@danmoisan/drm-copilot-mcp 1.1.25 → 1.1.27

package/resources/codex-and-agents-customizations/.codex/hooks/hook-cleanup-context.ps1

@@ -0,0 +1,343 @@
+<#
+.SYNOPSIS
+    Pure cleanup-context predicates shared by the cleanup legs of the enforcement gates (issue #1026).
+
+.DESCRIPTION
+    The cleanup-merged-worktrees skill writes no per-feature, epic, or parallel checkpoint, so
+    the checkpoint-based gates cannot recognize its writes, commits, delegation, and pull
+    request. Its integrity record is the sanctioned-removal manifest. This file holds the pure
+    decisions the gates' cleanup legs share:
+
+      Test-CleanupManifestText              - the manifest header (tool, schema_version) and,
+                                              with -UtcNow, its freshness and run_id.
+      Test-CleanupConsolidationRelativePath - the allowlist: the repository-relative prefixes
+                                              docs/ and .claude/agent-memory/ (ordinal,
+                                              case-sensitive), plus the pr-author receipt
+                                              artifacts/pr_body_<digits>.receipt.json with
+                                              -AllowReceipt.
+      Find-CleanupConsolidationRecord       - the consolidation worktree, identified by its
+                                              porcelain branch, never by its path.
+      Test-CleanupScratchPath               - the scratch rule: an absolute path outside every
+                                              registered worktree and the session root, under a
+                                              temporary root.
+      Test-CleanupConsolidationBranchLabel  - the delegation label rule of the model-routing leg.
+
+    Every function fails closed: a malformed or ambiguous input answers $false or $null.
+
+    The literals below restate values owned elsewhere: the branch equals
+    CLEANUP_WT_CONSOLIDATION_BRANCH in
+    .claude/skills/cleanup-merged-worktrees/scripts/cleanup_worktrees_actions_lib.sh, and the
+    manifest tool, schema version, and freshness bound equal $script:ExpectedManifestTool,
+    $script:ExpectedManifestSchemaVersion, and $script:ManifestFreshnessBound in
+    .claude/lib/cleanup-manifest/CleanupWorktreeManifest.psm1. The Codex hooks cannot import
+    .claude/lib, so the values are restated here and pinned equal by
+    tests/scripts/claude-hooks/hook-cleanup-context.Parity.Tests.ps1. The names avoid the
+    removal gates' $script:CleanupWorktreeManifestPath.
+
+.NOTES
+    PowerShell 7+. Functions and literals only: no file, process, network, clock, or
+    environment access, no dot-source, and no import. Byte-identical at .claude/hooks,
+    .codex/hooks, and both bundle mirrors under extensions/drm-copilot/resources/.
+#>
+
+$script:CleanupContextBranch = 'documentationandmemories'
+$script:CleanupContextManifestRelativePath = 'artifacts/orchestration/cleanup-worktrees-manifest.json'
+$script:CleanupContextManifestTool = 'cleanup-merged-worktrees'
+$script:CleanupContextManifestSchemaVersion = 1
+$script:CleanupContextFreshnessHours = 24
+
+function Test-CleanupManifestText {
+    <#
+    .SYNOPSIS
+        Return $true when the text is a cleanup manifest with the expected header.
+    .DESCRIPTION
+        The text must parse as a JSON object whose tool is the string cleanup-merged-worktrees
+        (ordinal) and whose schema_version is the integer 1. When -UtcNow is supplied, the
+        manifest must also carry a generated_at that parses, is not after UtcNow, and lies
+        within the freshness bound, and a run_id that is a non-blank string. The generated_at
+        value is read exactly as CleanupWorktreeManifest.psm1 reads it, so the PR and
+        delegation legs agree with the removal gates on freshness.
+    .PARAMETER Raw
+        The manifest text, or $null when no manifest exists.
+    .PARAMETER UtcNow
+        The current UTC time from the caller's clock seam.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()][AllowEmptyString()][string] $Raw,
+        [datetime] $UtcNow
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Raw)) {
+        return $false
+    }
+    try {
+        $manifest = $Raw | ConvertFrom-Json -ErrorAction Stop
+    }
+    catch {
+        return $false
+    }
+    if ($manifest -isnot [System.Management.Automation.PSCustomObject]) {
+        return $false
+    }
+    $names = @($manifest.PSObject.Properties.Name)
+    if ($names -notcontains 'tool' -or $names -notcontains 'schema_version') {
+        return $false
+    }
+    if ($manifest.tool -isnot [string] -or $manifest.tool -cne $script:CleanupContextManifestTool) {
+        return $false
+    }
+    $schemaVersion = $manifest.schema_version
