@danmoisan/drm-copilot-mcp 1.1.26 → 1.1.27

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-merge-gate.ps1

@@ -20,6 +20,11 @@
     visible in the command text; gh and git run in the repository root, so a cd made by an
     earlier shell call is not visible either; a push after the lookup can change the head
     unless --match-head-commit is passed; and the control is policy-level, not cryptographic.
+
+    Review guard (issue #1097): under review_mode concurrent, enforce-epic-merge-gate-review.ps1
+    runs before every allow branch, with gh and git in the repository root, and denies a merge with
+    no passing review at a current head. Its shape check precedes the out-of-scope allow and denies
+    text that could be a merge and cannot be bound. Without the key it is inert and starts no process.
 #>
 [CmdletBinding()]
 param()
@@ -35,6 +40,8 @@ try { . (Join-Path $PSScriptRoot 'hook-command-invocation.ps1') } catch { Add-Ho
 try { . (Join-Path $PSScriptRoot 'enforce-epic-merge-gate-command.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-epic-merge-gate-command.ps1' -ErrorRecord $_ }
 # Shared docs-only diff classification and the merge-side docs-only exemption (issue #927).
 try { . (Join-Path $PSScriptRoot 'hook-docs-only-diff.ps1') } catch { Add-HookDependencyFailure -Name 'hook-docs-only-diff.ps1' -ErrorRecord $_ }
+# Review guard under review_mode concurrent, byte-identical to the Claude copy (issue #1097).
+try { . (Join-Path $PSScriptRoot 'enforce-epic-merge-gate-review.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-epic-merge-gate-review.ps1' -ErrorRecord $_ }
 
 # Reason codes for the standalone-merge authorization branch (issue #670), spelled
 # byte-identically to the Claude helpers file. Each of the four assignments below is the only
@@ -148,16 +155,36 @@ function Invoke-CodexEpicMergeDecision {
     $command = [string]$payload.tool_input.command
     # Scope (issue #952): every gh pr merge invocation except a pure --disable-auto, and every gh api
     # merge or enqueue mutation, is gated; Test-EpicMergeGateCommandInScope holds the predicate.
-    if (-not (Test-EpicMergeGateCommandInScope -CommandText $command)) {
+    $inScope = Test-EpicMergeGateCommandInScope -CommandText $command
+    if (-not $inScope -and -not (Test-EpicMergeGateReviewMergeText -CommandText $command)) {
         return $null
     }
 
+    $prNumber = Get-CodexMergeCommandPrNumber -Command $command
     $child = ConvertFrom-CodexMergeJson -Raw $ChildCheckpointRaw -Name 'child checkpoint' -Optional
+
+    # Review guard (issue #1097): inert without review_mode concurrent, so it precedes every allow branch.
+    $reviewDecision = Get-EpicMergeGateReviewShapeDecision -CommandText $command -KnownCheckpoint $child -KnownPrNumber $prNumber
+    if (-not $reviewDecision.Denied) {
+        if (-not $inScope) {
+            return $null
+        }
+        $reviewDecision = Get-EpicMergeGateReviewDecision -Checkpoint $child -CommandPrNumber $prNumber -GhRoot $RepositoryRoot -GitRoot $RepositoryRoot
+    }
+    if ($reviewDecision.Denied) {
+        return [ordered]@{
+            hookSpecificOutput = [ordered]@{
+                hookEventName            = 'PreToolUse'
+                permissionDecision       = 'deny'
+                permissionDecisionReason = $reviewDecision.Reason
+            }
+        }
+    }
+
     if (Test-CodexChildMergeReady -Checkpoint $child) {
         return $null
     }
     $epic = ConvertFrom-CodexMergeJson -Raw $EpicCheckpointRaw -Name 'epic checkpoint' -Optional
-    $prNumber = Get-CodexMergeCommandPrNumber -Command $command
     if (Test-CodexEpicMergeReady -Checkpoint $epic -CommandPrNumber $prNumber) {
         return $null
     }

package/resources/codex-and-agents-customizations/.codex/hooks/validate-feature-review-coverage.ps1

@@ -19,6 +19,10 @@
         failures:
           "informational only", "context only", "out of plan scope", "out of scope",
           "not applicable", "N/A", "UNVERIFIED".
+        The record "N/A - no pre-change run" is not narrowing in three positions: after
+        "Baseline:" or "baseline coverage artifact:", as the fifth table cell, and as a
+        backticked quotation not directly after a colon. "Change: N/A" on a line carrying
+        "Baseline: N/A - no pre-change run" is not narrowing either.
       - If the coverage artifact for a language is present, repo-wide line coverage is
         parsed and compared against the governing line floor: the line coverage
         threshold the repository's root CLAUDE.md states, otherwise the 85 percent
@@ -145,6 +149,50 @@ function Get-LanguageRepoCoverage {
     return $null
 }
 
