TraceRookWhat must be verified
A protected decision requires a supported local session; configured, enabled, trusted hooks; receipt of the event by TraceRook; a tool path that honors a pre-execution denial; and a compatible adapter that passed schema and smoke checks.
A config file on disk is not proof the host runs it. An installed executable is not proof it is trusted. A heartbeat is useful, but a real pre-tool blocking test is needed for each claimed tool class.
Status language and its meaning
| Label | Meaning |
|---|---|
| Protected (verified hooks) | The relevant local callback and blocking path have actual verification evidence |
| Monitoring only | Events observed; blocking for the tool class has not been validated |
| Degraded | Service, provider, hook, or configuration errors reduce verified capability |
| Not integrated | No validated integration connects the session |
| Demo data | Entirely synthetic sample content |
Keep provider health separate from hook health. Anthropic unavailable can mean Local rules only; it does not automatically mean every local callback failed. Idle sessions should show Verification not recent rather than being declared broken solely for inactivity.
When the callback runs but a dependency fails
The MVP1 bridge must contain the same lightweight catastrophic fallback rules as the service. If the service or provider is unreachable after the bridge actually starts, matched critical signatures can still return a valid denial before the host’s timeout.
The default outage policy allows low or unknown activity with degraded status and denies clearly sensitive mutation or exfiltration signatures. Strict offline protection can optionally deny all mutable or executable tool classes during an outage. This guarantee exists only inside a callback that runs and finishes in time.
When the hook never completes
If the host skips the hook, cannot launch it, or times it out, TraceRook cannot force a block. Both hosts can continue after hook errors or timeouts. Config checks, missing helpers, detected failures, and stale heartbeats must surface coverage limitations when detectable.
A preference labeled fail closed cannot make a missing callback enforce policy. Same-user processes can alter configurations or execute outside the integration. TraceRook is not tamper-proof against the user account.
Paths outside the local guarantee
- Hosted or remote actions without compatible local callbacks.
- Codex hosted WebSearch and specialized paths that bypass local hooks.
- Codex
write_stdincontinuation, which does not necessarily create a new pre-tool gate. - Nested commands, processes, and network activity inside an already allowed shell call.
- Manual terminal commands and applications outside an integrated agent.
Post-tool observations do not undo execution. TraceRook cannot promise complete exfiltration prevention, system-wide process control, or universal sandboxing.
Current preview coverage
The development app has no live integration. Its real activity is Not integrated and sample findings are Demo data. Signed IPC, real callbacks, fallback enforcement, and both hosts’ pre-execution proofs remain pending.
Coverage claims will be version-specific. An agent newer than the verified range must show Compatibility not yet verified until validation is complete.