failproofai 1.0.6-beta.1 → 1.0.7-beta.0

package/src/hooks/daemon-service.ts

@@ -1070,6 +1070,36 @@ export async function probeDaemonEndToEnd(): Promise<boolean> {
   return (await probeDaemon()).ok;
 }
 
+/**
+ * Proves that the daemon supports the structured request native plugins use.
+ *
+ * This deliberately follows the ordinary end-to-end hook probe. Besides
+ * retaining its startup-race retry, that makes the failure meaningful: an old
+ * daemon can be fully healthy for shell hooks while still lacking the
+ * `policyEvaluation` variant added for Hermes. Protocol v1 predates that
+ * variant, so version equality alone cannot establish the capability.
+ */
+export async function probeDaemonPolicyEvaluation(): Promise<boolean> {
+  if (!(await probeDaemonEndToEnd())) return false;
+  try {
+    const { attemptDaemonPolicyEvaluation } = await import("./daemon-client");
+    const attempt = await attemptDaemonPolicyEvaluation(
+      {
+        integration: "hermes",
+        event: "on_session_start",
+        payload: {
+          hook_event_name: "on_session_start",
+          source: "failproofai-native-policy-health-probe",
+        },
+      },
+      { responseTimeoutMs: DAEMON_PROBE_TIMEOUT_MS },
+    );
+    return attempt.ok;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Waits for the service to report running and to HOLD it — a `Type=simple` unit
  * is active the moment it forks, so one optimistic reading passes a daemon that

package/src/hooks/effective-reviewers.ts

@@ -0,0 +1,79 @@
+/**
+ * The semantic checks a `reviewedBy` may name ON THIS MACHINE.
+ *
+ * ## Why this is not simply `SEMANTIC_REVIEWER_NAMES`
+ *
+ * A pack that declares its own `semantic` entries replaces the compiled-in
+ * `SEMANTIC_POLICIES` wholesale (`semantic/pack-policies.ts`). So on that
+ * machine the sixteen builtin names are checks that will never be asked, and the
+ * pack's own names are the only ones that will — while
+ * `resolvePolicyAuthority`, judging against the builtin set, would read the
+ * pack's `reviewedBy: ["its-own-check"]` as naming a check "this build does not
+ * have" and downgrade the policy to `hard` with nothing but a warning in the
+ * hook log. That is a rewritten policy set arriving with its reviewability
+ * quietly removed: the deny half of the two-tier evaluator working exactly as
+ * documented while the clearing half cannot fire once — the failure
+ * `policy-reviewability.ts` was written to make audible, reintroduced one layer
+ * down.
+ *
+ * The names come from the MANIFEST, which is already where `authority` and
+ * `reviewedBy` themselves are read from, so this adds no new trust and imports
+ * no semantic module.
+ *
+ * ## Why it is a module of its own, and cached the way it is
+ *
+ * `registerPolicy` asks this for every policy that declares an authority — forty
+ * times per hook event — and the honest answer costs a digest verification per
+ * installed pack. So it is cached, and the cache is dropped by `clearPolicies()`:
+ * one read per registration pass, and the answer's lifetime is exactly the
+ * registry's. That is the right coupling rather than a convenient one — this set
+ * describes the policies sitting in the registry, and the handler rebuilds both
+ * together, so they cannot come to describe different machines.
+ *
+ * It lives beside `policy-registry.ts` rather than inside `pack-manifest.ts`
+ * because the registry may not depend on the whole manifest reader: several
+ * tests isolate themselves from the running machine's real packs by mocking
+ * `pack-manifest` down to `readInstalledPacks` and `hasInstalledPacks`, and a
+ * registration path reaching for a third export of that module breaks them all
+ * — loudly here, but it is the shape of a change that would later break them
+ * silently.
+ */
+import { readInstalledPacks } from "./pack-manifest";
+import { SEMANTIC_REVIEWER_NAMES } from "./policy-authority";
+
+let cached: ReadonlySet<string> | null = null;
+
+/**
+ * The installed packs' semantic policy names when any pack declares some, and
+ * this build's compiled-in set otherwise.
+ *
+ * Never throws: an unreadable manifest declares nothing, and the builtin set
+ * stands. That is the same fail-open posture every other reader of the pack
+ * manifest takes, and here it also fails in the safe direction — a pack's
+ * `reviewedBy` will not match a builtin name, so its policies stay `hard`
+ * rather than being cleared by a question nobody could read.
+ */
+export function effectiveReviewerNames(): ReadonlySet<string> {
+  if (cached) return cached;
+  let names: ReadonlySet<string> = SEMANTIC_REVIEWER_NAMES;
+  try {
+    const declared = readInstalledPacks().packs.flatMap((p) => (p.semantic ?? []).map((s) => s.name));
+    // Only when a pack actually declared some. A machine whose packs carry only
+    // the regex floor still runs the compiled-in semantic set, so its builtin
+    // reviewer names are the live ones.
+    if (declared.length > 0) names = new Set(declared);
+  } catch {
+    // See above: silence here is the builtin set, not an empty one.
+  }
+  cached = names;
+  return names;
+}
+
+/**
+ * Drop the cached answer. Called by `clearPolicies()`, which every evaluation
+ * runs before it registers anything — so a pack installed under a long-lived
+ * warm worker is picked up on the next event rather than at the next restart.
+ */
+export function forgetEffectiveReviewerNames(): void {
+  cached = null;
+}

