@danmoisan/drm-copilot-mcp 1.1.22 → 1.1.24

package/resources/customizations/.github/hooks/discovery-planning.ps1

@@ -0,0 +1,91 @@
+<#
+.SYNOPSIS
+    GitHub Copilot (VS Code local harness) PreToolUse hook that gates planner and orchestrator launches on discovery authority.
+
+.DESCRIPTION
+    Registered through .github/hooks/*.json. The hook reads the Copilot PreToolUse
+    envelope from stdin (camelCase keys, snake_case accepted), recognizes an
+    atomic-planner or orchestrator launch, and takes its decision from the shared
+    DiscoveryPlanning module under .claude/lib/discovery-validation:
+
+    - a call that is not a planner or orchestrator launch, and a workspace without
+      a protected discovery activation, are allowed so existing behavior continues;
+    - an active workspace must still hold the activated locator and domain profile
+      and the protected session must hold a current, passing, gateway-written
+      planning-mode receipt for this host and session; otherwise the launch is
+      denied with the DISCOVERY_PLANNING_GATE_BLOCKED: prefix.
+
+    A helper that fails to load and an envelope that cannot be read both deny with
+    the prefix; the hook never fails open and never runs Python.
+
+.NOTES
+    Issue #980. Requires PowerShell 7+. Invokes NO external process.
+#>
+[CmdletBinding()]
+param()
+
+$script:DiscoveryPlanningReasonPrefix = 'DISCOVERY_PLANNING_GATE_BLOCKED:'
+$script:DiscoveryPlanningDependencyFailures = [System.Collections.Generic.List[object]]::new()
+
+function Add-DiscoveryPlanningDependencyFailure {
+    <#
+    .SYNOPSIS
+        Records one helper module that failed to load.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$Name,
+        [Parameter(Mandatory = $false)][AllowNull()][System.Management.Automation.ErrorRecord]$ErrorRecord
+    )
+
+    $message = 'no error record'
+    if ($null -ne $ErrorRecord) { $message = ([string]$ErrorRecord.Exception.Message -split "`r?`n")[0] }
+    [void]$script:DiscoveryPlanningDependencyFailures.Add([pscustomobject]@{ Name = $Name; Message = $message })
+}
+
+foreach ($moduleName in @('DiscoveryEncoding.psm1', 'DiscoveryAuthority.psm1', 'DiscoveryManifest.psm1', 'DiscoveryPayload.psm1', 'DiscoveryToolRouting.psm1', 'DiscoveryAuthorization.psm1', 'DiscoveryStartRecord.psm1', 'DiscoveryPlanning.psm1')) {
+    try { Import-Module (Join-Path $PSScriptRoot "../../.claude/lib/discovery-validation/$moduleName") -Force -Global -ErrorAction Stop } catch { Add-DiscoveryPlanningDependencyFailure -Name $moduleName -ErrorRecord $_ }
+}
+
+function Invoke-DiscoveryPlanningDecision {
+    <#
+    .SYNOPSIS
+        Parses the Copilot PreToolUse envelope and returns the hookSpecificOutput decision.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory = $false)][AllowNull()][AllowEmptyString()][string]$ToolInputRaw,
+        [Parameter(Mandatory = $false)][AllowNull()][hashtable]$HostEnvironment = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][hashtable]$Store = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][scriptblock]$ReadBytes = $null
+    )
+
+    if ($script:DiscoveryPlanningDependencyFailures.Count -gt 0) {
+        $first = $script:DiscoveryPlanningDependencyFailures[0]
+        return [ordered]@{
+            hookSpecificOutput = [ordered]@{
+                hookEventName            = 'PreToolUse'
+                permissionDecision       = 'deny'
+                permissionDecisionReason = "$($script:DiscoveryPlanningReasonPrefix) the dependency '$($first.Name)' failed to load ($($first.Message)); the gate fails closed."
+            }
+        }
+    }
+    if ($null -eq $HostEnvironment) { $HostEnvironment = Get-DiscoveryTrustedHostEnvironment }
+    if ($null -eq $Store) { $Store = Get-DiscoveryStartStore }
+
+    $normalized = ConvertFrom-DiscoveryHostPayloadText -HostName 'github-copilot' -Text $ToolInputRaw
+    $parameters = @{ Normalized = $normalized; HostEnvironment = $HostEnvironment; Store = $Store }
+    if ($null -ne $ReadBytes) { $parameters['ReadBytes'] = $ReadBytes }
+    $outcome = Get-DiscoveryPlanningDecision @parameters
+    return ConvertTo-DiscoveryPlanningHookOutput -Outcome $outcome -ReasonPrefix $script:DiscoveryPlanningReasonPrefix
+}
+
+# Guard allows dot-sourcing in tests without executing the entrypoint.
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+
+$decision = Invoke-DiscoveryPlanningDecision -ToolInputRaw ([Console]::In.ReadToEnd())
+$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+exit 0

