@danmoisan/drm-copilot-mcp 1.1.11 → 1.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danmoisan/drm-copilot-mcp",
-  "version": "1.1.11",
+  "version": "1.1.12",
   "description": "Stdio MCP server exposing drm-copilot repo-automation tools.",
   "license": "MIT",
   "type": "commonjs",

package/resources/claude-customizations/.claude/agents/epic-orchestrator.md

@@ -134,7 +134,7 @@ full schema enforced by `validate_epic_orchestrator_state_text`, implemented in
 `epic_feature_folder`,
 `epic_manifest_path`, `epic_status_doc_path`, `integration_branch`, `completed_steps`, `next_step`,
 `last_updated`, `current_wave`, `waves[]`, `features[]` (including `merge_status` and the four
-lifecycle timestamps), `epic_merge_pr`, and the three receipt arrays
+lifecycle timestamps), `epic_merge_pr`, `epic_issue_num`, `model_routing_receipts[]` (including the `pr-author` receipt recorded before the integration-to-`main` pull request, issue #663), and the three receipt arrays
 (`delegation_receipts[]`, `skill_receipts[]`, `mcp_call_receipts[]`) populated with the `epic`
 route's required names from `config/orchestration-routing.json`.
 

package/resources/claude-customizations/.claude/agents/epic-planner.md

@@ -9,11 +9,13 @@ tools:
   - Glob
   - "Write(docs/features/epics/**)"
   - "Edit(docs/features/epics/**)"
+  - "Write(docs/features/potential/**)"
   - "Write(artifacts/orchestration/**)"
   - "Edit(artifacts/orchestration/**)"
   - "Bash(git *)"
   - "Bash(gh *)"
   - "mcp__drm-copilot__validate_orchestration_artifacts"
+  - "mcp__drm-copilot__potential_to_issue"
 skills:
   - policy-compliance-order
   - epic-plan
@@ -102,10 +104,11 @@ the prepared epic, per the template in the `epic-plan` skill.
 ## Checkpoint Persistence
 
 Update `artifacts/orchestration/epic-planner-state.json` after every completed step with:
-`objective`, `epic_feature_folder`, `epic_manifest_path`, `integration_branch`,
+`objective`, `epic_feature_folder`, `epic_manifest_path`, `integration_branch`, `epic_issue_num`,
 `epic_worthiness` (`{verdict, rationale}`), `features[]` (per-feature `issue_num`,
 `feature_folder`, `depends_on`, `wave`, `complexity_band`, `preparation_status`, `plan_path`,
 `preflight_status`), `kickoff_prompt_path`, `completed_steps`, `next_step`, and `last_updated`.
+`epic_issue_num` is the epic-level issue `epic-planner` promotes at planning time through `mcp__drm-copilot__potential_to_issue` with `promotion_type: epic` (issue #663; see `## Epic-Level Issue Promotion` in the `epic-plan` skill).
 
 ## Completion Requirements
 

package/resources/claude-customizations/.claude/agents/pr-author.md

@@ -92,3 +92,18 @@ deliberate, documented act to circumvent. It is not tamper-proof and is not a se
 Repository tone is defined in `CLAUDE.md` and `.claude/rules/tonality.md`. Reference only files
 listed under "Additional context files" in the PR-context bundle; do not cite or summarize files
 outside that enumeration. Do not invent issue or PR numbers.
+
+## Required `--head` on `gh pr create` (issue #687)
+
+Every `gh pr create` command this agent issues MUST carry an explicit
+`--head <branch>` naming the branch the pull request is opened from.
+
+This is what makes the call's target derivable. `enforce-pr-author-skill.ps1` resolves the
+worktree the call pertains to from the command text, and validates the orchestrator checkpoint
+belonging to that worktree. Without `--head`, `gh pr create` infers its head branch from the
+current checkout and the command carries no signal at all, so the gate denies with
+`TARGET_WORKTREE_NOT_DERIVABLE` rather than validating against whichever checkpoint occupies the
+session root, which in a parallel or epic topology belongs to a different item.
+
+Pass `--head` even when the branch is the current one: the gate resolves it to the session root
+and behaves exactly as before, and the command stays correct if it is ever replayed elsewhere.

