@danmoisan/drm-copilot-mcp 1.1.26 → 1.1.27

package/resources/claude-customizations/.claude/hooks/enforce-epic-merge-gate.ps1

@@ -45,7 +45,11 @@
     enqueues the pull request; only a pure --disable-auto is out of scope. The predicate and the
     PR selector reader live in enforce-epic-merge-gate-command.ps1.
 
-    Design decision: branches 1-4 trust the on-disk checkpoint and never call gh. The green-CI
+    Design decision: without review_mode concurrent, branches 1-4 trust the on-disk checkpoint and
+    never call gh. Under that key the review guard (enforce-epic-merge-gate-review.ps1, issue #1097)
+    runs before branch 1 and makes one bounded gh pr view call and at most two git calls, and it
+    denies a merge with no passing review at a current head. Its shape check precedes the
+    out-of-scope allow and denies text that could be a merge and cannot be bound. The green-CI
     branch makes at most one bounded gh pr view call, only after its pure stages A to C pass.
     Its parallel exclusion is best-effort: the Parallel mode: true marker is in the delegation
     prompt, not in a Bash payload, so a parallel child that no checkpoint records yet is not
@@ -100,6 +104,8 @@ try { . (Join-Path $PSScriptRoot 'enforce-epic-merge-gate-command.ps1') } catch
 try { . (Join-Path $PSScriptRoot 'hook-docs-only-diff.ps1') } catch { Add-HookDependencyFailure -Name 'hook-docs-only-diff.ps1' -ErrorRecord $_ }
 # Green-CI standalone merge branch: pure checks, the live-head seam, and the stage orchestrator (issue #997).
 try { . (Join-Path $PSScriptRoot 'enforce-epic-merge-gate-green-ci.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-epic-merge-gate-green-ci.ps1' -ErrorRecord $_ }
+# Review guard under review_mode concurrent, byte-identical to the Codex copy (issue #1097).
+try { . (Join-Path $PSScriptRoot 'enforce-epic-merge-gate-review.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-epic-merge-gate-review.ps1' -ErrorRecord $_ }
 
 function ConvertFrom-EpicMergeGateJson {
     <#
@@ -349,6 +355,9 @@ function Invoke-EpicMergeGateDecision {
     # Scope (issue #952): every gh pr merge invocation except a pure --disable-auto, and every gh api
     # merge or enqueue mutation, is gated; Test-EpicMergeGateCommandInScope holds the predicate.
     if (-not (Test-EpicMergeGateCommandInScope -CommandText $commandText)) {
+        if (-not (Test-EpicMergeGateReviewMergeText -CommandText $commandText)) { return Get-EpicMergeGateAllowDecision }
+        $unscopedDecision = Get-EpicMergeGateReviewUnscopedDecision -CommandText $commandText
+        if ($unscopedDecision.Denied) { return Get-EpicMergeGateBlockDecision -Reason $unscopedDecision.Reason }
         return Get-EpicMergeGateAllowDecision
     }
 
@@ -366,6 +375,12 @@ function Invoke-EpicMergeGateDecision {
         $childRoot = if (@('SessionRoot', 'OtherWorktree') -contains $itemTarget.Status) { $itemTarget.WorktreeRoot } else { $null }
     }
     $childCheckpoint = if ($childRoot) { ConvertFrom-EpicMergeGateJson -Raw (Get-ChildOrchestratorCheckpointContent -Path (Get-WorktreeRunCheckpointPath -Kind item -WorktreeRoot $childRoot)) } else { $null }
+
+    # Review guard (issue #1097): inert without review_mode concurrent, so it precedes every allow branch.
+    $reviewDecision = Get-EpicMergeGateReviewShapeDecision -CommandText $commandText -KnownCheckpoint $childCheckpoint -KnownPrNumber $commandPrNumber -ReadCheckpoint ${function:Read-EpicMergeGateReviewItemCheckpoint}
+    if (-not $reviewDecision.Denied) { $reviewDecision = Get-EpicMergeGateReviewDecision -Checkpoint $childCheckpoint -CommandPrNumber $commandPrNumber -GhRoot $sessionRoot -GitRoot $childRoot }
+    if ($reviewDecision.Denied) { return Get-EpicMergeGateBlockDecision -Reason $reviewDecision.Reason }
+
     if ((Test-ChildCheckpointAllowsEpicMerge -Checkpoint $childCheckpoint) -and
         (Test-ChildCheckpointPrGateBinding -Checkpoint $childCheckpoint -CommandPrNumber $commandPrNumber)) {
         return Get-EpicMergeGateAllowDecision

package/resources/claude-customizations/.claude/hooks/validate-feature-review-coverage-rules.ps1

@@ -1,12 +1,14 @@
 <#
 .SYNOPSIS
-    Artifact-path rules, changed-language set, and coverage-row rule for the feature-review coverage hook.
+    Artifact-path rules, changed-language set, narrowing-line reader, and coverage-row rule for the
+    feature-review coverage hook.
 
 .DESCRIPTION
     Dot-sourced by validate-feature-review-coverage.ps1. Defines the advertised-path reader
     (Get-ReviewArtifactPathFromOutput), the active-feature location rule (Get-ReviewArtifactInfo),
-    the changed-language reader for the PR context summary (Get-ChangedLanguageSet), and the
-    per-language coverage-row rule (Test-LanguageCoverageRow).
+    the changed-language reader for the PR context summary (Get-ChangedLanguageSet), the
+    scope-narrowing line reader (Get-CoverageNarrowingLine), and the per-language coverage-row
+    rule (Test-LanguageCoverageRow).
 