package/resources/customizations/.github/hooks/discovery-pre-tool.ps1

@@ -0,0 +1,123 @@
+<#
+.SYNOPSIS
+    Native PreToolUse authorization adapter for GitHub Copilot (VS Code local harness) discovery agents.
+
+.DESCRIPTION
+    Registered through .github/hooks/*.json. The hook reads the Copilot PreToolUse
+    envelope from stdin (camelCase keys, snake_case accepted), derives the trusted
+    principal from the payload alone (session, agentId and agentType when the
+    harness supplies them, and parentAgentId or the literal parent root), and
+    takes its decision from the shared DiscoveryAuthorization module under
+    .claude/lib/discovery-validation:
+
+    - a root call (no agentId) of prepare_discovery_agent, run_discovery_doctor or
+      a controlled discovery tool is allowed with a one-use root grant the MCP
+      server consumes; every other root call and every call of an agent that is
+      not a discovery specialist is allowed, so ordinary sessions keep their behavior;
+    - a sentinel envelope is observed for the capability probe and never granted;
+    - a discovery specialist may use read-only native tools and the controlled
+      discovery MCP tools only; shell, terminal, exec and evaluation tools, generic
+      file mutations, nested agents, foreign MCP servers, root-only discovery
+      operations and caller-supplied identity fields are denied before execution;
+    - the specialist's first controlled call binds the single prepared invocation
+      of its session, parent and agent type (the Copilot subagentStart payload
+      carries no agent identifier); every controlled call must name that invocation
+      through invocation_ref and is recorded as one short-lived, one-use tool-authorization.
+
+    A helper that fails to load and an envelope that cannot be read both deny with
+    the DISCOVERY_ARTIFACT_GATE_BLOCKED: prefix; the hook never fails open.
+
+.NOTES
+    Issue #980. Requires PowerShell 7+. Invokes NO external process.
+#>
+[CmdletBinding()]
+param()
+
+$script:DiscoveryGateReasonPrefix = 'DISCOVERY_ARTIFACT_GATE_BLOCKED:'
+$script:DiscoveryGateHandlerPath = $PSCommandPath
+$script:DiscoveryGateDependencyFailures = [System.Collections.Generic.List[object]]::new()
+
+function Add-DiscoveryGateDependencyFailure {
+    <#
+    .SYNOPSIS
+        Records one helper module that failed to load.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$Name,
+        [Parameter(Mandatory = $false)][AllowNull()][System.Management.Automation.ErrorRecord]$ErrorRecord
+    )
+
+    $message = 'no error record'
+    if ($null -ne $ErrorRecord) { $message = ([string]$ErrorRecord.Exception.Message -split "`r?`n")[0] }
+    [void]$script:DiscoveryGateDependencyFailures.Add([pscustomobject]@{ Name = $Name; Message = $message })
+}
+
+foreach ($moduleName in @('DiscoveryEncoding.psm1', 'DiscoveryAuthority.psm1', 'DiscoveryPayload.psm1', 'DiscoveryToolRouting.psm1', 'DiscoveryStartRecord.psm1', 'DiscoveryRootGrant.psm1', 'DiscoveryObservation.psm1', 'DiscoveryStart.psm1', 'DiscoveryAuthorization.psm1')) {
+    try { Import-Module (Join-Path $PSScriptRoot "../../.claude/lib/discovery-validation/$moduleName") -Force -Global -ErrorAction Stop } catch { Add-DiscoveryGateDependencyFailure -Name $moduleName -ErrorRecord $_ }
+}
+
+function Get-DiscoveryGateHandlerSha256 {
+    <#
+    .SYNOPSIS
+        Returns the SHA-256 of this handler's own bytes for the authorization writer record.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory = $false)][AllowNull()][string]$HandlerPath = $script:DiscoveryGateHandlerPath)
+
+    if ([string]::IsNullOrEmpty($HandlerPath) -or -not (Test-Path -LiteralPath $HandlerPath -PathType Leaf)) {
+        return ('0' * 64)
+    }
+    return Get-DiscoveryBytesSha256Hex -Bytes ([System.IO.File]::ReadAllBytes($HandlerPath))
+}
+
+function Invoke-DiscoveryPreToolDecision {
+    <#
+    .SYNOPSIS
+        Parses the Copilot PreToolUse envelope and returns the hookSpecificOutput decision.
+    .DESCRIPTION
+        Every seam defaults to the real host and is injectable so tests run over
+        in-memory values. A recorded helper failure denies before the envelope is read.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory = $false)][AllowNull()][AllowEmptyString()][string]$ToolInputRaw,
+        [Parameter(Mandatory = $false)][AllowNull()][hashtable]$HostEnvironment = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][hashtable]$Store = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][nullable[datetime]]$Now = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][string]$Nonce = $null
+    )
+
+    if ($script:DiscoveryGateDependencyFailures.Count -gt 0) {
+        $first = $script:DiscoveryGateDependencyFailures[0]
+        return [ordered]@{
+            hookSpecificOutput = [ordered]@{
+                hookEventName            = 'PreToolUse'
+                permissionDecision       = 'deny'
+                permissionDecisionReason = "$($script:DiscoveryGateReasonPrefix) the dependency '$($first.Name)' failed to load ($($first.Message)); the gate fails closed."
+            }
+        }
+    }
+    # Seams resolve only after the dependency check so a missing module denies
+    # instead of raising while a default is evaluated.
+    if ($null -eq $HostEnvironment) { $HostEnvironment = Get-DiscoveryTrustedHostEnvironment }
+    if ($null -eq $Store) { $Store = Get-DiscoveryDefaultStore }
+    if ($null -eq $Now) { $Now = [datetime]::UtcNow }
+    if ([string]::IsNullOrEmpty($Nonce)) { $Nonce = Get-DiscoveryAuthorizationNonce }
+
+    $normalized = ConvertFrom-DiscoveryHostPayloadText -HostName 'github-copilot' -Text $ToolInputRaw
+    $outcome = Get-DiscoveryPreToolDecision -Normalized $normalized -HostEnvironment $HostEnvironment `
+        -HandlerSha256 (Get-DiscoveryGateHandlerSha256) -Store $Store -Now $Now -Nonce $Nonce
+    return ConvertTo-DiscoveryPreToolHookOutput -Outcome $outcome -ReasonPrefix $script:DiscoveryGateReasonPrefix
+}
+
+# Guard allows dot-sourcing in tests without executing the entrypoint.
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+
+$decision = Invoke-DiscoveryPreToolDecision -ToolInputRaw ([Console]::In.ReadToEnd())
+$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+exit 0