package/resources/claude-customizations/.claude/hooks/enforce-epic-merge-gate-authorization.ps1

@@ -0,0 +1,443 @@
+<#
+.SYNOPSIS
+    Dot-sourced standalone-merge authorization helpers for enforce-epic-merge-gate.ps1.
+
+.DESCRIPTION
+    Holds the fourth allow condition of the epic merge gate, the standalone-merge
+    authorization record, together with the two pure decision-envelope factories the gate
+    returns on every path.
+
+    This file is split out of the parent hook, .claude/hooks/enforce-epic-merge-gate.ps1,
+    because that file had 13 lines of headroom under the 500-line limit, which a fourth allow
+    condition, its predicates, and the rewritten header could not fit (issue #670). The two
+    envelope factories were moved here unchanged: they read no script-scoped state and no
+    test calls them by name, so the move is a pure relocation with no behaviour change.
+
+    Every function in this file is pure. It reads no file, starts no process, and reads no
+    clock; the parent hook supplies the already-parsed checkpoint objects and the live
+    envelope session_id. A test can therefore dot-source this file on its own.
+
+    Honest disclosure. The standalone-merge authorization record is a policy-level,
+    auditable declaration and is
+    not a cryptographic or security control.
+    It names a specific pull request, a specific session, an authorizer, a time, and a
+    stated basis, so that a standalone merge leaves a reviewable trail and cannot be reached
+    by accident or by a record written for a different pull request. authorized_by is a
+    declaration only: the hook checks that it is present and non-empty and does not verify
+    the identity it names, because the runtime exposes no attested agent identity at Bash
+    PreToolUse time. The record is not tamper-proof: any actor able to write
+    artifacts/orchestration/*.json inside the authorizing session can write a record,
+    because all agents share one filesystem and defaultPermissionMode is bypassPermissions.
+    The session_id cross-check binds a record to the session that emitted it, so a stale
+    record from a previous run or a record copied between runs authorizes nothing; it does
+    not stop same-session forgery. The mechanism converts an untraceable bypass into a
+    deliberate, attributable, auditable act. This is a documented accepted trade, not an
+    unexamined gap.
+
+.NOTES
+    Compatible with PowerShell 7+. No external module dependencies.
+#>
+[CmdletBinding()]
+param()
+
+# Reason codes for the standalone-merge authorization branch. Each of the four assignments
+# below is the only place its code literal appears in this file; every other use reads the
+# variable, and the Codex hook's spelling is compared against these assignments by a test.
+$script:StandaloneAbsentReasonCode = 'STANDALONE_MERGE_AUTHORIZATION_ABSENT'
+$script:StandalonePrMismatchReasonCode = 'STANDALONE_MERGE_AUTHORIZATION_PR_MISMATCH'
+$script:StandaloneMalformedReasonCode = 'STANDALONE_MERGE_AUTHORIZATION_MALFORMED'
+$script:StandaloneNotPrSpecificReasonCode = 'STANDALONE_MERGE_AUTHORIZATION_NOT_PR_SPECIFIC'
+
+# The checkpoint key that carries the authorization records, and the pointer every
+# standalone deny message ends with.
+$script:StandaloneAuthorizationKey = 'standalone_merge_authorizations'
+$script:StandaloneAuthorizationGuidance = 'To authorize a standalone merge, write a standalone_merge_authorizations record naming this pull request and the current session_id into an orchestrator checkpoint, as described in the Standalone-Merge-Authorization section of .claude/rules/orchestrator-state.md.'
+
+function Get-EpicMergeGateAllowDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param()
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName      = 'PreToolUse'
+            permissionDecision = 'allow'
+        }
+    }
+}
+
+function Get-EpicMergeGateBlockDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $Reason
+    )
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $Reason
+        }
+    }
+}
+
+function Test-StandalonePositiveJsonInteger {
+    <#
+    .SYNOPSIS
+        Report whether a parsed JSON value is an integer strictly greater than zero.
