📄 CodeRabbit inference engine (.agents/security/infrastructure-file-patterns.md)

PowerShell scripts in scripts directory (scripts/**/*.ps1) should trigger security agent review due to high security implications

Validation scripts belong in scripts/ directory; may duplicate to .agents/utilities/ for agent access

All scripts must avoid credential handling and should not store or process sensitive authentication information

scripts/**/*.ps1: Validate parameter null checks for mandatory parameters in PowerShell scripts
Verify error handling uses ErrorActionPreference Stop or -ErrorAction Stop in PowerShell scripts
Check LASTEXITCODE validation after external process calls in PowerShell scripts
Flag hardcoded values that should be parameters in PowerShell scripts
Verify fail-safe defaults in PowerShell scripts (exit 0 on success, non-zero on failure)

scripts/**/*.ps1: Use text-based status indicators instead of emojis: [PASS], [FAIL], [WARNING], [SKIP], [RUNNING] to maintain consistency with DevOps style guide
Respect the NO_COLOR environment variable in validation scripts - disable color output in CI environments automatically or when NO_COLOR=1 is set
Provide actionable fix suggestions for each validation failure in the format: error message, specific steps to fix, and reference to documentation
Use specific exit codes in validation scripts: 0 for PASS, 1 for FAIL, 2 for ERROR (environment or configuration issues)

scripts/**/*.ps1: Use git diff --cached --quiet for querying Git index state (Exit 0 = no staged changes, Exit 1 = staged changes exist) to ensure cross-platform compatibility between Linux and Windows runners
Implement conditional commit logic that skips commits when no staged changes exist, while preserving exception throwing for actual merge failures
Log INFO-level messages when skipping commits due to no staged changes to provide visibility into conditional code path execution
Extract repeated conditional merge/commit logic into helper functions to reduce code duplication across multiple code paths (e.g....

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-15-cva-install-scripts.md)

Extract environment variations to .psd1 data files, keeping logic generic rather than hardcoding configuration in scripts

Convert PathInfo objects to string representations when passing to string-typed parameters to prevent type mismatch errors

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-15-documentation-gap.md)

Create module-specific README documentation for PowerShell scripts and modules, including parameter documentation and usage examples

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-15-install-scripts-session.md)

Use BeforeAll blocks for all variable initialization in Pester 5.x tests; avoid variable assignments outside BeforeAll during Discovery phase

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-15-instruction-files-gap.md)

User instruction files should be excluded from agent file copying during installation to prevent them from being treated as agent files

Use .Path property to extract string value from PathInfo objects returned by Resolve-Path in PowerShell (e.g., (Resolve-Path $Path).Path instead of Resolve-Path $Path)

PowerShell scripts should normalize output line endings (convert CRLF to LF) when output is intended to be processed by shell commands like grep to ensure cross-platform compatibility

Use -cmatch instead of -match when pattern requires case-sensitive matching in PowerShell validation scripts (e.g., EPIC vs epic for naming conventions)

**/*.ps1: In PowerShell script scope, use exit with explicit exit codes instead of return; return exits with code 0 regardless of boolean value
Document the bash-PowerShell exit code contract explicitly in PowerShell script comments: exit code 0 means success, non-zero means failure

When combining ShouldProcess with PassThru in PowerShell cmdlets: always provide explicit return value in else branch when ShouldProcess returns false

Before executing any PowerShell generation script, audit its code for alignment with known user requirements and identify dead/unused functions

**/*.ps1: Create regression tests for PowerShell scripts covering wildcard character detection, path resolution correctness, and edge cases when fixing path handling logic
In PowerShell, validate wildcard detection logic by distinguishing between literal wildcard characters (? and *) vs. actual wildcard patterns, using the -like operator correctly with character class escaping (e.g., *[?]* instead of *?*)

**/*.ps1: Before implementing features search for pre-existing test coverage
When tests pre-exist run them first to understand feature expectations
Use deep cloning to preserve source data integrity when transforming configurations
Use regex with exact match anchors (^...$) to prevent partial matches in configuration transformations
Up...

