@danmoisan/drm-copilot-mcp 1.0.0 → 1.0.7

package/resources/claude-customizations/.claude/hooks/check-python-test-purity.ps1

@@ -38,8 +38,11 @@ function Get-PythonTestPurityBlockDecision {
     )
 
     [ordered]@{
-        decision = 'block'
-        reason   = $Reason
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $Reason
+        }
     }
 }
 
@@ -63,7 +66,7 @@ function Invoke-PythonTestPurityDecision {
     )
 
     if (-not $ToolInputRaw) {
-        return [ordered]@{ decision = 'allow' }
+        return $null
     }
 
     try {
@@ -74,11 +77,11 @@ function Invoke-PythonTestPurityDecision {
 
     $filePath = $toolInput.file_path
     if (-not $filePath) {
-        return [ordered]@{ decision = 'allow' }
+        return $null
     }
 
     if (-not (Test-PythonTestFilePath -FilePath $filePath)) {
-        return [ordered]@{ decision = 'allow' }
+        return $null
     }
 
     $content = $null
@@ -89,7 +92,7 @@ function Invoke-PythonTestPurityDecision {
     }
 
     if (-not $content) {
-        return [ordered]@{ decision = 'allow' }
+        return $null
     }
 
     $forbiddenPatterns = @(
@@ -125,7 +128,7 @@ function Invoke-PythonTestPurityDecision {
     }
 
     if ($violations.Count -eq 0) {
-        return [ordered]@{ decision = 'allow' }
+        return $null
     }
 
     $uniqueViolations = $violations | Select-Object -Unique
@@ -139,8 +142,8 @@ if ($MyInvocation.InvocationName -eq '.') {
 }
 
 $decision = Invoke-PythonTestPurityDecision -ToolInputRaw $env:CLAUDE_TOOL_INPUT
-if ($decision.decision -eq 'block') {
-    $decision | ConvertTo-Json -Compress | Write-Output
+if ($null -ne $decision -and $decision.hookSpecificOutput.permissionDecision -eq 'deny') {
+    $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
 }
 
 exit 0

package/resources/claude-customizations/.claude/hooks/enforce-checkpoint-monotonic.ps1

@@ -27,9 +27,11 @@
 
     Entries that do not match any canonical prefix are treated as informational
     and ignored. If any pair (i, j) with i < j has a higher canonical index at
-    position i than at position j, the script blocks with a reason listing the
-    offending pair. A non-empty rollback_history array suppresses this check
-    because rollbacks legitimately reorder steps.
+    position i than at position j, the script denies via a PreToolUse JSON
+    response with hookSpecificOutput.permissionDecision='deny' and a reason
+    listing the offending pair. A non-empty rollback_history array suppresses
+    this check because rollbacks legitimately reorder steps. All allow paths
+    emit hookSpecificOutput.permissionDecision='allow'.
 
     Edit tool calls supply only old_string/new_string (a partial patch) and
     cannot be reliably validated without the full target file content, so they
@@ -204,7 +206,7 @@ function Invoke-CheckpointMonotonicDecision {
     )
 
     if (-not $ToolInputRaw) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     try {
@@ -216,19 +218,19 @@ function Invoke-CheckpointMonotonicDecision {
 