     The file has no param() block, writes nothing to the output stream, and runs no top-level
     statement other than function definitions.
@@ -95,6 +97,50 @@ function Get-ChangedLanguageSet {
     return $langs
 }
 
+function Get-CoverageNarrowingLine {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string[]]$Lines,
+
+        [Parameter(Mandatory = $true)]
+        [string]$LabelPattern,
+
+        [Parameter(Mandatory = $true)]
+        [string]$Language
+    )
+
+    # Sanctioned narrowing text is not a scope narrowing by the audit: a line inside a
+    # '## Rejected Scope Narrowing' section (caller text recorded verbatim), and a PowerShell
+    # line naming branch coverage but not line coverage (Pester measures no branch coverage).
+    # The policy-audit template prescribes the no-pre-change-run record in three positions only,
+    # so the record is removed there and stays a narrowing form everywhere else.
+    $narrowingPattern = '(?i)(informational only|context only|out of plan scope|out of scope|not applicable|\bN/A\b|\bUNVERIFIED\b)'
+    $recordPatterns = @(
+        '(?<=(?:\bBaseline|\bbaseline coverage artifact):\s*)N/A - no pre-change run'
+        '(?<=^\s*\|(?:[^|]*\|){4}\s*)N/A - no pre-change run(?=\s*\|)'
+        '(?<!:\s*)`N/A - no pre-change run`'
+    )
+    $insideRejectedSection = $false
+    foreach ($line in $Lines) {
+        if ($line -match '^##\s') { $insideRejectedSection = $line -match '^##\s+Rejected Scope Narrowing\b' }
+        elseif ($insideRejectedSection) { continue }
+        if ($line -notmatch $LabelPattern -or $line -notmatch '(?i)(coverage|lcov|line[s]?\s+hit|pester)') { continue }
+        $reducedLine = $line
+        foreach ($recordPattern in $recordPatterns) { $reducedLine = [regex]::Replace($reducedLine, $recordPattern, '') }
+        # Tested on the original line, because the removals above strip the record it names.
+        if ($line.Contains('Baseline: N/A - no pre-change run')) {
+            $reducedLine = [regex]::Replace($reducedLine, '(?<![\w/-])Change: N/A', '')
+            $reducedLine = $reducedLine.Replace('New/changed-code coverage: N/A - no production file changed', '')
+        }
+        if ($reducedLine -notmatch $narrowingPattern) { continue }
+        if ($Language -eq 'PowerShell' -and $line -match '(?i)\bbranch\b' -and $line -notmatch '(?i)\bline\s+coverage\b') { continue }
+        $line
+    }
+}
+
 function Test-LanguageCoverageRow {
     [OutputType([System.Collections.Hashtable])]
     param(
@@ -141,19 +187,7 @@ function Test-LanguageCoverageRow {
         }
     }
 
-    # Sanctioned narrowing text is not a scope narrowing by the audit: a line inside a
-    # '## Rejected Scope Narrowing' section (caller text recorded verbatim), and a PowerShell
-    # line naming branch coverage but not line coverage (Pester measures no branch coverage).
-    $narrowingPattern = '(?i)(informational only|context only|out of plan scope|out of scope|not applicable|\bN/A\b|\bUNVERIFIED\b)'
-    $insideRejectedSection = $false
-    $narrowing = foreach ($line in $lines) {
-        if ($line -match '^##\s') { $insideRejectedSection = $line -match '^##\s+Rejected Scope Narrowing\b' }
-        elseif ($insideRejectedSection) { continue }
-        if ($line -notmatch $labelPattern -or $line -notmatch '(?i)(coverage|lcov|line[s]?\s+hit|pester)' -or $line -notmatch $narrowingPattern) { continue }
-        if ($Language -eq 'PowerShell' -and $line -match '(?i)\bbranch\b' -and $line -notmatch '(?i)\bline\s+coverage\b') { continue }
-        $line
-    }
-    $narrowing = @($narrowing)
+    $narrowing = @(Get-CoverageNarrowingLine -Lines $lines -LabelPattern $labelPattern -Language $Language)
     if ($narrowing.Count -gt 0) {
         $first = ($narrowing | Select-Object -First 1).ToString().Trim()
         return @{

package/resources/claude-customizations/.claude/lib/orchestrator-state/OrchestratorState.psm1

@@ -297,7 +297,8 @@ function Get-OrchestratorStatePrCreationReadinessError {
     .DESCRIPTION
         Private readiness check mirroring validate_orchestrator_state_pr_creation_readiness in
         _orchestrator_state_pr_creation_readiness.py: steps 5-8 must not be pending, blocked, or
-        blocked_remediation_loop_limit; blocked_reason must be `none` or absent; and the
+        blocked_remediation_loop_limit, except a pending step 7 under review_mode concurrent;
+        blocked_reason must be `none` or absent; and the
         local_execution_overrides / delegation_bypasses lists must be empty when present. It does
         not enforce completion, CI, PR, or routing-contract gates.
     .PARAMETER State
@@ -313,11 +314,15 @@ function Get-OrchestratorStatePrCreationReadinessError {
     )
 
     $errors = [System.Collections.Generic.List[string]]::new()
+    $stateNames = @($State.PSObject.Properties | ForEach-Object { $_.Name })
+    $reviewMode = if ($stateNames -ccontains 'review_mode') { (Get-OrchestratorStateField -State $State -Name 'review_mode').Value } else { $null }
 
     # Reject an upstream step recorded as pending, blocked, or blocked_remediation_loop_limit; steps
     # 5-8 must have finished before the first PR of a branch is created.
     foreach ($key in $script:PR_CREATION_READY_STEP_KEYS) {
         $field = Get-OrchestratorStateField -State $State -Name $key
+        # Under review_mode concurrent the review runs beside CI and the merge guard holds the merge.
+        if ($key -ceq 'step7_status' -and $field.Value -ceq 'pending' -and $reviewMode -is [string] -and $reviewMode -ceq 'concurrent') { continue }
         if ($field.Present -and (@('pending', 'blocked', 'blocked_remediation_loop_limit') -contains $field.Value)) {
             $errors.Add("Checkpoint PR-creation readiness validation failed: $key is $($field.Value).")
         }

package/resources/claude-customizations/.claude/lib/orchestrator-state/OrchestratorStateCompletion.psm1