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

⚙️ CodeRabbit configuration file

**/*.ps1: ## PowerShell Review Criteria

P0 (Must Fix)

• CWE-78: Invoke-Expression with user input
• CWE-20: Missing [ValidateScript()] on external input
• CWE-22: Path concatenation without normalization
• Hardcoded secrets

P1 (Should Fix)

• Missing error handling
• Functions > 60 lines

Skip

• Test coverage (Pester handles)
  Prefix all comments with: [P0], [P1], or [P2]

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-15-instruction-files-gap.md)

Verify that all files referenced in installer configuration (InstructionsFile, SourceDir, etc.) exist in their expected locations before release

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/roadmap/epic-agent-consolidation.md)

Build script must generate platform-specific YAML frontmatter for VS Code and Copilot CLI variants at build time

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/qa/047-test-pollution-fix-verification.md)

**/*.Tests.ps1: Add BeforeEach cleanup block to Pester test contexts to prevent test pollution between tests
Use BeforeAll block in Pester tests to create isolated temp directories for test execution
Use AfterAll block in Pester tests to clean up and remove temp directories after all tests complete
Clean temp test directory using Get-ChildItem -Recurse | Remove-Item -Force pattern with -ErrorAction SilentlyContinue to safely remove test artifacts
Verify test isolation through file count assertions in Pester tests to detect if previous test files remain

Pre-compute collections before Pester hashtable initialization; pipeline operators inside hashtable index expressions are not supported

**/*.Tests.ps1: Include $LASTEXITCODE assertion tests in Pester test suites for PowerShell scripts invoked from bash hooks to validate exit code contracts
Verify that Pester tests for PowerShell scripts check both internal logic and external exit code behavior when scripts are executed from bash contexts

**/*.Tests.ps1: PowerShell cmdlets with 2+ switch parameters require combination testing: n parameters = n individual + C(n,2) pair tests minimum
Integration tests must include first-time setup scenario where config files don't exist yet
Organize PowerShell Pester test files with contexts for: Basic Functionality, Error Handling, Parameter Combinations, and Edge Cases

**/*.Tests.ps1: Use Pester test isolation pattern with BeforeAll, AfterAll, and BeforeEach blocks when creating file system-based tests in PowerShell
Achieve 100% branch coverage and 80%+ edge case coverage for wildcard detection and path resolution tests, with execution time under 5 seconds
For file system-based tests in PowerShell, use temp directory isolation with proper cleanup in BeforeAll/AfterAll blocks to prevent test pollution and ensure test repeatability

Pester test files must follow the AAA (Arrange-Act-Assert) pattern and use mocking for dependencies with behavior verification as docum...

Files:

• scripts/tests/Validate-Session.Tests.ps1

⚙️ CodeRabbit configuration file

**/*.Tests.ps1: ## Pester Test Review Criteria

P0 (Must Fix)

• Tests modifying global state without cleanup
• Hardcoded paths (use $PSScriptRoot)

P1 (Should Fix)

• Non-descriptive test names

Skip

• Coverage percentage (Pester handles)
  Prefix all comments with: [P0], [P1], or [P2]

Files:

• scripts/tests/Validate-Session.Tests.ps1

📄 CodeRabbit inference engine (.agents/retrospective/phase1-remediation-pr43.md)

Use relative paths only in documentation and configuration files; avoid absolute paths (e.g., C:\ on Windows) to prevent environment contamination and maintain cross-platform portability

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/phase1-remediation-pr43.md)

**/*Validate*.{ps1,py,sh,js,ts}: Create validation scripts that distinguish between intentional code examples/anti-patterns and production code (e.g., by detecting and skipping code fence blocks) to prevent false positives
Validation scripts should include pedagogical error messages that teach the standard (not just report violations), with references to documentation, examples of correct patterns, and remediation steps

