@danmoisan/drm-copilot-mcp 1.1.6 → 1.1.8

package/resources/claude-customizations/.claude/hooks/enforce-python-batch-budget.ps1

@@ -13,6 +13,19 @@
     persisted under .claude/state/python-batch-budget.<session_id>.json. Only distinct
     file paths are counted; repeated edits to the same file consume one slot.
 
+    The session id is resolved from the first non-empty of: the CLAUDE_SESSION_ID
+    environment variable; the contents of <root>/.claude/state/current-session-id;
+    a worktree-derived identifier built from the root's leaf name and a short
+    stable hash of its normalized path. The resolved value is sanitized before it
+    is composed into a file name, so a hostile id cannot escape the state
+    directory. Resolving the id never creates the state directory.
+
+    Candidate paths are contained to the resolved root. A candidate that resolves
+    outside it is discarded: the decision is 'allow', no slot is consumed, and no
+    state is written. Persisted entries that fail the same containment test are
+    dropped when state is rehydrated, so a state file carried between worktrees
+    cannot spend this worktree's budget.
+
     Test files are those matching:
       - tests/**/*.py
       - test_*.py
@@ -36,6 +49,127 @@ param()
 
 
 Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
+
+function Test-PythonBatchBudgetPathInRoot {
+    <#
+    .SYNOPSIS
+        Reports whether a candidate path belongs to the batch-budget root.
+    .DESCRIPTION
+        Compares forward-slash-normalized forms of the candidate and the root,
+        case-insensitively. A relative candidate carries no root of its own and is
+        admitted, which is what keeps a relative path recorded by one worktree from
+        being treated as foreign by another.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Path,
+
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Root
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Path)) {
+        return $false
+    }
+
+    $normalizedPath = $Path -replace '\\', '/'
+    if ($normalizedPath -notmatch '^(/|[A-Za-z]:/)') {
+        return $true
+    }
+
+    $normalizedRoot = ($Root -replace '\\', '/').TrimEnd('/')
+    if ([string]::IsNullOrWhiteSpace($normalizedRoot)) {
+        return $true
+    }
+
+    return ([string]::Equals($normalizedPath, $normalizedRoot, [System.StringComparison]::OrdinalIgnoreCase) -or $normalizedPath.StartsWith($normalizedRoot + '/', [System.StringComparison]::OrdinalIgnoreCase))
+}
+
+function ConvertTo-PythonBatchBudgetSafeSegment {
+    <#
+    .SYNOPSIS
+        Reduces a session id to characters that are safe in a file name.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Value
+    )
+
+    return ($Value -replace '[^A-Za-z0-9._-]', '_')
+}
+
+function Get-PythonBatchBudgetSessionId {
+    <#
+    .SYNOPSIS
+        Resolves the session id used to compose the batch-budget state-file name.
+    .DESCRIPTION
+        Returns the first non-empty of: the explicit SessionId argument; the
+        CLAUDE_SESSION_ID environment variable; the contents of the session-id state
+        file; a worktree-derived identifier. The result is sanitized so it cannot
+        escape the state directory. The session-id state file is read through the
+        ReadSessionIdFile seam and is never created, so resolution performs no write.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $SessionId,
+
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Root,
+
+        [Parameter(Mandatory)]
+        [string] $SessionIdFilePath,
+
+        [scriptblock] $ReadSessionIdFile
+    )
+
+    $candidates = @(
+        $SessionId
+        $env:CLAUDE_SESSION_ID
+    )
+
+    foreach ($candidate in $candidates) {
+        if (-not [string]::IsNullOrWhiteSpace($candidate)) {
+            return (ConvertTo-PythonBatchBudgetSafeSegment -Value $candidate.Trim())
+        }
+    }
+
+    $fromFile = ''
+    try {
+        $fromFile = [string](& $ReadSessionIdFile $SessionIdFilePath)
+    } catch {
+        Write-Verbose "Ignoring unreadable session-id file '$SessionIdFilePath': $($_.Exception.Message)"
+        $fromFile = ''
+    }
+
+    if (-not [string]::IsNullOrWhiteSpace($fromFile)) {
+        return (ConvertTo-PythonBatchBudgetSafeSegment -Value $fromFile.Trim())
+    }
+
+    $normalizedRoot = ($Root -replace '\\', '/').TrimEnd('/')
+    $leaf = ConvertTo-PythonBatchBudgetSafeSegment -Value (Split-Path -Path $normalizedRoot -Leaf)
+
+    $sha = [System.Security.Cryptography.SHA256]::Create()
+    try {
+        $hashBytes = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($normalizedRoot))
+    } finally {
+        $sha.Dispose()
+    }
+    $shortHash = -join (@($hashBytes[0..3]) | ForEach-Object { $_.ToString('x2') })
+
+    return "worktree-$leaf-$shortHash"
+}
+
 function Get-PythonBatchBudgetState {
     [CmdletBinding()]
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
@@ -66,14 +200,26 @@ function ConvertTo-PythonBatchBudgetState {
         [int] $ProdCap,
 
