@danmoisan/drm-copilot-mcp 1.1.11 → 1.1.14

package/resources/codex-and-agents-customizations/.agents/skills/codex-model-routing/SKILL.md

@@ -16,7 +16,7 @@ agent profile.
 2. Run the canonical topology resolver before choosing a logical agent:
 
    ```powershell
-   poetry run python -m scripts.dev_tools.resolve_codex_topology `
+   pwsh -NoProfile -File .codex/scripts/Resolve-CodexTopology.ps1 `
      --language <python|powershell|csharp|typescript> `
      --production-file-count <count> `
      --test-file-count <count> `
@@ -53,7 +53,7 @@ epic root personas are forced independently of file count.
 5. Run the canonical resolver:
 
    ```powershell
-   poetry run python -m scripts.dev_tools.resolve_codex_deployment `
+   pwsh -NoProfile -File .codex/scripts/Resolve-CodexDeployment.ps1 `
      --logical-agent <agent> `
      --complexity-band <C1|C2|C3|C4> `
      --execution-context <context> `
@@ -96,15 +96,14 @@ incomplete, and request a policy change. Do not silently fall back.
 ## Validation
 
 Before accepting delegated results or reporting completion, validate the
-checkpoint with the Codex routing gate:
-
-```powershell
-poetry run python -m scripts.dev_tools.validate_orchestration_artifacts `
-  orchestrator-state artifacts/orchestration/orchestrator-state.json `
-  --require-codex-topology `
-  --require-codex-model-routing
-```
-
-For epic execution use `epic-orchestrator-state` with the same flag. The MCP
-`validate_orchestration_artifacts` surface is the authoritative completion gate
-when available.
+checkpoint with the Codex routing gate by calling the MCP tool
+`validate_orchestration_artifacts` with these arguments:
+
+- `artifact_type`: `orchestrator-state` (use `epic-orchestrator-state` for epic
+  execution)
+- `artifact_path`: `artifacts/orchestration/orchestrator-state.json`
+- `workspace_root`: the repository root
+- `require_codex_topology`: `true`
+- `require_codex_model_routing`: `true`
+
+The MCP tool is the authoritative completion gate and needs no Python toolchain.

package/resources/codex-and-agents-customizations/.codex/config.toml

@@ -2,7 +2,7 @@ default_permissions = ":danger-full-access"
 
 [mcp_servers.drm-copilot]
 command = "npx"
-args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.11"]
+args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.14"]
 required = true
 enabled_tools = [
     "collect_commit_context",

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-merge-gate.ps1

@@ -11,6 +11,14 @@ param()
 . (Join-Path $PSScriptRoot 'hook-command-scanner.ps1')
 . (Join-Path $PSScriptRoot 'hook-command-invocation.ps1')
 
+# Reason codes for the standalone-merge authorization branch (issue #670), spelled
+# byte-identically to the Claude helpers file. Each of the four assignments below is the only
+# place its code literal appears in this file.
+$script:CodexStandaloneAbsentReasonCode = 'STANDALONE_MERGE_AUTHORIZATION_ABSENT'
+$script:CodexStandalonePrMismatchReasonCode = 'STANDALONE_MERGE_AUTHORIZATION_PR_MISMATCH'
+$script:CodexStandaloneMalformedReasonCode = 'STANDALONE_MERGE_AUTHORIZATION_MALFORMED'
+$script:CodexStandaloneNotPrSpecificReasonCode = 'STANDALONE_MERGE_AUTHORIZATION_NOT_PR_SPECIFIC'
+
 function ConvertFrom-CodexMergeJson {
     [CmdletBinding()]
     param([AllowNull()][AllowEmptyString()][string] $Raw, [Parameter(Mandatory)][string] $Name, [switch] $Optional)
@@ -155,6 +163,24 @@ function Invoke-CodexEpicMergeDecision {
         return $null
     }
 
+    # Standalone branch (issue #670), evaluated last and only for an explicit PR number: a
+    # PR-specific authorization record bound to the payload session. Its deny keeps the gate
+    # token first.
+    if ($null -ne $prNumber) {
+        $sessionId = [string]$payload.session_id
+        $verdict = Test-CodexStandaloneMergeAuthorization -Checkpoints @($child, $epic) -CommandPrNumber $prNumber -SessionId $sessionId
+        if ($verdict.Allowed) {
+            return $null
+        }
+        return [ordered]@{
+            hookSpecificOutput = [ordered]@{
+                hookEventName            = 'PreToolUse'
+                permissionDecision       = 'deny'
+                permissionDecisionReason = 'EPIC_MERGE_GATE_BLOCKED: ' + $verdict.ReasonCode + ': ' + $verdict.Message
+            }
+        }
+    }
+
     return [ordered]@{
         hookSpecificOutput = [ordered]@{
             hookEventName            = 'PreToolUse'
@@ -164,6 +190,173 @@ function Invoke-CodexEpicMergeDecision {
     }
 }
 