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/pr-feedback-remediation.md)

Create Pester tests following 5.x structure with test cases covering Pattern Detection, File Filtering, Exit Code Behavior, Reporting, and Edge Cases for validation scripts

Create Pester tests for error handling paths in skill scripts (e.g., skill-*.ps1) to verify graceful failure handling

**/tests/**/*.Tests.ps1: Remove hardcoded hashtable tests and replace with integration tests using mocked gh CLI
Achieve greater than 70% code coverage in Pester tests
Include critique recommendations for integration tests and cross-platform verification in Pester test reviews

Files:

• scripts/tests/Validate-Session.Tests.ps1

📄 CodeRabbit inference engine (.agents/analysis/002-project-constraints-consolidation.md)

Use .claude/skills/github/ scripts for GitHub operations. NEVER use raw gh commands directly.

**/*.{ps1,psm1}: All PowerShell scripts (.ps1, .psm1) must include corresponding Pester test files (.Tests.ps1) with test coverage
PowerShell modules should use type safety, object pipelines, and structured error handling rather than string-based output

**/*.{ps1,psm1}: Use PowerShell regex pattern ^[a-zA-Z0-9][a-zA-Z0-9 _\-\.]{0,48}[a-zA-Z0-9]?$ for GitHub label validation to allow spaces in labels
All GitHub label validation must reject empty strings, accept single characters only if alphanumeric, reject newlines and tabs, enforce maximum 50 character limit per GitHub's specifications, and allow spaces in label names
Document all regex edge cases including empty string rejection, single character handling, newline/tab rejection, and character limit rationale in PowerShell code comments

MUST use PowerShell for all scripting (.ps1, .psm1)

**/*.{ps1,psm1}: Sanitize all values written to $env:GITHUB_OUTPUT by escaping newlines and special characters to prevent injection of arbitrary output variables
Quote label names in gh commands or reject spaces in label validation patterns to prevent shell word-splitting attacks
Use UNC path normalization with Resolve-Path in Test-SafeFilePath to prevent bypass via UNC paths like \?\C:\ or \server\share
Implement atomic label create-or-update operations using gh label create with --force flag to prevent TOCTOU race conditions
Add command-level timeouts to individual gh CLI commands using timeout command or PowerShell Start-Process -Timeout to prevent workflow hangs
Sanitize API error messages before logging to prevent leaking secrets, internal URLs, or sensitive information from GitHub API responses
Use explicit parameters (e.g., -ThrowInstead switch) to control error handling behavior instead of environment variable detection to ensure consistent behavior across environments
Validate AI output is well-formed JSON and pa...

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/analysis/003-session-protocol-skill-gate.md)

Validate skill availability before implementing GitHub operations - Check if .claude/skills/github/ directory exists and contains the required capability; list available GitHub skill scripts; read the skill-usage-mandatory memory; document available skills in session log; use existing skills if they exist rather than writing inline code

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/analysis/003-session-protocol-skill-gate.md)

NEVER use raw gh commands (like gh pr view, gh issue create, gh api) when a Claude skill exists for that functionality - Always use the tested skill scripts from .claude/skills/github/ instead of writing inline commands

**/*.{ps1,yml,yaml}: Use atomic gh label create $label --force operation instead of separate check + create steps to prevent TOCTOU race conditions
Implement all 4 mandatory Phase 1 security hardening conditions (label creation atomicity, auth check always-run, GITHUB_OUTPUT sanitization, debug file path randomization) before merge approval

Do not hardcode branch references in scripts and workflows; use dynamic branch detection or configuration

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/analysis/004-pr-60-gap-coverage-validation.md)

Add explicit exit code checks for npm and GitHub CLI commands instead of using || true error suppression patterns

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/analysis/004-pr-60-gap-coverage-validation.md)

Generate unique temporary directories for each workflow run using timestamped or UUID-based naming to prevent directory collision