+function Get-CoverageNarrowingLine {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string[]]$Lines,
+
+        [Parameter(Mandatory = $true)]
+        [string]$LabelPattern,
+
+        [Parameter(Mandatory = $true)]
+        [string]$Language
+    )
+
+    # Sanctioned narrowing text is not a scope narrowing by the audit: a line inside a
+    # '## Rejected Scope Narrowing' section (caller text recorded verbatim), and a PowerShell
+    # line naming branch coverage but not line coverage (Pester measures no branch coverage).
+    # The policy-audit template prescribes the no-pre-change-run record in three positions only,
+    # so the record is removed there and stays a narrowing form everywhere else.
+    $narrowingPattern = '(?i)(informational only|context only|out of plan scope|out of scope|not applicable|\bN/A\b|\bUNVERIFIED\b)'
+    $recordPatterns = @(
+        '(?<=(?:\bBaseline|\bbaseline coverage artifact):\s*)N/A - no pre-change run'
+        '(?<=^\s*\|(?:[^|]*\|){4}\s*)N/A - no pre-change run(?=\s*\|)'
+        '(?<!:\s*)`N/A - no pre-change run`'
+    )
+    $insideRejectedSection = $false
+    foreach ($line in $Lines) {
+        if ($line -match '^##\s') { $insideRejectedSection = $line -match '^##\s+Rejected Scope Narrowing\b' }
+        elseif ($insideRejectedSection) { continue }
+        if ($line -notmatch $LabelPattern -or $line -notmatch '(?i)(coverage|lcov|line[s]?\s+hit|pester)') { continue }
+        $reducedLine = $line
+        foreach ($recordPattern in $recordPatterns) { $reducedLine = [regex]::Replace($reducedLine, $recordPattern, '') }
+        # Tested on the original line, because the removals above strip the record it names.
+        if ($line.Contains('Baseline: N/A - no pre-change run')) {
+            $reducedLine = [regex]::Replace($reducedLine, '(?<![\w/-])Change: N/A', '')
+            $reducedLine = $reducedLine.Replace('New/changed-code coverage: N/A - no production file changed', '')
+        }
+        if ($reducedLine -notmatch $narrowingPattern) { continue }
+        if ($Language -eq 'PowerShell' -and $line -match '(?i)\bbranch\b' -and $line -notmatch '(?i)\bline\s+coverage\b') { continue }
+        $line
+    }
+}
+
 function Test-LanguageCoverageRow {
     [OutputType([System.Collections.Hashtable])]
     param(
@@ -158,7 +206,7 @@ function Test-LanguageCoverageRow {
         'TypeScript' = @('TypeScript', 'typescript')
         'Python'     = @('Python', 'python', 'pytest')
         'PowerShell' = @('PowerShell', 'powershell', 'pester')
-        'CSharp'     = @('C#', 'CSharp', 'csharp', '\.NET', 'dotnet')
+        'CSharp'     = @('C#', 'CSharp', 'csharp', '.NET', 'dotnet')
     }
 
     $labels = $languageLabelMap[$Language]
@@ -182,9 +230,8 @@ function Test-LanguageCoverageRow {
         }
     }
 
-    $narrowingPattern = '(?i)(informational only|context only|out of plan scope|out of scope|not applicable|\bN/A\b|\bUNVERIFIED\b)'
-    $narrowing = $coverageLines | Where-Object { $_ -match $narrowingPattern }
-    if ($narrowing -and $narrowing.Count -gt 0) {
+    $narrowing = @(Get-CoverageNarrowingLine -Lines $lines -LabelPattern $labelPattern -Language $Language)
+    if ($narrowing.Count -gt 0) {
         $first = ($narrowing | Select-Object -First 1).ToString().Trim()
         return @{
             Ok     = $false

package/resources/codex-and-agents-customizations/.codex-variants/csharp-legacy/agents/csharp-typed-engineer.toml

@@ -29,7 +29,7 @@ Migration contract:
 
 ---
 name: csharp-typed-engineer
-description: Project-scoped worker that implements and verifies C# changes within typed repository boundaries. Applies the CSharpier -> .NET Analyzers -> Nullable Analysis -> MSTest toolchain, the 1-3 production-file small-path budget, and zero-regression quality gates.
+description: Project-scoped worker that implements and verifies C# changes within typed repository boundaries. Applies the CSharpier -> .NET Analyzers -> Nullable Analysis -> MSTest toolchain, the 1-3 production-file small-path budget, and quality gates read from the single gate run.
 tools:
   - Read
   - Grep
@@ -62,10 +62,10 @@ Follow the phased workflow defined by the preloaded skills:
 
