@danmoisan/drm-copilot-mcp 1.1.22 → 1.1.24

package/resources/claude-customizations/.claude/skills/pr-author/SKILL.md

@@ -40,7 +40,7 @@ Use these sections in this order:
 8. **Risks and Mitigations** — realistic risks with mitigations and rollback notes
 9. **Review Guide** — suggested order, noisy mechanical moves, large diffs
 10. **Follow-ups** — known TODOs, deferred cleanup, next PRs
-11. **GitHub Auto-close** — `- Closes #NNN` only from verified autoclose lists; do not invent issue numbers
+11. **GitHub Auto-close** — `- Closes #NNN` from the three sources in Issue/PR Reference Rules (the PR-context "Issues to autoclose" list, the PR-context "Author-asserted autoclose issues" list, and an issue named as author-asserted in the delegation prompt); `- None` only when no source has an entry; do not invent issue numbers
 
 ## Output Artifact
 
@@ -74,22 +74,69 @@ writes and the `gh pr create` / `gh pr edit --body-file` handoff.
 
 ## Issue/PR Reference Rules
 
-- Only mention an issue/PR number if it appears verbatim in the provided context.
+- Only mention an issue/PR number if it appears verbatim in the provided context or in the delegation prompt.
 - Do not treat PR numbers as issues.
-- Auto-close bullets must use exactly `- Closes #NNN` format, sourced only from "Issues to autoclose" or "Author-asserted autoclose issues."
-- If GitHub validation is unavailable/unverified, do not emit `Closes`; use the fallback `None` bullet.
+- Auto-close bullets must use exactly `- Closes #NNN` format. Three sources are valid:
+  1. the PR-context "Issues to autoclose" list;
+  2. the PR-context "Author-asserted autoclose issues" list (rendered from the PR Intent);
+  3. each issue named on the line `Author-asserted autoclose issues: #NNN [#NNN ...]` in the
+     delegation prompt; a combined parallel item (issue #1013) names every member issue on that
+     one line, and each named issue gets its own `- Closes #NNN` bullet. This source is valid even
+     when the PR context lists no verified autoclose issues.
+- Emit the fallback `- None` bullet only when no source has an entry.
+- GitHub validation applies to the two PR-context lists: if it is unavailable or unverified for
+  an entry on those lists, do not emit `Closes` for that entry. An issue named as author-asserted
+  in the delegation prompt is emitted without that validation; the closing-reference
+  verification below confirms it after the pull request exists.
+
+## Closing-Reference Verification
+
+The pr-author agent MUST run `gh pr view <N> --json closingIssuesReferences,body` as a single
+command (no chaining, no extra flags) after every `gh pr create` or `gh pr edit` it issues, where
+`<N>` is the pull request number. It reports the closing issue numbers that
+`closingIssuesReferences` lists, and reports any mismatch with the author-asserted list: an
+author-asserted issue that GitHub does not list as closing, or a closing issue that no source
+named. The command is read-only, and this exact form is the only pull-request view form the
+agent's allowlist hook permits.
 
 ## Required `--head` on `gh pr create` (issue #687)
 
 Every `gh pr create` command this agent issues MUST carry an explicit
-`--head <branch>` naming the branch the pull request is opened from.
+`--head <branch>` naming the branch the pull request is opened from, for example
+`gh pr create --head <branch> --body-file artifacts/pr_body_<N>.md`.
 
 This is what makes the call's target derivable. `enforce-pr-author-skill.ps1` resolves the
 worktree the call pertains to from the command text, and validates the orchestrator checkpoint
 belonging to that worktree. Without `--head`, `gh pr create` infers its head branch from the
-current checkout and the command carries no signal at all, so the gate denies with
-`TARGET_WORKTREE_NOT_DERIVABLE` rather than validating against whichever checkpoint occupies the
-session root, which in a parallel or epic topology belongs to a different item.
+current checkout and the command carries no signal at all, so the gate falls back to the branch
+checked out in its own working directory (issue #989) and denies with
+`TARGET_WORKTREE_NOT_DERIVABLE` when that checkout is detached or unreadable, rather than
+validating against whichever checkpoint occupies the session root, which in a parallel or epic
+topology belongs to a different item.
 
