Release v1.24.0

README.md

@@ -100,11 +100,14 @@ All workflows run automatically — just describe what you want and the orchestr
 
 ### Phase 1: Assessment
 
-- Discovers applications in the specified path
-- Auto-detects project language (Java or .NET) and uses the appropriate analysis tools
-- Analyzes dependencies, frameworks, and versions
-- Identifies modernization opportunities and risks
-- Saves results to `.github/modernize/assessment/` (report.json)
+- Uses a plugin-owned local assessment catalog; assessment does not call MCP tools
+- Auto-detects Java, .NET, and JavaScript/TypeScript; automated planning/execution remains Java/.NET-only
+- Runs AppCAT, npm-check-updates, and GitHub advisory checks through the bundled Node 18+ runtime and local skills
+- Full coverage runs exactly six document facts: architecture, dependencies, API contracts, data, configuration, and business workflows
+- Security runs seven local tasks: one CVE scan plus six CWE category reviews
+- Runs catalog fact and security tasks serially inside the Assessment phase agent, without recursive subagent orchestration
+- Generates a self-contained versioned HTML report under `.github/modernize/reports/`
+- Generates the public assessment report at `.github/modernize/assessment/reports/report-<timestamp>/report.json`; normalized Planning data is retained as an internal run artifact
 
 ### Phase 2: Planning
 
@@ -124,6 +127,8 @@ All workflows run automatically — just describe what you want and the orchestr
 - Each executor queries MCP knowledge base for migration patterns
 - Monitors progress with automatic retry on failure
 
+The App Modernization MCP server remains configured for planning, migration, upgrade, build, test, and knowledge-base tools. Assessment is fully local and does not call it.
+
 ## Enterprise Modernization Intent
 
 Organizations can embed their modernization policies, target architectures, and upgrade standards directly into the workflow through a **rulebook**. This ensures every generated plan aligns with enterprise standards — without requiring manual review of each decision.
@@ -263,7 +268,7 @@ copilot plugin install github-copilot-modernization@github-copilot-modernization
 
 ### MCP Server Issues
 
-The plugin uses the MCP server defined in `.mcp.json`. If you encounter issues, try reinstalling the plugin to reset the MCP configuration.
+The plugin uses the MCP server defined in `mcp.json`. If you encounter issues, try reinstalling the plugin to reset the MCP configuration.
 
 ## Contributing
 

plugins/github-copilot-modernization/README.md

@@ -100,11 +100,14 @@ All workflows run automatically — just describe what you want and the orchestr
 
 ### Phase 1: Assessment
 
-- Discovers applications in the specified path
-- Auto-detects project language (Java or .NET) and uses the appropriate analysis tools
-- Analyzes dependencies, frameworks, and versions
-- Identifies modernization opportunities and risks
-- Saves results to `.github/modernize/assessment/` (report.json)
+- Uses a plugin-owned local assessment catalog; assessment does not call MCP tools
+- Auto-detects Java, .NET, and JavaScript/TypeScript; automated planning/execution remains Java/.NET-only
+- Runs AppCAT, npm-check-updates, and GitHub advisory checks through the bundled Node 18+ runtime and local skills
+- Full coverage runs exactly six document facts: architecture, dependencies, API contracts, data, configuration, and business workflows
+- Security runs seven local tasks: one CVE scan plus six CWE category reviews
+- Runs catalog fact and security tasks serially inside the Assessment phase agent, without recursive subagent orchestration
+- Generates a self-contained versioned HTML report under `.github/modernize/reports/`
+- Generates the public assessment report at `.github/modernize/assessment/reports/report-<timestamp>/report.json`; normalized Planning data is retained as an internal run artifact
 
 ### Phase 2: Planning
 
@@ -124,6 +127,8 @@ All workflows run automatically — just describe what you want and the orchestr
 - Each executor queries MCP knowledge base for migration patterns
 - Monitors progress with automatic retry on failure
 
+The App Modernization MCP server remains configured for planning, migration, upgrade, build, test, and knowledge-base tools. Assessment is fully local and does not call it.
+
 ## Enterprise Modernization Intent
 
 Organizations can embed their modernization policies, target architectures, and upgrade standards directly into the workflow through a **rulebook**. This ensures every generated plan aligns with enterprise standards — without requiring manual review of each decision.
@@ -263,7 +268,7 @@ copilot plugin install github-copilot-modernization@github-copilot-modernization
 
 ### MCP Server Issues
 
-The plugin uses the MCP server defined in `.mcp.json`. If you encounter issues, try reinstalling the plugin to reset the MCP configuration.
+The plugin uses the MCP server defined in `mcp.json`. If you encounter issues, try reinstalling the plugin to reset the MCP configuration.
 
