@danmoisan/drm-copilot-mcp 1.1.23 → 1.1.25

package/resources/codex-and-agents-customizations/.agents/skills/adjudicate-unspecified-behavior/SKILL.md

@@ -0,0 +1,135 @@
+---
+name: adjudicate-unspecified-behavior
+description: 'Draft traceable proposals for unresolved behavior and separate them from root-owned approval. Use when asked to adjudicate contradictory or undocumented behavior and derive explicitly requested acceptance criteria.'
+---
+
+# Adjudicate Unspecified Behavior
+
+## When to Use This Skill
+
+Use for selected unresolved records with competing interpretations and a named decision owner. A request to adjudicate does not let the specialist approve its own proposal.
+
+## Inputs
+
+These are human-facing workflow selections, not additional service-request fields.
+Supply explicit selections; neither omitted inputs nor profile roots create authority.
+
+| Input | Required contract |
+| --- | --- |
+| profile | Required validated profile and trusted workspace binding. |
+| unresolved_ids | Required explicit unresolved record selection. |
+| interpretations | Required competing interpretations and unknowns. |
+| evidence_refs | Required selected evidence supporting or contradicting each interpretation. |
+| decision_owner | Required explicit owner for a proposed decision. |
+| approval_record | Optional explicitly supplied approval evidence; only the authorized root may apply it. |
+| derived_acceptance | Optional explicit selection of derived acceptance records/views; it adds no feature-contract authority. |
+
+## Routing
+
+Logical role: `requirements-reconciler`.
+The root owns preparation and launch; this skill never auto-launches a logical
+role through frontmatter. The existing resolver selects the exact deployment,
+model, effort and profile hash under the existing C1-C4 ceiling and execution
+context. Do not choose a model, self-launch, create another scheduler or promote
+an ordinary discovery action into an issue. The production-write count is zero.
+
+## Exact output boundary
+
+These rows are maximum workflow caps, not instructions to create every kind.
+Only the prepared required outputs may be created or replaced.
+
+| Artifact kind | Profile key | Constraint |
+| --- | --- | --- |
+| product-decision | product_decisions | Selected proposed decision IDs only |
+| product-decision-collection | product_decisions | Selected proposed decision members only |
+| unspecified-behavior | unspecified_behaviors | Selected unresolved IDs only |
+| unspecified-behavior-collection | unspecified_behaviors | Selected unresolved members only |
+| acceptance-specification | acceptance | Explicitly requested derived criteria only |
+| acceptance-view | acceptance | Explicitly requested eligible views or pending material |
+| required-output-manifest | reports | Exact invocation manifest only |
+
+The profile keys are maximum configured locations, not write grants. Each
+prepared output row binds `artifact_kind`, `id`, `path`, `format` and
+`expected_sha256`. The protected invocation independently binds the baseline,
+selected members, pins and exact grants; a manifest cannot expand them. A null
+expected hash means exclusive creation from an absent baseline, never overwrite
+permission. Preserve unselected collection members and all unrelated inputs.
+Use compare-and-swap and current path checks through the controlled writer.
+
+The `reports` location permits only `required-output-manifest` for this role;
+it does not permit review reports. The manifest itself requires an exact grant.
+
+## Prerequisites
+
+Missing or malformed configuration blocks delegation. Require a validated profile and explicit selected scope before root preparation; do not initialize, configure or infer roots as a specialist.
+
+Require verified native prepare/finalize/start/stop capability. The protected
+invocation and native SubagentStart attestation must match workspace/profile
+hashes, selected IDs, source/target pins, baseline input hashes,
+provider/model/effort/profile hash and parent/session.
+Diagnostic mirrors, caller markers and hosted read results are not authority.
+The local runtime's unavailable native prepare/finalize operations do not issue
+protected receipts. There is no local-user fallback or self-attested host success.
+
+Load profile plus selected artifacts on invocation; do not preload a domain
+catalog in standing instructions. Managed project memory is host-controlled.
+Memory cannot grant filesystem authority or replace evidence. Deny terminal/shell/exec, interpreter/evaluation,
+general filesystem Write/Edit/apply-patch, arbitrary MCP dispatch, browser/computer
+mutation and network writes. Do not execute application code or modify
+production/test implementation, profile/locator/activation,