Ensure authentication checks always run and are not skipped by conditional logic in diagnostics mode - remove or restructure conditions that bypass authentication

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/critique/004-pr-60-remediation-final-validation.md)

All test cases must pass before PR merge; implement blocking acceptance gate for 7 mandatory Pester injection tests (5 for labels, 2 for milestone) as required criteria

Files:

• scripts/tests/Validate-Session.Tests.ps1

📄 CodeRabbit inference engine (.agents/planning/PR-60/006-agent-validation-sign-offs.md)

Align all PowerShell implementations with ADR-005 (PowerShell-only requirement) and ADR-006 (thin workflows principle) to maintain architecture coherence

Add rate limiting for label operations to prevent DoS of GitHub API quota by capping the maximum number of labels per issue

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/planning/PR-60/006-agent-validation-sign-offs.md)

Establish daily test execution gate requiring all Pester tests to PASS with exit code 0 before proceeding to next implementation phase

Files:

• scripts/tests/Validate-Session.Tests.ps1

📄 CodeRabbit inference engine (.agents/planning/PR-60/007-phase-1-detailed-schedule.md)

Verify exit code after each critical command (gh issue edit, npm install) in PowerShell workflows and scripts

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/planning/PR-60/007-phase-1-detailed-schedule.md)

Remove or justify all '|| true' patterns in PowerShell scripts and workflows to prevent silent failures

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/planning/PR-60/007-phase-1-detailed-schedule.md)

Replace 'exit 1' with 'throw' statements in PowerShell modules and scripts for proper exception handling

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/planning/phase3-complete-handoff.md)

Use case-sensitive regex matching (-cmatch) instead of case-insensitive (-match) for naming convention validation in PowerShell

Pre-commit hook validation scripts must follow the error message template: WHAT HAPPENED, WHY IT MATTERS, HOW TO FIX (numbered steps)

Implement CWE-78 (OS Command Injection) and CWE-22 (Path Traversal) mitigations in validation scripts that process file paths and execute system commands

Extend existing validation framework (Validate-MemoryIndex.ps1) rather than replacing it when adding new validation logic

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/planning/pr-60-implementation-plan.md)

Add test cases for security vulnerabilities including code injection prevention scenarios, malformed input handling, and edge cases in critical paths

Files:

• scripts/tests/Validate-Session.Tests.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-18-serena-memory-reference-migration.md)

Search entire codebase for pattern before migration to identify all references

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/security/SR-PR60-implementation-review.md)

Use unique, secured temporary file paths with random identifiers and cleanup logic instead of hardcoded predictable paths like /tmp/categorize-output.txt

Validate date format with regex pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ before performing date comparisons to ensure YYYY-MM-DD format compliance

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-18-session-28-pr-60-qa-strategy.md)

Use Mock with endpoint pattern matching and mode switching (Success, ApiError, NotFound, Unauthenticated) for realistic gh CLI API mocking across test files

Files:

• scripts/tests/Validate-Session.Tests.ps1

📄 CodeRabbit inference engine (scripts/AGENTS.md)

All PowerShell test files must use Pester framework and cover the corresponding script/module functions

Files:

• scripts/tests/Validate-Session.Tests.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-19-skill-extraction-summary.md)

Use identical syntax for all instances when migrating patterns to maintain consistency

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-20-pr-94-acknowledgment-failure.md)

PowerShell script failure requires immediate gh CLI fallback attempt (dual-path tooling for GitHub operations)

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-20-session-43-qa-validation-pr147.md)

Use regex patterns with single-line mode flag (?s) for multi-line matching in YAML comment extraction

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/critique/047-pr-212-retrospective-critique.md)

Use ([pattern])? instead of [pattern]? for optional trailing groups in regex to ensure correct optional behavior and prevent special character bypass

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-20-pr-212-comment-response.md)

Use atomic optional groups ([pattern])?$ instead of [pattern]?$ for optional trailing characters in regex validation to prevent special character bypass

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-20-session-01.md)