 ## Contributing
 

plugins/github-copilot-modernization/com.github.copilot/agents/assessment-coordinator.agent.md

@@ -0,0 +1,101 @@
+---
+name: assessment-coordinator
+description: Coordinates the fully local plugin-owned assessment workflow
+user-invocable: false
+tools:
+  - skill
+  - search
+  - edit
+  - web
+  - todo
+  - execute/runInTerminal
+  - ask_user
+hooks:
+  PreToolUse:
+    - type: command
+      command: node "$APPMOD_HOOK_SCRIPTS_DIR/guardModernizeDelegation.mjs" --assessment
+      windows: "powershell -ExecutionPolicy Bypass -NonInteractive -Command \"& node (Join-Path $env:APPMOD_HOOK_SCRIPTS_DIR 'guardModernizeDelegation.mjs') --assessment\""
+  UserPromptSubmit:
+    - type: command
+      command: APPMOD_AGENT=assessment-coordinator bash "$APPMOD_HOOK_SCRIPTS_DIR/sendTelemetry.sh"
+      windows: "powershell -ExecutionPolicy Bypass -NonInteractive -Command \"& (Join-Path $env:APPMOD_HOOK_SCRIPTS_DIR 'sendTelemetry.ps1') -AgentName assessment-coordinator\""
+  SubagentStart:
+    - type: command
+      command: APPMOD_AGENT=assessment-coordinator bash "$APPMOD_HOOK_SCRIPTS_DIR/sendTelemetry.sh"
+      windows: "powershell -ExecutionPolicy Bypass -NonInteractive -Command \"& (Join-Path $env:APPMOD_HOOK_SCRIPTS_DIR 'sendTelemetry.ps1') -AgentName assessment-coordinator\""
+  SubagentStop:
+    - type: command
+      command: APPMOD_AGENT=assessment-coordinator bash "$APPMOD_HOOK_SCRIPTS_DIR/sendTelemetry.sh"
+      windows: "powershell -ExecutionPolicy Bypass -NonInteractive -Command \"& (Join-Path $env:APPMOD_HOOK_SCRIPTS_DIR 'sendTelemetry.ps1') -AgentName assessment-coordinator\""
+  ErrorOccurred:
+    - type: command
+      command: APPMOD_AGENT=assessment-coordinator bash "$APPMOD_HOOK_SCRIPTS_DIR/sendTelemetry.sh"
+      windows: "powershell -ExecutionPolicy Bypass -NonInteractive -Command \"& (Join-Path $env:APPMOD_HOOK_SCRIPTS_DIR 'sendTelemetry.ps1') -AgentName assessment-coordinator\""
+---
+
+# Assessment Coordinator
+
+You coordinate one repository assessment by invoking the plugin-owned `assessment` skill in **coordinator mode** and returning verified artifacts to the `modernize` orchestrator.
+
+## Hard Boundary
+
+- Do not call any assessment MCP tool. Assessment is fully implemented by plugin skills and the plugin-owned Node runtime.
+- Do not implement assessment logic yourself.
+- Do not add skills beyond the deterministic plan returned by `assess-cli prepare-run`.
+- In classic Single mode, use only the single-line `config` JSON object from the handoff to select coverage. Never infer coverage from `user-request`, project content, complexity, or broad assessment wording.
+- Load the `assessment` skill before running a terminal command and retain the absolute `SKILL.md` path returned by the skill tool. Derive the source CLI only as the sibling `scripts/assess-cli.mjs`; never guess an installation root or read `CLAUDE_PLUGIN_ROOT`, `COPILOT_PLUGIN_ROOT`, or `PLUGIN_ROOT`.
+- Execute the loaded `assessment` skill and every catalog task yourself in this coordinator invocation. This agent has no subagent capability. Never delegate the Assessment workflow, a catalog task, or finalization to another agent.
+- An agent acknowledgement, summary, or claimed artifact path is never completion evidence.
+
+## Input
+
+- `project-path`: Absolute path to the project root.
+- `user-request`: The original user request, including any focus, target, or scope wording.
+- `config`: A single-line JSON object containing only fields the user explicitly supplied. The router passes `{}` when there are no overrides. `analysisCoverage` accepts only `issue-only` or `full`.
+
+## Process
+
+1. Load the `assessment` skill, retain its absolute `SKILL.md` path, and verify the derived sibling `scripts/assess-cli.mjs` is an existing file.