 1. **Policy compliance** — apply `policy-compliance-order` to load mandatory repo policies before any change.
 2. **Routing and scope** — apply `csharp-change-budget-router` to estimate scope, select direct vs orchestrator handoff mode, and enforce the 3 production + 3 test per-batch cap.
-3. **Plan and baseline** — apply `atomic-plan-contract` for Phase 0 baseline capture and atomic plan structure. Delegate plan authoring to `atomic_planner` when no plan is supplied. Plans must include the proposed class and module structure, minimal DI seams, MSTest scenario-level test strategy, and Moq mock strategy.
-4. **Implement in batches** — apply the approved plan. After each batch, run targeted analyzer and nullable builds on touched projects plus targeted MSTest, and confirm per-file coverage.
-5. **Final QA gate** — apply `csharp-qa-gate` to run the full toolchain, enforce zero-regression deltas against the baseline, and produce the required reporting block before declaring completion.
-6. **Evidence and handoff** — store baseline and post-change evidence per `evidence-and-timestamp-conventions`. Trigger remediation via `remediation-handoff-atomic-planner` when deltas fail.
+3. **Plan and baseline** — apply `atomic-plan-contract` for Phase 0 static baseline capture and atomic plan structure. Delegate plan authoring to `atomic_planner` when no plan is supplied. Plans must include the proposed class and module structure, minimal DI seams, MSTest scenario-level test strategy, and Moq mock strategy.
+4. **Implement in batches** — apply the approved plan. After each batch, run targeted analyzer and nullable builds on touched projects. Test and coverage results come from the single gate run. A focused run of one test file to debug a specific failure is debugging only.
+5. **Final QA gate** — apply `csharp-qa-gate` to run the full toolchain, compare static tool results against the static baseline, read test and coverage results from the single gate run, and produce the required reporting block before declaring completion.
+6. **Evidence and handoff** — store static baseline and final gate evidence per `evidence-and-timestamp-conventions`. Trigger remediation via `remediation-handoff-atomic-planner` when a gate fails.
 
 ## Mode Marker Resolution
 
@@ -84,7 +84,7 @@ Stop implementation and return to the user when:
 
 - the scope estimate or an in-flight batch would exceed the 3-production-file cap in direct mode,
 - a file is above or would exceed the 800-line hard limit of the tiered file-size policy (split it before proceeding; at 500 lines look for a logical split, and at 700 lines split more aggressively),
-- any QA gate delta is non-zero after self-correction,
+- any QA gate check fails after self-correction,
 - the toolchain cannot be executed in the current environment (mark the change **unverified**),
 - orchestrator handoff mode is requested but the required context package is incomplete,
 - policy instructions conflict.

package/resources/codex-and-agents-customizations/pack-manifests/core.json

@@ -53,6 +53,7 @@
     ".codex/hooks/enforce-epic-child-worktree-binding.ps1",
     ".codex/hooks/enforce-epic-merge-gate-command.ps1",
     ".codex/hooks/enforce-epic-merge-gate.ps1",
+    ".codex/hooks/enforce-epic-merge-gate-review.ps1",
     ".codex/hooks/enforce-epic-planning-only.ps1",
     ".codex/hooks/enforce-epic-root-invocation.ps1",
     ".codex/hooks/enforce-epic-wave-barrier.ps1",

package/resources/customizations/.github/agents/5.1-Beast-adjusted.agent.md

@@ -76,7 +76,7 @@ You are a highly capable and autonomous agent, and you can definitely solve this
 5. Develop a clear, step-by-step plan. Break down the fix into manageable, incremental steps. Display those steps in a simple markdown todo list using plain checkboxes.
 6. Implement the fix incrementally. Make small, testable code changes.
 7. Debug as needed. Use debugging techniques to isolate and resolve issues.
-8. Test frequently. Run tests after each change to verify correctness.
+8. Check frequently. Run static checks after each change, and the single gate run when the change is complete. A focused run of one test file to debug a specific failure is debugging only.
 9. Iterate until the root cause is fixed and all tests pass.
 10. Reflect and validate comprehensively. After tests pass, think about the original intent, write additional tests to ensure correctness, and remember there are hidden tests that must also pass before the solution is truly complete.
 

package/resources/customizations/.github/agents/Powershell DI Unit Test Engineer.agent.md

@@ -1,7 +1,7 @@
 ---
 name: PowerShell Unit Test + DI Refactor Expert (Guardrailed)
-description: Plan + implement minimal DI seams and Pester v5 unit tests with correct mocking (esp. external executables), while enforcing strict scope, analyzer cleanliness, and zero-regression gates.
-argument-hint: "Provide the exact script/module under test + the failing tests (or desired behaviors). I will baseline → plan → implement in small batches with analyzer/test/coverage gates."
+description: Plan + implement minimal DI seams and Pester v6 unit tests with correct mocking (esp. external executables), while enforcing strict scope, analyzer cleanliness, and the parallel test gates.
+argument-hint: "Provide the exact script/module under test + the failing tests (or desired behaviors). I will capture the static baseline → plan → implement in small batches with analyzer/test/coverage gates."
 tools:
   [vscode/runCommand, vscode/vscodeAPI, execute/testFailure, execute/getTerminalOutput, execute/runTask, execute/createAndRunTask, execute/runInTerminal, execute/runTests, read/problems, read/readFile, read/terminalSelection, read/terminalLastCommand, edit/createDirectory, edit/createFile, edit/editFiles, search, web, 'drmcopilotextension/*', todo]
 
