@danmoisan/drm-copilot-mcp 1.1.22 → 1.1.23

package/resources/claude-customizations/.claude/hooks/enforce-epic-merge-gate.ps1

@@ -20,6 +20,11 @@
          entry whose merge_status == "ci_green". A parallel run always names an explicit PR
          number (each item merges from its own isolated worktree), so a bare command with no
          PR number cannot satisfy this branch.
+     3b. Green-CI standalone path (issue #997): the command names an explicit PR number, no
+         epic or parallel checkpoint records that number or the item worktree, the per-feature
+         checkpoint records step9_status == "passed", ci_gate.conclusion == "success", and a
+         pr_gate.pr_number equal to it, and the live PR head equals ci_gate.head_sha. The
+         dot-sourced enforce-epic-merge-gate-green-ci.ps1 implements this branch.
       4. Standalone path (issue #670), evaluated last: the command names an explicit PR
          number and one of the three checkpoints above carries a
          standalone_merge_authorizations record whose pr_number equals it, whose fields are
@@ -29,15 +34,20 @@
     Otherwise the command is denied with reason EPIC_MERGE_GATE_BLOCKED; a denial from
     condition 4 also carries a standalone reason code after that token. A missing or
     unreadable checkpoint in any branch fails closed (denies). A standalone (non-epic,
-    non-parallel) run never satisfies conditions 1-3, so its only route to a merge is an
-    explicit, PR-specific, session-bound record under condition 4; a bare command with no
-    PR number never satisfies condition 4, and a blanket flag is rejected rather than read.
+    non-parallel) run never satisfies conditions 1-3; it merges through the green-CI branch
+    3b or through an explicit, PR-specific, session-bound record under condition 4. A bare
+    command with no PR number satisfies neither, and a blanket flag is rejected rather than
+    read. A 3b decline after its live-head lookup appends a GREEN_CI_* code to the deny.
     Trigger scope (issue #952): every merge method (--merge/-m, --squash/-s, --rebase/-r), --auto,
     --admin, and a bare gh pr merge are gated alike, because under a merge queue each spelling
     enqueues the pull request; only a pure --disable-auto is out of scope. The predicate and the
     PR selector reader live in enforce-epic-merge-gate-command.ps1.
 
-    Design decision: branches 1-4 trust the on-disk checkpoint and never call gh. Issue #927
+    Design decision: branches 1-4 trust the on-disk checkpoint and never call gh. The green-CI
+    branch makes at most one bounded gh pr view call, only after its pure stages A to C pass.
+    Its parallel exclusion is best-effort: the Parallel mode: true marker is in the delegation
+    prompt, not in a Bash payload, so a parallel child that no checkpoint records yet is not
+    excluded mechanically (residual window; see enforce-epic-merge-gate-green-ci.ps1). Issue #927
     adds a docs-only branch after branch 4 fails, only for an explicit PR number whose item,
     epic, and parallel targets are all NoTarget (no checkpoint records the PR): it calls
     Get-DocsOnlyMergeExemption (hook-docs-only-diff.ps1), which runs gh pr view and git in the
@@ -86,6 +96,8 @@ try { . (Join-Path $PSScriptRoot 'enforce-epic-merge-gate-resolution.ps1') } cat
 try { . (Join-Path $PSScriptRoot 'enforce-epic-merge-gate-command.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-epic-merge-gate-command.ps1' -ErrorRecord $_ }
 # Shared docs-only diff classification and the merge-side docs-only exemption (issue #927).
 try { . (Join-Path $PSScriptRoot 'hook-docs-only-diff.ps1') } catch { Add-HookDependencyFailure -Name 'hook-docs-only-diff.ps1' -ErrorRecord $_ }
+# Green-CI standalone merge branch: pure checks, the live-head seam, and the stage orchestrator (issue #997).
+try { . (Join-Path $PSScriptRoot 'enforce-epic-merge-gate-green-ci.ps1') } catch { Add-HookDependencyFailure -Name 'enforce-epic-merge-gate-green-ci.ps1' -ErrorRecord $_ }
 
 function ConvertFrom-EpicMergeGateJson {
     <#
@@ -376,6 +388,10 @@ function Invoke-EpicMergeGateDecision {
         return Get-EpicMergeGateAllowDecision
     }
 