Verify regex validation patterns in security remediation code

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-21-session-53-pr212-security-continuation.md)

Transform validation error messages into 5-word activation prompts that trigger correct behavior

Use gh api --paginate flag when fetching sweep jobs to handle pagination in GitHub CLI commands

Flag unquoted PowerShell/bash parameter expansion for CWE-78 (Command Injection) vulnerability detection

All external command exit codes must be explicitly checked and handled, with errors failing closed not open

For PowerShell scripts on Windows, use native gh CLI directly instead of PowerShell wrappers to minimize spawn overhead

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-21-session-57-pr-222-review-response.md)

Include the -Force flag when using Import-Module to ensure module reload and prevent stale module state

Use PowerShell exclusively for implementation; avoid bash and Python in critical workflows

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/planning/prd-visual-studio-install-support.md)

Add unit tests in scripts/tests/ directory for new Visual Studio configuration entries and installation workflows

Files:

• scripts/tests/Validate-Session.Tests.ps1

📄 CodeRabbit inference engine (.agents/archive/HANDOFF-2025-12-22.md)

Document all ADR (Architecture Decision Record) references in code comments and commit messages using 'ADR-NNN' format

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-22-pr-249-comprehensive-retrospective.md)

Safety modes must default to ON (fail-safe) when input is empty or missing, never to fail-open

Implement fail-safe defaults for empty inputs instead of fail-open logic in workflows and scripts

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-22-pr-249-comprehensive-retrospective.md)

Parameterize branch references instead of hardcoding values like 'main' in workflow scripts and automation code

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-22-session-67-pr-249-review-response.md)

{**/.github/workflows/*.yml,**/*.ps1}: Default dry_run to true when inputs.dry_run is empty to prevent DryRun bypass for scheduled GitHub Actions runs
Allow protected branch checks to pass when GITHUB_ACTIONS=true to prevent CI workflow failures

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-22-session-69-pr-249-p2-fixes.md)

Use jq aliasing pattern (e.g., field: .sourceField) to create property aliases for cleaner downstream code consumption

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-22-session-73-skillbook-pr-249.md)

Detect CI vs local execution environments using GITHUB_ACTIONS environment variable to conditionally apply CI-specific logic

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-22-session-73-skillbook-pr-249.md)

Parameterize branch references instead of hardcoding branch names (e.g., main) to enable flexibility across different branches

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-20-sessions-40-41-comprehensive.md)

Reject any PR with external shell scripts or PowerShell scripts (.sh, .ps1) used for agent pattern detection, routing, or decision logic. All such patterns must be documented as skills in memory with >85% atomicity.

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/analysis/001-workflow-validation-shift-left-analysis.md)

All PowerShell validation scripts in build/scripts/ and scripts/ directories must support cross-platform execution using PowerShell Core (pwsh) with no Windows-only dependencies.

Ensure PowerShell Core cross-platform support in all validation and build scripts

{scripts,build/scripts}/**/*.ps1: PowerShell scripts in the scripts/ and build/scripts/ directories must follow the unified validation runner pattern from scripts/Validate-PrePR.ps1
Use PowerShell Core 7+ as the scripting standard for all build and validation scripts

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-24-memory-split-failure.md)

Validation scripts must check both format correctness and output completeness, including file count and index consistency

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-23-session-62-velocity-analysis.md)

Run Invoke-PesterTests.ps1 locally before pushing code to prevent test failures

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-23-session-85-velocity-analysis.md)

Add pre-commit linting for style issues to catch problems before code review

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-23-session-86-workflow-validation-research.md)

**/{build,scripts}/**/*.ps1: PowerShell validation scripts should use cross-platform pwsh core for execution and include local developer documentation in comments
Validation scripts must be idempotent and produce standardized verdict outputs using vocabulary: PASS, WARN, FAIL, CRITICAL_FAIL, REJECTED

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-25-pr-395-copilot-swe-failure-analysis.md)

