@danmoisan/drm-copilot-mcp 1.1.5 → 1.1.7

package/out/mcp-server.js

@@ -31365,10 +31365,16 @@ function parseSection3(markdown, heading) {
 function formatDiffPath2(pathText) {
   return pathText !== null ? formatDiffPath(pathText) : "";
 }
-function appendGenerationTimestamp(clock = () => /* @__PURE__ */ new Date()) {
+var GENERATED_CONTEXT_SECTION_TITLE = "Context generated";
+var HEAD_SHA_LABEL = "Head SHA:";
+var UNKNOWN_HEAD_SHA_PLACEHOLDER = "(unknown)";
+function appendGenerationTimestamp(clock = () => /* @__PURE__ */ new Date(), headSha = null) {
   const now = clock();
   const timestamp = formatUtcTimestamp(now);
-  return section("Context generated") + "\n" + timestamp + "\n";
+  const shaText = headSha !== null && headSha !== "" ? headSha : UNKNOWN_HEAD_SHA_PLACEHOLDER;
+  return section(GENERATED_CONTEXT_SECTION_TITLE) + "\n" + timestamp + `
+${HEAD_SHA_LABEL} ${shaText}
+`;
 }
 function formatUtcTimestamp(date3) {
   const year = date3.getUTCFullYear().toString().padStart(4, "0");
@@ -31716,7 +31722,7 @@ function renderVerificationEvidenceSection(fs10, resolvedRoot, featureDocs) {
   }
   return lines.join("\n");
 }
-function buildSummaryText(collected, fs10, appendixPath) {
+function buildSummaryText(collected, fs10, appendixPath, generatedSection) {
   const ctx = collected.contextResult;
   const ghStatusText = resolveGhStatusText(collected);
   const intentBlock = [
@@ -31727,6 +31733,7 @@ function buildSummaryText(collected, fs10, appendixPath) {
     "Author-asserted autoclose issues:"
   ].join("\n");
   const summarySections = [
+    generatedSection,
     section("GitHub CLI status"),
     ghStatusText,
     intentBlock,
@@ -31804,7 +31811,7 @@ function buildSummaryText(collected, fs10, appendixPath) {
   }
   return summaryText;
 }
-function buildAppendixText(collected, clock) {
+function buildAppendixText(collected, generatedSection) {
   const featureBlock = collected.featureDocs.map((doc) => doc.excerpt).join("\n");
   const issueSections = collected.issueDetails.map(
     (detail) => issueAppendix(detail)
@@ -31813,7 +31820,7 @@ function buildAppendixText(collected, clock) {
     (detail) => prAppendix(detail)
   );
   const appendixParts = [
-    appendGenerationTimestamp(clock),
+    generatedSection,
     collected.contextResult.text,
     "",
     section("Issue details"),
@@ -31846,17 +31853,23 @@ function writeOutput(fs10, text, outPath, append2) {
 function collectAndWrite(options) {
   const clock = options.clock ?? (() => /* @__PURE__ */ new Date());
   const collected = collectPrContext(options);
+  const generatedSection = appendGenerationTimestamp(
+    clock,
+    collected.contextResult.headSha
+  );
   const summaryText = buildSummaryText(
     collected,
     options.fs,
-    options.appendixOut
+    options.appendixOut,
+    generatedSection
   );
-  const appendixText = buildAppendixText(collected, clock);
+  const appendixText = buildAppendixText(collected, generatedSection);
   writeOutput(options.fs, summaryText, options.out, options.append);
   writeOutput(options.fs, appendixText, options.appendixOut, options.append);
   const log = options.log ?? (() => void 0);
   log(`Wrote context summary to: ${options.out}`);
   log(`Wrote context appendix to: ${options.appendixOut}`);
+  return { summaryText, appendixText };
 }
 function resolveGhStatusText(collected) {
   let ghStatusText = collected.ghStatusOverride || collected.ghStatusMessage || "GitHub CLI authenticated.";
@@ -31928,26 +31941,48 @@ function parentDir(path11) {
 // ../../extensions/drm-copilot/src/lib/pr-context/pr-context-service-call.ts
 var SUMMARY_OUT = "artifacts/pr_context.summary.txt";
 var APPENDIX_OUT = "artifacts/pr_context.appendix.txt";
+function verifyWrittenArtifact(fileSystem, artifactPath, expected) {
+  let actual;
+  try {
+    actual = fileSystem.readTextFile(artifactPath);
+  } catch (error2) {
+    const detail = error2 instanceof Error ? error2.message : String(error2);
+    throw new Error(
+      `Failed to verify PR context artifact '${artifactPath}': the file could not be read back after writing (${detail}).`,
+      { cause: error2 }
+    );
+  }
+  if (actual !== expected) {
+    throw new Error(
+      `Failed to verify PR context artifact '${artifactPath}': the content read back is not the content this invocation rendered (expected ${String(expected.length)} characters, read back ${String(actual.length)}).`
+    );
+  }
+}
 function collectPrContextServiceCall(input) {
-  collectAndWrite({
+  const summaryOut = normalizeGeneratedPath(
+    (0, import_node_path.join)(input.workspaceRoot, SUMMARY_OUT)
+  );
+  const appendixOut = normalizeGeneratedPath(
+    (0, import_node_path.join)(input.workspaceRoot, APPENDIX_OUT)
+  );
+  const rendered = collectAndWrite({
     base: input.base,
     repoRoot: input.workspaceRoot,
-    out: SUMMARY_OUT,
-    appendixOut: APPENDIX_OUT,
+    out: summaryOut,
+    appendixOut,
     append: false,
     includeUntracked: true,
     fs: input.fileSystem,
     runner: input.runner,
     ...input.log === void 0 ? {} : { log: input.log }
   });
+  verifyWrittenArtifact(input.fileSystem, summaryOut, rendered.summaryText);
+  verifyWrittenArtifact(input.fileSystem, appendixOut, rendered.appendixText);
   return {
     tool: "collect_pr_context",
     workspaceRoot: input.workspaceRoot,
     summary: `Collected PR context against base '${input.base}'.`,
-    artifacts: [
-      normalizeGeneratedPath((0, import_node_path.join)(input.workspaceRoot, SUMMARY_OUT)),
-      normalizeGeneratedPath((0, import_node_path.join)(input.workspaceRoot, APPENDIX_OUT))
-    ]
+    artifacts: [summaryOut, appendixOut]
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danmoisan/drm-copilot-mcp",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Stdio MCP server exposing drm-copilot repo-automation tools.",
   "license": "MIT",
   "type": "commonjs",

