@danmoisan/drm-copilot-mcp 1.0.0 → 1.0.7

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-pr-author-skill.ps1

@@ -13,7 +13,9 @@
 
     Required sequence:
       1. mcp__drm-copilot__collect_pr_context writes artifacts/pr_context.summary.txt
-      2. pr-author skill reads that file and writes artifacts/pr_body_<N>.md
+      2. pr-author skill produces the body text; the pr-author agent writes
+         artifacts/pr_body_<N>.md and a sibling integrity receipt
+         artifacts/pr_body_<N>.receipt.json
       3. gh pr create --body-file artifacts/pr_body_<N>.md
          (or gh pr edit --body-file ...)
 
@@ -21,35 +23,71 @@
       Case A - gh pr create or gh pr edit with --body (inline, no --body-file): blocked.
       Case B - gh pr create with neither --body nor --body-file: blocked.
       Case C - gh pr create or gh pr edit with --body-file but context artifact absent: blocked.
-      Case D - --body-file present, context artifact present, but the authorization sentinel
-               artifacts/pr_author_authorization.json is absent or empty: blocked
-               (PR_AGENT_AUTHORIZATION_MISSING).
-      Malformed - sentinel present but not valid JSON, or issued_at missing/unparseable: blocked
-               (PR_AGENT_AUTHORIZATION_MALFORMED).
-      Case E - sentinel valid JSON but issued_by != "pr-author": blocked
-               (PR_AGENT_AUTHORIZATION_INVALID).
-      Case F - sentinel issued_by == "pr-author" but elapsed time since issued_at exceeds
-               ttl_seconds: blocked (PR_AGENT_AUTHORIZATION_EXPIRED).
-
-    Authorization sentinel decision order on the --body-file-with-context path:
-      missing -> malformed -> invalid issuer -> expired -> allow.
+      Preflight - --body-file/context present: orchestrator-state checkpoint must pass
+                  --require-pr-creation-ready before receipt verification runs, else blocked.
+      Receipt - preflight passed: the SHA-256 receipt is verified in five ordered checks
+                (Section below). The first failing check blocks.
+
+    Receipt verification decision order on the --body-file-with-context path:
+      PR_BODY_PATH_NONCANONICAL -> PR_AUTHOR_RECEIPT_MISSING -> PR_AUTHOR_RECEIPT_NUMBER_MISMATCH
+      -> PR_AUTHOR_RECEIPT_HASH_MISMATCH -> PR_AUTHOR_RECEIPT_STALE -> allow.
 
 .NOTES
     Compatible with PowerShell 7+. No external module dependencies.
 
-    Enforcement strength: the authorization sentinel is a policy guardrail, not a cryptographic
-    or security control. Any actor with Write access to artifacts/ can forge
-    artifacts/pr_author_authorization.json, because all agents share the same filesystem and the
-    runtime exposes no native agent-identity signal at Bash PreToolUse time. The mechanism prevents
-    accidental bypass and requires a deliberate, documented act to circumvent. It MUST NOT be
-    described as tamper-proof or as a security boundary.
+    Enforcement strength: the SHA-256 receipt is a policy-level integrity check that binds the
+    PR body bytes to the receipt the pr-author agent wrote. It is not a cryptographic or security
+    boundary: any actor with Write access to artifacts/ can replace both the body file and the
+    receipt together, because all agents share the same filesystem and the runtime exposes no
+    native agent-identity signal at Bash PreToolUse time. The mechanism prevents accidental bypass
+    and requires a deliberate, documented act to circumvent. It MUST NOT be described as
+    tamper-proof or as a security boundary.
 #>
 [CmdletBinding()]
 param()
 
