terminal/shell/exec, interpreter/evaluation,
+general filesystem Write/Edit/apply-patch, arbitrary MCP dispatch, browser/computer
+mutation and network writes. Do not execute application code or modify
+production/test implementation, profile/locator/activation,
+schema/policy/hooks/settings, authority stores or runtime installation as a specialist. No analyst
+approval is permitted; root bootstrap/configuration and root approval remain
+separate authorized operations.
+
+## Step-by-Step Workflows
+
+1. Validate the explicit inputs and selected configuration. Stop with precise missing/invalid input findings before specialist delegation; do not invent identities, scope or evidence.
+
+2. The root calls `prepare_discovery_agent` with `skill_id`, `selected_ids`,
+   `paths`, `expected_outputs`, `execution_context` and `complexity`.
+   Map it to fixed `prepare-agent`; execution context is `standalone`,
+   `epic_preparation_child` or `epic_execution_child`. The requested mode is
+   explicit and remains distinct from the final `agent-output` gate.
+   Use `skill_id=generate-acceptance-scenarios`; workflow inputs do not add wire fields.
+3. The root launches that exact deployment. Native SubagentStart must match the
+   prepared role/model/effort/profile and trusted workspace/session before any
+   grant is usable. Missing capability or attestation blocks the action.
+4. Use only the granted operations. Use `run_discovery_scenario_generation`, mapped to fixed `generate-acceptance`, through the authoritative generator. Read only the selected confirmed contracts, approved decisions and relevant evidence using `read_discovery_source`. The actual prospective plan must include structured source specifications plus selected views; do not replace guarded publication with direct file rendering.
+5. Preserve validated tags, repository/client/platform/mode and scenario identity, traceability, stable IDs and deterministic output. Keep null unresolved expectations and explicit pending material. Emit eligible Markdown/Gherkin views only; a pending specification cannot become ready through a format change. Derived criteria do not authorize `feature_contracts` writes. Do not alter observed source facts, approve decisions or check off implementation criteria; generated specifications are not implementation or runtime evidence.
+6. Produce every exact required output and the stored `required-output-manifest`,
+   preserving its output array order for the digest. Validate claims, references,
+   pins and selected-ID accounting. Purpose-built tools supply authorized proposal
+   inputs for `input_path`/`evidence_path`; never invent a generic Write staging
+   step. Server-side role checks, exact one-use authorization and prospective
+   validation remain mandatory. Bounded source reads preserve content identity
+   and line ranges; truncation requires a narrower selection, not a completeness
+   claim or filesystem fallback.
+7. Call `finalize_discovery_agent` as the specialist, mapped to `finalize-agent`
+   with `mode=agent-output`, non-null `invocation_ref` and no operation inputs.
+   It validates the protected invocation's outputs, not final-message paths.
+   Native SubagentStop then verifies current output authority.
+   Missing final text cannot skip native stop validation.
+8. After native stop, the root records the explicit result, content-addressed artifact references,
+   selected-ID accounting and all findings. A successful tool call or generated
+   path alone is not evidence of completed discovery.
+
+## Stop and result
+
+Return structured ready and pending counts, content-addressed records/views and findings. Generated acceptance specifications are not implementation or runtime evidence and do not satisfy completion by themselves.
+
+Structural success is not discovery, parity or planning completion.
+Missing prepare/finalize/start/stop capability, missing outputs, invalid claims,
+unresolved required work, wrong role/model/start context or a stale/missing
+receipt blocks successful completion. Return explicit
+PASS, FAIL or BLOCKED, distinguishing valid incremental outputs from a passing
+completion gate. Missing native enforcement remains BLOCKED even when ordinary
+local-user operations can run; do not substitute CLI success for native authority.
+
+## References
+
+- [Canonical requirements-reconciler contract](../../../.claude/agents/requirements-reconciler.md)
+- Installed v2 `service-request` and `required-output-manifest` schema contracts;
+  consume them through the authoritative runtime, with no checkout-schema fallback.