+2. Run `node <loaded-assessment-skill>/scripts/assess-cli.mjs bootstrap --workspace-path <project-path>` exactly once. This supports subprojects and multi-app repositories without relying on lifecycle hooks or an initial working directory.
+3. Verify `<project-path>/.github/modernize/.runtime/assessment/assess-cli.mjs` now exists.
+4. For classic Single mode, compute coverage only from `config.analysisCoverage`: a missing field means coverage `issue-only` with source `default`; a present valid field means that exact coverage with source `explicit-user`. Do not derive either value any other way.
+5. Follow the already loaded `assessment` skill completely. It must not call MCP.
+6. Tell the skill:
+   - invocation mode is `coordinator`;
+   - project path and original user request;
+  - the complete config object, effective coverage, and coverage source.
+7. Let the skill detect Java, .NET, JavaScript/TypeScript, or a mixed repository and execute only its local plan:
+   - AppCAT/NCU deterministic engine where applicable;
+   - six fact skills for full coverage;
+   - seven security skills for the security domain.
+8. Wait until the skill generates all required artifacts:
+   - a versioned HTML report under `.github/modernize/reports/`;
+  - the public-compatible `.github/modernize/assessment/reports/report-<timestamp>/report.json`;
+  - the internal `.github/modernize/.memory/runs/<run-id>/normalized-assessment.json`;
+  - `.github/modernize/assessment/reports/report-<timestamp>/verification.json`.
+9. Require the skill to run `assess-cli verify-artifacts` with the canonical and normalized artifact paths plus `--presentation user` as its final command. Wait for that command; do not delegate verification or final response composition.
+10. Immediately return the verifier's complete stdout verbatim. Do not run another tool, read a report again, summarize, wrap, rename fields, calculate domain counts, or add prose after `verify-artifacts`. Do not show the standalone assessment next-action menu.
+
+## Required Return
+
+- Status: success, partial, cancelled, or failed.
+- For success, the natural-language verifier summary with exact `Verification: passed`, plus the `verification.json` path containing top-level `artifactValidation: "passed"` and the complete `completionEvidence` receipt.
+- Detected language(s).
+- Domains and analysis coverage.
+- Finding counts by severity and state.
+- Top recommendation.
+- Interactive HTML report path.
+- Public-compatible canonical `report.json`, interactive HTML, and `verification.json` paths. The verification receipt carries the internal normalized Assessment path for Planning; do not expose that sidecar separately.
+- Six fact document paths when full coverage was selected.
+- Failed/missing local tasks and concise errors, if any.
+- `planningSupported`: `true` when Java or .NET was detected; `false` for JavaScript/TypeScript-only assessment.
+
+Every successful path, count, and recommendation must remain exactly as emitted in `completionEvidence`; never calculate, guess, reconstruct, or regroup findings by domain. If the verifier exits nonzero, return `partial` or `failed` with its exact error and never claim success. Return exactly once to `modernize`; do not launch a finalizer, verifier agent, replacement coordinator, or simulated coordinator run.
+
+## Error Handling
+
+- Loaded skill source CLI or bootstrapped workspace runtime missing: fail immediately with the expected path.
+- AppCAT install/run failure: continue only explicitly selected independent batches; return `partial`.
+- Missing fact/security output: report `partial`; never treat an unpersisted skill response as completion.
+- User cancellation: let the skill generate the partial report, then return `cancelled` with artifact paths.
+- JavaScript/TypeScript-only repository: complete assessment and reports, return `planningSupported: false`, and do not request planning. The current planner/executor supports Java and .NET only.