#811 hook-runtime-expansion gated milestone. Beyond the deny-only command hooks shipped in milestone-1.
Blocker (security design): these can alter model context or decisions, so per docs/architecture/hook-runtime-expansion-design.md §6.4/§6.5 they ship ONLY after (a) signed or managed-only hook policy and (b) model-visible audit (model/user can see a hook influenced context). Specifically:
- MCP-tool / prompt / agent hooks (§6.4) — context-altering.
updatedInput/modify action (§6.5) — currently action ∈ {allow, deny}; mutation withheld until hook signing (a mutating hook is a far larger trust delegation than a deny-only gate).
Needs the hook-signing / managed-policy mechanism first. Refs: docs/architecture/hook-runtime-expansion-design.md §6.4, §6.5. Parent: #811.
#811 hook-runtime-expansion gated milestone. Beyond the deny-only command hooks shipped in milestone-1.
Blocker (security design): these can alter model context or decisions, so per docs/architecture/hook-runtime-expansion-design.md §6.4/§6.5 they ship ONLY after (a) signed or managed-only hook policy and (b) model-visible audit (model/user can see a hook influenced context). Specifically:
updatedInput/modifyaction (§6.5) — currentlyaction ∈ {allow, deny}; mutation withheld until hook signing (a mutating hook is a far larger trust delegation than a deny-only gate).Needs the hook-signing / managed-policy mechanism first. Refs: docs/architecture/hook-runtime-expansion-design.md §6.4, §6.5. Parent: #811.