 Pass `--head` even when the branch is the current one: the gate resolves it to the session root
-and behaves exactly as before, and the command stays correct if it is ever replayed elsewhere.
+and behaves exactly as before, and the command stays correct if it is ever replayed elsewhere.
+
+`gh pr edit` takes no head-branch flag, and --head is not valid for gh pr edit. Name the target of
+an edit in one of two ways:
+
+- Run `gh pr edit <N> --body-file artifacts/pr_body_<N>.md` from the item worktree. The gate
+  derives the branch from that worktree's checkout.
+- When running outside the item worktree, append the shell comment `# branch: <branch>` to the
+  command, and pass the absolute canonical body path beneath the item worktree.
+
+## Coordinator-Session Topology (issue #1011)
+
+When the process directory is not the item worktree (for example, when the orchestrator delegates
+from a coordinator session rooted in another checkout), a relative `artifacts/` path resolves to the
+wrong checkout. In that topology, use this procedure instead of the relative forms above:
+
+1. Run `git worktree list --porcelain` as a single command. Select the `worktree` entry whose `branch refs/heads/<branch>` line names the `--head` branch, and use that entry's absolute root, written with forward slashes, as `<item worktree>`. If zero or more than one entry matches, stop and report the result; do not choose a root.
+2. Confirm that the PR context summary already exists at `<item worktree>/artifacts/pr_context.summary.txt`. The orchestrator produces it; pr-author does not call `collect_pr_context`.
+3. Write the body to `<item worktree>/artifacts/pr_body_<N>.md` by absolute path.
+4. Run `sha256sum <item worktree>/artifacts/pr_body_<N>.md` as a single command and take the lowercase hexadecimal digest.
+5. Write the receipt to `<item worktree>/artifacts/pr_body_<N>.receipt.json` by absolute path. Keep `pr_body_path` and `context_summary_path` repo-relative (`artifacts/pr_body_<N>.md` and `artifacts/pr_context.summary.txt`), so no absolute path is recorded in the receipt. The receipt `created_at` must be strictly newer than the last-write time of the summary.
+6. Run `gh pr create --head <branch> --body-file <item worktree>/artifacts/pr_body_<N>.md`. The gate resolves the item worktree from `--head` and verifies the body and receipt beneath it; in this topology it denies a relative `--body-file` with `PR_BODY_PATH_NONCANONICAL`.
+
+In this topology pr-author is delegated without worktree isolation, because an isolated agent
+worktree refuses command text that names another worktree.

package/resources/claude-customizations/.claude/skills/reconcile-parity-matrix/SKILL.md

