@danmoisan/drm-copilot-mcp 1.1.23 → 1.1.24

package/resources/customizations/.github/hooks/discovery-capability-probe.ps1

@@ -0,0 +1,98 @@
+<#
+.SYNOPSIS
+    GitHub Copilot (VS Code local harness) capability probe for discovery agents.
+
+.DESCRIPTION
+    Not an event hook. The gateway doctor and the operator script
+    scripts/dev-tools/Test-DiscoveryHostCapability.ps1 run this probe to observe
+    whether this workspace's Copilot local harness provides the required discovery
+    controls: the SubagentStart, PreToolUse and SubagentStop handlers registered in
+    .github/hooks/discovery.json, their current hashes, and the host observations
+    the PreToolUse gate recorded while the discovery-capability-sentinel agent ran
+    in session SessionId. Workspace Trust and enabled hooks are host requirements
+    the harness enforces before running any hook; the caller reports them through
+    -WorkspaceTrusted. The result is a capability-attestation-shaped JSON document
+    on stdout; exit 0 when supported, 1 when unsupported. A session without
+    observations is unsupported.
+
+.NOTES
+    Issue #980. Requires PowerShell 7+. Invokes NO external process and makes no
+    in-process sentinel decision.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $false)][string]$WorkspaceRoot = (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent),
+    [Parameter(Mandatory = $false)][string]$SessionId = 'capability-probe',
+    [Parameter(Mandatory = $false)][AllowNull()][string]$Nonce = $null,
+    [Parameter(Mandatory = $false)][bool]$WorkspaceTrusted = $true,
+    [Parameter(Mandatory = $false)][AllowNull()][string]$RuntimeJson = $null
+)
+
+Import-Module (Join-Path $PSScriptRoot '../../.claude/lib/discovery-validation/DiscoveryCapability.psm1') -Force -Global -ErrorAction Stop
+. (Join-Path $PSScriptRoot 'discovery-pre-tool.ps1')
+
+function Get-DiscoveryProbeRuntime {
+    <#
+    .SYNOPSIS
+        Returns the runtime identity the probe records: the caller's JSON, or the local configuration digest.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param([Parameter(Mandatory = $false)][AllowNull()][string]$RuntimeJson, [Parameter(Mandatory = $true)][string]$WorkspaceRoot)
+
+    if (-not [string]::IsNullOrWhiteSpace($RuntimeJson)) {
+        $parsed = ConvertFrom-Json -InputObject $RuntimeJson -Depth 4
+        $runtime = [ordered]@{}
+        foreach ($key in @('build_sha256', 'package_version', 'policy_sha256', 'policy_version', 'schema_version')) {
+            # The runtime identity contract types policy_version as an integer; the hosts compare it canonically.
+            $runtime[$key] = $(if ($key -eq 'policy_version') { [int]$parsed.$key } else { [string]$parsed.$key })
+        }
+        return $runtime
+    }
+    # The workspace root is a host-modelled path string; Join-Path would require its drive to exist locally.