Detect and reject breaking API changes such as function signature modifications (e.g., changing function parameters from boolean to hashtable) without explicit approval

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/architecture/ADR-019-script-organization.md)

Use Validate-*.ps1 naming convention for validation scripts in scripts/ directory that enforce protocols, consistency checks, and session-end validation

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/devops/QUICK-REFERENCE.md)

**/*.{graphql,gql,ps1}: Verify that GraphQL query depth does not exceed 12 levels
Maintain GraphQL response size under approximately 1MB limit
Keep individual GraphQL query size under approximately 10KB

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/qa/test-coverage-Test-PRHasFailingChecks.md)

Maintain comprehensive code path and edge case coverage at 90%+ for the Test-PRHasFailingChecks function, with specific focus on testing all statusCheckRollup states, CheckRun conclusions, and StatusContext states documented in GitHub API

Files:

• scripts/tests/Validate-Session.Tests.ps1

📄 CodeRabbit inference engine (.agents/qa/test-coverage-summary.md)

**/scripts/**/*.Tests.ps1: Add test coverage for EXPECTED state in statusCheckRollup - should return false when state is EXPECTED
Add test coverage for StatusContext ERROR state - should return true when StatusContext state is ERROR
Add test coverage for mixed CheckRun and StatusContext types in the same contexts array
Add PSObject compatibility test using ConvertFrom-Json to verify Get-SafeProperty works with both hashtables and PSObjects
Add integration tests that mock gh api GraphQL responses and verify end-to-end behavior with JSON parsing and PSObject conversion

Files:

• scripts/tests/Validate-Session.Tests.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-26-session-90-pr453-security-qa.md)

**/*Test*.ps1: Test-SafeBranchName must reject command injection attack strings (semicolon, pipe, backtick), git option injection (--), path traversal (..), variable expansion ($), background execution (&), control characters, and git special characters (~, ^, :)
Achieve comprehensive test coverage for security fixes including positive cases (valid branch names), negative cases (attack strings), and edge cases in behavioral tests

Maintain unit test coverage of 100% for CI check verification functions with test cases covering nulls, PSObjects, hashtables, mixed check states, and edge cases

Files:

• scripts/tests/Validate-Session.Tests.ps1

📄 CodeRabbit inference engine (.agents/planning/session-85-pr-review-improvements.md)

**/*.{sh,ps1,pwsh}: Verify PR merge state using GraphQL API before starting review work - use gh api graphql to check merged field, as gh pr view --json state may return stale data for recently merged PRs
Use GraphQL mutation aliases for batch thread resolution (e.g., t1:, t2:, t3:) to resolve multiple review threads in a single API call instead of making N separate calls
Verify that replying to a review comment does NOT automatically resolve the thread - a separate GraphQL mutation call using resolveReviewThread is REQUIRED
Use exit codes consistently in PR verification scripts: 0=Not merged (safe to proceed), 1=Merged (skip review work), 2=Error
Include Skill-PR-Review-007 reference in code comments when implementing PR merge state verification to document the lesson learned from Session 85
Document GraphQL queries in scripts with comments explaining why GraphQL is used (e.g., 'source of truth' vs stale REST API responses) to educate future maintainers
When querying GitHub GraphQL for PR state verification, include all relevant fields (state, merged, mergedAt, mergedBy) to enable comprehensive validation and prevent false positives

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-22-session-65-pr-255-learnings.md)

Tests should be separated into CI validation directories and not included in skill execution paths

Files:

• scripts/tests/Validate-Session.Tests.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-22-session-65-pr-255-learnings.md)

Files longer than 100 lines should include a table of contents

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (AGENTS.md)

PowerShell unit tests for installation scripts should be located in scripts/tests/ and run using the reusable test runner at build/scripts/Invoke-PesterTests.ps1

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/critique/468-phase1-pr-size-resilience-critique.md)