+schema/policy/hooks/settings, authority stores or runtime installation as a specialist. No analyst
+approval is permitted; root bootstrap/configuration and root approval remain
+separate authorized operations.
+
+## Step-by-Step Workflows
+
+1. Validate the explicit inputs and selected configuration. Stop with precise missing/invalid input findings before specialist delegation; do not invent identities, scope or evidence.
+
+2. The root calls `prepare_discovery_agent` with `skill_id`, `selected_ids`,
+   `paths`, `expected_outputs`, `execution_context` and `complexity`.
+   Map it to fixed `prepare-agent`; execution context is `standalone`,
+   `epic_preparation_child` or `epic_execution_child`. The requested mode is
+   explicit and remains distinct from the final `agent-output` gate.
+   Use `skill_id=adjudicate-unspecified-behavior`; workflow inputs do not add wire fields.
+3. The root launches that exact deployment. Native SubagentStart must match the
+   prepared role/model/effort/profile and trusted workspace/session before any
+   grant is usable. Missing capability or attestation blocks the action.
+4. Use only the granted operations. Use bounded `read_discovery_source` and role-permitted creation/ordinary `update_discovery_artifact` to draft proposed decision and unresolved records. Explicitly requested derived acceptance uses the authoritative generation operation, with pending/null expectations preserved. The specialist cannot use an approval action, even when an input carries an approval record.
+5. Preserve observed source facts, competing interpretations and approved history. Draft proposed decisions only. Do not approve/reject/supersede product decisions or alter approval history. Pending questions cannot become approved requirements. Derived criteria do not authorize `feature_contracts` writes. Without root approval, a proposal remains a proposal.
+6. Produce every exact required output and the stored `required-output-manifest`,
+   preserving its output array order for the digest. Validate claims, references,
+   pins and selected-ID accounting. Purpose-built tools supply authorized proposal
+   inputs for `input_path`/`evidence_path`; never invent a generic Write staging
+   step. Server-side role checks, exact one-use authorization and prospective
+   validation remain mandatory. Bounded source reads preserve content identity
+   and line ranges; truncation requires a narrower selection, not a completeness
+   claim or filesystem fallback.
+7. Call `finalize_discovery_agent` as the specialist, mapped to `finalize-agent`
+   with `mode=agent-output`, non-null `invocation_ref` and no operation inputs.
+   It validates the protected invocation's outputs, not final-message paths.
+   Native SubagentStop then verifies current output authority.
+   Missing final text cannot skip native stop validation.
+8. After proposal finalization and native stop, the authorized root may separately call `update_discovery_artifact`, mapped to `update-artifact` with `update_action=approve-decision`, exact product-decision identity, whole-document `input_path`, `expected_sha256`, `approval_owner` and nonempty `approval_evidence_refs`. Ordinary replacement cannot set approval-only fields. Root approval is a separate authorized operation from reconciler proposal validity; it invalidates prior completion receipts and requires fresh validation before any later gate.
+9. After the separate root operation, the root records the explicit result, content-addressed artifact references,
+   selected-ID accounting and all findings. A successful tool call or generated
+   path alone is not evidence of completed discovery.
+
+## Stop and result
+
+Return proposal findings and any separate root approval result explicitly. Do not report a proposed or pending decision as approved; omit approval when the required authorization or evidence is absent.
+
+Structural success is not discovery, parity or planning completion.
+Missing prepare/finalize/start/stop capability, missing outputs, invalid claims,
+unresolved required work, wrong role/model/start context or a stale/missing
+receipt blocks successful completion. Return explicit
+PASS, FAIL or BLOCKED, distinguishing valid incremental outputs from a passing
+completion gate. Missing native enforcement remains BLOCKED even when ordinary
+local-user operations can run; do not substitute CLI success for native authority.
+
+## References
+
+- [Canonical requirements-reconciler contract](../../../.codex/agents/requirements-reconciler.toml)
+- Installed v2 `service-request` and `required-output-manifest` schema contracts;
+  consume them through the authoritative runtime, with no checkout-schema fallback.
+- The selected profile and pinned local artifacts supplied for this invocation;
+  references do not preload catalogs or grant access to unselected paths.

