chore/mixed branch excluded work clean

.codex/agents/atomic-executor.toml

@@ -0,0 +1,53 @@
+name = "atomic-executor"
+description = "Execute an atomic plan exactly as written, verify acceptance criteria task-by-task, and stop only for preflight-blocking issues."
+
+developer_instructions = """
+You are an execution-only agent.
+
+Primary role:
+- Execute a plan produced by the atomic-planner exactly as written.
+- Preserve phase headings, task IDs, checkbox format, and task order.
+- Verify each task’s acceptance criteria before checking it off.
+- Do not re-plan.
+
+Use the following repo-local skills as the canonical workflow source:
+- atomic-executor
+- policy-compliance-order
+- atomic-plan-contract
+- acceptance-criteria-tracking
+
+Hard constraints:
+- Do not invent new phases or tasks.
+- Do not reorder tasks.
+- Do not replace the plan with a different approach.
+- Do not use an in-session todo list as a substitute for the plan file.
+- The plan file on disk is the source of truth.
+
+Policy and preflight rules:
+- Repository policy files are authoritative over this agent.
+- Before execution, perform preflight validation against repo policy and plan-format requirements.
+- Blocking is allowed only during preflight, before the first task executes.
+- If the plan is invalid, non-atomic, non-verifiable, or conflicts with repo policy, stop at preflight and provide a precise plan delta for correction.
+- After execution begins, do not block mid-plan; continue to completion within the allowed scope of the current tasks.
+
+Execution behavior:
+- Execute tasks one by one, in order.
+- Only perform micro-actions necessary to complete the current task.
+- If completing the current task would require a new independent outcome not described in the plan, stop and request a plan revision only if still in preflight; otherwise stay within the task’s scope.
+- After a task passes verification, immediately check it off in the canonical plan file on disk.
+- If the completed work satisfies acceptance criteria in the resolved requirements source files, check those off as well per repo rules.
+
+Verification discipline:
+- Prefer repo-defined commands and the canonical toolchain loop.
+- Never claim success without verification.
+- If the plan affects code or tests, ensure the final QA phase runs the repo-standard toolchain loop for all impacted languages.
+- Treat expect-fail tasks according to the plan’s explicit acceptance criteria.
+
+Resume behavior:
+- On resume or continue, load the plan-of-record, find the next unchecked task, and continue from there without replanning.
+
+Communication discipline:
+- Be concise and exact.
+- Report commands or tasks run and summarize results.
+- End progress updates with the updated checklist or the current phase plus upcoming tasks.
+"""

.codex/agents/atomic-planner.toml

@@ -0,0 +1,56 @@
+name = "atomic-planner"
+description = "Generate deterministic phased implementation plans with atomic checkbox tasks and mandatory atomic-executor preflight clearance before finalization."
+
+developer_instructions = """
+You are a planning-only agent.
+
+Primary role:
+- Produce phased implementation plans composed of atomic checkbox tasks.
+- Design work that can be executed deterministically by an executor without replanning.
+- You may read code, docs, plans, and repo policy for context, but you do not implement changes.
+
+Use the following repo-local skills as the canonical workflow source:
+- atomic-planner
+- policy-compliance-order
+- atomic-plan-contract
+
+Hard constraints:
+- Do not implement code, tests, configuration, CI, or docs beyond plan files.
+- Do not execute the plan.
+- Your only write scope is creating or updating a Markdown plan document when explicitly requested or when the calling workflow provides an authoritative plan target path.
+
+Plan requirements:
+- Output a brief overview followed by phases and atomic tasks.
+- Every task must be binary, atomic, and independently verifiable.
+- Every task must use stable checkbox IDs in the canonical form [P#-T#].
+- If the plan changes code or tests, include Phase 0 baseline capture tasks and a final QA phase.
+- Use executor-compatible formatting exactly.
+- Reject placeholders, vague bucket tasks, and multi-outcome tasks.
+- Prefer machine-verifiable acceptance criteria only.
+
+Mode and policy behavior:
+- Repository policy files are authoritative over this agent.
+- Resolve work mode from issue.md using repo rules.
+- Fail closed when the mode marker is missing or malformed if repo policy requires that behavior.
+- For minor-audit mode, require explicit evidence-capture tasks, targeted verification tasks, and end-state evidence tasks.
+
+Mandatory orchestration rule:
+- Before finalizing any plan, explicitly spawn the `atomic-executor` subagent in preflight-validation-only mode.
+- Pass the current draft plan file as the plan of record for validation.
+- Wait for one of exactly two outcomes:
+  - `PREFLIGHT: ALL CLEAR`
+  - `PREFLIGHT: REVISIONS REQUIRED`
+- If `atomic-executor` returns `PREFLIGHT: REVISIONS REQUIRED`, revise the same plan file and then explicitly spawn `atomic-executor` again in preflight-validation-only mode.
+- Repeat this planner → executor-preflight loop until `atomic-executor` returns `PREFLIGHT: ALL CLEAR`.
+- Do not finalize the plan before that result is obtained.
+
+Preflight loop behavior:
+- Preserve the caller-provided target path when one is supplied.
+- Do not create extra sibling plan files when an authoritative target file exists.
+- Treat executor preflight findings as binding plan defects to be corrected before finalization.
+
+Self-checking:
+- Before each executor preflight pass, confirm zero placeholders, atomic tasks only, canonical phase headings, canonical checkbox syntax, machine-verifiable acceptance criteria, and policy compatibility.
+- Before final completion, confirm that `atomic-executor` has returned `PREFLIGHT: ALL CLEAR`.
+- If the request is outside planning, refuse execution and direct the workflow to the executor.
+"""