 $script:PrContextArtifactPath = 'artifacts/pr_context.summary.txt'
-$script:PrAuthorAuthorizationPath = 'artifacts/pr_author_authorization.json'
-$script:PrAuthorAuthorizationTtlSeconds = 120
+$script:OrchestratorStateCheckpointPath = 'artifacts/orchestration/orchestrator-state.json'
+
+function Invoke-OrchestratorStatePreflight {
+    <#
+    .SYNOPSIS
+        Runs the orchestrator-state validator against the checkpoint and reports pass/fail.
+    .DESCRIPTION
+        Mirrors Invoke-RoutingContractValidation (.codex/hooks/validate-orchestrator-output.ps1):
+        an injectable subprocess scriptblock seam defaults to ``python -m
+        scripts.dev_tools.validate_orchestration_artifacts orchestrator-state <CheckpointPath>
+        --require-pr-creation-ready``. A missing checkpoint or validation failure surfaces via the
+        validator's exit/stderr text (pre-PR-creation readiness, not full completion).
+    .OUTPUTS
+        System.Collections.Hashtable with keys HasErrors (bool) and ErrorText (string).
+    #>
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param(
+        [Parameter(Mandatory = $false)]
+        [string] $CheckpointPath = $script:OrchestratorStateCheckpointPath,
+
+        [Parameter(Mandatory = $false)]
+        [scriptblock] $Invoker = {
+            param($Path)
+            $output = & python -m scripts.dev_tools.validate_orchestration_artifacts `
+                orchestrator-state $Path --require-pr-creation-ready 2>&1
+            [pscustomobject]@{
+                ExitCode = $LASTEXITCODE
+                Output   = ($output | Out-String)
+            }
+        }
+    )
+
+    $result = & $Invoker $CheckpointPath
+    $exitCode = 0
+    if ($null -ne $result -and ($result.PSObject.Properties.Name -contains 'ExitCode')) { $exitCode = [int]$result.ExitCode }
+    $outputText = ''
+    if ($null -ne $result -and ($result.PSObject.Properties.Name -contains 'Output')) { $outputText = ([string]$result.Output).Trim() }
+
+    return @{ HasErrors = ($exitCode -ne 0); ErrorText = $outputText }
+}
 
 function Get-PrContextArtifactExistence {
     <#
@@ -65,108 +103,180 @@ function Get-PrContextArtifactExistence {
     return [bool](Test-Path -LiteralPath $script:PrContextArtifactPath)
 }
 
-function Get-PrAuthorAuthorizationContent {
+function Get-PrBodyFileBytes {
+    <#
+    .SYNOPSIS
+        Read the raw bytes of the PR body file. Tests mock this function (read seam).
+    .DESCRIPTION
+        Returns the byte content of the supplied body-file path, or $null when the file is absent.
+        This is the injectable boundary for body-file bytes in tests; no test writes the body file
+        to disk. The bytes are hashed inline by the receipt verification function.
+    .PARAMETER BodyFilePath
+        The relative path to the PR body file (for example artifacts/pr_body_5.md).
+    .OUTPUTS
+        System.Byte[] or $null
+    #>
+    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseSingularNouns', '', Justification = 'The plural noun names the byte-array return; the seam name is fixed by the receipt contract.')]
+    [CmdletBinding()]
+    [OutputType([byte[]])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $BodyFilePath
+    )
+
+    if (-not (Test-Path -LiteralPath $BodyFilePath)) {
+        return $null
+    }
+
+    return [System.IO.File]::ReadAllBytes($BodyFilePath)
+}
+
+function Get-PrAuthorReceiptContent {
     <#
     .SYNOPSIS
-        Read the raw text of the authorization sentinel. Tests mock this function (read seam).
+        Read the raw JSON text of the PR body receipt. Tests mock this function (read seam).
     .DESCRIPTION
-        Returns the raw text content of artifacts/pr_author_authorization.json, or $null when the
-        sentinel file is absent. This is the injectable boundary for sentinel content in tests; no
-        test writes the sentinel file to disk.
+        Returns the raw text content of the sibling receipt file artifacts/pr_body_<N>.receipt.json,
+        or $null when the receipt file is absent. This is the injectable boundary for receipt
+        content in tests; no test writes the receipt file to disk.
+    .PARAMETER ReceiptFilePath
+        The relative path to the receipt file (for example artifacts/pr_body_5.receipt.json).
     .OUTPUTS
         System.String or $null
     #>
     [CmdletBinding()]
     [OutputType([string])]
-    param()
+    param(
+        [Parameter(Mandatory)]
+        [string] $ReceiptFilePath
+    )
 
-    if (-not (Test-Path -LiteralPath $script:PrAuthorAuthorizationPath)) {
+    if (-not (Test-Path -LiteralPath $ReceiptFilePath)) {
         return $null
     }
 
-    return (Get-Content -LiteralPath $script:PrAuthorAuthorizationPath -Raw)
+    return (Get-Content -LiteralPath $ReceiptFilePath -Raw)
 }
 
