@danmoisan/drm-copilot-mcp 1.1.19 → 1.1.21

package/resources/codex-and-agents-customizations/.codex/agents/python-typed-engineer-c4.toml

@@ -1,6 +1,6 @@
 name = "python-typed-engineer-c4"
 description = "Converted subagent"
-model = "gpt-5.6-sol"
+model = "gpt-6-astra"
 model_reasoning_effort = "max"
 developer_instructions = '''
 Canonical migration source: .github/agents/python-typed-engineer.agent.md

package/resources/codex-and-agents-customizations/.codex/agents/python-typed-engineer.toml

@@ -1,6 +1,6 @@
 name = "python-typed-engineer"
 description = "Converted subagent"
-model = "gpt-5.6-terra"
+model = "gpt-6.1-sol"
 model_reasoning_effort = "high"
 developer_instructions = '''
 Canonical migration source: .github/agents/python-typed-engineer.agent.md

package/resources/codex-and-agents-customizations/.codex/agents/task-researcher-c1.toml

@@ -1,6 +1,6 @@
 name = "task-researcher-c1"
 description = "Converted subagent"
-model = "gpt-5.6-luna"
+model = "gpt-6-luna"
 model_reasoning_effort = "low"
 developer_instructions = '''
 Canonical migration source: .github/agents/task-researcher.agent.md
@@ -13,6 +13,10 @@ Do not weaken validation-only preflight loops, QA gates, remediation triggers, r
 Applied rewrites:
 - Rewrite Claude skill paths to shared skill paths.
 
+Use the following repo-local skills as the canonical workflow source:
+- evidence-and-timestamp-conventions
+- execution-environment
+
 Canonical migration source:
 - .github/agents/task-researcher.agent.md
 
@@ -33,7 +37,9 @@ tools:
   - Glob
   - WebFetch
   - "Write(/artifacts/research/**)"
+skills:
   - evidence-and-timestamp-conventions
+  - execution-environment
 memory: project
 hooks:
   Stop:

package/resources/codex-and-agents-customizations/.codex/agents/task-researcher-c2.toml

@@ -1,6 +1,6 @@
 name = "task-researcher-c2"
 description = "Converted subagent"
-model = "gpt-5.6-terra"
+model = "gpt-6.1-sol"
 model_reasoning_effort = "medium"
 developer_instructions = '''
 Canonical migration source: .github/agents/task-researcher.agent.md
@@ -13,6 +13,10 @@ Do not weaken validation-only preflight loops, QA gates, remediation triggers, r
 Applied rewrites:
 - Rewrite Claude skill paths to shared skill paths.
 
+Use the following repo-local skills as the canonical workflow source:
+- evidence-and-timestamp-conventions
+- execution-environment
+
 Canonical migration source:
 - .github/agents/task-researcher.agent.md
 
@@ -33,7 +37,9 @@ tools:
   - Glob
   - WebFetch
   - "Write(/artifacts/research/**)"
+skills:
   - evidence-and-timestamp-conventions
+  - execution-environment
 memory: project
 hooks:
   Stop:

package/resources/codex-and-agents-customizations/.codex/agents/task-researcher-c3-elevated.toml

@@ -1,6 +1,6 @@
 name = "task-researcher-c3-elevated"
 description = "Converted subagent"
-model = "gpt-5.6-sol"
+model = "gpt-6-astra"
 model_reasoning_effort = "high"
 developer_instructions = '''
 Canonical migration source: .github/agents/task-researcher.agent.md
@@ -13,6 +13,10 @@ Do not weaken validation-only preflight loops, QA gates, remediation triggers, r
 Applied rewrites:
 - Rewrite Claude skill paths to shared skill paths.
 
+Use the following repo-local skills as the canonical workflow source:
+- evidence-and-timestamp-conventions
+- execution-environment
+
 Canonical migration source:
 - .github/agents/task-researcher.agent.md
 
@@ -33,7 +37,9 @@ tools:
   - Glob
   - WebFetch
   - "Write(/artifacts/research/**)"
+skills:
   - evidence-and-timestamp-conventions
+  - execution-environment
 memory: project
 hooks:
   Stop:

package/resources/codex-and-agents-customizations/.codex/agents/task-researcher-c3.toml

@@ -1,6 +1,6 @@
 name = "task-researcher-c3"
 description = "Converted subagent"
-model = "gpt-5.6-terra"
+model = "gpt-6.1-sol"
 model_reasoning_effort = "high"
 developer_instructions = '''
 Canonical migration source: .github/agents/task-researcher.agent.md
@@ -13,6 +13,10 @@ Do not weaken validation-only preflight loops, QA gates, remediation triggers, r
 Applied rewrites:
 - Rewrite Claude skill paths to shared skill paths.
 