package/src/hooks/first-run-gate.ts

@@ -35,6 +35,11 @@ export const FIRST_RUN_EXEMPT_SUBCOMMANDS: readonly string[] = [
   // Same reason: a backfill is an explicit instruction about an already-set-up
   // machine, and interrupting it to offer setup answers a question nobody asked.
   "backfill",
+  // `jev setup` is configuration in its own right, and `jev status` / `test` /
+  // `remove` inspect or undo it. It is also the command most likely to be
+  // scripted with a key on stdin — a wizard in front of it would read that key
+  // as the answer to its first question.
+  "jev",
 ];
 
 export function shouldOfferFirstRun(args: readonly string[]): boolean {

package/src/hooks/fp-home.ts

@@ -51,6 +51,7 @@
  *   VERSION                  layout / cli / daemon versions
  *   config.json       0644   non-secret: mode, daemon, collector prefs
  *   credentials.json  0600   every token
+ *   jev.json          0600   the customer's own Jev endpoint + key (BYOK opt-in)
  *   policies-config.json     the builtin enable/disable set + params
  *   bin/                     downloaded daemon binaries, one per version
  *   policies/                every policy: the user's *.mjs sit directly here
@@ -148,6 +149,14 @@ export const configFile = (home?: string) => atHome(home, "config.json");
  */
 export const credentialsFile = (home?: string) => atHome(home, "credentials.json");
 
+/**
+ * The customer's own Jev endpoint and key (BYOK), owner-only. Its presence is
+ * the whole opt-in to the two-tier evaluator: absent, hooks run the regex
+ * engine exactly as before. GLOBAL only — a repository can never set it. See
+ * `src/hooks/semantic/jev-config.ts`.
+ */
+export const jevConfigFile = (home?: string) => atHome(home, "jev.json");
+
 // ── Daemon binaries ──────────────────────────────────────────────────────────
 