+    if (($schemaVersion -isnot [int] -and $schemaVersion -isnot [long]) -or [long]$schemaVersion -ne $script:CleanupContextManifestSchemaVersion) {
+        return $false
+    }
+    if (-not $PSBoundParameters.ContainsKey('UtcNow')) {
+        return $true
+    }
+
+    if ($names -notcontains 'generated_at' -or $names -notcontains 'run_id') {
+        return $false
+    }
+    $generatedAt = [datetime]::MinValue
+    $styles = [System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal
+    if (-not [datetime]::TryParse([string]$manifest.generated_at, [cultureinfo]::InvariantCulture, $styles, [ref] $generatedAt)) {
+        return $false
+    }
+    if ($generatedAt -gt $UtcNow -or ($UtcNow - $generatedAt) -gt [timespan]::FromHours($script:CleanupContextFreshnessHours)) {
+        return $false
+    }
+    return ($manifest.run_id -is [string] -and -not [string]::IsNullOrWhiteSpace($manifest.run_id))
+}
+
+function Test-CleanupConsolidationRelativePath {
+    <#
+    .SYNOPSIS
+        Return $true when a repository-relative path is on the consolidation allowlist.
+    .DESCRIPTION
+        The path must use only the plain characters A-Z a-z 0-9 . _ / -, must not be rooted,
+        must carry no '..' segment, and must start with docs/ or .claude/agent-memory/ under
+        ordinal, case-sensitive comparison with at least one character after the prefix. Any
+        other Markdown path, such as CLAUDE.md or .claude/rules/x.md, is not admitted. With
+        -AllowReceipt the pr-author receipt artifacts/pr_body_<digits>.receipt.json is also
+        admitted; it never enters the staging allowlist.
+    .PARAMETER RelativePath
+        The repository-relative path or operand.
+    .PARAMETER AllowReceipt
+        Admit the pr-author receipt path (Write and Edit leg only).
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()][AllowEmptyString()][string] $RelativePath,
+        [switch] $AllowReceipt
+    )
+
+    $path = [string]$RelativePath
+    if ($path -cnotmatch '^[A-Za-z0-9._/-]+$' -or $path.StartsWith('/')) {
+        return $false
+    }
+    if (@($path -split '/') -contains '..') {
+        return $false
+    }
+    if ($AllowReceipt -and $path -cmatch '^artifacts/pr_body_[0-9]+\.receipt\.json$') {
+        return $true
+    }
+    foreach ($prefix in @('docs/', '.claude/agent-memory/')) {
+        if ($path.Length -gt $prefix.Length -and $path.StartsWith($prefix, [System.StringComparison]::Ordinal)) {
+            return $true
+        }
+    }
+    return $false
+}
+
+function Find-CleanupConsolidationRecord {
+    <#
+    .SYNOPSIS
+        Return the registered consolidation worktree record, or $null.
+    .DESCRIPTION
+        Takes the records ConvertFrom-HookTargetWorktreePorcelain emits. The first record (the
+        main worktree stanza), prunable records, and detached records are skipped. The single
+        remaining record whose Branch is ordinal-equal to documentationandmemories is returned;
+        none, or more than one, returns $null. The path is never consulted, because the
+        consolidation path can be overridden by CLEANUP_WT_CONSOLIDATION_PATH.
+    .PARAMETER Record
+        The porcelain records, in listing order.
+    .OUTPUTS
+        System.Management.Automation.PSCustomObject or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [AllowNull()][AllowEmptyCollection()][object[]] $Record
+    )
+
+    $records = @($Record | Where-Object { $null -ne $_ })
+    $found = [System.Collections.Generic.List[object]]::new()
+    for ($index = 1; $index -lt $records.Count; $index++) {
+        $candidate = $records[$index]
+        if ([bool]$candidate.Prunable -or $null -eq $candidate.Branch) {
+            continue
+        }
+        if ([string]$candidate.Branch -ceq $script:CleanupContextBranch) {
+            $found.Add($candidate)
+        }
+    }
+    if ($found.Count -ne 1) {
+        return $null
+    }
+    return $found[0]
+}
+
+function ConvertTo-CleanupContextPath {
+    <#
+    .SYNOPSIS
+        Normalize a path to forward slashes with one trailing slash removed (bare roots kept).
+    .OUTPUTS
+        System.String
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [AllowNull()][AllowEmptyString()][string] $Path
+    )
+
+    $normalized = ([string]$Path).Replace('\', '/')
+    if ($normalized.Length -gt 1 -and $normalized.EndsWith('/') -and $normalized -notmatch '^[A-Za-z]:/$') {
+        $normalized = $normalized.Substring(0, $normalized.Length - 1)
+    }
+    return $normalized
+}
+
+function Test-CleanupContextPathUnder {
+    <#
+    .SYNOPSIS
+        Return $true when a normalized path equals a root or lies beneath it (OrdinalIgnoreCase).
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory)][AllowEmptyString()][string] $Path,
+        [AllowNull()][AllowEmptyString()][string] $Root