+Use the following repo-local skills as the canonical workflow source:
+- evidence-and-timestamp-conventions
+- execution-environment
+
 Canonical migration source:
 - .github/agents/task-researcher.agent.md
 
@@ -33,7 +37,9 @@ tools:
   - Glob
   - WebFetch
   - "Write(/artifacts/research/**)"
+skills:
   - evidence-and-timestamp-conventions
+  - execution-environment
 memory: project
 hooks:
   Stop:

package/resources/codex-and-agents-customizations/.codex/agents/task-researcher-c4.toml

@@ -1,6 +1,6 @@
 name = "task-researcher-c4"
 description = "Converted subagent"
-model = "gpt-5.6-sol"
+model = "gpt-6-astra"
 model_reasoning_effort = "max"
 developer_instructions = '''
 Canonical migration source: .github/agents/task-researcher.agent.md
@@ -13,6 +13,10 @@ Do not weaken validation-only preflight loops, QA gates, remediation triggers, r
 Applied rewrites:
 - Rewrite Claude skill paths to shared skill paths.
 
+Use the following repo-local skills as the canonical workflow source:
+- evidence-and-timestamp-conventions
+- execution-environment
+
 Canonical migration source:
 - .github/agents/task-researcher.agent.md
 
@@ -33,7 +37,9 @@ tools:
   - Glob
   - WebFetch
   - "Write(/artifacts/research/**)"
+skills:
   - evidence-and-timestamp-conventions
+  - execution-environment
 memory: project
 hooks:
   Stop:

package/resources/codex-and-agents-customizations/.codex/agents/task-researcher.toml

@@ -1,6 +1,6 @@
 name = "task-researcher"
 description = "Converted subagent"
-model = "gpt-5.6-terra"
+model = "gpt-6.1-sol"
 model_reasoning_effort = "high"
 developer_instructions = '''
 Canonical migration source: .github/agents/task-researcher.agent.md
@@ -13,6 +13,10 @@ Do not weaken validation-only preflight loops, QA gates, remediation triggers, r
 Applied rewrites:
 - Rewrite Claude skill paths to shared skill paths.
 
+Use the following repo-local skills as the canonical workflow source:
+- evidence-and-timestamp-conventions
+- execution-environment
+
 Canonical migration source:
 - .github/agents/task-researcher.agent.md
 
@@ -33,7 +37,9 @@ tools:
   - Glob
   - WebFetch
   - "Write(/artifacts/research/**)"
+skills:
   - evidence-and-timestamp-conventions
+  - execution-environment
 memory: project
 hooks:
   Stop:

package/resources/codex-and-agents-customizations/.codex/agents/typescript-engineer-c1.toml

@@ -1,6 +1,6 @@
 name = "typescript-engineer-c1"
 description = "Converted subagent"
-model = "gpt-5.6-luna"
+model = "gpt-6-luna"
 model_reasoning_effort = "low"
 developer_instructions = '''
 Canonical migration source: .github/agents/typescript-engineer.agent.md

package/resources/codex-and-agents-customizations/.codex/agents/typescript-engineer-c2.toml

@@ -1,6 +1,6 @@
 name = "typescript-engineer-c2"
 description = "Converted subagent"
-model = "gpt-5.6-terra"
+model = "gpt-6.1-sol"
 model_reasoning_effort = "medium"
 developer_instructions = '''
 Canonical migration source: .github/agents/typescript-engineer.agent.md

package/resources/codex-and-agents-customizations/.codex/agents/typescript-engineer-c3-elevated.toml

@@ -1,6 +1,6 @@
 name = "typescript-engineer-c3-elevated"
 description = "Converted subagent"
-model = "gpt-5.6-sol"
+model = "gpt-6-astra"
 model_reasoning_effort = "high"
 developer_instructions = '''
 Canonical migration source: .github/agents/typescript-engineer.agent.md

package/resources/codex-and-agents-customizations/.codex/agents/typescript-engineer-c3.toml

@@ -1,6 +1,6 @@
 name = "typescript-engineer-c3"
 description = "Converted subagent"
-model = "gpt-5.6-terra"
+model = "gpt-6.1-sol"
 model_reasoning_effort = "high"
 developer_instructions = '''
 Canonical migration source: .github/agents/typescript-engineer.agent.md

package/resources/codex-and-agents-customizations/.codex/agents/typescript-engineer-c4.toml