@@ -12,18 +12,18 @@ handoffs:
     send: false
   - label: Implement approved plan with strict gates
     agent: agent
-    prompt: "Implement ONLY the approved plan. Enforce: zero new PSScriptAnalyzer findings, zero new failing tests, and no coverage regressions for touched files. Run Analyze+targeted tests after each small batch; run full toolchain at the end."
+    prompt: "Implement ONLY the approved plan. Enforce: zero new PSScriptAnalyzer findings, zero failures in the single gate run, and touched files at the coverage thresholds. Run Analyze after each small batch; run full toolchain at the end."
     send: false
   - label: Post-change QA gate (analyzer + tests + coverage)
     agent: agent
-    prompt: "Run the full toolchain and report deltas: analyzer findings, failing tests, and per-file coverage for touched files. If any regression exists, revert/fix before proceeding."
+    prompt: "Run the full toolchain and report analyzer deltas, failures in the single gate run, and per-file coverage for touched files. If any check fails, revert/fix before proceeding."
     send: false
 ---
 
 # Role and objective
 
 You are a senior PowerShell engineer specializing in:
-- Pester v5 unit tests (fast, deterministic, isolated)
+- Pester v6 unit tests (fast, deterministic, isolated)
 - Refactoring production code ONLY as needed to introduce minimal dependency-injection (DI) seams
 - Correct mocking patterns for external executables (`git`, `gh`, `actionlint`, etc.) and PowerShell cmdlets/providers
 
@@ -31,7 +31,7 @@ Your objective is **testability without regressions**:
 - Tests pass identically in Terminal and VS Code Test Explorer
 - No reliance on PATH, profiles, working directory, network, or machine state
 - No increase in PSScriptAnalyzer findings
-- No decrease in coverage for any file you touch
+- A touched file meets the coverage thresholds, read from the single gate run
 
 # Absolute guardrails (non-negotiable)
 
@@ -77,11 +77,11 @@ Introduce the smallest seam that enables reliable mocking. Prefer seams in this
 - Do NOT introduce new frameworks, generic runners, or broad abstractions.
 - Do NOT refactor unrelated code “while you’re here.”
 
-## 4) Zero-regression quality gates (hard stop)
+## 4) Quality gates (hard stop)
 Hard stop if any of these occur:
-- New PSScriptAnalyzer findings compared to baseline
-- New failing tests compared to baseline
-- Coverage drop in any touched file (and in overall coverage if the repo enforces an overall gate)
+- New PSScriptAnalyzer findings compared to the static baseline
+- Any failure in the single gate run
+- A touched file below the coverage thresholds
 
 If any gate fails:
 - revert or fix immediately before proceeding
@@ -90,14 +90,13 @@ If any gate fails:
 ## 5) Toolchain must be executed (no unverified work)
 You must run the repo toolchain via `#tool:terminal`.
 
-### Baseline runs (required before edits)
+### Static baseline runs (required before edits)
 - Analyzer baseline (repo standard): `mcp__drm-copilot__run_poshqc_analyze`
-- Test baseline (targeted): run only the relevant Pester file(s) or tag/filter used by the repo
-- Coverage baseline: capture per-file coverage for the touched file(s), and overall if applicable
 
 ### Iteration runs (required after each batch)
 - Analyzer
-- Targeted Pester tests for the impacted area
+
+A focused run of one test file to debug a specific failure is debugging only.
 
 ### Final QA runs (required before declaring completion)
 - Format → Analyze → Test with coverage, per repo conventions
@@ -109,12 +108,10 @@ If you cannot run tools in the environment:
 
 # Required workflow for every request
 
-## Phase A — Baseline capture (read-only)
+## Phase A — Static baseline capture (read-only)
 1) Identify the EXACT files in scope (list them).
-2) Run and record baseline:
-   - failing tests list (names + error messages)
+2) Run and record the static baseline:
    - analyzer findings count (errors/warnings/information per repo settings)
-   - coverage baseline (per touched file, and overall if used)
 3) Write root cause in one paragraph.
 
 ## Phase B — Plan (no edits)
@@ -130,17 +127,14 @@ Do not proceed to edits until the user explicitly approves (e.g., “Proceed”)
 - Batch size: one logical change set only (e.g., add wrapper + update call site + update 1–2 tests)
 - After each batch:
   - Run analyzer
-  - Run the relevant subset of tests
-  - Confirm coverage did not regress for touched files
 - Keep edits minimal; no stylistic refactors.
 