 export const binDir = (home?: string) => atHome(home, "bin");
@@ -389,6 +398,12 @@ export const failedDir = (home?: string) => resolve(stateDir(home), "failed");
 export const collectorHealthFile = (home?: string) => resolve(stateDir(home), "collector-health.json");
 /** Per-session enforcement pauses, keyed by a hash of the session id. */
 export const sessionPauseDir = () => resolve(stateDir(), "sessions");
+/**
+ * The semantic (Jev) evaluator's local state: `sessions/<id>.json` holds the
+ * human prompts recorded at `UserPromptSubmit`, and `verdicts.jsonl` one row
+ * per semantic evaluation. Written only when a Jev config (BYOK) is present.
+ */
+export const semanticDir = () => resolve(stateDir(), "semantic");
 /**
  * When the scheduled audit last ran, and when the next one is due.
  *
@@ -554,6 +569,9 @@ export const HOME_CLASSES: readonly { path: (home?: string) => string; class: Da
   // policy silently — it keeps enforcing whatever it last had, reports healthy,
   // and never reconciles again. Nothing re-derives a token.
   { path: credentialsFile, class: "user-typed" },
+  // The Jev BYOK config. A person typed the key; nothing regenerates it, and
+  // losing it silently turns the two-tier evaluator off.
+  { path: jevConfigFile, class: "user-typed" },
   // Holds `daemon.configured` (the flag that makes the machine fail closed),
   // the collector preferences, `[audit] auto`, the telemetry opt-out, and
   // `collector.sources.*.extra_paths` — the entire output of `harness add-path`.
@@ -642,6 +660,11 @@ export const HOME_CLASSES: readonly { path: (home?: string) => string; class: Da
   { path: codexSessionPathsFile, class: "derived" },
   { path: shimsDir, class: "derived" },
   { path: sessionPauseDir, class: "derived" },
+  // Recorded prompts (a six-hour window that only ever lets Jev clear a
+  // reviewable policy) and a local diagnostic log of semantic verdicts that is
+  // never shipped. Losing either costs a clear and some history, never
+  // enforcement.
+  { path: semanticDir, class: "derived" },
   { path: logsDir, class: "derived" },
   { path: lastVersionFile, class: "derived" },
   { path: launcherMarker, class: "derived" },

package/src/hooks/handler.ts

@@ -24,18 +24,26 @@ import {
   OPENCLAW_EVENT_MAP,
   ANTIGRAVITY_EVENT_MAP,
 } from "./types";
+import { existsSync } from "node:fs";
 import { canonicalizeToolName, canonicalizeToolInput } from "./tool-name-canonicalize";
 import { normalizeCliPayload } from "./normalize-cli-payload";
 import type { PolicyFunction, PolicyResult, HooksConfig } from "./policy-types";
 import { readMergedHooksConfig } from "./hooks-config";
 import { registerBuiltinPolicies } from "./builtin-policies";
 import { evaluatePolicies } from "./policy-evaluator";
+// Types only: the semantic (Jev) modules are loaded with a dynamic import, and
+// only once a Jev config exists, so an unconfigured machine never loads them.
+import type { TwoTierReview } from "./semantic/combine";
+import type { JevActivityFields } from "./semantic/combine";
+import type { JevConfig } from "./semantic/jev-config";
 import { clearPolicies, registerPolicy, getPoliciesForEvent } from "./policy-registry";
 import { loadAllCustomHooks } from "./custom-hooks-loader";
+import { authorityDeclarationFor, resolvePolicyAuthority, warnAuthority } from "./policy-authority";
 import type { CustomHook } from "./policy-types";
 import { persistHookActivity } from "./hook-activity-store";
 import { deliveryHealth, deliveryHealthLine } from "./delivery-health";
 import { trackHookEvent, flushHookTelemetry } from "./hook-telemetry";
+import * as hookTelemetry from "./hook-telemetry";
 import { resolveCwd } from "./resolve-cwd";
 import { resolvePermissionMode } from "./resolve-permission-mode";
 import { resolveTranscriptPath } from "./resolve-transcript-path";
@@ -46,6 +54,7 @@ import { readActiveCloudManagedPolicies, type CloudManagedPolicyArtifact } from
 import { hasInstalledPacks, readInstalledPacks, type PackError, type ResolvedPack } from "./pack-manifest";
 import { missingGuards, packFailureReason, combinedGuardMatch, guardsCover } from "./pack-failclosed";
 import { readActivePause, type ActivePause } from "./session-pause";
+import { jevConfigFile } from "./fp-home";
 import { layoutWarningForHook } from "./fp-reset";
 