@@ -1,6 +1,6 @@
 name = "typescript-engineer-c4"
 description = "Converted subagent"
-model = "gpt-5.6-sol"
+model = "gpt-6-astra"
 model_reasoning_effort = "max"
 developer_instructions = '''
 Canonical migration source: .github/agents/typescript-engineer.agent.md

package/resources/codex-and-agents-customizations/.codex/agents/typescript-engineer.toml

@@ -1,6 +1,6 @@
 name = "typescript-engineer"
 description = "Converted subagent"
-model = "gpt-5.6-terra"
+model = "gpt-6.1-sol"
 model_reasoning_effort = "high"
 developer_instructions = '''
 Canonical migration source: .github/agents/typescript-engineer.agent.md

package/resources/codex-and-agents-customizations/.codex/config.toml

@@ -2,7 +2,7 @@ default_permissions = ":danger-full-access"
 
 [mcp_servers.drm-copilot]
 command = "npx"
-args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.19"]
+args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.21"]
 required = true
 enabled_tools = [
     "collect_commit_context",

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-merge-gate-command.ps1

@@ -0,0 +1,190 @@
+<#
+.SYNOPSIS
+    Scope predicate and pull-request selector reader for the epic merge gate (issue #952).
+.DESCRIPTION
+    Dot-sourced by enforce-epic-merge-gate.ps1 on both runtimes; this file is byte-identical in
+    .claude/hooks and .codex/hooks. Under a merge queue every gh pr merge spelling (--merge, -m,
+    --squash, -s, --rebase, -r, --auto, --admin, or no method flag) adds the pull request to the
+    queue, and the gh api mutations enqueuePullRequest, enablePullRequestAutoMerge, and
+    mergePullRequest and the REST pulls/<n>/merge endpoint also reach the base branch. All of
+    them are in scope. A gh pr merge whose only action flag is --disable-auto is out of scope.
+
+    Pure string logic only: no disk, process, network, clock, or environment access. The file
+    dot-sources and imports nothing; it consumes Get-CommandLineInvocation and
+    Get-CommandLineStructuralMatch, which the gate loads from hook-command-invocation.ps1 first.
+
+    Known limitation (issue #952 code review CR-5): the gh api scope reads the command text
+    only. A GraphQL mutation supplied from a file (gh api graphql -F query=@mutation.graphql,
+    or gh api --input payload.json) is not visible to this text-based scope and is not gated.
+#>
+
+# gh pr merge flags that perform or schedule a merge. Any of them keeps a command in scope even
+# when it also carries --disable-auto.
+$script:EpicMergeGateActionFlags = @('--merge', '-m', '--squash', '-s', '--rebase', '-r', '--auto', '--admin')
+
+# gh pr merge flags, including the inherited --repo, that consume the following token as a value.
+$script:EpicMergeGateValueFlags = @('-b', '--body', '-F', '--body-file', '-t', '--subject', '-A', '--author-email', '--match-head-commit', '-R', '--repo')
+
+# GraphQL mutations that merge, enqueue, or schedule the merge of a pull request.
+$script:EpicMergeGateMutationNames = @('enqueuePullRequest', 'enablePullRequestAutoMerge', 'mergePullRequest')
+
+# The REST merge endpoint path; group 1 is the pull-request number.
+$script:EpicMergeGateRestMergePattern = '(?:^|/)pulls/(\d+)/merge(?:$|[^\w-])'
+
+function Get-EpicMergeGateFlagName {
+    <#
+    .SYNOPSIS
+        Return the flag name of a dash-led token without any '=value' suffix.
+    .OUTPUTS
+        System.String
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $Token)
+
+    $split = $Token.IndexOf('=')
+    if ($split -gt 0) { return $Token.Substring(0, $split) }
+    return $Token
+}
+
+function ConvertFrom-EpicMergeGateSelector {
+    <#
+    .SYNOPSIS
+        Convert a gh pr merge selector to a pull-request number, or $null.
+    .DESCRIPTION
+        Accepts an all-digit selector or a URL whose path ends in /pull/<n>. A branch-name
+        selector carries no number and yields $null.
+    .OUTPUTS
+        System.Nullable[int]
+    #>
+    [CmdletBinding()]
+    [OutputType([int])]
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $Selector)
+
+    $digits = $null
+    if ($Selector -match '^\d+$') {
+        $digits = $Selector
+    } elseif ($Selector -match '/pull/(\d+)/?(?:[?#].*)?$') {
+        $digits = $Matches[1]
+    }
+    $number = 0
+    if ($null -ne $digits -and [int]::TryParse($digits, [ref] $number)) { return $number }
+    return $null
+}
+
+function Test-EpicMergeGateDisableAutoOnly {
+    <#
+    .SYNOPSIS
+        Report whether a Structural gh pr merge match carries --disable-auto and no action flag.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory)][pscustomobject] $Match)
+
+    $tokens = [string[]]@($Match.Segment.Tokens)
+    $hasDisableAuto = $false