+    )
+
+    $normalizedRoot = ConvertTo-CleanupContextPath -Path $Root
+    if ([string]::IsNullOrEmpty($normalizedRoot)) {
+        return $false
+    }
+    if ([string]::Equals($Path, $normalizedRoot, [System.StringComparison]::OrdinalIgnoreCase)) {
+        return $true
+    }
+    $prefix = if ($normalizedRoot.EndsWith('/')) { $normalizedRoot } else { $normalizedRoot + '/' }
+    return $Path.StartsWith($prefix, [System.StringComparison]::OrdinalIgnoreCase)
+}
+
+function Test-CleanupScratchPath {
+    <#
+    .SYNOPSIS
+        Return $true when a path is a scratch path under a temporary root and outside every worktree.
+    .DESCRIPTION
+        The path must be absolute (drive-rooted or slash-rooted, not UNC), carry no '.' or '..'
+        segment and no surrounding whitespace, lie outside every registered worktree root and
+        outside the session root, and lie under at least one accepted temporary-root spelling.
+        Comparisons use forward-slash normalization and OrdinalIgnoreCase. The rule fails
+        closed when no registered root or no temporary root is supplied, and when any
+        registered worktree root lies under an accepted temporary root, because a path under
+        such a worktree could then be spelled so that it matches no registered root.
+    .PARAMETER Path
+        The Write or Edit file path.
+    .PARAMETER RegisteredRoot
+        Every registered worktree root from the listing, prunable ones included.
+    .PARAMETER SessionRoot
+        The session root.
+    .PARAMETER TemporaryRoot
+        Every accepted spelling of the operating-system temporary root.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()][AllowEmptyString()][string] $Path,
+        [AllowNull()][AllowEmptyCollection()][string[]] $RegisteredRoot,
+        [AllowNull()][AllowEmptyString()][string] $SessionRoot,
+        [AllowNull()][AllowEmptyCollection()][string[]] $TemporaryRoot
+    )
+
+    $raw = [string]$Path
+    if ([string]::IsNullOrEmpty($raw) -or $raw.Trim() -cne $raw) {
+        return $false
+    }
+    $normalized = ConvertTo-CleanupContextPath -Path $raw
+    if ($normalized -notmatch '^([A-Za-z]:/|/(?!/))') {
+        return $false
+    }
+    $segments = @($normalized -split '/')
+    if ($segments -contains '.' -or $segments -contains '..') {
+        return $false
+    }
+    $roots = @($RegisteredRoot | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    $temporary = @($TemporaryRoot | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    if ($roots.Count -eq 0 -or $temporary.Count -eq 0 -or [string]::IsNullOrWhiteSpace($SessionRoot)) {
+        return $false
+    }
+    foreach ($registeredCandidate in $roots) {
+        $normalizedRoot = ConvertTo-CleanupContextPath -Path $registeredCandidate
+        foreach ($temporaryCandidate in $temporary) {
+            if (Test-CleanupContextPathUnder -Path $normalizedRoot -Root $temporaryCandidate) {
+                return $false
+            }
+        }
+        if (Test-CleanupContextPathUnder -Path $normalized -Root $registeredCandidate) {
+            return $false
+        }
+    }
+    if (Test-CleanupContextPathUnder -Path $normalized -Root $SessionRoot) {
+        return $false
+    }
+    foreach ($temporaryCandidate in $temporary) {
+        $normalizedTemporary = ConvertTo-CleanupContextPath -Path $temporaryCandidate
+        if (-not [string]::Equals($normalized, $normalizedTemporary, [System.StringComparison]::OrdinalIgnoreCase) -and
+            (Test-CleanupContextPathUnder -Path $normalized -Root $normalizedTemporary)) {
+            return $true
+        }
+    }
+    return $false
+}
+
+function Test-CleanupConsolidationBranchLabel {
+    <#
+    .SYNOPSIS
+        Return $true when a delegation prompt names the consolidation branch by exactly one label.
+    .DESCRIPTION
+        The prompt must contain exactly one 'branch:' label (case-insensitive count), on its own
+        line in the lowercase form 'branch: <value>', with the value ordinal-equal to
+        documentationandmemories, and no --head or --branch token anywhere, so the worktree
+        resolvers that read the first branch signal cannot select a different branch.
+    .PARAMETER PromptText
+        The delegation prompt.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()][AllowEmptyString()][string] $PromptText
+    )
+
+    $text = [string]$PromptText
+    if ([regex]::Matches($text, '(?i)\bbranch:').Count -ne 1) {
+        return $false
+    }
+    if ([regex]::IsMatch($text, '(?i)(?<![\w-])--(?:head|branch)(?![\w-])')) {
+        return $false
+    }
+    $label = [regex]::Match($text, '(?m)^[ \t]*branch:[ \t]*(?<value>[^\r\n]*?)[ \t]*\r?$')
+    return ($label.Success -and $label.Groups['value'].Value -ceq $script:CleanupContextBranch)
+}

