@danmoisan/drm-copilot-mcp 1.0.13 → 1.0.15

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-codex-model-routing.ps1

@@ -0,0 +1,198 @@
+<#
+.SYNOPSIS
+    Denies covered subagent mutations when the actual Codex model/profile does not match routing.
+#>
+[CmdletBinding()]
+param()
+
+. (Join-Path $PSScriptRoot 'codex-authority-store.ps1')
+. (Join-Path $PSScriptRoot 'codex-agent-profile-attestation.ps1')
+
+$script:CodexModelGateRepositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+
+function ConvertFrom-CodexModelGateJson {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string] $Raw, [Parameter(Mandatory)][string] $Name)
+
+    if ([string]::IsNullOrWhiteSpace($Raw)) {
+        throw "MODEL_ROUTING_ATTESTATION_BLOCKED: $Name is empty."
+    }
+    try {
+        return $Raw | ConvertFrom-Json -ErrorAction Stop
+    } catch {
+        throw "MODEL_ROUTING_ATTESTATION_BLOCKED: $Name is malformed JSON: $_"
+    }
+}
+
+function Get-CodexModelGateAttestationKey {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)][string] $TranscriptPath)
+
+    $bytes = [System.Text.Encoding]::UTF8.GetBytes($TranscriptPath)
+    return [Convert]::ToHexString([System.Security.Cryptography.SHA256]::HashData($bytes)).ToLowerInvariant()
+}
+
+function Test-CodexModelGateProfileAttestation {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory)] $Payload,
+        [Parameter(Mandatory)] $Attestation,
+        [Parameter(Mandatory)][string] $RepositoryRoot
+    )
+
+    if ($Attestation.schema_version -isnot [ValueType] -or
+        [int]$Attestation.schema_version -ne 2 -or
+        $Attestation.routing_valid -isnot [bool] -or
+        -not [bool]$Attestation.routing_valid -or
+        -not [string]::IsNullOrWhiteSpace([string]$Attestation.profile_validation_error)) {
+        return $false
+    }
+    foreach ($requiredField in @(
+            'agent_type', 'actual_model', 'expected_model',
+            'actual_reasoning_effort', 'expected_reasoning_effort',
+            'profile_name', 'profile_model', 'profile_path', 'profile_sha256'
+        )) {
+        if ([string]::IsNullOrWhiteSpace([string]$Attestation.$requiredField)) {
+            return $false
+        }
+    }
+    if ([string]$Attestation.profile_sha256 -notmatch '^[0-9a-f]{64}$') {
+        return $false
+    }
+    try {
+        $agentProfile = Get-CodexAgentProfileAttestation `
+            -RepositoryRoot $RepositoryRoot `
+            -AgentType ([string]$Attestation.agent_type)
+    } catch {
+        return $false
+    }
+    if (-not (Test-CodexAgentProfileBinding `
+                -AgentProfile $agentProfile `
+                -AgentType ([string]$Attestation.agent_type) `
+                -ActualModel ([string]$Payload.model) `
+                -ExpectedModel ([string]$Attestation.expected_model) `
+                -ExpectedReasoningEffort ([string]$Attestation.expected_reasoning_effort) `
+                -ExpectedProfilePath ([string]$Attestation.profile_path) `
+                -ExpectedProfileSha256 ([string]$Attestation.profile_sha256))) {
+        return $false
+    }
+    return [string]$Payload.model -ceq [string]$Attestation.actual_model -and
+    [string]$Attestation.profile_name -ceq [string]$agentProfile.profile_name -and
+    [string]$Attestation.profile_model -ceq [string]$agentProfile.profile_model -and
+    [string]$Attestation.actual_reasoning_effort -ceq [string]$agentProfile.profile_reasoning_effort
+}
+
+function Invoke-CodexModelRoutingDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)][string] $PayloadRaw,
+        [AllowNull()][AllowEmptyString()][string] $AttestationRaw
+    )
+
+    $payload = ConvertFrom-CodexModelGateJson -Raw $PayloadRaw -Name 'PreToolUse input'
+    if ([string]::IsNullOrWhiteSpace($AttestationRaw)) {
+        if (-not [string]::IsNullOrWhiteSpace([string]$payload.agent_type) -and
