@danmoisan/drm-copilot-mcp 1.0.13 → 1.0.15

package/resources/codex-and-agents-customizations/.codex/agents/typescript-engineer-c4.toml

@@ -0,0 +1,50 @@
+name = "typescript-engineer-c4"
+description = "Converted subagent"
+model = "gpt-5.6-sol"
+model_reasoning_effort = "max"
+developer_instructions = '''
+Canonical migration source: .github/agents/typescript-engineer.agent.md
+Read the canonical source agent file first and follow it exactly.
+Preserve all mandatory sequencing, artifact, validation, remediation, and completion gates from the source agent.
+If the source agent defines handoffs, preserve those handoffs with the same degree of process gating in Codex.
+Treat .agents/skills, .codex/agents, and .codex/prompts as the Codex runtime surfaces for migrated behavior.
+Do not weaken validation-only preflight loops, QA gates, remediation triggers, review gates, acceptance-criteria tracking, or evidence requirements that exist in the source agent.
+
+Applied rewrites:
+- Rewrite Claude skill paths to shared skill paths.
+
+Canonical migration source:
+- .github/agents/typescript-engineer.agent.md
+
+Migration contract:
+- Read the canonical source agent file first and follow it exactly.
+- Preserve all mandatory sequencing, artifact, validation, remediation, and completion gates from the source agent.
+- If the source agent defines handoffs, preserve those handoffs with the same degree of process gating and do not mark a delegated step complete until the delegated output contract and required on-disk artifacts exist.
+- Treat .agents/skills, .codex/agents, and .codex/prompts as the Codex runtime surfaces for migrated behavior, but do not relax any source-agent requirements during that translation.
+- Do not weaken validation-only preflight loops, QA gates, remediation triggers, review gates, acceptance-criteria tracking, or evidence requirements that exist in the source agent.
+
+---
+name: typescript-engineer
+description: Project-scoped worker that implements and verifies TypeScript changes within typed repository boundaries.
+tools:
+  - Read
+  - Grep
+  - Glob
+  - "Bash(npx *)"
+skills:
+  - acceptance-criteria-tracking
+memory: project
+---
+
+# TypeScript Engineer Agent
+
+Implement TypeScript changes within the approved scope, preserve typed boundaries, and verify results with the repository TypeScript toolchain.
+
+## Evidence Location Invariant
+
+All evidence artifacts this agent produces (baselines, QA gates, regression results, coverage) MUST be written to `<FEATURE>/evidence/<kind>/` as defined in `.agents/skills/evidence-and-timestamp-conventions/SKILL.md`.
+
+Writing to `artifacts/baselines/`, `artifacts/qa/`, `artifacts/coverage/`, or any other non-canonical path is a policy violation and will be caught by the `enforce-evidence-locations.ps1` PreToolUse hook.
+
+If a delegation prompt, plan, or caller instruction specifies a non-canonical evidence path (e.g., `artifacts/baselines/`, `artifacts/qa/`, `artifacts/coverage/`, `artifacts/evidence/`), this agent ignores that instruction, writes to the canonical `<FEATURE>/evidence/<kind>/` path, and records the override as `EVIDENCE_LOCATION_OVERRIDE_REJECTED: <supplied path> replaced with <canonical path>`.
+'''

package/resources/codex-and-agents-customizations/.codex/agents/typescript-engineer.toml

@@ -1,5 +1,7 @@
 name = "typescript-engineer"
 description = "Converted subagent"
+model = "gpt-5.6-terra"
+model_reasoning_effort = "high"
 developer_instructions = '''
 Canonical migration source: .github/agents/typescript-engineer.agent.md
 Read the canonical source agent file first and follow it exactly.

package/resources/codex-and-agents-customizations/.codex/config.toml

@@ -2,7 +2,7 @@ default_permissions = ":danger-full-access"
 
 [mcp_servers.drm-copilot]
 command = "npx"
-args = ["-y", "@danmoisan/drm-copilot-mcp"]
+args = ["-y", "@danmoisan/drm-copilot-mcp@1.0.15"]
 required = true
 enabled_tools = [
     "collect_commit_context",
@@ -28,60 +28,225 @@ enabled_tools = [
 ]
 default_tools_approval_mode = "prompt"
 