 /**
@@ -153,6 +162,16 @@ export interface EvaluateHookEventOptions {
    * written for.
    */
   fallbackCwd?: string;
+  /**
+   * The warm worker's hook into its request queue. Called at most once, and
+   * only on the two-tier path, at the point this evaluation stops reading the
+   * process-global policy registry and starts waiting on Jev's network answer
+   * — so the next queued hook can run instead of every hook on the machine
+   * queueing behind that round trip. After it is called nothing in this
+   * evaluation reads the registry again. The one-shot path has no queue and
+   * leaves it unset.
+   */
+  releaseRegistry?: () => void;
 }
 
 /**
@@ -186,6 +205,211 @@ async function runObserved(
   }
 }
 
+// ── Two-tier (Jev) opt-in ────────────────────────────────────────────────────
+//
+// Jev reviews a call only when ALL of these hold, and the regex engine runs
+// alone — exactly as it did before two tiers existed — otherwise:
+//
+// - a valid BYOK config exists (`~/.failproofai/jev.json`, global only);
+// - `FAILPROOFAI_EVALUATOR` is not `legacy` (see "Turning Jev off" below);
+// - this is not the fail-closed `forceDecision` path and no session pause is
+//   active — a pause suspends local policy, and Jev must not become a way to
+//   evaluate what the pause switched off;
+// - the event is a gate (`PreToolUse` / `PermissionRequest`) for a named tool
+//   that the AGENT requested (see `isHumanAuthoredGate`).
+//
+// There is no cloud-deployment exclusion: cloud policies default to `hard`, so
+// Jev can only make a centrally managed machine stricter, never weaker.
+//
+// Turning Jev off. The switch that works everywhere is the config file itself:
+// it is read on every event, here, in whichever process evaluates — the
+// daemon's warm worker included — so `failproofai jev remove` (or a `mode:
+// "shadow"` config, which keeps enforcing the regex result) applies from the
+// next tool call, with no restart. `FAILPROOFAI_EVALUATOR=legacy` is the dev
+// escape hatch, read from the EVALUATING process's environment: it covers a
+// one-shot hook (no daemon) and a worker whose own environment sets it, but
+// not a variable exported in a shell on a daemon machine — the daemon
+// forwards a hook's event, cli, stdin and cwd to the worker, never the hook
+// process's environment. `failproofai jev status` says so when it sees the
+// variable. A per-session switch for daemon machines would be a new field in
+// the daemon protocol; there is none today.
+
+/** The two gate events Jev reviews. Everything else is regex-only. */
+const JEV_GATE_EVENTS: ReadonlySet<string> = new Set(["PreToolUse", "PermissionRequest"]);
+
+/**
+ * A gate event that carries a command the HUMAN typed, not one the agent
+ * requested: Pi's `user_bash` (`!cmd` at Pi's prompt) canonicalizes to
+ * `PreToolUse` like an agent's `tool_call`. Jev judges an agent's request
+ * against what the human asked for, and says so to the model ("A coding agent
+ * has REQUESTED the tool call"); the human's own command is the human asking,
+ * and never appears in `user_said`, so Jev would judge it as an unrequested
+ * agent action and could block the human's own command. The regex policies
+ * still run on it exactly as they always have.
+ */
+function isHumanAuthoredGate(rawEventType: string | undefined, cli: IntegrationType): boolean {
+  return cli === "pi" && rawEventType === "user_bash";
+}
+
+function jevForcedOff(opts: EvaluateHookEventOptions | undefined): boolean {
+  return process.env.FAILPROOFAI_EVALUATOR === "legacy" || !!opts?.forceDecision;
+}
+
+/**
+ * The BYOK config (with the build's default mode, D2), or null (Jev off). A
+ * config that cannot be read is off, never a failure. Logged at info, like
+ * every configured-but-broken Jev path: warn-level lines reach the hook's
+ * stderr, which is the deny text itself on some CLIs (Factory's exit 2).
+ * `failproofai jev status` is where a broken config is made visible.
+ *
+ * The file is checked for BEFORE the import, and that order is the point. With
+ * no `jev.json` the answer is null however the module would have read it — so