@@ -23,6 +23,7 @@
       C5        mandatory route phases
       C6        the routing contract, from `OrchestratorStateRoutingContract.psm1`
       C7        the preparation terminal contract
+      C8        the review record under review_mode concurrent
       M1        model-routing receipt required once delegated
       M2        a complexity assessment for every matched receipt phase
       M3        per-entry re-validation of the U6.C and U6.M families
@@ -408,8 +409,8 @@ function Test-OrchestratorStateCompletionReadiness {
     $errors.AddRange([string[]]@(Get-OrchestratorStateUnconditionalError -State $state))
 
     # C family, in the reference's require_complete order: step statuses,
-    # blocked_reason, pr_gate, ci_gate, phase completeness, routing contract, and
-    # the preparation terminal contract.
+    # blocked_reason, pr_gate, ci_gate, phase completeness, routing contract, the
+    # preparation terminal contract, and the concurrent review record.
     $errors.AddRange([string[]]@(Get-OrchestratorStateCompletionStepStatusError -State $state))
     $errors.AddRange([string[]]@(Get-OrchestratorStateCompletionBlockedReasonError -State $state))
     $errors.AddRange([string[]]@(Get-OrchestratorStateCompletionPrGateError -State $state))
@@ -417,6 +418,7 @@ function Test-OrchestratorStateCompletionReadiness {
     $errors.AddRange([string[]]@(Get-OrchestratorStatePhaseCompletenessError -State $state))
     $errors.AddRange([string[]]@(Get-OrchestratorStateRoutingContractError -State $state))
     $errors.AddRange([string[]]@(Get-OrchestratorStatePreparationTerminalError -State $state))
+    $errors.AddRange([string[]]@(Get-OrchestratorStateCompletionConcurrentReviewError -State $state))
 
     # M family. The gate's M3 leg re-invokes the U6.C and U6.M validators, so its
     # output is merged under the PD-2 single-emission rule rather than appended

package/resources/claude-customizations/.claude/lib/orchestrator-state/OrchestratorStateCompletionChecks.psm1

@@ -1,6 +1,6 @@
 <#
 .SYNOPSIS
-    Portable completion-gate checks C1, C2, C3, C4, C5, and C7.
+    Portable completion-gate checks C1, C2, C3, C4, C5, C7, and C8.
 
 .DESCRIPTION
     Destination-runtime PowerShell port of the `--require-complete` checks the
@@ -19,6 +19,7 @@
       C5.1  mandatory route phases, from a static map
       C7.1  preparation terminal next_step (value-gated, repr rendering)
       C7.2  preparation terminal step statuses (value-gated, repr rendering)
+      C8    last review outcome under review_mode concurrent (value-gated)
 
     Route gating for C3 and C4 is resolved through
     `OrchestratorStateRoutingMatrix.psm1`, implementing deviation PD-1: the gate
@@ -407,6 +408,53 @@ function Get-OrchestratorStatePreparationTerminalError {
     return $errors.ToArray()
 }
 
+function Get-OrchestratorStateCompletionConcurrentReviewError {
+    <#
+    .SYNOPSIS
+        Return the review-record error under review_mode concurrent (row C8).
+    .DESCRIPTION
+        Mirrors validate_concurrent_review_completion. Only the exact string concurrent
+        activates the check, and only the final review_outcomes element counts. The head
+        error is reported only when the verdict error does not apply. The check does no
+        git work: head currency stays with the merge guard.
+    .PARAMETER State
+        The parsed checkpoint object.
+    .OUTPUTS
+        System.String[] - zero or one error string.
+    #>
+    [CmdletBinding()]
+    [OutputType([string[]])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [psobject] $State
+    )
+
+    $mode = $null
+    if ((Get-CheckpointObjectMemberName -Owner $State) -ccontains 'review_mode') { $mode = (Get-CheckpointObjectMember -Owner $State -Name 'review_mode').Value }
+    if (-not (($mode -is [string]) -and ($mode -ceq 'concurrent'))) {
+        return [string[]]@()
+    }
+
+    # A missing loop, a non-list value, an empty list, and a non-object last entry all
+    # leave $last unset, so each reports the verdict error.
+    $last = $null
+    $loop = (Get-CheckpointObjectMember -Owner $State -Name 'remediation_loop').Value
+    $outcomes = (Get-CheckpointObjectMember -Owner $loop -Name 'review_outcomes').Value
+    if ((Test-CheckpointListValue -Value $outcomes) -and $outcomes.Count -gt 0) {
+        $last = $outcomes[$outcomes.Count - 1]
+    }
+    $verdict = (Get-CheckpointObjectMember -Owner $last -Name 'verdict').Value
+    if (-not (($verdict -is [string]) -and ($verdict -ceq 'PASS'))) {
+        return [string[]]@('Checkpoint completion validation failed: review_mode concurrent requires a last review_outcomes entry with verdict PASS.')
+    }
+
+    $head = (Get-CheckpointObjectMember -Owner $last -Name 'head_sha').Value
+    if (-not (($head -is [string]) -and ($head -cmatch '\A[0-9a-f]{40}([0-9a-f]{24})?\z'))) {
+        return [string[]]@('Checkpoint completion validation failed: review_mode concurrent requires head_sha on the last review_outcomes entry.')
+    }
+    return [string[]]@()
+}
+
 # Each check family is exported individually so the completion entry point can
 # compose them in the Python reference's order; the gate-key helper stays private.
 Export-ModuleMember -Function `
@@ -415,4 +463,5 @@ Export-ModuleMember -Function `
     Get-OrchestratorStateCompletionPrGateError, `
     Get-OrchestratorStateCompletionCiGateError, `
     Get-OrchestratorStatePhaseCompletenessError, `
-    Get-OrchestratorStatePreparationTerminalError
+    Get-OrchestratorStatePreparationTerminalError, `
+    Get-OrchestratorStateCompletionConcurrentReviewError

package/resources/claude-customizations/.claude/lib/orchestrator-state/OrchestratorStateReceipts.psm1

