# fak guard and MCP status - 2026-06-25

This packet folds the current evidence for `fak` guard defaults, MCP, Claude Code,
and OpenAI/Codex. It is a status artifact, not a shipped-claims ledger; quote
`CLAIMS.md` for shipped scope.

Scope note: the Codex evidence below is the MCP/DOS hook path, not proof that the
current Codex process was launched under `fak guard -- codex`. On this host the
working Codex controls are the configured `fak` MCP server plus native DOS hooks;
the guard-wrapper and hosted OpenAI paths are separate pilots.

Machine-readable rollup: `experiments/agent-live/guard-mcp-status-audit-2026-06-25.json`
contains the same check verdicts and default-on blocker queue, and can be rendered
with `go run ./cmd/fak console guard --guard-json experiments\agent-live\guard-mcp-status-audit-2026-06-25.json`.
The queue evidence also carries bounded settlement-plan rows with marker-relative
paths, counts, origin labels, settlement actions, and count-shape transcript tags.
Native operator dry-runs are available with `go run ./cmd/fak stopfailure plan`
and evidence-backed stale consecutive counts can be cleared explicitly with
`go run ./cmd/fak stopfailure reset-stale --apply`. Marker-only stale files can
be moved out of the active scan with `go run ./cmd/fak stopfailure archive-marker-only --apply`.
Recently reviewed session markers can be cleared by id with
`go run ./cmd/fak stopfailure clear-reviewed --session <session> --apply`.

