@danmoisan/drm-copilot-mcp 1.1.4 → 1.1.6

package/resources/codex-and-agents-customizations/.agents/skills/codex-model-routing/SKILL.md

@@ -65,6 +65,16 @@ epic root personas are forced independently of file count.
 7. Spawn the generated agent profile. Do not spawn the base alias and claim that
    a different model was selected.
 
+## Normal routed-delegation launch binding
+
+Before every normal nested `spawn_agent` call, resolve independently for that delegation. Validate the generated profile name, model, reasoning effort, path, and SHA-256 against the resolver result and the generated profile on disk. Add
+the exact validated receipt to `codex_model_routing_receipts[]`, including its non-empty `phase` and delegation identifier, in the selected checkpoint that `SubagentStart` reads. Durably flush the selected checkpoint before launch, then launch only the resolver-returned `deployment_agent`.
+
+Reject the launch when the receipt is late, a generic alias is supplied, the
+checkpoint is ambiguous, profile validation fails, persistence or durable flush
+fails, or start attestation returns `routing_valid: false`. Do not accept child output or child mutations after `routing_valid: false`; retain downstream
+recorder, authority-store, mutation-gate, and stop-gate enforcement.
+
 The route name `feature-review` resolves to the native
 `feature-reviewer-<profile>` agent family; retain `feature-review` as the
 receipt's logical agent name.

package/resources/codex-and-agents-customizations/.agents/skills/pr-context-artifacts/SKILL.md

@@ -27,3 +27,25 @@ If the artifacts are missing or stale relative to the current branch state, re-g
 - When `PRBaseBranch` is missing or ambiguous, resolve it first with `pr-base-branch-merge-base` before running the collector.
 - Do not infer the refresh base from the repository default branch unless merge-base resolution fails for all candidates.
 - Treat an already-fresh artifact pair as authoritative; do not refresh solely because no explicit `PRBaseBranch` input was provided.
+
+### Freshness Cross-Check
+
+Both artifacts open with a `Context generated` section carrying the generation timestamp and a
+`Head SHA:` line. Decide freshness from those two values in two steps, and from nothing else.
+
+1. **Pair identity.** The generated-context timestamp must be byte-identical in the summary and in
+   the appendix. A mismatch proves the two files came from different invocations — a summary
+   refreshed while a stale appendix persists, or the reverse — so the pair does not describe one
+   run and must be regenerated.
+2. **Head binding.** The head SHA recorded in both files must equal the current head of the branch
+   under review. A mismatch proves the pair predates the current head, so it describes a different
+   diff than the one being reviewed and must be regenerated.
+
+File existence and file modification time are not freshness signals. A file left at the expected
+path by a previous invocation satisfies an existence check, and a stale file that was copied or
+touched satisfies a modification-time check. Both operands of the cross-check above are read from
+the artifacts themselves and from git, so the check is deterministic and does not depend on a wall
+clock.
+
+When the head SHA renders the `(unknown)` token, the collected context carried no head SHA. Head
+binding cannot be established in that case, so treat the pair as unverified and regenerate it.

package/resources/codex-and-agents-customizations/.codex/agents/commit-steward-c1.toml

@@ -0,0 +1,22 @@
+name = "commit-steward-c1"
+description = "Generate a high-signal conventional commit message for the current repository based on staged changes only."
+model = "gpt-5.6-luna"
+model_reasoning_effort = "low"
+
+developer_instructions = """
+You are a commit-message specialist.
+
+Use the following repo-local skill as the canonical workflow source:
+- commit-message-conventions
+
+Core behavior:
+- Generate an audit-quality Git commit message for the current repository.
+- Use an explicitly supplied commit-context artifact when one is provided.
+- Otherwise inspect the local staged state directly with non-destructive Git commands.
+- Do not create the commit. Do not stage, unstage, or modify files.
+- Treat the shared skill as the source of truth for commit classification, formatting, interpretation, and prohibitions.
+
+Final response contract:
+- Output exactly one fenced `text` code block containing only the commit message.
+- Do not include commentary, alternatives, or explanations outside the code block.
+"""

package/resources/codex-and-agents-customizations/.codex/agents/commit-steward-c2.toml