package/resources/codex-and-agents-customizations/.agents/skills/atomic-planner/SKILL.md

@@ -36,6 +36,13 @@ Each task must be:
 - independently verifiable,
 - free of placeholder text.
 
+In a workspace with an active discovery activation, the planner launch itself is admitted
+only after the native planning gate verifies the receipt named by the profile's
+`completion_gates.planning_prerequisite`. A plan cites the current acceptance
+specifications as its criteria and keeps implementation test passes as separate,
+executor-verified tasks: a ready criterion is never recorded as a passed test (see
+`docs/engineering/legacy-discovery-and-parity/enforcement.md`).
+
 ## Scratch Location
 
 Concurrent child runs in one session share one session scratchpad, so every plan places its scratch files in a directory unique to the child.

package/resources/codex-and-agents-customizations/.agents/skills/characterize-runtime-behavior/SKILL.md

@@ -0,0 +1,134 @@
+---
+name: characterize-runtime-behavior
+description: 'Describe selected runtime scenarios from supplied captures or honest manual plans. Use when asked to characterize legacy behavior, record runtime evidence or prepare not-run and blocked scenarios.'
+---
+
+# Characterize Runtime Behavior
+
+## When to Use This Skill
+
+Use for explicit runtime scenarios with supplied environment and capability information. The specialist documents observations or manual plans; it does not execute applications.
+
+## Inputs
+
+These are human-facing workflow selections, not additional service-request fields.
+Supply explicit selections; neither omitted inputs nor profile roots create authority.
+
+| Input | Required contract |
+| --- | --- |
+| profile | Required validated profile and trusted workspace binding. |
+| feature_ids | Required selected features and relevant contracts. |
+| environment | Required recorded environment identity or explicit unavailable state. |
+| fixtures | Required supplied fixture references or explicit absent/manual requirements. |
+| preconditions | Required stated scenario preconditions; unknown facts remain unresolved. |
+| actions | Required ordered manual actions or supplied action descriptions. |
+| capability_mode | Required declared runtime capability and whether observations are supplied, manual, unavailable or blocked. |
+| supplied_captures | Optional supplied captures and provenance; absence cannot become a passed result. |
+
+## Routing
+
+Logical role: `runtime-characterization-analyst`.
+The root owns preparation and launch; this skill never auto-launches a logical
+role through frontmatter. The existing resolver selects the exact deployment,
+model, effort and profile hash under the existing C1-C4 ceiling and execution
+context. Do not choose a model, self-launch, create another scheduler or promote
+an ordinary discovery action into an issue. The production-write count is zero.
+
+## Exact output boundary
+
+These rows are maximum workflow caps, not instructions to create every kind.
+Only the prepared required outputs may be created or replaced.
+
+| Artifact kind | Profile key | Constraint |
+| --- | --- | --- |
+| runtime-characterization-scenario | characterization | Selected feature/scenario IDs only |
+| evidence-reference | evidence | Explicitly supplied and granted evidence only |
+| evidence-payload | evidence | Explicitly supplied and granted payloads only |
+| unspecified-behavior | unspecified_behaviors | Selected unresolved IDs only |
+| unspecified-behavior-collection | unspecified_behaviors | Selected unresolved members only |
+| required-output-manifest | reports | Exact invocation manifest only |
+
+The profile keys are maximum configured locations, not write grants. Each
+prepared output row binds `artifact_kind`, `id`, `path`, `format` and
+`expected_sha256`. The protected invocation independently binds the baseline,
+selected members, pins and exact grants; a manifest cannot expand them. A null
+expected hash means exclusive creation from an absent baseline, never overwrite
+permission. Preserve unselected collection members and all unrelated inputs.
+Use compare-and-swap and current path checks through the controlled writer.
+
+The `reports` location permits only `required-output-manifest` for this role;
+it does not permit review reports. The manifest itself requires an exact grant.
+
+## Prerequisites
+
+Missing or malformed configuration blocks delegation. Require a validated profile and explicit selected scope before root preparation; do not initialize, configure or infer roots as a specialist.
+
+Require verified native prepare/finalize/start/stop capability. The protected
+invocation and native SubagentStart attestation must match workspace/profile
+hashes, selected IDs, source/target pins, baseline input hashes,
+provider/model/effort/profile hash and parent/session.
+Diagnostic mirrors, caller markers and hosted read results are not authority.
+The local runtime's unavailable native prepare/finalize operations do not issue