     $filePath = $toolInput.file_path
     if (-not $filePath) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     $normalized = $filePath -replace '\\', '/'
     if (-not (Test-IsCheckpointPath -NormalizedPath $normalized)) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     # Write tool: validate the content payload. Edit tool: partial new_string is
     # not reliable without the full target file content, so allow.
     $content = $toolInput.content
     if (-not $content) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     try {
@@ -237,11 +239,11 @@ function Invoke-CheckpointMonotonicDecision {
     catch {
         # The content itself is not valid JSON. Let downstream tools surface the
         # error rather than blocking with a misleading reason here.
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     if (-not $payload.PSObject.Properties.Name -contains 'completed_steps') {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     $steps = @()
@@ -256,14 +258,17 @@ function Invoke-CheckpointMonotonicDecision {
         $rollbackHistory = $payload.rollback_history
     }
     if ($rollbackHistory -and @($rollbackHistory).Count -gt 0) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     $pair = if ($steps.Count -ge 2) { Get-OutOfOrderPair -CompletedSteps $steps } else { $null }
     if ($null -ne $pair) {
         return [ordered]@{
-            decision = 'block'
-            reason   = "CHECKPOINT_ORDER_BLOCKED: completed_steps lists '$($pair.EarlierEntry)' at position $($pair.EarlierPos) before '$($pair.LaterEntry)' at position $($pair.LaterPos), but the canonical orchestrator workflow requires the later step to follow the earlier one. Reorder completed_steps or, if a rollback occurred, record it in rollback_history."
+            hookSpecificOutput = [ordered]@{
+                hookEventName            = 'PreToolUse'
+                permissionDecision       = 'deny'
+                permissionDecisionReason = "CHECKPOINT_ORDER_BLOCKED: completed_steps lists '$($pair.EarlierEntry)' at position $($pair.EarlierPos) before '$($pair.LaterEntry)' at position $($pair.LaterPos), but the canonical orchestrator workflow requires the later step to follow the earlier one. Reorder completed_steps or, if a rollback occurred, record it in rollback_history."
+            }
         }
     }
 
@@ -277,12 +282,15 @@ function Invoke-CheckpointMonotonicDecision {
             $missing += 'S4_atomic_planning'
         }
         return [ordered]@{
-            decision = 'block'
-            reason   = "CHECKPOINT_ORDER_BLOCKED: completed_steps lists '$($missingPrerequisite.Step)' before required prerequisite step(s): $($missing -join ', '). Record promotion and planning completion before implementation, review, PR, CI, or DONE steps."
+            hookSpecificOutput = [ordered]@{
+                hookEventName            = 'PreToolUse'
+                permissionDecision       = 'deny'
+                permissionDecisionReason = "CHECKPOINT_ORDER_BLOCKED: completed_steps lists '$($missingPrerequisite.Step)' before required prerequisite step(s): $($missing -join ', '). Record promotion and planning completion before implementation, review, PR, CI, or DONE steps."
+            }
         }
     }
 
-    return [ordered]@{ decision = 'allow' }
+    return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
 }
 
 # Guard allows dot-sourcing in tests without executing the entrypoint.
@@ -298,6 +306,6 @@ catch {
     exit 1
 }
 
-$decision | ConvertTo-Json -Compress | Write-Output
+$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
 
 exit 0

package/resources/claude-customizations/.claude/hooks/enforce-completion-consistency.ps1

@@ -23,9 +23,11 @@
         variables.feature-folder);
       - a ci_gate object with conclusion == "success" and a non-empty head_sha.
 
-    The block reason names the specific missing evidence so the caller can
-    remediate. When completion is not asserted, the write is allowed
-    (backward compatibility).
+    When completion evidence is missing the hook emits a PreToolUse JSON
+    response with hookSpecificOutput.permissionDecision='deny' and a reason that
+    names the specific missing evidence so the caller can remediate. When
+    completion is not asserted, the write is allowed via
+    hookSpecificOutput.permissionDecision='allow' (backward compatibility).
 
     Edit tool calls supply only old_string/new_string (a partial patch) and
     cannot be reliably validated without the full target file content, so they
@@ -331,7 +333,7 @@ function Invoke-CompletionConsistencyDecision {
     )
 
     if (-not $ToolInputRaw) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     try {
@@ -343,12 +345,12 @@ function Invoke-CompletionConsistencyDecision {
 
     $filePath = $toolInput.file_path
     if (-not $filePath) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     $normalized = $filePath -replace '\\', '/'
     if (-not (Test-IsCheckpointPath -NormalizedPath $normalized)) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     # Write tool: validate the content payload directly. Edit tool: no content is
@@ -360,7 +362,7 @@ function Invoke-CompletionConsistencyDecision {
         if (-not $content) {
             # No content, and the Edit could not be resolved against on-disk
             # state (missing file or non-matching patch): defer and allow.
-            return [ordered]@{ decision = 'allow' }
+            return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
         }
     }
 