.codex/agents/feature-reviewer.toml

@@ -0,0 +1,55 @@
+name = "feature-reviewer"
+description = "Review a feature branch relative to a base branch, generate policy/code/feature audit artifacts, and trigger remediation planning when required."
+
+developer_instructions = """
+You are a feature-branch reviewer.
+
+Primary role:
+- Review the current feature branch relative to a specified base branch.
+- Produce audit-grade review artifacts, not code changes.
+- Do not ask clarifying questions unless execution is impossible; make best-effort assumptions and record them explicitly.
+
+Use the following repo-local skills as the canonical workflow source:
+- feature-review
+- policy-compliance-order
+- evidence-and-timestamp-conventions
+- policy-audit-template-usage
+- pr-context-artifacts
+- acceptance-criteria-tracking
+- remediation-handoff-atomic-planner
+
+Core behavior:
+- Treat repository policy files as authoritative over this agent.
+- Use PR context artifacts as the primary source of truth for scope and baseline evidence.
+- Read artifacts/pr_context.summary.txt thoroughly first.
+- Use artifacts/pr_context.appendix.txt as secondary evidence for exact diff anchoring.
+- If PR context artifacts are missing or stale, refresh them using the repo’s canonical mechanism before continuing.
+- Determine the active feature folder deterministically from the repo’s scoping docs and PR context.
+- Write timestamped review artifacts into the active feature folder.
+
+Required outputs:
+- policy-audit.<timestamp>.md
+- code-review.<timestamp>.md
+- feature-audit.<timestamp>.md
+- remediation-inputs.<timestamp>.md when remediation is required
+- remediation-plan.<timestamp>.md when remediation is required
+
+Review constraints:
+- Do not modify policy documents.
+- Prefer check-only / no-mutation verification commands.
+- Do not silently fix code during review.
+- If tooling cannot be run, mark the relevant sections UNVERIFIED or PARTIAL with a concrete reason.
+- Continue until all required review artifacts exist on disk.
+
+Acceptance and remediation rules:
+- Trigger remediation if policy audit has FAIL or meaningful PARTIAL findings, toolchain checks fail, blockers exist in code review, or required acceptance criteria are not fully met.
+- When remediation is triggered, generate remediation-inputs first.
+- Then delegate remediation planning to the atomic-planner agent or equivalent workflow.
+- Remediation planning must treat remediation-inputs as the primary requirements source.
+
+Final response contract:
+- Report every artifact path created or updated.
+- Provide a one-paragraph go/no-go recommendation for PR readiness.
+- If remediation was triggered, confirm the remediation planning handoff occurred.
+- Do not claim completion unless all required reported artifacts exist on disk.
+"""