+protected receipts. There is no local-user fallback or self-attested host success.
+
+Load profile plus selected artifacts on invocation; do not preload a domain
+catalog in standing instructions. Managed project memory is host-controlled.
+Memory cannot grant filesystem authority or replace evidence. Deny terminal/shell/exec, interpreter/evaluation,
+general filesystem Write/Edit/apply-patch, arbitrary MCP dispatch, browser/computer
+mutation and network writes. Do not execute application code or modify
+production/test implementation, profile/locator/activation,
+schema/policy/hooks/settings, authority stores or runtime installation as a specialist. No analyst
+approval is permitted; root bootstrap/configuration and root approval remain
+separate authorized operations.
+
+## Step-by-Step Workflows
+
+1. Validate the explicit inputs and selected configuration. Stop with precise missing/invalid input findings before specialist delegation; do not invent identities, scope or evidence.
+
+2. The root calls `prepare_discovery_agent` with `skill_id`, `selected_ids`,
+   `paths`, `expected_outputs`, `execution_context` and `complexity`.
+   Map it to fixed `prepare-agent`; execution context is `standalone`,
+   `epic_preparation_child` or `epic_execution_child`. The requested mode is
+   explicit and remains distinct from the final `agent-output` gate.
+   Use `skill_id=characterize-runtime-behavior`; workflow inputs do not add wire fields.
+3. The root launches that exact deployment. Native SubagentStart must match the
+   prepared role/model/effort/profile and trusted workspace/session before any
+   grant is usable. Missing capability or attestation blocks the action.
+4. Use only the granted operations. Use bounded `read_discovery_source` for selected contracts, documentation, fixtures and supplied captures. Use `create_discovery_artifact` for fixed `new-scenario`, ordinary `update_discovery_artifact` and `link_discovery_evidence` for exact granted records. Register supplied metadata/payloads through controlled tools; never manufacture or collect new runtime captures by launching an application.
+5. Every requested scenario needs a plan/result state. Known expectations stay separate from unknown expectations; unknown expectations stay null with unresolved references. A passed runtime result needs qualifying runtime evidence. Source inspection, static inference and a scenario plan are not runtime execution evidence. Valid manual/no-runtime tasks may end in not-run or blocked plans when those are the prepared outputs, without claiming behavior passed.
+6. Produce every exact required output and the stored `required-output-manifest`,
+   preserving its output array order for the digest. Validate claims, references,
+   pins and selected-ID accounting. Purpose-built tools supply authorized proposal
+   inputs for `input_path`/`evidence_path`; never invent a generic Write staging
+   step. Server-side role checks, exact one-use authorization and prospective
+   validation remain mandatory. Bounded source reads preserve content identity
+   and line ranges; truncation requires a narrower selection, not a completeness
+   claim or filesystem fallback.
+7. Call `finalize_discovery_agent` as the specialist, mapped to `finalize-agent`
+   with `mode=agent-output`, non-null `invocation_ref` and no operation inputs.
+   It validates the protected invocation's outputs, not final-message paths.
+   Native SubagentStop then verifies current output authority.
+   Missing final text cannot skip native stop validation.
+8. After native stop, the root records the explicit result, content-addressed artifact references,
+   selected-ID accounting and all findings. A successful tool call or generated
+   path alone is not evidence of completed discovery.
+
+## Stop and result
+
+Account for each selected feature/scenario, supplied capture and missing capability. Output-valid manual plans do not prove runtime success or completion readiness.
+
+Structural success is not discovery, parity or planning completion.
+Missing prepare/finalize/start/stop capability, missing outputs, invalid claims,
+unresolved required work, wrong role/model/start context or a stale/missing
+receipt blocks successful completion. Return explicit
+PASS, FAIL or BLOCKED, distinguishing valid incremental outputs from a passing
+completion gate. Missing native enforcement remains BLOCKED even when ordinary
+local-user operations can run; do not substitute CLI success for native authority.
+
+## References
+
+- [Canonical runtime-characterization-analyst contract](../../../.codex/agents/runtime-characterization-analyst.toml)
+- Installed v2 `service-request` and `required-output-manifest` schema contracts;
+  consume them through the authoritative runtime, with no checkout-schema fallback.
+- The selected profile and pinned local artifacts supplied for this invocation;
+  references do not preload catalogs or grant access to unselected paths.