+ * the stat decides it, and a machine that never configured Jev never evaluates
+ * a line of the semantic modules to be told what their absence already says.
+ * The same stat-rather-than-load trade `warnAuthority` makes, for the same
+ * reason. It short-circuits nothing but a null `loadJevConfig` would have
+ * returned itself: that function reads this path, and an absent file, an
+ * unreadable directory above it and a path that is not a file are all null
+ * there too.
+ */
+async function readJevConfig(): Promise<{ config: JevConfig; defaultMode: TwoTierReview["mode"] } | null> {
+  try {
+    if (!existsSync(jevConfigFile())) return null;
+    const { loadJevConfig, DEFAULT_JEV_MODE } = await import("./semantic/jev-config");
+    const config = loadJevConfig();
+    return config ? { config, defaultMode: DEFAULT_JEV_MODE } : null;
+  } catch (err) {
+    hookLogInfo(
+      `Jev config could not be read (${err instanceof Error ? err.message : String(err)}); the regex engine decides alone`,
+    );
+    return null;
+  }
+}
+
+/**
+ * Start Jev's review of this call — before the regex policies run, so the two
+ * proceed in parallel — or return null for the regex-only path.
+ */
+async function startTwoTier(
+  canonicalEventType: string,
+  parsed: Record<string, unknown>,
+  session: SessionMetadata,
+  cli: IntegrationType,
+  opts: EvaluateHookEventOptions | undefined,
+  activePause: ActivePause | null,
+): Promise<TwoTierReview | null> {
+  if (!JEV_GATE_EVENTS.has(canonicalEventType)) return null;
+  if (isHumanAuthoredGate(session.rawHookEventName, cli)) return null;
+  if (typeof parsed.tool_name !== "string" || parsed.tool_name.length === 0) return null;
+  if (jevForcedOff(opts) || activePause) return null;
+  const loaded = await readJevConfig();
+  if (!loaded) return null;
+  const cfg = loaded.config;
+  try {
+    const { startJevReview } = await import("./semantic/jev-review");
+    return startJevReview(cfg, {
+      eventType: canonicalEventType,
+      toolName: parsed.tool_name,
+      toolInput: parsed.tool_input,
+      cwd: session.cwd,
+      permissionMode: session.permissionMode,
+      sessionId: session.sessionId,
+      cli,
+    });
+  } catch (err) {
+    // Configured but unable to start: that is a fallback, and it is recorded
+    // as one — every regex verdict hard, the regex result final. Recorded as
+    // `error`, one of the reason codes the activity store and the collector
+    // know (T8's closed list); an unknown code would ship as `other`. Logged
+    // at info, off the hook's stderr (see `readJevConfig`); the activity row
+    // carries the fallback.
+    hookLogInfo(`Jev review could not start (${err instanceof Error ? err.message : String(err)})`);
+    return {
+      mode: cfg.mode === "shadow" || cfg.mode === "enforce" ? cfg.mode : loaded.defaultMode,
+      review: Promise.resolve({ kind: "fallback", reason: "error", latencyMs: null, model: null }),
+      abort: () => {},
+      authorityOf: () => ({ authority: "hard", reviewedBy: [] }),
+    };
+  }
+}
+
+/**
+ * The Jev properties for `hook_policy_triggered`, from T8's
+ * `jevTelemetryProperties` (decisions, reason codes, policy and model names,
+ * a latency — never command or prompt text). `{}` when the two-tier path did
+ * not run, so an unconfigured machine's event is unchanged, and `{}` when the
+ * helper is not in this build (it is T8's, not a §7 contract) or throws:
+ * telemetry never costs a hook its answer.
+ *
+ * Only its `jev_`-prefixed keys are kept. These are spread into an event whose
+ * core properties (`decision`, `policy_name`, `event_type`, …) are what the
+ * rollout is read from, and a helper owned by another task must not be able to
+ * overwrite one of them — silently, and only on two-tier machines — by
+ * emitting a key of that name. The helper is treated as untrusted in every
+ * other respect (absent, non-object, throwing); this is the same guard for
+ * what it returns.
+ */
+function jevTelemetry(activity: JevActivityFields | undefined): Record<string, unknown> {
+  if (!activity) return {};
+  try {
