V9: A second tool shape, and the egress gate

.claude/settings.json

@@ -2,7 +2,7 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "^Bash$",
+        "matcher": "^(Bash|WebFetch)$",
         "hooks": [
           {
             "type": "command",

docs/demos/v3-runbook.md

@@ -107,7 +107,7 @@ every point in this narration except where a section is actively showing its own
 No edit needed — this is the tracked `policy/lib/data.json` exactly as committed. When V3 shipped
 that meant the destructive-command patterns alone; **since V4 the tracked file also carries a
 `redact` block**, of which the one the `transform` section below used to add is a subset — V4
-ships a second pattern beside it (`policy/lib/data.json:12-15`). Re-run against it, `ls -la` is still
+ships a second pattern beside it (`policy/lib/data.json:17-20`). Re-run against it, `ls -la` is still
 the clean allow captured here — the redaction patterns match secrets, and this command carries
 none.
 
@@ -267,7 +267,7 @@ The diff, as V3 captured it (against blob `2530d81`; V4's tracked file is `7130e
 `redact` block below is **a subset of what ships** there — V4 added a second pattern,
 `AKIA[0-9A-Z]{16}`, beside this one and put the array on a single line, so the tracked block is
 neither this text nor this formatting. Read the diff as the edit V3 actually made, not as a
-quotation of the current file; `policy/lib/data.json:12-15` is the current file):
+quotation of the current file; `policy/lib/data.json:17-20` is the current file):
 
 ```diff
 diff --git a/policy/lib/data.json b/policy/lib/data.json
@@ -421,6 +421,52 @@ carries a non-empty `policy_references` and the second carries none at all — t
 presence/absence is the entire signal that a policy fired versus stayed silent, per R1.2
 and `mapping.yaml`'s `warn: { decision: allow, require_policy_references: true }`.
 
+> **Re-run (V9, slice #28) — the verdict is unchanged, and one field of the capture is not.**
+> V9 moved `policy/manifest.drift.yaml`'s `policy_target` — and its annotation's `from` — off
+> `$.tool_call.args.command` and onto the shared normalised leaf, because a target naming one
+> tool's own argument denies every call by a tool that has no such argument. The drift gate reads
+> an annotation rather than the target, so the verdict *should* be unaffected; "should be" is not
+> this repository's standard, so it was re-run rather than reasoned about.
+>
+> Same script above with its port changed to `8792`, same `drift.warn_threshold: 0.5` edit to
+> `policy/lib/data.json`, same `ls -la`, and the `request_id` deliberately set to this section's
+> own so the two blocks are comparable. The JSON-RPC `id` is the client's own and was not matched;
+> it is `1` below and this section's `request_id` above. Captured against commit `16a3ab0`:
+>
+> ```json
+> {
+>   "jsonrpc": "2.0",
+>   "id": 1,
+>   "result": {
+>     "type": "final",
+>     "acs_version": "0.1.0",
+>     "request_id": "64144466-0a20-4564-8e26-92c76e13a597",
+>     "decision": "allow",
+>     "reasoning": "This step was allowed, but flagged: the agent's behaviour drifted from its baseline. Policy: drift_detected, from AGT's stock bundle (agt_stock). AGT reported: drift_score 0.9 reached threshold 0.5.",
+>     "reason_codes": [
+>       "drift_detected"
+>     ],
+>     "policy_references": [
+>       {
+>         "policy_id": "agt_stock",
+>         "rule_id": "drift_detected"
+>       }
+>     ]
+>   }
+> }
+> ```
+>
+> `decision`, `reason_codes` and `policy_references` are identical to the capture above, which is
+> the whole of what the moved target could have broken. `reasoning` is not, and the cause is not
+> V9: `mapping.yaml` no longer sources that field from `verdict.message` verbatim but composes it
+> through `field_synthesis.reasoning`'s template and per-rule summaries. AGT's own sentence is
+> still in there, at the end, word for word. That change landed after V8 and before V9 (commit
+> `1534a59`); every `reasoning` string captured in this file predates it.
+>
+> The `ls -la` envelope also now carries `raw_command`, which V9 put on the wire. It changes
+> nothing here — this manifest declares a `drift_score` annotator, not an `egress` one — and it is
+> mentioned so the re-run's envelope is not mistaken for this section's original.
+
 ## Both failure postures, live: kill the Guardian mid-session
 
 This drives `hosts/claude-code/acs-hook.ts` directly on stdin, the same mechanism

docs/demos/v5-runbook.md

@@ -38,8 +38,9 @@ always making the one choice this runbook needs it to make.
 
 **The manifest edit is the whole deployment-side change, and it is additive.** OpenCode reports
 its shell tool as `bash` (lowercase); Claude Code reports `Bash`. AGT resolves
-`policy/manifest.yaml`'s fixed `pre_tool_call.policy_target` (`$.tool_call.args.command`)
-**before any authored rule runs**, and a `tool_call.name` the manifest has not registered fails
+`policy/manifest.yaml`'s fixed `pre_tool_call.policy_target` — which was `$.tool_call.args.command`
+when this slice shipped — **before any authored rule runs**, and a `tool_call.name` the manifest has
+not registered fails
 that resolution closed — `runtime_error:tool_unknown` for `bash` itself, `runtime_error:path_missing`
 for every other tool OpenCode can call. So `policy/manifest.yaml` and `policy/manifest.drift.yaml`
 each gained one `tools:` entry, `bash`, beside the existing `Bash`/`run_shell` — nothing removed,
@@ -48,9 +49,26 @@ Rego authored, `policy/lib` byte-identical under `bun run verify:pin`, `data.agt
 unchanged, and zero lines changed in the Guardian, the bridge, or AGT — `bun run verify:zero-diff`
 proves that mechanically, captured near the end of this file.
 
-**Both gates are scoped `tools: [bash]`, which makes the two hosts symmetric rather than
-asymmetric.** Host #1 is `Bash`-only at both its hooks too, via the anchored `^Bash$` matcher in
-`hosts/claude-code/settings.json`. An earlier note in this project's own planning claimed the
+⚠️ *That target has moved since, and the sentence above is scoped to when this slice shipped rather
+than rewritten, because the mechanism it explains is unchanged: AGT still resolves one fixed
+`policy_target` per intervention point, before any rule runs, and an unregistered `tool_call.name`
+still fails closed. What changed in V9 (slice #28) is which leaf that one target names. It is now
+`$.tool_call.args.acs_policy_target` — a normalised leaf the Guardian writes — because a target
+naming one tool's own argument denies every call by a tool that has no such argument, which is
+exactly the `runtime_error:path_missing` this paragraph describes, reached from the other side.
+`mapping.yaml`'s `policy_target_argument` table says which of each tool's own arguments is copied
+into that leaf. See [`docs/demos/v9-runbook.md`](v9-runbook.md).*
+
+**Both gates carry a `tools:` scope, which makes the two hosts symmetric rather than asymmetric.**
+When this slice shipped that scope was `tools: [bash]` at both gates, matching host #1, which was
+`Bash`-only at both its hooks via the anchored `^Bash$` matcher in
+`hosts/claude-code/settings.json`. ⚠️ *Both halves of that sentence are stale as of V9 (slice #28),
+and the symmetry it describes survives the change: V9 widened each host's **request** gate to a
+second tool and left each host's **result** gate alone. Today OpenCode's request gate declares
+`tools: [bash, webfetch]` and its result gate `tools: [bash]`, while host #1's `PreToolUse` matcher
+is `^(Bash|WebFetch)$` and its `PostToolUse` matcher is still `^Bash$`. The asymmetry is now
+between the two gates rather than between the two hosts, and it is deliberate — see
+[`docs/demos/v9-runbook.md`](v9-runbook.md).* An earlier note in this project's own planning claimed the
 *request* gate needed no such list, because its hookmap paths (`$.tool`, `$.args`) resolve
 whatever tool ran — true, and irrelevant: the manifest's policy target is checked independently of
 the hookmap, and an unscoped request gate would not govern every tool, it would **deny every tool

docs/demos/v7-runbook.md

@@ -201,8 +201,8 @@ bun run verify:pin        # re-clones AGT and byte-diffs the pinned bundle — n
 ```
 