package/resources/codex-and-agents-customizations/.agents/skills/discovery-behavior-reconciliation/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: discovery-behavior-reconciliation
+description: 'Dispatch unresolved behavior to canonical proposal and root-approval handling. Use when invoking the existing behavior-reconciliation alias.'
+---
+
+# Discovery Behavior Reconciliation Alias
+
+## When to Use This Skill
+
+Use this compatibility name only to dispatch to its canonical workflow.
+
+## Inputs
+
+| Input | Required contract |
+| --- | --- |
+| inputs | Required inputs of the linked canonical workflow, forwarded unchanged. |
+
+Forward all other supplied canonical inputs to the selected target. These
+alias selectors are not service-request fields. A fixed mapping requires no
+additional selector; it does not add fields to `prepare-agent`.
+
+## Dispatch
+
+| Selector | Canonical skill |
+| --- | --- |
+| fixed | adjudicate-unspecified-behavior |
+
+Dispatch directly to `adjudicate-unspecified-behavior`. The target separates specialist proposals from authorized root approval; this alias does not approve decisions.
+
+This alias has no independent output or write authority. Do not duplicate
+business validation, call tools independently, create a receipt, change a model
+or auto-launch a role. Use only the linked canonical workflow's lifecycle and
+exact grants; no alias chain or filesystem fallback is permitted.
+
+## Stop and result
+
+Return the selected canonical workflow's explicit result and references without
+changing failed, blocked, pending or incremental outcomes into completion.
+An unknown selector fails with no fallback. Missing configuration or native
+capability is handled by the canonical workflow, including initialization's
+explicit root bootstrap exception. The alias cannot bypass prepare/finalize or
+native start/stop requirements.
+
+## References
+
+- [adjudicate-unspecified-behavior](../adjudicate-unspecified-behavior/SKILL.md)

