@danmoisan/drm-copilot-mcp 1.1.5 → 1.1.7

package/resources/claude-customizations/.claude/hooks/validate-task-researcher-output.ps1

@@ -161,6 +161,68 @@ function Test-AutomationFeasibilitySection {
     return @{ Ok = $true; Message = $null }
 }
 
+function Test-NumericDerivationEvidence {
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string] $Content
+    )
+
+    $numericClaimPattern = '(?im)^\s*[-*]\s*Numeric\s+spec\.md\s+acceptance\s+criterion:\s*.*\b\d+\b'
+    if (-not [regex]::IsMatch($Content, $numericClaimPattern)) {
+        return @{ Ok = $true; Message = $null }
+    }
+
+    $section = [regex]::Match($Content, '(?ims)^##\s+Numeric\s+Derivation\s+Evidence\s*$.*?(?=^##\s|\z)')
+    if (-not $section.Success) {
+        return @{ Ok = $false; Message = 'task-researcher hook: numeric spec.md acceptance criterion is missing ## Numeric Derivation Evidence.' }
+    }
+
+    $requiredLabels = @(
+        'Complete Family', 'Exhaustive Search Scope', 'Inclusion Rules', 'Exclusion Rules',
+        'Primary Search Strategy or Query Expression', 'Primary Member Set', 'Primary Count',
+        'Cross-check Search Strategy or Query Expression', 'Cross-check Member Set', 'Cross-check Count',
+        'Member-set Comparison'
+    )
+    $values = @{}
+    foreach ($label in $requiredLabels) {
+        $match = [regex]::Match($section.Value, "(?im)^[\t ]*[-*]?[\t ]*$([regex]::Escape($label))[\t ]*:[\t ]*(?<value>\S(?:.*\S)?)[\t ]*$")
+        if (-not $match.Success) { return @{ Ok = $false; Message = "task-researcher hook: numeric derivation evidence is missing $label." } }
+        $values[$label] = $match.Groups['value'].Value.Trim()
+    }
+    if ($values['Exhaustive Search Scope'] -notmatch '(?i)\b(entire|all|complete)\b.*\b(repository|repo|source tree|tree)\b') {
+        return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation evidence does not declare an exhaustive repository search scope.' }
+    }
+    $primaryStrategy = $values['Primary Search Strategy or Query Expression']
+    $crossCheckStrategy = $values['Cross-check Search Strategy or Query Expression']
+    if ($primaryStrategy -match '(?i)\b(single|narrow|named[- ]?pattern)\b' -or $crossCheckStrategy -match '(?i)\b(single|narrow|named[- ]?pattern)\b') {
+        return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation evidence uses a narrow named-pattern search.' }
+    }
+    if ([regex]::Replace($primaryStrategy, '\s+', '').ToLowerInvariant() -eq [regex]::Replace($crossCheckStrategy, '\s+', '').ToLowerInvariant()) {
+        return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation cross-check repeats the primary search strategy or query expression.' }
+    }
+    $familyMembers = @($values['Complete Family'].Split(',') | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    foreach ($familyMember in $familyMembers) {
+        if ($primaryStrategy -notmatch [regex]::Escape($familyMember) -or $crossCheckStrategy -notmatch [regex]::Escape($familyMember)) {
+            return @{ Ok = $false; Message = "task-researcher hook: numeric derivation search does not cover complete family member '$familyMember'." }
+        }
+    }
+    if ($values['Primary Count'] -notmatch '^\d+$' -or $values['Cross-check Count'] -notmatch '^\d+$') { return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation counts must be numeric.' } }
+    $primaryMembers = @($values['Primary Member Set'].Split(',') | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    $crossCheckMembers = @($values['Cross-check Member Set'].Split(',') | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    if ([int]$values['Primary Count'] -ne $primaryMembers.Count -or [int]$values['Cross-check Count'] -ne $crossCheckMembers.Count) {
+        return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation count does not match its independently enumerated member set.' }
+    }
+    $normalizedPrimaryMembers = @($primaryMembers | ForEach-Object { $_.ToLowerInvariant() } | Sort-Object -Unique) -join '|'
+    $normalizedCrossCheckMembers = @($crossCheckMembers | ForEach-Object { $_.ToLowerInvariant() } | Sort-Object -Unique) -join '|'
+    if ($normalizedPrimaryMembers -ne $normalizedCrossCheckMembers) { return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation primary and cross-check member sets disagree.' } }
+    if ($values['Member-set Comparison'] -notmatch '(?i)\b(equal|match|identical)\b') { return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation evidence is missing an explicit member-set comparison.' } }
+
+    return @{ Ok = $true; Message = $null }
+}
+
 function Invoke-TaskResearcherOutputValidation {
     [CmdletBinding()]
     [OutputType([hashtable])]
@@ -209,6 +271,13 @@ function Invoke-TaskResearcherOutputValidation {
         return @{ Ok = $false; Message = $feasibilityResult.Message }
     }
 
+    if (Test-Path -LiteralPath $researchPath -PathType Leaf) {
+        $numericEvidenceResult = Test-NumericDerivationEvidence -Content (Get-Content -LiteralPath $researchPath -Raw -ErrorAction Stop)
+        if (-not $numericEvidenceResult.Ok) {
+            return $numericEvidenceResult
+        }
+    }
+
     return @{ Ok = $true; Message = $null }
 }
 
@@ -223,4 +292,3 @@ if (-not $result.Ok) {
 }
 
 exit 0
-

package/resources/claude-customizations/.claude/lib/blast-radius/BlastRadius.psm1