+    $configuration = "$($WorkspaceRoot.TrimEnd('/', '\'))/.github/hooks/discovery.json"
+    $digest = $(if (Test-Path -LiteralPath $configuration -PathType Leaf) { Get-DiscoveryBytesSha256Hex -Bytes ([System.IO.File]::ReadAllBytes($configuration)) } else { '0' * 64 })
+    return [ordered]@{ build_sha256 = $digest; package_version = '2.0.0'; policy_sha256 = $digest; policy_version = 2; schema_version = '2.0.0' }
+}
+
+function Invoke-DiscoveryCapabilityProbe {
+    <#
+    .SYNOPSIS
+        Runs the Copilot capability observation and returns the attestation-shaped document.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory = $true)][string]$WorkspaceRoot,
+        [Parameter(Mandatory = $true)][string]$SessionId,
+        [Parameter(Mandatory = $false)][AllowNull()][string]$Nonce = $null,
+        [Parameter(Mandatory = $false)][bool]$WorkspaceTrusted = $true,
+        [Parameter(Mandatory = $false)][AllowNull()][string]$RuntimeJson = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][hashtable]$HostEnvironment = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][hashtable]$Store = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][scriptblock]$ReadBytes = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][nullable[datetime]]$Now = $null
+    )
+
+    if ([string]::IsNullOrEmpty($Nonce)) { $Nonce = Get-DiscoveryAuthorizationNonce }
+    if ($null -eq $HostEnvironment) { $HostEnvironment = Get-DiscoveryTrustedHostEnvironment }
+    if ($null -eq $Store) { $Store = Get-DiscoveryDefaultStore }
+    if ($null -eq $Now) { $Now = [datetime]::UtcNow }
+    $parameters = @{
+        HostName = 'github-copilot'; WorkspaceRoot = $WorkspaceRoot; SessionId = $SessionId; Nonce = $Nonce; WorkspaceTrusted = $WorkspaceTrusted; Now = $Now
+        Runtime = (Get-DiscoveryProbeRuntime -RuntimeJson $RuntimeJson -WorkspaceRoot $WorkspaceRoot)
+        HostEnvironment = $HostEnvironment; Store = $Store
+    }
+    if ($null -ne $ReadBytes) { $parameters['ReadBytes'] = $ReadBytes }
+    $observation = Get-DiscoveryCapabilityObservation @parameters
+    # The doctor, the agent preparation and the start attestation read only the protected session copy.
+    [void](Write-DiscoveryCapabilityAttestation -Observation $observation -WorkspaceRoot $WorkspaceRoot -HostEnvironment $HostEnvironment -Store $Store)
+    return $observation
+}
+
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+$observation = Invoke-DiscoveryCapabilityProbe -WorkspaceRoot $WorkspaceRoot -SessionId $SessionId -Nonce $Nonce -WorkspaceTrusted $WorkspaceTrusted -RuntimeJson $RuntimeJson
+$observation | ConvertTo-Json -Depth 8 | Write-Output
+exit $(if ($observation['status'] -eq 'supported') { 0 } else { 1 })

package/resources/customizations/.github/hooks/discovery-planning.ps1

@@ -0,0 +1,91 @@
+<#
+.SYNOPSIS
+    GitHub Copilot (VS Code local harness) PreToolUse hook that gates planner and orchestrator launches on discovery authority.
+
+.DESCRIPTION
+    Registered through .github/hooks/*.json. The hook reads the Copilot PreToolUse
+    envelope from stdin (camelCase keys, snake_case accepted), recognizes an
+    atomic-planner or orchestrator launch, and takes its decision from the shared
+    DiscoveryPlanning module under .claude/lib/discovery-validation:
+
+    - a call that is not a planner or orchestrator launch, and a workspace without
+      a protected discovery activation, are allowed so existing behavior continues;
+    - an active workspace must still hold the activated locator and domain profile
+      and the protected session must hold a current, passing, gateway-written
+      planning-mode receipt for this host and session; otherwise the launch is
+      denied with the DISCOVERY_PLANNING_GATE_BLOCKED: prefix.
+
+    A helper that fails to load and an envelope that cannot be read both deny with
+    the prefix; the hook never fails open and never runs Python.
+
+.NOTES
+    Issue #980. Requires PowerShell 7+. Invokes NO external process.