+    .DESCRIPTION
+        ConvertFrom-Json yields a 32- or 64-bit integer for a JSON integer, a double for a
+        JSON number with a fraction, and a string for a quoted value. Only the two integer
+        types qualify, so a string that spells digits is rejected on its type.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()]
+        $Value
+    )
+
+    if (-not ($Value -is [int] -or $Value -is [long])) {
+        return $false
+    }
+    return ($Value -gt 0)
+}
+
+function Test-StandaloneJsonObject {
+    <#
+    .SYNOPSIS
+        Report whether a parsed JSON value is an object rather than a scalar or an array.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()]
+        $Value
+    )
+
+    return ($Value -is [System.Management.Automation.PSCustomObject])
+}
+
+function Get-StandaloneRecordField {
+    <#
+    .SYNOPSIS
+        Read a named field off a parsed record, returning $null when the field is absent.
+    .OUTPUTS
+        System.Object, System.Object[], or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([object], [object[]])]
+    param(
+        [Parameter(Mandatory)]
+        $Record,
+
+        [Parameter(Mandatory)]
+        [string] $Name
+    )
+
+    $property = $Record.PSObject.Properties[$Name]
+    if ($null -eq $property) {
+        return $null
+    }
+    # The unary comma keeps a one-element array from unrolling into its scalar, so a
+    # pr_number spelled as [691] is still seen as an array and rejected.
+    return , $property.Value
+}
+
+function Get-StandaloneMergeAuthorizationRecord {
+    <#
+    .SYNOPSIS
+        Select the authorization record for one pull request from a parsed checkpoint.
+    .DESCRIPTION
+        Returns the first entry of the checkpoint's authorization array that is an object
+        whose pr_number is a positive JSON integer equal to PrNumber, or nothing when no
+        such entry exists. Reads no file, starts no process, and reads no clock.
+    .PARAMETER Checkpoint
+        Parsed checkpoint object, or $null when the checkpoint is absent or unreadable.
+    .PARAMETER PrNumber
+        The pull request number extracted from the command under evaluation.
+    .OUTPUTS
+        System.Object or nothing
+    #>
+    [CmdletBinding()]
+    param(
+        [AllowNull()]
+        $Checkpoint,
+
+        [Parameter(Mandatory)]
+        [int] $PrNumber
+    )
+
+    if (-not (Test-StandaloneJsonObject -Value $Checkpoint)) {
+        return
+    }
+    $property = $Checkpoint.PSObject.Properties[$script:StandaloneAuthorizationKey]
+    if ($null -eq $property -or $property.Value -isnot [System.Array]) {
+        return
+    }
+    foreach ($entry in $property.Value) {
+        if (-not (Test-StandaloneJsonObject -Value $entry)) {
+            continue
+        }
+        $entryNumber = Get-StandaloneRecordField -Record $entry -Name 'pr_number'
+        if ((Test-StandalonePositiveJsonInteger -Value $entryNumber) -and $entryNumber -eq $PrNumber) {
+            return $entry
+        }
+    }
+}
+
+function Test-StandaloneNonBlankString {
+    <#
+    .SYNOPSIS
+        Report whether a value is a string whose trimmed length reaches a minimum.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()]
+        $Value,
+
+        [int] $MinimumLength = 1
+    )
+
+    if ($Value -isnot [string]) {
+        return $false
+    }
+    return ($Value.Trim().Length -ge $MinimumLength)
+}
+
+function Test-StandaloneAuthorizedAt {
+    <#
+    .SYNOPSIS
+        Report whether an authorized_at value is a parseable date-time.
+    .DESCRIPTION
+        ConvertFrom-Json already converts an ISO 8601 string into a date-time value, so
+        such a value is accepted as parsed. Any other string must parse with the invariant
+        culture, assuming and adjusting to UTC. No clock is read.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()]
+        $Value
+    )
+
+    if ($Value -is [DateTime] -or $Value -is [DateTimeOffset]) {
+        return $true
+    }
+    if (-not (Test-StandaloneNonBlankString -Value $Value)) {
+        return $false
+    }
+    $parsed = [DateTime]::MinValue
+    return [DateTime]::TryParse(
+        $Value,
+        [System.Globalization.CultureInfo]::InvariantCulture,