@@ -428,6 +428,17 @@ function Test-BlastRadiusConflict {
     .OUTPUTS
         System.Collections.Hashtable. Keys conflict (a boolean) and reasons (an
         array of hashtables with keys kind and detail).
+
+        Read the verdict from the conflict key of the returned hashtable.
+        Do not test the returned object itself: the hashtable is
+        unconditionally truthy under PowerShell boolean coercion, so
+        'if ($result)' treats every pair as contending.
+        System.Collections.Hashtable implements IDictionary and ICollection but
+        not IList, and the count-based truthiness rule applies only to IList
+        implementations, so a hashtable falls under the rule for any other
+        non-collection type and is always $true. The Python port agrees with its
+        own verdict; this mirror provably cannot, because PowerShell exposes no
+        hook by which a type can decline or change the conversion.
     #>
     [CmdletBinding()]
     [OutputType([hashtable])]

package/resources/claude-customizations/.claude/lib/requirements/GeneratedDocumentCounters.psm1

@@ -0,0 +1,32 @@
+Set-StrictMode -Version Latest
+
+<#
+.SYNOPSIS
+Counts markdown checkbox items contained by a named heading section.
+#>
+function Get-NamedSectionCheckboxCount {
+    [CmdletBinding()]
+    [OutputType([int])]
+    param(
+        [Parameter(Mandatory = $true)][AllowEmptyString()][string] $Document,
+        [Parameter(Mandatory = $true)][string] $Heading
+    )
+
+    $headingPattern = '^(?<marks>#{1,6})\s+' + [regex]::Escape($Heading) + '\s*$'
+    $inside = $false
+    $level = 0
+    $count = 0
+    foreach ($line in ($Document -split "`r?`n")) {
+        if (-not $inside) {
+            $match = [regex]::Match($line, $headingPattern)
+            if ($match.Success) { $inside = $true; $level = $match.Groups['marks'].Value.Length }
+            continue
+        }
+        $nextHeading = [regex]::Match($line, '^(?<marks>#{1,6})\s+')
+        if ($nextHeading.Success -and $nextHeading.Groups['marks'].Value.Length -le $level) { break }
+        if ($line -match '^\s*[-*]\s+\[[ xX]\]\s+') { $count++ }
+    }
+    return $count
+}
+
+Export-ModuleMember -Function Get-NamedSectionCheckboxCount

package/resources/claude-customizations/.claude/rules/parallel-orchestration.md

@@ -409,3 +409,4 @@ an unclassified key or a key present in only one copy fails loudly and names its
 - Enforcement is therefore Python validator logic, plus the TypeScript parity port, plus this prose file. It is NEVER an imported JSON Schema. No schema file is read at validation time.
 - The `parallel` route entry lives in `config/orchestration-routing.json` with `requires_pr_gate: false` (there is no run-level pull request to gate; each child's own route checkpoint enforces its per-item pull-request gate) and is mirrored byte-for-byte in `extensions/drm-copilot/resources/config/orchestration-routing.json`.
 - The `PreToolUse` merge gate `.claude/hooks/enforce-epic-merge-gate.ps1` carries a parallel allow-branch that authorizes a per-item `gh pr merge --merge` from the parallel-orchestrator checkpoint when `route_id == "parallel"`, the target item's `merge_status == "ci_green"`, and the command's PR number matches that item's `pr_number`; any other case fails closed with `EPIC_MERGE_GATE_BLOCKED`.
+- The `PreToolUse` worktree-removal gate `.claude/hooks/enforce-epic-worktree-removal-gate.ps1` likewise carries a parallel allow-branch that authorizes a per-item worktree removal from the parallel-orchestrator checkpoint when `route_id == "parallel"` and the `items[]` entry whose `worktree_path` matches the normalized removal target has `merge_status` in `{merged, worktree_removed}`; any other case — neither checkpoint present, either checkpoint unparseable, `route_id` absent or not `"parallel"`, no matching `worktree_path`, or a matched entry whose `merge_status` is outside that set or absent — fails closed with `EPIC_WORKTREE_REMOVAL_BLOCKED`. Removal is keyed on the worktree path rather than on `pr_number`, because the command names a path. This gate and the sibling gate `.claude/hooks/enforce-parallel-worktree-removal-gate.ps1`, which owns `PARALLEL_WORKTREE_REMOVAL_BLOCKED`, both fire on the same command, and `PreToolUse` denials are conjunctive, so both must allow for a removal to proceed.

package/resources/claude-customizations/.claude/settings.json

@@ -239,6 +239,15 @@
           }
         ]
       },
+      {
+        "matcher": "prd-feature",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "pwsh -NoProfile -File .claude/hooks/validate-prd-feature-output.ps1"
+          }
+        ]
+      },
       {
         "matcher": "pr-author",
         "hooks": [

package/resources/claude-customizations/.claude/skills/acceptance-criteria-tracking/SKILL.md

@@ -35,6 +35,8 @@ When multiple AC source files exist, track checkboxes in **each** applicable fil
 
 ## AC Identification
 
+For generated-document summaries, call `.claude/lib/requirements/GeneratedDocumentCounters.psm1` and supply `Acceptance Criteria` as the named section. The counter begins after that heading and ends at the next equal-or-shallower heading. Do not use `scripts/dev_tools/plan_progress_report.py`, which counts plan tasks rather than generated requirements criteria.
+
 Acceptance criteria are markdown checkbox items within AC source files.
 
 Deterministic heading rule:

package/resources/claude-customizations/.claude/skills/atomic-plan-contract/SKILL.md

@@ -139,8 +139,26 @@ For command-bearing tasks in approved plans (especially Phase 2 final-QC tasks):
 
 Any regression test task expected to fail must be tagged with `[expect-fail]` and include an auditable evidence artifact per `evidence-and-timestamp-conventions`.
 