@@ -264,9 +264,12 @@ function Get-RemediationCycleError {
 
     # Invariant 2: an execution status in the blocked set requires the nested
     # preflight to report exactly the cleared status; a missing or non-object
-    # preflight cannot satisfy it.
+    # preflight cannot satisfy it. An exact light cycle runs no preflight and is
+    # checked by invariant 8 instead.
     $executionStatus = (Get-CheckpointObjectMember -Owner $Cycle -Name 'execution_status').Value
-    if ($executionStatus -is [string] -and
+    $remediationPath = (Get-CheckpointObjectMember -Owner $Cycle -Name 'remediation_path').Value
+    $isLightCycle = ($remediationPath -is [string]) -and ([string]$remediationPath -ceq 'light')
+    if (-not $isLightCycle -and $executionStatus -is [string] -and
         ($script:EXECUTION_STATUSES_REQUIRING_CLEAR_PREFLIGHT -contains [string]$executionStatus)) {
         $preflight = (Get-CheckpointObjectMember -Owner $Cycle -Name 'preflight').Value
         $preflightStatus = (Get-CheckpointObjectMember -Owner $preflight -Name 'final_status').Value

package/resources/claude-customizations/.claude/lib/orchestrator-state/OrchestratorStateRemediationAccounting.psm1

@@ -6,8 +6,10 @@
     Destination-runtime PowerShell port of the issue #484 invariants the
     authoritative Python validator applies to a checkpoint's remediation_loop:
     the review-outcome rules R8a, R8b, R9a-R9d, and R10, and the accounting
-    rules R5, R6, R7a, R7b, and R11, matching the error-string templates in
-    `scripts/dev_tools/_orchestrator_state_remediation_loop.py` and the rules
+    rules R5, R6, R7a, R7b, and R11, and the light-remediation invariant 8
+    (issue #1097), matching the error-string templates in
+    `scripts/dev_tools/_orchestrator_state_remediation_loop.py`,
+    `scripts/dev_tools/_orchestrator_state_light_cycle.py`, and the rules
     document `.claude/rules/orchestrator-state.md`.
 
     The receipts module calls the exported entry point after its unchanged
@@ -40,6 +42,14 @@ $script:CANDIDATE_APPLIED_KEY = 'candidate_applied'
 $script:OPENED_BY_REVIEW_KEY = 'opened_by_review'
 $script:COMPLETED_EXECUTION_STATUS = 'complete'
 
+# Invariant 8 (light remediation) keys and limits. Pinned to the Python constants
+# in _orchestrator_state_light_cycle.py.
+$script:REMEDIATION_PATH_KEY = 'remediation_path'
+$script:LIGHT_REMEDIATION_PATH = 'light'
+$script:FULL_REMEDIATION_PATH = 'full'
+$script:LIGHT_FINDING_LIMIT = 3
+$script:CONTAINED_SCOPE = 'contained'
+
 # Review verdicts and remediability classes in spec table order, and the two
 # derived class partitions. Pinned to the Python constants of the same names.
 $script:REVIEW_VERDICTS = @('PASS', 'REMEDIATION_REQUIRED', 'HALT_NON_REMEDIABLE', 'AWAITING_CI')
@@ -260,6 +270,106 @@ function Test-RemediationOpenedByReview {
     return ($verdict -is [string]) -and ([string]$verdict -ceq $script:REMEDIATION_REQUIRED_VERDICT)
 }
 