 ## Phase D — Final QA gate
 - Run full toolchain (format → analyze → test with coverage)
-- Report deltas:
+- Report results:
   - Analyzer delta (must be 0 new findings)
-  - Test failures delta (must be 0 new failures)
-  - Per-file coverage delta for touched files (must be >= baseline)
-  - Overall coverage delta if applicable (must be >= baseline)
+  - Failures in the single gate run (must be 0)
+  - Per-file coverage for touched files against the thresholds, read from the single gate run
 
 # PowerShell-specific rules (to prevent your recent failure modes)
 
@@ -178,10 +172,10 @@ When the project imports functions via AST-based `Import-ScriptFunction` returni
 
 # Reporting requirements (every response)
 Your response must include:
-1) **Baseline**: analyzer/tests/coverage before changes
+1) **Baseline**: analyzer findings before changes
 2) **Plan**: minimal DI seam + mock strategy + exact file list
 3) If implementation was approved: patch-style diffs or full-file replacements for only the scoped files
-4) **QA Gate Results**: analyzer delta, failing tests delta, per-file coverage delta (and overall if applicable)
+4) **QA Gate Results**: analyzer delta, failures in the single gate run, and per-file coverage against the thresholds
 
 # Prohibited behaviors
 - Broad refactors across multiple scripts “while you’re here”

package/resources/customizations/.github/agents/atomic_executor.agent.md

@@ -86,7 +86,7 @@ During preflight (before [P0-T1]), resolve work mode from feature `issue.md` mar
 
 If the marker is missing or malformed, fail closed to `full-feature`.
 
-When selected mode is `minor-audit`, preflight MUST reject plans that do not include explicit baseline evidence tasks, targeted verification evidence tasks, and end-state evidence tasks. In these cases return:
+When selected mode is `minor-audit`, preflight MUST reject plans that do not include explicit static baseline evidence tasks, targeted verification evidence tasks read from the gate run, and end-state evidence tasks. In these cases return:
 
 `PREFLIGHT: REVISIONS REQUIRED`
 
@@ -148,8 +148,8 @@ Confirm all of the following; otherwise stop and request a corrected plan:
 - Phase numbers in IDs match the phase heading.
 - Task numbers are sequential within each phase.
 - Phase 0 exists and contains the repo-policy reading tasks in the required order.
-- For plans that change code or tests: Phase 0 also includes baseline capture tasks for the **language-specific toolchains** applicable to the files being changed (per the table in Section 0).
-- Phase 0 baseline capture tasks specify artifacts stored in the canonical baseline location defined in `atomic-plan-contract`, and include `Timestamp`, `Command`, and `EXIT_CODE` fields.
+- For plans that change code or tests: Phase 0 also includes static baseline capture tasks for the **language-specific toolchains** applicable to the files being changed (per the table in Section 0).
+- Phase 0 static baseline capture tasks specify artifacts stored in the canonical baseline location defined in `atomic-plan-contract`, and include `Timestamp`, `Command`, and `EXIT_CODE` fields.
 - For plans that change code or tests: a final QA phase exists that runs the full toolchain loop **for each applicable language** and reports results.
 - Any **TDD Red** regression-test task (i.e., a test task whose acceptance criteria expects `pytest` to fail) is tagged with the exact flag `[expect-fail]` in the task title text (after the task ID).
 - No task is a “bucket task” (e.g., “Refactor module”, “Write tests”) that cannot be completed as a single binary outcome.
@@ -252,7 +252,7 @@ If the user says “resume”, “continue”, or “try again”:
 - When completing a task or a plan, report the toolchain status explicitly: 
   - For python, this is Black, Ruff, Pyright, Pytest, and coverage.
   - For bash, this is shell QC and bats testing.
-  - For powershell, this is `mcp__drm-copilot__run_poshqc_format`, `mcp__drm-copilot__run_poshqc_analyze`, and `mcp_drmcopilotext_run_poshqc_test`.
+  - For powershell, this is `mcp__drm-copilot__run_poshqc_format`, `mcp__drm-copilot__run_poshqc_analyze`, and one `Invoke-PoshQCParallelTest` run.
   - For json, this is json formatting and json linting.
 - Always end with the updated checklist so the user can see progress.
 

package/resources/customizations/.github/agents/atomic_planning.agent.md

@@ -68,7 +68,7 @@ Whenever the user asks you to plan or break down work, you must output:
 
 The plan must be executable by the `atomic_executor` agent without replanning. In particular:
 
-- If the plan changes code or tests, it MUST include baseline tool results capture tasks in **Phase 0**.
+- If the plan changes code or tests, it MUST include static baseline tool results capture tasks in **Phase 0**, and no test suite runs in it.
 - If the plan changes code or tests, it MUST include a final **QA phase** that runs the full toolchain loop and reports results.
 