+## Planner Adversarial Self-Review (Mandatory)
+
+Before any plan handoff, `atomic-planner` MUST complete one explicit adversarial self-review pass over every fact, assumption, and line or file citation the plan relies on. The pass is required on initial authoring and on every revision-delta round. A revision round is not exempt because it changed only part of the plan: the citations the revision touched describe the tree as it stands after the revision, and no earlier pass observed that state.
+
+Rules:
+
+- **Re-derive every citation in this pass.** Any line, file, test, or assertion that the planner's own edit touched, added, or removed in the current authoring or revision pass MUST be re-derived directly against current repository state in that same pass. The prohibited source is a citation carried forward from an earlier round, including one the planner itself verified in a prior round: that earlier verification observed the tree before the intervening edits, so it is evidence about a superseded state rather than about the state the plan now asserts.
+- **Re-check the sibling region.** The self-review MUST re-check the sibling lines, tests, and assertions that sit in the same file or region as any edited citation. The failure mechanism is sibling invalidation: a fix to one line can invalidate an assumption baked into a sibling line or test that a prior round's citation did not cover, so a pass that verifies only the edited line leaves the invalidated sibling unreported and it surfaces as a defect on a later round.
+
+Declaration requirement. Every plan handoff MUST carry exactly one of these two signal lines, written in the directive-line form already used elsewhere in this contract:
+
+- `SELF-REVIEW: RE-DERIVED THIS PASS` — the adversarial self-review pass completed in this pass. This signal MUST be followed by an enumeration of the citations re-derived in that pass, one entry per citation, each naming the file and the line, test, or identifier that was re-derived. A signal carrying no enumeration is not a completed declaration.
+- `SELF-REVIEW: BLOCKED` — the pass could not be completed. This signal halts the handoff. It does not permit a self-approved plan: the planner reports the blocking reason and waits for the caller rather than proceeding to hand off an unverified plan.
+
 ## Preflight Validation (Planner ↔ Executor)
 
+### Planner Internal Review Record
+
+Before executor preflight, the planner must emit exactly one bounded record between `PLANNER-INTERNAL-REVIEW: PASS` and the existing `PREFLIGHT:` signal. The record requires exactly one passing declaration each for `CITATION-TO-TREE`, `AC-TRACEABILITY`, and `SCOPE-BOUNDARY`; one or more `CITATION: <repository-relative path> | <nonblank locator>` entries; exactly one `AC-INVENTORY:` declaration containing unique nonblank IDs; one `AC-MAPPING: <ID> | IMPLEMENTATION: <nonblank> | TESTS: <nonblank> | EVIDENCE: <nonblank>` for every and only inventory ID; and exactly one `UNRESOLVED-GAPS: NONE`. Missing, blank, duplicate, non-passing, out-of-bounds, or inventory/mapping-disagreeing declarations block handoff. If review cannot pass, emit `SELF-REVIEW: BLOCKED` and do not hand the plan to preflight. `SELF-REVIEW: RE-DERIVED THIS PASS` remains distinct and does not replace executor clearance.
+
 When validating or handing off plans for execution:
 - Use the directive line: `DIRECTIVE: PREFLIGHT VALIDATION ONLY`.
 - Require one of the exact signals:
@@ -149,6 +167,20 @@ When validating or handing off plans for execution:
 - If revisions are required, provide a precise plan delta and repeat validation until all clear.
 - If the required planner ↔ executor handoff cannot be started or completed, stop and report blocked state; do not self-approve the plan.
 
+Review depth and reporting rules:
+
+- **Review the entire plan in one pass.** Under `DIRECTIVE: PREFLIGHT VALIDATION ONLY`, `atomic-executor` MUST continue checking every remaining phase, task, and prose region after finding an initial defect. Stopping at the first defect is prohibited: the unchecked remainder holds defects that the same pass could have reported, and each one that is left unreported becomes an additional round.
+- **Enumerate every defect found.** `PREFLIGHT: REVISIONS REQUIRED` output MUST list every defect found in that pass, not only the first. The failure mechanism is round inflation: a single-defect report causes the next round to rediscover a defect the same pass could have reported, so the round count rises without the review having covered more of the plan.
+- **Check the delta against its own rule.** Before returning either signal, `atomic-executor` MUST check its proposed fix or delta text against every rule the plan enforces, including that delta's own prose against the same violation class it is remediating. Worked example: the delta prose of a tonality-compliance fix must not itself contain the hyperbole or humor that `.claude/rules/tonality.md` prohibits, because a delta that violates the rule it is written to enforce reintroduces the finding it closes.
+- **Two-round target.** The quality bar is a target of at most two preflight rounds per plan. Exhaustive first-pass review is the mechanism that holds the round count to that target: a pass that reports every defect it can find leaves at most a revision round and a confirming round, whereas a pass that reports one defect at a time cannot reach the target however correct each individual report is.
+
+Convergence signal. Every preflight return, whether it carries `PREFLIGHT: ALL CLEAR` or `PREFLIGHT: REVISIONS REQUIRED`, MUST additionally carry exactly one of these two forward-looking lines:
+
+- `CONVERGENCE: NO FURTHER ROUNDS EXPECTED` — the reviewer expects the plan to clear without a further round.
+- `CONVERGENCE: FURTHER ROUNDS LIKELY` — the reviewer expects at least one further round, and states why.
+
+The convergence line is a required signal rather than free prose. It is a second required line accompanying the preflight signal, not a third value of the signal set that the `Require one of the exact signals:` bullet above enumerates: that bullet's two-value set is unchanged, and every return carries one value from it together with one convergence line.
+
 ## Validator Gate (Mandatory)
 