package/resources/claude-customizations/.claude/agents/atomic-planner.md

@@ -57,6 +57,8 @@ Generate plans using the atomic plan contract defined in the `atomic-plan-contra
 
 ## Preflight Validation
 
+Before handing the plan to executor preflight, return the exact bounded line record defined in `atomic-plan-contract`, starting with `PLANNER-INTERNAL-REVIEW: PASS` and ending with the required `PREFLIGHT:` signal. The bounded record must include exactly one passing `CITATION-TO-TREE`, `AC-TRACEABILITY`, and `SCOPE-BOUNDARY` declaration; one or more current-tree `CITATION: <repository-relative path> | <locator>` records; one complete unique `AC-INVENTORY:`; one complete `AC-MAPPING: <ID> | IMPLEMENTATION: <identifier> | TESTS: <identifier> | EVIDENCE: <identifier>` for every and only inventory ID; and exactly one `UNRESOLVED-GAPS: NONE`. A missing, duplicate, malformed, failed, blocked, or out-of-bounds record declaration requires `SELF-REVIEW: BLOCKED` and stops handoff.
+
 Return the finalized plan for validation-only preflight through `atomic-executor` and preserve the same target file path across revision loops. Do not claim nested worker delegation from within planner execution.
 
 ## Output

package/resources/claude-customizations/.claude/agents/prd-feature.md

@@ -16,6 +16,8 @@ hooks:
       hooks:
         - type: command
           command: pwsh -NoProfile -File .claude/hooks/validate-required-artifact-output.ps1 -AgentName prd-feature -RequiredArtifact 'spec-path|^docs/features/active/.+/spec\.md$|feature spec artifact' -RequiredArtifact 'user-story-path|^docs/features/active/.+/user-story\.md$|feature user story artifact'
+        - type: command
+          command: pwsh -NoProfile -File .claude/hooks/validate-prd-feature-output.ps1
 ---
 
 # PRD Feature Agent
@@ -27,12 +29,15 @@ Produce feature-document outputs for the active feature folder.
 - `docs/features/active/<feature>/spec.md`
 - `docs/features/active/<feature>/user-story.md`
 
+When an approved `spec.md` acceptance criterion contains a numeric count, enumeration, or population, require the supplied research record to include complete `## Numeric Derivation Evidence`: `Complete Family`, `Exhaustive Search Scope`, `Inclusion Rules`, `Exclusion Rules`, `Primary Search Strategy or Query Expression`, `Primary Member Set`, `Primary Count`, `Cross-check Search Strategy or Query Expression`, `Cross-check Member Set`, `Cross-check Count`, and `Member-set Comparison`. The two derivations must be non-empty, independently constructed, use distinct search strategies or query expressions, independently enumerate member sets, and explicitly compare those sets. The exhaustive scope must cover the complete family, including all relevant overloads and members. Omit the numeric assertion when the record is missing, repeated, incomplete, non-exhaustive, narrow, or disagrees; equal totals, distinct query text, or equal member sets alone are insufficient.
+
 ## Output Reporting
 
 Report the final artifact paths as:
 