## Verdict

| Surface | Status | Evidence |
|---|---|---|
| `fak guard` default floor | PASS | `cmd/fak/guard_test.go::TestGuardDefaultPolicyDeniesDangerAllowsBenign` proves the embedded guard policy allows normal agent tools, denies dangerous Bash arguments, blocks self-modifying paths, and fails closed on unlisted tools. |
| `fak guard` default audit journal | PASS | `cmd/fak/guard_test.go::TestGuardAuditPlan`, `TestGuardDefaultAuditPath`, and `TestGuardEnableAuditEnablesVerifiableTrail` prove the decision journal defaults to an on-disk hash-chained trail unless explicitly opted out. |
| MCP stdio kernel tools | PASS | `experiments/agent-live/codex-dogfood-019efde3-6794-7401-93a1-e97e6bd72a9c.json` records `mcp_stdio_adjudication.status=PASS`, expected tools present, `git_push` denied as `POLICY_BLOCK`, and `git_status` allowed. |
| Historical Codex/DOS sessions | WARN audit, PASS actionability | `experiments/agent-live/codex-dos-recent-audit.json` audits 20 recent Codex sessions. Overall audit remains `WARN` for residual debt, while `actionability.status=PASS`: Codex stream stop blocks/failures are 0, the workspace StopFailure API-wall breaker rollup found 69 one-day failures across 54 nonzero markers and 138 zero-total markers, and 0 markers remain active after review. Current StopFailure shape is 0 recent-active markers, 0 stale-active markers, 0 active consecutive failures, and 54 healed nonzero markers at `consecutive=0`. |
| Historical git writes after mitigation | PASS | Expected-deny reports for `git_add`, `git_commit`, and `git_push` prove at `2026-06-25T22:38:12.037688Z`. The post-gate lens shows no `git_write` family after that proof, so earlier opaque git writes are classified as `HISTORICAL_GIT_WRITE_BEFORE_STRUCTURED_GATE`, not current actionability. |
| Historical Claude Code sessions | PASS + friction surfaced | `experiments/agent-live/claude-historical-guard-audit-2026-06-25.json` and `experiments/agent-live/CLAUDE-HISTORICAL-GUARD-AUDIT-2026-06-25.md` now scan 20 recent `C--work-fak` transcripts across 10 local `.claude*` account roots; 16 of those sessions had tool calls. They found 231 tool proposals and replayed 228 unique tool shapes through `fak preflight` under `examples/dogfood-claude-policy.json`, recording 177 `ALLOW` and 51 `DENY` verdicts, including 9 `POLICY_BLOCK`. The same artifact surfaces count-only friction tags: `HOOK_OR_API_WALL_FEEDBACK`, `HOST_PERMISSION_INTERRUPT`, `TOOL_ERROR_RECOVERY`, and `DENY_OR_BLOCKED_FEEDBACK` in all 20 summarized sessions, `SHELL_HEAVY_SESSION` in 11, and `LARGE_RESULT` in 7, while storing no prompts, tool arguments, tool results, full user paths, or raw transcript text. |
| Claude Code live session | PASS | `experiments/agent-live/claude-code-fak-guard-live-pilot-2026-06-25.json` records a live Claude Code turn where `rm -rf ./.fak-live-pilot-sentinel-do-not-exist` was denied (`POLICY_BLOCK`) and a later same-session `echo fak-claude-live-pilot-ok` was allowed. |
| OpenAI/Codex MCP live session | PASS | `experiments/agent-live/codex-mcp-fak-live-pilot-2026-06-25.json` records a Codex CLI MCP turn where `fak_adjudicate(git_push)` denied `POLICY_BLOCK` and the same turn continued with allowed `fak_adjudicate(git_status, read_only=true)`. |
| OpenAI Agents guardrail adapter | PASS | `examples/openai-agents-guardrail/demo.py` starts `fak serve`, blocks `git_push` before execution, allows `git_status`, admits the clean result, and quarantines a poisoned `web_fetch` result. Latest local run returned `summary: PASS`; captured expected output is in `examples/openai-agents-guardrail/EXAMPLE-OUTPUT.md`. |
| Hosted OpenAI / installed Agents SDK live prerequisites | PARTIAL | `experiments/agent-live/openai-live-prereq-2026-06-25.json` and `experiments/agent-live/OPENAI-LIVE-PREREQ-2026-06-25.md` record sanitized host state: `codex_login_ready=true`, `platform_api_ready=false`, `OPENAI_API_KEY_set=false`, `openai=2.41.0`, `openai-agents=None`, and the importable `agents` module resolves to `C:\work\job\agents\__init__.py`, not an installed SDK distribution. |
| Hosted OpenAI live pilot | PASS | `tools/openai_hosted_live_pilot.py --auth-mode codex-login` starts/uses `fak serve`, proves `git_push` is denied before execution and `git_status` can continue, then runs `codex exec --ephemeral` with the existing ChatGPT/OAuth login. `experiments/agent-live/openai-hosted-live-pilot-2026-06-25.json` and `experiments/agent-live/OPENAI-HOSTED-LIVE-PILOT-2026-06-25.md` record `auth_source=codex_login`, `codex_exec_exit_code=0`, `contains_expected_marker=true`, and only hosted-output hashes/event counts. |