+- The selected profile and pinned local artifacts supplied for this invocation;
+  references do not preload catalogs or grant access to unselected paths.

package/resources/claude-customizations/.claude/skills/initialize-discovery-workspace/SKILL.md

@@ -0,0 +1,131 @@
+---
+name: initialize-discovery-workspace
+description: 'Initialize or explicitly configure a discovery workspace through root-owned operations before constrained review. Use when asked to bootstrap a discovery workspace or preview its initial structure.'
+---
+
+# Initialize Discovery Workspace
+
+## When to Use This Skill
+
+Use when a workspace needs explicit bootstrap inputs or controlled configuration. Missing initial configuration is allowed only for the root bootstrap stage.
+
+## Inputs
+
+These are human-facing workflow selections, not additional service-request fields.
+Supply explicit selections; neither omitted inputs nor profile roots create authority.
+
+| Input | Required contract |
+| --- | --- |
+| system_id | Required explicit system identity, independently of system_name. |
+| system_name | Required explicit display name; do not infer it from repository paths. |
+| repository_id | Required explicit repository identity. |
+| repository_role | Required explicit supported repository role. |
+| roots | Required explicit source/test/documentation and other applicable roots, or honest draft choices. |
+| draft_inputs | Optional explicit draft/unknown inputs when completeness is not established. |
+| dry_run | Required explicit preview intent; dry-run creates no configuration or authority. |
+| profile_selection | Optional explicit profile selection for root configure; no ancestor or checkout inference. |
+
+## Routing
+
+Logical role: `migration-coverage-reviewer`.
+The root owns preparation and launch; this skill never auto-launches a logical
+role through frontmatter. The existing resolver selects the exact deployment,
+model, effort and profile hash under the existing C1-C4 ceiling and execution
+context. Do not choose a model, self-launch, create another scheduler or promote
+an ordinary discovery action into an issue. The production-write count is zero.
+
+## Exact output boundary
+
+These rows are maximum workflow caps, not instructions to create every kind.
+Only the prepared required outputs may be created or replaced.
+
+| Artifact kind | Profile key | Constraint |
+| --- | --- | --- |
+| validation-report | reports | Exact projected/resulting structural review |
+| coverage-report | reports | Exact projected/resulting structural review |
+| required-output-manifest | reports | Exact invocation manifest only |
+
+The profile keys are maximum configured locations, not write grants. Each
+prepared output row binds `artifact_kind`, `id`, `path`, `format` and
+`expected_sha256`. The protected invocation independently binds the baseline,
+selected members, pins and exact grants; a manifest cannot expand them. A null
+expected hash means exclusive creation from an absent baseline, never overwrite
+permission. Preserve unselected collection members and all unrelated inputs.
+Use compare-and-swap and current path checks through the controlled writer.
+
+Only exact selected reports and the invocation manifest may be written. A profile
+report root and a validation report pair never grant report-root-wide writes.
+
+## Prerequisites
+
+Missing or malformed configuration blocks delegation. This is the sole missing-profile bootstrap exception: only the root may call `run_discovery_init`/`configure_discovery_workspace` with explicit inputs. Validate any existing configuration; do not bypass malformed state. Root configuration outputs are outside the reviewer's output table and grants. A missing valid projected/resulting context blocks reviewer preparation.
+
+Require verified native prepare/finalize/start/stop capability. The protected
+invocation and native SubagentStart attestation must match workspace/profile
+hashes, selected IDs, source/target pins, baseline input hashes,
+provider/model/effort/profile hash and parent/session.
+Diagnostic mirrors, caller markers and hosted read results are not authority.
+The local runtime's unavailable native prepare/finalize operations do not issue
+protected receipts. There is no local-user fallback or self-attested host success.
+
+Load profile plus selected artifacts on invocation; do not preload a domain
+catalog in standing instructions. Managed project memory is host-controlled.