-function Get-CurrentDateTimeUtc {
+function Get-PrContextSummaryLastWriteUtc {
     <#
     .SYNOPSIS
-        Return the current UTC time. Tests mock this function (clock seam) for time-travel scenarios.
+        Return the UTC last-write time of the PR context summary. Tests mock this function (seam).
+    .DESCRIPTION
+        Returns the LastWriteTimeUtc of artifacts/pr_context.summary.txt, or $null when the file is
+        absent. The staleness check compares the receipt's created_at against this value; both are
+        artifact metadata, so no wall-clock seam is required.
     .OUTPUTS
-        System.DateTime
+        System.DateTime or $null
     #>
     [CmdletBinding()]
     [OutputType([datetime])]
     param()
 
-    return [DateTime]::UtcNow
+    if (-not (Test-Path -LiteralPath $script:PrContextArtifactPath)) {
+        return $null
+    }
+
+    return (Get-Item -LiteralPath $script:PrContextArtifactPath).LastWriteTimeUtc
 }
 
-function Test-PrAuthorAuthorization {
+function Test-PrAuthorReceiptVerification {
     <#
     .SYNOPSIS
-        Validate the authorization sentinel and return a block-reason string, or $null when authorized.
+        Verify the SHA-256 receipt and return a block-reason string, or $null when verified.
     .DESCRIPTION
-        Reads the sentinel via Get-PrAuthorAuthorizationContent and computes elapsed time via
-        Get-CurrentDateTimeUtc. Applies the decision order missing -> malformed -> invalid issuer ->
-        expired -> allow (spec FR-2 step 3):
-          - $null/empty contents              -> PR_AGENT_AUTHORIZATION_MISSING
-          - not valid JSON, or issued_at
-            missing/unparseable               -> PR_AGENT_AUTHORIZATION_MALFORMED
-          - issued_by != "pr-author"          -> PR_AGENT_AUTHORIZATION_INVALID
-          - elapsed seconds > ttl_seconds     -> PR_AGENT_AUTHORIZATION_EXPIRED
-          - all checks pass                   -> $null (allow)
-        The ttl_seconds value defaults to the named constant when absent from the sentinel.
-        This is a policy guardrail, not a cryptographic control; the sentinel is forgeable by any
-        actor with Write access to artifacts/.
+        Runs the five ordered receipt checks on the --body-file-with-context path. Each check is its
+        own short-circuiting branch; the first failure returns its reason code:
+          1. PR_BODY_PATH_NONCANONICAL        - --body-file path does not match the canonical
+                                                 artifacts/pr_body_<N>.md pattern (case-sensitive).
+          2. PR_AUTHOR_RECEIPT_MISSING        - sibling artifacts/pr_body_<N>.receipt.json absent.
+          3. PR_AUTHOR_RECEIPT_NUMBER_MISMATCH- receipt.number (integer) != <N> from the path.
+          4. PR_AUTHOR_RECEIPT_HASH_MISMATCH  - inline SHA-256 (lowercase hex) of the body bytes
+                                                 != receipt.sha256.
+          5. PR_AUTHOR_RECEIPT_STALE          - receipt.created_at (UTC) not strictly newer than the
+                                                 context summary last-write time.
+        Returns $null when all five checks pass (allow). All disk access flows through the three
+        injectable seams (Get-PrBodyFileBytes, Get-PrAuthorReceiptContent,
+        Get-PrContextSummaryLastWriteUtc); SHA-256 is computed inline. This is a policy-level
+        integrity check, not a cryptographic control: any actor with Write access to artifacts/ can
+        replace the body file and the receipt together.
+    .PARAMETER CommandText
+        The Bash command text containing the --body-file argument.
     .OUTPUTS
         System.String or $null
     #>
     [CmdletBinding()]
     [OutputType([string])]
-    param()
+    param(
+        [Parameter(Mandatory)]
+        [string] $CommandText
+    )
 
-    $contents = Get-PrAuthorAuthorizationContent
+    # Check 1: the --body-file argument must match the canonical artifacts/pr_body_<N>.md pattern.
+    # The match is case-sensitive (-cmatch) so a non-canonical path is rejected before any read.
+    if ($CommandText -cnotmatch '--body-file\s+artifacts/pr_body_(\d+)\.md\b') {
+        return "PR_BODY_PATH_NONCANONICAL: ``--body-file`` must reference a canonical ``artifacts/pr_body_<N>.md`` file produced by the pr-author skill. The path supplied does not match ``artifacts/pr_body_<N>.md``."
+    }
+
+    $bodyNumber = [int]$Matches[1]
+    $bodyFilePath = "artifacts/pr_body_$bodyNumber.md"
+    $receiptFilePath = "artifacts/pr_body_$bodyNumber.receipt.json"
 
