Chore: Update agents for drm-copilot v1.1.8

.claude/agents/atomic-planner.md

@@ -57,6 +57,8 @@ Generate plans using the atomic plan contract defined in the `atomic-plan-contra
 
 ## Preflight Validation
 
+Before handing the plan to executor preflight, return the exact bounded line record defined in `atomic-plan-contract`, starting with `PLANNER-INTERNAL-REVIEW: PASS` and ending with the required `PREFLIGHT:` signal. The bounded record must include exactly one passing `CITATION-TO-TREE`, `AC-TRACEABILITY`, and `SCOPE-BOUNDARY` declaration; one or more current-tree `CITATION: <repository-relative path> | <locator>` records; one complete unique `AC-INVENTORY:`; one complete `AC-MAPPING: <ID> | IMPLEMENTATION: <identifier> | TESTS: <identifier> | EVIDENCE: <identifier>` for every and only inventory ID; and exactly one `UNRESOLVED-GAPS: NONE`. A missing, duplicate, malformed, failed, blocked, or out-of-bounds record declaration requires `SELF-REVIEW: BLOCKED` and stops handoff.
+
 Return the finalized plan for validation-only preflight through `atomic-executor` and preserve the same target file path across revision loops. Do not claim nested worker delegation from within planner execution.
 
 ## Output

.claude/agents/parallel-orchestrator.md

@@ -89,11 +89,12 @@ reference; it is not invoked on the destination-runtime path. Cohort recoloring
 batching use `compute-cohorts.sh` and `compute-concurrency-batches.sh` under the same allowlist
 entry.
 
-The two `poetry run` grants remain for the repository-local paths that still need an interpreter:
-the checkpoint-validator CLI fallback the skill names in its `## Parallel-Level Checkpoint` section
-is invoked as `poetry run python -m`, and the drift-detection CLI likewise. Both grants stay scoped
-to those two invocation forms only — not to `poetry run` as a whole — so `pytest`, `black`, `ruff`,
-and every other `poetry run` subcommand remain outside the allowlist. The sibling persona
+The `poetry run` grants remain for the repository-local paths that still need an interpreter. The
+skill's `## Parallel-Level Checkpoint` section now validates through
+`mcp__drm-copilot__validate_orchestration_artifacts`, so exactly one named consumer is left: the
+drift-detection CLI, invoked as `poetry run python -m`. Each grant stays scoped to its own
+`poetry run python` invocation form — not to `poetry run` as a whole — so `pytest`, `black`,
+`ruff`, and every other `poetry run` subcommand remain outside the allowlist. The sibling persona
 `.claude/agents/parallel-planner.md` records the same destination-runtime posture.
 
 ## Startup Protocol

.claude/agents/parallel-planner.md

@@ -17,6 +17,7 @@ tools:
   - "Bash(bash .claude/lib/bash/compute-cohorts.sh*)"
   - "Bash(bash .claude/lib/bash/compute-concurrency-batches.sh*)"
   - "Bash(bash .claude/lib/bash/validate-parallel-manifest.sh*)"
+  - "Bash(bash .claude/lib/bash/report-lane-assertion.sh*)"
   - "mcp__drm-copilot__validate_orchestration_artifacts"
 skills:
   - policy-compliance-order
@@ -148,19 +149,24 @@ plan a parallel run.
 relation come from `.claude/lib/blast-radius/BlastRadius.psm1`:
 
 ```powershell
-Import-Module .claude/lib/blast-radius/BlastRadius.psm1 -Force
+$repoRoot = git rev-parse --show-toplevel
+Import-Module (Join-Path $repoRoot '.claude/lib/blast-radius/BlastRadius.psm1') -Force -ErrorAction Stop
 ```
 
+The default PowerShell 5.1 execution policy blocks `Import-Module` of a `.psm1` file, so `pwsh` is
+mandatory here.
+
 The facade exports `Get-PlanPaths`, `Get-BlastRadius`, `Get-BlastRadiusFromObservedPaths`,
 `Test-BlastRadius`, and `Test-BlastRadiusConflict`. Its truth table is
 `config/blast-radius.json`, which push-down publishes alongside `.claude`.
 