+Memory cannot grant filesystem authority or replace evidence. Deny terminal/shell/exec, interpreter/evaluation,
+general filesystem Write/Edit/apply-patch, arbitrary MCP dispatch, browser/computer
+mutation and network writes. Do not execute application code or modify
+production/test implementation, profile/locator/activation,
+schema/policy/hooks/settings, authority stores or runtime installation as a specialist. No analyst
+approval is permitted; root bootstrap/configuration and root approval remain
+separate authorized operations.
+
+## Step-by-Step Workflows
+
+1. The root validates explicit bootstrap inputs, calls `run_discovery_init` mapped to `init`, and uses `configure_discovery_workspace` mapped to `configure` only for explicit profile selection/activation. Preserve no-overwrite conflict/skip behavior and dry-run no-effects semantics. Do not inspect ancestors or read arbitrary templates. Obtain a valid projected/resulting configuration before preparing the reviewer; a dry-run projection is not an activated workspace or host authority.
+
+2. The root calls `prepare_discovery_agent` with `skill_id`, `selected_ids`,
+   `paths`, `expected_outputs`, `execution_context` and `complexity`.
+   Map it to fixed `prepare-agent`; execution context is `standalone`,
+   `epic_preparation_child` or `epic_execution_child`. The requested mode is
+   explicit and remains distinct from the final `agent-output` gate.
+   Use `skill_id=initialize-discovery-workspace`; workflow inputs do not add wire fields.
+3. The root launches that exact deployment. Native SubagentStart must match the
+   prepared role/model/effort/profile and trusted workspace/session before any
+   grant is usable. Missing capability or attestation blocks the action.
+4. Use only the granted operations. After root bootstrap, the reviewer uses `validate_discovery_artifacts` for the exact projected/resulting structural review and its selected report pair. The reviewer writes exact reports, never configuration, and never receives profile, locator, activation, authority or installation writes. If the native provider cannot prepare a review for the valid projected context, return BLOCKED instead of inventing a persisted profile.
+5. A truthful initialized draft may pass structural validation while discovery-complete, parity-complete and planning remain blocked. Review only root-supplied projected/resulting inputs and exact reports; preserve draft/unknown markers and empty-scope distinctions. Root local-user CLI success cannot serve as a native reviewer invocation or protected receipt.
+6. Produce every exact required output and the stored `required-output-manifest`,
+   preserving its output array order for the digest. Validate claims, references,
+   pins and selected-ID accounting. Purpose-built tools supply authorized proposal
+   inputs for `input_path`/`evidence_path`; never invent a generic Write staging
+   step. Server-side role checks, exact one-use authorization and prospective
+   validation remain mandatory. Bounded source reads preserve content identity
+   and line ranges; truncation requires a narrower selection, not a completeness
+   claim or filesystem fallback.
+7. Call `finalize_discovery_agent` as the specialist, mapped to `finalize-agent`
+   with `mode=agent-output`, non-null `invocation_ref` and no operation inputs.
+   It validates the protected invocation's outputs, not final-message paths.
+   Native SubagentStop then verifies current output authority.
+   Missing final text cannot skip native stop validation.
+8. After native stop, the root records the explicit result, content-addressed artifact references,
+   selected-ID accounting and all findings. A successful tool call or generated
+   path alone is not evidence of completed discovery.
+
+## Stop and result
+
+Return root initialization/configuration results and the separately authorized reviewer result. If a preview leaves required stored outputs absent, finalization remains blocked; never fabricate writes or receipts. A dry-run or draft structure is not completed discovery; unavailable reviewer capability remains an explicit block even if root bootstrap succeeded.
+
+Structural success is not discovery, parity or planning completion.
+Missing prepare/finalize/start/stop capability, missing outputs, invalid claims,
+unresolved required work, wrong role/model/start context or a stale/missing
+receipt blocks successful completion. Return explicit
+PASS, FAIL or BLOCKED, distinguishing valid incremental outputs from a passing
+completion gate. Missing native enforcement remains BLOCKED even when ordinary
+local-user operations can run; do not substitute CLI success for native authority.