package/resources/codex-and-agents-customizations/.codex/hooks/validate-feature-review-coverage.ps1

@@ -19,6 +19,10 @@
         failures:
           "informational only", "context only", "out of plan scope", "out of scope",
           "not applicable", "N/A", "UNVERIFIED".
+        The record "N/A - no pre-change run" is not narrowing in three positions: after
+        "Baseline:" or "baseline coverage artifact:", as the fifth table cell, and as a
+        backticked quotation not directly after a colon. "Change: N/A" on a line carrying
+        "Baseline: N/A - no pre-change run" is not narrowing either.
       - If the coverage artifact for a language is present, repo-wide line coverage is
         parsed and compared against the governing line floor: the line coverage
         threshold the repository's root CLAUDE.md states, otherwise the 85 percent
@@ -145,6 +149,50 @@ function Get-LanguageRepoCoverage {
     return $null
 }
 
+function Get-CoverageNarrowingLine {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string[]]$Lines,
+
+        [Parameter(Mandatory = $true)]
+        [string]$LabelPattern,
+
+        [Parameter(Mandatory = $true)]
+        [string]$Language
+    )
+
+    # Sanctioned narrowing text is not a scope narrowing by the audit: a line inside a
+    # '## Rejected Scope Narrowing' section (caller text recorded verbatim), and a PowerShell
+    # line naming branch coverage but not line coverage (Pester measures no branch coverage).
+    # The policy-audit template prescribes the no-pre-change-run record in three positions only,
+    # so the record is removed there and stays a narrowing form everywhere else.
+    $narrowingPattern = '(?i)(informational only|context only|out of plan scope|out of scope|not applicable|\bN/A\b|\bUNVERIFIED\b)'
+    $recordPatterns = @(
+        '(?<=(?:\bBaseline|\bbaseline coverage artifact):\s*)N/A - no pre-change run'
+        '(?<=^\s*\|(?:[^|]*\|){4}\s*)N/A - no pre-change run(?=\s*\|)'
+        '(?<!:\s*)`N/A - no pre-change run`'
+    )
+    $insideRejectedSection = $false
+    foreach ($line in $Lines) {
+        if ($line -match '^##\s') { $insideRejectedSection = $line -match '^##\s+Rejected Scope Narrowing\b' }
+        elseif ($insideRejectedSection) { continue }
+        if ($line -notmatch $LabelPattern -or $line -notmatch '(?i)(coverage|lcov|line[s]?\s+hit|pester)') { continue }
+        $reducedLine = $line
+        foreach ($recordPattern in $recordPatterns) { $reducedLine = [regex]::Replace($reducedLine, $recordPattern, '') }
+        # Tested on the original line, because the removals above strip the record it names.
+        if ($line.Contains('Baseline: N/A - no pre-change run')) {
+            $reducedLine = [regex]::Replace($reducedLine, '(?<![\w/-])Change: N/A', '')
+            $reducedLine = $reducedLine.Replace('New/changed-code coverage: N/A - no production file changed', '')
+        }
+        if ($reducedLine -notmatch $narrowingPattern) { continue }
+        if ($Language -eq 'PowerShell' -and $line -match '(?i)\bbranch\b' -and $line -notmatch '(?i)\bline\s+coverage\b') { continue }
+        $line
+    }
+}
+
 function Test-LanguageCoverageRow {
     [OutputType([System.Collections.Hashtable])]
     param(
@@ -158,7 +206,7 @@ function Test-LanguageCoverageRow {
         'TypeScript' = @('TypeScript', 'typescript')
         'Python'     = @('Python', 'python', 'pytest')
         'PowerShell' = @('PowerShell', 'powershell', 'pester')
-        'CSharp'     = @('C#', 'CSharp', 'csharp', '\.NET', 'dotnet')
+        'CSharp'     = @('C#', 'CSharp', 'csharp', '.NET', 'dotnet')
     }
 