 Before a plan can be treated as approved:

package/resources/claude-customizations/.claude/skills/cleanup-merged-worktrees/SKILL.md

@@ -3,11 +3,23 @@ name: cleanup-merged-worktrees
 description: 'Detect, consolidate, and delete git worktrees/branches that are fully merged into main; use after an epic or feature''s PRs have merged and stale drm-copilot-wt-* branches/worktrees remain, driving the detect -> report -> consolidate -> pr-author handoff -> post-merge deletion workflow.'
 allowed-tools:
   - Read
+  - Grep
+  - Glob
+  - Agent
   - "Bash(bash scripts/bash/cleanup-worktrees.sh *)"
   - "Bash(git fetch *)"
   - "Bash(git merge-base *)"
   - "Bash(git push *)"
   - "Bash(git rev-parse *)"
+  - "Bash(git status *)"
+  - "Bash(git log *)"
+  - "Bash(git show *)"
+  - "Bash(git diff *)"
+  - "Bash(git branch -r*)"
+  - "Bash(git worktree list*)"
+  - "Bash(gh issue view *)"
+  - mcp__drm-copilot__new_potential_bug_entry
+  - mcp__drm-copilot__potential_to_issue
 ---
 
 # Cleanup Merged Worktrees
@@ -35,8 +47,12 @@ and is out of the script's scope.
   which carry unmerged or unique work (`NOT_MERGED`, `HAS_UNIQUE_RESIDUALS`).
 - When stranded documentation/agent-memory commits were appended to a worktree branch
   after its feature content already merged and must be preserved before deletion.
+- When a worktree is reported `BLOCKED-DIRTY`, or its branch is classified `NOT_MERGED`
+  or `HAS_UNIQUE_RESIDUALS`, and the uncommitted or unmerged content it holds must be
+  triaged into disposable versus must-preserve before the worktree can ever be deleted.
 - Do not use this skill to manage remote branches; its scope is local branches and
-  local worktree registrations only.
+  local worktree registrations only, except for the explicitly confirmed origin-branch
+  offer in the Dirty Worktree Triage Procedure's final step.
 
 ## Report Line Contract
 
@@ -99,7 +115,9 @@ The script emits pipe-delimited, `LC_ALL=C`-ordered records, one per line:
    (without force; a dirty worktree is reported via `DIRTY|` lines and skipped), then
    deletes branches with `git branch -D`. The now-merged `documentationandmemories`
    branch and its worktree become `MERGED_CLEAN` instances and are cleaned up by the same
-   mechanics.
+   mechanics. Any worktree left standing afterward — reported `BLOCKED-DIRTY`, or whose
+   branch classified `NOT_MERGED` or `HAS_UNIQUE_RESIDUALS` — is not abandoned; it moves
+   to the Dirty Worktree Triage Procedure below.
 
 ## Nothing to Consolidate (Short Path)
 
@@ -108,6 +126,108 @@ with an empty cherry-pick-candidate list, skip steps 3-5 entirely: proceed direc
 the report to `bash scripts/bash/cleanup-worktrees.sh --apply`. Cleanup completes in a
 single session with no PR.
 