+#>
+[CmdletBinding()]
+param()
+
+$script:DiscoveryPlanningReasonPrefix = 'DISCOVERY_PLANNING_GATE_BLOCKED:'
+$script:DiscoveryPlanningDependencyFailures = [System.Collections.Generic.List[object]]::new()
+
+function Add-DiscoveryPlanningDependencyFailure {
+    <#
+    .SYNOPSIS
+        Records one helper module that failed to load.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$Name,
+        [Parameter(Mandatory = $false)][AllowNull()][System.Management.Automation.ErrorRecord]$ErrorRecord
+    )
+
+    $message = 'no error record'
+    if ($null -ne $ErrorRecord) { $message = ([string]$ErrorRecord.Exception.Message -split "`r?`n")[0] }
+    [void]$script:DiscoveryPlanningDependencyFailures.Add([pscustomobject]@{ Name = $Name; Message = $message })
+}
+
+foreach ($moduleName in @('DiscoveryEncoding.psm1', 'DiscoveryAuthority.psm1', 'DiscoveryManifest.psm1', 'DiscoveryPayload.psm1', 'DiscoveryToolRouting.psm1', 'DiscoveryAuthorization.psm1', 'DiscoveryStartRecord.psm1', 'DiscoveryPlanning.psm1')) {
+    try { Import-Module (Join-Path $PSScriptRoot "../../.claude/lib/discovery-validation/$moduleName") -Force -Global -ErrorAction Stop } catch { Add-DiscoveryPlanningDependencyFailure -Name $moduleName -ErrorRecord $_ }
+}
+
+function Invoke-DiscoveryPlanningDecision {
+    <#
+    .SYNOPSIS
+        Parses the Copilot PreToolUse envelope and returns the hookSpecificOutput decision.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory = $false)][AllowNull()][AllowEmptyString()][string]$ToolInputRaw,
+        [Parameter(Mandatory = $false)][AllowNull()][hashtable]$HostEnvironment = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][hashtable]$Store = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][scriptblock]$ReadBytes = $null
+    )
+
+    if ($script:DiscoveryPlanningDependencyFailures.Count -gt 0) {
+        $first = $script:DiscoveryPlanningDependencyFailures[0]
+        return [ordered]@{
+            hookSpecificOutput = [ordered]@{
+                hookEventName            = 'PreToolUse'
+                permissionDecision       = 'deny'
+                permissionDecisionReason = "$($script:DiscoveryPlanningReasonPrefix) the dependency '$($first.Name)' failed to load ($($first.Message)); the gate fails closed."
+            }
+        }
+    }
+    if ($null -eq $HostEnvironment) { $HostEnvironment = Get-DiscoveryTrustedHostEnvironment }
+    if ($null -eq $Store) { $Store = Get-DiscoveryStartStore }
+
+    $normalized = ConvertFrom-DiscoveryHostPayloadText -HostName 'github-copilot' -Text $ToolInputRaw
+    $parameters = @{ Normalized = $normalized; HostEnvironment = $HostEnvironment; Store = $Store }
+    if ($null -ne $ReadBytes) { $parameters['ReadBytes'] = $ReadBytes }
+    $outcome = Get-DiscoveryPlanningDecision @parameters
+    return ConvertTo-DiscoveryPlanningHookOutput -Outcome $outcome -ReasonPrefix $script:DiscoveryPlanningReasonPrefix
+}
+
+# Guard allows dot-sourcing in tests without executing the entrypoint.
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+
+$decision = Invoke-DiscoveryPlanningDecision -ToolInputRaw ([Console]::In.ReadToEnd())
+$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+exit 0

package/resources/customizations/.github/hooks/discovery-pre-tool.ps1

@@ -0,0 +1,123 @@
+<#
+.SYNOPSIS
+    Native PreToolUse authorization adapter for GitHub Copilot (VS Code local harness) discovery agents.
+
+.DESCRIPTION
+    Registered through .github/hooks/*.json. The hook reads the Copilot PreToolUse
+    envelope from stdin (camelCase keys, snake_case accepted), derives the trusted
+    principal from the payload alone (session, agentId and agentType when the
+    harness supplies them, and parentAgentId or the literal parent root), and
+    takes its decision from the shared DiscoveryAuthorization module under
+    .claude/lib/discovery-validation:
+
+    - a root call (no agentId) of prepare_discovery_agent, run_discovery_doctor or
+      a controlled discovery tool is allowed with a one-use root grant the MCP
+      server consumes; every other root call and every call of an agent that is
+      not a discovery specialist is allowed, so ordinary sessions keep their behavior;
+    - a sentinel envelope is observed for the capability probe and never granted;
+    - a discovery specialist may use read-only native tools and the controlled
+      discovery MCP tools only; shell, terminal, exec and evaluation tools, generic
+      file mutations, nested agents, foreign MCP servers, root-only discovery
+      operations and caller-supplied identity fields are denied before execution;
+    - the specialist's first controlled call binds the single prepared invocation
+      of its session, parent and agent type (the Copilot subagentStart payload
+      carries no agent identifier); every controlled call must name that invocation
+      through invocation_ref and is recorded as one short-lived, one-use tool-authorization.