@@ -370,11 +372,11 @@ function Invoke-CompletionConsistencyDecision {
     catch {
         # The content itself is not valid JSON. Let downstream tools surface the
         # error rather than blocking with a misleading reason here.
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     if (-not (Test-CompletionAsserted -Payload $payload)) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     $missingArgs = @{ Payload = $payload; FolderExistsCheck = $FolderExistsCheck }
@@ -383,12 +385,16 @@ function Invoke-CompletionConsistencyDecision {
     }
     $missing = Get-MissingCompletionEvidence @missingArgs
     if ($missing.Count -eq 0) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
+    $reason = "COMPLETION_CONSISTENCY_BLOCKED: the checkpoint asserts completion but is missing required completion evidence: $($missing -join ', '). A completion-asserting checkpoint must include a non-empty issue-num, a non-empty feature-folder, and a ci_gate object with conclusion == 'success' and a non-empty head_sha; routes whose requires_pr_gate is true must also include pr_gate evidence with a matching head_sha. Supply the missing evidence or remove the completion assertion."
     return [ordered]@{
-        decision = 'block'
-        reason   = "COMPLETION_CONSISTENCY_BLOCKED: the checkpoint asserts completion but is missing required completion evidence: $($missing -join ', '). A completion-asserting checkpoint must include a non-empty issue-num, a non-empty feature-folder, and a ci_gate object with conclusion == 'success' and a non-empty head_sha; routes whose requires_pr_gate is true must also include pr_gate evidence with a matching head_sha. Supply the missing evidence or remove the completion assertion."
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $reason
+        }
     }
 }
 
@@ -405,6 +411,6 @@ catch {
     exit 1
 }
 
-$decision | ConvertTo-Json -Compress | Write-Output
+$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
 
 exit 0

package/resources/claude-customizations/.claude/hooks/enforce-epic-merge-gate.ps1