+## Dirty Worktree Triage Procedure
+
+**Trigger.** A worktree reported `ACTION|worktree-remove|<path>|BLOCKED-DIRTY` (with
+accompanying `DIRTY|<path>|<status-porcelain-line>` records), or a branch classified
+`NOT_MERGED` or `HAS_UNIQUE_RESIDUALS`, carries uncommitted or unmerged content the
+script correctly refuses to discard. That refusal is correct and this procedure never
+overrides it — a dirty worktree is never force-removed. This procedure is the systematic
+follow-up: deciding, per worktree, whether that content is disposable or must be
+preserved before the worktree can ever be deleted.
+
+Steps 1-7 are read-only investigation. Run them per worktree, or fan out one
+`Agent(general-purpose)` investigation per worktree (or small batch) concurrently per
+step 8, each returning a `SAFE_TO_DELETE` / `PRESERVE` verdict with justification citing
+specific files or commit SHAs, before step 9 acts on any finding.
+
+1. **Re-verify current state before analyzing.** Worktrees can be actively in use by
+   another concurrent session. Re-run `git status --porcelain` in the worktree and
+   re-check the branch's merge status fresh — do not reuse the original scan's
+   snapshot. If the worktree's `.git`/index/HEAD mtimes show activity in the last few
+   minutes, treat it as possibly live and pause rather than analyze it as abandoned.
+
+2. **Check committed-but-unmerged commits, not only the working tree.** Run
+   `git log main..<branch> --oneline`. Some worktrees carry real commits that never
+   merged, separate from uncommitted working-tree changes. Both need the classification
+   in step 5.
+
+3. **Check for equivalent content already on `main`, by topic, not only by path.** For
+   every dirty, untracked, or unmerged file, check `git show main:<path>` at the same
+   path, and also grep broadly across the relevant shared namespace (for example
+   `.claude/agent-memory/**` for lesson files, `docs/features/**` for feature docs)
+   since the same fact is often re-recorded under a different filename on `main`.
+
+4. **For feature-folder doc snapshots** (`issue.md`, `plan.md`, `spec.md`,
+   `research/*`), check whether the feature is fully closed on `main` — acceptance
+   criteria all checked, code-review/feature-audit/policy-audit artifacts present, an
+   evidence trail present. An earlier draft of an already-closed feature is almost
+   always fully superseded; diff it against the closed feature's final artifacts to
+   confirm rather than assume.
+
+5. **Classify any content that is not obviously superseded** into exactly one of:
+   - `DEAD_ONE_OFF` — real, but tied to an already-executed, closed plan with no reuse
+     elsewhere (check whether the same pattern appears in shared `.claude/skills/**`
+     templates or in other feature plans). Low value; safe to discard even though it is
+     not technically duplicated.
+   - `ALREADY_SOLVED_ELSEWHERE` — the underlying problem it documents is fixed a
+     different way on `main` (check `main`'s current code/config/script, not only its
+     memory files — a memory file can describe a bug that no longer exists).
+   - `STALE_OR_CONTRADICTED` — `main`'s current version of the same lesson has since
+     been corrected to state something different or opposite. This is not merely
+     redundant; it is actively wrong, and discarding is the right call.
+   - `GENUINELY_NEW` / `STILL_RELEVANT` — not found anywhere else, or it corrects
+     something `main` currently gets wrong, or it documents unresolved scope on a
+     still-open issue (verify open/closed with `gh issue view <n>`; never assume). Must
+     be preserved before the worktree is deleted.
+
+6. **Handle non-memory dirty content on its own terms.** Some worktrees carry stale
+   build artifacts (a modified `.csproj`/`packages.config`/`app.config` from a build run
+   in that worktree) rather than documentation. Diff a representative sample against
+   `main` (`git diff main -- <path>`) to characterize the change before deciding it is
+   disposable.
+
+7. **Recognize orphaned non-worktree directories.** A path can still exist on disk
+   under a worktree-tracking folder after `git worktree remove` partially ran or
+   failed, with no `.git` file inside and no entry in `git worktree list`. These are no
+   longer worktrees — flag them for plain filesystem removal, not `git worktree
+   remove`, which will misfire or no-op on them. Filesystem removal of an orphaned
+   directory is a destructive action outside this skill's pre-approved tool surface; it
+   requires explicit user confirmation each time, the same as any other irreversible
+   delete.
+
+8. **Parallelize the triage.** Steps 1-7 are pure read-only investigation. Fan out one
+   `Agent(general-purpose)` investigation per worktree (or a small batch) concurrently,
+   each following steps 1-7 and returning a structured `SAFE_TO_DELETE` / `PRESERVE`
+   verdict with justification. This scales far better than triaging serially.
+
+9. **Route `PRESERVE` findings through the existing consolidation flow** (the
+   `documentationandmemories` branch/PR mechanism in steps 3-4 of the End-to-End
+   Workflow above) before that worktree's dirty content is discarded. If a finding
+   describes unresolved product scope rather than a process lesson, promote it to a
+   real follow-up issue instead of folding it into the docs/memory PR: file it with
+   `mcp__drm-copilot__new_potential_bug_entry` and promote with
+   `mcp__drm-copilot__potential_to_issue` per
+   `.claude/skills/feature-promotion-lifecycle/SKILL.md`. For a `SAFE_TO_DELETE`
+   verdict, discard the content as a distinct, individually confirmed manual action —
+   clear the dirty working tree, or delete a disposable `NOT_MERGED`/
+   `HAS_UNIQUE_RESIDUALS` branch directly. This is never automated: the script's
+   classification ladder and apply-mode allowlist are never changed to accept these
+   states, so a `--apply` run never deletes them on its own, before or after triage. If
+   discarding the working-tree content changes the branch's classification (for example
+   to content-neutral against `main`), a follow-up report/apply pass then picks it up
+   through the normal deterministic path.
+
+10. **After local branch deletion, check origin too.** This skill is local-only by
+    design (see "When to Use This Skill"), which leaves stale branches on the remote for
+    anything already merged. After `--apply` finishes, diff the deleted-local-branch
+    list against `git branch -r` (post-prune) to find remote branches whose local
+    counterpart is gone, and offer to delete the remainder on origin. Because this
+    mutates shared, visible remote state, each deletion requires explicit user
+    confirmation — never delete an origin branch as an automatic consequence of local
+    cleanup, and never rely on this skill's general `Bash(git push *)` allowance to
+    perform it silently.
+
 ## Prohibited Shortcuts
 
 - Never invoke `gh pr create` or `gh pr edit --body*` from this skill or the scripts. PR
@@ -116,10 +236,19 @@ single session with no PR.
 - Never pass a force flag to `git worktree remove`. A dirty worktree blocks deletion and
   is reported for manual handling; it is never force-removed.
 - Never execute `git worktree prune`. Prunable registrations are report-only.
-- Never act on `NOT_MERGED`, `HAS_UNIQUE_RESIDUALS`, or `PROTECTED_CURRENT` candidates;
-  the caller's worktree and branch, and the main worktree, are never mutated.
+- Never act on `NOT_MERGED`, `HAS_UNIQUE_RESIDUALS`, or `PROTECTED_CURRENT` candidates
+  through the script or its apply-mode allowlist; `--apply` never mutates them, and the
+  caller's worktree and branch, and the main worktree, are never mutated under any
+  disposition. The Dirty Worktree Triage Procedure's `SAFE_TO_DELETE` verdict authorizes
+  only a distinct, individually confirmed manual action outside that automated path for
+  `NOT_MERGED`/`HAS_UNIQUE_RESIDUALS` — never a change to the classification ladder
+  itself, and never for `PROTECTED_CURRENT`.
 - Never use commit-message text matching as a classification input, and never
   auto-resolve cherry-pick conflicts.
+- Never delete an origin branch, or run plain filesystem removal on an orphaned
+  worktree-tracking directory, without explicit per-item user confirmation — both are
+  outside this skill's pre-approved tool surface regardless of how the triage verdict
+  came out.
 