-    if ([string]::IsNullOrWhiteSpace($contents)) {
-        return "PR_AGENT_AUTHORIZATION_MISSING: ``$script:PrAuthorAuthorizationPath`` is absent or empty. The pr-author agent must write the authorization sentinel immediately before issuing ``gh pr create``/``gh pr edit --body*``."
+    # Check 2: the sibling receipt file must exist (read via the injectable seam).
+    $receiptRaw = Get-PrAuthorReceiptContent -ReceiptFilePath $receiptFilePath
+    if ([string]::IsNullOrWhiteSpace($receiptRaw)) {
+        return "PR_AUTHOR_RECEIPT_MISSING: ``$receiptFilePath`` is absent. The pr-author agent must write the SHA-256 receipt alongside ``$bodyFilePath`` before issuing ``gh pr create``/``gh pr edit --body-file``."
     }
 
+    # A receipt that is present but not valid JSON cannot be verified; treat it as missing content.
     try {
-        $sentinel = $contents | ConvertFrom-Json -ErrorAction Stop
+        $receipt = $receiptRaw | ConvertFrom-Json -ErrorAction Stop
     } catch {
-        return "PR_AGENT_AUTHORIZATION_MALFORMED: ``$script:PrAuthorAuthorizationPath`` is not valid JSON. The pr-author agent must write a well-formed sentinel with ``issued_by``, ``issued_at``, and ``ttl_seconds``."
+        return "PR_AUTHOR_RECEIPT_MISSING: ``$receiptFilePath`` is not valid JSON. The pr-author agent must write a well-formed receipt with ``number``, ``sha256``, and ``created_at``."
     }
 
-    $issuedAtRaw = $sentinel.issued_at
-    if ([string]::IsNullOrWhiteSpace([string]$issuedAtRaw)) {
-        return "PR_AGENT_AUTHORIZATION_MALFORMED: ``$script:PrAuthorAuthorizationPath`` is missing ``issued_at``. The pr-author agent must record a UTC ISO-8601 ``issued_at`` timestamp."
+    # Check 3: the receipt number must equal the <N> extracted from the canonical path.
+    $receiptNumber = $null
+    $parsedNumber = 0
+    if ([int]::TryParse([string]$receipt.number, [ref] $parsedNumber)) {
+        $receiptNumber = $parsedNumber
+    }
+    if ($receiptNumber -ne $bodyNumber) {
+        return "PR_AUTHOR_RECEIPT_NUMBER_MISMATCH: ``$receiptFilePath`` ``number`` ($($receipt.number)) does not equal the body-file number ($bodyNumber). The receipt must bind to ``$bodyFilePath``."
     }
 
-    $issuedAt = [DateTime]::MinValue
-    $parsed = [DateTime]::TryParse(
-        [string]$issuedAtRaw,
-        [System.Globalization.CultureInfo]::InvariantCulture,
-        [System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal,
-        [ref] $issuedAt)
-    if (-not $parsed) {
-        return "PR_AGENT_AUTHORIZATION_MALFORMED: ``$script:PrAuthorAuthorizationPath`` has an unparseable ``issued_at``. The pr-author agent must record a UTC ISO-8601 ``issued_at`` timestamp."
+    # Check 4: the inline SHA-256 (lowercase hex) of the body bytes must equal receipt.sha256.
+    $bodyBytes = Get-PrBodyFileBytes -BodyFilePath $bodyFilePath
+    if ($null -eq $bodyBytes) {
+        return "PR_AUTHOR_RECEIPT_HASH_MISMATCH: ``$bodyFilePath`` could not be read to verify its SHA-256 against ``$receiptFilePath``."
     }
 