package/resources/codex-and-agents-customizations/.agents/skills/discovery-coverage-ledger/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: discovery-coverage-ledger
+description: 'Dispatch explicit inventory, extraction or review without mixing coverage ownership. Use when invoking the existing coverage-ledger alias with action=inventory, extract or review.'
+---
+
+# Discovery Coverage Ledger Alias
+
+## When to Use This Skill
+
+Use this compatibility name only to dispatch to its canonical workflow.
+
+## Inputs
+
+| Input | Required contract |
+| --- | --- |
+| action | Required inventory, extract or review; reject missing, mixed or unknown actions with no fallback. |
+
+Forward all other supplied canonical inputs to the selected target. These
+alias selectors are not service-request fields. A fixed mapping requires no
+additional selector; it does not add fields to `prepare-agent`.
+
+## Dispatch
+
+| Selector | Canonical skill |
+| --- | --- |
+| inventory | inventory-legacy-system |
+| extract | extract-feature-contract |
+| review | review-discovery-coverage |
+
+`action=inventory|extract|review` selects the corresponding canonical workflow. Inventory and extraction use `legacy-parity-analyst`; review uses `migration-coverage-reviewer` with no reviewer ledger writes. These names describe the target's mapping and never authorize an unprepared logical-role launch.
+
+This alias has no independent output or write authority. Do not duplicate
+business validation, call tools independently, create a receipt, change a model
+or auto-launch a role. Use only the linked canonical workflow's lifecycle and
+exact grants; no alias chain or filesystem fallback is permitted.
+
+## Stop and result
+
+Return the selected canonical workflow's explicit result and references without
+changing failed, blocked, pending or incremental outcomes into completion.
+An unknown selector fails with no fallback. Missing configuration or native
+capability is handled by the canonical workflow, including initialization's
+explicit root bootstrap exception. The alias cannot bypass prepare/finalize or
+native start/stop requirements.
+
+## References
+
+- [inventory-legacy-system](../inventory-legacy-system/SKILL.md)
+- [extract-feature-contract](../extract-feature-contract/SKILL.md)
+- [review-discovery-coverage](../review-discovery-coverage/SKILL.md)

package/resources/codex-and-agents-customizations/.agents/skills/discovery-parity-matrix/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: discovery-parity-matrix
+description: 'Dispatch parity reconciliation to the canonical Requirements Reconciler workflow. Use when invoking the existing discovery parity-matrix alias.'
+---
+
+# Discovery Parity Matrix Alias
+
+## When to Use This Skill
+
+Use this compatibility name only to dispatch to its canonical workflow.
+
+## Inputs
+
+| Input | Required contract |
+| --- | --- |
+| inputs | Required inputs of the linked canonical workflow, forwarded unchanged. |
+
+Forward all other supplied canonical inputs to the selected target. These
+alias selectors are not service-request fields. A fixed mapping requires no
+additional selector; it does not add fields to `prepare-agent`.
+
+## Dispatch
+
+| Selector | Canonical skill |
+| --- | --- |
+| fixed | reconcile-parity-matrix |
+
+Dispatch directly to `reconcile-parity-matrix`, whose logical role is `requirements-reconciler`. Do not route parity ownership to Legacy Parity Analyst or bypass the canonical root preparation.
+
+This alias has no independent output or write authority. Do not duplicate
+business validation, call tools independently, create a receipt, change a model
+or auto-launch a role. Use only the linked canonical workflow's lifecycle and
+exact grants; no alias chain or filesystem fallback is permitted.
+
+## Stop and result
+
+Return the selected canonical workflow's explicit result and references without
+changing failed, blocked, pending or incremental outcomes into completion.
+An unknown selector fails with no fallback. Missing configuration or native
+capability is handled by the canonical workflow, including initialization's
+explicit root bootstrap exception. The alias cannot bypass prepare/finalize or
+native start/stop requirements.
+
+## References
+
+- [reconcile-parity-matrix](../reconcile-parity-matrix/SKILL.md)