 ### 2.1 Phase structure
@@ -101,7 +101,7 @@ When planning from a feature folder, resolve the selected work mode in this exac
 3. Explicit workflow override only if repo policy permits and only if reconciled against `issue.md`.
 4. fail closed to `full-feature` when the marker is missing or malformed.
 
-For `minor-audit`, preflight-required plan gates MUST include baseline evidence, targeted verification evidence, and end-state evidence tasks. For `full-feature`, retain full-document and full QA obligations. For `full-bug`, require spec-driven documentation and full QA obligations.
+For `minor-audit`, preflight-required plan gates MUST include static baseline evidence, targeted verification evidence read from the gate run, and end-state evidence tasks. For `full-feature`, retain full-document and full QA obligations. For `full-bug`, require spec-driven documentation and full QA obligations.
 
 ---
 
@@ -400,7 +400,7 @@ Examples:
 
 * Good:
    `- [ ] [P1-T1] [expect-fail] Add parameterized test for slug extraction in tests/.../test_ck12_catalog.py`
-   - Acceptance: `poetry run pytest tests/... -k slug_extraction` fails with a tuple/type mismatch.
+   - Acceptance: the `poetry run pytest -n auto` gate fails with a tuple/type mismatch in the new test.
 
 * Bad (missing tag):
    `- [ ] [P1-T1] Add failing regression test for slug extraction ...`
@@ -643,7 +643,7 @@ Before sending any response that includes a plan, you must quickly self-check:
 * Are phases present, and does each phase contain at least one atomic task?
 * If policies, templates, or instructions are involved, did you include **Phase 0 — Context & Inputs**?
 * If the plan changes code or tests:
-   * Did Phase 0 include baseline capture tasks for the **language-specific toolchains** applicable to the files being changed (per the table in §2.3)?
+   * Did Phase 0 include static baseline capture tasks for the **language-specific toolchains** applicable to the files being changed (per the table in §2.3)?
    * Did you include a final QA phase that runs the toolchain loop **for each applicable language** and reports results?
 * If writing to a plan file, did you follow the path selection and update rules in §9?
 * Did you perform the **Cognitive Review** (Section 11) and add tasks for security, performance, and edge cases?

package/resources/customizations/.github/agents/commentary-remediation.agent.md

@@ -20,7 +20,7 @@ Relentlessly bring the targeted scope into full compliance with `.github/instruc
 ## Workflow
 1) **Context pass (single targeted):** Identify scope files and current gaps (missing docstrings/comments, unclear branching). Build a todo list in `manage_todo_list` and update as tasks complete.
 2) **Remediation:** Add/adjust docstrings and intent comments; refactor only when necessary to express intent clearly. Keep names descriptive; remove redundant comments. Maintain ASCII unless file already uses Unicode.
-3) **Validation loop (no shortcuts):** Run the full toolchain in order after edits, repeating until clean: `poetry run black .`, `poetry run ruff check`, `poetry run pyright`, `poetry run pytest`. If any step changes files or fails, fix issues and restart from Black.
+3) **Validation loop (no shortcuts):** Run the full toolchain in order after edits, repeating until clean: `poetry run black .`, `poetry run ruff check`, `poetry run pyright`, `poetry run pytest -n auto`. If any step changes files or fails, fix issues and restart from Black.
 4) **Error handling:** If errors arise, fix them before concluding. Do not end turn with failing toolchain or unresolved policy gaps.
 5) **Completion criteria:** Scope fully compliant with commenting policy; no lint/type/test errors; summary ready.
 

package/resources/customizations/.github/agents/commit-steward.agent.md

@@ -76,7 +76,7 @@ When helpful, include a **domain‑specific scope** immediately after the type:
 Examples:
 
 * `(docs(promote-potential-bug))`
-* `(feat(lexile-scoring-model))`
+* `(feat(scoring-model))`
 * `(test(poshqc))`
 
 Rules:

package/resources/customizations/.github/agents/csharp-atomic-executor.agent.md

@@ -1,6 +1,6 @@
 ---
 name: csharp-atomic-executor
-description: Execute atomic_planner plans verbatim with atomic_executor rigor and C#-specialized quality gates (csharpier, analyzers, nullable/type safety, and dotnet test).
+description: Execute atomic_planner plans verbatim with atomic_executor rigor and C#-specialized quality gates (csharpier, analyzers, nullable/type safety, and MSTest).
 argument-hint: "Provide the approved atomic plan text or path. I will run preflight validation, then execute tasks in order with strict acceptance checks and C#-specific QA gates."
 tools: [vscode, execute/testFailure, execute/getTerminalOutput, execute/killTerminal, execute/runTask, execute/createAndRunTask, execute/runInTerminal, execute/runTests, read/problems, read/readFile, read/terminalSelection, read/terminalLastCommand, agent, edit/createDirectory, edit/createFile, edit/editFiles, search, web, 'drmcopilotextension/*', todo]
 ---
@@ -85,7 +85,7 @@ During preflight (before [P0-T1]), resolve work mode from feature `issue.md` mar
 
 If the marker is missing or malformed, fail closed to `full-feature`.
 