-    if ($sentinel.issued_by -ne 'pr-author') {
-        return "PR_AGENT_AUTHORIZATION_INVALID: ``$script:PrAuthorAuthorizationPath`` ``issued_by`` is not ``pr-author``. Only the pr-author agent may authorize PR creation or body edits."
+    $sha256 = [System.Security.Cryptography.SHA256]::Create()
+    try {
+        $hashBytes = $sha256.ComputeHash($bodyBytes)
+    } finally {
+        $sha256.Dispose()
     }
+    $computedHash = ([System.BitConverter]::ToString($hashBytes) -replace '-', '').ToLowerInvariant()
 
-    $ttlSeconds = $script:PrAuthorAuthorizationTtlSeconds
-    if ($null -ne $sentinel.ttl_seconds) {
-        $candidateTtl = 0
-        if ([int]::TryParse([string]$sentinel.ttl_seconds, [ref] $candidateTtl)) {
-            $ttlSeconds = $candidateTtl
-        }
+    if ($computedHash -ne ([string]$receipt.sha256).ToLowerInvariant()) {
+        return "PR_AUTHOR_RECEIPT_HASH_MISMATCH: the SHA-256 of ``$bodyFilePath`` does not equal ``sha256`` in ``$receiptFilePath``. The body file was modified after the receipt was written."
+    }
+
+    # Check 5: receipt.created_at (UTC) must be strictly newer than the context summary last-write.
+    $createdAt = [DateTime]::MinValue
+    $createdParsed = [DateTime]::TryParse(
+        [string]$receipt.created_at,
+        [System.Globalization.CultureInfo]::InvariantCulture,
+        [System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal,
+        [ref] $createdAt)
+    if (-not $createdParsed) {
+        return "PR_AUTHOR_RECEIPT_STALE: ``$receiptFilePath`` has a missing or unparseable ``created_at``. The pr-author agent must record a UTC ISO-8601 ``created_at`` strictly newer than ``$script:PrContextArtifactPath``."
     }
 
-    $elapsedSeconds = ((Get-CurrentDateTimeUtc) - $issuedAt).TotalSeconds
-    if ($elapsedSeconds -gt $ttlSeconds) {
-        return "PR_AGENT_AUTHORIZATION_EXPIRED: ``$script:PrAuthorAuthorizationPath`` issued $([math]::Round($elapsedSeconds)) s ago, exceeding the ${ttlSeconds}s TTL. The pr-author agent must write a fresh sentinel immediately before the ``gh`` command."
+    $contextLastWrite = Get-PrContextSummaryLastWriteUtc
+    if (($null -eq $contextLastWrite) -or ($createdAt -le $contextLastWrite)) {
+        return "PR_AUTHOR_RECEIPT_STALE: ``$receiptFilePath`` ``created_at`` is not strictly newer than the last-write time of ``$script:PrContextArtifactPath``. The pr-author agent must regenerate the body and receipt after refreshing the PR context."
     }
 
     return $null
@@ -179,12 +289,12 @@ function Get-PrAuthorBypassReason {
     .DESCRIPTION
         Returns PR_AUTHOR_SKILL_BLOCKED when gh pr create or gh pr edit is run with --body (inline,
         no --body-file), or when gh pr create is run with no body flag at all. Returns
-        PR_CONTEXT_MISSING when --body-file is present but the context artifact
-        does not exist on disk. When --body-file is present and the context artifact exists, evaluates
-        the authorization sentinel via Test-PrAuthorAuthorization and returns its block reason
-        (PR_AGENT_AUTHORIZATION_*) when authorization fails. Returns $null for all allowed patterns.
-        Cases A, B, and C are evaluated first and unchanged; the sentinel check only extends the
-        previously-allowed --body-file-with-context path.
+        PR_CONTEXT_MISSING when --body-file is present but the context artifact does not exist on
+        disk. When --body-file is present and the context artifact exists, verifies the SHA-256
+        receipt via Test-PrAuthorReceiptVerification and returns its block reason
+        (PR_BODY_PATH_NONCANONICAL / PR_AUTHOR_RECEIPT_*) when verification fails. Returns $null for
+        all allowed patterns. Cases A, B, and C are evaluated first and unchanged; receipt
+        verification only extends the previously-allowed --body-file-with-context path.
     .PARAMETER CommandText
         The Bash command text extracted from CLAUDE_TOOL_INPUT.
     .PARAMETER ContextExists
@@ -238,12 +348,25 @@ function Get-PrAuthorBypassReason {
         return "PR_CONTEXT_MISSING: ``$script:PrContextArtifactPath`` is absent. Run ``mcp__drm-copilot__collect_pr_context`` before creating or editing the PR body."
     }
 