## Current Residuals

- `HOST_SHELL_OPACITY` debt: Codex still emits many free-form shell commands whose file
  footprint is not visible to DOS lane admission. In the current audit this is visible
  as shell-shape debt and remains current default-on active debt: 2,290
  `shell_no_write_target_detected` calls. The new remediation split makes that queue
  actionable without storing command bodies: 826 read/search calls should become
  path-visible read tools, 844 test/git-read/build commands need explicit workspace
  scope, 107 script/redirect calls should be split into structured steps, 45 git-write
  calls belong behind structured git gates, 31 path-bearing writes should become
  apply/artifact operations, and 474 calls remain truly opaque shell needing tool or
  path metadata before DOS can price file-tree collision risk.
- `HISTORICAL_GIT_WRITE_BEFORE_STRUCTURED_GATE`: the one-day window still contains
  opaque `git_write` shell families before the fresh structured deny probes. The
  post-gate lens is empty, so this is historical debt, not current actionability.
- `STOPFAILURE_API_WALL_BREAKER`: `.dos/stop-failures` contains 69 one-day API-wall
  failures across 54 nonzero session markers and 138 zero-total markers. This is now
  resolved for current actionability: 37 evidence-backed stale reset candidates were
  reset to `consecutive=0`, 4 marker-only stale records were moved under
  `.dos/stop-failures/archive/`, and the 3 reviewed recent markers were cleared with
  `fak stopfailure clear-reviewed --apply`. The active shape is 0 recent-active
  markers, 0 stale-active markers, 0 active consecutive failures, and 54 healed
  nonzero markers at `consecutive=0`. The reviewed and settlement-plan rows carried
  only sanitized count-shape transcript evidence (`HOOK_OR_API_WALL_FEEDBACK`,
  `HOST_PERMISSION_INTERRUPT`, `DENY_OR_BLOCKED_FEEDBACK`, `TOOL_ERROR_RECOVERY`,
  `SHELL_HEAVY_SESSION`, `LARGE_TOOL_RESULT`) and no prompts, command bodies, tool
  output, or model text.
- `CLAUDE_FRICTION_SHAPES`: the all-account Claude replay is policy-clean enough to
  pass, but the transcripts show operational friction: 509 hook/API-wall marker lines,
  440 permission marker lines, 448 deny/blocked marker lines, 1463 error-recovery
  marker lines, and a maximum sanitized result length of 55,614 characters. The new
  remediation split makes this actionable: clear hook/API-wall feedback, reduce
  permission interruptions, align policy with real tool shapes, and fix tool-error
  recovery loops each appear in all 20 summarized sessions; 11 sessions need shell
  replacement with path-visible tools, and 7 need large-output capping or summaries.
  These are count-shape signals only; session ids are hashed and root names are
  account labels.
- `OPENAI_AGENTS_SDK_NOT_INSTALLED`: The hosted OpenAI proof now passes through the
  existing Codex ChatGPT/OAuth login (`auth_source=codex_login`), not a Platform API
  key. The remaining OpenAI residual is narrower: this host still has no installed
  `openai-agents` distribution, and the local `agents` import resolves to a non-SDK
  shadow package. The dependency-free guardrail adapter remains the local mapping
  proof for Agents-style behavior.

## Default-On Blocker Queue

Ranked from current active debt to historical/external debt:

1. `CODEX_HOST_SHELL_OPACITY` (`ACTIVE_DEBT`, Codex hooks): post-repair evidence still
   has 2,290 `shell_no_write_target_detected` calls. Remediation buckets:
   `replace_with_path_visible_read_tool=826`,
   `keep_repo_context_but_expose_workspace_scope=844`,
   `split_script_or_redirect_into_structured_steps=107`,
   `route_git_write_through_structured_gate=45`,
   `replace_path_bearing_write_with_apply_patch_or_artifact_tool=31`, and
   `opaque_shell_needs_tool_or_path_metadata=474`. Next action: work those buckets in
   that order so DOS sees path/operation metadata instead of one bulk opaque shell
   stream.
2. `CLAUDE_ALL_ACCOUNT_OPERATIONAL_FRICTION` (`ACTIVE_DEBT`, Claude Code): across 20
   recent transcripts, the all-account replay shows hook/API-wall, permission,
   deny/blocked, and tool-error recovery friction in all 20 summarized sessions,
   plus shell-heavy sessions in 11 and large results in 7. Remediation buckets:
   `clear_hook_or_api_wall_feedback=20`,
   `reduce_permission_interruptions_or_scope_policy=20`,
   `align_policy_with_real_tool_shapes=20`,
   `fix_tool_contract_or_error_recovery_loop=20`,
   `replace_shell_with_path_visible_tools=11`, and
   `cap_or_summarize_large_outputs=7`. Next action: work those buckets in that order
   so Claude defaults become useful without repeated hook/API-wall, permission, and
   tool-contract interruptions.
3. `HISTORICAL_OPAQUE_GIT_WRITE_BEFORE_GATE` (`HISTORICAL`, Codex hooks): opaque
   `git_write` appears in the one-day post-repair window, but not after the structured
   git gate proof at `2026-06-25T22:38:12.037688Z`. Next action: keep structured git
   gates in place; this only becomes current actionability if `git_write` reappears
   after the gate timestamp.
4. `OPENAI_AGENTS_SDK_NOT_INSTALLED` (`EXTERNAL_PREREQ`, hosted OpenAI): the hosted
   Codex-login pilot passes, but the installed Agents SDK path remains unavailable on
   this host. Next action: install the SDK only when that hosted Agents surface is the
   target.