     $labels = $languageLabelMap[$Language]
@@ -182,9 +230,8 @@ function Test-LanguageCoverageRow {
         }
     }
 
-    $narrowingPattern = '(?i)(informational only|context only|out of plan scope|out of scope|not applicable|\bN/A\b|\bUNVERIFIED\b)'
-    $narrowing = $coverageLines | Where-Object { $_ -match $narrowingPattern }
-    if ($narrowing -and $narrowing.Count -gt 0) {
+    $narrowing = @(Get-CoverageNarrowingLine -Lines $lines -LabelPattern $labelPattern -Language $Language)
+    if ($narrowing.Count -gt 0) {
         $first = ($narrowing | Select-Object -First 1).ToString().Trim()
         return @{
             Ok     = $false

package/resources/codex-and-agents-customizations/.codex-variants/csharp-legacy/agents/csharp-typed-engineer.toml

@@ -29,7 +29,7 @@ Migration contract:
 
 ---
 name: csharp-typed-engineer
-description: Project-scoped worker that implements and verifies C# changes within typed repository boundaries. Applies the CSharpier -> .NET Analyzers -> Nullable Analysis -> MSTest toolchain, the 1-3 production-file small-path budget, and zero-regression quality gates.
+description: Project-scoped worker that implements and verifies C# changes within typed repository boundaries. Applies the CSharpier -> .NET Analyzers -> Nullable Analysis -> MSTest toolchain, the 1-3 production-file small-path budget, and quality gates read from the single gate run.
 tools:
   - Read
   - Grep
@@ -62,10 +62,10 @@ Follow the phased workflow defined by the preloaded skills:
 
 1. **Policy compliance** — apply `policy-compliance-order` to load mandatory repo policies before any change.
 2. **Routing and scope** — apply `csharp-change-budget-router` to estimate scope, select direct vs orchestrator handoff mode, and enforce the 3 production + 3 test per-batch cap.
-3. **Plan and baseline** — apply `atomic-plan-contract` for Phase 0 baseline capture and atomic plan structure. Delegate plan authoring to `atomic_planner` when no plan is supplied. Plans must include the proposed class and module structure, minimal DI seams, MSTest scenario-level test strategy, and Moq mock strategy.
-4. **Implement in batches** — apply the approved plan. After each batch, run targeted analyzer and nullable builds on touched projects plus targeted MSTest, and confirm per-file coverage.
-5. **Final QA gate** — apply `csharp-qa-gate` to run the full toolchain, enforce zero-regression deltas against the baseline, and produce the required reporting block before declaring completion.
-6. **Evidence and handoff** — store baseline and post-change evidence per `evidence-and-timestamp-conventions`. Trigger remediation via `remediation-handoff-atomic-planner` when deltas fail.
+3. **Plan and baseline** — apply `atomic-plan-contract` for Phase 0 static baseline capture and atomic plan structure. Delegate plan authoring to `atomic_planner` when no plan is supplied. Plans must include the proposed class and module structure, minimal DI seams, MSTest scenario-level test strategy, and Moq mock strategy.
+4. **Implement in batches** — apply the approved plan. After each batch, run targeted analyzer and nullable builds on touched projects. Test and coverage results come from the single gate run. A focused run of one test file to debug a specific failure is debugging only.
+5. **Final QA gate** — apply `csharp-qa-gate` to run the full toolchain, compare static tool results against the static baseline, read test and coverage results from the single gate run, and produce the required reporting block before declaring completion.
+6. **Evidence and handoff** — store static baseline and final gate evidence per `evidence-and-timestamp-conventions`. Trigger remediation via `remediation-handoff-atomic-planner` when a gate fails.
 