 **Cohort seeding and concurrency batching — bash entry points.** The bash library is granted as
-three entry-point-specific allowlist entries — `"Bash(bash .claude/lib/bash/compute-cohorts.sh*)"`,
-`"Bash(bash .claude/lib/bash/compute-concurrency-batches.sh*)"`, and
-`"Bash(bash .claude/lib/bash/validate-parallel-manifest.sh*)"` — one per command-line entry point.
-The six sourceable libraries carry no grant because they are never invoked directly. The two
-commands below require the first two of those entries:
+four entry-point-specific allowlist entries — `"Bash(bash .claude/lib/bash/compute-cohorts.sh*)"`,
+`"Bash(bash .claude/lib/bash/compute-concurrency-batches.sh*)"`,
+`"Bash(bash .claude/lib/bash/validate-parallel-manifest.sh*)"`, and the entry for
+`.claude/lib/bash/report-lane-assertion.sh` declared in this persona's `tools:` list — one per
+command-line entry point. The seven sourceable libraries carry no grant because they are never
+invoked directly. The two commands below require the first two of those entries:
 
 ```bash
 bash .claude/lib/bash/compute-cohorts.sh --keys "<k1> <k2> ..." --edges "<a>:<b> ..."
@@ -176,11 +182,22 @@ bash .claude/lib/bash/validate-parallel-manifest.sh --print-mode <manifest-path>
 bash .claude/lib/bash/validate-parallel-manifest.sh --print-max-concurrency <manifest-path>
 ```
 
+**Lane assertion — bash entry point.** The entry-point grant for
+`.claude/lib/bash/report-lane-assertion.sh` covers:
+
+```bash
+bash .claude/lib/bash/report-lane-assertion.sh --manifest <manifest-path> --edges "<a>:<b> ..."
+```
+
+The diagnostic is advisory only. It never blocks the run, never modifies or suppresses a derived
+edge, never feeds cohort computation, and always exits 0, including when it reports disagreements.
+
 **Python modules are the repository authority, not the runtime path.**
 `scripts/dev_tools/compute_blast_radius.py`, `scripts/dev_tools/parallel_cohort_computation.py`,
 and `scripts/dev_tools/parallel_manifest_contract.py` remain the reference implementations that the
 ported libraries are asserted against by shared fixture corpora. Do not invoke them on the
 destination-runtime path; cite them for their contract.
 
 The `"Bash(poetry run *)"` allowlist entry is retained for the repository-local paths that still
-need it — it is not required by any step above.
+need a Python interpreter. The four bash entry points above and the PowerShell blast-radius facade
+run without it, so no destination-runtime step depends on that grant.

.claude/agents/prd-feature.md

@@ -16,6 +16,8 @@ hooks:
       hooks:
         - type: command
           command: pwsh -NoProfile -File .claude/hooks/validate-required-artifact-output.ps1 -AgentName prd-feature -RequiredArtifact 'spec-path|^docs/features/active/.+/spec\.md$|feature spec artifact' -RequiredArtifact 'user-story-path|^docs/features/active/.+/user-story\.md$|feature user story artifact'
+        - type: command
+          command: pwsh -NoProfile -File .claude/hooks/validate-prd-feature-output.ps1
 ---
 
 # PRD Feature Agent
@@ -27,12 +29,15 @@ Produce feature-document outputs for the active feature folder.
 - `docs/features/active/<feature>/spec.md`
 - `docs/features/active/<feature>/user-story.md`
 
+When an approved `spec.md` acceptance criterion contains a numeric count, enumeration, or population, require the supplied research record to include complete `## Numeric Derivation Evidence`: `Complete Family`, `Exhaustive Search Scope`, `Inclusion Rules`, `Exclusion Rules`, `Primary Search Strategy or Query Expression`, `Primary Member Set`, `Primary Count`, `Cross-check Search Strategy or Query Expression`, `Cross-check Member Set`, `Cross-check Count`, and `Member-set Comparison`. The two derivations must be non-empty, independently constructed, use distinct search strategies or query expressions, independently enumerate member sets, and explicitly compare those sets. The exhaustive scope must cover the complete family, including all relevant overloads and members. Omit the numeric assertion when the record is missing, repeated, incomplete, non-exhaustive, narrow, or disagrees; equal totals, distinct query text, or equal member sets alone are insufficient.
+
 ## Output Reporting
 