package/resources/customizations/.github/hooks/discovery.json

@@ -0,0 +1,35 @@
+{
+  "version": 1,
+  "hooks": {
+    "SubagentStart": [
+      {
+        "type": "command",
+        "powershell": "pwsh -NoProfile -File .github/hooks/discovery-agent-start.ps1",
+        "bash": "pwsh -NoProfile -File .github/hooks/discovery-agent-start.ps1",
+        "timeout": 30
+      }
+    ],
+    "PreToolUse": [
+      {
+        "type": "command",
+        "powershell": "pwsh -NoProfile -File .github/hooks/discovery-pre-tool.ps1",
+        "bash": "pwsh -NoProfile -File .github/hooks/discovery-pre-tool.ps1",
+        "timeout": 30
+      },
+      {
+        "type": "command",
+        "powershell": "pwsh -NoProfile -File .github/hooks/discovery-planning.ps1",
+        "bash": "pwsh -NoProfile -File .github/hooks/discovery-planning.ps1",
+        "timeout": 30
+      }
+    ],
+    "SubagentStop": [
+      {
+        "type": "command",
+        "powershell": "pwsh -NoProfile -File .github/hooks/discovery-agent-stop.ps1",
+        "bash": "pwsh -NoProfile -File .github/hooks/discovery-agent-stop.ps1",
+        "timeout": 60
+      }
+    ]
+  }
+}

package/resources/customizations/.github/instructions/general-code-change.instructions.md