 ## Mode Marker Resolution
 
@@ -84,7 +84,7 @@ Stop implementation and return to the user when:
 
 - the scope estimate or an in-flight batch would exceed the 3-production-file cap in direct mode,
 - a file is above or would exceed the 800-line hard limit of the tiered file-size policy (split it before proceeding; at 500 lines look for a logical split, and at 700 lines split more aggressively),
-- any QA gate delta is non-zero after self-correction,
+- any QA gate check fails after self-correction,
 - the toolchain cannot be executed in the current environment (mark the change **unverified**),
 - orchestrator handoff mode is requested but the required context package is incomplete,
 - policy instructions conflict.

package/resources/codex-and-agents-customizations/pack-manifests/core.json

@@ -53,10 +53,13 @@
     ".codex/hooks/enforce-epic-child-worktree-binding.ps1",
     ".codex/hooks/enforce-epic-merge-gate-command.ps1",
     ".codex/hooks/enforce-epic-merge-gate.ps1",
+    ".codex/hooks/enforce-epic-merge-gate-review.ps1",
     ".codex/hooks/enforce-epic-planning-only.ps1",
     ".codex/hooks/enforce-epic-root-invocation.ps1",
     ".codex/hooks/enforce-epic-wave-barrier.ps1",
     ".codex/hooks/enforce-epic-worktree-removal-gate.ps1",
+    ".codex/hooks/enforce-orchestration-preimplementation-gate-cleanup.ps1",
+    ".codex/hooks/hook-cleanup-context.ps1",
     ".codex/hooks/enforce-orchestration-preimplementation-gate-epic-resolution.ps1",
     ".codex/hooks/enforce-orchestration-preimplementation-gate-epic-scope.ps1",
     ".codex/hooks/enforce-orchestration-preimplementation-gate-helpers.ps1",

package/resources/customizations/.github/agents/5.1-Beast-adjusted.agent.md

@@ -76,7 +76,7 @@ You are a highly capable and autonomous agent, and you can definitely solve this
 5. Develop a clear, step-by-step plan. Break down the fix into manageable, incremental steps. Display those steps in a simple markdown todo list using plain checkboxes.
 6. Implement the fix incrementally. Make small, testable code changes.
 7. Debug as needed. Use debugging techniques to isolate and resolve issues.
-8. Test frequently. Run tests after each change to verify correctness.
+8. Check frequently. Run static checks after each change, and the single gate run when the change is complete. A focused run of one test file to debug a specific failure is debugging only.
 9. Iterate until the root cause is fixed and all tests pass.
 10. Reflect and validate comprehensively. After tests pass, think about the original intent, write additional tests to ensure correctness, and remember there are hidden tests that must also pass before the solution is truly complete.
 

package/resources/customizations/.github/agents/Powershell DI Unit Test Engineer.agent.md

@@ -1,7 +1,7 @@
 ---
 name: PowerShell Unit Test + DI Refactor Expert (Guardrailed)
-description: Plan + implement minimal DI seams and Pester v5 unit tests with correct mocking (esp. external executables), while enforcing strict scope, analyzer cleanliness, and zero-regression gates.
-argument-hint: "Provide the exact script/module under test + the failing tests (or desired behaviors). I will baseline → plan → implement in small batches with analyzer/test/coverage gates."
+description: Plan + implement minimal DI seams and Pester v6 unit tests with correct mocking (esp. external executables), while enforcing strict scope, analyzer cleanliness, and the parallel test gates.
+argument-hint: "Provide the exact script/module under test + the failing tests (or desired behaviors). I will capture the static baseline → plan → implement in small batches with analyzer/test/coverage gates."
 tools:
   [vscode/runCommand, vscode/vscodeAPI, execute/testFailure, execute/getTerminalOutput, execute/runTask, execute/createAndRunTask, execute/runInTerminal, execute/runTests, read/problems, read/readFile, read/terminalSelection, read/terminalLastCommand, edit/createDirectory, edit/createFile, edit/editFiles, search, web, 'drmcopilotextension/*', todo]
 