+
+## References
+
+- [Canonical migration-coverage-reviewer contract](../../../.claude/agents/migration-coverage-reviewer.md)
+- Installed v2 `service-request` and `required-output-manifest` schema contracts;
+  consume them through the authoritative runtime, with no checkout-schema fallback.
+- The selected profile and pinned local artifacts supplied for this invocation;
+  references do not preload catalogs or grant access to unselected paths.

package/resources/claude-customizations/.claude/skills/inventory-legacy-system/SKILL.md

@@ -0,0 +1,131 @@
+---
+name: inventory-legacy-system
+description: 'Inventory selected legacy repository surfaces with explicit analyzer scope and truthful coverage dispositions. Use when asked to inventory a legacy system or refresh selected discovery coverage.'
+---
+
+# Inventory Legacy System
+
+## When to Use This Skill
+
+Use for an explicit selected repository inventory or an incremental inventory refresh. Detection identifies candidates; it does not establish inspected behavior.
+
+## Inputs
+
+These are human-facing workflow selections, not additional service-request fields.
+Supply explicit selections; neither omitted inputs nor profile roots create authority.
+
+| Input | Required contract |
+| --- | --- |
+| profile | Required validated profile and trusted workspace binding. |
+| scope | Required confirmed or draft scope with selected component IDs and roots. |
+| analyzer_ids | Required explicit supported analyzer selection; no arbitrary plugin or module. |
+| write | Required explicit publication intent; it grants no paths by itself. |
+| dry_run | Required explicit preview intent; preserve the request's no-write result. |
+
+## Routing
+
+Logical role: `legacy-parity-analyst`.
+The root owns preparation and launch; this skill never auto-launches a logical
+role through frontmatter. The existing resolver selects the exact deployment,
+model, effort and profile hash under the existing C1-C4 ceiling and execution
+context. Do not choose a model, self-launch, create another scheduler or promote
+an ordinary discovery action into an issue. The production-write count is zero.
+
+## Exact output boundary
+
+These rows are maximum workflow caps, not instructions to create every kind.
+Only the prepared required outputs may be created or replaced.
+
+| Artifact kind | Profile key | Constraint |
+| --- | --- | --- |
+| inventory-snapshot | inventory | Requested inventory scope only |
+| coverage-ledger | coverage_ledger | Selected component members only |
+| evidence-reference | evidence | Explicitly granted observations only |
+| unspecified-behavior | unspecified_behaviors | Selected unresolved IDs only |
+| unspecified-behavior-collection | unspecified_behaviors | Selected unresolved members only |
+| required-output-manifest | reports | Exact invocation manifest only |
+
+The profile keys are maximum configured locations, not write grants. Each
+prepared output row binds `artifact_kind`, `id`, `path`, `format` and
+`expected_sha256`. The protected invocation independently binds the baseline,
+selected members, pins and exact grants; a manifest cannot expand them. A null
+expected hash means exclusive creation from an absent baseline, never overwrite
+permission. Preserve unselected collection members and all unrelated inputs.
+Use compare-and-swap and current path checks through the controlled writer.
+
+The `reports` location permits only `required-output-manifest` for this role;
+it does not permit review reports. The manifest itself requires an exact grant.
+
+## Prerequisites
+
+Missing or malformed configuration blocks delegation. Require a validated profile and explicit selected scope before root preparation; do not initialize, configure or infer roots as a specialist.
+
+Require verified native prepare/finalize/start/stop capability. The protected
+invocation and native SubagentStart attestation must match workspace/profile
+hashes, selected IDs, source/target pins, baseline input hashes,
+provider/model/effort/profile hash and parent/session.
+Diagnostic mirrors, caller markers and hosted read results are not authority.
+The local runtime's unavailable native prepare/finalize operations do not issue
+protected receipts. There is no local-user fallback or self-attested host success.
+
+Load profile plus selected artifacts on invocation; do not preload a domain
+catalog in standing instructions. Managed project memory is host-controlled.