@@ -143,8 +143,11 @@ Rules for functions:
 
    - A module/file should have a clear purpose (e.g. “QIF parsing,” “Lexile model,” “corpus download”).
    - Avoid dumping unrelated classes/functions into the same file.
-   - Do not exceed 500 lines for any one file.
-   - This 500-line limit applies to production code, test code, and reusable scripts.
+   - File size follows a tiered policy that applies to production code, test code, and reusable scripts:
+     - **500 lines (guidance):** look for logical ways to divide the file into multiple files, provided the parts can be separated logically. No gate fails at this tier.
+     - **700 lines (advisory):** look for a split more aggressively. Reviewers and `feature-review` report a non-blocking Warning for a file at or above 700 lines. No gate fails at this tier.
+     - **Above 800 lines (hard block):** a split is enforced regardless of logical separability. A file of 801 lines or more is blocked by the repository CI check and by the PreToolUse hook; a file of exactly 800 lines passes. Legacy files already above 800 lines are recorded in `config/file-size-baseline.json` and may shrink (with the entry tightened) or stay the same size, but may not grow.
+     - Lines are logical lines: the content split on line terminators, where a trailing terminator does not add a line.
    - Exceptions: temporary throwaway scripts created and deleted during an agent session; raw text fixtures used for language-processing test data; Markdown documentation files.
 