+[mcp_servers.drm-copilot.tools.collect_commit_context]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.collect_pr_context]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.new_potential_bug_entry]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.new_potential_entry]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.link_parent_child]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.potential_to_issue]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.new_active_feature_folder]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.run_poshqc_format]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.run_poshqc_analyze]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.run_poshqc_test]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.run_poshqc_analyze_autofix]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.run_poshqc_suite]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.resolve_policy_audit_template_asset]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.resolve_execute_hard_lock_prompt]
+approval_mode = "approve"
+
+[mcp_servers.drm-copilot.tools.resolve_atomic_plan_prompt]
+approval_mode = "approve"
+
 [mcp_servers.drm-copilot.tools.validate_orchestration_artifacts]
 approval_mode = "approve"
 
-[features]
-multi_agent = true
+[permissions.orchestrator-workspace]
+description = "Workspace-scoped orchestration with network access for Git, GitHub, and MCP workflows."
+extends = ":workspace"
 
-[[hooks.PreToolUse]]
-matcher = "Bash"
-command = "pwsh -NoProfile -File .codex/hooks/validate-bash.ps1"
+[permissions.orchestrator-workspace.filesystem.":workspace_roots"]
+".codex" = "read"
+".agents" = "read"
+"AGENTS.md" = "read"
+"config/orchestration-routing.json" = "read"
 
-[[hooks.PreToolUse]]
-matcher = "Bash"
-command = "pwsh -NoProfile -File .codex/hooks/enforce-promotion-mcp-only.ps1"
+[permissions.orchestrator-workspace.network]
+enabled = true
 
-[[hooks.PreToolUse]]
-matcher = "Bash"
-command = "pwsh -NoProfile -File .codex/hooks/enforce-orchestration-preimplementation-gate.ps1"
+[features]
+multi_agent = true
+hooks = true
 
-[[hooks.PreToolUse]]
-matcher = "Write|Edit"
-command = "pwsh -NoProfile -File .codex/hooks/check-python-test-purity.ps1"
+[agents]
+max_depth = 3
+max_threads = 12
 
-[[hooks.PreToolUse]]
-matcher = "Write|Edit"
-command = "pwsh -NoProfile -File .codex/hooks/enforce-python-batch-budget.ps1"
+[[hooks.UserPromptSubmit]]
 
-[[hooks.PreToolUse]]
-matcher = "Write|Edit"
-command = "pwsh -NoProfile -File .codex/hooks/check-powershell-test-purity.ps1"
+[[hooks.UserPromptSubmit.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/authorize-root-epic-invocation.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/authorize-root-epic-invocation.ps1"'
+timeout = 15
+statusMessage = "Authorizing root epic entry"
 
-[[hooks.PreToolUse]]
-matcher = "Write|Edit"
-command = "pwsh -NoProfile -File .codex/hooks/enforce-powershell-batch-budget.ps1"
+[[hooks.SubagentStart]]
+matcher = "epic-planner|epic-orchestrator|orchestrator|atomic-planner|atomic-executor|feature-review|feature-reviewer|task-researcher|prd-feature|pr-author|typed-engineer|-c"
 
-[[hooks.PreToolUse]]
-matcher = "Write|Edit"
-command = "pwsh -NoProfile -File .codex/hooks/enforce-evidence-locations.ps1"
+[[hooks.SubagentStart.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/record-subagent-routing-attestation.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/record-subagent-routing-attestation.ps1"'
+timeout = 15
+statusMessage = "Recording subagent routing attestation"
 
 [[hooks.PreToolUse]]
-matcher = "Write|Edit"
-command = "pwsh -NoProfile -File .codex/hooks/enforce-orchestration-preimplementation-gate.ps1"
+matcher = "^Bash$"
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/validate-bash.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/validate-bash.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-promotion-mcp-only.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-promotion-mcp-only.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-orchestration-preimplementation-gate.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-orchestration-preimplementation-gate.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-epic-merge-gate.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-epic-merge-gate.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-epic-worktree-removal-gate.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-epic-worktree-removal-gate.ps1"'
+timeout = 30
 