+Memory cannot grant filesystem authority or replace evidence. Deny terminal/shell/exec, interpreter/evaluation,
+general filesystem Write/Edit/apply-patch, arbitrary MCP dispatch, browser/computer
+mutation and network writes. Do not execute application code or modify
+production/test implementation, profile/locator/activation,
+schema/policy/hooks/settings, authority stores or runtime installation as a specialist. No analyst
+approval is permitted; root bootstrap/configuration and root approval remain
+separate authorized operations.
+
+## Step-by-Step Workflows
+
+1. Validate the explicit inputs and selected configuration. Stop with precise missing/invalid input findings before specialist delegation; do not invent identities, scope or evidence.
+
+2. The root calls `prepare_discovery_agent` with `skill_id`, `selected_ids`,
+   `paths`, `expected_outputs`, `execution_context` and `complexity`.
+   Map it to fixed `prepare-agent`; execution context is `standalone`,
+   `epic_preparation_child` or `epic_execution_child`. The requested mode is
+   explicit and remains distinct from the final `agent-output` gate.
+   Use `skill_id=inventory-legacy-system`; workflow inputs do not add wire fields.
+3. The root launches that exact deployment. Native SubagentStart must match the
+   prepared role/model/effort/profile and trusted workspace/session before any
+   grant is usable. Missing capability or attestation blocks the action.
+4. Use only the granted operations. Use `run_discovery_repo_inventory`, mapped to fixed `inventory`, with the explicit analyzer selection and write/dry-run intent. Use bounded `read_discovery_source` only for selected supporting inspection, and ordinary controlled updates or evidence links only for the listed granted outputs. Do not run application code, compiler evaluation, package restore or an arbitrary analyzer.
+5. Record detected paths, hashes, classifications and explicit analyzer limitations. Detection alone never marks a component inspected or dispositioned. Preserve unselected coverage members; do not silently shrink scope or infer a confirmed-empty inventory from a failed read. Missing facts or contradictory evidence become unresolved records. Inventory and coverage observations do not approve target requirements.
+6. Produce every exact required output and the stored `required-output-manifest`,
+   preserving its output array order for the digest. Validate claims, references,
+   pins and selected-ID accounting. Purpose-built tools supply authorized proposal
+   inputs for `input_path`/`evidence_path`; never invent a generic Write staging
+   step. Server-side role checks, exact one-use authorization and prospective
+   validation remain mandatory. Bounded source reads preserve content identity
+   and line ranges; truncation requires a narrower selection, not a completeness
+   claim or filesystem fallback.
+7. Call `finalize_discovery_agent` as the specialist, mapped to `finalize-agent`
+   with `mode=agent-output`, non-null `invocation_ref` and no operation inputs.
+   It validates the protected invocation's outputs, not final-message paths.
+   Native SubagentStop then verifies current output authority.
+   Missing final text cannot skip native stop validation.
+8. After native stop, the root records the explicit result, content-addressed artifact references,
+   selected-ID accounting and all findings. A successful tool call or generated
+   path alone is not evidence of completed discovery.
+
+## Stop and result
+
+Account for each selected component and requested analyzer. If a dry-run leaves required stored outputs absent, finalization remains blocked; never fabricate writes or receipts. A valid incremental inventory is not discovery-complete, parity-complete or planning authority.
+
+Structural success is not discovery, parity or planning completion.
+Missing prepare/finalize/start/stop capability, missing outputs, invalid claims,
+unresolved required work, wrong role/model/start context or a stale/missing
+receipt blocks successful completion. Return explicit
+PASS, FAIL or BLOCKED, distinguishing valid incremental outputs from a passing
+completion gate. Missing native enforcement remains BLOCKED even when ordinary
+local-user operations can run; do not substitute CLI success for native authority.
+
+## References
+
+- [Canonical legacy-parity-analyst contract](../../../.claude/agents/legacy-parity-analyst.md)
+- Installed v2 `service-request` and `required-output-manifest` schema contracts;
+  consume them through the authoritative runtime, with no checkout-schema fallback.
+- The selected profile and pinned local artifacts supplied for this invocation;
+  references do not preload catalogs or grant access to unselected paths.