Egress capture: PostToolUse hook for what actually left the machine

[githubscum]

Follows #3 (gated runs). Branched from feat/gated-runs since it reuses that branch's policy matchers; this diff will include #3's changes until #3 merges, which is expected for a stacked branch.

What this closes, and what it doesn't

KNOWN-LIMITS item 2 says outbound capture "is not fully derivable from Claude Code JSONL session transcripts alone" and names MCP-boundary instrumentation as the fix. This is a real step in that direction, not the whole thing, and the docs say so precisely rather than overselling it.

A PostToolUse hook fires after a tool call completes, with both the tool_input and the tool_response the host actually observed. That's captured live, at the moment of execution, by the host — not reconstructed later by parsing a transcript file. Genuine improvement in attestation strength. But it is not wire-level capture: no network proxy, no TLS interception, no independent check that a tool's own response was honest. A tool that lies about its own outcome, or an egress path the matchers don't recognize, isn't caught. True wire-level capture is a larger architectural change, not this PR.

What it does

bin/hook-post-tool-use.js reuses isPushForce, isPushProtected, isPublish, isEgressOther from src/policy/ unchanged — no duplicated matcher logic. On a match, appends an egress-event receipt carrying only digests: paramsDigest, responseDigest, and a best-effort responseOk signal extracted from common success/error shapes. Raw tool_input and raw tool_response are never written to the chain, matching the digest-only convention every other receipt in this repo follows.

No exit-2 path. PostToolUse fires after the call already completed, so there is nothing left to block; the hook always exits 0.

Verification

• 177 tests passing (172 baseline + 5).
• The work order's own demo proved no raw content in the receipt for a git push --force payload.
• I went further in review: independently re-probed with a fabricated exfil URL and a distinctive secret string planted in tool_input/tool_response, then grepped the persisted chain entry directly. Zero hits on both. That's the check that actually matters for a receipt layer's core promise.

Views and docs

• renderMorningAfter gains an EGRESS EVENTS block (total + per-rule breakdown), same style as the existing POLICY WARNINGS block from gated runs.
• KNOWN-LIMITS item 2 rewritten to describe the new reality precisely: what's captured now, and what still needs a real network-boundary proxy that isn't in v1.

[githubscum]

Follows #3 (gated runs). Branched from feat/gated-runs since it reuses that branch's policy matchers; this diff will include #3's changes until #3 merges, which is expected for a stacked branch.

What this closes, and what it doesn't

KNOWN-LIMITS item 2 says outbound capture "is not fully derivable from Claude Code JSONL session transcripts alone" and names MCP-boundary instrumentation as the fix. This is a real step in that direction, not the whole thing, and the docs say so precisely rather than overselling it.

A PostToolUse hook fires after a tool call completes, with both the tool_input and the tool_response the host actually observed. That's captured live, at the moment of execution, by the host — not reconstructed later by parsing a transcript file. Genuine improvement in attestation strength. But it is not wire-level capture: no network proxy, no TLS interception, no independent check that a tool's own response was honest. A tool that lies about its own outcome, or an egress path the matchers don't recognize, isn't caught. True wire-level capture is a larger architectural change, not this PR.

What it does

bin/hook-post-tool-use.js reuses isPushForce, isPushProtected, isPublish, isEgressOther from src/policy/ unchanged — no duplicated matcher logic. On a match, appends an egress-event receipt carrying only digests: paramsDigest, responseDigest, and a best-effort responseOk signal extracted from common success/error shapes. Raw tool_input and raw tool_response are never written to the chain, matching the digest-only convention every other receipt in this repo follows.

No exit-2 path. PostToolUse fires after the call already completed, so there is nothing left to block; the hook always exits 0.

Verification

• 177 tests passing (172 baseline + 5).
• The work order's own demo proved no raw content in the receipt for a git push --force payload.
• I went further in review: independently re-probed with a fabricated exfil URL and a distinctive secret string planted in tool_input/tool_response, then grepped the persisted chain entry directly. Zero hits on both. That's the check that actually matters for a receipt layer's core promise.

Views and docs

• renderMorningAfter gains an EGRESS EVENTS block (total + per-rule breakdown), same style as the existing POLICY WARNINGS block from gated runs.
• KNOWN-LIMITS item 2 rewritten to describe the new reality precisely: what's captured now, and what still needs a real network-boundary proxy that isn't in v1.