+
+    A helper that fails to load and an envelope that cannot be read both deny with
+    the DISCOVERY_ARTIFACT_GATE_BLOCKED: prefix; the hook never fails open.
+
+.NOTES
+    Issue #980. Requires PowerShell 7+. Invokes NO external process.
+#>
+[CmdletBinding()]
+param()
+
+$script:DiscoveryGateReasonPrefix = 'DISCOVERY_ARTIFACT_GATE_BLOCKED:'
+$script:DiscoveryGateHandlerPath = $PSCommandPath
+$script:DiscoveryGateDependencyFailures = [System.Collections.Generic.List[object]]::new()
+
+function Add-DiscoveryGateDependencyFailure {
+    <#
+    .SYNOPSIS
+        Records one helper module that failed to load.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$Name,
+        [Parameter(Mandatory = $false)][AllowNull()][System.Management.Automation.ErrorRecord]$ErrorRecord
+    )
+
+    $message = 'no error record'
+    if ($null -ne $ErrorRecord) { $message = ([string]$ErrorRecord.Exception.Message -split "`r?`n")[0] }
+    [void]$script:DiscoveryGateDependencyFailures.Add([pscustomobject]@{ Name = $Name; Message = $message })
+}
+
+foreach ($moduleName in @('DiscoveryEncoding.psm1', 'DiscoveryAuthority.psm1', 'DiscoveryPayload.psm1', 'DiscoveryToolRouting.psm1', 'DiscoveryStartRecord.psm1', 'DiscoveryRootGrant.psm1', 'DiscoveryObservation.psm1', 'DiscoveryStart.psm1', 'DiscoveryAuthorization.psm1')) {
+    try { Import-Module (Join-Path $PSScriptRoot "../../.claude/lib/discovery-validation/$moduleName") -Force -Global -ErrorAction Stop } catch { Add-DiscoveryGateDependencyFailure -Name $moduleName -ErrorRecord $_ }
+}
+
+function Get-DiscoveryGateHandlerSha256 {
+    <#
+    .SYNOPSIS
+        Returns the SHA-256 of this handler's own bytes for the authorization writer record.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory = $false)][AllowNull()][string]$HandlerPath = $script:DiscoveryGateHandlerPath)
+
+    if ([string]::IsNullOrEmpty($HandlerPath) -or -not (Test-Path -LiteralPath $HandlerPath -PathType Leaf)) {
+        return ('0' * 64)
+    }
+    return Get-DiscoveryBytesSha256Hex -Bytes ([System.IO.File]::ReadAllBytes($HandlerPath))
+}
+
+function Invoke-DiscoveryPreToolDecision {
+    <#
+    .SYNOPSIS
+        Parses the Copilot PreToolUse envelope and returns the hookSpecificOutput decision.
+    .DESCRIPTION
+        Every seam defaults to the real host and is injectable so tests run over
+        in-memory values. A recorded helper failure denies before the envelope is read.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory = $false)][AllowNull()][AllowEmptyString()][string]$ToolInputRaw,
+        [Parameter(Mandatory = $false)][AllowNull()][hashtable]$HostEnvironment = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][hashtable]$Store = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][nullable[datetime]]$Now = $null,
+        [Parameter(Mandatory = $false)][AllowNull()][string]$Nonce = $null
+    )
+
+    if ($script:DiscoveryGateDependencyFailures.Count -gt 0) {
+        $first = $script:DiscoveryGateDependencyFailures[0]
+        return [ordered]@{
+            hookSpecificOutput = [ordered]@{
+                hookEventName            = 'PreToolUse'
+                permissionDecision       = 'deny'
+                permissionDecisionReason = "$($script:DiscoveryGateReasonPrefix) the dependency '$($first.Name)' failed to load ($($first.Message)); the gate fails closed."