+function Test-CodexStandalonePositiveInteger {
+    <#
+    .SYNOPSIS
+        Report whether a parsed JSON value is an integer greater than zero; a digit string fails.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([AllowNull()] $Value)
+
+    return (($Value -is [int] -or $Value -is [long]) -and $Value -gt 0)
+}
+
+function Test-CodexStandaloneText {
+    <#
+    .SYNOPSIS
+        Report whether a value is a string whose trimmed length reaches a minimum.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([AllowNull()] $Value, [int] $MinimumLength = 1)
+
+    return ($Value -is [string] -and $Value.Trim().Length -ge $MinimumLength)
+}
+
+function Get-CodexStandaloneField {
+    <#
+    .SYNOPSIS
+        Read a named field off a parsed record, or $null; the unary comma keeps a
+        one-element array from unrolling into its scalar.
+    #>
+    [CmdletBinding()]
+    [OutputType([object], [object[]])]
+    param([Parameter(Mandatory)] $Record, [Parameter(Mandatory)][string] $Name)
+
+    $property = $Record.PSObject.Properties[$Name]
+    if ($null -eq $property) {
+        return $null
+    }
+    return , $property.Value
+}
+
+function Get-CodexStandaloneRecordFailure {
+    <#
+    .SYNOPSIS
+        Return the first failing field of a matched record, or $null when every check passes.
+    .DESCRIPTION
+        Uses the same fixed order as the Claude helpers file: pr_url, issue_num, branch_name,
+        authorized_by, authorized_at, basis, run_slug, session_id. branch_name is checked for
+        presence only. A blank payload session fails closed.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)] $Record, [AllowNull()][AllowEmptyString()][string] $SessionId)
+
+    $prUrl = Get-CodexStandaloneField -Record $Record -Name 'pr_url'
+    if (-not (Test-CodexStandaloneText -Value $prUrl) -or
+        -not $prUrl.EndsWith('/pull/' + [string]$Record.pr_number, [System.StringComparison]::Ordinal)) {
+        return 'pr_url'
+    }
+    if (-not (Test-CodexStandalonePositiveInteger -Value (Get-CodexStandaloneField -Record $Record -Name 'issue_num'))) {
+        return 'issue_num'
+    }
+    foreach ($name in @('branch_name', 'authorized_by')) {
+        if (-not (Test-CodexStandaloneText -Value (Get-CodexStandaloneField -Record $Record -Name $name))) {
+            return $name
+        }
+    }
+    $authorizedAt = Get-CodexStandaloneField -Record $Record -Name 'authorized_at'
+    $parsedAt = [DateTime]::MinValue
+    $timestampValid = $authorizedAt -is [DateTime] -or $authorizedAt -is [DateTimeOffset]
+    if (-not $timestampValid -and (Test-CodexStandaloneText -Value $authorizedAt)) {
+        $timestampValid = [DateTime]::TryParse(
+            $authorizedAt,
+            [System.Globalization.CultureInfo]::InvariantCulture,
+            [System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal,
+            [ref] $parsedAt)
+    }
+    if (-not $timestampValid) {
+        return 'authorized_at'
+    }
+    if (-not (Test-CodexStandaloneText -Value (Get-CodexStandaloneField -Record $Record -Name 'basis') -MinimumLength 20)) {
+        return 'basis'
+    }
+    if ($null -ne $Record.PSObject.Properties['run_slug'] -and
+        -not (Test-CodexStandaloneText -Value (Get-CodexStandaloneField -Record $Record -Name 'run_slug'))) {
+        return 'run_slug'
+    }
+    $recordSession = Get-CodexStandaloneField -Record $Record -Name 'session_id'
+    if (-not (Test-CodexStandaloneText -Value $recordSession) -or
+        [string]::IsNullOrWhiteSpace($SessionId) -or
+        -not [string]::Equals($recordSession, $SessionId, [System.StringComparison]::Ordinal)) {
+        return 'session_id'
+    }
+    return $null
+}
+
+function Test-CodexStandaloneMergeAuthorization {
+    <#
+    .SYNOPSIS
+        Codex counterpart of the Claude standalone-merge authorization predicate.
+    .DESCRIPTION
+        Evaluates the parsed child and epic checkpoints with the same activation condition
+        as the Claude side: a PR-specific record naming CommandPrNumber, with well-formed
+        fields and a session_id equal to the payload session. Returns an object whose
+        Allowed member is $true on success, or $false with ReasonCode and Message.
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [AllowNull()][AllowEmptyCollection()][object[]] $Checkpoints,
+        [Parameter(Mandatory)][int] $CommandPrNumber,
+        [AllowNull()][AllowEmptyString()][string] $SessionId
+    )
+
+    $key = 'standalone_merge_authorizations'
+    $present = $false
+    $specific = $true
+    $match = $null
+    foreach ($checkpoint in @($Checkpoints)) {
+        if ($checkpoint -isnot [System.Management.Automation.PSCustomObject] -or
+            $null -eq $checkpoint.PSObject.Properties[$key]) {
+            continue
+        }
+        $present = $true
+        $block = $checkpoint.PSObject.Properties[$key].Value
+        if ($block -isnot [System.Array] -or $block.Count -eq 0) {
+            $specific = $false
+            continue
+        }
+        foreach ($entry in $block) {
+            $number = $null
+            if ($entry -is [System.Management.Automation.PSCustomObject]) {
+                $number = Get-CodexStandaloneField -Record $entry -Name 'pr_number'
+            }
+            if (-not (Test-CodexStandalonePositiveInteger -Value $number)) {
+                $specific = $false
+            } elseif ($null -eq $match -and $number -eq $CommandPrNumber) {
+                $match = $entry
+            }
+        }
+    }
+
+    if (-not $present) {
+        $code = $script:CodexStandaloneAbsentReasonCode
+        $message = 'no orchestrator checkpoint carries an authorization record, but an authorized standalone merge path exists.'
+    } elseif (-not $specific) {
+        $code = $script:CodexStandaloneNotPrSpecificReasonCode
+        $message = 'an orchestrator checkpoint carries the authorization key but names no specific pull request; a blanket flag is not an authorization record.'
+    } elseif ($null -eq $match) {
+        $code = $script:CodexStandalonePrMismatchReasonCode
+        $message = "authorization records exist, but none names pull request $CommandPrNumber."
+    } else {
+        $field = Get-CodexStandaloneRecordFailure -Record $match -SessionId $SessionId
+        if ($null -eq $field) {
+            return [pscustomobject]@{ Allowed = $true; ReasonCode = $null; Message = $null }
+        }
+        $code = $script:CodexStandaloneMalformedReasonCode
+        $message = "the matched authorization record has an invalid '$field'."
+    }
+
+    return [pscustomobject]@{
+        Allowed    = $false
+        ReasonCode = $code
+        Message    = "$message To authorize a standalone merge, write a $key record naming this pull request and the current session_id into an orchestrator checkpoint, as described in .claude/rules/orchestrator-state.md."
+    }
+}
+
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-planning-only.ps1