+            (Test-CodexModelGateAgentType -AgentType ([string]$payload.agent_type))) {
+            return Get-CodexModelGateDenyDecision -Reason (
+                "MODEL_ROUTING_ATTESTATION_BLOCKED: routed agent '$($payload.agent_type)' has " +
+                'no matching SubagentStart attestation. Relaunch the exact generated profile.'
+            )
+        }
+        return $null
+    }
+
+    $attestation = ConvertFrom-CodexModelGateJson -Raw $AttestationRaw -Name 'routing attestation'
+    if (Test-CodexModelGateProfileAttestation `
+            -Payload $payload `
+            -Attestation $attestation `
+            -RepositoryRoot $script:CodexModelGateRepositoryRoot) {
+        return $null
+    }
+
+    return Get-CodexModelGateDenyDecision -Reason (
+        "MODEL_ROUTING_ATTESTATION_BLOCKED: agent '$($attestation.agent_type)' has model, " +
+        'reasoning, or profile drift from its persisted deployment receipt. Correct the ' +
+        'receipt and relaunch the exact generated profile.'
+    )
+}
+
+function Test-CodexModelGateAgentType {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory)][string] $AgentType)
+
+    return $AgentType -match '-c(?:1|2|3|4|3-elevated)$' -or @(
+        'orchestrator', 'atomic-planner', 'atomic-executor', 'feature-review',
+        'feature-reviewer', 'task-researcher', 'prd-feature', 'pr-author',
+        'python-typed-engineer', 'powershell-typed-engineer',
+        'csharp-typed-engineer', 'typescript-engineer',
+        'epic-planner', 'epic-orchestrator'
+    ) -contains $AgentType
+}
+
+function Get-CodexModelGateDenyDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param([Parameter(Mandatory)][string] $Reason)
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $Reason
+        }
+    }
+}
+
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+
+try {
+    $payloadRaw = [Console]::In.ReadToEnd()
+    $payload = ConvertFrom-CodexModelGateJson -Raw $payloadRaw -Name 'PreToolUse input'
+    $attestationRaw = ''
+    $repositoryRoot = $script:CodexModelGateRepositoryRoot
+    $sessionId = [string]$payload.session_id
+    $transcriptPath = [string]$payload.transcript_path
+    if (-not [string]::IsNullOrWhiteSpace($transcriptPath) -and
+        -not [string]::IsNullOrWhiteSpace($sessionId)) {
+        $key = Get-CodexModelGateAttestationKey -TranscriptPath $transcriptPath
+        $path = Get-CodexAuthorityAttestationPath `
+            -RepositoryRoot $repositoryRoot `
+            -SessionId $sessionId `
+            -AttestationKey $key
+        if (Test-Path -LiteralPath $path -PathType Leaf) {
+            $attestationRaw = Get-Content -Raw -LiteralPath $path
+        }
+    }
+    if ([string]::IsNullOrWhiteSpace($attestationRaw) -and
+        -not [string]::IsNullOrWhiteSpace([string]$payload.agent_id) -and
+        -not [string]::IsNullOrWhiteSpace($sessionId)) {
+        $stateRoot = Get-CodexAuthorityStateRoot `
+            -RepositoryRoot $repositoryRoot `
+            -SessionId $sessionId
+        foreach ($path in Get-ChildItem -LiteralPath $stateRoot -Filter 'codex-routing-attestation.*.json' -File -ErrorAction SilentlyContinue) {
+            $candidate = Get-Content -Raw -LiteralPath $path.FullName
+            try {
+                if ([string]($candidate | ConvertFrom-Json -ErrorAction Stop).agent_id -eq [string]$payload.agent_id) {
+                    $attestationRaw = $candidate
+                    break
+                }
+            } catch {
+                continue
+            }
+        }
+    }
+    $decision = Invoke-CodexModelRoutingDecision -PayloadRaw $payloadRaw -AttestationRaw $attestationRaw
+    if ($null -ne $decision) {
+        $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+    }
+    exit 0
+} catch {
+    [Console]::Error.WriteLine([string]$_)
+    exit 2
+}

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-completion-consistency.ps1

@@ -5,8 +5,8 @@
     evidence.
 