Maintain consistent variable naming patterns across PowerShell and Bash contexts, even though implementation details differ (e.g., $env:GITHUB_REPOSITORY in PowerShell vs $GH_REPO in Bash)

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-28-session-critic-468-review.md)

{.github/workflows/*.yml,**/*.psm1,**/*.ps1}: Enable pagination when using GitHub REST API to list PR files to handle PRs with more than 100 files
Use the GitHub files API endpoint format gh api "repos/$REPOSITORY/pulls/$PR_NUMBER/files" --paginate --jq '.[].filename' for fetching changed files in pull requests

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-28-session-01-issue-348-review.md)

Use $env:GITHUB_BASE_REF instead of ${{ github.base_ref }} for runtime evaluation in GitHub Actions workflows

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-30-session-103-pr-568-review.md)

PowerShell examples that build GraphQL queries must use GraphQL variables with gh api graphql -f (for string parameters) and -F (for integer/other type parameters) instead of string interpolation to prevent code injection attacks

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-30-session-103-pr-568-review.md)

Avoid direct variable interpolation in GraphQL queries; use GraphQL variable declarations with proper type annotations (e.g., query($owner: String!, $repo: String!, $number: Int!)) and pass variables via CLI flags instead

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/analysis/session-export-analysis-2025-12-30.md)

Maintain pre-commit and CI validation parity - ensure pre-commit hooks and CI validation scripts check the same requirements to prevent PRs passing locally but failing in CI

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/analysis/session-export-analysis-2025-12-30.md)

Add pre-commit validation regression tests to ensure validation scripts stay synchronized with protocol evolution and prevent gaps like the Session Protocol Validation failure pattern

Files:

• scripts/tests/Validate-Session.Tests.ps1
• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/planning/phase3-complete-handoff.md)

All validation scripts must include comprehensive Pester tests in scripts/tests/ directory

Files:

• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/sessions/2025-12-18-session-21-check-skill-exists.md)

PowerShell scripts must support -Operation, -Action, and -ListAvailable parameters with ValidateSet constraint for valid operations

Document exit code semantics in scripts used by CI/CD workflows to clarify expected behavior (success vs. fatal error) to GitHub Actions

Files:

• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-20-session-protocol-mass-failure.md)

PowerShell validation scripts for session protocol compliance must validate exact template format matching and all MUST requirements checked; non-compliance returns exit code 1 for pre-commit hook blocking

scripts/Validate-*.ps1: Implement -Quick flag in validation scripts to skip slow validations (path normalization, planning artifacts, agent drift detection) for rapid iteration during development
Use exit codes: 0 for PASS, 1 for FAIL, 2 for environment errors in PowerShell validation scripts
Implement color output with NO_COLOR environment variable support in validation scripts for CI-friendly output
Use clear status indicators [PASS], [FAIL], [WARNING] and quantified metrics (validation time, pass/fail counts) in validation script output
Provide helpful error messages with fix suggestions in validation script failures
Use fail-fast mode by default in validation runners (stop on first failure) unless -ContinueOnError flag is specified
Detect session logs from latest file in .agents/sessions/ directory for session validation in Validate-PrePR.ps1
Implement -Verbose flag in validation scripts for detailed output during troubleshooting

scripts/Validate-*.ps1: Reuse existing Validate-SessionEnd.ps1 script for session log validation instead of creating new Validate-PrePR.ps1, as the production-ready script already exists with test coverage
Document all validation scripts with examples of bypass mechanisms, expected failure modes, and developer remediation steps to reduce support burden and improve adoption

scripts/Validate-*.ps1: Pre-PR session protocol validation script MUST exit with code 0 on PASS, 1 on FAIL, 2 on ERROR, and validate all MUST requirements from SESSION-PROTOCOL.md
All validation scripts MUST follow PowerShell best practices per ADR-005 and include Pester test coverage
All error messages in validation scripts MUST follow the pattern: WHAT HAPPENED → WHY IT MATTERS → HOW TO FIX (pedagogical error messages per Skill-Validation-002)

Files:

• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/analysis/001-workflow-validation-shift-left-analysis.md)

{scripts,build/scripts}/Validate-*.ps1: All validation scripts must use exit codes: 0 for PASS, 1 for FAIL (protocol/validation violation), 2 for FAIL (usage/environment error) to enable consistent CI/local execution.
All validation scripts must provide consistent output formatting to enable unified validation runner integration and easier troubleshooting.