 ## Cross-References
 
@@ -130,3 +259,6 @@ single session with no PR.
 - `.claude/rules/shell.md` — the bash toolchain (shfmt/shellcheck/bats/kcov), the
   500-line cap, the no-temp-files test policy, and the `CLEANUP_WT_GIT_BIN` seam
   convention.
+- `.claude/skills/feature-promotion-lifecycle/SKILL.md` — the potential-entry-to-issue
+  promotion path used by the Dirty Worktree Triage Procedure's step 9 for `PRESERVE`
+  findings that describe unresolved product scope.

package/resources/claude-customizations/.claude/skills/fill-feature-docs/SKILL.md

@@ -12,6 +12,8 @@ This direct-use wrapper delegates feature-document work to the `prd-feature` wor
 - Feature folder issue and research context
 - Existing spec and user-story files when present
 
+For a numeric `spec.md` acceptance criterion, the research context must contain complete `## Numeric Derivation Evidence` with `Complete Family`, `Exhaustive Search Scope`, `Inclusion Rules`, `Exclusion Rules`, `Primary Search Strategy or Query Expression`, `Primary Member Set`, `Primary Count`, `Cross-check Search Strategy or Query Expression`, `Cross-check Member Set`, `Cross-check Count`, and `Member-set Comparison`. The two derivations must be non-empty, independently constructed, distinct in strategy or query expression, exhaustive across the complete family, independently enumerated, and explicitly compared. The worker must withhold a numeric assertion for missing, copied, incomplete, non-exhaustive, narrow, or disagreeing evidence; a single grep, a named-pattern-only query, matching totals, distinct query text, or equal member sets alone does not approve a number.
+
 ## Output Paths
 
 - `docs/features/active/<feature>/spec.md`
@@ -20,3 +22,4 @@ This direct-use wrapper delegates feature-document work to the `prd-feature` wor
 ## Worker Routing
 
 - Worker: `prd-feature`
+- Require the worker to report the authoritative `research-path` when a numeric acceptance criterion is written.

package/resources/claude-customizations/.claude/skills/parallel-add/SKILL.md

@@ -21,6 +21,8 @@ this operation may and may not disturb. Read that section before applying anythi
 
 ## Prerequisites
 
+- Reject a pending or not-started run with guidance to consolidate the initial set through `/parallel-plan`. Admit exactly one item only after execution has started in an open run; closed runs are not eligible.
+
 - A parallel run is in progress and `artifacts/orchestration/parallel-orchestrator-state.json`
   tracks its `parallel_slug`. This skill does not start a run; use `/parallel-plan` and
   `/parallel-run` for that.
@@ -64,7 +66,9 @@ re-derivation is mandatory and is not an optimization to skip when the checkpoin
    required parsed `config/blast-radius.json` mapping, which push-down publishes into the
    destination workspace. `conflicts(a, b, config)` in `scripts/dev_tools/compute_blast_radius.py`
    (defined in `scripts/dev_tools/_blast_radius_conflicts.py`) remains the repository authority and
-   the parity reference. Map each conflicting pair onto an `(int, int)` conflict edge
+   the parity reference. Read the verdict from the conflict key of the returned hashtable.
+   The hashtable itself is always truthy, so a bare boolean test on the result treats every pair as
+   conflicting. Map each conflicting pair onto an `(int, int)` conflict edge
    of `items[].issue_num` values, normalized so `a < b`. Do not reimplement the relation and do not
    compute edges over the unstarted subset only: an in-flight conflict is precisely what the
    admission decision turns on.

package/resources/claude-customizations/.claude/skills/parallel-orchestrate/SKILL.md

@@ -387,15 +387,21 @@ checkout, never from inside a child worktree — issues `git worktree remove <wo
 success it records `merge_status: worktree_removed` and `worktree_removed_at`, then regenerates
 `docs/features/parallel/<slug>/parallel-status.md`.
 
-Mechanical gating of this command for parallel worktrees is F7 scope.
-`.claude/hooks/enforce-epic-worktree-removal-gate.ps1` is a project-wide `PreToolUse` Bash-matcher
-hook that denies any `git worktree remove` unless the epic checkpoint carries a matching
-`features[]` record whose `merge_status` is `merged` or `worktree_removed`; an unreadable checkpoint
-or an absent record also denies. Its block reason is `EPIC_WORKTREE_REMOVAL_BLOCKED`. A parallel run
-has no epic checkpoint record for its worktrees, so removal is denied until F7 both delivers
-`enforce-parallel-worktree-removal-gate.ps1` and coordinates the epic gate's allow conditions:
-`PreToolUse` denials are conjunctive, so a new allow-hook alone cannot override the existing deny.
-This feature ships no hook file and makes no `.claude/settings.json` change.
+Mechanical gating of this command for parallel worktrees is delivered. Both halves have landed.
+`.claude/hooks/enforce-parallel-worktree-removal-gate.ps1` exists and is registered in
+`.claude/settings.json` on the `Bash` matcher; it authorizes a removal from the
+parallel-orchestrator checkpoint and owns the block reason
+`PARALLEL_WORKTREE_REMOVAL_BLOCKED`. `.claude/hooks/enforce-epic-worktree-removal-gate.ps1` is a
+project-wide `PreToolUse` Bash-matcher hook registered alongside it whose block reason is
+`EPIC_WORKTREE_REMOVAL_BLOCKED`; it now carries a second, parallel allow-branch, so it authorizes a
+removal either from a matching epic checkpoint `features[]` record or from a parallel-orchestrator
+checkpoint whose `route_id` is `parallel` and whose matching `items[].worktree_path` record has
+`merge_status` in `{merged, worktree_removed}`. An unreadable checkpoint, an absent record, or a
+non-authorizing `merge_status` still denies on both branches. The coordination matters because
+`PreToolUse` denials are conjunctive: a new allow-hook alone could not have overridden the epic
+gate's independent deny, which is why the epic gate itself had to gain the parallel branch.
+The parallel-orchestrator-surface feature (F7) shipped no hook file and made no
+`.claude/settings.json` change of its own.
 