Resolved this pass: `WORKSPACE_RECENT_STOPFAILURE_API_WALL` and
`WORKSPACE_STALE_STOPFAILURE_MARKERS` no longer appear in the default-on blocker
queue. Evidence-backed stale markers were reset to `consecutive=0`; marker-only
stale files were moved under `.dos/stop-failures/archive/`; reviewed recent markers
were cleared to `consecutive=0` by explicit session id.

## Re-run Commands

```powershell
go test ./cmd/fak -run "TestGuardDefaultPolicyDeniesDangerAllowsBenign|TestGuardAuditPlan|TestGuardDefaultAuditPath|TestGuardEnableAuditEnablesVerifiableTrail" -count=1
python examples\mcp\verify.py
python examples\openai-agents-guardrail\demo.py
python tools\openai_live_prereq_audit.py `
  --out experiments\agent-live\openai-live-prereq-2026-06-25.json `
  --markdown experiments\agent-live\OPENAI-LIVE-PREREQ-2026-06-25.md
python tools\openai_hosted_live_pilot.py `
  --auth-mode codex-login `
  --out experiments\agent-live\openai-hosted-live-pilot-2026-06-25.json `
  --markdown experiments\agent-live\OPENAI-HOSTED-LIVE-PILOT-2026-06-25.md
python tools\claude_historical_guard_audit.py `
  --all-accounts `
  --namespace C--work-fak `
  --policy examples\dogfood-claude-policy.json `
  --fak .\fak.exe `
  --since-days 1 `
  --max-sessions 20 `
  --max-calls 500 `
  --out experiments\agent-live\claude-historical-guard-audit-2026-06-25.json `
  --markdown experiments\agent-live\CLAUDE-HISTORICAL-GUARD-AUDIT-2026-06-25.md
python tools\codex_dos_recent_audit.py `
  --repo-root . `
  --codex-home $env:USERPROFILE\.codex `
  --limit 20 `
  --since-days 1 `
  --gate-report experiments\agent-live\codex-fak-gate-git-add.json `
  --gate-report experiments\agent-live\codex-fak-gate-git-commit.json `
  --gate-report experiments\agent-live\codex-fak-gate-git-push.json `
  --max-delegates 0 `
  --out experiments\agent-live\codex-dos-recent-audit.json `
  --out-debt experiments\agent-live\codex-dos-host-opacity-debt.md
python tools\guard_mcp_status_audit.py `
  --root . `
  --out experiments\agent-live\guard-mcp-status-audit-2026-06-25.json
go run ./cmd/fak console guard `
  --guard-json experiments\agent-live\guard-mcp-status-audit-2026-06-25.json `
  --width 190
go run ./cmd/fak stopfailure plan --root .
go run ./cmd/fak stopfailure reset-stale --root .
go run ./cmd/fak stopfailure archive-marker-only --root .
go run ./cmd/fak stopfailure clear-reviewed --root . --session <session>
```

The live pilot JSON files carry raw-capture hashes or sanitized hosted-response
metadata, but the vendor-session artifacts require the same credentials and local
client setup to re-run. The hosted OpenAI pilot uses the existing Codex
ChatGPT/OAuth login in `~/.codex/auth.json` for `--auth-mode codex-login`; the
direct Platform API-key route remains available with `--auth-mode api-key`.