package/resources/codex-and-agents-customizations/.agents/skills/discovery-repo-inventory/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: discovery-repo-inventory
+description: 'Dispatch repository inventory to the canonical legacy inventory workflow. Use when invoking the existing discovery repo-inventory alias.'
+---
+
+# Discovery Repository Inventory Alias
+
+## When to Use This Skill
+
+Use this compatibility name only to dispatch to its canonical workflow.
+
+## Inputs
+
+| Input | Required contract |
+| --- | --- |
+| inputs | Required inputs of the linked canonical workflow, forwarded unchanged. |
+
+Forward all other supplied canonical inputs to the selected target. These
+alias selectors are not service-request fields. A fixed mapping requires no
+additional selector; it does not add fields to `prepare-agent`.
+
+## Dispatch
+
+| Selector | Canonical skill |
+| --- | --- |
+| fixed | inventory-legacy-system |
+
+Dispatch directly to `inventory-legacy-system`. Its prepared Legacy Parity Analyst owns inventory and selected coverage dispositions; this alias grants no role or tool.
+
+This alias has no independent output or write authority. Do not duplicate
+business validation, call tools independently, create a receipt, change a model
+or auto-launch a role. Use only the linked canonical workflow's lifecycle and
+exact grants; no alias chain or filesystem fallback is permitted.
+
+## Stop and result
+
+Return the selected canonical workflow's explicit result and references without
+changing failed, blocked, pending or incremental outcomes into completion.
+An unknown selector fails with no fallback. Missing configuration or native
+capability is handled by the canonical workflow, including initialization's
+explicit root bootstrap exception. The alias cannot bypass prepare/finalize or
+native start/stop requirements.
+
+## References
+
+- [inventory-legacy-system](../inventory-legacy-system/SKILL.md)

package/resources/codex-and-agents-customizations/.agents/skills/discovery-runtime-characterization/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: discovery-runtime-characterization
+description: 'Dispatch runtime characterization to its canonical supplied-evidence workflow. Use when invoking the existing runtime-characterization alias.'
+---
+
+# Discovery Runtime Characterization Alias
+
+## When to Use This Skill
+
+Use this compatibility name only to dispatch to its canonical workflow.
+
+## Inputs
+
+| Input | Required contract |
+| --- | --- |
+| inputs | Required inputs of the linked canonical workflow, forwarded unchanged. |
+
+Forward all other supplied canonical inputs to the selected target. These
+alias selectors are not service-request fields. A fixed mapping requires no
+additional selector; it does not add fields to `prepare-agent`.
+
+## Dispatch
+
+| Selector | Canonical skill |
+| --- | --- |
+| fixed | characterize-runtime-behavior |
+
+Dispatch directly to `characterize-runtime-behavior`. The canonical workflow preserves supplied evidence and honest manual, not-run or blocked states; the alias does not execute applications.
+
+This alias has no independent output or write authority. Do not duplicate
+business validation, call tools independently, create a receipt, change a model
+or auto-launch a role. Use only the linked canonical workflow's lifecycle and
+exact grants; no alias chain or filesystem fallback is permitted.
+
+## Stop and result
+
+Return the selected canonical workflow's explicit result and references without
+changing failed, blocked, pending or incremental outcomes into completion.
+An unknown selector fails with no fallback. Missing configuration or native
+capability is handled by the canonical workflow, including initialization's
+explicit root bootstrap exception. The alias cannot bypass prepare/finalize or
+native start/stop requirements.
+
+## References
+
+- [characterize-runtime-behavior](../characterize-runtime-behavior/SKILL.md)

package/resources/codex-and-agents-customizations/.agents/skills/discovery-validate-artifacts/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: discovery-validate-artifacts
+description: 'Dispatch artifact validation to the canonical explicit-kind and mode workflow. Use when invoking the existing validate-artifacts alias.'
+---
+
+# Discovery Artifact Validation Alias
+
+## When to Use This Skill
+
+Use this compatibility name only to dispatch to its canonical workflow.
+
+## Inputs
+
+| Input | Required contract |
+| --- | --- |
+| inputs | Required inputs of the linked canonical workflow, forwarded unchanged. |
+
+Forward all other supplied canonical inputs to the selected target. These
+alias selectors are not service-request fields. A fixed mapping requires no
+additional selector; it does not add fields to `prepare-agent`.
+
+## Dispatch
+
+| Selector | Canonical skill |
+| --- | --- |
+| fixed | validate-discovery-artifacts |
+
+Dispatch directly to `validate-discovery-artifacts`. Forward its exact artifact kind/selection and explicit mode without type probing or substituting a different gate.
+
+This alias has no independent output or write authority. Do not duplicate
+business validation, call tools independently, create a receipt, change a model
+or auto-launch a role. Use only the linked canonical workflow's lifecycle and
+exact grants; no alias chain or filesystem fallback is permitted.
+
+## Stop and result
+
+Return the selected canonical workflow's explicit result and references without
+changing failed, blocked, pending or incremental outcomes into completion.
+An unknown selector fails with no fallback. Missing configuration or native
+capability is handled by the canonical workflow, including initialization's
+explicit root bootstrap exception. The alias cannot bypass prepare/finalize or
+native start/stop requirements.
+
+## References
+
+- [validate-discovery-artifacts](../validate-discovery-artifacts/SKILL.md)