+        [System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal,
+        [ref] $parsed)
+}
+
+function Get-StandaloneRecordFailure {
+    <#
+    .SYNOPSIS
+        Build the malformed-record result naming the failing field.
+    .OUTPUTS
+        System.Management.Automation.PSCustomObject
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $Field,
+
+        [Parameter(Mandatory)]
+        [string] $Rule
+    )
+
+    return [pscustomobject]@{
+        ReasonCode = $script:StandaloneMalformedReasonCode
+        Message    = "the matched authorization record has an invalid '$Field': $Rule"
+    }
+}
+
+function Test-StandaloneMergeAuthorizationRecord {
+    <#
+    .SYNOPSIS
+        Validate the fields of a selected authorization record.
+    .DESCRIPTION
+        Runs the field checks in the fixed order pr_url, issue_num, branch_name,
+        authorized_by, authorized_at, basis, run_slug, session_id. Returns nothing when
+        every check passes; otherwise returns the first failure as an object carrying
+        ReasonCode and a Message that names the failing field. branch_name is checked for
+        presence only and is never compared against the live branch or working directory.
+    .PARAMETER Record
+        The parsed record selected by pr_number.
+    .PARAMETER EnvelopeSessionId
+        The session_id read from the live PreToolUse envelope. A blank value fails closed.
+    .OUTPUTS
+        System.Management.Automation.PSCustomObject or nothing
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]
+        $Record,
+
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $EnvelopeSessionId
+    )
+
+    $prUrl = Get-StandaloneRecordField -Record $Record -Name 'pr_url'
+    $pullSuffix = '/pull/' + [string](Get-StandaloneRecordField -Record $Record -Name 'pr_number')
+    if (-not (Test-StandaloneNonBlankString -Value $prUrl) -or
+        -not $prUrl.EndsWith($pullSuffix, [System.StringComparison]::Ordinal)) {
+        return Get-StandaloneRecordFailure -Field 'pr_url' -Rule "it must end with $pullSuffix."
+    }
+    if (-not (Test-StandalonePositiveJsonInteger -Value (Get-StandaloneRecordField -Record $Record -Name 'issue_num'))) {
+        return Get-StandaloneRecordFailure -Field 'issue_num' -Rule 'it must be a JSON integer greater than zero.'
+    }
+    foreach ($name in @('branch_name', 'authorized_by')) {
+        if (-not (Test-StandaloneNonBlankString -Value (Get-StandaloneRecordField -Record $Record -Name $name))) {
+            return Get-StandaloneRecordFailure -Field $name -Rule 'it must be a non-empty string.'
+        }
+    }
+    if (-not (Test-StandaloneAuthorizedAt -Value (Get-StandaloneRecordField -Record $Record -Name 'authorized_at'))) {
+        return Get-StandaloneRecordFailure -Field 'authorized_at' -Rule 'it must be a parseable date-time string.'
+    }
+    if (-not (Test-StandaloneNonBlankString -Value (Get-StandaloneRecordField -Record $Record -Name 'basis') -MinimumLength 20)) {
+        return Get-StandaloneRecordFailure -Field 'basis' -Rule 'it must be at least 20 characters after trimming.'
+    }
+    if ($null -ne $Record.PSObject.Properties['run_slug'] -and
+        -not (Test-StandaloneNonBlankString -Value (Get-StandaloneRecordField -Record $Record -Name 'run_slug'))) {
+        return Get-StandaloneRecordFailure -Field 'run_slug' -Rule 'when present it must be a non-empty string.'
+    }
+    $recordSessionId = Get-StandaloneRecordField -Record $Record -Name 'session_id'
+    if (-not (Test-StandaloneNonBlankString -Value $recordSessionId) -or
+        [string]::IsNullOrWhiteSpace($EnvelopeSessionId) -or
+        -not [string]::Equals($recordSessionId, $EnvelopeSessionId, [System.StringComparison]::Ordinal)) {
+        return Get-StandaloneRecordFailure -Field 'session_id' -Rule 'it must be non-empty and equal the session_id of the live hook envelope.'
+    }
+}
+
+function Get-StandaloneAuthorizationBlockState {
+    <#
+    .SYNOPSIS
+        Classify one parsed checkpoint as Absent, NotPrSpecific, or PrSpecific.
+    .DESCRIPTION
+        Absent means the checkpoint is missing or carries no authorization key. The block
+        is PrSpecific only when it is a non-empty array whose every entry is an object with