+    # Branch 3b (issue #997): a standalone run whose checkpoint records a green S9 gate merges its own PR.
+    $greenCi = Get-EpicMergeGateGreenCiDecision -CommandText $commandText -CommandPrNumber $commandPrNumber -ChildCheckpoint $childCheckpoint -ItemTarget $itemTarget -EpicTarget $epicTarget -ParallelTarget $parallelTarget -SessionRoot $sessionRoot
+    if ($greenCi.Allowed) { return Get-EpicMergeGateAllowDecision }
+
     # Branch 4, evaluated last and only for an explicit PR number: a PR-specific standalone
     # authorization record bound to the live session. Its deny keeps the gate token first.
     if ($null -ne $commandPrNumber) {
@@ -397,10 +413,10 @@ function Invoke-EpicMergeGateDecision {
         # three details precede the standalone reason (issue #850).
         $unresolved = Get-EpicMergeGateUnresolvedReason -ItemTarget $itemTarget -EpicTarget $epicTarget -ParallelTarget $parallelTarget
         $prefix = if ($unresolved) { $unresolved + '; ' } else { '' }
-        return Get-EpicMergeGateBlockDecision -Reason ('EPIC_MERGE_GATE_BLOCKED: ' + $prefix + $standalone.ReasonCode + ': ' + $standalone.Message + $docsOnlySuffix)
+        return Get-EpicMergeGateBlockDecision -Reason ('EPIC_MERGE_GATE_BLOCKED: ' + $prefix + $standalone.ReasonCode + ': ' + $standalone.Message + $docsOnlySuffix + $greenCi.Suffix)
     }
 
-    return Get-EpicMergeGateBlockDecision -Reason 'EPIC_MERGE_GATE_BLOCKED: a pull-request merge or merge-queue enqueue (gh pr merge with any method, --auto, or --admin, or a gh api merge or enqueue mutation) requires either a per-feature checkpoint with epic_mode == true and step9_status == "passed", an epic checkpoint with epic_merge_pr.ci_gate.conclusion == "success" and a matching pr_number, or a parallel-orchestrator checkpoint with route_id == "parallel" whose target item (matched by pr_number) has merge_status == "ci_green". No checkpoint satisfied this gate.'
+    return Get-EpicMergeGateBlockDecision -Reason 'EPIC_MERGE_GATE_BLOCKED: a pull-request merge or merge-queue enqueue (gh pr merge with any method, --auto, or --admin, or a gh api merge or enqueue mutation) requires either a per-feature checkpoint with epic_mode == true and step9_status == "passed", an epic checkpoint with epic_merge_pr.ci_gate.conclusion == "success" and a matching pr_number, a parallel-orchestrator checkpoint with route_id == "parallel" whose target item (matched by pr_number) has merge_status == "ci_green", or a standalone per-feature checkpoint (epic_mode absent or false, no parallel marker) with step9_status == "passed", ci_gate.conclusion == "success", pr_gate.pr_number equal to the explicit PR number, and ci_gate.head_sha equal to the live pull-request head. No checkpoint satisfied this gate.'
 }
 
 function Invoke-EpicMergeGateEntryPoint {

package/resources/claude-customizations/.claude/hooks/enforce-epic-worktree-removal-gate-resolution.ps1

@@ -21,6 +21,9 @@
       for the removal target, and Get-EpicWorktreeGateDenyDiagnostics, which builds the
       diagnostics clause of the final deny from two read results without reading any
       file (issue #851).
+    - The import guard for WorktreeRunRecordPath.psm1, whose Get-WorktreeRunRecordBaseRoot
+      pairs the main checkout root with a read's own root so a relative recorded
+      worktree_path is compared through the shared matcher (issue #995).
 
 .NOTES
     PowerShell 7+. Depends on Get-EpicWorktreeGateBlockDecision,
@@ -29,6 +32,8 @@
     extensions/drm-copilot/resources/claude-customizations/.
 #>
 
+# Shared recorded-path matcher and main-checkout-root seam (issue #995).
+try { Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/WorktreeRunRecordPath.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'WorktreeRunRecordPath.psm1' -ErrorRecord $_ }
 try { Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/WorktreeRunResolution.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'WorktreeRunResolution.psm1' -ErrorRecord $_ }
 
 function Get-EpicWorktreeGateCheckpointContent {
@@ -132,13 +137,15 @@ function Find-EpicWorktreeGateParallelItemRecord {
     .SYNOPSIS
         Locate the parallel items[] record whose worktree_path matches the target path.
     .DESCRIPTION
-        Pure. Normalizes both paths exactly as Test-ParallelCheckpointAllowsWorktreeRemoval
-        does (backslash to slash, trailing slash trimmed, PowerShell -eq) and returns the
-        first matching entry (issue #851).
+        Pure. Compares through Test-WorktreeRunRecordedPathMatchesTarget, exactly as
+        Test-ParallelCheckpointAllowsWorktreeRemoval does, and returns the first matching
+        entry (issues #851, #995).
     .PARAMETER Checkpoint
         Parsed parallel-orchestrator checkpoint, or $null when absent/unreadable.
     .PARAMETER WorktreePath
         The removal target the command names.
+    .PARAMETER BaseRoot
+        Optional. The roots a relative recorded worktree_path is joined to.
     .OUTPUTS
         System.Object or $null
     #>
@@ -148,7 +155,9 @@ function Find-EpicWorktreeGateParallelItemRecord {
         $Checkpoint,
 