 ## Documentation Maintenance Boundaries
 
@@ -736,6 +742,9 @@ against `items[].worktree_path`. Removal is allowed only when that item's `merge
 or `worktree_removed`; anything else — including an unreadable checkpoint or no matching record —
 denies with a reason prefixed `PARALLEL_WORKTREE_REMOVAL_BLOCKED`. Commands that are not
 `git worktree remove` always allow. This is the mechanical counterpart to `## Worktree Cleanup`.
+`.claude/hooks/enforce-epic-worktree-removal-gate.ps1` fires on the same command and now carries a
+matching parallel allow-branch keyed on the same checkpoint, so both gates must allow for a removal
+to proceed.
 
 **Invocation-origin extension.** `.claude/hooks/enforce-epic-invocation-origin.ps1` was extended
 additively so `$script:GatedSubagentTypes` lists `epic-planner`, `epic-orchestrator`,

package/resources/claude-customizations/.claude/skills/parallel-plan/SKILL.md

@@ -32,6 +32,8 @@ Before proceeding, `parallel-planner` must:
 
 ## Item Intake
 
+Initial intake must provide the complete item set in one `/parallel-plan <slug> <item> [<item> ...]` invocation before waves are calculated. `/parallel-add` is not an initial-intake path.
+
 Invocation shape: `/parallel-plan <slug> <item> [<item> ...]`, where each `<item>` is either a
 GitHub issue number (already-promoted work) or a potential-entry path (unpromoted work). This is
 the same intake domain as `/parallel-add`, so initial intake here and F6's add operation accept
@@ -214,7 +216,9 @@ as-is and never reimplemented here:
   `compute_blast_radius.py`. The signature takes three arguments; the third is the parsed
   `config/blast-radius.json`. Reasons come from the fixed vocabulary
   `{path_overlap, module_overlap, shared_surface_overlap, contract_dependency}`, and the relation
-  fails closed.
+  fails closed. Read the verdict from the conflict field of the returned ConflictResult.
+  The result's boolean projection now agrees with that field, so `if conflicts(a, b, config):`
+  yields the verdict rather than the unconditional truth a bare object test gave before issue #576.
 
 **The F1a corrections (issue #452, merged PR #453) are load-bearing.** Derivation now reaches
 separator-free repository-root shared surfaces from plan and spec text, admitting such a token only
@@ -303,6 +307,11 @@ The library returns the partition; the planner supplies the record fields.
    item is `prepared` and radius-validated. Derive the conflict edge set by applying
    `Test-BlastRadiusConflict` to every unordered pair of `declared` radii, then pass the pairs as
    `--edges "<a>:<b> ..."` and the item keys as `--keys "<k1> <k2> ..."`.
+   Read the verdict from the conflict key of the returned hashtable.
+   The hashtable itself is always truthy, so a bare boolean test on the result treats every pair as
+   conflicting and serializes the whole run. This is the sibling hazard to the `@(...)` warning
+   above for `Test-BlastRadius`: that function writes an `IList`-shaped pipeline result whose
+   emptiness is falsy, while this one returns a hashtable whose emptiness is not expressible at all.
 2. Immediately after the conflict-edge set is derived and before anything consumes it, run the
    lane-assertion diagnostic:
    `poetry run python -m scripts.dev_tools.parallel_lane_assertion --manifest docs/features/parallel/<slug>/parallel.md --edges "<a>:<b> ..."`

package/resources/claude-customizations/.claude/skills/pr-context-artifacts/SKILL.md

@@ -28,3 +28,25 @@ If the artifacts are missing or stale relative to the current branch state, re-g
 - Do not infer the refresh base from the repository default branch unless merge-base resolution fails for all candidates.
 - Treat an already-fresh artifact pair as authoritative; do not refresh solely because no explicit `PRBaseBranch` input was provided.
 
+### Freshness Cross-Check
+
+Both artifacts open with a `Context generated` section carrying the generation timestamp and a
+`Head SHA:` line. Decide freshness from those two values in two steps, and from nothing else.
+
+1. **Pair identity.** The generated-context timestamp must be byte-identical in the summary and in
+   the appendix. A mismatch proves the two files came from different invocations — a summary
+   refreshed while a stale appendix persists, or the reverse — so the pair does not describe one
+   run and must be regenerated.
+2. **Head binding.** The head SHA recorded in both files must equal the current head of the branch
+   under review. A mismatch proves the pair predates the current head, so it describes a different
+   diff than the one being reviewed and must be regenerated.
+
+File existence and file modification time are not freshness signals. A file left at the expected
+path by a previous invocation satisfies an existence check, and a stale file that was copied or
+touched satisfies a modification-time check. Both operands of the cross-check above are read from
+the artifacts themselves and from git, so the check is deterministic and does not depend on a wall
+clock.
+
+When the head SHA renders the `(unknown)` token, the collected context carried no head SHA. Head
+binding cannot be established in that case, so treat the pair as unverified and regenerate it.
+

package/resources/claude-customizations/.claude/skills/remediation-handoff-atomic-planner/SKILL.md

@@ -81,6 +81,10 @@ Timestamp rule:
 
 A cycle with fewer than five artifacts is malformed. A cycle that uses the same timestamp value for both its `remediation/<ts>/` and `audit/<ts>/` folders is malformed unless entry and exit genuinely ran within the same minute — the two folders remain distinct either way, since one is named `remediation/` and the other `audit/`.
 