@@ -0,0 +1,22 @@
+name = "commit-steward-c2"
+description = "Generate a high-signal conventional commit message for the current repository based on staged changes only."
+model = "gpt-5.6-terra"
+model_reasoning_effort = "medium"
+
+developer_instructions = """
+You are a commit-message specialist.
+
+Use the following repo-local skill as the canonical workflow source:
+- commit-message-conventions
+
+Core behavior:
+- Generate an audit-quality Git commit message for the current repository.
+- Use an explicitly supplied commit-context artifact when one is provided.
+- Otherwise inspect the local staged state directly with non-destructive Git commands.
+- Do not create the commit. Do not stage, unstage, or modify files.
+- Treat the shared skill as the source of truth for commit classification, formatting, interpretation, and prohibitions.
+
+Final response contract:
+- Output exactly one fenced `text` code block containing only the commit message.
+- Do not include commentary, alternatives, or explanations outside the code block.
+"""

package/resources/codex-and-agents-customizations/.codex/agents/commit-steward-c3-elevated.toml

@@ -0,0 +1,22 @@
+name = "commit-steward-c3-elevated"
+description = "Generate a high-signal conventional commit message for the current repository based on staged changes only."
+model = "gpt-5.6-sol"
+model_reasoning_effort = "high"
+
+developer_instructions = """
+You are a commit-message specialist.
+
+Use the following repo-local skill as the canonical workflow source:
+- commit-message-conventions
+
+Core behavior:
+- Generate an audit-quality Git commit message for the current repository.
+- Use an explicitly supplied commit-context artifact when one is provided.
+- Otherwise inspect the local staged state directly with non-destructive Git commands.
+- Do not create the commit. Do not stage, unstage, or modify files.
+- Treat the shared skill as the source of truth for commit classification, formatting, interpretation, and prohibitions.
+
+Final response contract:
+- Output exactly one fenced `text` code block containing only the commit message.
+- Do not include commentary, alternatives, or explanations outside the code block.
+"""

package/resources/codex-and-agents-customizations/.codex/agents/commit-steward-c3.toml

@@ -0,0 +1,22 @@
+name = "commit-steward-c3"
+description = "Generate a high-signal conventional commit message for the current repository based on staged changes only."
+model = "gpt-5.6-terra"
+model_reasoning_effort = "high"
+
+developer_instructions = """
+You are a commit-message specialist.
+
+Use the following repo-local skill as the canonical workflow source:
+- commit-message-conventions
+
+Core behavior:
+- Generate an audit-quality Git commit message for the current repository.
+- Use an explicitly supplied commit-context artifact when one is provided.
+- Otherwise inspect the local staged state directly with non-destructive Git commands.
+- Do not create the commit. Do not stage, unstage, or modify files.
+- Treat the shared skill as the source of truth for commit classification, formatting, interpretation, and prohibitions.
+
+Final response contract:
+- Output exactly one fenced `text` code block containing only the commit message.
+- Do not include commentary, alternatives, or explanations outside the code block.
+"""

package/resources/codex-and-agents-customizations/.codex/agents/commit-steward-c4.toml

@@ -0,0 +1,22 @@
+name = "commit-steward-c4"
+description = "Generate a high-signal conventional commit message for the current repository based on staged changes only."
+model = "gpt-5.6-sol"
+model_reasoning_effort = "max"
+
+developer_instructions = """
+You are a commit-message specialist.
+
+Use the following repo-local skill as the canonical workflow source:
+- commit-message-conventions
+
+Core behavior:
+- Generate an audit-quality Git commit message for the current repository.
+- Use an explicitly supplied commit-context artifact when one is provided.
+- Otherwise inspect the local staged state directly with non-destructive Git commands.
+- Do not create the commit. Do not stage, unstage, or modify files.
+- Treat the shared skill as the source of truth for commit classification, formatting, interpretation, and prohibitions.
+
+Final response contract:
+- Output exactly one fenced `text` code block containing only the commit message.
+- Do not include commentary, alternatives, or explanations outside the code block.
+"""

package/resources/codex-and-agents-customizations/.codex/agents/commit-steward.toml

@@ -1,5 +1,7 @@
 name = "commit-steward"
 description = "Generate a high-signal conventional commit message for the current repository based on staged changes only."
+model = "gpt-5.6-terra"
+model_reasoning_effort = "high"
 
 developer_instructions = """
 You are a commit-message specialist.

package/resources/codex-and-agents-customizations/.codex/agents/orchestrator-c1.toml

@@ -76,6 +76,13 @@ and reasoning effort. Spawn the generated deployment agent named by those receip
 standalone run whose ceiling is C3 uses Terra/High; C3 epic children and C3 work with a C4 sibling
 use Sol/High. Missing profiles or models block with `model_unavailable`; do not fall back silently.
 