 .DESCRIPTION
-    Invoked by the Claude Code PreToolUse hook on Write or Edit operations. The
-    hook activates only when the target file_path normalizes to
+    Invoked by the Codex PreToolUse hook on apply_patch operations. The hook
+    reads one JSON object from stdin and activates only when the target path normalizes to
     artifacts/orchestration/orchestrator-state.json.
 
     A written checkpoint asserts completion when any of the following hold:
@@ -41,6 +41,9 @@
 [CmdletBinding()]
 param()
 
+# Reuse the adjacent hook's read-only Codex apply_patch adapter.
+. (Join-Path $PSScriptRoot 'enforce-checkpoint-monotonic.ps1')
+
 # Dot-source the shared validation helpers. Guarded so a missing file produces a
 # clear error and so dot-sourcing this hook in tests loads the helpers too.
 $script:CompletionHelpersPath = Join-Path $PSScriptRoot 'enforce-completion-helpers.ps1'
@@ -314,7 +317,7 @@ function Resolve-EditedCheckpointContent {
 function Invoke-CompletionConsistencyDecision {
     <#
     .SYNOPSIS
-        Parses CLAUDE_TOOL_INPUT and returns an allow-or-block decision based on
+        Parses mapped Codex tool_input JSON and returns an allow-or-deny decision based on
         completion-evidence consistency.
     #>
     [CmdletBinding()]
@@ -340,7 +343,7 @@ function Invoke-CompletionConsistencyDecision {
         $toolInput = $ToolInputRaw | ConvertFrom-Json -ErrorAction Stop
     }
     catch {
-        throw "enforce-completion-consistency hook received malformed JSON in CLAUDE_TOOL_INPUT: $_"
+        throw "enforce-completion-consistency received malformed mapped tool_input JSON: $_"
     }
 
     $filePath = $toolInput.file_path
@@ -360,9 +363,10 @@ function Invoke-CompletionConsistencyDecision {
     if (-not $content) {
         $content = Resolve-EditedCheckpointContent -ToolInput $toolInput -CheckpointReader $CheckpointReader
         if (-not $content) {
-            # No content, and the Edit could not be resolved against on-disk
-            # state (missing file or non-matching patch): defer and allow.
-            return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
+            return [ordered]@{ hookSpecificOutput = [ordered]@{
+                    hookEventName = 'PreToolUse'; permissionDecision = 'deny'
+                    permissionDecisionReason = 'COMPLETION_CONSISTENCY_BLOCKED: the canonical checkpoint cannot be deleted, emptied, or replaced through an unresolved patch.'
+                } }
         }
     }
 
@@ -370,9 +374,10 @@ function Invoke-CompletionConsistencyDecision {
         $payload = ConvertFrom-CheckpointJson -Json $content
     }
     catch {
-        # The content itself is not valid JSON. Let downstream tools surface the
-        # error rather than blocking with a misleading reason here.
-        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{
+                hookEventName = 'PreToolUse'; permissionDecision = 'deny'
+                permissionDecisionReason = 'COMPLETION_CONSISTENCY_BLOCKED: the canonical checkpoint must remain valid JSON.'
+            } }
     }
 
     if (-not (Test-CompletionAsserted -Payload $payload)) {
@@ -404,13 +409,17 @@ if ($MyInvocation.InvocationName -eq '.') {
 }
 
 try {
-    $decision = Invoke-CompletionConsistencyDecision -ToolInputRaw $env:CLAUDE_TOOL_INPUT
-}
-catch {
-    Write-Error $_
-    exit 1
+    $payload = ConvertFrom-CodexCheckpointHookPayload -PayloadRaw ([Console]::In.ReadToEnd())
+    foreach ($toolInput in @(ConvertTo-CodexApplyPatchCheckpointInput -Payload $payload)) {
+        $toolInputRaw = $toolInput | ConvertTo-Json -Compress -Depth 20
+        $decision = Invoke-CompletionConsistencyDecision -ToolInputRaw $toolInputRaw
+        if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {
+            $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+            exit 0
+        }
+    }
+    exit 0
+} catch {
+    [Console]::Error.WriteLine([string]$_)
+    exit 2
 }
-
-$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
-
-exit 0