@@ -0,0 +1,131 @@
+---
+name: reconcile-parity-matrix
+description: 'Reconcile selected feature and client parity against pinned source facts and target evidence. Use when asked to update a parity matrix or identify migration gaps without changing approved decisions.'
+---
+
+# Reconcile Parity Matrix
+
+## When to Use This Skill
+
+Use for selected feature/client comparisons against immutable source snapshot references and explicit target evidence.
+
+## Inputs
+
+These are human-facing workflow selections, not additional service-request fields.
+Supply explicit selections; neither omitted inputs nor profile roots create authority.
+
+| Input | Required contract |
+| --- | --- |
+| profile | Required validated profile and trusted workspace binding. |
+| source_snapshot_refs | Required immutable source snapshot references and content pins. |
+| feature_ids | Required explicit selected feature mappings. |
+| client_ids | Required explicit selected target clients. |
+| target_implementation_refs | Required selected implementation records or explicit missing-state references. |
+| evidence_refs | Required selected verification evidence or explicit unavailable state. |
+| approved_decision_refs | Required applicable approved decisions or an explicit empty selection. |
+
+## Routing
+
+Logical role: `requirements-reconciler`.
+The root owns preparation and launch; this skill never auto-launches a logical
+role through frontmatter. The existing resolver selects the exact deployment,
+model, effort and profile hash under the existing C1-C4 ceiling and execution
+context. Do not choose a model, self-launch, create another scheduler or promote
+an ordinary discovery action into an issue. The production-write count is zero.
+
+## Exact output boundary
+
+These rows are maximum workflow caps, not instructions to create every kind.
+Only the prepared required outputs may be created or replaced.
+
+| Artifact kind | Profile key | Constraint |
+| --- | --- | --- |
+| parity-matrix | parity_matrix | Selected feature/client entries only |
+| unspecified-behavior | unspecified_behaviors | Selected unresolved IDs only |
+| unspecified-behavior-collection | unspecified_behaviors | Selected unresolved members only |
+| required-output-manifest | reports | Exact invocation manifest only |
+
+The profile keys are maximum configured locations, not write grants. Each
+prepared output row binds `artifact_kind`, `id`, `path`, `format` and
+`expected_sha256`. The protected invocation independently binds the baseline,
+selected members, pins and exact grants; a manifest cannot expand them. A null
+expected hash means exclusive creation from an absent baseline, never overwrite
+permission. Preserve unselected collection members and all unrelated inputs.
+Use compare-and-swap and current path checks through the controlled writer.
+
+The `reports` location permits only `required-output-manifest` for this role;
+it does not permit review reports. The manifest itself requires an exact grant.
+
+## Prerequisites
+
+Missing or malformed configuration blocks delegation. Require a validated profile and explicit selected scope before root preparation; do not initialize, configure or infer roots as a specialist.
+
+Require verified native prepare/finalize/start/stop capability. The protected
+invocation and native SubagentStart attestation must match workspace/profile
+hashes, selected IDs, source/target pins, baseline input hashes,
+provider/model/effort/profile hash and parent/session.
+Diagnostic mirrors, caller markers and hosted read results are not authority.
+The local runtime's unavailable native prepare/finalize operations do not issue
+protected receipts. There is no local-user fallback or self-attested host success.
+
+Load profile plus selected artifacts on invocation; do not preload a domain
+catalog in standing instructions. Managed project memory is host-controlled.
+Memory cannot grant filesystem authority or replace evidence. Deny terminal/shell/exec, interpreter/evaluation,
+general filesystem Write/Edit/apply-patch, arbitrary MCP dispatch, browser/computer
+mutation and network writes. Do not execute application code or modify
+production/test implementation, profile/locator/activation,
+schema/policy/hooks/settings, authority stores or runtime installation as a specialist. No analyst