 - `spec-path: docs/features/active/<feature>/spec.md`
 - `user-story-path: docs/features/active/<feature>/user-story.md`
+- `research-path: docs/features/active/<feature>/research/<timestamp>-<short-name>-research.md` when numeric acceptance criteria are present
 
 ## Evidence Location Invariant
 

package/resources/claude-customizations/.claude/agents/task-researcher.md

@@ -64,6 +64,8 @@ The orchestrator resolves which root to use from whether an active feature folde
 ### 4. Requirements Mapping
 
 - Map acceptance criteria into a concrete design with proposed state model, transitions, and required file changes.
+- Before a numeric count, enumeration, or population can be proposed for an approved `spec.md` acceptance criterion, add a complete `## Numeric Derivation Evidence` section. For each numeric claim, record `Complete Family`, `Exhaustive Search Scope`, `Inclusion Rules`, `Exclusion Rules`, `Primary Search Strategy or Query Expression`, `Primary Member Set`, `Primary Count`, `Cross-check Search Strategy or Query Expression`, `Cross-check Member Set`, `Cross-check Count`, and `Member-set Comparison`.
+- The primary and cross-check records must both be non-empty, independently enumerate their member sets, and name distinct search strategies or query expressions. The exhaustive scope must cover the complete family, including every relevant overload or member; a single grep or query that matches only one named pattern in the declared family is insufficient even if it yields the same count. Explicitly compare the normalized primary and cross-check member sets before proposing the numeric assertion. Withhold the assertion if either record is missing, incomplete, duplicated, non-exhaustive, narrow, or disagrees.
 
 ### 5. Testing Implications
 
@@ -75,6 +77,7 @@ The orchestrator resolves which root to use from whether an active feature folde
 - Ground all findings in verified evidence.
 - Keep discussion of non-selected approaches brief.
 - Do not claim nested worker delegation.
+- Do not present a numeric `spec.md` acceptance criterion when the required numeric derivation evidence is absent, incomplete, or has disagreeing counts.
 
 ## Evidence Location Invariant
 

package/resources/claude-customizations/.claude/hooks/enforce-epic-worktree-removal-gate.ps1

@@ -4,14 +4,51 @@
 
 .DESCRIPTION
     Invoked by the Claude Code PreToolUse hook on the "Bash" matcher before any Bash
-    command runs. Regex-matches git worktree remove against the envelope's tool_input.command,
-    extracts the target worktree path argument, reads
-    artifacts/orchestration/epic-orchestrator-state.json, and finds the features[] record
-    whose worktree_path matches. Allows removal only when that record's merge_status is
-    merged or worktree_removed. Denies with reason EPIC_WORKTREE_REMOVAL_BLOCKED when the
-    checkpoint is unreadable, no matching record exists, or merge_status is anything else -
-    fail-closed, following the enforce-orchestration-preimplementation-gate.ps1 precedent of
-    treating an unreadable/no-match checkpoint as deny.
+    command runs. Regex-matches git worktree remove against the envelope's
+    tool_input.command, extracts the target worktree path argument, and allows the
+    removal only when one of two checkpoint-only conditions holds. The branches are
+    evaluated in this order and are ORed, not ANDed: the first that authorizes wins and
+    the second is not consulted.
+
+      1. Epic path: artifacts/orchestration/epic-orchestrator-state.json carries a
+         features[] record whose worktree_path matches the removal target and whose
+         merge_status is merged or worktree_removed.
+      2. Parallel path: artifacts/orchestration/parallel-orchestrator-state.json has
+         route_id == "parallel" and carries an items[] entry whose worktree_path matches
+         the removal target and whose merge_status is merged or worktree_removed.
+
+    Otherwise the command is denied with reason EPIC_WORKTREE_REMOVAL_BLOCKED. The gate
+    is fail-closed in every failure mode: neither checkpoint present, either checkpoint
+    unparseable, route_id absent or not "parallel", no matching worktree_path, a matched
+    record whose merge_status is not in the allowed set, or a matched record carrying no
+    merge_status key. The cascade is a disjunction of two positive predicates; no
+    negative path returns an allow. An envelope-level anomaly is checked first and denies
+    before either checkpoint is read.
+
+    Both branches key on the worktree PATH because the command names a path, and both
+    normalize separators and trim a trailing slash on each side of the comparison, so
+    Windows- and POSIX-style paths compare equal. Path is also why the two branches are
+    mutually exclusive in practice: an epic run and a parallel run allocate worktrees
+    under distinct per-run, per-item paths, so a path recorded in one checkpoint is not a
+    path recorded in the other, and adding branch 2 cannot widen what branch 1 authorizes.
+    The authorization is a property of the path rather than of the caller, and the safety
+    property this gate protects - do not destroy unmerged work - is likewise a property of
+    the path's recorded merge state.
+
+    Accepted residual: artifacts/ is gitignored, so the parallel checkpoint persists after
+    a run ends and a stale document remains readable here. For a stale document to
+    authorize a removal it should not, a worktree would have to exist at a path
+    byte-identical, after normalization, to one it records with merge_status merged or
+    worktree_removed. Worktree paths carry a session or timestamp component, so a
+    collision is implausible, and where the recorded status is worktree_removed the path
+    was already deleted. This is a documented accepted trade, not an unexamined gap; the
+    route_id check does not reduce it, because a stale parallel checkpoint legitimately
+    declares that route.
+
+    The sibling gate enforce-parallel-worktree-removal-gate.ps1 fires on the same command
+    and owns its own reason prefix. PreToolUse denials are conjunctive, so both gates must
+    allow for a removal to proceed; this gate keeps the EPIC_WORKTREE_REMOVAL_BLOCKED
+    prefix for both of its branches so transcript attribution stays unambiguous.
 