+            }
+        }
+    }
+    # Seams resolve only after the dependency check so a missing module denies
+    # instead of raising while a default is evaluated.
+    if ($null -eq $HostEnvironment) { $HostEnvironment = Get-DiscoveryTrustedHostEnvironment }
+    if ($null -eq $Store) { $Store = Get-DiscoveryDefaultStore }
+    if ($null -eq $Now) { $Now = [datetime]::UtcNow }
+    if ([string]::IsNullOrEmpty($Nonce)) { $Nonce = Get-DiscoveryAuthorizationNonce }
+
+    $normalized = ConvertFrom-DiscoveryHostPayloadText -HostName 'github-copilot' -Text $ToolInputRaw
+    $outcome = Get-DiscoveryPreToolDecision -Normalized $normalized -HostEnvironment $HostEnvironment `
+        -HandlerSha256 (Get-DiscoveryGateHandlerSha256) -Store $Store -Now $Now -Nonce $Nonce
+    return ConvertTo-DiscoveryPreToolHookOutput -Outcome $outcome -ReasonPrefix $script:DiscoveryGateReasonPrefix
+}
+
+# Guard allows dot-sourcing in tests without executing the entrypoint.
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+
+$decision = Invoke-DiscoveryPreToolDecision -ToolInputRaw ([Console]::In.ReadToEnd())
+$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+exit 0

package/resources/customizations/.github/hooks/discovery.json

@@ -0,0 +1,35 @@
+{
+  "version": 1,
+  "hooks": {
+    "SubagentStart": [
+      {
+        "type": "command",
+        "powershell": "pwsh -NoProfile -File .github/hooks/discovery-agent-start.ps1",
+        "bash": "pwsh -NoProfile -File .github/hooks/discovery-agent-start.ps1",
+        "timeout": 30
+      }
+    ],
+    "PreToolUse": [
+      {
+        "type": "command",
+        "powershell": "pwsh -NoProfile -File .github/hooks/discovery-pre-tool.ps1",
+        "bash": "pwsh -NoProfile -File .github/hooks/discovery-pre-tool.ps1",
+        "timeout": 30
+      },
+      {
+        "type": "command",
+        "powershell": "pwsh -NoProfile -File .github/hooks/discovery-planning.ps1",
+        "bash": "pwsh -NoProfile -File .github/hooks/discovery-planning.ps1",
+        "timeout": 30
+      }
+    ],
+    "SubagentStop": [
+      {
+        "type": "command",
+        "powershell": "pwsh -NoProfile -File .github/hooks/discovery-agent-stop.ps1",
+        "bash": "pwsh -NoProfile -File .github/hooks/discovery-agent-stop.ps1",
+        "timeout": 60
+      }
+    ]
+  }
+}

package/resources/customizations/.github/instructions/mermaid.instructions.md

@@ -0,0 +1,85 @@
+---
+applyTo: "**"
+---
+# Mermaid AI Skills
+
+When the user asks to create, edit, or visualize any diagram, use the Mermaid
+VS Code extension tools and commands described below.
+
+## Workflow
+
+1. Determine the diagram type and generate Mermaid syntax.
+2. Write the diagram to a `.mmd` file in the project.
+3. Validate syntax: correct first-line keyword, arrow types, balanced brackets.
+4. Preview via the Mermaid extension — open the `.mmd` file (auto-preview) or run
+   **MermaidChart: Preview Diagram** (`mermaidChart.preview`).
+
+## LM Tools — call these for every diagram interaction
+
+- `mermaid-diagram-validator` — validate Mermaid syntax before presenting any diagram
+- `mermaid-diagram-preview` — render a live preview inside VS Code after generating
+- `get-syntax-docs-mermaid` — fetch correct syntax docs for any diagram type
+
+## VS Code Commands
+
+Invoke via Command Palette or the VS Code command API (GitHub Copilot in VS Code only).
+Do not invent command IDs. Prefer writing/editing `.mmd` files when a command is not needed.
+
+### Diagram editing & preview
+- **Preview** (`mermaidChart.preview`) — preview the active Mermaid editor (`.mmd` / `.mermaid` must be open).