+        a positive integer pr_number; any other shape, including a blanket boolean, is
+        NotPrSpecific, so a blanket flag is rejected visibly rather than read as absent.
+    .OUTPUTS
+        System.String
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [AllowNull()]
+        $Checkpoint
+    )
+
+    if (-not (Test-StandaloneJsonObject -Value $Checkpoint)) {
+        return 'Absent'
+    }
+    $property = $Checkpoint.PSObject.Properties[$script:StandaloneAuthorizationKey]
+    if ($null -eq $property) {
+        return 'Absent'
+    }
+    $block = $property.Value
+    if ($block -isnot [System.Array] -or $block.Count -eq 0) {
+        return 'NotPrSpecific'
+    }
+    foreach ($entry in $block) {
+        if (-not (Test-StandaloneJsonObject -Value $entry)) {
+            return 'NotPrSpecific'
+        }
+        if (-not (Test-StandalonePositiveJsonInteger -Value (Get-StandaloneRecordField -Record $entry -Name 'pr_number'))) {
+            return 'NotPrSpecific'
+        }
+    }
+    return 'PrSpecific'
+}
+
+function Test-StandaloneCheckpointAllowsMerge {
+    <#
+    .SYNOPSIS
+        Decision logic for the standalone-merge authorization path (branch 4).
+    .DESCRIPTION
+        Evaluates the three parsed orchestrator checkpoints for a record that authorizes
+        CommandPrNumber in the live session. Returns an object whose Allowed member is
+        $true on success; otherwise Allowed is $false and ReasonCode and Message describe
+        the denial:
+          - absent: no checkpoint carries the authorization key;
+          - not PR-specific: a checkpoint carries the key but names no specific pull request;
+          - PR mismatch: records exist, but none names CommandPrNumber;
+          - malformed: the matched record fails a field check, and the message names the field.
+    .PARAMETER Checkpoints
+        The three parsed checkpoint objects; any element may be $null.
+    .PARAMETER CommandPrNumber
+        The explicit pull request number extracted from the command.
+    .PARAMETER EnvelopeSessionId
+        The session_id read from the live PreToolUse envelope.
+    .OUTPUTS
+        System.Management.Automation.PSCustomObject
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [AllowNull()]
+        [AllowEmptyCollection()]
+        [object[]] $Checkpoints,
+
+        [Parameter(Mandatory)]
+        [int] $CommandPrNumber,
+
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $EnvelopeSessionId
+    )
+
+    $states = @(foreach ($checkpoint in @($Checkpoints)) { Get-StandaloneAuthorizationBlockState -Checkpoint $checkpoint })
+    $reasonCode = $null
+    $message = $null
+    if ($states -contains 'NotPrSpecific') {
+        $reasonCode = $script:StandaloneNotPrSpecificReasonCode
+        $message = 'an orchestrator checkpoint carries the authorization key but names no specific pull request; a blanket flag is not an authorization record.'
+    } elseif ($states -notcontains 'PrSpecific') {
+        $reasonCode = $script:StandaloneAbsentReasonCode
+        $message = 'no orchestrator checkpoint carries an authorization record, but an authorized standalone merge path exists.'
+    } else {
+        foreach ($checkpoint in @($Checkpoints)) {
+            $record = Get-StandaloneMergeAuthorizationRecord -Checkpoint $checkpoint -PrNumber $CommandPrNumber
+            if ($null -eq $record) {
+                continue
+            }
+            $failure = Test-StandaloneMergeAuthorizationRecord -Record $record -EnvelopeSessionId $EnvelopeSessionId
+            if ($null -eq $failure) {
+                return [pscustomobject]@{ Allowed = $true; ReasonCode = $null; Message = $null }
+            }
+            $reasonCode = $failure.ReasonCode
+            $message = $failure.Message
+            break
+        }
+        if ($null -eq $reasonCode) {
+            $reasonCode = $script:StandalonePrMismatchReasonCode
+            $message = "authorization records exist, but none names pull request $CommandPrNumber."
+        }
+    }
+
+    return [pscustomobject]@{
+        Allowed    = $false
+        ReasonCode = $reasonCode
+        Message    = "$message $script:StandaloneAuthorizationGuidance"
+    }
+}