 .NOTES
     Compatible with PowerShell 7+. No external module dependencies. Filesystem reads go
@@ -24,6 +61,7 @@ param()
 
 Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
 $script:EpicCheckpointPath = 'artifacts/orchestration/epic-orchestrator-state.json'
+$script:ParallelCheckpointPath = 'artifacts/orchestration/parallel-orchestrator-state.json'
 $script:AllowedMergeStatuses = @('merged', 'worktree_removed')
 
 function Get-EpicWorktreeGateCheckpointContent {
@@ -44,6 +82,52 @@ function Get-EpicWorktreeGateCheckpointContent {
     return (Get-Content -LiteralPath $script:EpicCheckpointPath -Raw)
 }
 
+function Get-EpicWorktreeGateParallelCheckpointContent {
+    <#
+    .SYNOPSIS
+        Read the raw JSON text of the parallel-orchestrator checkpoint. Tests mock
+        this function (read seam).
+    .OUTPUTS
+        System.String or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param()
+
+    if (-not (Test-Path -LiteralPath $script:ParallelCheckpointPath -PathType Leaf)) {
+        return $null
+    }
+    return (Get-Content -LiteralPath $script:ParallelCheckpointPath -Raw)
+}
+
+function ConvertFrom-EpicWorktreeGateJson {
+    <#
+    .SYNOPSIS
+        Parse checkpoint JSON text, returning $null on unreadable/invalid content.
+    .DESCRIPTION
+        Shared by both authorization branches so the two checkpoints are parsed by
+        one implementation rather than by duplicated inline logic.
+    .PARAMETER Raw
+        Raw checkpoint text, or $null when the file does not exist.
+    .OUTPUTS
+        System.Object or $null
+    #>
+    [CmdletBinding()]
+    param(
+        [AllowNull()]
+        [string] $Raw
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Raw)) {
+        return $null
+    }
+    try {
+        return ($Raw | ConvertFrom-Json -ErrorAction Stop)
+    } catch {
+        return $null
+    }
+}
+
 function Get-EpicWorktreeRemovalCommandPath {
     <#
     .SYNOPSIS
@@ -138,6 +222,70 @@ function Test-EpicWorktreeRemovalAllowed {
     return $script:AllowedMergeStatuses -contains ([string]$FeatureRecord.merge_status)
 }
 
+function Test-ParallelCheckpointAllowsWorktreeRemoval {
+    <#
+    .SYNOPSIS
+        Decision logic for the parallel-orchestrator checkpoint path (branch 2).
+    .DESCRIPTION
+        Allows only when the checkpoint declares the parallel route identity and
+        carries an items[] entry whose worktree_path matches the removal target and
+        whose merge_status is in the allowed set. Every other shape returns $false,
+        so the branch is a positive predicate with no negative path to an allow.
+    .PARAMETER Checkpoint
+        Parsed parallel-orchestrator checkpoint, or $null when absent/unreadable.
+    .PARAMETER WorktreePath
+        The target worktree path extracted from the command text.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()]
+        $Checkpoint,
+
+        [AllowNull()]
+        [string] $WorktreePath
+    )
+
+    if ($null -eq $Checkpoint -or [string]::IsNullOrWhiteSpace($WorktreePath)) {
+        return $false
+    }
+    $props = @($Checkpoint.PSObject.Properties.Name)
+    # Route identity is orchestrator invariant 2, so a document at the parallel path
+    # that does not declare it is malformed by the rule's own definition and inert here.
+    if ($props -notcontains 'route_id' -or ([string]$Checkpoint.route_id) -ne 'parallel') {
+        return $false
+    }
+    if ($props -notcontains 'items' -or $null -eq $Checkpoint.items) {
+        return $false
+    }
+
+    $normalizedTarget = ($WorktreePath -replace '\\', '/').TrimEnd('/')
+
+    # Scan every recorded item for a worktree_path that matches the removal target;
+    # path separators are normalized exactly as the epic branch normalizes them.
+    foreach ($item in @($Checkpoint.items)) {
+        if ($null -eq $item) {
+            continue
+        }
+        $itemProps = @($item.PSObject.Properties.Name)
+        if ($itemProps -notcontains 'worktree_path') {
+            continue
+        }
+        $normalizedItemPath = (([string]$item.worktree_path) -replace '\\', '/').TrimEnd('/')
+        if ($normalizedItemPath -ne $normalizedTarget) {
+            continue
+        }
+        if ($itemProps -notcontains 'merge_status') {
+            return $false
+        }
+        return $script:AllowedMergeStatuses -contains ([string]$item.merge_status)
+    }
+
+    return $false
+}
+
 function Get-EpicWorktreeGateAllowDecision {
     [CmdletBinding()]
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
@@ -202,22 +350,19 @@ function Invoke-EpicWorktreeRemovalGateDecision {
 