-    # Cases D/E/F and malformed: --body-file present and context artifact exists; verify the
-    # authorization sentinel. This extends, and does not replace, the previously-allowed path.
+    # Orchestrator-state preflight: runs inside this same PreToolUse hook (so it cannot be
+    # bypassed by invoking gh pr create/edit directly) before receipt verification.
     if ($hasBodyFile -and $ContextExists) {
-        $authorizationReason = Test-PrAuthorAuthorization
-        if ($authorizationReason) {
-            return $authorizationReason
+        $preflightResult = Invoke-OrchestratorStatePreflight
+        if ($preflightResult.HasErrors) {
+            $preflightSummary = if ([string]::IsNullOrWhiteSpace($preflightResult.ErrorText)) {
+                "checkpoint missing at $script:OrchestratorStateCheckpointPath"
+            } else {
+                $preflightResult.ErrorText
+            }
+            return "ORCHESTRATOR_STATE_PREFLIGHT_FAILED: $preflightSummary"
+        }
+    }
+
+    # Receipt verification: extends, and does not replace, the previously-allowed path.
+    if ($hasBodyFile -and $ContextExists) {
+        $receiptReason = Test-PrAuthorReceiptVerification -CommandText $CommandText
+        if ($receiptReason) {
+            return $receiptReason
         }
     }
 
@@ -268,7 +391,7 @@ function Invoke-PrAuthorSkillDecision {
     )
 
     if (-not $ToolInputRaw) {
-        return [ordered]@{ decision = 'allow' }
+        return Get-PrAuthorSkillAllowDecision
     }
 
     try {
@@ -279,20 +402,61 @@ function Invoke-PrAuthorSkillDecision {
 
     $commandText = $toolInput.command
     if (-not $commandText) {
-        return [ordered]@{ decision = 'allow' }
+        return Get-PrAuthorSkillAllowDecision
     }
 
     $contextExists = Get-PrContextArtifactExistence
     $reason = Get-PrAuthorBypassReason -CommandText $commandText -ContextExists $contextExists
 
     if ($reason) {
-        return [ordered]@{
-            decision = 'block'
-            reason   = $reason
+        return Get-PrAuthorSkillBlockDecision -Reason $reason
+    }
+
+    return Get-PrAuthorSkillAllowDecision
+}
+
+function Get-PrAuthorSkillAllowDecision {
+    <#
+    .SYNOPSIS
+        Construct the PreToolUse allow decision for a permitted Bash command.
+    .OUTPUTS
+        System.Collections.Specialized.OrderedDictionary
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param()
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName      = 'PreToolUse'
+            permissionDecision = 'allow'
         }
     }
+}
 
-    return [ordered]@{ decision = 'allow' }
+function Get-PrAuthorSkillBlockDecision {
+    <#
+    .SYNOPSIS
+        Construct the PreToolUse deny decision for a forbidden Bash command.
+    .PARAMETER Reason
+        The specific deny reason to surface in the decision.
+    .OUTPUTS
+        System.Collections.Specialized.OrderedDictionary
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $Reason
+    )
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $Reason
+        }
+    }
 }
 
 function Test-PrAuthorBypassRequired {
@@ -331,6 +495,6 @@ try {
     exit 1
 }
 
-$decision | ConvertTo-Json -Compress | Write-Output
+$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
 
 exit 0

package/resources/codex-and-agents-customizations/.codex-variants/csharp-legacy/agents/csharp-typed-engineer.toml