 2. Public vs internal

package/resources/customizations/.github/instructions/mermaid.instructions.md

@@ -0,0 +1,85 @@
+---
+applyTo: "**"
+---
+# Mermaid AI Skills
+
+When the user asks to create, edit, or visualize any diagram, use the Mermaid
+VS Code extension tools and commands described below.
+
+## Workflow
+
+1. Determine the diagram type and generate Mermaid syntax.
+2. Write the diagram to a `.mmd` file in the project.
+3. Validate syntax: correct first-line keyword, arrow types, balanced brackets.
+4. Preview via the Mermaid extension — open the `.mmd` file (auto-preview) or run
+   **MermaidChart: Preview Diagram** (`mermaidChart.preview`).
+
+## LM Tools — call these for every diagram interaction
+
+- `mermaid-diagram-validator` — validate Mermaid syntax before presenting any diagram
+- `mermaid-diagram-preview` — render a live preview inside VS Code after generating
+- `get-syntax-docs-mermaid` — fetch correct syntax docs for any diagram type
+
+## VS Code Commands
+
+Invoke via Command Palette or the VS Code command API (GitHub Copilot in VS Code only).
+Do not invent command IDs. Prefer writing/editing `.mmd` files when a command is not needed.
+
+### Diagram editing & preview
+- **Preview** (`mermaidChart.preview`) — preview the active Mermaid editor (`.mmd` / `.mermaid` must be open).
+- **Create Diagram** (`mermaidChart.createMermaidFile`) — creates a demo flowchart and opens preview side by side.
+- **Repair Diagram** (`mermaidChart.repairDiagram`) — Mermaid AI repair for the active diagram; uses Mermaid AI credits — tell the user before running.
+- **Improve Diagram** (`mermaidChart.improveDiagram`) — uses Copilot / LM API; suggests layout + styling variants for the active diagram.
+
+### Generate diagrams (GitHub Copilot required)
+- **Generate Diagram from Code** (`mermaidChart.generateDiagramFromCode`)
+- **Generate Cloud Diagram** (`mermaidChart.generateCloudDiagram`)
+- **Generate ER Diagram** (`mermaidChart.generateERDiagram`)
+- **Generate Docker Diagram** (`mermaidChart.generateDockerDiagram`)
+- **Open AI Chat** (`mermaidChart.openCopilotChat`)
+
+### Mermaid Chart cloud
+- **Login** (`mermaidChart.login`) / **Logout** (`mermaidChart.logout`)
+- **Connect Diagram** (`mermaidChart.connectDiagramToMermaidChart`) — link a local diagram to Mermaid Chart.
+- **Sync Diagram** (`mermaidChart.syncDiagramWithMermaid`) — only for diagrams already connected (frontmatter has `id:`). Example:
+  ```yaml
+  ---
+  id: cbd9e9ba-a2cb-47c5-a98e-8c28a753428d
+  ---
+  ```
+
+### Review Mermaid Sync
+For diagrams updated by the Mermaid Chart GitHub Sync app (or pre-commit regenerate):
+- **Review Mermaid Sync** (`mermaidChart.reviewAppCommits`) — start / open the review flow.
+- **Regenerate with Mermaid AI** (`mermaidChart.regenerateDiagramWithMermaidAI`) — regenerate from source references.
+Do not manually rewrite diagrams managed by this workflow. Accept/reject/diff UI actions stay in the extension UI.
+
+### Install / update this pack
+- **MermaidChart: Install AI Skills…** (`mermaidChart.installAiSkills`)
+
+## @mermaid-chart slash commands
+
+| Command | Purpose |
+|---|---|
+| `/generate_diagram_from_code` | General diagram from any source file |
+| `/generate_execution_sequence` | Sequence diagram from code flow |
+| `/generate_er_diagram` | ER diagram from schema / models |
+| `/generate_cloud_architecture_diagram` | Cloud / CI-CD architecture |
+| `/generate_docker_diagram` | Architecture from Dockerfiles |
+| `/generate_c4_topdown_architecture` | C4 top-down architecture |
+| `/analyze_code_ownership` | Code ownership diagram |
+| `/generate_dependency_diagram` | Dependency / security visualisation |
+
+## Rules
+
+1. Always call `mermaid-diagram-validator` before showing any diagram.
+2. Always call `mermaid-diagram-preview` after generating a diagram.
+3. Use `get-syntax-docs-mermaid` before generating an unfamiliar diagram type.
+4. Prefer `@mermaid-chart` slash commands for complex generation.
+5. Write diagrams to `.mmd` files; never return unvalidated Mermaid syntax.
+6. Warn the user before Repair (Mermaid AI credits).
+7. Cooperate with the Sync workflow — do not manually regenerate managed diagrams.
+
+## Docs
+
+More commands and features: https://marketplace.visualstudio.com/items?itemName=MermaidChart.vscode-mermaid-chart

package/resources/customizations/.github/instructions/powershell-code-change.instructions.md

@@ -58,7 +58,7 @@ If you encounter any conflicting instructions, **halt and notify the user.**
 
 ## 3. Structure, Naming, and Comments
 
-- Keep scripts **cohesive and under 500 lines** (matches general policy).
+- Keep scripts **cohesive** and within the tiered file-size policy of `general-code-change.instructions.md` (section 4, Module & File Structure).
 - Use approved verbs and descriptive nouns for functions (PSScriptAnalyzer will enforce).
 - Prefer modules/helpers over copy-paste between scripts; share common logic in dedicated helper functions.
 - Comment **why** for non-obvious patterns (e.g., rule suppressions, compatibility shims), not what.