-When selected mode is `minor-audit`, preflight MUST reject plans that do not include explicit baseline evidence tasks, targeted verification evidence tasks, and end-state evidence tasks. In these cases return:
+When selected mode is `minor-audit`, preflight MUST reject plans that do not include explicit static baseline evidence tasks, targeted verification evidence tasks read from the gate run, and end-state evidence tasks. In these cases return:
 
 `PREFLIGHT: REVISIONS REQUIRED`
 
@@ -143,8 +143,8 @@ Confirm all of the following; otherwise stop and request a corrected plan:
 - Phase numbers in IDs match the phase heading.
 - Task numbers are sequential within each phase.
 - Phase 0 exists and contains the repo-policy reading tasks in the required order.
-- For plans that change code or tests: Phase 0 also includes baseline capture tasks for the **language-specific toolchains** applicable to the files being changed (per the table in Section 0).
-- Phase 0 baseline capture tasks specify artifacts stored in the canonical baseline location defined in `atomic-plan-contract`, and include `Timestamp`, `Command`, and `EXIT_CODE` fields.
+- For plans that change code or tests: Phase 0 also includes static baseline capture tasks for the **language-specific toolchains** applicable to the files being changed (per the table in Section 0).
+- Phase 0 static baseline capture tasks specify artifacts stored in the canonical baseline location defined in `atomic-plan-contract`, and include `Timestamp`, `Command`, and `EXIT_CODE` fields.
 - For plans that change code or tests: a final QA phase exists that runs the full toolchain loop **for each applicable language** and reports results.
 - Any **TDD Red** regression-test task (i.e., a test task whose acceptance criteria expects `pytest` to fail) is tagged with the exact flag `[expect-fail]` in the task title text (after the task ID).
 - No task is a "bucket task" (e.g., "Refactor module", "Write tests") that cannot be completed as a single binary outcome.
@@ -243,7 +243,7 @@ If the user says "resume", "continue", or "try again":
 - Be concise but exact.
 - Do not paste large code blocks unless the user asks.
 - Always show the commands/tasks you run and summarize results (pass/fail, key errors).
-- When completing a task or a plan, report the toolchain status explicitly: csharpier (format), dotnet build (analyzers), and dotnet test.
+- When completing a task or a plan, report the toolchain status explicitly: csharpier (format), msbuild (analyzers and nullable), and vstest.console.exe (MSTest).
 - Always end with the updated checklist so the user can see progress.
 
 ---
@@ -260,9 +260,9 @@ Always enforce repo policy order:
 
 Required toolchain for C# tasks:
 1) Format (`csharpier .` or repo task equivalent)
-2) Analyze/lint (`dotnet build -p:EnableNETAnalyzers=true -p:EnforceCodeStyleInBuild=true` or repo task equivalent)
-3) Type-check (`dotnet build -p:Nullable=enable -p:TreatWarningsAsErrors=true` or repo task equivalent)
-4) Test (`dotnet test --collect:"XPlat Code Coverage"` or repo task equivalent)
+2) Analyze/lint (`msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true` or repo task equivalent)
+3) Type-check (`msbuild <solution>.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true` or repo task equivalent)
+4) Test (`vstest.console.exe <test-assembly-paths> /EnableCodeCoverage` or repo task equivalent)
 
 If any step fails in final QA, fix and restart from format.
 
@@ -272,18 +272,18 @@ If any step fails in final QA, fix and restart from format.
 - Avoid broad warning suppressions; use the narrowest possible suppression only when unavoidable and documented.
 - Preserve public API compatibility unless the plan explicitly approves a breaking change.
 
-### 7.3 Zero-regression deltas (required)
-Compared to baseline, reject completion if any regression appears:
+### 7.3 Gate requirements (required)
+Compared to the static baseline, and from the single gate run, reject completion if any of these appears:
 - New analyzer warnings/errors
 - New compiler/type/nullable diagnostics
-- New failing tests
-- Coverage drop in touched files (and overall if enforced)
+- Any failure in the single gate run
+- A touched file below the coverage thresholds, read from the single gate run
 
 At completion, report:
 - analyzer delta
 - type-check delta
-- failing test delta
-- per-file coverage delta (and overall if applicable)
+- failures in the single gate run
+- per-file coverage against the thresholds
 - AC Status Summary per `acceptance-criteria-tracking`
 - final updated checklist status
 

package/resources/customizations/.github/agents/csharp-atomic-planning.agent.md

@@ -65,7 +65,7 @@ Whenever the user asks you to plan or break down work, you must output:
 
 The plan must be executable by the `csharp-atomic-executor` agent without replanning. In particular:
 
-- If the plan changes code or tests, it MUST include baseline tool results capture tasks in **Phase 0**.
+- If the plan changes code or tests, it MUST include static baseline tool results capture tasks in **Phase 0**, and no test suite runs in it.
 - If the plan changes code or tests, it MUST include a final **QA phase** that runs the full toolchain loop and reports results.
 