         [Parameter(Mandatory)]
-        [int] $TestCap
+        [int] $TestCap,
+
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Root = (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent)
     )
 
     $state = Get-PythonBatchBudgetState -ProdCap $ProdCap -TestCap $TestCap
     if ($null -ne $InputObject.prodCap) { $state.prodCap = [int]$InputObject.prodCap }
     if ($null -ne $InputObject.testCap) { $state.testCap = [int]$InputObject.testCap }
-    if ($null -ne $InputObject.prodFiles) { $state.prodFiles = @($InputObject.prodFiles) }
-    if ($null -ne $InputObject.testFiles) { $state.testFiles = @($InputObject.testFiles) }
+
+    # Persisted entries that resolve outside this root belong to another worktree
+    # and are dropped, so a state file carried across worktrees cannot spend this
+    # worktree's budget.
+    if ($null -ne $InputObject.prodFiles) {
+        $state.prodFiles = @(@($InputObject.prodFiles) | Where-Object { Test-PythonBatchBudgetPathInRoot -Path $_ -Root $Root })
+    }
+    if ($null -ne $InputObject.testFiles) {
+        $state.testFiles = @(@($InputObject.testFiles) | Where-Object { Test-PythonBatchBudgetPathInRoot -Path $_ -Root $Root })
+    }
 
     return $state
 }
@@ -113,7 +259,11 @@ function Invoke-PythonBatchBudgetDecision {
         [System.Collections.IDictionary] $State,
 
         [Parameter(Mandatory)]
-        [string] $StateFile
+        [string] $StateFile,
+
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Root = (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent)
     )
 
     $normalized = $FilePath -replace '\\', '/'
@@ -121,6 +271,13 @@ function Invoke-PythonBatchBudgetDecision {
         return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' }; state = $State; shouldWriteState = $false }
     }
 
+    # An out-of-root candidate is discarded rather than denied: it consumes no
+    # slot and writes no state, so this hook stays deny-only for real overruns.
+    if (-not (Test-PythonBatchBudgetPathInRoot -Path $normalized -Root $Root)) {
+        Write-Verbose "Discarding batch-budget candidate '$normalized': it resolves outside the batch-budget root '$Root'."
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' }; state = $State; shouldWriteState = $false }
+    }
+
     $isTestFile = ($normalized -match '(^|/)tests/.*\.py$') -or ($normalized -match '(^|/)test_[^/]+\.py$')
     $targetList = if ($isTestFile) { @($State.testFiles) } else { @($State.prodFiles) }
     $cap = if ($isTestFile) { [int]$State.testCap } else { [int]$State.prodCap }
@@ -151,10 +308,17 @@ function Invoke-PythonBatchBudgetHook {
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
     param(
         [string] $ToolInputRaw,
-        [string] $SessionId = 'default',
-        [string] $Root = (Get-Location).Path,
+        [string] $SessionId = '',
+        [string] $Root = (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent),
         [int] $ProdCap = 3,
         [int] $TestCap = 3,
+        [scriptblock] $ReadSessionIdFile = {
+            param([string] $Path)
+            if (Test-Path -LiteralPath $Path -PathType Leaf) {
+                return (Get-Content -LiteralPath $Path -Raw)
+            }
+            return ''
+        },
         [scriptblock] $TestPathExists = { param([string] $Path) Test-Path -Path $Path },
         [scriptblock] $EnsureDirectory = { param([string] $Path) New-Item -ItemType Directory -Path $Path -Force | Out-Null },
         [scriptblock] $ReadState = { param([string] $Path) Get-Content -Path $Path -Raw },
@@ -183,23 +347,32 @@ function Invoke-PythonBatchBudgetHook {
     }
 