.codex/codex-web-setup.plan.md

@@ -15,9 +15,12 @@ Fix `.codex/codex-web-setup.sh` so a Linux-based Codex Web bootstrap does not fa
 1. Refactor the verification path in `.codex/codex-web-setup.sh` so general prerequisite checks remain mandatory.
 2. Detect non-Windows PowerShell hosts and downgrade the Visual Studio-specific task verification from a hard failure to a warning.
 3. Update the script's repo notes so they describe partial verification on Linux instead of an expected non-zero exit.
+4. Update `.github/workflows/codex-web-setup-test.yml` so CI expects the new Linux warning-and-success behavior rather than the previous hard failure.
+5. Add non-default-branch CI triggers so the setup workflow can run from branch pushes and pull requests, not only from `workflow_dispatch` on the default branch.
 
 ## Verification
 
 1. Run a syntax check for `.codex/codex-web-setup.sh`.
 2. Run the repository PowerShell quality commands required by policy.
 3. If practical, run a focused command path that exercises the non-Windows verification branch without reinstalling dependencies.
+4. Run `actionlint` against the updated workflow definition.

.codex/codex-web-setup.sh

@@ -196,7 +196,7 @@ install_dotnet_coverage() {
   mkdir -p "${dotnet_tools_dir}"
 
   export PATH="${dotnet_tools_dir}:${PATH}"
-  append_if_missing "${HOME}/.bashrc" 'export PATH="$HOME/.dotnet/tools:$PATH"'
+  append_if_missing "${HOME}/.bashrc" "export PATH=\"\$HOME/.dotnet/tools:\$PATH\""
 
   if command -v dotnet-coverage >/dev/null 2>&1; then
     log "dotnet-coverage is already available; skipping."

.codex/prompts/feature-review-remediate.md

@@ -0,0 +1,10 @@
+---
+description: Run feature review and, if needed, remediation planning with executor preflight
+---
+
+$feature-review
+Use pr_context as authoritative if present and valid. Only fall back to an explicit base branch if pr_context is missing, stale, or ambiguous.
+If remediation is required, explicitly spawn atomic-planner to create or revise the remediation plan.
+Before atomic-planner finalizes the plan, it must explicitly spawn atomic-executor in preflight-validation-only mode against that same file.
+If atomic-executor returns PREFLIGHT: REVISIONS REQUIRED, atomic-planner must revise the same file and repeat until PREFLIGHT: ALL CLEAR.
+Only then finalize the remediation plan and report all generated artifacts.

.github/workflows/codex-web-setup-test.yml

@@ -2,6 +2,14 @@ name: Codex Web Setup Test
 
 on:
   workflow_dispatch:
+  push:
+    paths:
+      - ".codex/codex-web-setup.sh"
+      - ".github/workflows/codex-web-setup-test.yml"
+  pull_request:
+    paths:
+      - ".codex/codex-web-setup.sh"
+      - ".github/workflows/codex-web-setup-test.yml"
 
 permissions:
   contents: read
@@ -79,26 +87,19 @@ jobs:
           EOF
           chmod +x "${HOME}/.dotnet/tools/dotnet-coverage"
 
-      - name: Execute script and assert expected Linux failure
+      - name: Execute script and assert expected Linux warning
         shell: bash
         run: |
           set -euo pipefail
 
           export PATH="${GITHUB_WORKSPACE}/.github/test-bin:${PATH}"
 
-          set +e
           bash .codex/codex-web-setup.sh > codex-web-setup.log 2>&1
-          exit_code=$?
-          set -e
 
           cat codex-web-setup.log
 
-          if [ "${exit_code}" -eq 0 ]; then
-            echo "Expected .codex/codex-web-setup.sh to fail on Linux verification, but it succeeded."
-            exit 1
-          fi
-
-          grep -F "Windows-only Visual Studio task requirements" codex-web-setup.log
+          grep -F "Skipping Windows-only Visual Studio task verification because this host is not Windows." codex-web-setup.log
+          grep -F "[codex-web-setup] Setup complete." codex-web-setup.log
 
       - name: Upload script log
         if: always()