+function Get-RemediationLightCycleError {
+    <#
+    .SYNOPSIS
+        Return the invariant 8 errors of every cycle that carries remediation_path.
+    .DESCRIPTION
+        Private helper mirroring validate_light_cycles (issue #1097). Per object cycle
+        whose key is present, in order: a value other than the exact string light or
+        full yields rule 1 alone; full yields nothing; light yields rule 2 (a preflight
+        key is present), rule 3 (opened_by_review is absent or fails the R11 predicate,
+        which skips rules 4 to 6), rule 4 (more than 3 findings; a non-list findings
+        value counts as empty), rule 5 per finding whose remediability is not exactly
+        autonomous, rule 6 per finding whose scope is not exactly contained, and rule 7
+        (the immediately prior element is an object whose remediation_path is exactly
+        light). Every string value is tested with -is [string] before -ceq, because
+        -ceq on an array filters rather than compares.
+    .PARAMETER Cycle
+        The loop's cycles list, or $null when cycles is absent or not a list.
+    .PARAMETER Outcomes
+        The raw review_outcomes value. May be $null.
+    .OUTPUTS
+        System.String[] - zero or more error strings.
+    #>
+    [CmdletBinding()]
+    [OutputType([string[]])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowNull()]
+        [AllowEmptyCollection()]
+        [object] $Cycle,
+
+        [Parameter(Mandatory = $true)]
+        [AllowNull()]
+        [object] $Outcomes
+    )
+
+    $errors = [System.Collections.Generic.List[string]]::new()
+    $cycleItems = @()
+    if ($null -ne $Cycle) { $cycleItems = @($Cycle) }
+
+    # Walk the cycles in order so each light cycle can see its immediate prior.
+    for ($index = 0; $index -lt $cycleItems.Count; $index++) {
+        $item = $cycleItems[$index]
+        if (-not (Test-CheckpointObjectValue -Value $item)) { continue }
+        $member = Get-CheckpointObjectMember -Owner $item -Name $script:REMEDIATION_PATH_KEY
+        if (-not $member.Present) { continue }
+
+        # Rule 1 routes by exact value: full has no further rule, and anything other
+        # than light is reported once and stops there.
+        $path = $member.Value
+        $isString = $path -is [string]
+        if ($isString -and ([string]$path -ceq $script:FULL_REMEDIATION_PATH)) { continue }
+        if (-not ($isString -and ([string]$path -ceq $script:LIGHT_REMEDIATION_PATH))) {
+            $errors.Add("Checkpoint remediation cycle #$index remediation_path must be light or full.")
+            continue
+        }
+
+        $prefix = "Checkpoint remediation cycle #$index remediation_path is light but"
+        if ((Get-CheckpointObjectMember -Owner $item -Name 'preflight').Present) {
+            $errors.Add("$prefix the cycle carries preflight.")
+        }
+
+        $opened = Get-CheckpointObjectMember -Owner $item -Name $script:OPENED_BY_REVIEW_KEY
+        if (-not $opened.Present -or -not (Test-RemediationOpenedByReview -OpenedByReview $opened.Value -Outcomes $Outcomes)) {
+            $errors.Add("$prefix opened_by_review does not name its opening review.")
+        } else {
+            $outcome = @($Outcomes)[[int]$opened.Value]
+            $findings = (Get-CheckpointObjectMember -Owner $outcome -Name 'findings').Value
+            $findingList = @()
+            if (Test-CheckpointListValue -Value $findings) { $findingList = @($findings) }
+            if ($findingList.Count -gt $script:LIGHT_FINDING_LIMIT) {
+                $errors.Add("$prefix its opening review has $($findingList.Count) findings; the limit is $($script:LIGHT_FINDING_LIMIT).")
+            }
+            # Report every finding a light cycle may not fix autonomously, then every
+            # finding whose fix is not contained; a non-object finding fails both.
+            foreach ($key in @('remediability', 'scope')) {
+                $required = if ($key -ceq 'remediability') { $script:REMEDIABLE_CLASS } else { $script:CONTAINED_SCOPE }
+                for ($findingIndex = 0; $findingIndex -lt $findingList.Count; $findingIndex++) {
+                    $finding = $findingList[$findingIndex]
+                    $value = $null
+                    if (Test-CheckpointObjectValue -Value $finding) { $value = (Get-CheckpointObjectMember -Owner $finding -Name $key).Value }
+                    if (-not (($value -is [string]) -and ([string]$value -ceq $required))) {
+                        $suffix = if ($key -ceq 'remediability') { 'is not autonomous.' } else { 'scope is not contained.' }
+                        $errors.Add("$prefix finding #$findingIndex $suffix")
+                    }
+                }
+            }
+        }
+
+        # Rule 7: two light cycles may not run back to back.
+        if ($index -gt 0 -and (Test-CheckpointObjectValue -Value $cycleItems[$index - 1])) {
+            $priorPath = (Get-CheckpointObjectMember -Owner $cycleItems[$index - 1] -Name $script:REMEDIATION_PATH_KEY).Value
+            if (($priorPath -is [string]) -and ([string]$priorPath -ceq $script:LIGHT_REMEDIATION_PATH)) {
+                $errors.Add("$prefix the prior cycle is light.")
+            }
+        }
+    }
+
+    return $errors.ToArray()
+}
+
 function Get-OrchestratorStateRemediationAccountingError {
     <#
     .SYNOPSIS
@@ -268,8 +378,9 @@ function Get-OrchestratorStateRemediationAccountingError {
         Public entry mirroring the issue #484 tail of _validate_remediation_loop.
         Returns, in order: the review-outcome errors (R8a; otherwise per outcome
         R8b, R9a, R9b, R9c or R9d per finding, then R10); then, for each object
-        cycle in order, R5, R6, and R11; then R7a, otherwise R7b. With none of the
-        new keys present it returns nothing.
+        cycle in order, R5, R6, and R11; then R7a, otherwise R7b; then invariant 8
+        through Get-RemediationLightCycleError. With none of the new keys present it
+        returns nothing.
     .PARAMETER RemediationLoop
         The deserialized remediation_loop object.
     .PARAMETER Cycle
@@ -329,6 +440,7 @@ function Get-OrchestratorStateRemediationAccountingError {
         }
     }
 
+    $errors.AddRange([string[]]@(Get-RemediationLightCycleError -Cycle $Cycle -Outcomes $outcomes))
     return $errors.ToArray()
 }
 

package/resources/claude-customizations/.claude/rules/csharp.md

@@ -2,19 +2,19 @@
 paths:
   - "**/*.cs"
   - "**/*.csproj"
-description: C#-specific toolchain and coding standards (xUnit).
+description: C#-specific toolchain and coding standards (MSTest).
 ---
 
 # C# Code Standards
 
-This rule file summarizes the C#-specific policies for this repository. It targets a host-neutral .NET foundation: xUnit, NSubstitute, FluentAssertions, `dotnet build`, the analyzer stack, `TimeProvider`, and uniform coverage thresholds.
+This rule file summarizes the C#-specific policies for this repository. It targets a host-neutral .NET foundation: MSTest, NSubstitute, FluentAssertions, `dotnet build`, the analyzer stack, `TimeProvider`, and uniform coverage thresholds.
 