     $stateDir = Join-Path -Path $Root -ChildPath '.claude/state'
+
+    # Resolved before the directory is ensured, because reading the session-id
+    # file must never be what creates the state directory.
+    $resolvedSessionId = Get-PythonBatchBudgetSessionId `
+        -SessionId $SessionId `
+        -Root $Root `
+        -SessionIdFilePath (Join-Path -Path $stateDir -ChildPath 'current-session-id') `
+        -ReadSessionIdFile $ReadSessionIdFile
+
     if (-not (& $TestPathExists $stateDir)) {
         & $EnsureDirectory $stateDir
     }
 
-    $stateFile = Join-Path -Path $stateDir -ChildPath ("python-batch-budget.$SessionId.json")
+    $stateFile = Join-Path -Path $stateDir -ChildPath ("python-batch-budget.$resolvedSessionId.json")
     $state = Get-PythonBatchBudgetState -ProdCap $ProdCap -TestCap $TestCap
 
     if (& $TestPathExists $stateFile) {
         try {
             $loaded = & $ReadState $stateFile | ConvertFrom-Json -ErrorAction Stop
-            $state = ConvertTo-PythonBatchBudgetState -InputObject $loaded -ProdCap $ProdCap -TestCap $TestCap
+            $state = ConvertTo-PythonBatchBudgetState -InputObject $loaded -ProdCap $ProdCap -TestCap $TestCap -Root $Root
         } catch {
             Write-Verbose "Ignoring unreadable Python batch-budget state file '$stateFile': $($_.Exception.Message)"
         }
     }
 
-    $decision = Invoke-PythonBatchBudgetDecision -FilePath $filePath -State $state -StateFile $stateFile
+    $decision = Invoke-PythonBatchBudgetDecision -FilePath $filePath -State $state -StateFile $stateFile -Root $Root
     if ($decision.shouldWriteState) {
         try {
             & $WriteState $stateFile $decision.state
@@ -242,10 +415,10 @@ function Invoke-PythonBatchBudgetEntryPoint {
         $ToolInputRaw = [string](& $ReadPayload)
     }
 
-    $sessionId = $env:CLAUDE_SESSION_ID
-    if (-not $sessionId) {
-        $sessionId = 'default'
-    }
+    # No literal fallback here: an empty value routes through the hook's session
+    # resolution, which falls back to the session-id state file and then to a
+    # worktree-derived identifier.
+    $sessionId = [string]$env:CLAUDE_SESSION_ID
 
     $prodCap = 3
     $testCap = 3

package/resources/claude-customizations/.claude/hooks/persist-session-id.ps1

@@ -8,13 +8,15 @@
     falling back to the CLAUDE_HOOK_INPUT environment variable (the existing
     SubagentStop-hook precedent), and extracts the 'session_id' field.
 
-    Persistence channel:
-      - When CLAUDE_ENV_FILE is set, appends the line
-        'CLAUDE_SESSION_ID=<id>' to that file. Variables persisted there are
+    Persistence channels:
+      - The id is always written to .claude/state/current-session-id, creating
+        that directory when absent. Publishing it unconditionally is what lets a
+        consumer that cannot read the env file, such as a hook running in a
+        fresh process, still resolve the session id from disk.
+      - When CLAUDE_ENV_FILE is set, the line 'CLAUDE_SESSION_ID=<id>' is
+        additionally appended to that file. Variables persisted there are
         exported to subsequent Bash tool commands in the session, which is how
         this hook provisions the otherwise-unset CLAUDE_SESSION_ID variable.
-      - When CLAUDE_ENV_FILE is unset, writes the id to
-        .claude/state/current-session-id instead.
 
     On malformed or empty input (missing/blank payload, unparseable JSON, or an
     absent/blank session_id) the hook performs no write. It always exits 0 so a
@@ -101,6 +103,15 @@ function Invoke-PersistSessionIdHook {
     switch ($decision.action) {
         'env-file' {
             & $AppendLine $decision.path ("CLAUDE_SESSION_ID={0}" -f $decision.sessionId)
+
+            # The state file is published unconditionally, so a consumer that
+            # cannot read the env file (a hook invoked in a fresh process, for
+            # example) still resolves the session id from disk.
+            $envStateDir = Split-Path -Path $StateFilePath -Parent
+            if ($envStateDir) {
+                & $EnsureDirectory $envStateDir
+            }
+            & $WriteStateFile $StateFilePath $decision.sessionId
         }
         'state-file' {
             $stateDir = Split-Path -Path $decision.path -Parent

package/resources/claude-customizations/.claude/hooks/validate-planner-output.ps1