 [[hooks.PreToolUse]]
-matcher = "Write|Edit"
-command = "pwsh -NoProfile -File .codex/hooks/enforce-checkpoint-monotonic.ps1"
+matcher = "^(Bash|shell_command|apply_patch|Edit|Write|mcp__.*)$"
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-epic-root-invocation.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-epic-root-invocation.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-codex-model-routing.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-codex-model-routing.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-epic-planning-only.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-epic-planning-only.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-epic-wave-barrier.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-epic-wave-barrier.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-epic-child-worktree-binding.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-epic-child-worktree-binding.ps1"'
+timeout = 30
 
 [[hooks.PreToolUse]]
-matcher = "Write|Edit"
-command = "pwsh -NoProfile -File .codex/hooks/enforce-completion-consistency.ps1"
+matcher = "^(apply_patch|Edit|Write)$"
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/check-python-test-purity.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/check-python-test-purity.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-python-batch-budget.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-python-batch-budget.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/check-powershell-test-purity.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/check-powershell-test-purity.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-powershell-batch-budget.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-powershell-batch-budget.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-evidence-locations.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-evidence-locations.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-orchestration-preimplementation-gate.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-orchestration-preimplementation-gate.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-checkpoint-monotonic.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-checkpoint-monotonic.ps1"'
+timeout = 30
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-completion-consistency.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/enforce-completion-consistency.ps1"'
+timeout = 30
 
-[[hooks.PreToolUse]]
-matcher = "Agent"
-command = "pwsh -NoProfile -File .codex/hooks/enforce-orchestration-preimplementation-gate.ps1"
+[[hooks.SubagentStop]]
+matcher = "epic-planner|epic-orchestrator|orchestrator|atomic-planner|atomic-executor|feature-review|feature-reviewer|task-researcher|prd-feature|pr-author|typed-engineer|-c"
+
+[[hooks.SubagentStop.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/validate-codex-subagent-routing.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/validate-codex-subagent-routing.ps1"'
+timeout = 30
 
 [[hooks.SubagentStop]]
 matcher = "feature-review|feature-reviewer"
-command = "pwsh -NoProfile -File .codex/hooks/validate-feature-review-coverage.ps1"
+
+[[hooks.SubagentStop.hooks]]
+type = "command"
+command = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/validate-feature-review-coverage.ps1"'
+command_windows = 'pwsh -NoProfile -File "$(git rev-parse --show-toplevel)/.codex/hooks/validate-feature-review-coverage.ps1"'
+timeout = 30

package/resources/codex-and-agents-customizations/.codex/hooks/authorize-root-epic-invocation.ps1