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-child-worktree-binding.ps1

@@ -0,0 +1,325 @@
+<#
+.SYNOPSIS
+    Denies epic-child mutations outside the launch-authorized worktree and profile.
+
+.DESCRIPTION
+    A launcher-created environment attestation activates this guard. The guard fails closed when
+    the hook repository root, payload working directory, live branch, immutable launch receipt,
+    specification hash, deployment profile, model, reasoning effort, or delegation differs from
+    the launch authorization. Every drm-copilot MCP call must name the authorized workspace_root.
+#>
+[CmdletBinding()]
+param()
+
+$contractPath = Join-Path (Split-Path $PSScriptRoot -Parent) 'scripts/epic-child-launch-contract.ps1'
+if (Test-Path -LiteralPath $contractPath -PathType Leaf) {
+    . $contractPath
+}
+
+function ConvertFrom-CodexChildGuardJson {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string] $Raw, [Parameter(Mandatory)][string] $Name)
+
+    if ([string]::IsNullOrWhiteSpace($Raw)) {
+        throw "EPIC_WORKTREE_BINDING_BLOCKED: $Name is empty."
+    }
+    try {
+        return $Raw | ConvertFrom-Json -Depth 32 -ErrorAction Stop
+    } catch {
+        throw "EPIC_WORKTREE_BINDING_BLOCKED: $Name is malformed JSON: $_"
+    }
+}
+
+function Get-CodexChildGuardCanonicalPath {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)][string] $Path, [Parameter(Mandatory)][string] $BasePath)
+
+    $candidate = if ([System.IO.Path]::IsPathFullyQualified($Path)) {
+        $Path
+    } else {
+        Join-Path $BasePath $Path
+    }
+    return [System.IO.Path]::GetFullPath($candidate).TrimEnd(
+        [System.IO.Path]::DirectorySeparatorChar,
+        [System.IO.Path]::AltDirectorySeparatorChar
+    )
+}
+
+function Get-CodexChildGuardDenyDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param([Parameter(Mandatory)][string] $Reason)
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = "EPIC_WORKTREE_BINDING_BLOCKED: $Reason"
+        }
+    }
+}
+
+function Test-CodexChildGuardMutation {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory)] $Payload)
+
+    $toolName = [string]$Payload.tool_name
+    if ($toolName -in @('apply_patch', 'Edit', 'Write')) {
+        return $true
+    }
+    if ($toolName -like 'mcp__*') {
+        return $true
+    }
+    if ($toolName -in @('Bash', 'shell_command')) {
+        return $true
+    }
+    return $false
+}
+
+function Test-CodexChildGuardProtectedPathMutation {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory)] $Payload,
+        [Parameter(Mandatory)][string] $ReceiptPath,
+        [Parameter(Mandatory)][string] $SpecPath,
+        [Parameter(Mandatory)][string] $ProfilePath,
+        [Parameter(Mandatory)][string] $WorktreePath
+    )
+
+    if (-not (Test-CodexChildGuardMutation -Payload $Payload)) {
+        return $false
+    }
+    $inputText = (($Payload.tool_input | ConvertTo-Json -Depth 16 -Compress) -replace '\\+', '/').ToLowerInvariant()
+    if ($inputText -match 'codex_epic_child|(?:^|[/"''])(?:\.codex|\.agents)(?:[/"'']|$)|agents\.md|orchestration-routing\.json') {
+        return $true
+    }
+    foreach ($path in @(
+            $ReceiptPath, (Split-Path $ReceiptPath -Parent), $SpecPath, $ProfilePath,
+            (Join-Path $WorktreePath '.codex/config.toml'),
+            (Join-Path $WorktreePath '.codex/hooks'),
+            (Join-Path $WorktreePath '.codex/scripts'),
+            (Join-Path $WorktreePath '.agents'),
+            (Join-Path $WorktreePath 'AGENTS.md'),