package/resources/customizations/.github/prompts/execute-hard-lock.prompt.md

@@ -0,0 +1,105 @@
+YOU ARE OPERATING IN ATOMIC EXECUTION MODE (atomic_executor).
+
+IDENTITY & SCOPE
+- Execution-only persona. No planning, no redesign, no reordering.
+- Execute an atomic_planner plan exactly as written.
+- Preserve Phase headings, task IDs ([P#-T#]), checkbox format, and task order.
+- Complete tasks strictly one-by-one.
+- Verify acceptance criteria before checking off any task.
+
+SUPREMACY & PRECONDITIONS (NON-NEGOTIABLE)
+- Repository policy files override these instructions.
+- BEFORE executing any task, you must confirm compliance with:
+  1) .github/copilot-instructions.md
+  2) .github/instructions/general-code-change.instructions.md
+  3) .github/instructions/general-unit-test.instructions.md
+  4) Any applicable language-specific policies
+- If Phase 0 does not include:
+  - Repo-policy reading tasks, AND
+  - Baseline toolchain capture for each language touched by the plan,
+  the plan is INVALID and execution must not begin.
+
+PLAN AUTHORITY (THE CONTRACT)
+- The plan text is the sole source of truth and the only todo list.
+- Task IDs must remain unchanged and referenced exactly.
+- Tasks must be executed in exact written order.
+- You MUST NOT:
+  - Add phases or tasks
+  - Reorder tasks
+  - Replace the plan with an alternative approach
+  - Perform work not explicitly described in the plan
+
+PREFLIGHT VALIDATION GATE (BEFORE [P0-T1])
+You must validate ALL of the following; otherwise STOP:
+- Phase headings follow “Phase N — …”
+- Each task is a markdown checkbox with valid [P#-T#]
+- Phase numbers and task IDs are consistent
+- Phase 0 exists and includes:
+  - Repo-policy reading
+  - Baseline toolchain runs for each language touched
+- A final QA phase exists with full toolchain loops per touched language
+- Any TDD red tests are tagged [expect-fail]
+- No task is non-atomic or unverifiable
+
+If blocked:
+- State: “BLOCKED at preflight (before [P0-T1])”
+- Explain concretely
+- Provide an exact plan delta
+- Request atomic_planner regeneration or user approval
+
+EXECUTION LOOP (AFTER PREFLIGHT PASSES)
+Once execution begins:
+- Do NOT stop mid-plan
+- Do NOT replan or redesign
+- Persist across turns until the plan is fully complete
+
+For EACH task:
+1) Announce: “Executing [P#-T#]: …”
+2) Verify stated preconditions
+3) Perform ONLY work required by the task (bounded micro-actions allowed)
+4) Verify acceptance criteria
+5) Run required toolchains as specified or implied
+6) Check off the task ONLY when verification passes
+
+[expect-fail] tasks:
+- A failing test is success ONLY for that task
+- Formatting, linting, and type checks still apply unless explicitly waived
+
+BLOCKING RULE
+- Blocking is permitted ONLY during preflight.
+- After execution begins, blocking is forbidden; continue to completion.
+
+RESUME / CONTINUE
+- On “resume”, “continue”, or “try again”:
+  - Reload the last plan-of-record
+  - Identify the next unchecked task
+  - Announce: “Continuing from [P#-T#]”
+  - Continue execution without replanning
+
+OUTPUT DISCIPLINE
+- Be concise and exact
+- Show commands run and summarize results (pass/fail, key errors)
+- Do not paste large code blocks unless asked
+- Report toolchain status explicitly for each touched language
+- End every response with the updated checklist (or current phase + next tasks)
+
+--- END OF ATOMIC EXECUTION HARD-LOCK ---
+
+MODE CONTEXT
+- Selected work mode: `${work-mode}`
+
+PLAN OF RECORD
+`${plan-path}`
+
+MANDATORY READ-PROOF (DO THIS FIRST; NO EXECUTION YET)
+1) Confirm the Plan of Record file exists in the repo/branch you are operating on.
+2) Output a fingerprint of what you read:
+   - git rev-parse HEAD
+   - sha256 of the plan file
+   - total count of tasks matching "^- \\[[ x]\\] \\[P" (or equivalent)
+3) Enter atomic execution mode
+4) Perform PREFLIGHT VALIDATION ONLY.
+5) Identify the FIRST unchecked task ([ ]) in plan order and print ONLY:
+   - the exact line for that task
+   - 2 lines above and 2 lines below (no more)
+6) State: "READY TO BEGIN FROM [P#-T#]" and immediately begin execution..

package/resources/customizations/.github/prompts/remediate-comments.prompt.md

@@ -25,7 +25,7 @@ Apply in this sequence:
 ## Execution Rules
 
 - Remediate the entire scope to add/adjust robust docstrings and intent comments for loops, branches, and multi-step blocks; avoid low-value narration.
-- Keep modules cohesive, under 500 lines, strongly typed; avoid `Any` unless justified.
+- Keep modules cohesive, within the tiered file-size policy of `general-code-change.instructions.md`, strongly typed; avoid `Any` unless justified.
 - Maintain encoding/EOL and ASCII unless the file already uses Unicode.
 - Do not pause for approval or clarification once scope is set; continue across turns if needed until fully compliant.
 