         [AllowNull()]
-        [string] $WorktreePath
+        [string] $WorktreePath,
+
+        [AllowNull()][AllowEmptyCollection()][string[]] $BaseRoot = @()
     )
 
     if ($null -eq $Checkpoint -or [string]::IsNullOrWhiteSpace($WorktreePath)) {
@@ -159,7 +168,7 @@ function Find-EpicWorktreeGateParallelItemRecord {
         return $null
     }
 
-    $normalizedTarget = ($WorktreePath -replace '\\', '/').TrimEnd('/')
+    # Scan the items for the first record the shared matcher accepts for the target.
     foreach ($item in @($Checkpoint.items)) {
         if ($null -eq $item) {
             continue
@@ -168,8 +177,7 @@ function Find-EpicWorktreeGateParallelItemRecord {
         if ($itemProps -notcontains 'worktree_path') {
             continue
         }
-        $normalizedItemPath = (([string]$item.worktree_path) -replace '\\', '/').TrimEnd('/')
-        if ($normalizedItemPath -eq $normalizedTarget) {
+        if (Test-WorktreeRunRecordedPathMatchesTarget -RecordedPath ([string]$item.worktree_path) -TargetPath $WorktreePath -BaseRoot $BaseRoot) {
             return $item
         }
     }
@@ -191,6 +199,9 @@ function Get-EpicWorktreeGateDenyDiagnostics {
         The parallel read result (Target, Checkpoint, Path).
     .PARAMETER WorktreePath
         The removal target the command names.
+    .PARAMETER MainRoot
+        Optional. The main checkout root the gate derived; with each read's own root it
+        forms the base roots a relative recorded worktree_path is joined to (issue #995).
     .OUTPUTS
         System.String
     #>
@@ -200,7 +211,8 @@ function Get-EpicWorktreeGateDenyDiagnostics {
     param(
         [Parameter(Mandatory)] $EpicRead,
         [Parameter(Mandatory)] $ParallelRead,
-        [AllowNull()][AllowEmptyString()][string] $WorktreePath
+        [AllowNull()][AllowEmptyString()][string] $WorktreePath,
+        [AllowNull()][AllowEmptyString()][string] $MainRoot
     )
 
     $parts = foreach ($kind in @('epic', 'parallel')) {
@@ -213,11 +225,12 @@ function Get-EpicWorktreeGateDenyDiagnostics {
             $recordText = 'checkpoint absent or unparseable'
         }
         else {
+            $baseRoot = Get-WorktreeRunRecordBaseRoot -MainRoot $MainRoot -Read $read
             $record = if ($kind -eq 'epic') {
-                Find-EpicWorktreeFeatureRecord -Checkpoint $read.Checkpoint -WorktreePath $WorktreePath
+                Find-EpicWorktreeFeatureRecord -Checkpoint $read.Checkpoint -WorktreePath $WorktreePath -BaseRoot $baseRoot
             }
             else {
-                Find-EpicWorktreeGateParallelItemRecord -Checkpoint $read.Checkpoint -WorktreePath $WorktreePath
+                Find-EpicWorktreeGateParallelItemRecord -Checkpoint $read.Checkpoint -WorktreePath $WorktreePath -BaseRoot $baseRoot
             }
             $arrayName = if ($kind -eq 'epic') { 'features' } else { 'items' }
             $recordText = if ($null -eq $record) {

package/resources/claude-customizations/.claude/hooks/enforce-epic-worktree-removal-gate.ps1

@@ -26,8 +26,9 @@
     before either checkpoint is read.
 