+    const build = (hookTelemetry as unknown as { jevTelemetryProperties?: (entry: JevActivityFields) => unknown })
+      .jevTelemetryProperties;
+    const props = typeof build === "function" ? build(activity) : null;
+    if (!props || typeof props !== "object" || Array.isArray(props)) return {};
+    return Object.fromEntries(Object.entries(props as Record<string, unknown>).filter(([key]) => key.startsWith("jev_")));
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Record what the human just typed, for Jev to judge later calls against.
+ * Only when Jev is configured. Every canonical `UserPromptSubmit` is passed,
+ * except a prompt a policy denied on a CLI where that deny is known to hold
+ * (`ENFORCEMENT_CAPABILITY` says `block`): the agent never receives that
+ * prompt, so it cannot be what the agent is working on. Where a prompt deny
+ * is only observed — Goose, OpenCode, Antigravity — or not verified, the
+ * agent does get the prompt, and it is passed like any other. Which CLIs'
+ * prompt events count as human is decided inside `captureIntent` (T4).
+ * Never throws; a failure is logged at info (see `readJevConfig`).
+ *
+ * `captureIntent` gets the whole normalized payload (`payload`): the prompt
+ * text is in a different field on some harnesses (Goose: `message`), and the
+ * marks that tell a human's prompt from a subagent's or an extension's are
+ * elsewhere in it. `prompt` is §7's original field, still read by the
+ * contract stub; T4's implementation reads `payload` and ignores it.
+ */
+async function captureJevIntent(
+  canonicalEventType: string,
+  decision: "allow" | "deny" | "instruct",
+  parsed: Record<string, unknown>,
+  session: SessionMetadata,
+  cli: IntegrationType,
+  opts: EvaluateHookEventOptions | undefined,
+): Promise<void> {
+  if (canonicalEventType !== "UserPromptSubmit" || jevForcedOff(opts)) return;
+  try {
+    if (!(await readJevConfig())) return;
+    if (decision === "deny") {
+      const { ENFORCEMENT_CAPABILITY } = await import("./enforcement-capability");
+      if (ENFORCEMENT_CAPABILITY[cli]?.UserPromptSubmit === "block") return;
+    }
+    const { captureIntent } = await import("./semantic/intent");
+    // Built first, then passed: the one object satisfies §7's shape and T4's.
+    const event = {
+      eventType: canonicalEventType,
+      sessionId: session.sessionId,
+      transcriptPath: session.transcriptPath,
+      cli,
+      payload: parsed,
+      prompt: parsed.prompt,
+    };
+    captureIntent(event);
+  } catch (err) {
+    hookLogInfo(`Jev intent capture failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
 /**
  * The core hook-evaluation logic, decoupled from process stdin/stdout so it
  * can be called repeatedly inside a long-lived process (the daemon's warm
@@ -561,6 +785,14 @@ export async function evaluateHookEvent(
           ...(cloudManaged ? { cloudPolicyId: cloudManaged.id, cloudVersion: cloudManaged.version } : {}),
           ...(pack ? { packId: pack.id, packVersion: pack.version } : {}),
         });
+        // Whether Jev may clear this policy's verdict. The cloud assignment or
+        // the pack manifest declares it for those routes, the hook itself only
+        // for the user's own files; anything unclear registers as hard. Said
+        // aloud when a `reviewable` claim is refused and Jev is configured, so
+        // an author is not left wondering why Jev never clears it.
+        const authority = authorityDeclarationFor(hook, { cloudManaged, pack });
+        const refused = resolvePolicyAuthority(authority).downgraded;
+        if (refused) warnAuthority(`${registeredName} asks to be reviewable, but ${refused} — it stays hard`);
         registerPolicy(
           registeredName,
           hook.description ?? "",
@@ -572,6 +804,7 @@ export async function evaluateHookEvent(
           // configured. Matched by the pack's own name for the policy, which is
           // the name before the `pack/<id>@<version>/` prefix is applied.
           pack?.policies.find((p) => p.name === hook.name)?.params,
+          authority,
         );
       }
 