@@ -0,0 +1,304 @@
+<#
+.SYNOPSIS
+    Pre-tool-use hook that gates gh pr merge --merge behind epic-mode checkpoint state.
+
+.DESCRIPTION
+    Invoked by the Claude Code PreToolUse hook on the "Bash" matcher before any Bash
+    command runs. Regex-matches gh pr merge with a --merge flag against
+    CLAUDE_TOOL_INPUT.command and, when matched, allows the merge only when one of two
+    checkpoint-only conditions holds:
+
+      1. Child-feature path: artifacts/orchestration/orchestrator-state.json exists,
+         epic_mode == true, and step9_status == "passed" (the per-feature orchestrator has
+         already run S9 step 6's CI-green gate before attempting its own merge-on-green).
+      2. Epic-integration path: artifacts/orchestration/epic-orchestrator-state.json exists,
+         epic_merge_pr.ci_gate.conclusion == "success", and, when the command names an
+         explicit PR number, that number matches epic_merge_pr.pr_number.
+
+    Otherwise the command is denied with reason EPIC_MERGE_GATE_BLOCKED. A missing or
+    unreadable checkpoint in either branch fails closed (denies); standalone (non-epic)
+    orchestration never sets epic_mode or populates epic_merge_pr, so it is structurally
+    prevented from invoking gh pr merge --merge at all.
+
+    Design decision: this gate trusts the on-disk checkpoint rather than shelling out live
+    to gh pr view for a real-time head-SHA check, matching the same non-adversarial,
+    policy-level-not-cryptographic posture already accepted for
+    enforce-pr-author-skill.ps1's own receipt mechanism. It is not a cryptographic control.
+
+.NOTES
+    Compatible with PowerShell 7+. No external module dependencies. Filesystem reads go
+    through injectable wrapper functions so tests can mock the boundary without writing
+    temporary files.
+#>
+[CmdletBinding()]
+param()
+
+$script:ChildCheckpointPath = 'artifacts/orchestration/orchestrator-state.json'
+$script:EpicCheckpointPath = 'artifacts/orchestration/epic-orchestrator-state.json'
+
+function Get-ChildOrchestratorCheckpointContent {
+    <#
+    .SYNOPSIS
+        Read the raw JSON text of the per-feature orchestrator checkpoint. Tests mock
+        this function (read seam).
+    .OUTPUTS
+        System.String or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param()
+
+    if (-not (Test-Path -LiteralPath $script:ChildCheckpointPath -PathType Leaf)) {
+        return $null
+    }
+    return (Get-Content -LiteralPath $script:ChildCheckpointPath -Raw)
+}
+
+function Get-EpicOrchestratorCheckpointContent {
+    <#
+    .SYNOPSIS
+        Read the raw JSON text of the epic checkpoint. Tests mock this function
+        (read seam).
+    .OUTPUTS
+        System.String or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param()
+
+    if (-not (Test-Path -LiteralPath $script:EpicCheckpointPath -PathType Leaf)) {
+        return $null
+    }
+    return (Get-Content -LiteralPath $script:EpicCheckpointPath -Raw)
+}
+
+function ConvertFrom-EpicMergeGateJson {
+    <#
+    .SYNOPSIS
+        Parse checkpoint JSON text, returning $null on unreadable/invalid content.
+    .PARAMETER Raw
+        Raw checkpoint text, or $null when the file does not exist.
+    .OUTPUTS
+        System.Object or $null
+    #>
+    [CmdletBinding()]
+    param(
+        [AllowNull()]
+        [string] $Raw
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Raw)) {
+        return $null
+    }
+    try {
+        return ($Raw | ConvertFrom-Json -ErrorAction Stop)
+    } catch {
+        return $null
+    }
+}
+
+function Get-EpicMergeGateCommandPrNumber {
+    <#
+    .SYNOPSIS
+        Extract an explicit PR number argument from a gh pr merge command, or $null.
+    .PARAMETER CommandText
+        The Bash command text under evaluation.
+    .OUTPUTS
+        System.Nullable[int]
+    #>
+    [CmdletBinding()]
+    [OutputType([int])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $CommandText
+    )
+
+    if ($CommandText -match '(?i)\bgh\s+pr\s+merge\s+(\d+)\b') {
+        return [int]$Matches[1]
+    }
+    return $null
+}
+
+function Test-ChildCheckpointAllowsEpicMerge {
+    <#
+    .SYNOPSIS
+        Decision logic for the child-feature checkpoint path (branch 1).
+    .PARAMETER Checkpoint
+        Parsed child orchestrator checkpoint, or $null when absent/unreadable.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()]
+        $Checkpoint
+    )
+
+    if ($null -eq $Checkpoint) {
+        return $false
+    }
+    $props = @($Checkpoint.PSObject.Properties.Name)
+    if ($props -notcontains 'epic_mode' -or -not [bool]$Checkpoint.epic_mode) {
+        return $false
+    }
+    if ($props -notcontains 'step9_status') {
+        return $false