@@ -110,6 +110,123 @@ function Test-HasPreflightSignal {
     )
 }
 
+function Get-PlannerInternalReviewValidation {
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param([Parameter(Mandatory = $true)][string] $AgentOutput)
+
+    $lines = @($AgentOutput -split "`r?`n")
+    $labelPattern = '^\s*(?:PLANNER-INTERNAL-REVIEW|CITATION-TO-TREE|AC-TRACEABILITY|SCOPE-BOUNDARY|CITATION|AC-INVENTORY|AC-MAPPING|UNRESOLVED-GAPS|PREFLIGHT)\s*:'
+    $headerPattern = '^\s*PLANNER-INTERNAL-REVIEW\s*:\s*(?<Value>.*?)\s*$'
+    $preflightPattern = '^\s*PREFLIGHT\s*:\s*(?:ALL CLEAR|REVISIONS REQUIRED)\s*$'
+    $labelIndexes = [System.Collections.Generic.List[int]]::new()
+    $headerIndexes = [System.Collections.Generic.List[int]]::new()
+    $preflightIndexes = [System.Collections.Generic.List[int]]::new()
+
+    for ($index = 0; $index -lt $lines.Count; $index++) {
+        if ($lines[$index] -match $labelPattern) {
+            $labelIndexes.Add($index)
+        }
+        if ($lines[$index] -match $headerPattern) {
+            $headerIndexes.Add($index)
+        }
+        if ($lines[$index] -match $preflightPattern) {
+            $preflightIndexes.Add($index)
+        }
+    }
+
+    if ($headerIndexes.Count -ne 1) {
+        return @{ Ok = $false; Message = 'planner internal review must contain exactly one `PLANNER-INTERNAL-REVIEW:` declaration.' }
+    }
+
+    $headerIndex = $headerIndexes[0]
+    $headerMatch = [regex]::Match($lines[$headerIndex], $headerPattern)
+    if ($headerMatch.Groups['Value'].Value.Trim() -ne 'PASS') {
+        return @{ Ok = $false; Message = 'planner internal review header must be exactly `PLANNER-INTERNAL-REVIEW: PASS`.' }
+    }
+
+    $preflightAfterHeader = @($preflightIndexes | Where-Object { $_ -gt $headerIndex })
+    if ($preflightAfterHeader.Count -ne 1) {
+        return @{ Ok = $false; Message = 'planner internal review must terminate at exactly one required `PREFLIGHT:` signal after its header.' }
+    }
+
+    $preflightIndex = $preflightAfterHeader[0]
+    foreach ($labelIndex in $labelIndexes) {
+        if ($labelIndex -lt $headerIndex -or $labelIndex -gt $preflightIndex) {
+            return @{ Ok = $false; Message = 'planner internal review declarations must not occur outside the bounded record.' }
+        }
+    }
+
+    $recordLines = @($lines[$headerIndex..$preflightIndex])
+    $requiredDeclarations = @('CITATION-TO-TREE', 'AC-TRACEABILITY', 'SCOPE-BOUNDARY')
+    foreach ($declaration in $requiredDeclarations) {
+        $declarationMatches = @($recordLines | Where-Object { $_ -match "^\s*$declaration\s*:" })
+        if ($declarationMatches.Count -ne 1) {
+            return @{ Ok = $false; Message = "planner internal review must contain exactly one `$declaration: PASS` declaration." }
+        }
+        if ($declarationMatches[0] -notmatch "^\s*$declaration\s*:\s*PASS\s*$") {
+            return @{ Ok = $false; Message = "planner internal review declaration `$declaration must be exactly PASS." }
+        }
+    }
+
+    $citationLines = @($recordLines | Where-Object { $_ -match '^\s*CITATION\s*:' })
+    if ($citationLines.Count -eq 0) {
+        return @{ Ok = $false; Message = 'planner internal review must contain at least one `CITATION:` record.' }
+    }
+    foreach ($citationLine in $citationLines) {
+        $citation = [regex]::Match($citationLine, '^\s*CITATION\s*:\s*(?<Path>[^|\s]+)\s*\|\s*(?<Locator>.+?\S)\s*$')
+        if (-not $citation.Success -or $citation.Groups['Path'].Value -notmatch '^(?![A-Za-z]:)(?!/)(?!\\)(?:\.?[^/\\|\s]+)(?:/[^/\\|\s]+)+$') {