     $worktreePath = Get-EpicWorktreeRemovalCommandPath -CommandText $commandText
 
-    $checkpointRaw = Get-EpicWorktreeGateCheckpointContent
-    $checkpoint = $null
-    if (-not [string]::IsNullOrWhiteSpace($checkpointRaw)) {
-        try {
-            $checkpoint = $checkpointRaw | ConvertFrom-Json -ErrorAction Stop
-        } catch {
-            $checkpoint = $null
-        }
-    }
+    $checkpoint = ConvertFrom-EpicWorktreeGateJson -Raw (Get-EpicWorktreeGateCheckpointContent)
 
     $featureRecord = Find-EpicWorktreeFeatureRecord -Checkpoint $checkpoint -WorktreePath $worktreePath
     if (Test-EpicWorktreeRemovalAllowed -FeatureRecord $featureRecord) {
         return Get-EpicWorktreeGateAllowDecision
     }
 
-    return Get-EpicWorktreeGateBlockDecision -Reason "EPIC_WORKTREE_REMOVAL_BLOCKED: git worktree remove for '$worktreePath' requires a matching epic checkpoint features[] record with merge_status in {merged, worktree_removed}. The checkpoint was unreadable, no matching record was found, or merge_status was not yet safe for removal."
+    $parallelCheckpoint = ConvertFrom-EpicWorktreeGateJson -Raw (Get-EpicWorktreeGateParallelCheckpointContent)
+    if (Test-ParallelCheckpointAllowsWorktreeRemoval -Checkpoint $parallelCheckpoint -WorktreePath $worktreePath) {
+        return Get-EpicWorktreeGateAllowDecision
+    }
+
+    return Get-EpicWorktreeGateBlockDecision -Reason "EPIC_WORKTREE_REMOVAL_BLOCKED: git worktree remove for '$worktreePath' requires either an epic checkpoint features[] record with merge_status in {merged, worktree_removed}, or a parallel-orchestrator checkpoint with route_id == ""parallel"" whose matching items[] record (matched by worktree_path) has merge_status in {merged, worktree_removed}. No checkpoint authorized this removal."
 }
 
 function Invoke-EpicWorktreeRemovalGateEntryPoint {

package/resources/claude-customizations/.claude/hooks/validate-planner-output.ps1