@@ -660,19 +893,40 @@ export async function evaluateHookEvent(
       );
     }
 
+    // Two-tier: when a Jev config exists and this is a gate, Jev's request
+    // starts HERE, before any regex policy runs, and evaluatePolicies combines
+    // the two (see semantic/combine.ts). Otherwise this is null and the call
+    // below is exactly the regex-only evaluation it always was.
+    const twoTier = await startTwoTier(canonicalEventType, parsed, session, cli, opts, activePause);
+    // On the two-tier path the registry is read for the activity row BEFORE
+    // evaluating, because evaluatePolicies may hand the registry back to the
+    // warm worker's queue (`releaseRegistry`) while it waits on Jev, and the
+    // next request's clearPolicies() could then run under this one. Same
+    // cached lookup, same answer: nothing between here and there registers.
+    const matchedBeforeRelease = twoTier
+      ? getPoliciesForEvent(canonicalEventType, parsed.tool_name as string | undefined).map((p) => p.name)
+      : null;
+
     // Evaluate policies (use canonical PascalCase event type)
-    const result = await evaluatePolicies(canonicalEventType, parsed, session, config);
+    const result = twoTier
+      ? await evaluatePolicies(canonicalEventType, parsed, session, config, {
+          ...twoTier,
+          releaseRegistry: opts?.releaseRegistry,
+        })
+      : await evaluatePolicies(canonicalEventType, parsed, session, config);
     const durationMs = Math.round(performance.now() - startTime);
     hookLogInfo(`result=${result.decision} policy=${result.policyName ?? "none"} duration=${durationMs}ms`);
 
+    await captureJevIntent(canonicalEventType, result.decision, parsed, session, cli, opts);
+
     // Which policies actually ran for this event, regardless of how they
     // decided. `result.policyName` names only the decider — null on a plain
     // allow — so without this a row cannot tell "your policy ran and allowed"
     // from "no policy covers this event". The lookup is the same cached call
     // the evaluator already made, so it costs nothing.
-    const matchedPolicies = getPoliciesForEvent(canonicalEventType, parsed.tool_name as string | undefined).map(
-      (p) => p.name,
-    );
+    const matchedPolicies =
+      matchedBeforeRelease ??
+      getPoliciesForEvent(canonicalEventType, parsed.tool_name as string | undefined).map((p) => p.name);
 
     // Persist activity to disk (visible in /policies activity tab)
     const activityEntry = {
@@ -686,6 +940,8 @@ export async function evaluateHookEvent(
       decision: result.decision,
       reason: result.reason,
       durationMs,
+      // How Jev took part (§7 fields). Absent unless the two-tier path ran.
+      ...(result.twoTier ? result.twoTier.activity : {}),
       sessionId: session.sessionId,
       transcriptPath: session.transcriptPath,
       cwd: session.cwd,
@@ -693,8 +949,10 @@ export async function evaluateHookEvent(
       hookEventName: session.hookEventName,
       // Attribution. A builtin is anything registered that is not in the map,
       // so its absence is meaningful rather than missing — but only when a
-      // policy actually decided; a plain allow names nobody.
-      ...(result.policyName
+      // policy actually decided; a plain allow names nobody. When Jev's own
+      // verdict decided, no registered policy did: `evaluator` + `jevDecision`
+      // say so, and claiming "builtin" here would be false.
+      ...(result.policyName && !result.twoTier?.decidedByJev
         ? (() => {
             const attribution = policyAttribution.get(result.policyName);
             return {
@@ -751,6 +1009,7 @@ export async function evaluateHookEvent(
           convention_scope: conventionScope,
           has_custom_params: hasCustomParams,
           param_keys_overridden: paramKeysOverridden,
+          ...jevTelemetry(result.twoTier?.activity),
         });
         // Deny/instruct is exactly the response the daemon's warm worker
         // needs to return fast — a live network POST to PostHog on this path