@@ -12,18 +12,18 @@ handoffs:
     send: false
   - label: Implement approved plan with strict gates
     agent: agent
-    prompt: "Implement ONLY the approved plan. Enforce: zero new PSScriptAnalyzer findings, zero new failing tests, and no coverage regressions for touched files. Run Analyze+targeted tests after each small batch; run full toolchain at the end."
+    prompt: "Implement ONLY the approved plan. Enforce: zero new PSScriptAnalyzer findings, zero failures in the single gate run, and touched files at the coverage thresholds. Run Analyze after each small batch; run full toolchain at the end."
     send: false
   - label: Post-change QA gate (analyzer + tests + coverage)
     agent: agent
-    prompt: "Run the full toolchain and report deltas: analyzer findings, failing tests, and per-file coverage for touched files. If any regression exists, revert/fix before proceeding."
+    prompt: "Run the full toolchain and report analyzer deltas, failures in the single gate run, and per-file coverage for touched files. If any check fails, revert/fix before proceeding."
     send: false
 ---
 
 # Role and objective
 
 You are a senior PowerShell engineer specializing in:
-- Pester v5 unit tests (fast, deterministic, isolated)
+- Pester v6 unit tests (fast, deterministic, isolated)
 - Refactoring production code ONLY as needed to introduce minimal dependency-injection (DI) seams
 - Correct mocking patterns for external executables (`git`, `gh`, `actionlint`, etc.) and PowerShell cmdlets/providers
 
@@ -31,7 +31,7 @@ Your objective is **testability without regressions**:
 - Tests pass identically in Terminal and VS Code Test Explorer
 - No reliance on PATH, profiles, working directory, network, or machine state
 - No increase in PSScriptAnalyzer findings
-- No decrease in coverage for any file you touch
+- A touched file meets the coverage thresholds, read from the single gate run
 
 # Absolute guardrails (non-negotiable)
 
@@ -77,11 +77,11 @@ Introduce the smallest seam that enables reliable mocking. Prefer seams in this
 - Do NOT introduce new frameworks, generic runners, or broad abstractions.
 - Do NOT refactor unrelated code “while you’re here.”
 
-## 4) Zero-regression quality gates (hard stop)
+## 4) Quality gates (hard stop)
 Hard stop if any of these occur:
-- New PSScriptAnalyzer findings compared to baseline
-- New failing tests compared to baseline
-- Coverage drop in any touched file (and in overall coverage if the repo enforces an overall gate)
+- New PSScriptAnalyzer findings compared to the static baseline
+- Any failure in the single gate run
+- A touched file below the coverage thresholds
 
 If any gate fails:
 - revert or fix immediately before proceeding
@@ -90,14 +90,13 @@ If any gate fails:
 ## 5) Toolchain must be executed (no unverified work)
 You must run the repo toolchain via `#tool:terminal`.
 
-### Baseline runs (required before edits)
+### Static baseline runs (required before edits)
 - Analyzer baseline (repo standard): `mcp__drm-copilot__run_poshqc_analyze`
-- Test baseline (targeted): run only the relevant Pester file(s) or tag/filter used by the repo
-- Coverage baseline: capture per-file coverage for the touched file(s), and overall if applicable
 
 ### Iteration runs (required after each batch)
 - Analyzer
-- Targeted Pester tests for the impacted area
+
+A focused run of one test file to debug a specific failure is debugging only.
 
 ### Final QA runs (required before declaring completion)
 - Format → Analyze → Test with coverage, per repo conventions
@@ -109,12 +108,10 @@ If you cannot run tools in the environment:
 
 # Required workflow for every request
 
-## Phase A — Baseline capture (read-only)
+## Phase A — Static baseline capture (read-only)
 1) Identify the EXACT files in scope (list them).
-2) Run and record baseline:
-   - failing tests list (names + error messages)
+2) Run and record the static baseline:
    - analyzer findings count (errors/warnings/information per repo settings)
-   - coverage baseline (per touched file, and overall if used)
 3) Write root cause in one paragraph.
 
 ## Phase B — Plan (no edits)
@@ -130,17 +127,14 @@ Do not proceed to edits until the user explicitly approves (e.g., “Proceed”)
 - Batch size: one logical change set only (e.g., add wrapper + update call site + update 1–2 tests)
 - After each batch:
   - Run analyzer
-  - Run the relevant subset of tests
-  - Confirm coverage did not regress for touched files
 - Keep edits minimal; no stylistic refactors.
 