@@ -0,0 +1,236 @@
+<#
+.SYNOPSIS
+    Records a bounded root-session authorization receipt for Codex epic personas.
+
+.DESCRIPTION
+    UserPromptSubmit hook. Reads the documented Codex JSON payload from stdin. Exact epic skill
+    commands and direct requests to invoke an epic persona produce one turn-bound receipt in the
+    non-workspace Codex authority store. Non-epic prompts are ignored. The receipt is consumed by
+    the SubagentStart attestation hook.
+#>
+[CmdletBinding()]
+param()
+
+. (Join-Path $PSScriptRoot 'codex-authority-store.ps1')
+
+$script:ReceiptLifetimeMinutes = 60
+
+function ConvertFrom-RootEpicHookPayload {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string] $PayloadRaw)
+
+    if ([string]::IsNullOrWhiteSpace($PayloadRaw)) {
+        throw 'EPIC_INVOCATION_ORIGIN_BLOCKED: UserPromptSubmit hook input is empty.'
+    }
+    try {
+        return $PayloadRaw | ConvertFrom-Json -ErrorAction Stop
+    } catch {
+        throw "EPIC_INVOCATION_ORIGIN_BLOCKED: UserPromptSubmit hook input is malformed JSON: $_"
+    }
+}
+
+function Get-RootEpicRequestedPersona {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $Prompt)
+
+    if ($Prompt -match '(?im)^\s*(?:/|\$)?epic-plan(?:\s+|$)' -or
+        $Prompt -match '(?im)^\s*(?:please\s+)?(?:invoke|spawn|use|run|delegate(?:\s+this)?\s+to)\s+(?:the\s+)?(?:Codex\s+)?epic-planner\b') {
+        return 'epic-planner'
+    }
+    if ($Prompt -match '(?im)^\s*(?:/|\$)?epic-(?:run|orchestrate)(?:\s+|$)' -or
+        $Prompt -match '(?im)^\s*(?:please\s+)?(?:invoke|spawn|use|run|delegate(?:\s+this)?\s+to)\s+(?:the\s+)?(?:Codex\s+)?epic-orchestrator\b') {
+        return 'epic-orchestrator'
+    }
+    return ''
+}
+
+function Get-RootEpicReference {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $Prompt)
+
+    if ($Prompt -match '(?im)^\s*(?:/|\$)?epic-(?:plan|run|orchestrate)\s+(?<reference>[^\r\n]+)') {
+        return $Matches.reference.Trim()
+    }
+    if ($Prompt -match '(?i)(?<reference>docs[\\/]features[\\/]epics[\\/][^\s"'']+)') {
+        return ($Matches.reference -replace '\\', '/').TrimEnd('.', ',', ';')
+    }
+    return ''
+}
+
+function Get-RootEpicEntryKind {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $Prompt)
+
+    if ($Prompt -match '(?im)^\s*(?:/|\$)?epic-plan(?:\s+|$)') {
+        return 'epic-plan'
+    }
+    if ($Prompt -match '(?im)^\s*(?:/|\$)?epic-run(?:\s+|$)') {
+        return 'epic-run'
+    }
+    if ($Prompt -match '(?im)^\s*(?:/|\$)?epic-orchestrate(?:\s+|$)') {
+        return 'epic-orchestrate'
+    }
+    return 'direct'
+}
+
+function Get-RootEpicSlug {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $Reference)
+
+    $parts = @(($Reference -replace '\\', '/').Trim('/').Split('/') | Where-Object { $_ })
+    if ($parts.Count -eq 0) {
+        return ''
+    }
+    if ($parts[-1] -in @('epic.md', 'epic-kickoff.md') -and $parts.Count -ge 2) {
+        return [string]$parts[-2]
+    }
+    return [string]$parts[-1]
+}
+
+function Get-LowerSha256 {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $Text)
+
+    $bytes = [System.Text.Encoding]::UTF8.GetBytes($Text)
+    return [Convert]::ToHexString([System.Security.Cryptography.SHA256]::HashData($bytes)).ToLowerInvariant()
+}
+
+function Get-RootEpicReceiptFileName {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)][string] $TurnId)
+
+    $safeTurnId = $TurnId -replace '[^A-Za-z0-9._-]', '_'
+    return "epic-root-invocation.$safeTurnId.json"
+}
+
+function Get-RootEpicInvocationReceipt {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)] $Payload,
+        [Parameter(Mandatory)][datetimeoffset] $Now,
+        [Parameter(Mandatory)][string] $RepositoryRoot,
+        [Parameter(Mandatory)][string] $HeadSha
+    )
+
+    $prompt = [string]$Payload.prompt
+    $persona = Get-RootEpicRequestedPersona -Prompt $prompt
+    if (-not $persona) {
+        return $null
+    }
+
+    $turnId = [string]$Payload.turn_id