[githubscum]

Follows #3 (gated runs). Branched from feat/gated-runs since it reuses that branch's policy matchers; this diff will include #3's changes until #3 merges, which is expected for a stacked branch.

What this closes, and what it doesn't

KNOWN-LIMITS item 2 says outbound capture "is not fully derivable from Claude Code JSONL session transcripts alone" and names MCP-boundary instrumentation as the fix. This is a real step in that direction, not the whole thing, and the docs say so precisely rather than overselling it.

A PostToolUse hook fires after a tool call completes, with both the tool_input and the tool_response the host actually observed. That's captured live, at the moment of execution, by the host — not reconstructed later by parsing a transcript file. Genuine improvement in attestation strength. But it is not wire-level capture: no network proxy, no TLS interception, no independent check that a tool's own response was honest. A tool that lies about its own outcome, or an egress path the matchers don't recognize, isn't caught. True wire-level capture is a larger architectural change, not this PR.

What it does

bin/hook-post-tool-use.js reuses isPushForce, isPushProtected, isPublish, isEgressOther from src/policy/ unchanged — no duplicated matcher logic. On a match, appends an egress-event receipt carrying only digests: paramsDigest, responseDigest, and a best-effort responseOk signal extracted from common success/error shapes. Raw tool_input and raw tool_response are never written to the chain, matching the digest-only convention every other receipt in this repo follows.

No exit-2 path. PostToolUse fires after the call already completed, so there is nothing left to block; the hook always exits 0.

Verification

• 177 tests passing (172 baseline + 5).
• The work order's own demo proved no raw content in the receipt for a git push --force payload.
• I went further in review: independently re-probed with a fabricated exfil URL and a distinctive secret string planted in tool_input/tool_response, then grepped the persisted chain entry directly. Zero hits on both. That's the check that actually matters for a receipt layer's core promise.

Views and docs

• renderMorningAfter gains an EGRESS EVENTS block (total + per-rule breakdown), same style as the existing POLICY WARNINGS block from gated runs.
• KNOWN-LIMITS item 2 rewritten to describe the new reality precisely: what's captured now, and what still needs a real network-boundary proxy that isn't in v1.

[githubscum]

Follows #3 (gated runs). Branched from feat/gated-runs since it reuses that branch's policy matchers; this diff will include #3's changes until #3 merges, which is expected for a stacked branch.

What this closes, and what it doesn't

KNOWN-LIMITS item 2 says outbound capture "is not fully derivable from Claude Code JSONL session transcripts alone" and names MCP-boundary instrumentation as the fix. This is a real step in that direction, not the whole thing, and the docs say so precisely rather than overselling it.

A PostToolUse hook fires after a tool call completes, with both the tool_input and the tool_response the host actually observed. That's captured live, at the moment of execution, by the host — not reconstructed later by parsing a transcript file. Genuine improvement in attestation strength. But it is not wire-level capture: no network proxy, no TLS interception, no independent check that a tool's own response was honest. A tool that lies about its own outcome, or an egress path the matchers don't recognize, isn't caught. True wire-level capture is a larger architectural change, not this PR.

What it does

bin/hook-post-tool-use.js reuses isPushForce, isPushProtected, isPublish, isEgressOther from src/policy/ unchanged — no duplicated matcher logic. On a match, appends an egress-event receipt carrying only digests: paramsDigest, responseDigest, and a best-effort responseOk signal extracted from common success/error shapes. Raw tool_input and raw tool_response are never written to the chain, matching the digest-only convention every other receipt in this repo follows.

No exit-2 path. PostToolUse fires after the call already completed, so there is nothing left to block; the hook always exits 0.

Verification

• 177 tests passing (172 baseline + 5).
• The work order's own demo proved no raw content in the receipt for a git push --force payload.
• I went further in review: independently re-probed with a fabricated exfil URL and a distinctive secret string planted in tool_input/tool_response, then grepped the persisted chain entry directly. Zero hits on both. That's the check that actually matters for a receipt layer's core promise.

Views and docs

• renderMorningAfter gains an EGRESS EVENTS block (total + per-rule breakdown), same style as the existing POLICY WARNINGS block from gated runs.
• KNOWN-LIMITS item 2 rewritten to describe the new reality precisely: what's captured now, and what still needs a real network-boundary proxy that isn't in v1.