     Both branches key on the worktree PATH because the command names a path, and both
-    normalize separators and trim a trailing slash on each side of the comparison, so
-    Windows- and POSIX-style paths compare equal. Path is also why the two branches are
+    compare through Test-WorktreeRunRecordedPathMatchesTarget (issue #995), so Windows-
+    and POSIX-style paths compare equal and a relative record is joined to the main
+    checkout root and the checkpoint's own root. Path is also why the two branches are
     mutually exclusive in practice: an epic run and a parallel run allocate worktrees
     under distinct per-run, per-item paths, so a path recorded in one checkpoint is not a
     path recorded in the other, and adding branch 2 cannot widen what branch 1 authorizes.
@@ -121,6 +122,8 @@ function Find-EpicWorktreeFeatureRecord {
         Parsed epic checkpoint, or $null when absent/unreadable.
     .PARAMETER WorktreePath
         The target worktree path extracted from the command text.
+    .PARAMETER BaseRoot
+        Optional. The roots a relative recorded worktree_path is joined to (issue #995).
     .OUTPUTS
         System.Object or $null
     #>
@@ -130,7 +133,9 @@ function Find-EpicWorktreeFeatureRecord {
         $Checkpoint,
 
         [AllowNull()]
-        [string] $WorktreePath
+        [string] $WorktreePath,
+
+        [AllowNull()][AllowEmptyCollection()][string[]] $BaseRoot = @()
     )
 
     if ($null -eq $Checkpoint -or [string]::IsNullOrWhiteSpace($WorktreePath)) {
@@ -141,17 +146,14 @@ function Find-EpicWorktreeFeatureRecord {
         return $null
     }
 
-    $normalizedTarget = ($WorktreePath -replace '\\', '/').TrimEnd('/')
-
-    # Scan every recorded feature for a worktree_path that matches the removal target;
-    # path separators are normalized so Windows- and POSIX-style paths compare equal.
+    # Scan every recorded feature for a worktree_path that names the removal target
+    # through the shared matcher (separator, trailing slash, case rule, relative join).
     foreach ($feature in @($Checkpoint.features)) {
         $featureProps = @($feature.PSObject.Properties.Name)
         if ($featureProps -notcontains 'worktree_path') {
             continue
         }
-        $normalizedFeaturePath = (([string]$feature.worktree_path) -replace '\\', '/').TrimEnd('/')
-        if ($normalizedFeaturePath -eq $normalizedTarget) {
+        if (Test-WorktreeRunRecordedPathMatchesTarget -RecordedPath ([string]$feature.worktree_path) -TargetPath $WorktreePath -BaseRoot $BaseRoot) {
             return $feature
         }
     }
@@ -198,6 +200,8 @@ function Test-ParallelCheckpointAllowsWorktreeRemoval {
         Parsed parallel-orchestrator checkpoint, or $null when absent/unreadable.
     .PARAMETER WorktreePath
         The target worktree path extracted from the command text.
+    .PARAMETER BaseRoot
+        Optional. The roots a relative recorded worktree_path is joined to (issue #995).
     .OUTPUTS
         System.Boolean
     #>
@@ -208,7 +212,9 @@ function Test-ParallelCheckpointAllowsWorktreeRemoval {
         $Checkpoint,
 
         [AllowNull()]
-        [string] $WorktreePath
+        [string] $WorktreePath,
+
+        [AllowNull()][AllowEmptyCollection()][string[]] $BaseRoot = @()
     )
 
     if ($null -eq $Checkpoint -or [string]::IsNullOrWhiteSpace($WorktreePath)) {
@@ -224,10 +230,8 @@ function Test-ParallelCheckpointAllowsWorktreeRemoval {
         return $false
     }
 
-    $normalizedTarget = ($WorktreePath -replace '\\', '/').TrimEnd('/')
-
-    # Scan every recorded item for a worktree_path that matches the removal target;
-    # path separators are normalized exactly as the epic branch normalizes them.
+    # Scan every recorded item for a worktree_path that names the removal target through
+    # the same shared matcher the epic branch uses.
     foreach ($item in @($Checkpoint.items)) {
         if ($null -eq $item) {
             continue
@@ -236,8 +240,7 @@ function Test-ParallelCheckpointAllowsWorktreeRemoval {
         if ($itemProps -notcontains 'worktree_path') {
             continue
         }
-        $normalizedItemPath = (([string]$item.worktree_path) -replace '\\', '/').TrimEnd('/')
-        if ($normalizedItemPath -ne $normalizedTarget) {
+        if (-not (Test-WorktreeRunRecordedPathMatchesTarget -RecordedPath ([string]$item.worktree_path) -TargetPath $WorktreePath -BaseRoot $BaseRoot)) {
             continue
         }
         if ($itemProps -notcontains 'merge_status') {
@@ -366,14 +369,19 @@ function Get-EpicWorktreeRemovalTargetDenial {
         }
     }
     $checkpoint = $epicRead.Checkpoint
+    # A relative record is joined to the main checkout root and to the root holding the
+    # checkpoint read (issue #995); the main root is derived once per target.
+    $mainRoot = Get-WorktreeRunMainCheckoutRoot -SessionRoot (Get-Location).Path
+    $epicBaseRoot = Get-WorktreeRunRecordBaseRoot -MainRoot $mainRoot -Read $epicRead
+    $parallelBaseRoot = Get-WorktreeRunRecordBaseRoot -MainRoot $mainRoot -Read $parallelRead
 