+            (Join-Path $WorktreePath 'config/orchestration-routing.json')
+        )) {
+        $normalized = $path.Replace('\', '/').ToLowerInvariant()
+        if ($inputText.Contains($normalized) -or $inputText.Contains((Split-Path $normalized -Leaf))) {
+            return $true
+        }
+    }
+    return $false
+}
+
+function Test-CodexChildGuardNestedCodexInvocation {
+    [OutputType([bool])]
+    param([Parameter(Mandatory)] $Payload)
+    if ([string]$Payload.tool_name -notin @('Bash', 'shell_command')) {
+        return $false
+    }
+    $command = [string]$Payload.tool_input.command
+    return $command -match '(?i)(?:^|[\s;&|`"''])codex(?:\.exe|\.cmd|\.ps1)?(?:[\s;&|`"'']|$)|@openai[/\\]codex|codex\.js'
+}
+
+function Test-CodexChildGuardAttestation {
+    [CmdletBinding()]
+    [OutputType([string[]])]
+    param(
+        [Parameter(Mandatory)] $Payload,
+        [Parameter(Mandatory)] $Receipt,
+        [Parameter(Mandatory)] $Attestation,
+        [Parameter(Mandatory)][string] $HookRepositoryRoot,
+        [Parameter(Mandatory)][string] $LiveBranch,
+        [Parameter(Mandatory)][string] $ActualSpecSha256,
+        [Parameter(Mandatory)][string] $ActualProfileSha256
+    )
+
+    $errors = [System.Collections.Generic.List[string]]::new()
+    $expectedWorktree = Get-CodexChildGuardCanonicalPath -Path ([string]$Receipt.worktree_path) -BasePath $HookRepositoryRoot
+    $actualRoot = Get-CodexChildGuardCanonicalPath -Path $HookRepositoryRoot -BasePath $HookRepositoryRoot
+    $payloadCwd = if ([string]::IsNullOrWhiteSpace([string]$Payload.cwd)) {
+        ''
+    } else {
+        Get-CodexChildGuardCanonicalPath -Path ([string]$Payload.cwd) -BasePath $actualRoot
+    }
+    if ($actualRoot -ne $expectedWorktree -or $payloadCwd -ne $expectedWorktree) {
+        $errors.Add('payload.cwd, hook repository root, and expected worktree must match exactly.')
+    }
+    if ([string]$LiveBranch -cne [string]$Receipt.branch_name) {
+        $errors.Add('the live Git branch does not match the launch receipt.')
+    }
+    $pairs = @(
+        @('launch_id', 'launch_id'),
+        @('delegation_id', 'delegation_id'),
+        @('execution_context', 'execution_context'),
+        @('agent', 'deployment_agent'),
+        @('model', 'model'),
+        @('reasoning_effort', 'model_reasoning_effort'),
+        @('profile_sha256', 'profile_sha256'),
+        @('expected_worktree', 'worktree_path'),
+        @('receipt_path', 'receipt_path'),
+        @('spec_path', 'spec_path')
+    )
+    foreach ($pair in $pairs) {
+        if ([string]$Attestation.($pair[0]) -cne [string]$Receipt.($pair[1])) {
+            $errors.Add("environment attestation $($pair[0]) does not match the launch receipt.")
+        }
+    }
+    if (Get-Command Get-CodexChildActiveReceiptErrorList -ErrorAction SilentlyContinue) {
+        foreach ($receiptError in @(Get-CodexChildActiveReceiptErrorList -Receipt $Receipt `
+                    -ExpectedSessionId ([string]$Payload.session_id))) {
+            $errors.Add($receiptError)
+        }
+    } else {
+        $errors.Add('launch receipt validator is unavailable.')
+    }
+    if ([string]$ActualSpecSha256 -ne [string]$Receipt.spec_sha256) {
+        $errors.Add('the immutable launch specification hash has changed.')
+    }
+    $expectedProfile = Join-Path $expectedWorktree ".codex/agents/$($Receipt.deployment_agent).toml"
+    if ((Get-CodexChildGuardCanonicalPath -Path ([string]$Receipt.profile_path) -BasePath $expectedWorktree) -ne