 ## Toolchain
 
 1. **Formatting — CSharpier**: All C# source files must be formatted with CSharpier. Do not use `dotnet format`. Command: `dotnet tool restore` followed by `dotnet csharpier check .` (or `dotnet csharpier .` to auto-format).
 2. **Linting — .NET Analyzers**: C# code must pass Roslyn/.NET analyzer diagnostics. Analyzer enforcement is centralized in `Directory.Build.props` (`AnalysisLevel=latest-all`, `AnalysisMode=All`, `TreatWarningsAsErrors=true`). Command: `dotnet build` runs analyzers as part of the build.
 3. **Type Checking — Nullable Analysis**: Nullable reference types are enabled solution-wide via `Directory.Build.props` (`Nullable=enable`, `TreatWarningsAsErrors=true`). Command: `dotnet build` enforces nullable warnings as errors.
-4. **Testing — xUnit + NSubstitute + FluentAssertions**: Run tests with: `dotnet test --collect:"XPlat Code Coverage"`.
+4. **Testing — MSTest + NSubstitute + FluentAssertions**: Run tests with: `dotnet test --collect:"XPlat Code Coverage"`.
 
 Run the toolchain in order: format → lint → type-check → architecture → test. Restart from step 1 if any step fails or changes files.
 
@@ -31,11 +31,11 @@ Run the toolchain in order: format → lint → type-check → architecture →
 
 ## Testing Standards
 
-- Use **xUnit** as the test framework with `[Fact]` and `[Theory]` attributes.
-- Use **`[Theory]` + `[InlineData]`** for parameterized tests.
-- Use **`IClassFixture<T>`** to share expensive setup across tests within a class.
+- Use **MSTest** (`Microsoft.VisualStudio.TestTools.UnitTesting`) as the test framework with `[TestClass]` and `[TestMethod]` attributes, on the VSTest runner (the `MSTest` package with `Microsoft.NET.Test.Sdk` and `coverlet.collector`).
+- Use **`[TestMethod]` + `[DataRow]`** for parameterized tests.
+- Use **`[ClassInitialize]`** to share expensive setup across tests within a class.
 - Use **NSubstitute** for test doubles. Example: `var sut = Substitute.For<IService>(); sut.Get().Returns(value);`.
-- Prefer **FluentAssertions** for assertions; use xUnit `Assert` only when FluentAssertions is not practical.
+- Prefer **FluentAssertions** for assertions; use MSTest `Assert` only when FluentAssertions is not practical.
 - Follow Arrange–Act–Assert structure.
 - No external dependencies in unit tests.
 
@@ -53,7 +53,7 @@ Run the toolchain in order: format → lint → type-check → architecture →
 
 ### Golden Tests
 
-- **Verify.Xunit**: required for T1 classifier-output modules, tested against a versioned corpus.
+- **Verify.MSTest**: required for T1 classifier-output modules, tested against a versioned corpus.
 
 ## Analyzer Stack
 

package/resources/claude-customizations/.claude/rules/orchestrator-state.md

@@ -71,7 +71,7 @@ These invariants apply only when the checkpoint contains a top-level `remediatio
 
 1. **Non-empty `plan_path`.** Each cycle's `plan_path` must be a non-empty string. A missing value, a non-string value, or an empty/whitespace-only string is a malformed cycle.
 
-2. **Execution requires cleared preflight.** A cycle's `execution_status` may be in `{in_progress, complete, failed}` only when that cycle's `preflight.final_status` is exactly `'clear'`. Any other preflight status with one of those execution statuses is a malformed cycle (execution was recorded before preflight cleared).
+2. **Execution requires cleared preflight.** A cycle's `execution_status` may be in `{in_progress, complete, failed}` only when that cycle's `preflight.final_status` is exactly `'clear'`. Any other preflight status with one of those execution statuses is a malformed cycle (execution was recorded before preflight cleared). The invariant does not apply to a cycle whose `remediation_path` is exactly the string `light`, compared ordinally, because a light cycle runs no preflight; invariant 8 governs that cycle.
 
 3. **Exit gate requires zero blocking findings.** When a cycle's `exit_condition_met == true`, its `blocking_count` must be `0`. A non-zero `blocking_count` with `exit_condition_met == true` is a malformed cycle (the exit gate was marked satisfied while blocking findings remained).
 
@@ -83,6 +83,17 @@ These invariants apply only when the checkpoint contains a top-level `remediatio
 
 7. **`completed_attempts` counts completed attempts (R7).** When `remediation_loop.completed_attempts` is present, it must be a non-negative integer (not a boolean) equal to the number of object cycles whose `candidate_applied` is `true` (zero when `cycles` is absent or not a list), and any other value is a malformed loop.
 