+            return @{ Ok = $false; Message = 'planner internal review citations require a repository-relative path and nonblank locator.' }
+        }
+    }
+
+    $inventoryLines = @($recordLines | Where-Object { $_ -match '^\s*AC-INVENTORY\s*:' })
+    if ($inventoryLines.Count -ne 1) {
+        return @{ Ok = $false; Message = 'planner internal review must contain exactly one nonblank `AC-INVENTORY:` declaration.' }
+    }
+    $inventoryValue = ($inventoryLines[0] -replace '^\s*AC-INVENTORY\s*:\s*', '').Trim()
+    if ([string]::IsNullOrWhiteSpace($inventoryValue)) {
+        return @{ Ok = $false; Message = 'planner internal review `AC-INVENTORY:` must contain nonblank unique IDs.' }
+    }
+    $inventoryIds = @($inventoryValue -split ',' | ForEach-Object { $_.Trim() })
+    if ((@($inventoryIds | Where-Object { [string]::IsNullOrWhiteSpace($_) }).Count -gt 0) -or
+        (@($inventoryIds | Select-Object -Unique).Count -ne $inventoryIds.Count)) {
+        return @{ Ok = $false; Message = 'planner internal review `AC-INVENTORY:` must contain nonblank unique IDs.' }
+    }
+
+    $mappingLines = @($recordLines | Where-Object { $_ -match '^\s*AC-MAPPING\s*:' })
+    if ($mappingLines.Count -eq 0) {
+        return @{ Ok = $false; Message = 'planner internal review must contain one `AC-MAPPING:` record for every inventory ID.' }
+    }
+    $mappingIds = [System.Collections.Generic.List[string]]::new()
+    foreach ($mappingLine in $mappingLines) {
+        $mapping = [regex]::Match($mappingLine, '^\s*AC-MAPPING\s*:\s*(?<Id>[^|]*?)\s*\|\s*IMPLEMENTATION\s*:\s*(?<Implementation>[^|]*?)\s*\|\s*TESTS\s*:\s*(?<Tests>[^|]*?)\s*\|\s*EVIDENCE\s*:\s*(?<Evidence>.*?)\s*$')
+        if (-not $mapping.Success -or
+            [string]::IsNullOrWhiteSpace($mapping.Groups['Id'].Value) -or
+            [string]::IsNullOrWhiteSpace($mapping.Groups['Implementation'].Value) -or
+            [string]::IsNullOrWhiteSpace($mapping.Groups['Tests'].Value) -or
+            [string]::IsNullOrWhiteSpace($mapping.Groups['Evidence'].Value)) {
+            return @{ Ok = $false; Message = 'planner internal review `AC-MAPPING:` requires nonblank ID, IMPLEMENTATION, TESTS, and EVIDENCE fields.' }
+        }
+        $mappingIds.Add($mapping.Groups['Id'].Value.Trim())
+    }
+    if (@($mappingIds | Select-Object -Unique).Count -ne $mappingIds.Count) {
+        return @{ Ok = $false; Message = 'planner internal review `AC-MAPPING:` identifiers must be unique.' }
+    }
+    if ($inventoryIds.Count -ne $mappingIds.Count -or
+        (@($inventoryIds | Where-Object { $_ -notin $mappingIds }).Count -gt 0) -or
+        (@($mappingIds | Where-Object { $_ -notin $inventoryIds }).Count -gt 0)) {
+        return @{ Ok = $false; Message = 'planner internal review AC inventory and mapping identifiers must match exactly.' }
+    }
+
+    $gapLines = @($recordLines | Where-Object { $_ -match '^\s*UNRESOLVED-GAPS\s*:' })
+    if ($gapLines.Count -ne 1 -or $gapLines[0] -notmatch '^\s*UNRESOLVED-GAPS\s*:\s*NONE\s*$') {
+        return @{ Ok = $false; Message = 'planner internal review must contain exactly one `UNRESOLVED-GAPS: NONE` declaration.' }
+    }
+
+    return @{ Ok = $true; Message = $null }
+}
+
 function Get-PlanStructureValidationReport {
     [CmdletBinding()]
     [OutputType([string[]])]
@@ -272,6 +389,11 @@ function Invoke-PlannerOutputValidation {
         return @{ Ok = $false; Message = $message }
     }
 