package/resources/claude-customizations/.claude/hooks/enforce-epic-merge-gate.ps1

@@ -5,7 +5,7 @@
 .DESCRIPTION
     Invoked by the Claude Code PreToolUse hook on the "Bash" matcher before any Bash
     command runs. Regex-matches gh pr merge with a --merge flag against
-    the envelope's tool_input.command and, when matched, allows the merge only when one of three
+    the envelope's tool_input.command and, when matched, allows the merge only when one of four
     checkpoint-only conditions holds:
 
       1. Child-feature path: artifacts/orchestration/orchestrator-state.json exists,
@@ -19,12 +19,19 @@
          entry whose merge_status == "ci_green". A parallel run always names an explicit PR
          number (each item merges from its own isolated worktree), so a bare command with no
          PR number cannot satisfy this branch.
-
-    Otherwise the command is denied with reason EPIC_MERGE_GATE_BLOCKED. A missing or
-    unreadable checkpoint in any branch fails closed (denies); standalone (non-epic,
-    non-parallel) orchestration never sets epic_mode, populates epic_merge_pr, or writes a
-    parallel checkpoint with route_id == "parallel", so it is structurally prevented from
-    invoking gh pr merge --merge at all.
+      4. Standalone path (issue #670), evaluated last: the command names an explicit PR
+         number and one of the three checkpoints above carries a
+         standalone_merge_authorizations record whose pr_number equals it, whose fields are
+         well formed, and whose session_id equals the live envelope's session_id. The
+         dot-sourced helpers file implements this branch.
+
+    Otherwise the command is denied with reason EPIC_MERGE_GATE_BLOCKED; a denial from
+    condition 4 also carries a standalone reason code after that token. A missing or
+    unreadable checkpoint in any branch fails closed (denies). A standalone (non-epic,
+    non-parallel) run never satisfies conditions 1-3, so its only route to a merge is an
+    explicit, PR-specific, session-bound record under condition 4; a bare command with no
+    PR number never satisfies condition 4, and a blanket flag is rejected rather than read.
+    Trigger scope: --squash is out of scope for this gate and is allowed on both runtimes.
 