+        (Get-CodexChildGuardCanonicalPath -Path $expectedProfile -BasePath $expectedWorktree) -or
+        [string]$ActualProfileSha256 -ne [string]$Receipt.profile_sha256) {
+        $errors.Add('the checked-in deployment profile path or hash has changed.')
+    }
+    if (-not [string]::IsNullOrWhiteSpace([string]$Payload.model) -and
+        [string]$Payload.model -cne [string]$Receipt.model) {
+        $errors.Add('the hook payload model does not match the launch receipt.')
+    }
+    if (-not [string]::IsNullOrWhiteSpace([string]$Payload.agent_type) -and
+        [string]$Payload.agent_type -cne [string]$Receipt.deployment_agent) {
+        $errors.Add('the hook payload agent type does not match the launch receipt.')
+    }
+    $payloadReasoning = if (@($Payload.PSObject.Properties.Name) -contains 'model_reasoning_effort') {
+        [string]$Payload.model_reasoning_effort
+    } elseif (@($Payload.PSObject.Properties.Name) -contains 'reasoning_effort') {
+        [string]$Payload.reasoning_effort
+    } else {
+        ''
+    }
+    if (-not [string]::IsNullOrWhiteSpace($payloadReasoning) -and
+        $payloadReasoning -cne [string]$Receipt.model_reasoning_effort) {
+        $errors.Add('the hook payload reasoning effort does not match the launch receipt.')
+    }
+    return $errors.ToArray()
+}
+
+function Invoke-CodexEpicChildGuardDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)][string] $PayloadRaw,
+        [AllowNull()][AllowEmptyString()][string] $ReceiptRaw,
+        [Parameter(Mandatory)] $Attestation,
+        [Parameter(Mandatory)][string] $HookRepositoryRoot,
+        [Parameter(Mandatory)][AllowEmptyString()][string] $LiveBranch,
+        [Parameter(Mandatory)][AllowEmptyString()][string] $ActualSpecSha256,
+        [Parameter(Mandatory)][AllowEmptyString()][string] $ActualProfileSha256
+    )
+
+    $payload = ConvertFrom-CodexChildGuardJson -Raw $PayloadRaw -Name 'PreToolUse input'
+    if ([string]::IsNullOrWhiteSpace([string]$Attestation.launch_id)) {
+        return $null
+    }
+    $isMcp = [string]$payload.tool_name -like 'mcp__*'
+    $isMutation = Test-CodexChildGuardMutation -Payload $payload
+    if (-not $isMcp -and -not $isMutation) {
+        return $null
+    }
+    if ([string]::IsNullOrWhiteSpace($ReceiptRaw)) {
+        return Get-CodexChildGuardDenyDecision -Reason 'the launcher authorization receipt is missing.'
+    }
+    $receipt = ConvertFrom-CodexChildGuardJson -Raw $ReceiptRaw -Name 'launch receipt'
+    if ($isMcp -and [string]$payload.tool_name -notlike 'mcp__drm-copilot__*') {
+        return Get-CodexChildGuardDenyDecision -Reason 'only repository-scoped drm-copilot MCP tools are authorized for an epic child.'
+    }
+    if (Test-CodexChildGuardNestedCodexInvocation -Payload $payload) {
+        return Get-CodexChildGuardDenyDecision -Reason 'nested Codex execution is prohibited inside an epic child.'
+    }
+    if ($isMcp) {
+        $workspaceRoot = [string]$payload.tool_input.workspace_root
+        $expected = Get-CodexChildGuardCanonicalPath -Path ([string]$receipt.worktree_path) -BasePath $HookRepositoryRoot
+        if ([string]::IsNullOrWhiteSpace($workspaceRoot) -or
+            (Get-CodexChildGuardCanonicalPath -Path $workspaceRoot -BasePath $HookRepositoryRoot) -ne $expected) {
+            return Get-CodexChildGuardDenyDecision -Reason 'drm-copilot MCP calls require workspace_root equal to the authorized worktree.'
+        }
+    }
+    if (Test-CodexChildGuardProtectedPathMutation -Payload $payload `
+            -ReceiptPath ([string]$receipt.receipt_path) -SpecPath ([string]$receipt.spec_path) `