@@ -83,9 +83,6 @@ function Get-EpicPlanningRegisteredMcpTool {
 }
 
 $script:EpicPlanningRepositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
-$script:AllowedPreparationSemanticMcpTools = @(Get-EpicPlanningRegisteredMcpTool `
-        -RegistryPath (Join-Path $script:EpicPlanningRepositoryRoot 'config/orchestration-handoff-registry.json') `
-        -SemanticIds $script:PreparationSemanticMcpIds)
 
 function Get-EpicPlanningDenyDecision {
     [CmdletBinding()]
@@ -209,7 +206,8 @@ function Invoke-EpicPlanningOnlyDecision {
         [AllowNull()][AllowEmptyString()][string] $CheckpointRaw,
         [AllowNull()][AllowEmptyString()][string] $EpicExecutionContext,
         [AllowNull()][string[]] $StagedPaths,
-        [AllowNull()][AllowEmptyString()][string] $CurrentBranch
+        [AllowNull()][AllowEmptyString()][string] $CurrentBranch,
+        [string] $RegistryPath = (Join-Path $script:EpicPlanningRepositoryRoot 'config/orchestration-handoff-registry.json')
     )
 
     $payload = ConvertFrom-EpicPlanningJson -Raw $PayloadRaw -Name 'PreToolUse input'
@@ -269,8 +267,20 @@ function Invoke-EpicPlanningOnlyDecision {
         return Get-EpicPlanningDenyDecision -Reason 'the Bash command is outside the preparation read, branch, commit, push, or validator allowlist.'
     }
 
+    # Lifecycle tools are decided first and never need the registry. Only a
+    # registry-dependent mcp__ call reads it, so a destination without the
+    # registry keeps every other decision and fails closed for semantic MCP.
     $allowedRepositoryMcp = $script:AllowedPreparationMcpTools -contains $toolName
-    $allowedSemanticMcp = $script:AllowedPreparationSemanticMcpTools -contains $toolName
+    $allowedSemanticMcp = $false
+    if (-not $allowedRepositoryMcp -and $toolName -like 'mcp__*') {
+        if (-not (Test-Path -LiteralPath $RegistryPath -PathType Leaf)) {
+            return Get-EpicPlanningDenyDecision -Reason "semantic MCP registry '$RegistryPath' does not exist; registry-dependent MCP tool '$toolName' is denied in preparation mode."
+        }
+        $registeredSemanticMcp = @(Get-EpicPlanningRegisteredMcpTool `
+                -RegistryPath $RegistryPath `
+                -SemanticIds $script:PreparationSemanticMcpIds)
+        $allowedSemanticMcp = $registeredSemanticMcp -contains $toolName
+    }
     if ($allowedRepositoryMcp -or $allowedSemanticMcp) {
         if ($attestedPreparation) {
             $workspaceRoot = [string]$payload.tool_input.workspace_root