+    for ($index = $Match.OperandIndex; $index -lt $tokens.Count; $index++) {
+        $name = Get-EpicMergeGateFlagName -Token $tokens[$index]
+        if ($script:EpicMergeGateActionFlags -ccontains $name) { return $false }
+        if ($name -ceq '--disable-auto') { $hasDisableAuto = $true }
+    }
+    return $hasDisableAuto
+}
+
+function Test-EpicMergeGateApiMutationText {
+    <#
+    .SYNOPSIS
+        Report whether gh api text names a merge or enqueue mutation or the REST merge endpoint.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory)][AllowEmptyString()][AllowNull()][string] $Text)
+
+    if ([string]::IsNullOrEmpty($Text)) { return $false }
+    foreach ($name in $script:EpicMergeGateMutationNames) {
+        if ($Text.IndexOf($name, [System.StringComparison]::OrdinalIgnoreCase) -ge 0) { return $true }
+    }
+    return [regex]::IsMatch($Text, $script:EpicMergeGateRestMergePattern)
+}
+
+function Test-EpicMergeGateCommandInScope {
+    <#
+    .SYNOPSIS
+        Report whether a command line is a gated merge or enqueue action (issue #952).
+    .DESCRIPTION
+        True for any gh pr merge match, Structural or Indeterminate, unless the match is Structural
+        and its only action flag is --disable-auto; true for any gh api match whose tokens name a
+        merge or enqueue mutation or a pulls/<n>/merge path. Text that only mentions these words
+        produces no match and stays out of scope. An Indeterminate gh pr merge match stays in scope
+        (fail closed).
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory)][AllowEmptyString()][AllowNull()][string] $CommandText)
+
+    foreach ($match in @(Get-CommandLineInvocation -CommandText $CommandText -CommandWord 'gh' -SubcommandPath @('pr', 'merge'))) {
+        if ($match.Status -ne 'Structural' -or -not (Test-EpicMergeGateDisableAutoOnly -Match $match)) { return $true }
+    }
+    foreach ($match in @(Get-CommandLineInvocation -CommandText $CommandText -CommandWord 'gh' -SubcommandPath @('api'))) {
+        if (Test-EpicMergeGateApiMutationText -Text (@($match.Segment.Tokens) -join ' ')) { return $true }
+    }
+    return $false
+}
+
+function Get-EpicMergeGateSelectorPrNumber {
+    <#
+    .SYNOPSIS
+        Resolve the pull-request number of a gated merge or enqueue command, or $null.
+    .DESCRIPTION
+        For gh pr merge, only the first Structural match is read. Value flags are skipped with
+        their values, other flags are skipped, an equals-joined --merge=<digits> yields its
+        digits (an equals-joined value that is not a number is skipped like any other flag),
+        and the first non-flag token (or the token after a bare '--') is the selector.
+        For gh api, the number comes from a pulls/<n>/merge token. Any other command yields
+        $null, which the gate handles through its no-number branches.
+    .OUTPUTS
+        System.Nullable[int]
+    #>
+    [CmdletBinding()]
+    [OutputType([int])]
+    param([Parameter(Mandatory)][AllowEmptyString()][AllowNull()][string] $CommandText)
+
+    $match = Get-CommandLineStructuralMatch -CommandText $CommandText -CommandWord 'gh' -SubcommandPath @('pr', 'merge')
+    if ($null -ne $match) {
+        $tokens = [string[]]@($match.Segment.Tokens)
+        $index = $match.OperandIndex
+        while ($index -lt $tokens.Count) {
+            $token = $tokens[$index]
+            if ($token -ceq '--') {
+                if ($index + 1 -lt $tokens.Count) { return ConvertFrom-EpicMergeGateSelector -Selector $tokens[$index + 1] }
+                return $null
+            }
+            if ($token.StartsWith('-') -and $token.Length -gt 1) {
+                $name = Get-EpicMergeGateFlagName -Token $token
+                if ($name -ceq '--merge' -and $token.Length -gt $name.Length) {
+                    $equalsNumber = ConvertFrom-EpicMergeGateSelector -Selector $token.Substring($name.Length + 1)
+                    if ($null -ne $equalsNumber) { return $equalsNumber }
+                }
+                $index += if ($script:EpicMergeGateValueFlags -ccontains $token) { 2 } else { 1 }
+                continue
+            }
+            return ConvertFrom-EpicMergeGateSelector -Selector $token
+        }
+        return $null
+    }
+
+    foreach ($apiMatch in @(Get-CommandLineInvocation -CommandText $CommandText -CommandWord 'gh' -SubcommandPath @('api'))) {
+        foreach ($token in @($apiMatch.Segment.Tokens)) {
+            $rest = [regex]::Match([string]$token, $script:EpicMergeGateRestMergePattern)
+            $number = 0
+            if ($rest.Success -and [int]::TryParse($rest.Groups[1].Value, [ref] $number)) { return $number }
+        }
+    }
+    return $null
+}