Files:

• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/analysis/investigation-session-patterns-analyst-report.md)

scripts/Validate-Session.ps1: Investigation-only sessions on code branches can use 'SKIPPED: investigation-only' evidence pattern without requiring QA reports, provided the session made zero code changes and git staging area is empty at commit time
For investigation-only sessions, add validation check to verify git diff --cached --name-only must be empty at commit time before allowing the 'SKIPPED: investigation-only' evidence pattern

scripts/Validate-Session.ps1: Use case-insensitive pattern matching for 'SKIPPED: investigation-only' evidence marker in session Evidence field
Sessions claiming 'SKIPPED: investigation-only' may ONLY have these paths staged: .agents/sessions/, .agents/analysis/, .agents/retrospective/, .serena/memories/, and .agents/security/
Implementation files not allowed in investigation-only sessions include: .agents/planning/, .agents/architecture/, .agents/qa/, .github/, .claude/agents/, .github/agents/, src/, scripts/, and *.ps1 files
Implement staged-file allowlist verification in Validate-Session.ps1 to prevent investigation-only claims for sessions with implementation artifacts
Add metrics counter in Validate-Session.ps1 to track investigation-only skip counts for monitoring and verification

scripts/Validate-Session.ps1: When QA skip evidence matches 'SKIPPED: investigation-only', verify that no code/config files are staged by checking git diff --cached --name-only and filtering out .agents/ paths; fail validation with error code 'E_INVESTIGATION_HAS_CODE' if non-agent files are found
Extract and verify the 'Files changed' section from session logs when investigation-only skip is claimed; flag violations with error code 'E_INVESTIGATION_CLAIMS_FILES' if non-agent files are listed
Log all --no-verify bypass usage to .agents/validation/bypasses.log with timestamp, session log path, branch name, and user information in JSON format for audit trail and trend analysis

Files:

• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/analysis/pre-commit-qa-investigation-sessions-gap.md)

**/*Validate-Session.ps1: Pre-commit session protocol validator must require QA validation (Evidence column with QA report path matching pattern .agents/qa/.*\.md) for all code-changing sessions on branches with code changes
Pre-commit session protocol validator must allow sessions to skip QA validation with SKIPPED evidence matching pattern (?i)SKIPPED:\s*docs-only when branch changes are limited to documentation only

Files:

• scripts/Validate-Session.ps1

📄 CodeRabbit inference engine (.agents/critique/investigation-qa-exemption-proposal-critique.md)

**/Validate-Session.ps1: Investigation-only sessions may only stage files from specific investigation artifact paths: .agents/sessions/, .agents/analysis/, .agents/retrospective/, .serena/memories/, and .agents/critique/. All other staged files are considered implementation artifacts and require QA validation.
Use case-insensitive regex pattern (?i)SKIPPED:\s*investigation-only to detect investigation-only skip evidence in session logs, maintaining consistency with existing (?i)SKIPPED:\s*docs-only pattern.
Implement session log consistency check: validate that the session log 'Files changed' section matches the files actually staged for commit to prevent retroactive false investigation-only claims.
Define a constant allowlist of valid skip reasons (e.g., docs-only, investigation-only) and validate all SKIPPED: evidence patterns against this known list to prevent uncontrolled pattern proliferation.
Add error message clarity when investigation-only skip is claimed but non-investigation artifacts are staged: specify exactly which files are implementation artifacts and list the allowed investigation artifact paths to guide agent recovery.

Files:

• scripts/Validate-Session.ps1