+    $review = Get-PlannerInternalReviewValidation -AgentOutput $agentOutput
+    if (-not $review.Ok) {
+        return @{ Ok = $false; Message = "atomic-planner hook: $($review.Message)" }
+    }
+
     return @{ Ok = $true; Message = $null }
 }
 

package/resources/claude-customizations/.claude/hooks/validate-prd-feature-output.ps1

@@ -0,0 +1,91 @@
+<#
+.SYNOPSIS
+    Validates numeric acceptance criteria produced by the prd-feature worker.
+#>
+
+[CmdletBinding()]
+param()
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+function Get-ArtifactPathFromOutput {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory = $true)][string] $Output, [Parameter(Mandatory = $true)][string] $Label)
+
+    $match = [regex]::Match($Output, "(?im)^\s*$([regex]::Escape($Label))\s*:\s*(?<path>\S+)")
+    if ($match.Success) { return $match.Groups['path'].Value }
+    return $null
+}
+
+function Test-NumericDerivationEvidence {
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param([Parameter(Mandatory = $true)][AllowEmptyString()][string] $Content)
+
+    $section = [regex]::Match($Content, '(?ims)^##\s+Numeric\s+Derivation\s+Evidence\s*$.*?(?=^##\s|\z)')
+    if (-not $section.Success) { return @{ Ok = $false; Message = 'prd-feature hook: numeric criterion requires ## Numeric Derivation Evidence.' } }
+    $requiredLabels = @(
+        'Complete Family', 'Exhaustive Search Scope', 'Inclusion Rules', 'Exclusion Rules',
+        'Primary Search Strategy or Query Expression', 'Primary Member Set', 'Primary Count',
+        'Cross-check Search Strategy or Query Expression', 'Cross-check Member Set', 'Cross-check Count',
+        'Member-set Comparison'
+    )
+    $values = @{}
+    foreach ($label in $requiredLabels) {
+        $match = [regex]::Match($section.Value, "(?im)^[\t ]*[-*]?[\t ]*$([regex]::Escape($label))[\t ]*:[\t ]*(?<value>\S(?:.*\S)?)[\t ]*$")
+        if (-not $match.Success) { return @{ Ok = $false; Message = "prd-feature hook: numeric derivation evidence is missing $label." } }
+        $values[$label] = $match.Groups['value'].Value.Trim()
+    }
+    if ($values['Exhaustive Search Scope'] -notmatch '(?i)\b(entire|all|complete)\b.*\b(repository|repo|source tree|tree)\b') { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation evidence does not declare an exhaustive repository search scope.' } }
+    $primaryStrategy = $values['Primary Search Strategy or Query Expression']
+    $crossCheckStrategy = $values['Cross-check Search Strategy or Query Expression']
+    if ($primaryStrategy -match '(?i)\b(single|narrow|named[- ]?pattern)\b' -or $crossCheckStrategy -match '(?i)\b(single|narrow|named[- ]?pattern)\b') { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation evidence uses a narrow named-pattern search.' } }
+    if ([regex]::Replace($primaryStrategy, '\s+', '').ToLowerInvariant() -eq [regex]::Replace($crossCheckStrategy, '\s+', '').ToLowerInvariant()) { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation cross-check repeats the primary search strategy or query expression.' } }
+    $familyMembers = @($values['Complete Family'].Split(',') | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    foreach ($familyMember in $familyMembers) {
+        if ($primaryStrategy -notmatch [regex]::Escape($familyMember) -or $crossCheckStrategy -notmatch [regex]::Escape($familyMember)) { return @{ Ok = $false; Message = "prd-feature hook: numeric derivation search does not cover complete family member '$familyMember'." } }
+    }