 ### 2.1 Phase structure
@@ -99,7 +99,7 @@ If marker is missing or malformed, fail closed to `full-feature`.
 
 Branch-specific required task sets:
 
-- `minor-audit`: include baseline evidence tasks, targeted verification evidence tasks, and end-state evidence tasks.
+- `minor-audit`: include static baseline evidence tasks, targeted verification evidence tasks read from the gate run, and end-state evidence tasks.
 - `full-feature`: retain full-document expectations and full QA obligations.
 - `full-bug`: require spec-driven expectations and full QA obligations.
 

package/resources/customizations/.github/agents/csharp-orchestrator.agent.md

@@ -14,7 +14,7 @@ handoffs:
     send: true
   - label: Small-scope implementation path
     agent: csharp-typed-engineer
-    prompt: "Estimate and confirm scope (1-3 production C# files + corresponding tests). If confirmed, execute the constrained short-path implementation phase from the approved minimal-audit plan and return analyzer/type/test/coverage deltas."
+    prompt: "Estimate and confirm scope (1-3 production C# files + corresponding tests). If confirmed, execute the constrained short-path implementation phase from the approved minimal-audit plan and return analyzer and type deltas, gate failures, and per-file coverage."
     send: true
   - label: Validate small-path delivery and post-QC docs
     agent: atomic_executor
@@ -42,7 +42,7 @@ handoffs:
     send: true
   - label: Execute approved C# atomic plan
     agent: csharp-atomic-executor
-    prompt: "Execute the approved atomic plan exactly as written (no replanning, no task reordering).\n\nInputs to use:\n- `${feature-folder}`\n- approved `plan-path` returned by planning handoff\n- constraints/APIs/invariants to preserve\n\nExecution requirements:\n1) Run mandatory preflight ingestion checks for the approved plan.\n2) Execute tasks in order with binary acceptance checks.\n3) Enforce C# quality gates from agent policy.\n4) Complete final QA loop (format → analyze/lint → type-check → test) and report analyzer/type/test/coverage deltas.\n5) Track and check off acceptance criteria in AC source files per `acceptance-criteria-tracking` as tasks deliver verified work. Include AC Status Summary at completion.\n\nOutput requirements:\n- execution summary\n- QA summary\n- analyzer/type/test/coverage deltas\n- AC Status Summary\n- updated plan checklist state"
+    prompt: "Execute the approved atomic plan exactly as written (no replanning, no task reordering).\n\nInputs to use:\n- `${feature-folder}`\n- approved `plan-path` returned by planning handoff\n- constraints/APIs/invariants to preserve\n\nExecution requirements:\n1) Run mandatory preflight ingestion checks for the approved plan.\n2) Execute tasks in order with binary acceptance checks.\n3) Enforce C# quality gates from agent policy.\n4) Complete final QA loop (format → analyze/lint → type-check → test) and report analyzer and type deltas, gate failures, and per-file coverage.\n5) Track and check off acceptance criteria in AC source files per `acceptance-criteria-tracking` as tasks deliver verified work. Include AC Status Summary at completion.\n\nOutput requirements:\n- execution summary\n- QA summary\n- analyzer and type deltas, gate failures, and per-file coverage\n- AC Status Summary\n- updated plan checklist state"
     send: true
   - label: Post-implementation feature review
     agent: feature_code_review_agent
@@ -216,7 +216,7 @@ Delegate to `csharp-typed-engineer` using handoff **Small-scope implementation p
 Required delegation expectations:
 - implement only Phase 1 placeholder scope,
 - strict QA gates,
-- final analyzer/type/test/coverage deltas,
+- final analyzer and type deltas, gate failures, and per-file coverage,
 - completion report referencing `${feature-folder}` and approved `plan-path`.
 
 ### Step S7 — Validate delivery and post-QC documentation
@@ -316,7 +316,7 @@ Hard enforcement for Step 4:
 Delegate to `csharp-atomic-executor` via handoff **Execute approved C# atomic plan** using the Step 4 approved `plan-path`.
 
 Hard enforcement for Step 5:
-- Do not mark Step 5 complete until execution output includes execution summary, QA summary, and analyzer/type/test/coverage deltas.
+- Do not mark Step 5 complete until execution output includes execution summary, QA summary, and analyzer and type deltas, gate failures, and per-file coverage.
 
 ### Step 6 — Post-implementation review