agent-control-plane-core 0.11.1 → 0.11.2

package/README.md

@@ -127,7 +127,10 @@ Read `NATIVE_ASK_TIER` instead of keeping a list of which agents to escalate an
 where the flag is `false`, and leaves it alone where the host does the asking.
 `renderEscalated(adapter, verdict, event, { soleGate })` applies that rule: it
 re-renders as a `deny` any non-allow verdict that would render unenforced on a
-vetoable call, except an `ask` on a host whose flag is `true`.
+vetoable call, except an `ask` on a host whose flag is `true`. A non-allow
+verdict on a payload that names no event at all blocks through the host's exit
+code and stderr, since `render` has no channel for it, unless the event parsed
+observe-only (a Codex below its enforcing version), which cannot veto.
 It describes the HOST, not the verdict — `ask` renders as `enforced: false`
 everywhere — and it names the pre-tool gate, since a tool that already ran has
 nothing left to suspend. Conformance probes your real `render` against it, so a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-control-plane-core",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "Vendor-neutral control-plane contract for coding agents: a normalized ToolCallEvent/Verdict schema with per-agent adapters (Claude Code, Codex, Amp, Gemini CLI) and a conformance suite.",
   "type": "module",
   "repository": {

package/src/control-plane.mjs

@@ -967,6 +967,13 @@ export function gatedResponse(
  * ({@link Adapter} `NATIVE_ASK_TIER`). Nothing changes for an allow, for a call
  * this guardrail cannot veto (a deny there blocks nothing either), or for a
  * render the host already enforces. The deny keeps the verdict's other fields.
+ *
+ * A payload that names no event at all (`meta.native_event` empty) is the one
+ * exception: `render` has no channel for it, so a non-allow verdict there takes
+ * the host's {@link BLOCK_TRANSPORT} block, which stops whatever call the hook
+ * was run for. An observe-only parse renders that block unenforced (exit 0),
+ * since its host cannot veto. An event the payload names but no adapter models keeps the rule
+ * above: on Claude Code's Stop, a block would keep the agent running.
  * @param {Adapter} adapter
  * @param {Verdict} verdict
  * @param {ToolCallEvent} event
@@ -974,7 +981,18 @@ export function gatedResponse(
  * @returns {NativeResponse}
  */
 export function renderEscalated(adapter, verdict, event, options = {}) {
-  const { decision } = normalizeVerdict(verdict);
+  const { decision, reason } = normalizeVerdict(verdict);
+  // This block is what stops a guardrail's deny on an unreadable payload from
+  // rendering as an empty exit 0, which every host runs.
+  if (event.meta.native_event === "" && decision !== Decision.ALLOW)
+    return gatedResponse(adapter.AGENT, {
+      transport: event.meta.integration_mode,
+      // An observe-only parse (a Codex below its enforcing version) has no
+      // veto, so claiming the block was enforced would report a false block.
+      enforced: event.meta.integration_mode !== IntegrationMode.OBSERVE_ONLY,
+      unblocked_exit_code: 0,
+      reason,
+    });
   const response = adapter.render(verdict, event, options);
   if (
     response.enforced ||

package/types/control-plane.d.mts

@@ -296,6 +296,13 @@ export function gatedResponse(agent: string, { transport, enforced, unblocked_ex
  * ({@link Adapter} `NATIVE_ASK_TIER`). Nothing changes for an allow, for a call
  * this guardrail cannot veto (a deny there blocks nothing either), or for a
  * render the host already enforces. The deny keeps the verdict's other fields.
+ *
+ * A payload that names no event at all (`meta.native_event` empty) is the one
+ * exception: `render` has no channel for it, so a non-allow verdict there takes
+ * the host's {@link BLOCK_TRANSPORT} block, which stops whatever call the hook
+ * was run for. An observe-only parse renders that block unenforced (exit 0),
+ * since its host cannot veto. An event the payload names but no adapter models keeps the rule
+ * above: on Claude Code's Stop, a block would keep the agent running.
  * @param {Adapter} adapter
  * @param {Verdict} verdict
  * @param {ToolCallEvent} event