[githubscum]

Follows #3 (gated runs). Branched from feat/gated-runs since it reuses that branch's policy matchers; this diff will include #3's changes until #3 merges, which is expected for a stacked branch.

What this closes, and what it doesn't

KNOWN-LIMITS item 2 says outbound capture "is not fully derivable from Claude Code JSONL session transcripts alone" and names MCP-boundary instrumentation as the fix. This is a real step in that direction, not the whole thing, and the docs say so precisely rather than overselling it.

A PostToolUse hook fires after a tool call completes, with both the tool_input and the tool_response the host actually observed. That's captured live, at the moment of execution, by the host — not reconstructed later by parsing a transcript file. Genuine improvement in attestation strength. But it is not wire-level capture: no network proxy, no TLS interception, no independent check that a tool's own response was honest. A tool that lies about its own outcome, or an egress path the matchers don't recognize, isn't caught. True wire-level capture is a larger architectural change, not this PR.

What it does

bin/hook-post-tool-use.js reuses isPushForce, isPushProtected, isPublish, isEgressOther from src/policy/ unchanged — no duplicated matcher logic. On a match, appends an egress-event receipt carrying only digests: paramsDigest, responseDigest, and a best-effort responseOk signal extracted from common success/error shapes. Raw tool_input and raw tool_response are never written to the chain, matching the digest-only convention every other receipt in this repo follows.

No exit-2 path. PostToolUse fires after the call already completed, so there is nothing left to block; the hook always exits 0.

Verification

• 177 tests passing (172 baseline + 5).
• The work order's own demo proved no raw content in the receipt for a git push --force payload.
• I went further in review: independently re-probed with a fabricated exfil URL and a distinctive secret string planted in tool_input/tool_response, then grepped the persisted chain entry directly. Zero hits on both. That's the check that actually matters for a receipt layer's core promise.

Views and docs

• renderMorningAfter gains an EGRESS EVENTS block (total + per-rule breakdown), same style as the existing POLICY WARNINGS block from gated runs.
• KNOWN-LIMITS item 2 rewritten to describe the new reality precisely: what's captured now, and what still needs a real network-boundary proxy that isn't in v1.

[githubscum]

Follows #3 (gated runs). Branched from feat/gated-runs since it reuses that branch's policy matchers; this diff will include #3's changes until #3 merges, which is expected for a stacked branch.

What this closes, and what it doesn't

KNOWN-LIMITS item 2 says outbound capture "is not fully derivable from Claude Code JSONL session transcripts alone" and names MCP-boundary instrumentation as the fix. This is a real step in that direction, not the whole thing, and the docs say so precisely rather than overselling it.

A PostToolUse hook fires after a tool call completes, with both the tool_input and the tool_response the host actually observed. That's captured live, at the moment of execution, by the host — not reconstructed later by parsing a transcript file. Genuine improvement in attestation strength. But it is not wire-level capture: no network proxy, no TLS interception, no independent check that a tool's own response was honest. A tool that lies about its own outcome, or an egress path the matchers don't recognize, isn't caught. True wire-level capture is a larger architectural change, not this PR.

What it does

bin/hook-post-tool-use.js reuses isPushForce, isPushProtected, isPublish, isEgressOther from src/policy/ unchanged — no duplicated matcher logic. On a match, appends an egress-event receipt carrying only digests: paramsDigest, responseDigest, and a best-effort responseOk signal extracted from common success/error shapes. Raw tool_input and raw tool_response are never written to the chain, matching the digest-only convention every other receipt in this repo follows.

No exit-2 path. PostToolUse fires after the call already completed, so there is nothing left to block; the hook always exits 0.

Verification

• 177 tests passing (172 baseline + 5).
• The work order's own demo proved no raw content in the receipt for a git push --force payload.
• I went further in review: independently re-probed with a fabricated exfil URL and a distinctive secret string planted in tool_input/tool_response, then grepped the persisted chain entry directly. Zero hits on both. That's the check that actually matters for a receipt layer's core promise.

Views and docs

• renderMorningAfter gains an EGRESS EVENTS block (total + per-rule breakdown), same style as the existing POLICY WARNINGS block from gated runs.
• KNOWN-LIMITS item 2 rewritten to describe the new reality precisely: what's captured now, and what still needs a real network-boundary proxy that isn't in v1.