+approval is permitted; root bootstrap/configuration and root approval remain
+separate authorized operations.
+
+## Step-by-Step Workflows
+
+1. Validate the explicit inputs and selected configuration. Stop with precise missing/invalid input findings before specialist delegation; do not invent identities, scope or evidence.
+
+2. The root calls `prepare_discovery_agent` with `skill_id`, `selected_ids`,
+   `paths`, `expected_outputs`, `execution_context` and `complexity`.
+   Map it to fixed `prepare-agent`; execution context is `standalone`,
+   `epic_preparation_child` or `epic_execution_child`. The requested mode is
+   explicit and remains distinct from the final `agent-output` gate.
+   Use `skill_id=reconcile-parity-matrix`; workflow inputs do not add wire fields.
+3. The root launches that exact deployment. Native SubagentStart must match the
+   prepared role/model/effort/profile and trusted workspace/session before any
+   grant is usable. Missing capability or attestation blocks the action.
+4. Use only the granted operations. Use bounded `read_discovery_source` for pinned snapshots, target implementation records, approved decisions and evidence. Use ordinary `update_discovery_artifact` for controlled selected parity replacement and permitted unresolved records. `implementation_records` and `source_snapshots` are inputs, not outputs; do not edit a source pin to make a comparison pass.
+5. Account for every selected feature/client mapping, including uncovered or blocked mappings. Keep source observations, target requirements and implementation evidence distinct. Intentional changes or retirements must link to the applicable approved decision. Preserve approved decision history and unrelated parity members. Pending questions cannot become approved requirements, and derived criteria do not authorize `feature_contracts` writes.
+6. Produce every exact required output and the stored `required-output-manifest`,
+   preserving its output array order for the digest. Validate claims, references,
+   pins and selected-ID accounting. Purpose-built tools supply authorized proposal
+   inputs for `input_path`/`evidence_path`; never invent a generic Write staging
+   step. Server-side role checks, exact one-use authorization and prospective
+   validation remain mandatory. Bounded source reads preserve content identity
+   and line ranges; truncation requires a narrower selection, not a completeness
+   claim or filesystem fallback.
+7. Call `finalize_discovery_agent` as the specialist, mapped to `finalize-agent`
+   with `mode=agent-output`, non-null `invocation_ref` and no operation inputs.
+   It validates the protected invocation's outputs, not final-message paths.
+   Native SubagentStop then verifies current output authority.
+   Missing final text cannot skip native stop validation.
+8. After native stop, the root records the explicit result, content-addressed artifact references,
+   selected-ID accounting and all findings. A successful tool call or generated
+   path alone is not evidence of completed discovery.
+
+## Stop and result
+
+Return explicit parity findings and unresolved mappings. A valid incremental parity update does not authorize parity-complete or planning without the requested authoritative gate.
+
+Structural success is not discovery, parity or planning completion.
+Missing prepare/finalize/start/stop capability, missing outputs, invalid claims,
+unresolved required work, wrong role/model/start context or a stale/missing
+receipt blocks successful completion. Return explicit
+PASS, FAIL or BLOCKED, distinguishing valid incremental outputs from a passing
+completion gate. Missing native enforcement remains BLOCKED even when ordinary
+local-user operations can run; do not substitute CLI success for native authority.
+
+## References
+
+- [Canonical requirements-reconciler contract](../../../.claude/agents/requirements-reconciler.md)
+- Installed v2 `service-request` and `required-output-manifest` schema contracts;
+  consume them through the authoritative runtime, with no checkout-schema fallback.
+- The selected profile and pinned local artifacts supplied for this invocation;
+  references do not preload catalogs or grant access to unselected paths.