package/resources/customizations/.github/skills/adjudicate-unspecified-behavior/SKILL.md

@@ -0,0 +1,135 @@
+---
+name: adjudicate-unspecified-behavior
+description: 'Draft traceable proposals for unresolved behavior and separate them from root-owned approval. Use when asked to adjudicate contradictory or undocumented behavior and derive explicitly requested acceptance criteria.'
+---
+
+# Adjudicate Unspecified Behavior
+
+## When to Use This Skill
+
+Use for selected unresolved records with competing interpretations and a named decision owner. A request to adjudicate does not let the specialist approve its own proposal.
+
+## Inputs
+
+These are human-facing workflow selections, not additional service-request fields.
+Supply explicit selections; neither omitted inputs nor profile roots create authority.
+
+| Input | Required contract |
+| --- | --- |
+| profile | Required validated profile and trusted workspace binding. |
+| unresolved_ids | Required explicit unresolved record selection. |
+| interpretations | Required competing interpretations and unknowns. |
+| evidence_refs | Required selected evidence supporting or contradicting each interpretation. |
+| decision_owner | Required explicit owner for a proposed decision. |
+| approval_record | Optional explicitly supplied approval evidence; only the authorized root may apply it. |
+| derived_acceptance | Optional explicit selection of derived acceptance records/views; it adds no feature-contract authority. |
+
+## Routing
+
+Logical role: `requirements-reconciler`.
+The root owns preparation and launch; this skill never auto-launches a logical
+role through frontmatter. The existing resolver selects the exact deployment,
+model, effort and profile hash under the existing C1-C4 ceiling and execution
+context. Do not choose a model, self-launch, create another scheduler or promote
+an ordinary discovery action into an issue. The production-write count is zero.
+
+## Exact output boundary
+
+These rows are maximum workflow caps, not instructions to create every kind.
+Only the prepared required outputs may be created or replaced.
+
+| Artifact kind | Profile key | Constraint |
+| --- | --- | --- |
+| product-decision | product_decisions | Selected proposed decision IDs only |
+| product-decision-collection | product_decisions | Selected proposed decision members only |
+| unspecified-behavior | unspecified_behaviors | Selected unresolved IDs only |
+| unspecified-behavior-collection | unspecified_behaviors | Selected unresolved members only |
+| acceptance-specification | acceptance | Explicitly requested derived criteria only |
+| acceptance-view | acceptance | Explicitly requested eligible views or pending material |
+| required-output-manifest | reports | Exact invocation manifest only |
+
+The profile keys are maximum configured locations, not write grants. Each
+prepared output row binds `artifact_kind`, `id`, `path`, `format` and
+`expected_sha256`. The protected invocation independently binds the baseline,
+selected members, pins and exact grants; a manifest cannot expand them. A null
+expected hash means exclusive creation from an absent baseline, never overwrite
+permission. Preserve unselected collection members and all unrelated inputs.
+Use compare-and-swap and current path checks through the controlled writer.
+
+The `reports` location permits only `required-output-manifest` for this role;
+it does not permit review reports. The manifest itself requires an exact grant.
+
+## Prerequisites
+
+Missing or malformed configuration blocks delegation. Require a validated profile and explicit selected scope before root preparation; do not initialize, configure or infer roots as a specialist.
+
+Require verified native prepare/finalize/start/stop capability. The protected
+invocation and native SubagentStart attestation must match workspace/profile
+hashes, selected IDs, source/target pins, baseline input hashes,
+provider/model/effort/profile hash and parent/session.
+Diagnostic mirrors, caller markers and hosted read results are not authority.
+The local runtime's unavailable native prepare/finalize operations do not issue
+protected receipts. There is no local-user fallback or self-attested host success.
+
+Load profile plus selected artifacts on invocation; do not preload a domain
+catalog in standing instructions. Managed project memory is host-controlled.
+Memory cannot grant filesystem authority or replace evidence. Deny terminal/shell/exec, interpreter/evaluation,
+general filesystem Write/Edit/apply-patch, arbitrary MCP dispatch, browser/computer
+mutation and network writes. Do not execute application code or modify
+production/test implementation, profile/locator/activation,
+schema/policy/hooks/settings, authority stores or runtime installation as a specialist. No analyst