-    $featureRecord = Find-EpicWorktreeFeatureRecord -Checkpoint $checkpoint -WorktreePath $worktreePath
+    $featureRecord = Find-EpicWorktreeFeatureRecord -Checkpoint $checkpoint -WorktreePath $worktreePath -BaseRoot $epicBaseRoot
     if (Test-EpicWorktreeRemovalAllowed -FeatureRecord $featureRecord) {
         return $null
     }
 
     $parallelCheckpoint = $parallelRead.Checkpoint
-    if (Test-ParallelCheckpointAllowsWorktreeRemoval -Checkpoint $parallelCheckpoint -WorktreePath $worktreePath) {
+    if (Test-ParallelCheckpointAllowsWorktreeRemoval -Checkpoint $parallelCheckpoint -WorktreePath $worktreePath -BaseRoot $parallelBaseRoot) {
         return $null
     }
 
@@ -387,8 +395,8 @@ function Get-EpicWorktreeRemovalTargetDenial {
     # the unchanged deny below. That exclusion is the only path by which the manifest
     # could widen what the gates protect, which is why it is required rather than
     # advisory, and why it is evaluated before the manifest predicate.
-    if (-not (Test-CleanupManifestCheckpointCoversPath -Checkpoint $checkpoint -RecordArrayName 'features' -WorktreePath $worktreePath) -and
-        -not (Test-CleanupManifestCheckpointCoversPath -Checkpoint $parallelCheckpoint -RecordArrayName 'items' -WorktreePath $worktreePath) -and
+    if (-not (Test-CleanupManifestCheckpointCoversPath -Checkpoint $checkpoint -RecordArrayName 'features' -WorktreePath $worktreePath -BaseRoot $epicBaseRoot) -and
+        -not (Test-CleanupManifestCheckpointCoversPath -Checkpoint $parallelCheckpoint -RecordArrayName 'items' -WorktreePath $worktreePath -BaseRoot $parallelBaseRoot) -and
         (Test-CleanupWorktreeManifestAuthorizesRemoval -WorktreePath $worktreePath)) {
         return $null
     }
@@ -400,7 +408,7 @@ function Get-EpicWorktreeRemovalTargetDenial {
     if ($epicRead.Target.Status -eq 'NoTarget' -and $parallelRead.Target.Status -eq 'NoTarget') {
         $prefix = "$($epicRead.Target.ReasonCode): $($epicRead.Target.Detail). "
     }
-    $diagnostics = Get-EpicWorktreeGateDenyDiagnostics -EpicRead $epicRead -ParallelRead $parallelRead -WorktreePath $worktreePath
+    $diagnostics = Get-EpicWorktreeGateDenyDiagnostics -EpicRead $epicRead -ParallelRead $parallelRead -WorktreePath $worktreePath -MainRoot $mainRoot
     return Get-EpicWorktreeGateBlockDecision -Reason ('EPIC_WORKTREE_REMOVAL_BLOCKED: ' + $prefix + "git worktree remove for '$worktreePath' requires either an epic checkpoint features[] record with merge_status in {merged, worktree_removed}, or a parallel-orchestrator checkpoint with route_id == ""parallel"" whose matching items[] record (matched by worktree_path) has merge_status in {merged, worktree_removed}. No checkpoint authorized this removal. " + $diagnostics)
 }
 

package/resources/claude-customizations/.claude/hooks/enforce-file-size-limit.ps1