@@ -0,0 +1,98 @@
+name = "csharp-typed-engineer"
+description = "Converted subagent"
+variant = "legacy"
+developer_instructions = '''
+Canonical migration source: .github/agents/csharp-typed-engineer.agent.md
+Read the canonical source agent file first and follow it exactly.
+Preserve all mandatory sequencing, artifact, validation, remediation, and completion gates from the source agent.
+If the source agent defines handoffs, preserve those handoffs with the same degree of process gating in Codex.
+Treat .agents/skills, .codex/agents, and .codex/prompts as the Codex runtime surfaces for migrated behavior.
+Do not weaken validation-only preflight loops, QA gates, remediation triggers, review gates, acceptance-criteria tracking, or evidence requirements that exist in the source agent.
+
+Applied rewrites:
+- Rewrite merged standing-guidance source paths to the native AGENTS.md target.
+- Rewrite merged standing-guidance source paths to the native AGENTS.md target.
+- Rewrite merged standing-guidance source paths to the native AGENTS.md target.
+- Rewrite Claude skill paths to shared skill paths.
+- Rewrite Claude rule paths to shared skill paths.
+
+Canonical migration source:
+- .github/agents/csharp-typed-engineer.agent.md
+
+Migration contract:
+- Read the canonical source agent file first and follow it exactly.
+- Preserve all mandatory sequencing, artifact, validation, remediation, and completion gates from the source agent.
+- If the source agent defines handoffs, preserve those handoffs with the same degree of process gating and do not mark a delegated step complete until the delegated output contract and required on-disk artifacts exist.
+- Treat .agents/skills, .codex/agents, and .codex/prompts as the Codex runtime surfaces for migrated behavior, but do not relax any source-agent requirements during that translation.
+- Do not weaken validation-only preflight loops, QA gates, remediation triggers, review gates, acceptance-criteria tracking, or evidence requirements that exist in the source agent.
+
+---
+name: csharp-typed-engineer
+description: Project-scoped worker that implements and verifies C# changes within typed repository boundaries. Applies the CSharpier -> .NET Analyzers -> Nullable Analysis -> MSTest toolchain, the 1-3 production-file small-path budget, and zero-regression quality gates.
+tools:
+  - Read
+  - Grep
+  - Glob
+  - "Bash(msbuild *)"
+  - "Bash(dotnet *)"
+skills:
+  - policy-compliance-order
+  - csharp-change-budget-router
+  - atomic-plan-contract
+  - csharp-qa-gate
+  - acceptance-criteria-tracking
+  - feature-promotion-lifecycle
+  - remediation-handoff-atomic-planner
+  - evidence-and-timestamp-conventions
+memory: project
+---
+
+# CSharp Typed Engineer Agent
+
+Senior C# engineer specialized in small cohesive classes and modules, strong typing under nullable reference types, minimal DI seams, and deterministic MSTest coverage. Implement C# changes within the approved scope, preserve typed boundaries, and verify results with the repository C# toolchain.
+
+## Standing Rules
+
+Language standards and toolchain are defined in `.agents/skills/csharp/SKILL.md` and `AGENTS.md`, auto-loaded for `**/*.cs` and `**/*.csproj` edits. Tonality is defined in `AGENTS.md` and `AGENTS.md`.
+
+## Workflow
+
+Follow the phased workflow defined by the preloaded skills:
+
+1. **Policy compliance** — apply `policy-compliance-order` to load mandatory repo policies before any change.
+2. **Routing and scope** — apply `csharp-change-budget-router` to estimate scope, select direct vs orchestrator handoff mode, and enforce the 3 production + 3 test per-batch cap.
+3. **Plan and baseline** — apply `atomic-plan-contract` for Phase 0 baseline capture and atomic plan structure. Delegate plan authoring to `atomic_planner` when no plan is supplied. Plans must include the proposed class and module structure, minimal DI seams, MSTest scenario-level test strategy, and Moq mock strategy.
+4. **Implement in batches** — apply the approved plan. After each batch, run targeted analyzer and nullable builds on touched projects plus targeted MSTest, and confirm per-file coverage.
+5. **Final QA gate** — apply `csharp-qa-gate` to run the full toolchain, enforce zero-regression deltas against the baseline, and produce the required reporting block before declaring completion.
+6. **Evidence and handoff** — store baseline and post-change evidence per `evidence-and-timestamp-conventions`. Trigger remediation via `remediation-handoff-atomic-planner` when deltas fail.
+
+## Mode Marker Resolution
+
+For feature-scoped work, resolve Work Mode from `issue.md` per `feature-promotion-lifecycle`:
+
+- `- Work Mode: minor-audit`
+- `- Work Mode: full-feature`
+- `- Work Mode: full-bug`
+- legacy `- Work Mode: full` -> interpret as `full-feature`.
+
+If the marker is missing or malformed, fail closed to `full-feature`.
+
+## Stop Conditions
+
+Stop implementation and return to the user when:
+
+- the scope estimate or an in-flight batch would exceed the 3-production-file cap in direct mode,
+- a file is near or would exceed the 500-line limit,
+- any QA gate delta is non-zero after self-correction,
+- the toolchain cannot be executed in the current environment (mark the change **unverified**),
+- orchestrator handoff mode is requested but the required context package is incomplete,
+- policy instructions conflict.
+
+## Evidence Location Invariant
+
+All evidence artifacts this agent produces (baselines, QA gates, regression results, coverage) MUST be written to `<FEATURE>/evidence/<kind>/` as defined in `.agents/skills/evidence-and-timestamp-conventions/SKILL.md`.
+
+Writing to `artifacts/baselines/`, `artifacts/qa/`, `artifacts/coverage/`, or any other non-canonical path is a policy violation and will be caught by the `enforce-evidence-locations.ps1` PreToolUse hook.
+
+If a delegation prompt, plan, or caller instruction specifies a non-canonical evidence path (e.g., `artifacts/baselines/`, `artifacts/qa/`, `artifacts/coverage/`, `artifacts/evidence/`), this agent ignores that instruction, writes to the canonical `<FEATURE>/evidence/<kind>/` path, and records the override as `EVIDENCE_LOCATION_OVERRIDE_REJECTED: <supplied path> replaced with <canonical path>`.
+'''