@@ -110,6 +110,123 @@ function Test-HasPreflightSignal {
     )
 }
 
+function Get-PlannerInternalReviewValidation {
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param([Parameter(Mandatory = $true)][string] $AgentOutput)
+
+    $lines = @($AgentOutput -split "`r?`n")
+    $labelPattern = '^\s*(?:PLANNER-INTERNAL-REVIEW|CITATION-TO-TREE|AC-TRACEABILITY|SCOPE-BOUNDARY|CITATION|AC-INVENTORY|AC-MAPPING|UNRESOLVED-GAPS|PREFLIGHT)\s*:'
+    $headerPattern = '^\s*PLANNER-INTERNAL-REVIEW\s*:\s*(?<Value>.*?)\s*$'
+    $preflightPattern = '^\s*PREFLIGHT\s*:\s*(?:ALL CLEAR|REVISIONS REQUIRED)\s*$'
+    $labelIndexes = [System.Collections.Generic.List[int]]::new()
+    $headerIndexes = [System.Collections.Generic.List[int]]::new()
+    $preflightIndexes = [System.Collections.Generic.List[int]]::new()
+
+    for ($index = 0; $index -lt $lines.Count; $index++) {
+        if ($lines[$index] -match $labelPattern) {
+            $labelIndexes.Add($index)
+        }
+        if ($lines[$index] -match $headerPattern) {
+            $headerIndexes.Add($index)
+        }
+        if ($lines[$index] -match $preflightPattern) {
+            $preflightIndexes.Add($index)
+        }
+    }
+
+    if ($headerIndexes.Count -ne 1) {
+        return @{ Ok = $false; Message = 'planner internal review must contain exactly one `PLANNER-INTERNAL-REVIEW:` declaration.' }
+    }
+
+    $headerIndex = $headerIndexes[0]
+    $headerMatch = [regex]::Match($lines[$headerIndex], $headerPattern)
+    if ($headerMatch.Groups['Value'].Value.Trim() -ne 'PASS') {
+        return @{ Ok = $false; Message = 'planner internal review header must be exactly `PLANNER-INTERNAL-REVIEW: PASS`.' }
+    }
+
+    $preflightAfterHeader = @($preflightIndexes | Where-Object { $_ -gt $headerIndex })
+    if ($preflightAfterHeader.Count -ne 1) {
+        return @{ Ok = $false; Message = 'planner internal review must terminate at exactly one required `PREFLIGHT:` signal after its header.' }
+    }
+
+    $preflightIndex = $preflightAfterHeader[0]
+    foreach ($labelIndex in $labelIndexes) {
+        if ($labelIndex -lt $headerIndex -or $labelIndex -gt $preflightIndex) {
+            return @{ Ok = $false; Message = 'planner internal review declarations must not occur outside the bounded record.' }
+        }
+    }
+
+    $recordLines = @($lines[$headerIndex..$preflightIndex])
+    $requiredDeclarations = @('CITATION-TO-TREE', 'AC-TRACEABILITY', 'SCOPE-BOUNDARY')
+    foreach ($declaration in $requiredDeclarations) {
+        $declarationMatches = @($recordLines | Where-Object { $_ -match "^\s*$declaration\s*:" })
+        if ($declarationMatches.Count -ne 1) {
+            return @{ Ok = $false; Message = "planner internal review must contain exactly one `$declaration: PASS` declaration." }
+        }
+        if ($declarationMatches[0] -notmatch "^\s*$declaration\s*:\s*PASS\s*$") {
+            return @{ Ok = $false; Message = "planner internal review declaration `$declaration must be exactly PASS." }
+        }
+    }
+
+    $citationLines = @($recordLines | Where-Object { $_ -match '^\s*CITATION\s*:' })
+    if ($citationLines.Count -eq 0) {
+        return @{ Ok = $false; Message = 'planner internal review must contain at least one `CITATION:` record.' }
+    }
+    foreach ($citationLine in $citationLines) {
+        $citation = [regex]::Match($citationLine, '^\s*CITATION\s*:\s*(?<Path>[^|\s]+)\s*\|\s*(?<Locator>.+?\S)\s*$')
+        if (-not $citation.Success -or $citation.Groups['Path'].Value -notmatch '^(?![A-Za-z]:)(?!/)(?!\\)(?:\.?[^/\\|\s]+)(?:/[^/\\|\s]+)+$') {