@@ -0,0 +1,244 @@
+<#
+.SYNOPSIS
+    Pre-tool-use hook that blocks a Write or Edit leaving a covered file above 800 lines.
+
+.DESCRIPTION
+    This script is invoked by the Claude Code PreToolUse hook before any Write or Edit
+    operation. It enforces the hard tier of the tiered file-size policy: 500 lines is
+    guidance, 700 lines is advisory, and above 800 lines a split is enforced regardless
+    of logical separability. The policy functions live in the shared module
+    ../lib/file-size-policy/FileSizePolicy.psm1.
+
+    Decision order:
+      1. A dependency-load failure denies (fail closed).
+      2. An unreadable envelope denies.
+      3. A path that is not covered (outside the extension allowlist, under an excluded
+         directory, or outside the repository root) allows with no file read.
+      4. Write: the resulting size is the logical line count of content. The pre-write
+         file is read only when that size is above 800.
+         Edit: the pre-edit file is read through the ReadFileContent seam and the
+         old_string to new_string replacement is applied in memory. An unreadable or
+         missing file, or an edit that cannot be resolved, denies.
+      5. The baseline-free pre-edit-size ratchet decides: a result above 800 lines is
+         denied unless the file already existed and does not grow.
+
+    The hook does not read config/file-size-baseline.json, because it ships to
+    repositories that have no baseline; the repository's CI gate is the
+    baseline-aware check. The deny shape is hookSpecificOutput.permissionDecision =
+    'deny' with permissionDecisionReason, exit 0.
+
+.NOTES
+    Compatible with PowerShell 7+.
+    This script must not modify any state; it is a read-only validation gate.
+#>
+[CmdletBinding()]
+param()
+$script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot 'hook-dependency-guard.ps1') } catch { $script:HookDependencyGuardLoadFailed = $true }
+
+try { Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'HookPayload.psm1' -ErrorRecord $_ }
+try { Import-Module (Join-Path $PSScriptRoot '../lib/file-size-policy/FileSizePolicy.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'FileSizePolicy.psm1' -ErrorRecord $_ }
+
+function Get-FileSizeLimitBlockDecision {
+    <#
+    .SYNOPSIS
+        Constructs a deny-decision ordered dictionary carrying the supplied reason.
+    .PARAMETER Reason
+        The deny reason; it starts with FILE_SIZE_LIMIT_BLOCKED:.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $Reason
+    )
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $Reason
+        }
+    }
+}
+
+function Get-FileSizeLimitAllowDecision {
+    <#
+    .SYNOPSIS
+        Constructs the allow-decision ordered dictionary.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param()
+
+    return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
+}
+
+function Get-FileSizeLimitReplaceAllFlag {
+    <#
+    .SYNOPSIS
+        Returns the boolean value of the replace_all property of an Edit tool input.
+    .DESCRIPTION
+        A boolean is returned as is; a string is true only when its trimmed value is
+        'true' (case-insensitive); every other value, and an absent property, is false.
+        No [bool] cast is used because [bool]'false' is $true in PowerShell.
+    .PARAMETER ToolInput
+        The tool_input object.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()]
+        [object] $ToolInput
+    )
+
+    $value = Get-ClaudeHookEnvelopeValue -Envelope $ToolInput -Name 'replace_all'
+    if ($value -is [bool]) {
+        return $value
+    }
+    if ($value -is [string]) {
+        return ($value.Trim() -ieq 'true')
+    }
+    return $false
+}
+
+function Invoke-FileSizeLimitDecision {
+    <#
+    .SYNOPSIS
+        Parses the PreToolUse envelope and returns an allow-or-deny decision.
+    .PARAMETER ToolInputRaw
+        The raw JSON hook payload acquired by Read-ClaudeHookRawPayload.
+    .PARAMETER RepositoryRoot
+        The repository root used to resolve relative paths. Defaults to the current
+        location, which is the project root when Claude Code runs the hook.
+    .PARAMETER ReadFileContent
+        Seam that returns the text of a file, $null when the file does not exist, and
+        throws when it cannot be read. Tests supply in-memory content.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $ToolInputRaw,
+
+        [string] $RepositoryRoot = (Get-Location).ProviderPath,
+
+        [scriptblock] $ReadFileContent = {
+            param([string] $Path)
+            if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return $null }
+            return [System.IO.File]::ReadAllText($Path)
+        }
+    )
+    $dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'FILE_SIZE_LIMIT_BLOCKED:'
+    if ($null -ne $dependencyDecision) { return $dependencyDecision }
+
+    $payload = Resolve-ClaudeHookToolInput -Raw $ToolInputRaw
+    if (-not $payload.IsValid) {