package/resources/claude-customizations/.claude/skills/review-discovery-coverage/SKILL.md

@@ -0,0 +1,129 @@
+---
+name: review-discovery-coverage
+description: 'Review selected discovery coverage and parity with authoritative reports and explicit findings. Use when asked for a structural, discovery-complete or parity-complete review.'
+---
+
+# Review Discovery Coverage
+
+## When to Use This Skill
+
+Use for a requested review of configured scope or a pinned snapshot. The reviewer reports readiness without editing underlying facts.
+
+## Inputs
+
+These are human-facing workflow selections, not additional service-request fields.
+Supply explicit selections; neither omitted inputs nor profile roots create authority.
+
+| Input | Required contract |
+| --- | --- |
+| profile | Required validated profile and trusted workspace binding. |
+| scope | Required exact requested scope or explicit whole configured graph. |
+| snapshot | Required selected current/pinned snapshot identity for the review. |
+| mode | Required explicit structural, discovery-complete or parity-complete review mode. |
+
+## Routing
+
+Logical role: `migration-coverage-reviewer`.
+The root owns preparation and launch; this skill never auto-launches a logical
+role through frontmatter. The existing resolver selects the exact deployment,
+model, effort and profile hash under the existing C1-C4 ceiling and execution
+context. Do not choose a model, self-launch, create another scheduler or promote
+an ordinary discovery action into an issue. The production-write count is zero.
+
+## Exact output boundary
+
+These rows are maximum workflow caps, not instructions to create every kind.
+Only the prepared required outputs may be created or replaced.
+
+| Artifact kind | Profile key | Constraint |
+| --- | --- | --- |
+| coverage-report | reports | Exact requested scope and mode |
+| parity-report | reports | Exact requested scope and mode |
+| completion-report | reports | Exact requested scope and mode |
+| validation-report | reports | Exact requested selection and mode |
+| required-output-manifest | reports | Exact invocation manifest only |
+
+The profile keys are maximum configured locations, not write grants. Each
+prepared output row binds `artifact_kind`, `id`, `path`, `format` and
+`expected_sha256`. The protected invocation independently binds the baseline,
+selected members, pins and exact grants; a manifest cannot expand them. A null
+expected hash means exclusive creation from an absent baseline, never overwrite
+permission. Preserve unselected collection members and all unrelated inputs.
+Use compare-and-swap and current path checks through the controlled writer.
+
+Only exact selected reports and the invocation manifest may be written. A profile
+report root and a validation report pair never grant report-root-wide writes.
+
+## Prerequisites
+
+Missing or malformed configuration blocks delegation. Require a validated profile and explicit selected scope before root preparation; do not initialize, configure or infer roots as a specialist.
+
+Require verified native prepare/finalize/start/stop capability. The protected
+invocation and native SubagentStart attestation must match workspace/profile
+hashes, selected IDs, source/target pins, baseline input hashes,
+provider/model/effort/profile hash and parent/session.
+Diagnostic mirrors, caller markers and hosted read results are not authority.
+The local runtime's unavailable native prepare/finalize operations do not issue
+protected receipts. There is no local-user fallback or self-attested host success.
+
+Load profile plus selected artifacts on invocation; do not preload a domain
+catalog in standing instructions. Managed project memory is host-controlled.
+Memory cannot grant filesystem authority or replace evidence. Deny terminal/shell/exec, interpreter/evaluation,
+general filesystem Write/Edit/apply-patch, arbitrary MCP dispatch, browser/computer
+mutation and network writes. Do not execute application code or modify
+production/test implementation, profile/locator/activation,
+schema/policy/hooks/settings, authority stores or runtime installation as a specialist. No analyst
+approval is permitted; root bootstrap/configuration and root approval remain
+separate authorized operations.
+
+## Step-by-Step Workflows
+
+1. Validate the explicit inputs and selected configuration. Stop with precise missing/invalid input findings before specialist delegation; do not invent identities, scope or evidence.
+
+2. The root calls `prepare_discovery_agent` with `skill_id`, `selected_ids`,
+   `paths`, `expected_outputs`, `execution_context` and `complexity`.
+   Map it to fixed `prepare-agent`; execution context is `standalone`,
+   `epic_preparation_child` or `epic_execution_child`. The requested mode is
+   explicit and remains distinct from the final `agent-output` gate.
+   Use `skill_id=review-discovery-coverage`; workflow inputs do not add wire fields.
+3. The root launches that exact deployment. Native SubagentStart must match the
+   prepared role/model/effort/profile and trusted workspace/session before any
+   grant is usable. Missing capability or attestation blocks the action.
+4. Use only the granted operations. Use `validate_discovery_artifacts` and `run_discovery_report` through the authoritative fixed validation/report operations in the requested mode. Use bounded `read_discovery_source` for selected supporting inputs only. Do not guess artifact types by first-success validation. Do not create a second graph/schema engine or infer readiness from report existence.
+5. At least one required report must be recomputable structured JSON in the invocation's requested review mode. Preserve all findings for the requested scope and explicit PASS/FAIL. Do not update inventory, coverage ledger, contracts, parity entries, evidence, decisions or configuration to force a pass. The validate-all canonical report pair does not grant report-root-wide writes.
+6. Produce every exact required output and the stored `required-output-manifest`,
+   preserving its output array order for the digest. Validate claims, references,
+   pins and selected-ID accounting. Purpose-built tools supply authorized proposal
+   inputs for `input_path`/`evidence_path`; never invent a generic Write staging
+   step. Server-side role checks, exact one-use authorization and prospective
+   validation remain mandatory. Bounded source reads preserve content identity
+   and line ranges; truncation requires a narrower selection, not a completeness
+   claim or filesystem fallback.
+7. Call `finalize_discovery_agent` as the specialist, mapped to `finalize-agent`
+   with `mode=agent-output`, non-null `invocation_ref` and no operation inputs.
+   It validates the protected invocation's outputs, not final-message paths.
+   Native SubagentStop then verifies current output authority.
+   Missing final text cannot skip native stop validation.
+8. After native stop, the root records the explicit result, content-addressed artifact references,
+   selected-ID accounting and all findings. A successful tool call or generated
+   path alone is not evidence of completed discovery.
+
+## Stop and result
+
+A valid FAIL report may finish as `output-valid/result-fail`; it never authorizes discovery, parity or planning completion. Missing required reports still block output validity. Review status and completion authority remain separate.
+
+Structural success is not discovery, parity or planning completion.
+Missing prepare/finalize/start/stop capability, missing outputs, invalid claims,
+unresolved required work, wrong role/model/start context or a stale/missing
+receipt blocks successful completion. Return explicit
+PASS, FAIL or BLOCKED, distinguishing valid incremental outputs from a passing
+completion gate. Missing native enforcement remains BLOCKED even when ordinary
+local-user operations can run; do not substitute CLI success for native authority.
+
+## References
+
+- [Canonical migration-coverage-reviewer contract](../../../.claude/agents/migration-coverage-reviewer.md)
+- Installed v2 `service-request` and `required-output-manifest` schema contracts;
+  consume them through the authoritative runtime, with no checkout-schema fallback.
+- The selected profile and pinned local artifacts supplied for this invocation;
+  references do not preload catalogs or grant access to unselected paths.

package/resources/claude-customizations/.claude/skills/validate-discovery-artifacts/SKILL.md