+            return @{ Ok = $false; Message = 'planner internal review citations require a repository-relative path and nonblank locator.' }
+        }
+    }
+
+    $inventoryLines = @($recordLines | Where-Object { $_ -match '^\s*AC-INVENTORY\s*:' })
+    if ($inventoryLines.Count -ne 1) {
+        return @{ Ok = $false; Message = 'planner internal review must contain exactly one nonblank `AC-INVENTORY:` declaration.' }
+    }
+    $inventoryValue = ($inventoryLines[0] -replace '^\s*AC-INVENTORY\s*:\s*', '').Trim()
+    if ([string]::IsNullOrWhiteSpace($inventoryValue)) {
+        return @{ Ok = $false; Message = 'planner internal review `AC-INVENTORY:` must contain nonblank unique IDs.' }
+    }
+    $inventoryIds = @($inventoryValue -split ',' | ForEach-Object { $_.Trim() })
+    if ((@($inventoryIds | Where-Object { [string]::IsNullOrWhiteSpace($_) }).Count -gt 0) -or
+        (@($inventoryIds | Select-Object -Unique).Count -ne $inventoryIds.Count)) {
+        return @{ Ok = $false; Message = 'planner internal review `AC-INVENTORY:` must contain nonblank unique IDs.' }
+    }
+
+    $mappingLines = @($recordLines | Where-Object { $_ -match '^\s*AC-MAPPING\s*:' })
+    if ($mappingLines.Count -eq 0) {
+        return @{ Ok = $false; Message = 'planner internal review must contain one `AC-MAPPING:` record for every inventory ID.' }
+    }
+    $mappingIds = [System.Collections.Generic.List[string]]::new()
+    foreach ($mappingLine in $mappingLines) {
+        $mapping = [regex]::Match($mappingLine, '^\s*AC-MAPPING\s*:\s*(?<Id>[^|]*?)\s*\|\s*IMPLEMENTATION\s*:\s*(?<Implementation>[^|]*?)\s*\|\s*TESTS\s*:\s*(?<Tests>[^|]*?)\s*\|\s*EVIDENCE\s*:\s*(?<Evidence>.*?)\s*$')
+        if (-not $mapping.Success -or
+            [string]::IsNullOrWhiteSpace($mapping.Groups['Id'].Value) -or
+            [string]::IsNullOrWhiteSpace($mapping.Groups['Implementation'].Value) -or
+            [string]::IsNullOrWhiteSpace($mapping.Groups['Tests'].Value) -or
+            [string]::IsNullOrWhiteSpace($mapping.Groups['Evidence'].Value)) {
+            return @{ Ok = $false; Message = 'planner internal review `AC-MAPPING:` requires nonblank ID, IMPLEMENTATION, TESTS, and EVIDENCE fields.' }
+        }
+        $mappingIds.Add($mapping.Groups['Id'].Value.Trim())
+    }
+    if (@($mappingIds | Select-Object -Unique).Count -ne $mappingIds.Count) {
+        return @{ Ok = $false; Message = 'planner internal review `AC-MAPPING:` identifiers must be unique.' }
+    }
+    if ($inventoryIds.Count -ne $mappingIds.Count -or
+        (@($inventoryIds | Where-Object { $_ -notin $mappingIds }).Count -gt 0) -or
+        (@($mappingIds | Where-Object { $_ -notin $inventoryIds }).Count -gt 0)) {
+        return @{ Ok = $false; Message = 'planner internal review AC inventory and mapping identifiers must match exactly.' }
+    }
+
+    $gapLines = @($recordLines | Where-Object { $_ -match '^\s*UNRESOLVED-GAPS\s*:' })
+    if ($gapLines.Count -ne 1 -or $gapLines[0] -notmatch '^\s*UNRESOLVED-GAPS\s*:\s*NONE\s*$') {
+        return @{ Ok = $false; Message = 'planner internal review must contain exactly one `UNRESOLVED-GAPS: NONE` declaration.' }
+    }
+
+    return @{ Ok = $true; Message = $null }
+}
+
 function Get-PlanStructureValidationReport {
     [CmdletBinding()]
     [OutputType([string[]])]
@@ -272,6 +389,11 @@ function Invoke-PlannerOutputValidation {
         return @{ Ok = $false; Message = $message }
     }
 