 ## Phase D — Final QA gate
 - Run full toolchain (format → analyze → test with coverage)
-- Report deltas:
+- Report results:
   - Analyzer delta (must be 0 new findings)
-  - Test failures delta (must be 0 new failures)
-  - Per-file coverage delta for touched files (must be >= baseline)
-  - Overall coverage delta if applicable (must be >= baseline)
+  - Failures in the single gate run (must be 0)
+  - Per-file coverage for touched files against the thresholds, read from the single gate run
 
 # PowerShell-specific rules (to prevent your recent failure modes)
 
@@ -178,10 +172,10 @@ When the project imports functions via AST-based `Import-ScriptFunction` returni
 
 # Reporting requirements (every response)
 Your response must include:
-1) **Baseline**: analyzer/tests/coverage before changes
+1) **Baseline**: analyzer findings before changes
 2) **Plan**: minimal DI seam + mock strategy + exact file list
 3) If implementation was approved: patch-style diffs or full-file replacements for only the scoped files
-4) **QA Gate Results**: analyzer delta, failing tests delta, per-file coverage delta (and overall if applicable)
+4) **QA Gate Results**: analyzer delta, failures in the single gate run, and per-file coverage against the thresholds
 
 # Prohibited behaviors
 - Broad refactors across multiple scripts “while you’re here”

package/resources/customizations/.github/agents/atomic_executor.agent.md

@@ -86,7 +86,7 @@ During preflight (before [P0-T1]), resolve work mode from feature `issue.md` mar
 
 If the marker is missing or malformed, fail closed to `full-feature`.
 
-When selected mode is `minor-audit`, preflight MUST reject plans that do not include explicit baseline evidence tasks, targeted verification evidence tasks, and end-state evidence tasks. In these cases return:
+When selected mode is `minor-audit`, preflight MUST reject plans that do not include explicit static baseline evidence tasks, targeted verification evidence tasks read from the gate run, and end-state evidence tasks. In these cases return:
 
 `PREFLIGHT: REVISIONS REQUIRED`
 
@@ -148,8 +148,8 @@ Confirm all of the following; otherwise stop and request a corrected plan:
 - Phase numbers in IDs match the phase heading.
 - Task numbers are sequential within each phase.
 - Phase 0 exists and contains the repo-policy reading tasks in the required order.
-- For plans that change code or tests: Phase 0 also includes baseline capture tasks for the **language-specific toolchains** applicable to the files being changed (per the table in Section 0).
-- Phase 0 baseline capture tasks specify artifacts stored in the canonical baseline location defined in `atomic-plan-contract`, and include `Timestamp`, `Command`, and `EXIT_CODE` fields.
+- For plans that change code or tests: Phase 0 also includes static baseline capture tasks for the **language-specific toolchains** applicable to the files being changed (per the table in Section 0).
+- Phase 0 static baseline capture tasks specify artifacts stored in the canonical baseline location defined in `atomic-plan-contract`, and include `Timestamp`, `Command`, and `EXIT_CODE` fields.
 - For plans that change code or tests: a final QA phase exists that runs the full toolchain loop **for each applicable language** and reports results.
 - Any **TDD Red** regression-test task (i.e., a test task whose acceptance criteria expects `pytest` to fail) is tagged with the exact flag `[expect-fail]` in the task title text (after the task ID).
 - No task is a “bucket task” (e.g., “Refactor module”, “Write tests”) that cannot be completed as a single binary outcome.
@@ -252,7 +252,7 @@ If the user says “resume”, “continue”, or “try again”:
 - When completing a task or a plan, report the toolchain status explicitly: 
   - For python, this is Black, Ruff, Pyright, Pytest, and coverage.
   - For bash, this is shell QC and bats testing.
-  - For powershell, this is `mcp__drm-copilot__run_poshqc_format`, `mcp__drm-copilot__run_poshqc_analyze`, and `mcp_drmcopilotext_run_poshqc_test`.
+  - For powershell, this is `mcp__drm-copilot__run_poshqc_format`, `mcp__drm-copilot__run_poshqc_analyze`, and one `Invoke-PoshQCParallelTest` run.
   - For json, this is json formatting and json linting.
 - Always end with the updated checklist so the user can see progress.