+8. **Light remediation (issue #1097).** When a cycle object carries `remediation_path`, the rules below run in the accounting stage, after the R7 checks, per cycle in order, with byte-identical messages in `scripts/dev_tools/_orchestrator_state_light_cycle.py`, `extensions/drm-copilot/src/lib/validate/orchestrator-state-light-cycle.ts`, and `Get-RemediationLightCycleError` in `.claude/lib/orchestrator-state/OrchestratorStateRemediationAccounting.psm1`, pinned by the corpus `tests/fixtures/orchestrator_state_remediation_loop/`. A cycle without the key reaches none of them, so every existing checkpoint validates as before. `scope` on a finding is read only by these rules.
+   1. A value other than exactly `light` or `full`, null included: `Checkpoint remediation cycle #N remediation_path must be light or full.` Nothing further runs for the cycle, and nothing further runs for `full`.
+   2. A `preflight` key, whatever its value: `Checkpoint remediation cycle #N remediation_path is light but the cycle carries preflight.`
+   3. `opened_by_review` absent, or not naming a `REMEDIATION_REQUIRED` outcome by the R11 predicate: `Checkpoint remediation cycle #N remediation_path is light but opened_by_review does not name its opening review.` Rules 4 to 6 are then skipped.
+   4. More than 3 findings in that outcome (a non-list `findings` value counts as empty): `Checkpoint remediation cycle #N remediation_path is light but its opening review has M findings; the limit is 3.`
+   5. Per finding K whose `remediability` is not exactly `autonomous`, a non-object finding included: `Checkpoint remediation cycle #N remediation_path is light but finding #K is not autonomous.`
+   6. Per finding K whose `scope` is not exactly `contained`, absent included: `Checkpoint remediation cycle #N remediation_path is light but finding #K scope is not contained.`
+   7. The immediately prior list element is an object whose `remediation_path` is exactly `light`: `Checkpoint remediation cycle #N remediation_path is light but the prior cycle is light.`
+
+   Route (D9): the installed MCP validator applies invariant 8 only after the extension release that carries it is installed. Until then, a Claude run validates a light checkpoint through the repository-local Python CLI, and on Codex, whose completion boundary is the installed MCP validator, the light path is unavailable.
+
 ## Invariants (remediation_loop.review_outcomes)
 
 These invariants apply only when `remediation_loop` contains a `review_outcomes` key. The orchestrator appends one entry per review, including a `PASS` review, in the shape `{"verdict": <verdict>, "findings": [{"remediability": <class>}, ...]}`, where `findings` lists the review's blocking findings only. A halt or wait verdict records no remediation cycle.
@@ -264,7 +275,7 @@ A standalone run (neither an epic child nor a parallel item) merges its own pull
 3. The per-feature checkpoint has `epic_mode` absent, `null`, or JSON `false`; carries no `parallel_mode: true` and no non-blank `parallel_slug`; records `step9_status` exactly `passed` and `ci_gate.conclusion` exactly `success`; records `pr_gate.pr_number` as a JSON integer equal to the command number (an authorization record does not substitute); records `ci_gate.head_sha` as a lowercase 40 or 64 character object id; and, when `pr_gate.head_sha` is present and not `null`, records it equal to `ci_gate.head_sha`.
 4. The live pull-request head from one bounded `gh pr view` call equals `ci_gate.head_sha`, and a `--match-head-commit` value, when present, equals the live head.
 
-`parallel_mode`, `parallel_slug`, and `pr_merge` are tolerated, unvalidated top-level checkpoint keys: no validator reads them. A parallel child records `parallel_mode: true` and `parallel_slug` at kickoff, and a standalone run records `pr_merge: { merge_commit_sha, target_branch, merged_at }` only after its merge is confirmed.
+`parallel_mode`, `parallel_slug`, `pr_merge`, and `stage_timing` are tolerated, unvalidated top-level checkpoint keys: no validator reads them. A parallel child records `parallel_mode: true` and `parallel_slug` at kickoff, and a standalone run records `pr_merge: { merge_commit_sha, target_branch, merged_at }` only after its merge is confirmed. The orchestrator main session writes `stage_timing`, a list of `{ stage, attempt, started_at, ended_at }` entries (issue 1097) of wall-clock times in which `ended_at` is null while a stage is open, and commits the same list as `FEATURE/evidence/other/stage-timing.<timestamp>.json` before the merge. The merge stage is not captured. The writer protocol is in the orchestrate skill.
 
 Honest disclosure: the parallel exclusion is best-effort. The `Parallel mode: true` marker lives in the delegation prompt and is not present in a Bash `PreToolUse` payload, so a parallel child whose number and worktree path the parallel checkpoint has not yet recorded, and which omits the `parallel_mode` key, is not excluded by the hook. Like the authorization record above, the green-CI condition is a policy-level control, not a security control. A push after the live-head lookup can also change the head unless the command passes `--match-head-commit`, which the hook does not require.
 
@@ -317,6 +328,21 @@ A lifecycle record moved to `docs/features/potential/promoted/` satisfies the `p
 
 Fail-closed behavior: any adoption error waives nothing, so each missing receipt is still reported as `Checkpoint missing successful MCP receipt: <tool>.`. Adoption errors are placed after the receipt-loop errors and before the `local_execution_overrides` errors. Rule 10 and rule 11 errors follow the rule 9 errors in the adoption error list, so a checkpoint that waives `new_active_feature_folder` without a valid record reports the missing-receipt line for each unreceipted required tool first, in `required_mcp_tools` order, and the rule 10 or rule 11 error after them. The waiver affects only receipt presence: the declared `required_mcp_tools` equality check with the routing matrix is unchanged, so a checkpoint must still declare every route tool it waives.
 