+    $review = Get-PlannerInternalReviewValidation -AgentOutput $agentOutput
+    if (-not $review.Ok) {
+        return @{ Ok = $false; Message = "atomic-planner hook: $($review.Message)" }
+    }
+
     return @{ Ok = $true; Message = $null }
 }
 

package/resources/claude-customizations/.claude/hooks/validate-prd-feature-output.ps1

@@ -0,0 +1,91 @@
+<#
+.SYNOPSIS
+    Validates numeric acceptance criteria produced by the prd-feature worker.
+#>
+
+[CmdletBinding()]
+param()
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+function Get-ArtifactPathFromOutput {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory = $true)][string] $Output, [Parameter(Mandatory = $true)][string] $Label)
+
+    $match = [regex]::Match($Output, "(?im)^\s*$([regex]::Escape($Label))\s*:\s*(?<path>\S+)")
+    if ($match.Success) { return $match.Groups['path'].Value }
+    return $null
+}
+
+function Test-NumericDerivationEvidence {
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param([Parameter(Mandatory = $true)][AllowEmptyString()][string] $Content)
+
+    $section = [regex]::Match($Content, '(?ims)^##\s+Numeric\s+Derivation\s+Evidence\s*$.*?(?=^##\s|\z)')
+    if (-not $section.Success) { return @{ Ok = $false; Message = 'prd-feature hook: numeric criterion requires ## Numeric Derivation Evidence.' } }
+    $requiredLabels = @(
+        'Complete Family', 'Exhaustive Search Scope', 'Inclusion Rules', 'Exclusion Rules',
+        'Primary Search Strategy or Query Expression', 'Primary Member Set', 'Primary Count',
+        'Cross-check Search Strategy or Query Expression', 'Cross-check Member Set', 'Cross-check Count',
+        'Member-set Comparison'
+    )
+    $values = @{}
+    foreach ($label in $requiredLabels) {
+        $match = [regex]::Match($section.Value, "(?im)^[\t ]*[-*]?[\t ]*$([regex]::Escape($label))[\t ]*:[\t ]*(?<value>\S(?:.*\S)?)[\t ]*$")
+        if (-not $match.Success) { return @{ Ok = $false; Message = "prd-feature hook: numeric derivation evidence is missing $label." } }
+        $values[$label] = $match.Groups['value'].Value.Trim()
+    }
+    if ($values['Exhaustive Search Scope'] -notmatch '(?i)\b(entire|all|complete)\b.*\b(repository|repo|source tree|tree)\b') { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation evidence does not declare an exhaustive repository search scope.' } }
+    $primaryStrategy = $values['Primary Search Strategy or Query Expression']
+    $crossCheckStrategy = $values['Cross-check Search Strategy or Query Expression']
+    if ($primaryStrategy -match '(?i)\b(single|narrow|named[- ]?pattern)\b' -or $crossCheckStrategy -match '(?i)\b(single|narrow|named[- ]?pattern)\b') { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation evidence uses a narrow named-pattern search.' } }
+    if ([regex]::Replace($primaryStrategy, '\s+', '').ToLowerInvariant() -eq [regex]::Replace($crossCheckStrategy, '\s+', '').ToLowerInvariant()) { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation cross-check repeats the primary search strategy or query expression.' } }
+    $familyMembers = @($values['Complete Family'].Split(',') | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    foreach ($familyMember in $familyMembers) {
+        if ($primaryStrategy -notmatch [regex]::Escape($familyMember) -or $crossCheckStrategy -notmatch [regex]::Escape($familyMember)) { return @{ Ok = $false; Message = "prd-feature hook: numeric derivation search does not cover complete family member '$familyMember'." } }
+    }
+    if ($values['Primary Count'] -notmatch '^\d+$' -or $values['Cross-check Count'] -notmatch '^\d+$') { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation counts must be numeric.' } }
+    $primaryMembers = @($values['Primary Member Set'].Split(',') | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    $crossCheckMembers = @($values['Cross-check Member Set'].Split(',') | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    if ([int]$values['Primary Count'] -ne $primaryMembers.Count -or [int]$values['Cross-check Count'] -ne $crossCheckMembers.Count) { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation count does not match its independently enumerated member set.' } }
+    $normalizedPrimaryMembers = @($primaryMembers | ForEach-Object { $_.ToLowerInvariant() } | Sort-Object -Unique) -join '|'
+    $normalizedCrossCheckMembers = @($crossCheckMembers | ForEach-Object { $_.ToLowerInvariant() } | Sort-Object -Unique) -join '|'
+    if ($normalizedPrimaryMembers -ne $normalizedCrossCheckMembers) { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation primary and cross-check member sets disagree.' } }
+    if ($values['Member-set Comparison'] -notmatch '(?i)\b(equal|match|identical)\b') { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation evidence is missing an explicit member-set comparison.' } }
+    return @{ Ok = $true; Message = $null }
+}
+
+function Test-SpecNumericCriterion {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory = $true)][AllowEmptyString()][string] $SpecContent)
+
+    $section = [regex]::Match($SpecContent, '(?ims)^##\s+Acceptance\s+Criteria\s*$.*?(?=^##\s|\z)')
+    return $section.Success -and [regex]::IsMatch($section.Value, '(?m)^\s*[-*]\s*\[.\].*\b\d+\b')
+}
+
+function Invoke-PrdFeatureOutputValidation {
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param([string] $RawPayload)
+
+    if ([string]::IsNullOrWhiteSpace($RawPayload)) { return @{ Ok = $false; Message = 'prd-feature hook: CLAUDE_HOOK_INPUT is empty.' } }
+    try { $payload = $RawPayload | ConvertFrom-Json -ErrorAction Stop } catch { return @{ Ok = $false; Message = "prd-feature hook: failed to parse CLAUDE_HOOK_INPUT as JSON: $($_.Exception.Message)" } }
+    $output = if ($null -ne $payload.PSObject.Properties['output']) { $payload.output } else { $null }
+    if ([string]::IsNullOrWhiteSpace($output)) { return @{ Ok = $false; Message = 'prd-feature hook: agent output is empty.' } }
+    $specPath = Get-ArtifactPathFromOutput -Output $output -Label 'spec-path'
+    if ([string]::IsNullOrWhiteSpace($specPath) -or -not (Test-Path -LiteralPath $specPath -PathType Leaf)) { return @{ Ok = $false; Message = 'prd-feature hook: spec-path is required and must exist.' } }
+    $specContent = Get-Content -LiteralPath $specPath -Raw -ErrorAction Stop
+    if (-not (Test-SpecNumericCriterion -SpecContent $specContent)) { return @{ Ok = $true; Message = $null } }
+    $researchPath = Get-ArtifactPathFromOutput -Output $output -Label 'research-path'
+    if ([string]::IsNullOrWhiteSpace($researchPath) -or -not (Test-Path -LiteralPath $researchPath -PathType Leaf)) { return @{ Ok = $false; Message = 'prd-feature hook: numeric acceptance criterion requires an existing research-path.' } }
+    return Test-NumericDerivationEvidence -Content (Get-Content -LiteralPath $researchPath -Raw -ErrorAction Stop)
+}
+
+if ($MyInvocation.InvocationName -eq '.') { return }
+$result = Invoke-PrdFeatureOutputValidation -RawPayload $env:CLAUDE_HOOK_INPUT
+if (-not $result.Ok) { Write-Error $result.Message; exit 1 }
+exit 0