+    }
+    return ([string]$Checkpoint.step9_status) -eq 'passed'
+}
+
+function Test-EpicCheckpointAllowsMerge {
+    <#
+    .SYNOPSIS
+        Decision logic for the epic-integration checkpoint path (branch 2).
+    .PARAMETER Checkpoint
+        Parsed epic checkpoint, or $null when absent/unreadable.
+    .PARAMETER CommandPrNumber
+        The explicit PR number parsed from the command, or $null when the command
+        does not name one (implying the current branch's PR).
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()]
+        $Checkpoint,
+
+        [AllowNull()]
+        [Nullable[int]] $CommandPrNumber
+    )
+
+    if ($null -eq $Checkpoint) {
+        return $false
+    }
+    $props = @($Checkpoint.PSObject.Properties.Name)
+    if ($props -notcontains 'epic_merge_pr' -or $null -eq $Checkpoint.epic_merge_pr) {
+        return $false
+    }
+    $mergePr = $Checkpoint.epic_merge_pr
+    $mergePrProps = @($mergePr.PSObject.Properties.Name)
+    if ($mergePrProps -notcontains 'ci_gate' -or $null -eq $mergePr.ci_gate) {
+        return $false
+    }
+    $ciGateProps = @($mergePr.ci_gate.PSObject.Properties.Name)
+    if ($ciGateProps -notcontains 'conclusion' -or ([string]$mergePr.ci_gate.conclusion) -ne 'success') {
+        return $false
+    }
+
+    # When the command names an explicit PR number, it must match the checkpoint's
+    # recorded epic_merge_pr.pr_number; a bare "gh pr merge --merge" implicitly targets
+    # the current branch's PR and is trusted per the checkpoint-only design decision.
+    if ($null -ne $CommandPrNumber) {
+        if ($mergePrProps -notcontains 'pr_number') {
+            return $false
+        }
+        $checkpointPrNumber = 0
+        if (-not [int]::TryParse([string]$mergePr.pr_number, [ref] $checkpointPrNumber)) {
+            return $false
+        }
+        if ($checkpointPrNumber -ne $CommandPrNumber) {
+            return $false
+        }
+    }
+
+    return $true
+}
+
+function Get-EpicMergeGateAllowDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param()
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName      = 'PreToolUse'
+            permissionDecision = 'allow'
+        }
+    }
+}
+
+function Get-EpicMergeGateBlockDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $Reason
+    )
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $Reason
+        }
+    }
+}
+
+function Invoke-EpicMergeGateDecision {
+    <#
+    .SYNOPSIS
+        Parses CLAUDE_TOOL_INPUT and returns an allow-or-block decision.
+    .PARAMETER ToolInputRaw
+        The raw JSON tool payload supplied by Claude Code.
+    .OUTPUTS
+        System.Collections.Specialized.OrderedDictionary
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [string] $ToolInputRaw
+    )
+
+    if (-not $ToolInputRaw) {
+        return Get-EpicMergeGateAllowDecision
+    }
+
+    try {
+        $toolInput = $ToolInputRaw | ConvertFrom-Json -ErrorAction Stop
+    } catch {
+        throw "enforce-epic-merge-gate hook received malformed JSON in CLAUDE_TOOL_INPUT: $_"
+    }
+
+    $commandText = $toolInput.command
+    if (-not $commandText) {
+        return Get-EpicMergeGateAllowDecision
+    }
+
+    # Only a gh pr merge invocation carrying --merge is in scope for this gate; every
+    # other Bash command is unaffected.
+    if ($commandText -notmatch '(?i)\bgh\s+pr\s+merge\b' -or $commandText -notmatch '--merge\b') {
+        return Get-EpicMergeGateAllowDecision
+    }
+
+    $commandPrNumber = Get-EpicMergeGateCommandPrNumber -CommandText $commandText
+
+    $childCheckpoint = ConvertFrom-EpicMergeGateJson -Raw (Get-ChildOrchestratorCheckpointContent)
+    if (Test-ChildCheckpointAllowsEpicMerge -Checkpoint $childCheckpoint) {
+        return Get-EpicMergeGateAllowDecision
+    }
+
+    $epicCheckpoint = ConvertFrom-EpicMergeGateJson -Raw (Get-EpicOrchestratorCheckpointContent)
+    if (Test-EpicCheckpointAllowsMerge -Checkpoint $epicCheckpoint -CommandPrNumber $commandPrNumber) {
+        return Get-EpicMergeGateAllowDecision
+    }
+
+    return Get-EpicMergeGateBlockDecision -Reason 'EPIC_MERGE_GATE_BLOCKED: gh pr merge --merge requires either a per-feature checkpoint with epic_mode == true and step9_status == "passed", or an epic checkpoint with epic_merge_pr.ci_gate.conclusion == "success" and a matching pr_number. Neither checkpoint satisfied this gate.'
+}
+
+# Guard allows dot-sourcing in tests without executing the entrypoint.
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+
+try {
+    $decision = Invoke-EpicMergeGateDecision -ToolInputRaw $env:CLAUDE_TOOL_INPUT
+} catch {
+    Write-Error $_
+    exit 1
+}
+
+$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+
+exit 0