+### Cycle-Document Sweep Scope
+
+A comprehensive or final sweep in a remediation cycle covers that cycle's own plan and audit documents — `remediation-plan.md`, `code-review.md`, `feature-audit.md`, and `policy-audit.md` — in addition to production and test code. The failure mechanism a code-only sweep leaves open is self-referential rule violation: a policy-compliance fix whose own descriptive text violates the policy it enforces is written into one of those four documents rather than into code, so a sweep scoped to code only reports no finding and the violation ships with the cycle.
+
 ## Plan Shape
 
 `remediation/<entry-ts>/remediation-plan.md` MUST conform to `.claude/skills/atomic-plan-contract/SKILL.md`. In particular:
@@ -102,6 +106,14 @@ After the plan is authored, `atomic-executor` runs preflight under the directive
 
 The orchestrator records the preflight outcome in `remediation_loop.cycles[current_cycle].preflight` with `iterations` (counter) and `final_status` (`clear|changes_requested|pending`).
 
+For a well-scoped item where `preflight.iterations > 1`, record a process-defect investigation that identifies the incomplete planner internal-review dimension. Treat excess rounds as a process signal, not routine iteration.
+
+The exhaustive-pass, defect-enumeration, and delta-self-check rules that govern how `atomic-executor` conducts preflight are defined in the `## Preflight Validation (Planner ↔ Executor)` section of `.claude/skills/atomic-plan-contract/SKILL.md` and are not restated here.
+
+Alongside `iterations` and `final_status`, the orchestrator also records in `remediation_loop.cycles[current_cycle].preflight` the convergence line `atomic-executor` returned on that round, which is one of `CONVERGENCE: NO FURTHER ROUNDS EXPECTED` or `CONVERGENCE: FURTHER ROUNDS LIKELY`. This convergence field extends the field set already recorded at `remediation_loop.cycles[current_cycle].preflight` rather than replacing it: `iterations` and `final_status` continue to be recorded exactly as stated above, and the convergence field is written in addition to them.
+
+Iteration ceiling. When a cycle's `iterations` would exceed 2, the orchestrator records `final_status: "blocked_preflight_iteration_limit"`, halts the preflight sub-loop, and escalates to the caller, rather than continuing the sub-loop indefinitely. `blocked_preflight_iteration_limit` is a fourth `final_status` value extending the `clear|changes_requested|pending` enumeration stated above. This ceiling bounds the repeat-until-clear behavior stated above it: the sub-loop still repeats until `PREFLIGHT: ALL CLEAR` is returned, and the ceiling supplies the terminating condition for the case where that signal is not reached within two iterations.
+
 ## Execution and Reaudit
 
 When preflight is clear, `atomic-executor` executes the plan task-by-task. The executor invokes workers (`python-typed-engineer`, `typescript-engineer`, `csharp-typed-engineer`, `powershell-typed-engineer`) internally as needed. The orchestrator does not call workers.

package/resources/claude-customizations/.claude/skills/research-issue/SKILL.md

@@ -55,6 +55,8 @@ Create or update a single research file at one of the two tracked research roots
 
 - Map acceptance criteria into a concrete design.
 - Propose state model, transitions, internal API boundaries, and required file changes.
+- For every numeric count, enumeration, or population proposed for an approved `spec.md` acceptance criterion, add complete `## Numeric Derivation Evidence`. Each record must identify `Complete Family`, `Exhaustive Search Scope`, `Inclusion Rules`, `Exclusion Rules`, `Primary Search Strategy or Query Expression`, `Primary Member Set`, `Primary Count`, `Cross-check Search Strategy or Query Expression`, `Cross-check Member Set`, `Cross-check Count`, and `Member-set Comparison`.
+- Both derivations must be non-empty and independently constructed. They must use distinct search strategies or query expressions, independently enumerate the member sets, and explicitly compare normalized member sets. The scope must cover the entire declared family, including all relevant overloads and members; reject a single grep, a narrow named-pattern search, or a query that covers only one family member even when totals and member sets appear equal. Withhold the numeric assertion if the records are incomplete, duplicated, non-exhaustive, narrow, or disagree.
 
 ### 5. Testing Implications
 
@@ -67,3 +69,4 @@ Create or update a single research file at one of the two tracked research roots
 - Ground all findings in verified evidence from the codebase and authoritative external sources.
 - Keep discussion of non-selected approaches brief.
 - Do not claim or perform nested worker delegation.
+- Omit numeric acceptance-criterion facts when the numeric derivation record is absent, incomplete, or disagrees.

package/resources/claude-customizations/pack-manifests/core.json

@@ -53,6 +53,7 @@
     ".claude/hooks/validate-feature-review-coverage.ps1",
     ".claude/hooks/validate-orchestrator-output.ps1",
     ".claude/hooks/validate-planner-output.ps1",
+    ".claude/hooks/validate-prd-feature-output.ps1",
     ".claude/hooks/validate-required-artifact-output.ps1",
     ".claude/hooks/validate-task-researcher-output.ps1",
     ".claude/rules/architecture-boundaries.md",
@@ -110,6 +111,7 @@
     ".claude/skills/translate-copilot-to-claude/SKILL.md",
     ".claude/skills/update-status/SKILL.md",
     ".claude/lib/hook-payload/HookPayload.psm1",
+    ".claude/lib/requirements/GeneratedDocumentCounters.psm1",
     ".claude/lib/model-routing/ModelRouting.psm1",
     ".claude/lib/orchestrator-state/OrchestratorState.psm1",
     ".claude/lib/orchestrator-state/OrchestratorStateCompletion.psm1",