 **`bun run verify:zero-diff` is deliberately not in the list above — it does not pass from
-this HEAD, and that is not a V7 defect.** Captured real, run bare, exactly as a reader would
-run it:
+this HEAD, and that is not a V7 defect.** Captured real, run bare, from V7's own HEAD at the
+time this file was written:
 
 ```bash
 $ bun run verify:zero-diff
@@ -227,6 +227,20 @@ policy/lib/data.json
 error: script "verify:zero-diff" exited with code 1
 ```
 
+**⚠️ That block is a record of a run, not an instruction — it no longer reproduces verbatim, and
+the sentence above it used to imply it would.** Three things have moved, all of them after V7,
+and none of them changes what the block is here to show. The script's failure message was
+rewritten: it now opens *"the second host must cost zero changed lines in the Guardian, the AGT
+bridge, or AGT itself — but these frozen paths changed:"* rather than *"R3.4 violated…"*. The
+`base=` line cited below moved from line 15 to line 16. And later slices added entries under the
+frozen paths, so the list is longer: run from this branch's HEAD the same command names
+seventeen paths rather than thirteen, `hosts/claude-code/claude-code.hookmap.yaml` and
+`mapping.yaml` among them. What still reproduces is the part this section is about — exit code
+`1`, for the reason given next, and still not a defect of V7 or of any slice after it. Re-run it
+and expect different wording and a longer list, never a pass. The block is left exactly as
+captured rather than re-taken, because re-taking it would make it a record of a different run
+under a heading about V7's.
+
 Exit code `1`. The measured reason: `scripts/verify-zero-diff.sh:15` reads
 `base="${1:-slice/v4}"`, so a bare invocation always diffs HEAD against `slice/v4` — the base
 V5's own R3.4 proof was written against (R3.4: "Adding the second host requires zero new AGT