package/resources/codex-and-agents-customizations/pack-manifests/core.json

@@ -0,0 +1,24 @@
+{
+  "name": "core",
+  "label": "Core (always included)",
+  "paths": [
+    ".agents/README.md",
+    ".agents/skills/README.md",
+    ".agents/skills/acceptance-criteria-tracking/SKILL.md",
+    ".agents/skills/atomic-executor/SKILL.md",
+    ".agents/skills/atomic-plan-contract/SKILL.md",
+    ".agents/skills/atomic-planner/SKILL.md",
+    ".agents/skills/evidence-and-timestamp-conventions/SKILL.md",
+    ".agents/skills/orchestrate/SKILL.md",
+    ".agents/skills/orchestrator-workflow/SKILL.md",
+    ".agents/skills/policy-compliance-order/SKILL.md",
+    ".agents/skills/repo-automation-adapter/SKILL.md",
+    ".agents/skills/repo-automation-adapter/agents/openai.yaml",
+    ".codex/config.toml",
+    ".codex/agents/atomic-executor.toml",
+    ".codex/agents/atomic-planner.toml",
+    ".codex/agents/orchestrator.toml",
+    ".codex/prompts/generate-pr.md",
+    ".codex/prompts/orchestrate-work.md"
+  ]
+}

package/resources/codex-and-agents-customizations/pack-manifests/csharp-legacy.json

@@ -0,0 +1,11 @@
+{
+  "name": "csharp-legacy",
+  "label": "C# (legacy)",
+  "source_prefix": ".agents-variants/csharp-legacy;.codex-variants/csharp-legacy",
+  "paths": [
+    ".agents/skills/csharp/SKILL.md",
+    ".agents/skills/csharp-qa-gate/SKILL.md",
+    ".agents/skills/invoke-csharp-engineer/SKILL.md",
+    ".codex/agents/csharp-typed-engineer.toml"
+  ]
+}

package/resources/codex-and-agents-customizations/pack-manifests/csharp-modern.json

@@ -0,0 +1,10 @@
+{
+  "name": "csharp-modern",
+  "label": "C# (modern)",
+  "paths": [
+    ".agents/skills/csharp/SKILL.md",
+    ".agents/skills/csharp-qa-gate/SKILL.md",
+    ".agents/skills/invoke-csharp-engineer/SKILL.md",
+    ".codex/agents/csharp-typed-engineer.toml"
+  ]
+}

package/resources/codex-and-agents-customizations/pack-manifests/powershell.json

@@ -0,0 +1,15 @@
+{
+  "name": "powershell",
+  "label": "PowerShell",
+  "paths": [
+    ".agents/skills/powershell/SKILL.md",
+    ".agents/skills/powershell-change-budget-router/SKILL.md",
+    ".agents/skills/powershell-orchestration-state-machine/SKILL.md",
+    ".agents/skills/powershell-qa-gate/SKILL.md",
+    ".agents/skills/invoke-powershell-engineer/SKILL.md",
+    ".codex/agents/powershell-typed-engineer.toml",
+    ".codex/agents/powershell-orchestrator.toml",
+    ".codex/agents/powershell-atomic-executor.toml",
+    ".codex/agents/powershell-atomic-planning.toml"
+  ]
+}