package/resources/codex-and-agents-customizations/.agents/skills/discovery-workflow/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: discovery-workflow
+description: 'Dispatch an explicit canonical discovery workflow without adding authority. Use when invoking the legacy discovery umbrella with a selected skill_id.'
+---
+
+# Discovery Workflow Alias
+
+## When to Use This Skill
+
+Use this compatibility name only to dispatch to its canonical workflow.
+
+## Inputs
+
+| Input | Required contract |
+| --- | --- |
+| skill_id | Required exact one of the nine canonical skill IDs listed below; unknown or missing values fail with no fallback. |
+
+Forward all other supplied canonical inputs to the selected target. These
+alias selectors are not service-request fields. A fixed mapping requires no
+additional selector; it does not add fields to `prepare-agent`.
+
+## Dispatch
+
+| Selector | Canonical skill |
+| --- | --- |
+| inventory-legacy-system | inventory-legacy-system |
+| extract-feature-contract | extract-feature-contract |
+| characterize-runtime-behavior | characterize-runtime-behavior |
+| reconcile-parity-matrix | reconcile-parity-matrix |
+| review-discovery-coverage | review-discovery-coverage |
+| adjudicate-unspecified-behavior | adjudicate-unspecified-behavior |
+| generate-acceptance-scenarios | generate-acceptance-scenarios |
+| initialize-discovery-workspace | initialize-discovery-workspace |
+| validate-discovery-artifacts | validate-discovery-artifacts |
+
+Select exactly one canonical workflow using `skill_id`. Forward its supplied inputs without inventing defaults or reinterpreting source identity. Each target owns its root prepare, exact launch, granted operations, finalize, native stop and root result; this umbrella adds no scheduler.
+
+This alias has no independent output or write authority. Do not duplicate
+business validation, call tools independently, create a receipt, change a model
+or auto-launch a role. Use only the linked canonical workflow's lifecycle and
+exact grants; no alias chain or filesystem fallback is permitted.
+
+## Stop and result
+
+Return the selected canonical workflow's explicit result and references without
+changing failed, blocked, pending or incremental outcomes into completion.
+An unknown selector fails with no fallback. Missing configuration or native
+capability is handled by the canonical workflow, including initialization's
+explicit root bootstrap exception. The alias cannot bypass prepare/finalize or
+native start/stop requirements.
+
+## References
+
+- [inventory-legacy-system](../inventory-legacy-system/SKILL.md)
+- [extract-feature-contract](../extract-feature-contract/SKILL.md)
+- [characterize-runtime-behavior](../characterize-runtime-behavior/SKILL.md)
+- [reconcile-parity-matrix](../reconcile-parity-matrix/SKILL.md)
+- [review-discovery-coverage](../review-discovery-coverage/SKILL.md)
+- [adjudicate-unspecified-behavior](../adjudicate-unspecified-behavior/SKILL.md)
+- [generate-acceptance-scenarios](../generate-acceptance-scenarios/SKILL.md)
+- [initialize-discovery-workspace](../initialize-discovery-workspace/SKILL.md)
+- [validate-discovery-artifacts](../validate-discovery-artifacts/SKILL.md)