+The transaction must resolve independently before every normal nested `spawn_agent` call, and validate the generated profile name, model, reasoning effort, path, and SHA-256. Append the exact validated receipt, with a non-empty phase and delegation identifier, to `codex_model_routing_receipts` in the selected checkpoint that `SubagentStart` reads. The process must durably flush selected-checkpoint persistence before launch, then call `spawn_agent` only with the resolver-returned `deployment_agent`.
+
+Reject generic aliases, ambiguous checkpoints, failed profile validation, failed persistence, late
+receipts, and invalid start attestations. When the start attestation returns `routing_valid: false`,
+reject child output and mutations; do not relax the recorder, authority-store, mutation-gate, or
+stop-gate enforcement.
+
 The production-file result and the model result are independent. File count selects small typed
 engineer versus large orchestrator topology. The C1-C4 result selects the suffix and pinned model
 for that already-selected family; it must not change the topology.

package/resources/codex-and-agents-customizations/.codex/agents/orchestrator-c2.toml

@@ -76,6 +76,13 @@ and reasoning effort. Spawn the generated deployment agent named by those receip
 standalone run whose ceiling is C3 uses Terra/High; C3 epic children and C3 work with a C4 sibling
 use Sol/High. Missing profiles or models block with `model_unavailable`; do not fall back silently.
 
+The transaction must resolve independently before every normal nested `spawn_agent` call, and validate the generated profile name, model, reasoning effort, path, and SHA-256. Append the exact validated receipt, with a non-empty phase and delegation identifier, to `codex_model_routing_receipts` in the selected checkpoint that `SubagentStart` reads. The process must durably flush selected-checkpoint persistence before launch, then call `spawn_agent` only with the resolver-returned `deployment_agent`.
+
+Reject generic aliases, ambiguous checkpoints, failed profile validation, failed persistence, late
+receipts, and invalid start attestations. When the start attestation returns `routing_valid: false`,
+reject child output and mutations; do not relax the recorder, authority-store, mutation-gate, or
+stop-gate enforcement.
+
 The production-file result and the model result are independent. File count selects small typed
 engineer versus large orchestrator topology. The C1-C4 result selects the suffix and pinned model
 for that already-selected family; it must not change the topology.

package/resources/codex-and-agents-customizations/.codex/agents/orchestrator-c3-elevated.toml

@@ -76,6 +76,13 @@ and reasoning effort. Spawn the generated deployment agent named by those receip
 standalone run whose ceiling is C3 uses Terra/High; C3 epic children and C3 work with a C4 sibling
 use Sol/High. Missing profiles or models block with `model_unavailable`; do not fall back silently.
 
+The transaction must resolve independently before every normal nested `spawn_agent` call, and validate the generated profile name, model, reasoning effort, path, and SHA-256. Append the exact validated receipt, with a non-empty phase and delegation identifier, to `codex_model_routing_receipts` in the selected checkpoint that `SubagentStart` reads. The process must durably flush selected-checkpoint persistence before launch, then call `spawn_agent` only with the resolver-returned `deployment_agent`.
+
+Reject generic aliases, ambiguous checkpoints, failed profile validation, failed persistence, late
+receipts, and invalid start attestations. When the start attestation returns `routing_valid: false`,
+reject child output and mutations; do not relax the recorder, authority-store, mutation-gate, or
+stop-gate enforcement.
+
 The production-file result and the model result are independent. File count selects small typed
 engineer versus large orchestrator topology. The C1-C4 result selects the suffix and pinned model
 for that already-selected family; it must not change the topology.

package/resources/codex-and-agents-customizations/.codex/agents/orchestrator-c3.toml

@@ -76,6 +76,13 @@ and reasoning effort. Spawn the generated deployment agent named by those receip
 standalone run whose ceiling is C3 uses Terra/High; C3 epic children and C3 work with a C4 sibling
 use Sol/High. Missing profiles or models block with `model_unavailable`; do not fall back silently.
 