+- **Create Diagram** (`mermaidChart.createMermaidFile`) — creates a demo flowchart and opens preview side by side.
+- **Repair Diagram** (`mermaidChart.repairDiagram`) — Mermaid AI repair for the active diagram; uses Mermaid AI credits — tell the user before running.
+- **Improve Diagram** (`mermaidChart.improveDiagram`) — uses Copilot / LM API; suggests layout + styling variants for the active diagram.
+
+### Generate diagrams (GitHub Copilot required)
+- **Generate Diagram from Code** (`mermaidChart.generateDiagramFromCode`)
+- **Generate Cloud Diagram** (`mermaidChart.generateCloudDiagram`)
+- **Generate ER Diagram** (`mermaidChart.generateERDiagram`)
+- **Generate Docker Diagram** (`mermaidChart.generateDockerDiagram`)
+- **Open AI Chat** (`mermaidChart.openCopilotChat`)
+
+### Mermaid Chart cloud
+- **Login** (`mermaidChart.login`) / **Logout** (`mermaidChart.logout`)
+- **Connect Diagram** (`mermaidChart.connectDiagramToMermaidChart`) — link a local diagram to Mermaid Chart.
+- **Sync Diagram** (`mermaidChart.syncDiagramWithMermaid`) — only for diagrams already connected (frontmatter has `id:`). Example:
+  ```yaml
+  ---
+  id: cbd9e9ba-a2cb-47c5-a98e-8c28a753428d
+  ---
+  ```
+
+### Review Mermaid Sync
+For diagrams updated by the Mermaid Chart GitHub Sync app (or pre-commit regenerate):
+- **Review Mermaid Sync** (`mermaidChart.reviewAppCommits`) — start / open the review flow.
+- **Regenerate with Mermaid AI** (`mermaidChart.regenerateDiagramWithMermaidAI`) — regenerate from source references.
+Do not manually rewrite diagrams managed by this workflow. Accept/reject/diff UI actions stay in the extension UI.
+
+### Install / update this pack
+- **MermaidChart: Install AI Skills…** (`mermaidChart.installAiSkills`)
+
+## @mermaid-chart slash commands
+
+| Command | Purpose |
+|---|---|
+| `/generate_diagram_from_code` | General diagram from any source file |
+| `/generate_execution_sequence` | Sequence diagram from code flow |
+| `/generate_er_diagram` | ER diagram from schema / models |
+| `/generate_cloud_architecture_diagram` | Cloud / CI-CD architecture |
+| `/generate_docker_diagram` | Architecture from Dockerfiles |
+| `/generate_c4_topdown_architecture` | C4 top-down architecture |
+| `/analyze_code_ownership` | Code ownership diagram |
+| `/generate_dependency_diagram` | Dependency / security visualisation |
+
+## Rules
+
+1. Always call `mermaid-diagram-validator` before showing any diagram.
+2. Always call `mermaid-diagram-preview` after generating a diagram.
+3. Use `get-syntax-docs-mermaid` before generating an unfamiliar diagram type.
+4. Prefer `@mermaid-chart` slash commands for complex generation.
+5. Write diagrams to `.mmd` files; never return unvalidated Mermaid syntax.
+6. Warn the user before Repair (Mermaid AI credits).
+7. Cooperate with the Sync workflow — do not manually regenerate managed diagrams.
+
+## Docs
+
+More commands and features: https://marketplace.visualstudio.com/items?itemName=MermaidChart.vscode-mermaid-chart

package/resources/customizations/.github/prompts/execute-hard-lock.prompt.md

@@ -0,0 +1,105 @@
+YOU ARE OPERATING IN ATOMIC EXECUTION MODE (atomic_executor).
+
+IDENTITY & SCOPE
+- Execution-only persona. No planning, no redesign, no reordering.
+- Execute an atomic_planner plan exactly as written.
+- Preserve Phase headings, task IDs ([P#-T#]), checkbox format, and task order.
+- Complete tasks strictly one-by-one.