+            -ProfilePath ([string]$receipt.profile_path) -WorktreePath ([string]$receipt.worktree_path)) {
+        return Get-CodexChildGuardDenyDecision -Reason 'the launch authorization or committed Codex customizations cannot be mutated by the child.'
+    }
+    $errors = Test-CodexChildGuardAttestation -Payload $payload -Receipt $receipt -Attestation $Attestation `
+        -HookRepositoryRoot $HookRepositoryRoot -LiveBranch $LiveBranch -ActualSpecSha256 $ActualSpecSha256 `
+        -ActualProfileSha256 $ActualProfileSha256
+    if ($errors.Count -gt 0) {
+        return Get-CodexChildGuardDenyDecision -Reason ($errors -join ' ')
+    }
+    return $null
+}
+
+function Invoke-CodexChildGuardGit {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string[]] $GitArgs)
+
+    return & git @GitArgs 2>&1
+}
+
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+
+try {
+    $payloadRaw = [Console]::In.ReadToEnd()
+    $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+    $attestation = [pscustomobject]@{
+        launch_id         = [string]$env:CODEX_EPIC_CHILD_LAUNCH_ID
+        receipt_path      = [string]$env:CODEX_EPIC_CHILD_LAUNCH_RECEIPT
+        spec_path         = [string]$env:CODEX_EPIC_CHILD_LAUNCH_SPEC
+        expected_worktree = [string]$env:CODEX_EPIC_CHILD_EXPECTED_WORKTREE
+        delegation_id     = [string]$env:CODEX_EPIC_CHILD_DELEGATION_ID
+        execution_context = [string]$env:CODEX_EPIC_CHILD_EXECUTION_CONTEXT
+        agent             = [string]$env:CODEX_EPIC_CHILD_AGENT
+        model             = [string]$env:CODEX_EPIC_CHILD_MODEL
+        reasoning_effort  = [string]$env:CODEX_EPIC_CHILD_REASONING_EFFORT
+        profile_sha256    = [string]$env:CODEX_EPIC_CHILD_PROFILE_SHA256
+    }
+    $receiptRaw = if (-not [string]::IsNullOrWhiteSpace($attestation.receipt_path) -and
+        (Test-Path -LiteralPath $attestation.receipt_path -PathType Leaf)) {
+        Get-Content -Raw -LiteralPath $attestation.receipt_path
+    } else {
+        ''
+    }
+    $actualSpecSha256 = if (-not [string]::IsNullOrWhiteSpace($attestation.spec_path) -and
+        (Test-Path -LiteralPath $attestation.spec_path -PathType Leaf)) {
+        (Get-FileHash -LiteralPath $attestation.spec_path -Algorithm SHA256).Hash.ToLowerInvariant()
+    } else {
+        ''
+    }
+    $receipt = if ([string]::IsNullOrWhiteSpace($receiptRaw)) { $null } else {
+        ConvertFrom-CodexChildGuardJson -Raw $receiptRaw -Name 'launch receipt'
+    }
+    $actualProfileSha256 = if ($null -ne $receipt -and
+        -not [string]::IsNullOrWhiteSpace([string]$receipt.profile_path) -and
+        (Test-Path -LiteralPath ([string]$receipt.profile_path) -PathType Leaf)) {
+        (Get-FileHash -LiteralPath ([string]$receipt.profile_path) -Algorithm SHA256).Hash.ToLowerInvariant()
+    } else {
+        ''
+    }
+    $liveBranch = [string](Invoke-CodexChildGuardGit -GitArgs @('-C', $repositoryRoot, 'branch', '--show-current'))
+    if ($LASTEXITCODE -ne 0) {
+        $liveBranch = ''
+    }
+    $decision = Invoke-CodexEpicChildGuardDecision -PayloadRaw $payloadRaw -ReceiptRaw $receiptRaw `
+        -Attestation $attestation -HookRepositoryRoot $repositoryRoot -LiveBranch $liveBranch.Trim() `
+        -ActualSpecSha256 $actualSpecSha256 -ActualProfileSha256 $actualProfileSha256
+    if ($null -ne $decision) {
+        $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+    }
+    exit 0
+} catch {
+    [Console]::Error.WriteLine([string]$_)
+    exit 2
+}