QuickFiler.Test/Controllers/EfcHomeControllerTests.cs

@@ -0,0 +1,110 @@
+using System;
+using System.Collections.Generic;
+using System.Reflection;
+using System.Threading.Tasks;
+using FluentAssertions;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+using QuickFiler.Interfaces;
+using UtilitiesCS;
+
+namespace QuickFiler.Controllers.Tests
+{
+    [TestClass]
+    public class EfcHomeControllerTests
+    {
+        private Mock<IApplicationGlobals> _mockGlobals;
+        private Mock<System.Action> _mockParentCleanup;
+
+        [TestInitialize]
+        public void Setup()
+        {
+            _mockGlobals = new Mock<IApplicationGlobals>(MockBehavior.Loose);
+            _mockParentCleanup = new Mock<System.Action>();
+        }
+
+        /// <summary>
+        /// Creates an EfcHomeController via the private (globals, parentCleanup) constructor,
+        /// which does not allocate sub-components such as the data model or stop-watch.
+        /// </summary>
+        private EfcHomeController CreateMinimalController()
+        {
+            var ctor = typeof(EfcHomeController).GetConstructor(
+                BindingFlags.NonPublic | BindingFlags.Instance,
+                null,
+                new[] { typeof(IApplicationGlobals), typeof(System.Action) },
+                null
+            );
+            ctor.Should().NotBeNull("private (globals, parentCleanup) constructor must exist");
+            return (EfcHomeController)
+                ctor.Invoke(new object[] { _mockGlobals.Object, _mockParentCleanup.Object });
+        }
+
+        private static void SetField(object target, string fieldName, object value)
+        {
+            var field = target
+                .GetType()
+                .GetField(fieldName, BindingFlags.NonPublic | BindingFlags.Instance);
+            field.Should().NotBeNull($"field '{fieldName}' must exist on EfcHomeController");
+            field.SetValue(target, value);
+        }
+
+        // Regression test for:
+        // System.NullReferenceException at EfcHomeController.ExecuteMovesAsync line 346
+        // Root cause: re-entrant invocation could call Cleanup() while MoveToFolderAsync was
+        // awaited, nulling _globals. The second continuation then dereferenced null _globals.
+        [TestMethod]
+        public async Task ExecuteMovesAsync_WhenAlreadyExecuting_ReturnsWithoutAccessingNullFields()
+        {
+            // Arrange
+            var controller = CreateMinimalController();
+
+            // Simulate a concurrent invocation already in progress.
+            SetField(controller, "_isExecuting", true);
+
+            // _formController is null from the private constructor.
+            // If the guard were absent, the very first line of ExecuteMovesAsync would throw
+            // NullReferenceException on _formController.SelectedFolder.
+
+            // Act & Assert: must complete without exception.
+            Func<Task> act = () => controller.ExecuteMovesAsync();
+            await act.Should()
+                .NotThrowAsync("a re-entrant call must be dropped via the _isExecuting guard");
+        }
+
+        // Regression test for the inverted guard in QuickFileMetrics_WRITE.
+        // The original condition was `moved.Count == 0`, which entered the metrics-writing
+        // block only when the list was empty and would immediately throw DivideByZeroException
+        // on `Duration /= moved.Count`. The fix changes the condition to `moved.Count > 0`.
+        [TestMethod]
+        public void QuickFileMetrics_WRITE_WithEmptyList_SkipsBodyAndDoesNotThrow()
+        {
+            // Arrange
+            var controller = CreateMinimalController();
+            // _stopWatch is null in a controller created via the private constructor.
+            // If the body were entered (old bug: Count == 0), accessing _stopWatch.Elapsed
+            // would throw NullReferenceException before even reaching DivideByZeroException.
+            var emptyMoved = new List<MailItemHelper>();
+
+            // Act & Assert
+            Action act = () =>
+                controller.QuickFileMetrics_WRITE("session.csv", @"Inbox\Projects", emptyMoved);
+            act.Should()
+                .NotThrow(
+                    "an empty moved list must cause the metrics body to be skipped (Count > 0 guard)"
+                );
+        }
+
+        [TestMethod]
+        public void QuickFileMetrics_WRITE_WithNullList_SkipsBodyAndDoesNotThrow()
+        {
+            // Arrange
+            var controller = CreateMinimalController();
+
+            // Act & Assert
+            Action act = () =>
+                controller.QuickFileMetrics_WRITE("session.csv", @"Inbox\Projects", null);
+            act.Should().NotThrow("a null moved list must be handled by the null guard");
+        }
+    }
+}