     Design decision: this gate trusts the on-disk checkpoint rather than shelling out live
     to gh pr view for a real-time head-SHA check, matching the same non-adversarial,
@@ -35,6 +42,12 @@
     Compatible with PowerShell 7+. No external module dependencies. Filesystem reads go
     through injectable wrapper functions so tests can mock the boundary without writing
     temporary files.
+
+    Honest disclosure: the standalone-merge authorization record is a policy-level,
+    auditable declaration and is not a cryptographic or security control. authorized_by is
+    a declaration the hook does not verify. The record is not tamper-proof against a writer
+    inside the authorizing session. The session_id cross-check rejects stale or copied
+    records from other sessions; it does not stop same-session forgery.
 #>
 [CmdletBinding()]
 param()
@@ -44,6 +57,8 @@ Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -
 # Invoke-EpicMergeGateDecision and by Get-EpicMergeGateCommandPrNumber.
 . (Join-Path $PSScriptRoot 'hook-command-scanner.ps1')
 . (Join-Path $PSScriptRoot 'hook-command-invocation.ps1')
+# Standalone-merge authorization predicates and the two decision-envelope factories (issue #670).
+. (Join-Path $PSScriptRoot 'enforce-epic-merge-gate-authorization.ps1')
 
 $script:ChildCheckpointPath = 'artifacts/orchestration/orchestrator-state.json'
 $script:EpicCheckpointPath = 'artifacts/orchestration/epic-orchestrator-state.json'
@@ -324,36 +339,6 @@ function Test-ParallelCheckpointAllowsMerge {
     return $false
 }
 
-function Get-EpicMergeGateAllowDecision {
-    [CmdletBinding()]
-    [OutputType([System.Collections.Specialized.OrderedDictionary])]
-    param()
-
-    return [ordered]@{
-        hookSpecificOutput = [ordered]@{
-            hookEventName      = 'PreToolUse'
-            permissionDecision = 'allow'
-        }
-    }
-}
-
-function Get-EpicMergeGateBlockDecision {
-    [CmdletBinding()]
-    [OutputType([System.Collections.Specialized.OrderedDictionary])]
-    param(
-        [Parameter(Mandatory)]
-        [string] $Reason
-    )
-
-    return [ordered]@{
-        hookSpecificOutput = [ordered]@{
-            hookEventName            = 'PreToolUse'
-            permissionDecision       = 'deny'
-            permissionDecisionReason = $Reason
-        }
-    }
-}
-
 function Invoke-EpicMergeGateDecision {
     <#
     .SYNOPSIS
@@ -430,6 +415,17 @@ function Invoke-EpicMergeGateDecision {
         return Get-EpicMergeGateAllowDecision
     }
 
+    # Branch 4, evaluated last and only for an explicit PR number: a PR-specific standalone
+    # authorization record bound to the live session. Its deny keeps the gate token first.
+    if ($null -ne $commandPrNumber) {
+        $envelopeSessionId = [string](Get-ClaudeHookEnvelopeValue -Envelope $payload.Envelope -Name 'session_id')
+        $standalone = Test-StandaloneCheckpointAllowsMerge -Checkpoints @($childCheckpoint, $epicCheckpoint, $parallelCheckpoint) -CommandPrNumber $commandPrNumber -EnvelopeSessionId $envelopeSessionId
+        if ($standalone.Allowed) {
+            return Get-EpicMergeGateAllowDecision
+        }
+        return Get-EpicMergeGateBlockDecision -Reason ('EPIC_MERGE_GATE_BLOCKED: ' + $standalone.ReasonCode + ': ' + $standalone.Message)
+    }
+
     return Get-EpicMergeGateBlockDecision -Reason 'EPIC_MERGE_GATE_BLOCKED: gh pr merge --merge requires either a per-feature checkpoint with epic_mode == true and step9_status == "passed", an epic checkpoint with epic_merge_pr.ci_gate.conclusion == "success" and a matching pr_number, or a parallel-orchestrator checkpoint with route_id == "parallel" whose target item (matched by pr_number) has merge_status == "ci_green". No checkpoint satisfied this gate.'
 }