+        return Get-FileSizeLimitBlockDecision -Reason ('FILE_SIZE_LIMIT_BLOCKED: payload anomaly - ' +
+            (Get-ClaudeHookPayloadAnomalyReason -Anomaly $payload.Anomaly) +
+            '. The gate fails closed on an envelope it cannot read.')
+    }
+
+    $toolInput = $payload.Value
+    $filePath = Get-ClaudeHookToolInputString -ToolInput $toolInput -Name 'file_path'
+    $relativePath = ConvertTo-FileSizeRelativePath -Path $filePath -RepositoryRoot $RepositoryRoot
+    if (-not (Test-FileSizeCoveredPath -RelativePath $relativePath)) {
+        return Get-FileSizeLimitAllowDecision
+    }
+
+    $isRooted = ($filePath -match '^[\\/]') -or ($filePath -match '^[A-Za-z]:[\\/]')
+    $readPath = if ($isRooted) { $filePath } else { Join-Path $RepositoryRoot $relativePath }
+    $toolName = Get-ClaudeHookToolInputString -ToolInput $payload.Envelope -Name 'tool_name'
+    $isEdit = ($toolName -eq 'Edit')
+
+    $resultCount = 0
+    if (-not $isEdit) {
+        $resultCount = Get-FileSizeLogicalLineCount -Content (Get-ClaudeHookToolInputString -ToolInput $toolInput -Name 'content')
+        if ($resultCount -le (Get-FileSizePolicyLimit).HardLimit) {
+            return Get-FileSizeLimitAllowDecision
+        }
+    }
+
+    try {
+        $preEditContent = & $ReadFileContent $readPath
+    } catch {
+        return Get-FileSizeLimitBlockDecision -Reason "FILE_SIZE_LIMIT_BLOCKED: '$relativePath' could not be read to measure its size ($($_.Exception.Message)). The gate fails closed for a covered file."
+    }
+
+    $preEditCount = $null
+    if ($null -ne $preEditContent) {
+        $preEditCount = Get-FileSizeLogicalLineCount -Content ([string]$preEditContent)
+    }
+
+    if ($isEdit) {
+        if ($null -eq $preEditContent) {
+            return Get-FileSizeLimitBlockDecision -Reason "FILE_SIZE_LIMIT_BLOCKED: '$relativePath' does not exist, so the Edit cannot be measured. The gate fails closed for a covered file."
+        }
+        $edit = Resolve-FileSizeEditContent -Content ([string]$preEditContent) `
+            -OldString (Get-ClaudeHookToolInputString -ToolInput $toolInput -Name 'old_string') `
+            -NewString (Get-ClaudeHookToolInputString -ToolInput $toolInput -Name 'new_string') `
+            -ReplaceAll (Get-FileSizeLimitReplaceAllFlag -ToolInput $toolInput)
+        if ($null -ne $edit.Failure) {
+            return Get-FileSizeLimitBlockDecision -Reason "FILE_SIZE_LIMIT_BLOCKED: the Edit to '$relativePath' could not be resolved in memory ($($edit.Failure)). The gate fails closed for a covered file."
+        }
+        $resultCount = Get-FileSizeLogicalLineCount -Content $edit.Content
+    }
+
+    $decision = Get-FileSizeHookDecision -RelativePath $relativePath -ResultLineCount $resultCount -PreEditLineCount $preEditCount
+    if ($decision.Allowed) {
+        return Get-FileSizeLimitAllowDecision
+    }
+    return Get-FileSizeLimitBlockDecision -Reason $decision.Reason
+}
+
+function Invoke-FileSizeLimitEntryPoint {
+    <#
+    .SYNOPSIS
+        Runs the file-size decision and returns the process exit code.
+    .DESCRIPTION
+        Acquires the payload through the shared reader unless the caller supplies one,
+        writes the compact JSON decision to the output stream, and returns 0. It never
+        returns 1: exit 1 is non-blocking for PreToolUse, so every anomaly is already a
+        deny decision by the time control reaches here.
+    .PARAMETER ToolInputRaw
+        Optional pre-acquired payload text. When omitted the ReadPayload seam runs.
+    .PARAMETER ReadPayload
+        Seam for payload acquisition.
+    #>
+    [CmdletBinding()]
+    [OutputType([int])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $ToolInputRaw,
+
+        [scriptblock] $ReadPayload = { Read-ClaudeHookRawPayload }
+    )
+
+    if (-not $PSBoundParameters.ContainsKey('ToolInputRaw')) {
+        $ToolInputRaw = [string](& $ReadPayload)
+    }
+
+    $decision = Invoke-FileSizeLimitDecision -ToolInputRaw $ToolInputRaw
+
+    $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+
+    return 0
+}
+
+# Guard allows dot-sourcing in tests without executing the entrypoint.
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+if ($script:HookDependencyGuardLoadFailed) { [Console]::Error.WriteLine('FILE_SIZE_LIMIT_BLOCKED: hook-dependency-guard.ps1 failed to load; the gate fails closed.'); exit 2 }
+$dependencyDecision = Get-HookDependencyFailureDecision -HookEvent PreToolUse -ReasonPrefix 'FILE_SIZE_LIMIT_BLOCKED:'
+if ($null -ne $dependencyDecision) { $dependencyDecision | ConvertTo-Json -Compress -Depth 5 | Write-Output; exit 0 }
+
+# The entry point returns its [int] exit code as the last pipeline element and the
+# decision JSON before it, so the decision is written explicitly here first.
+$entryPointResult = @(Invoke-FileSizeLimitEntryPoint)
+if ($entryPointResult.Count -gt 1) {
+    $entryPointResult[0..($entryPointResult.Count - 2)] | Write-Output
+}
+
+exit ([int]$entryPointResult[-1])