+    $sessionId = [string]$Payload.session_id
+    if ([string]::IsNullOrWhiteSpace($turnId) -or [string]::IsNullOrWhiteSpace($sessionId)) {
+        throw 'EPIC_INVOCATION_ORIGIN_BLOCKED: an epic root invocation requires session_id and turn_id.'
+    }
+
+    $reference = Get-RootEpicReference -Prompt $prompt
+    $entryKind = Get-RootEpicEntryKind -Prompt $prompt
+    $kickoffPath = ''
+    if ($persona -eq 'epic-orchestrator' -and $entryKind -eq 'epic-run') {
+        $slug = Get-RootEpicSlug -Reference $reference
+        if ($slug) {
+            $kickoffPath = "docs/features/epics/$slug/epic-kickoff.md"
+        }
+    }
+
+    return [ordered]@{
+        schema_version      = 1
+        repository_root     = Get-CodexCanonicalAuthorityPath -Path $RepositoryRoot
+        repository_sha256   = Get-CodexAuthorityRepositoryKey -RepositoryRoot $RepositoryRoot
+        repository_head_sha = $HeadSha
+        session_id          = $sessionId
+        turn_id             = $turnId
+        prompt_sha256       = Get-LowerSha256 -Text $prompt
+        requested_persona   = $persona
+        entry_kind          = $entryKind
+        epic_reference      = $reference
+        kickoff_path        = $kickoffPath
+        created_at          = $Now.ToUniversalTime().ToString('o')
+        expires_at          = $Now.AddMinutes($script:ReceiptLifetimeMinutes).ToUniversalTime().ToString('o')
+        consumed            = $false
+        consumed_by         = $null
+        consumed_at         = $null
+    }
+}
+
+function Write-RootEpicInvocationReceipt {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string] $RepositoryRoot,
+        [Parameter(Mandatory)][System.Collections.IDictionary] $Receipt
+    )
+
+    $directory = Get-CodexAuthorityStateRoot `
+        -RepositoryRoot $RepositoryRoot `
+        -SessionId ([string]$Receipt.session_id)
+    [System.IO.Directory]::CreateDirectory($directory) | Out-Null
+    $path = Get-CodexAuthorityReceiptPath `
+        -RepositoryRoot $RepositoryRoot `
+        -SessionId ([string]$Receipt.session_id) `
+        -TurnId ([string]$Receipt.turn_id)
+    $json = $Receipt | ConvertTo-Json -Depth 8
+    $stream = [System.IO.File]::Open(
+        $path,
+        [System.IO.FileMode]::CreateNew,
+        [System.IO.FileAccess]::Write,
+        [System.IO.FileShare]::None
+    )
+    try {
+        $writer = [System.IO.StreamWriter]::new(
+            $stream,
+            [System.Text.UTF8Encoding]::new($false)
+        )
+        try {
+            $writer.Write($json)
+            $writer.Flush()
+        } finally {
+            $writer.Dispose()
+        }
+    } finally {
+        $stream.Dispose()
+    }
+    return $path
+}
+
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+
+try {
+    $payload = ConvertFrom-RootEpicHookPayload -PayloadRaw ([Console]::In.ReadToEnd())
+    if (-not (Get-RootEpicRequestedPersona -Prompt ([string]$payload.prompt))) {
+        exit 0
+    }
+    $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+    $headSha = [string](& git -C $repositoryRoot rev-parse HEAD 2>$null)
+    if ($LASTEXITCODE -ne 0 -or $headSha -notmatch '^[0-9a-fA-F]{40,64}$') {
+        throw 'EPIC_INVOCATION_ORIGIN_BLOCKED: repository HEAD could not be resolved.'
+    }
+    $receipt = Get-RootEpicInvocationReceipt `
+        -Payload $payload `
+        -Now ([datetimeoffset]::UtcNow) `
+        -RepositoryRoot $repositoryRoot `
+        -HeadSha $headSha
+    if ($null -eq $receipt) {
+        exit 0
+    }
+    $receiptPath = Write-RootEpicInvocationReceipt -RepositoryRoot $repositoryRoot -Receipt $receipt
+    [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName     = 'UserPromptSubmit'
+            additionalContext = "Root epic invocation authorized for $($receipt.requested_persona); receipt: $receiptPath"
+        }
+    } | ConvertTo-Json -Compress -Depth 5 | Write-Output
+    exit 0
+} catch {
+    [Console]::Error.WriteLine([string]$_)
+    exit 2
+}