+approval is permitted; root bootstrap/configuration and root approval remain
+separate authorized operations.
+
+## Step-by-Step Workflows
+
+1. Validate the explicit inputs and selected configuration. Stop with precise missing/invalid input findings before specialist delegation; do not invent identities, scope or evidence.
+
+2. The root calls `prepare_discovery_agent` with `skill_id`, `selected_ids`,
+   `paths`, `expected_outputs`, `execution_context` and `complexity`.
+   Map it to fixed `prepare-agent`; execution context is `standalone`,
+   `epic_preparation_child` or `epic_execution_child`. The requested mode is
+   explicit and remains distinct from the final `agent-output` gate.
+   Use `skill_id=adjudicate-unspecified-behavior`; workflow inputs do not add wire fields.
+3. The root launches that exact deployment. Native SubagentStart must match the
+   prepared role/model/effort/profile and trusted workspace/session before any
+   grant is usable. Missing capability or attestation blocks the action.
+4. Use only the granted operations. Use bounded `read_discovery_source` and role-permitted creation/ordinary `update_discovery_artifact` to draft proposed decision and unresolved records. Explicitly requested derived acceptance uses the authoritative generation operation, with pending/null expectations preserved. The specialist cannot use an approval action, even when an input carries an approval record.
+5. Preserve observed source facts, competing interpretations and approved history. Draft proposed decisions only. Do not approve/reject/supersede product decisions or alter approval history. Pending questions cannot become approved requirements. Derived criteria do not authorize `feature_contracts` writes. Without root approval, a proposal remains a proposal.
+6. Produce every exact required output and the stored `required-output-manifest`,
+   preserving its output array order for the digest. Validate claims, references,
+   pins and selected-ID accounting. Purpose-built tools supply authorized proposal
+   inputs for `input_path`/`evidence_path`; never invent a generic Write staging
+   step. Server-side role checks, exact one-use authorization and prospective
+   validation remain mandatory. Bounded source reads preserve content identity
+   and line ranges; truncation requires a narrower selection, not a completeness
+   claim or filesystem fallback.
+7. Call `finalize_discovery_agent` as the specialist, mapped to `finalize-agent`
+   with `mode=agent-output`, non-null `invocation_ref` and no operation inputs.
+   It validates the protected invocation's outputs, not final-message paths.
+   Native SubagentStop then verifies current output authority.
+   Missing final text cannot skip native stop validation.
+8. After proposal finalization and native stop, the authorized root may separately call `update_discovery_artifact`, mapped to `update-artifact` with `update_action=approve-decision`, exact product-decision identity, whole-document `input_path`, `expected_sha256`, `approval_owner` and nonempty `approval_evidence_refs`. Ordinary replacement cannot set approval-only fields. Root approval is a separate authorized operation from reconciler proposal validity; it invalidates prior completion receipts and requires fresh validation before any later gate.
+9. After the separate root operation, the root records the explicit result, content-addressed artifact references,
+   selected-ID accounting and all findings. A successful tool call or generated
+   path alone is not evidence of completed discovery.
+
+## Stop and result
+
+Return proposal findings and any separate root approval result explicitly. Do not report a proposed or pending decision as approved; omit approval when the required authorization or evidence is absent.
+
+Structural success is not discovery, parity or planning completion.
+Missing prepare/finalize/start/stop capability, missing outputs, invalid claims,
+unresolved required work, wrong role/model/start context or a stale/missing
+receipt blocks successful completion. Return explicit
+PASS, FAIL or BLOCKED, distinguishing valid incremental outputs from a passing
+completion gate. Missing native enforcement remains BLOCKED even when ordinary
+local-user operations can run; do not substitute CLI success for native authority.
+
+## References
+
+- [Canonical requirements-reconciler contract](../../agents/requirements-reconciler.agent.md)
+- Installed v2 `service-request` and `required-output-manifest` schema contracts;
+  consume them through the authoritative runtime, with no checkout-schema fallback.
+- The selected profile and pinned local artifacts supplied for this invocation;
+  references do not preload catalogs or grant access to unselected paths.