@@ -0,0 +1,127 @@
+---
+name: validate-discovery-artifacts
+description: 'Validate an exact discovery artifact selection or configured graph through authoritative modes. Use when asked to validate discovery artifacts or evaluate an explicit completion or planning prerequisite.'
+---
+
+# Validate Discovery Artifacts
+
+## When to Use This Skill
+
+Use for individual artifact validation or a whole configured workspace gate with an explicit mode. Do not infer type or readiness from filenames.
+
+## Inputs
+
+These are human-facing workflow selections, not additional service-request fields.
+Supply explicit selections; neither omitted inputs nor profile roots create authority.
+
+| Input | Required contract |
+| --- | --- |
+| profile | Required validated profile and trusted workspace binding. |
+| artifact_kind | Required exact supported kind for individual validation; explicit workspace selection uses the workspace validator. |
+| selection | Required exact artifact paths/IDs or explicit whole configured workspace. |
+| mode | Required explicit structural, discovery-complete, parity-complete or planning mode, as applicable. |
+
+## Routing
+
+Logical role: `migration-coverage-reviewer`.
+The root owns preparation and launch; this skill never auto-launches a logical
+role through frontmatter. The existing resolver selects the exact deployment,
+model, effort and profile hash under the existing C1-C4 ceiling and execution
+context. Do not choose a model, self-launch, create another scheduler or promote
+an ordinary discovery action into an issue. The production-write count is zero.
+
+## Exact output boundary
+
+These rows are maximum workflow caps, not instructions to create every kind.
+Only the prepared required outputs may be created or replaced.
+
+| Artifact kind | Profile key | Constraint |
+| --- | --- | --- |
+| validation-report | reports | Exact requested selection and mode |
+| coverage-report | reports | Exact workspace validation pair when requested |
+| required-output-manifest | reports | Exact invocation manifest only |
+
+The profile keys are maximum configured locations, not write grants. Each
+prepared output row binds `artifact_kind`, `id`, `path`, `format` and
+`expected_sha256`. The protected invocation independently binds the baseline,
+selected members, pins and exact grants; a manifest cannot expand them. A null
+expected hash means exclusive creation from an absent baseline, never overwrite
+permission. Preserve unselected collection members and all unrelated inputs.
+Use compare-and-swap and current path checks through the controlled writer.
+
+Only exact selected reports and the invocation manifest may be written. A profile
+report root and a validation report pair never grant report-root-wide writes.
+
+## Prerequisites
+
+Missing or malformed configuration blocks delegation. Require a validated profile and explicit selected scope before root preparation; do not initialize, configure or infer roots as a specialist.
+
+Require verified native prepare/finalize/start/stop capability. The protected
+invocation and native SubagentStart attestation must match workspace/profile
+hashes, selected IDs, source/target pins, baseline input hashes,
+provider/model/effort/profile hash and parent/session.
+Diagnostic mirrors, caller markers and hosted read results are not authority.
+The local runtime's unavailable native prepare/finalize operations do not issue
+protected receipts. There is no local-user fallback or self-attested host success.
+
+Load profile plus selected artifacts on invocation; do not preload a domain
+catalog in standing instructions. Managed project memory is host-controlled.
+Memory cannot grant filesystem authority or replace evidence. Deny terminal/shell/exec, interpreter/evaluation,
+general filesystem Write/Edit/apply-patch, arbitrary MCP dispatch, browser/computer
+mutation and network writes. Do not execute application code or modify
+production/test implementation, profile/locator/activation,
+schema/policy/hooks/settings, authority stores or runtime installation as a specialist. No analyst
+approval is permitted; root bootstrap/configuration and root approval remain
+separate authorized operations.
+
+## Step-by-Step Workflows
+
+1. Validate the explicit inputs and selected configuration. Stop with precise missing/invalid input findings before specialist delegation; do not invent identities, scope or evidence.
+
+2. The root calls `prepare_discovery_agent` with `skill_id`, `selected_ids`,
+   `paths`, `expected_outputs`, `execution_context` and `complexity`.
+   Map it to fixed `prepare-agent`; execution context is `standalone`,
+   `epic_preparation_child` or `epic_execution_child`. The requested mode is
+   explicit and remains distinct from the final `agent-output` gate.
+   Use `skill_id=validate-discovery-artifacts`; workflow inputs do not add wire fields.
+3. The root launches that exact deployment. Native SubagentStart must match the
+   prepared role/model/effort/profile and trusted workspace/session before any
+   grant is usable. Missing capability or attestation blocks the action.
+4. Use only the granted operations. Use `validate_discovery_artifacts` for the authoritative individual validator, `validate-decisions` or `validate-all`, selected by the explicit kind/workspace request. Do not guess artifact types by first-success validation. Use `read_discovery_source` only for selected supporting inputs. The canonical validate-all pair does not authorize neighboring report writes or another schema/graph implementation.
+5. Preserve all loader/semantic findings and the exact requested mode. Require recomputable structured JSON for the reviewer output; prose or a successful individual artifact check cannot authorize a complete graph. Confirmed empty scope and explicit planning prerequisites are evaluated by the authoritative validator. Do not update inventory, coverage ledger, contracts, parity entries, evidence, decisions or configuration to force a pass.
+6. Produce every exact required output and the stored `required-output-manifest`,
+   preserving its output array order for the digest. Validate claims, references,
+   pins and selected-ID accounting. Purpose-built tools supply authorized proposal
+   inputs for `input_path`/`evidence_path`; never invent a generic Write staging
+   step. Server-side role checks, exact one-use authorization and prospective
+   validation remain mandatory. Bounded source reads preserve content identity
+   and line ranges; truncation requires a narrower selection, not a completeness
+   claim or filesystem fallback.
+7. Call `finalize_discovery_agent` as the specialist, mapped to `finalize-agent`
+   with `mode=agent-output`, non-null `invocation_ref` and no operation inputs.
+   It validates the protected invocation's outputs, not final-message paths.
+   Native SubagentStop then verifies current output authority.
+   Missing final text cannot skip native stop validation.
+8. After native stop, the root records the explicit result, content-addressed artifact references,
+   selected-ID accounting and all findings. A successful tool call or generated
+   path alone is not evidence of completed discovery.
+
+## Stop and result
+
+A valid FAIL report may finish as `output-valid/result-fail`; it never authorizes discovery, parity or planning completion. Only a current protected passing receipt for the exact requested completion/planning mode can satisfy that gate.
+
+Structural success is not discovery, parity or planning completion.
+Missing prepare/finalize/start/stop capability, missing outputs, invalid claims,
+unresolved required work, wrong role/model/start context or a stale/missing
+receipt blocks successful completion. Return explicit
+PASS, FAIL or BLOCKED, distinguishing valid incremental outputs from a passing
+completion gate. Missing native enforcement remains BLOCKED even when ordinary
+local-user operations can run; do not substitute CLI success for native authority.
+
+## References
+
+- [Canonical migration-coverage-reviewer contract](../../../.claude/agents/migration-coverage-reviewer.md)
+- Installed v2 `service-request` and `required-output-manifest` schema contracts;
+  consume them through the authoritative runtime, with no checkout-schema fallback.
+- The selected profile and pinned local artifacts supplied for this invocation;
+  references do not preload catalogs or grant access to unselected paths.