 Report the final artifact paths as:
 
 - `spec-path: docs/features/active/<feature>/spec.md`
 - `user-story-path: docs/features/active/<feature>/user-story.md`
+- `research-path: docs/features/active/<feature>/research/<timestamp>-<short-name>-research.md` when numeric acceptance criteria are present
 
 ## Evidence Location Invariant
 

.claude/agents/task-researcher.md

@@ -64,6 +64,8 @@ The orchestrator resolves which root to use from whether an active feature folde
 ### 4. Requirements Mapping
 
 - Map acceptance criteria into a concrete design with proposed state model, transitions, and required file changes.
+- Before a numeric count, enumeration, or population can be proposed for an approved `spec.md` acceptance criterion, add a complete `## Numeric Derivation Evidence` section. For each numeric claim, record `Complete Family`, `Exhaustive Search Scope`, `Inclusion Rules`, `Exclusion Rules`, `Primary Search Strategy or Query Expression`, `Primary Member Set`, `Primary Count`, `Cross-check Search Strategy or Query Expression`, `Cross-check Member Set`, `Cross-check Count`, and `Member-set Comparison`.
+- The primary and cross-check records must both be non-empty, independently enumerate their member sets, and name distinct search strategies or query expressions. The exhaustive scope must cover the complete family, including every relevant overload or member; a single grep or query that matches only one named pattern in the declared family is insufficient even if it yields the same count. Explicitly compare the normalized primary and cross-check member sets before proposing the numeric assertion. Withhold the assertion if either record is missing, incomplete, duplicated, non-exhaustive, narrow, or disagrees.
 
 ### 5. Testing Implications
 
@@ -75,6 +77,7 @@ The orchestrator resolves which root to use from whether an active feature folde
 - Ground all findings in verified evidence.
 - Keep discussion of non-selected approaches brief.
 - Do not claim nested worker delegation.
+- Do not present a numeric `spec.md` acceptance criterion when the required numeric derivation evidence is absent, incomplete, or has disagreeing counts.
 
 ## Evidence Location Invariant
 

.claude/hooks/enforce-orchestration-preimplementation-gate-modes.ps1

@@ -267,7 +267,7 @@ function Find-OrchestrationDelegationIssueNumber {
 
     if (-not $Prompt) { return $null }
 
-    $keyed = [regex]::Match($Prompt, 'issue[_-]?num(?:ber)?\s*[:=]\s*#?(\d+)', 'IgnoreCase')
+    $keyed = [regex]::Match($Prompt, 'issue(?:[_-]?num(?:ber)?|\s+number)\s*[:=]\s*#?(\d+)', 'IgnoreCase')
     if ($keyed.Success) { return $keyed.Groups[1].Value }
     $hashForm = [regex]::Match($Prompt, '(?:^|\s)#(\d+)\b')
     if ($hashForm.Success) { return $hashForm.Groups[1].Value }
@@ -344,14 +344,17 @@ function Find-OrchestrationModeRecord {
     )
 
     if ($null -eq $Records) { return $null }
-    foreach ($record in @($Records)) {
-        if ($null -eq $record) { continue }
-        if ($TargetFolder) {
+    if ($TargetFolder) {
+        foreach ($record in @($Records)) {
+            if ($null -eq $record) { continue }
             $folder = Get-OrchestrationModeString -Value $record -Name 'feature_folder'
             $basename = Get-OrchestrationModeFolderBasename -Path $folder
             if ($basename -and $basename -eq $TargetFolder) { return $record }
         }
-        if ($IssueNumber) {
+    }
+    if ($IssueNumber) {
+        foreach ($record in @($Records)) {
+            if ($null -eq $record) { continue }
             $issue = Get-OrchestrationModeString -Value $record -Name 'issue_num'
             if ($issue -and $issue -eq $IssueNumber) { return $record }
         }