+    if ($values['Primary Count'] -notmatch '^\d+$' -or $values['Cross-check Count'] -notmatch '^\d+$') { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation counts must be numeric.' } }
+    $primaryMembers = @($values['Primary Member Set'].Split(',') | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    $crossCheckMembers = @($values['Cross-check Member Set'].Split(',') | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    if ([int]$values['Primary Count'] -ne $primaryMembers.Count -or [int]$values['Cross-check Count'] -ne $crossCheckMembers.Count) { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation count does not match its independently enumerated member set.' } }
+    $normalizedPrimaryMembers = @($primaryMembers | ForEach-Object { $_.ToLowerInvariant() } | Sort-Object -Unique) -join '|'
+    $normalizedCrossCheckMembers = @($crossCheckMembers | ForEach-Object { $_.ToLowerInvariant() } | Sort-Object -Unique) -join '|'
+    if ($normalizedPrimaryMembers -ne $normalizedCrossCheckMembers) { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation primary and cross-check member sets disagree.' } }
+    if ($values['Member-set Comparison'] -notmatch '(?i)\b(equal|match|identical)\b') { return @{ Ok = $false; Message = 'prd-feature hook: numeric derivation evidence is missing an explicit member-set comparison.' } }
+    return @{ Ok = $true; Message = $null }
+}
+
+function Test-SpecNumericCriterion {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory = $true)][AllowEmptyString()][string] $SpecContent)
+
+    $section = [regex]::Match($SpecContent, '(?ims)^##\s+Acceptance\s+Criteria\s*$.*?(?=^##\s|\z)')
+    return $section.Success -and [regex]::IsMatch($section.Value, '(?m)^\s*[-*]\s*\[.\].*\b\d+\b')
+}
+
+function Invoke-PrdFeatureOutputValidation {
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param([string] $RawPayload)
+
+    if ([string]::IsNullOrWhiteSpace($RawPayload)) { return @{ Ok = $false; Message = 'prd-feature hook: CLAUDE_HOOK_INPUT is empty.' } }
+    try { $payload = $RawPayload | ConvertFrom-Json -ErrorAction Stop } catch { return @{ Ok = $false; Message = "prd-feature hook: failed to parse CLAUDE_HOOK_INPUT as JSON: $($_.Exception.Message)" } }
+    $output = if ($null -ne $payload.PSObject.Properties['output']) { $payload.output } else { $null }
+    if ([string]::IsNullOrWhiteSpace($output)) { return @{ Ok = $false; Message = 'prd-feature hook: agent output is empty.' } }
+    $specPath = Get-ArtifactPathFromOutput -Output $output -Label 'spec-path'
+    if ([string]::IsNullOrWhiteSpace($specPath) -or -not (Test-Path -LiteralPath $specPath -PathType Leaf)) { return @{ Ok = $false; Message = 'prd-feature hook: spec-path is required and must exist.' } }
+    $specContent = Get-Content -LiteralPath $specPath -Raw -ErrorAction Stop
+    if (-not (Test-SpecNumericCriterion -SpecContent $specContent)) { return @{ Ok = $true; Message = $null } }
+    $researchPath = Get-ArtifactPathFromOutput -Output $output -Label 'research-path'
+    if ([string]::IsNullOrWhiteSpace($researchPath) -or -not (Test-Path -LiteralPath $researchPath -PathType Leaf)) { return @{ Ok = $false; Message = 'prd-feature hook: numeric acceptance criterion requires an existing research-path.' } }
+    return Test-NumericDerivationEvidence -Content (Get-Content -LiteralPath $researchPath -Raw -ErrorAction Stop)
+}
+
+if ($MyInvocation.InvocationName -eq '.') { return }
+$result = Invoke-PrdFeatureOutputValidation -RawPayload $env:CLAUDE_HOOK_INPUT
+if (-not $result.Ok) { Write-Error $result.Message; exit 1 }
+exit 0