package/resources/claude-customizations/.claude-variants/csharp-legacy/agents/csharp-typed-engineer.md

@@ -54,7 +54,7 @@ If the marker is missing or malformed, fail closed to `full-feature`.
 Stop implementation and return to the user when:
 
 - the scope estimate or an in-flight batch would exceed the 3-production-file cap in direct mode,
-- a file is near or would exceed the 500-line limit,
+- a file is above or would exceed the 800-line hard limit of the tiered file-size policy (split it before proceeding; at 500 lines look for a logical split, and at 700 lines split more aggressively),
 - any QA gate delta is non-zero after self-correction,
 - the toolchain cannot be executed in the current environment (mark the change **unverified**),
 - orchestrator handoff mode is requested but the required context package is incomplete,

package/resources/claude-customizations/config/blast-radius.json

@@ -5,8 +5,7 @@
     "config/blast-radius.json",
     "config/orchestration-routing.json",
     "package-lock.json",
-    "poetry.lock",
-    "quality-tiers.yml"
+    "poetry.lock"
   ],
   "shared_surface_globs": [],
   "mandate_reads": [
@@ -32,13 +31,15 @@
   ],
   "conflict_tolerance": {
     "tolerance_percent": 100,
-    "weights": { "same_file": 8, "possible_overlap": 2, "append_only": 1, "module": 2 },
+    "weights": { "same_file": 8, "possible_overlap": 2, "append_only": 1, "module": 2, "contract": 8 },
     "band_durations": { "C1": 1, "C2": 2, "C3": 4, "C4": 8 },
     "default_band": "C1",
     "append_only_paths": [
       "**/CHANGELOG.md",
-      "extensions/drm-copilot/resources/claude-customizations/pack-manifests/core.json"
-    ]
+      "extensions/drm-copilot/resources/claude-customizations/pack-manifests/core.json",
+      "quality-tiers.yml"
+    ],
+    "combination_threshold_percent": 400
   },
   "write_intent_extraction": true,
   "path_roots": [],