[githubscum]

Follows #3 (gated runs). Branched from feat/gated-runs since it reuses that branch's policy matchers; this diff will include #3's changes until #3 merges, which is expected for a stacked branch.

What this closes, and what it doesn't

KNOWN-LIMITS item 2 says outbound capture "is not fully derivable from Claude Code JSONL session transcripts alone" and names MCP-boundary instrumentation as the fix. This is a real step in that direction, not the whole thing, and the docs say so precisely rather than overselling it.

A PostToolUse hook fires after a tool call completes, with both the tool_input and the tool_response the host actually observed. That's captured live, at the moment of execution, by the host — not reconstructed later by parsing a transcript file. Genuine improvement in attestation strength. But it is not wire-level capture: no network proxy, no TLS interception, no independent check that a tool's own response was honest. A tool that lies about its own outcome, or an egress path the matchers don't recognize, isn't caught. True wire-level capture is a larger architectural change, not this PR.

What it does

bin/hook-post-tool-use.js reuses isPushForce, isPushProtected, isPublish, isEgressOther from src/policy/ unchanged — no duplicated matcher logic. On a match, appends an egress-event receipt carrying only digests: paramsDigest, responseDigest, and a best-effort responseOk signal extracted from common success/error shapes. Raw tool_input and raw tool_response are never written to the chain, matching the digest-only convention every other receipt in this repo follows.

No exit-2 path. PostToolUse fires after the call already completed, so there is nothing left to block; the hook always exits 0.

Verification

• 177 tests passing (172 baseline + 5).
• The work order's own demo proved no raw content in the receipt for a git push --force payload.
• I went further in review: independently re-probed with a fabricated exfil URL and a distinctive secret string planted in tool_input/tool_response, then grepped the persisted chain entry directly. Zero hits on both. That's the check that actually matters for a receipt layer's core promise.

Views and docs

• renderMorningAfter gains an EGRESS EVENTS block (total + per-rule breakdown), same style as the existing POLICY WARNINGS block from gated runs.
• KNOWN-LIMITS item 2 rewritten to describe the new reality precisely: what's captured now, and what still needs a real network-boundary proxy that isn't in v1.

[githubscum]

Follows #3 (gated runs). Branched from feat/gated-runs since it reuses that branch's policy matchers; this diff will include #3's changes until #3 merges, which is expected for a stacked branch.

What this closes, and what it doesn't

KNOWN-LIMITS item 2 says outbound capture "is not fully derivable from Claude Code JSONL session transcripts alone" and names MCP-boundary instrumentation as the fix. This is a real step in that direction, not the whole thing, and the docs say so precisely rather than overselling it.

A PostToolUse hook fires after a tool call completes, with both the tool_input and the tool_response the host actually observed. That's captured live, at the moment of execution, by the host — not reconstructed later by parsing a transcript file. Genuine improvement in attestation strength. But it is not wire-level capture: no network proxy, no TLS interception, no independent check that a tool's own response was honest. A tool that lies about its own outcome, or an egress path the matchers don't recognize, isn't caught. True wire-level capture is a larger architectural change, not this PR.

What it does

bin/hook-post-tool-use.js reuses isPushForce, isPushProtected, isPublish, isEgressOther from src/policy/ unchanged — no duplicated matcher logic. On a match, appends an egress-event receipt carrying only digests: paramsDigest, responseDigest, and a best-effort responseOk signal extracted from common success/error shapes. Raw tool_input and raw tool_response are never written to the chain, matching the digest-only convention every other receipt in this repo follows.

No exit-2 path. PostToolUse fires after the call already completed, so there is nothing left to block; the hook always exits 0.

Verification

• 177 tests passing (172 baseline + 5).
• The work order's own demo proved no raw content in the receipt for a git push --force payload.
• I went further in review: independently re-probed with a fabricated exfil URL and a distinctive secret string planted in tool_input/tool_response, then grepped the persisted chain entry directly. Zero hits on both. That's the check that actually matters for a receipt layer's core promise.

Views and docs

• renderMorningAfter gains an EGRESS EVENTS block (total + per-rule breakdown), same style as the existing POLICY WARNINGS block from gated runs.
• KNOWN-LIMITS item 2 rewritten to describe the new reality precisely: what's captured now, and what still needs a real network-boundary proxy that isn't in v1.