package/resources/claude-customizations/.claude/hooks/enforce-model-routing-receipt.ps1

@@ -40,6 +40,13 @@
     delegation prompt to a receipt-gated subagent type carries the canonical issue
     number line and a `branch:` label naming the item's branch.
 
+    Author-asserted autoclose line (issue #989): for subagent `pr-author` only, once the
+    per-feature receipt is confirmed, a checkpoint that records an `issue-num` and whose
+    `epic_mode` is not true requires the prompt line
+    `Author-asserted autoclose issues: #<issue-num>` at the start of a line. Its absence denies
+    with the AUTHOR_ASSERTED_AUTOCLOSE_MISSING sub-code (Get-ModelRoutingAuthorAssertedReason).
+    The epic-scope path is not subject to this rule.
+
 .NOTES
     Compatible with PowerShell 7+. Read-only presence-gating deterrent.
 #>
@@ -198,6 +205,42 @@ function Get-ModelRoutingTargetCheckpointResolution {
     }
 }
 
+function Get-ModelRoutingAuthorAssertedReason {
+    <#
+    .SYNOPSIS
+        Return the deny reason for a pr-author delegation that omits the author-asserted line, or $null.
+    .DESCRIPTION
+        Returns $null when the checkpoint records no usable issue-num, when it carries an
+        epic_mode property whose value is true (an epic child whose integration PR owns the
+        closing keyword), or when a prompt line starts with 'Author-asserted autoclose issues:'
+        and names '#<issue-num>' later on that line with no digit after the number. Property
+        presence is tested first because strict mode throws on a missing property.
+    .PARAMETER Checkpoint
+        The resolved per-feature checkpoint object.
+    .PARAMETER PromptText
+        The delegation prompt.
+    .OUTPUTS
+        System.String or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory)][AllowNull()] $Checkpoint,
+        [Parameter(Mandatory)][AllowEmptyString()][string] $PromptText
+    )
+
+    $names = @($Checkpoint.PSObject.Properties.Name)
+    $issue = if ($names -contains 'issue-num') { ConvertTo-WorktreeItemIssueNumber -Value $Checkpoint.'issue-num' } else { $null }
+    if ($null -eq $issue -or ($names -contains 'epic_mode' -and $Checkpoint.epic_mode -eq $true)) {
+        return $null
+    }
+    $line = "Author-asserted autoclose issues: #$issue"
+    if ([regex]::IsMatch($PromptText, '(?m)^Author-asserted autoclose issues:[^\r\n]*#' + $issue + '(?!\d)')) {
+        return $null
+    }
+    return "MODEL_ROUTING_RECEIPT_BLOCKED: AUTHOR_ASSERTED_AUTOCLOSE_MISSING: the checkpoint records issue-num $issue, so the Agent(pr-author) delegation prompt must carry the line '$line' so the PR body emits '- Closes #$issue'. Add that line on its own line, or omit it only for an epic child (epic_mode true)."
+}
+
 function Invoke-ModelRoutingReceiptDecision {
     <#
     .SYNOPSIS
@@ -274,6 +317,11 @@ function Invoke-ModelRoutingReceiptDecision {
 
     $checkpoint = Get-ModelRoutingCheckpoint -CheckpointPath $resolution.CheckpointPath
     if (Test-ModelRoutingReceiptPresent -Checkpoint $checkpoint -Subagent $subagent) {
+        # Issue #989: the pr-author delegation names the item's issue as author-asserted.
+        $authorAssertedReason = if ($subagent -eq 'pr-author') { Get-ModelRoutingAuthorAssertedReason -Checkpoint $checkpoint -PromptText $prompt } else { $null }
+        if ($authorAssertedReason) {
+            return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'deny'; permissionDecisionReason = $authorAssertedReason } }
+        }
         return $allow
     }