package/resources/claude-customizations/config/orchestration-routing.json

@@ -269,6 +269,62 @@
     ],
     "receipt_key": "codex_topology_receipts"
   },
+  "discovery_operations": {
+    "inventory-legacy-system": {
+      "logical_agent": "legacy-parity-analyst",
+      "output_contract_version": "2.0.0",
+      "permissible_artifact_kinds": ["coverage-ledger", "evidence-reference", "inventory-snapshot", "required-output-manifest", "unspecified-behavior", "unspecified-behavior-collection"],
+      "gate_mode": "agent-output"
+    },
+    "extract-feature-contract": {
+      "logical_agent": "legacy-parity-analyst",
+      "output_contract_version": "2.0.0",
+      "permissible_artifact_kinds": ["coverage-ledger", "evidence-reference", "feature-contract", "required-output-manifest", "unspecified-behavior", "unspecified-behavior-collection"],
+      "gate_mode": "agent-output"
+    },
+    "characterize-runtime-behavior": {
+      "logical_agent": "runtime-characterization-analyst",
+      "output_contract_version": "2.0.0",
+      "permissible_artifact_kinds": ["evidence-payload", "evidence-reference", "required-output-manifest", "runtime-characterization-scenario", "unspecified-behavior", "unspecified-behavior-collection"],
+      "gate_mode": "agent-output"
+    },
+    "reconcile-parity-matrix": {
+      "logical_agent": "requirements-reconciler",
+      "output_contract_version": "2.0.0",
+      "permissible_artifact_kinds": ["parity-matrix", "required-output-manifest", "unspecified-behavior", "unspecified-behavior-collection"],
+      "gate_mode": "agent-output"
+    },
+    "review-discovery-coverage": {
+      "logical_agent": "migration-coverage-reviewer",
+      "output_contract_version": "2.0.0",
+      "permissible_artifact_kinds": ["completion-report", "coverage-report", "parity-report", "required-output-manifest", "validation-report"],
+      "gate_mode": "agent-output"
+    },
+    "adjudicate-unspecified-behavior": {
+      "logical_agent": "requirements-reconciler",
+      "output_contract_version": "2.0.0",
+      "permissible_artifact_kinds": ["acceptance-specification", "acceptance-view", "product-decision", "product-decision-collection", "required-output-manifest", "unspecified-behavior", "unspecified-behavior-collection"],
+      "gate_mode": "agent-output"
+    },
+    "generate-acceptance-scenarios": {
+      "logical_agent": "requirements-reconciler",
+      "output_contract_version": "2.0.0",
+      "permissible_artifact_kinds": ["acceptance-specification", "acceptance-view", "required-output-manifest"],
+      "gate_mode": "agent-output"
+    },
+    "initialize-discovery-workspace": {
+      "logical_agent": "migration-coverage-reviewer",
+      "output_contract_version": "2.0.0",
+      "permissible_artifact_kinds": ["coverage-report", "required-output-manifest", "validation-report"],
+      "gate_mode": "agent-output"
+    },
+    "validate-discovery-artifacts": {
+      "logical_agent": "migration-coverage-reviewer",
+      "output_contract_version": "2.0.0",
+      "permissible_artifact_kinds": ["coverage-report", "required-output-manifest", "validation-report"],
+      "gate_mode": "agent-output"
+    }
+  },
   "codex_model_policy": {
     "description": "Codex-native deployment profiles. Complexity selects model and reasoning independently from the file-count route; exact model slugs are mandatory and unavailable profiles do not fall back silently.",
     "profile_order": [
@@ -350,7 +406,11 @@
       "python-typed-engineer",
       "powershell-typed-engineer",
       "csharp-typed-engineer",
-      "typescript-engineer"
+      "typescript-engineer",
+      "legacy-parity-analyst",
+      "runtime-characterization-analyst",
+      "requirements-reconciler",
+      "migration-coverage-reviewer"
     ]
   }
 }