+- Verify acceptance criteria before checking off any task.
+
+SUPREMACY & PRECONDITIONS (NON-NEGOTIABLE)
+- Repository policy files override these instructions.
+- BEFORE executing any task, you must confirm compliance with:
+  1) .github/copilot-instructions.md
+  2) .github/instructions/general-code-change.instructions.md
+  3) .github/instructions/general-unit-test.instructions.md
+  4) Any applicable language-specific policies
+- If Phase 0 does not include:
+  - Repo-policy reading tasks, AND
+  - Baseline toolchain capture for each language touched by the plan,
+  the plan is INVALID and execution must not begin.
+
+PLAN AUTHORITY (THE CONTRACT)
+- The plan text is the sole source of truth and the only todo list.
+- Task IDs must remain unchanged and referenced exactly.
+- Tasks must be executed in exact written order.
+- You MUST NOT:
+  - Add phases or tasks
+  - Reorder tasks
+  - Replace the plan with an alternative approach
+  - Perform work not explicitly described in the plan
+
+PREFLIGHT VALIDATION GATE (BEFORE [P0-T1])
+You must validate ALL of the following; otherwise STOP:
+- Phase headings follow “Phase N — …”
+- Each task is a markdown checkbox with valid [P#-T#]
+- Phase numbers and task IDs are consistent
+- Phase 0 exists and includes:
+  - Repo-policy reading
+  - Baseline toolchain runs for each language touched
+- A final QA phase exists with full toolchain loops per touched language
+- Any TDD red tests are tagged [expect-fail]
+- No task is non-atomic or unverifiable
+
+If blocked:
+- State: “BLOCKED at preflight (before [P0-T1])”
+- Explain concretely
+- Provide an exact plan delta
+- Request atomic_planner regeneration or user approval
+
+EXECUTION LOOP (AFTER PREFLIGHT PASSES)
+Once execution begins:
+- Do NOT stop mid-plan
+- Do NOT replan or redesign
+- Persist across turns until the plan is fully complete
+
+For EACH task:
+1) Announce: “Executing [P#-T#]: …”
+2) Verify stated preconditions
+3) Perform ONLY work required by the task (bounded micro-actions allowed)
+4) Verify acceptance criteria
+5) Run required toolchains as specified or implied
+6) Check off the task ONLY when verification passes
+
+[expect-fail] tasks:
+- A failing test is success ONLY for that task
+- Formatting, linting, and type checks still apply unless explicitly waived
+
+BLOCKING RULE
+- Blocking is permitted ONLY during preflight.
+- After execution begins, blocking is forbidden; continue to completion.
+
+RESUME / CONTINUE
+- On “resume”, “continue”, or “try again”:
+  - Reload the last plan-of-record
+  - Identify the next unchecked task
+  - Announce: “Continuing from [P#-T#]”
+  - Continue execution without replanning
+
+OUTPUT DISCIPLINE
+- Be concise and exact
+- Show commands run and summarize results (pass/fail, key errors)
+- Do not paste large code blocks unless asked
+- Report toolchain status explicitly for each touched language
+- End every response with the updated checklist (or current phase + next tasks)
+
+--- END OF ATOMIC EXECUTION HARD-LOCK ---
+
+MODE CONTEXT
+- Selected work mode: `${work-mode}`
+
+PLAN OF RECORD
+`${plan-path}`
+
+MANDATORY READ-PROOF (DO THIS FIRST; NO EXECUTION YET)
+1) Confirm the Plan of Record file exists in the repo/branch you are operating on.
+2) Output a fingerprint of what you read:
+   - git rev-parse HEAD
+   - sha256 of the plan file
+   - total count of tasks matching "^- \\[[ x]\\] \\[P" (or equivalent)
+3) Enter atomic execution mode
+4) Perform PREFLIGHT VALIDATION ONLY.
+5) Identify the FIRST unchecked task ([ ]) in plan order and print ONLY:
+   - the exact line for that task
+   - 2 lines above and 2 lines below (no more)
+6) State: "READY TO BEGIN FROM [P#-T#]" and immediately begin execution..