package/resources/claude-customizations/.claude/hooks/validate-task-researcher-output.ps1

@@ -161,6 +161,68 @@ function Test-AutomationFeasibilitySection {
     return @{ Ok = $true; Message = $null }
 }
 
+function Test-NumericDerivationEvidence {
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string] $Content
+    )
+
+    $numericClaimPattern = '(?im)^\s*[-*]\s*Numeric\s+spec\.md\s+acceptance\s+criterion:\s*.*\b\d+\b'
+    if (-not [regex]::IsMatch($Content, $numericClaimPattern)) {
+        return @{ Ok = $true; Message = $null }
+    }
+
+    $section = [regex]::Match($Content, '(?ims)^##\s+Numeric\s+Derivation\s+Evidence\s*$.*?(?=^##\s|\z)')
+    if (-not $section.Success) {
+        return @{ Ok = $false; Message = 'task-researcher hook: numeric spec.md acceptance criterion is missing ## Numeric Derivation Evidence.' }
+    }
+
+    $requiredLabels = @(
+        'Complete Family', 'Exhaustive Search Scope', 'Inclusion Rules', 'Exclusion Rules',
+        'Primary Search Strategy or Query Expression', 'Primary Member Set', 'Primary Count',
+        'Cross-check Search Strategy or Query Expression', 'Cross-check Member Set', 'Cross-check Count',
+        'Member-set Comparison'
+    )
+    $values = @{}
+    foreach ($label in $requiredLabels) {
+        $match = [regex]::Match($section.Value, "(?im)^[\t ]*[-*]?[\t ]*$([regex]::Escape($label))[\t ]*:[\t ]*(?<value>\S(?:.*\S)?)[\t ]*$")
+        if (-not $match.Success) { return @{ Ok = $false; Message = "task-researcher hook: numeric derivation evidence is missing $label." } }
+        $values[$label] = $match.Groups['value'].Value.Trim()
+    }
+    if ($values['Exhaustive Search Scope'] -notmatch '(?i)\b(entire|all|complete)\b.*\b(repository|repo|source tree|tree)\b') {
+        return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation evidence does not declare an exhaustive repository search scope.' }
+    }
+    $primaryStrategy = $values['Primary Search Strategy or Query Expression']
+    $crossCheckStrategy = $values['Cross-check Search Strategy or Query Expression']
+    if ($primaryStrategy -match '(?i)\b(single|narrow|named[- ]?pattern)\b' -or $crossCheckStrategy -match '(?i)\b(single|narrow|named[- ]?pattern)\b') {
+        return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation evidence uses a narrow named-pattern search.' }
+    }
+    if ([regex]::Replace($primaryStrategy, '\s+', '').ToLowerInvariant() -eq [regex]::Replace($crossCheckStrategy, '\s+', '').ToLowerInvariant()) {
+        return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation cross-check repeats the primary search strategy or query expression.' }
+    }
+    $familyMembers = @($values['Complete Family'].Split(',') | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    foreach ($familyMember in $familyMembers) {
+        if ($primaryStrategy -notmatch [regex]::Escape($familyMember) -or $crossCheckStrategy -notmatch [regex]::Escape($familyMember)) {
+            return @{ Ok = $false; Message = "task-researcher hook: numeric derivation search does not cover complete family member '$familyMember'." }
+        }
+    }
+    if ($values['Primary Count'] -notmatch '^\d+$' -or $values['Cross-check Count'] -notmatch '^\d+$') { return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation counts must be numeric.' } }
+    $primaryMembers = @($values['Primary Member Set'].Split(',') | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    $crossCheckMembers = @($values['Cross-check Member Set'].Split(',') | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    if ([int]$values['Primary Count'] -ne $primaryMembers.Count -or [int]$values['Cross-check Count'] -ne $crossCheckMembers.Count) {
+        return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation count does not match its independently enumerated member set.' }
+    }
+    $normalizedPrimaryMembers = @($primaryMembers | ForEach-Object { $_.ToLowerInvariant() } | Sort-Object -Unique) -join '|'
+    $normalizedCrossCheckMembers = @($crossCheckMembers | ForEach-Object { $_.ToLowerInvariant() } | Sort-Object -Unique) -join '|'
+    if ($normalizedPrimaryMembers -ne $normalizedCrossCheckMembers) { return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation primary and cross-check member sets disagree.' } }
+    if ($values['Member-set Comparison'] -notmatch '(?i)\b(equal|match|identical)\b') { return @{ Ok = $false; Message = 'task-researcher hook: numeric derivation evidence is missing an explicit member-set comparison.' } }
+
+    return @{ Ok = $true; Message = $null }
+}
+
 function Invoke-TaskResearcherOutputValidation {
     [CmdletBinding()]
     [OutputType([hashtable])]
@@ -209,6 +271,13 @@ function Invoke-TaskResearcherOutputValidation {
         return @{ Ok = $false; Message = $feasibilityResult.Message }
     }
 
+    if (Test-Path -LiteralPath $researchPath -PathType Leaf) {
+        $numericEvidenceResult = Test-NumericDerivationEvidence -Content (Get-Content -LiteralPath $researchPath -Raw -ErrorAction Stop)
+        if (-not $numericEvidenceResult.Ok) {
+            return $numericEvidenceResult
+        }
+    }
+
     return @{ Ok = $true; Message = $null }
 }
 
@@ -223,4 +292,3 @@ if (-not $result.Ok) {
 }
 
 exit 0
-