+## Concurrent-Review Scope and Backward Compatibility
+
+These rules apply only when a checkpoint contains the top-level key `review_mode` with the exact string `concurrent`, compared ordinally. An absent key, `null`, `sequential`, a case variant, a number, and every other value mean sequential, and a checkpoint without the key validates exactly as before: no `gh` call, no new denial, and no readiness relaxation. The key is tolerated and is not a member of `REQUIRED_STATE_KEYS`. `.claude/skills/orchestrate/SKILL.md` (`## Concurrent Review and CI (review_mode)`) defines the run sequence.
+
+- **`head_sha`.** Each `remediation_loop.review_outcomes[]` entry of a concurrent run carries `head_sha`: the head the review ran against, a full lowercase object id of 40 or 64 characters. Plain validation does not read it.
+- **Last-entry semantics.** Only the final `review_outcomes[]` element counts, so an earlier `PASS` never satisfies a rule.
+- **Readiness.** Under the key, PR-creation readiness stops rejecting `step7_status` for the value `pending` only. `blocked`, and every other step, keep today's result. TypeScript has no readiness port.
+- **Completion.** Under the key, `require_complete` appends exactly one of these strings after the existing completion checks, byte-identical in `scripts/dev_tools/_orchestrator_state_concurrent_review.py`, `extensions/drm-copilot/src/lib/validate/orchestrator-state-concurrent-review.ts`, and `Get-OrchestratorStateCompletionConcurrentReviewError` in `.claude/lib/orchestrator-state/OrchestratorStateCompletionChecks.psm1`, and pinned by the corpus `tests/fixtures/orchestrator_state_concurrent_review/`. The second is reported only when the first does not apply. Validators do no git work.
+  - `Checkpoint completion validation failed: review_mode concurrent requires a last review_outcomes entry with verdict PASS.`
+  - `Checkpoint completion validation failed: review_mode concurrent requires head_sha on the last review_outcomes entry.`
+- **Merge guard.** `.claude/hooks/enforce-epic-merge-gate-review.ps1`, byte-identical at `.codex/hooks/`, runs before every allow branch of both merge gates. It denies with `REVIEW_GATE_NOT_PASSED`, `REVIEW_GATE_HEAD_STALE`, or `REVIEW_GATE_HEAD_UNRESOLVED`, each after the token `EPIC_MERGE_GATE_BLOCKED`. A later head is current only when the reviewed head is its ancestor and every path changed since then lies inside `feature-folder`, so a code change after the review, including a merge of `origin/main`, is stale. A merge must be one plain `gh pr merge` of one number as its own Bash call: under the key, text that could be a merge and cannot be bound to one pull request is denied with `REVIEW_GATE_HEAD_UNRESOLVED`, before any process and before the out-of-scope allow of both gates.
+- **Validator route (D9).** The TypeScript rule reaches the MCP surface only after an extension release. Until then, installed MCP accepts a checkpoint that the PowerShell stop hook and the Python CLI reject, so a concurrent checkpoint is checked through the Python CLI.
+
+Honest disclosure (D10): the guard is a policy-level control, not a security control. A writer in the same session can edit the checkpoint. A merge outside the Bash hook surface is not gated. A merge whose item target does not resolve (`NoTarget` or `Ambiguous`), or whose child checkpoint does not parse, sees no key, and the parallel skill step is then the only backstop. A push after the lookup can change the head unless the command passes `--match-head-commit`. The `CI full run` requirement of the join is skill-level, because a docs-only head passes `CI Required Gate`. The authorization path reads no CI result, so the required `CI Required Gate` context is the control there. A text scan cannot read every merge: a script file performing the merge cannot be read, and neither can encoded or run-time composed text, a `gh` alias or shell function from an earlier call, or an endpoint held in a variable. A merge through a tool other than Bash is not gated: the Claude PowerShell tool and `mcp__*` tools, because the gate is registered on the `Bash` matcher only, and the Codex `shell_command` tool, because the gate is registered under `^Bash$` and returns for any other tool name. An already-queued auto-merge fires with no command, and `gh pr merge <PR> --disable-auto` removes it. A direct push to the base branch is not a pull-request merge, and the gate does not read it. A number-less merge text sees only the session checkpoint, so a key in another worktree is not found. The extra checkpoint read of the shape rule is best-effort: a failed read sees no key and keeps the decision of a run without the key. The extra read covers at most the first 4 numbers of the text, so a key held only by an item named after them is not found. Under the key the rule is fail-closed, so prose containing `pr merge` is denied in any command, including `git commit -m` and `grep`. The trigger is wider than `pr merge`: prose such as `pr (#12)` or `pr $HOME` is denied the same way, and a plain merge followed by a line feed or `;` is denied, because a bound merge must be the whole text. This trade is accepted because only concurrent runs carry the key and a merge is issued in its own call.
+
 ## Enforcement
 
 - `scripts/dev_tools/validate_orchestrator_state.py` appends one error per violated invariant when a `remediation_loop` is present, using the existing validator message style (literal, checkpoint-context prefixed). The validator returns a list of error strings and does not mutate its input.

package/resources/claude-customizations/.claude/rules/powershell.md

@@ -15,7 +15,7 @@ This rule file summarizes the PowerShell-specific policies for this repository.
 1. **Formatting — Invoke-Formatter**: Format all PowerShell files via PoshQC. MCP command: `mcp__drm-copilot__run_poshqc_format`
 2. **Linting — PSScriptAnalyzer**: Run PoshQC analyzer with repo settings. MCP command: `mcp__drm-copilot__run_poshqc_analyze`. Optional autofix: `mcp__drm-copilot__run_poshqc_analyze_autofix`
 3. **Type checking**: Not applicable for PowerShell; skip to testing.
-4. **Testing — Pester (v5.x)**: Run tests via MCP. MCP command: `mcp__drm-copilot__run_poshqc_test`. Use repo config at `scripts/powershell/PoshQC/settings/pester.runsettings.psd1`.
+4. **Testing — Pester (v6.x)**: Run tests via MCP. MCP command: `mcp__drm-copilot__run_poshqc_test`. Use repo config at `scripts/powershell/PoshQC/settings/pester.runsettings.psd1`.
 
 Run the toolchain in order: format → analyze → test. Restart from step 1 if any step fails or changes files. Use the MCP server functions; do not substitute VS Code task wrappers.
 
@@ -53,7 +53,7 @@ Introduce the smallest seam that enables reliable mocking. Apply these options i
 
 ## Testing Standards
 
-- Use **Pester** (v5.x) as the test framework.
+- Use **Pester** (v6.x) as the test framework.
 - Organize tests to mirror code structure (e.g., `tests/scripts/dev-tools/ScriptName.Tests.ps1`).
 - Name test files `*.Tests.ps1`.
 - Use `Describe`/`Context`/`It` blocks; one behavior per `It`.