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-merge-gate.ps1

@@ -3,6 +3,11 @@
     Gates epic child and integration PR merges behind checkpointed green state.
 
 .DESCRIPTION
+    Trigger scope (issue #952): every gh pr merge invocation (any merge method, --auto, --admin,
+    or no method flag) and every gh api merge or enqueue mutation is gated, because under a merge
+    queue each of them reaches the base branch; only a pure --disable-auto is out of scope. The
+    predicate and the PR selector reader live in enforce-epic-merge-gate-command.ps1.
+
     Docs-only branch (issue #927): after the standalone branch denies an explicit PR number,
     and only when no checkpoint is present at the repository root (both checkpoint texts are
     blank; operator decision OD-1, stricter than the Claude per-PR rule), the gate calls
@@ -25,6 +30,9 @@ $script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot
 # the two runtimes on one implementation of the same concern.
 try { . (Join-Path $PSScriptRoot 'hook-command-scanner.ps1') } catch { Add-HookDependencyFailure -Name 'hook-command-scanner.ps1' -ErrorRecord $_ }
 try { . (Join-Path $PSScriptRoot 'hook-command-invocation.ps1') } catch { Add-HookDependencyFailure -Name 'hook-command-invocation.ps1' -ErrorRecord $_ }
+# Merge and enqueue scope predicate and the PR selector reader (issue #952), byte-identical to the
+# Claude copy.
+try { . (Join-Path $PSScriptRoot 'enforce-epic-merge-gate-command.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-epic-merge-gate-command.ps1' -ErrorRecord $_ }
 # Shared docs-only diff classification and the merge-side docs-only exemption (issue #927).
 try { . (Join-Path $PSScriptRoot 'hook-docs-only-diff.ps1') } catch { Add-HookDependencyFailure -Name 'hook-docs-only-diff.ps1' -ErrorRecord $_ }
 
@@ -61,15 +69,11 @@ function Get-CodexMergeCommandPrNumber {
     .SYNOPSIS
         Resolve the explicit pull-request number of a gh pr merge invocation, or $null.
     .DESCRIPTION
-        The number is taken from the segment that structurally invokes `gh pr merge` and
-        from nowhere else: the positional spelling through Get-CommandLineOperand, the
-        flag-led and equals-joined spellings through Get-CommandLineFlagValue. A leading
-        `cd <path>` segment contributes no operand and no flag value, so no digit run
+        The number is resolved by Get-EpicMergeGateSelectorPrNumber in
+        enforce-epic-merge-gate-command.ps1 (issue #952), the file shared byte-identically with
+        the Claude runtime, from the segment that structurally invokes gh pr merge or gh api and
+        from nowhere else. A leading cd <path> segment contributes no selector, so no digit run
         outside the merge segment can be mistaken for a pull-request number.
-
-        This copy has never carried the Claude copy's unanchored whole-text digit scan and
-        deliberately does not acquire one. No regular expression matching a bare digit run
-        is introduced here; the only pattern below anchors an all-digit token end to end.
     .OUTPUTS
         System.Nullable[int]
     #>
@@ -77,18 +81,7 @@ function Get-CodexMergeCommandPrNumber {
     [OutputType([int])]
     param([Parameter(Mandatory)][string] $Command)
 