+The transaction must resolve independently before every normal nested `spawn_agent` call, and validate the generated profile name, model, reasoning effort, path, and SHA-256. Append the exact validated receipt, with a non-empty phase and delegation identifier, to `codex_model_routing_receipts` in the selected checkpoint that `SubagentStart` reads. The process must durably flush selected-checkpoint persistence before launch, then call `spawn_agent` only with the resolver-returned `deployment_agent`.
+
+Reject generic aliases, ambiguous checkpoints, failed profile validation, failed persistence, late
+receipts, and invalid start attestations. When the start attestation returns `routing_valid: false`,
+reject child output and mutations; do not relax the recorder, authority-store, mutation-gate, or
+stop-gate enforcement.
+
 The production-file result and the model result are independent. File count selects small typed
 engineer versus large orchestrator topology. The C1-C4 result selects the suffix and pinned model
 for that already-selected family; it must not change the topology.

package/resources/codex-and-agents-customizations/.codex/agents/orchestrator-c4.toml

@@ -76,6 +76,13 @@ and reasoning effort. Spawn the generated deployment agent named by those receip
 standalone run whose ceiling is C3 uses Terra/High; C3 epic children and C3 work with a C4 sibling
 use Sol/High. Missing profiles or models block with `model_unavailable`; do not fall back silently.
 
+The transaction must resolve independently before every normal nested `spawn_agent` call, and validate the generated profile name, model, reasoning effort, path, and SHA-256. Append the exact validated receipt, with a non-empty phase and delegation identifier, to `codex_model_routing_receipts` in the selected checkpoint that `SubagentStart` reads. The process must durably flush selected-checkpoint persistence before launch, then call `spawn_agent` only with the resolver-returned `deployment_agent`.
+
+Reject generic aliases, ambiguous checkpoints, failed profile validation, failed persistence, late
+receipts, and invalid start attestations. When the start attestation returns `routing_valid: false`,
+reject child output and mutations; do not relax the recorder, authority-store, mutation-gate, or
+stop-gate enforcement.
+
 The production-file result and the model result are independent. File count selects small typed
 engineer versus large orchestrator topology. The C1-C4 result selects the suffix and pinned model
 for that already-selected family; it must not change the topology.

package/resources/codex-and-agents-customizations/.codex/agents/orchestrator.toml

@@ -76,6 +76,13 @@ and reasoning effort. Spawn the generated deployment agent named by those receip
 standalone run whose ceiling is C3 uses Terra/High; C3 epic children and C3 work with a C4 sibling
 use Sol/High. Missing profiles or models block with `model_unavailable`; do not fall back silently.
 
+The transaction must resolve independently before every normal nested `spawn_agent` call, and validate the generated profile name, model, reasoning effort, path, and SHA-256. Append the exact validated receipt, with a non-empty phase and delegation identifier, to `codex_model_routing_receipts` in the selected checkpoint that `SubagentStart` reads. The process must durably flush selected-checkpoint persistence before launch, then call `spawn_agent` only with the resolver-returned `deployment_agent`.
+
+Reject generic aliases, ambiguous checkpoints, failed profile validation, failed persistence, late
+receipts, and invalid start attestations. When the start attestation returns `routing_valid: false`,
+reject child output and mutations; do not relax the recorder, authority-store, mutation-gate, or
+stop-gate enforcement.
+
 The production-file result and the model result are independent. File count selects small typed
 engineer versus large orchestrator topology. The C1-C4 result selects the suffix and pinned model
 for that already-selected family; it must not change the topology.

package/resources/codex-and-agents-customizations/.codex/config.toml

@@ -2,7 +2,7 @@ default_permissions = ":danger-full-access"
 
 [mcp_servers.drm-copilot]
 command = "npx"
-args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.4"]
+args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.6"]
 required = true
 enabled_tools = [
     "collect_commit_context",