-    foreach ($operand in @(Get-CommandLineOperand -CommandText $Command -CommandWord 'gh' -SubcommandPath @('pr', 'merge'))) {
-        if ($operand -match '^\d+$') {
-            return [int]$operand
-        }
-    }
-
-    $flagValue = Get-CommandLineFlagValue -CommandText $Command -CommandWord 'gh' -SubcommandPath @('pr', 'merge') -FlagName '--merge'
-    if ($null -ne $flagValue -and $flagValue -match '^\d+$') {
-        return [int]$flagValue
-    }
-
-    return $null
+    return Get-EpicMergeGateSelectorPrNumber -CommandText $Command
 }
 
 function Test-CodexChildMergeReady {
@@ -153,23 +146,9 @@ function Invoke-CodexEpicMergeDecision {
         return $null
     }
     $command = [string]$payload.tool_input.command
-    # Both legs are read structurally from the segment that invokes the command, so a
-    # quoted mention of the phrase no longer brings a command into scope. The flag leg needs
-    # a raw-scan fallback: a wrapper's quoted argument collapses into ONE token, so a flag
-    # inside it is never read as a token, and the token-only read took
-    # bash -c "gh pr merge --merge 688" out of scope.
-    $isMergeInvocation = Test-CommandLineInvocation -CommandText $command -CommandWord 'gh' -SubcommandPath @('pr', 'merge')
-    $hasMergeFlag = Test-CommandLineFlag -CommandText $command -CommandWord 'gh' -SubcommandPath @('pr', 'merge') -FlagName '--merge'
-    if (-not $hasMergeFlag) {
-        foreach ($segment in @(Read-CommandLineSegment -CommandText $command)) {
-            if ((Test-CommandLineSegmentRawScan -Segment $segment) -and
-                $segment.ScanText.IndexOf('--merge', [System.StringComparison]::OrdinalIgnoreCase) -ge 0) {
-                $hasMergeFlag = $true
-                break
-            }
-        }
-    }
-    if (-not $isMergeInvocation -or -not $hasMergeFlag) {
+    # Scope (issue #952): every gh pr merge invocation except a pure --disable-auto, and every gh api
+    # merge or enqueue mutation, is gated; Test-EpicMergeGateCommandInScope holds the predicate.
+    if (-not (Test-EpicMergeGateCommandInScope -CommandText $command)) {
         return $null
     }
 
@@ -214,7 +193,7 @@ function Invoke-CodexEpicMergeDecision {
         hookSpecificOutput = [ordered]@{
             hookEventName            = 'PreToolUse'
             permissionDecision       = 'deny'
-            permissionDecisionReason = 'EPIC_MERGE_GATE_BLOCKED: gh pr merge --merge requires a safe epic child checkpoint or a successful final epic CI gate with a matching PR number.'
+            permissionDecisionReason = 'EPIC_MERGE_GATE_BLOCKED: a pull-request merge or merge-queue enqueue (gh pr merge with any method, --auto, or --admin, or a gh api merge or enqueue mutation) requires a safe epic child checkpoint or a successful final epic CI gate with a matching PR number.'
         }
     }
 }

package/resources/codex-and-agents-customizations/.codex/hooks/hook-docs-only-diff.ps1

@@ -19,7 +19,8 @@
                                                is balanced; a structural gh pr merge; no inline
                                                VAR= prefix token (GH_REPO=, GH_HOST=); no
                                                single-dash token containing R; no --repo or
-                                               --repo= token; no --auto token.
+                                               --repo= token; no --auto token; no token
+                                               containing /pull/ (a URL selector).
       M2 DOCS_ONLY_EXEMPTION_PR_UNRESOLVED   - the worktree root is an existing directory.
       M3 DOCS_ONLY_EXEMPTION_PR_UNRESOLVED   - gh pr view <N> --json baseRefName,headRefOid
                                                exits 0 and returns a JSON object; headRefOid
@@ -368,6 +369,9 @@ function Get-DocsOnlyMergeShapeViolation {
         if ($text -eq '--repo' -or $text.StartsWith('--repo=', [System.StringComparison]::OrdinalIgnoreCase)) {
             return $prefix + "the repository override '$text' is not accepted."
         }
+        if ($text.Contains('/pull/')) {
+            return $prefix + "the URL selector '$text' is not accepted."
+        }
         if ($text -eq '--auto' -or $text.StartsWith('--auto=', [System.StringComparison]::OrdinalIgnoreCase)) {
             return $prefix + 'auto-merge (--auto) is not eligible.'
         }