fullcourtdefense-cli 1.36.4 → 1.37.0

package/dist/commands/hook.js

@@ -60,22 +60,30 @@ const callerEnv_1 = require("../callerEnv");
 const deterministicGuard_1 = require("./deterministicGuard");
 const localSafetySnapshot_1 = require("../localSafetySnapshot");
 const taintLedger_1 = require("./taintLedger");
-const notify_1 = require("../notify");
-const blockExplanation_1 = require("../blockExplanation");
 const distress_1 = require("../distress");
 const describeError_1 = require("../describeError");
 const policyGateHealth_1 = require("../policyGateHealth");
-const verdictIpc_1 = require("../verdictIpc");
 const machineIdentity_1 = require("../machineIdentity");
 const actionPolicyEngine_1 = require("../actionPolicyEngine");
-const devConfirm_1 = require("../devConfirm");
-const askDialog_1 = require("../askDialog");
 // Shared with the slim hook entry (hookSlim.ts) so both entries log to the
 // same rotated hook.log and read stdin identically.
 const hookIo_1 = require("../hookIo");
 const fileWriteCanon_1 = require("../fileWriteCanon");
-const discoverProxy_1 = require("./discoverProxy");
 const shellAstLoader_1 = require("../shellAstLoader");
+const detectorInProcess_1 = require("../detectorInProcess");
+// ENFORCE CORE: a daemon-down verdict loads only what decides it — the engine,
+// the deterministic guard, the cached bundle + Local Safety snapshot and the
+// taint ledger. Everything below loads on the path that uses it: developer
+// confirmations and grants (asks), the dialog envelope, OS notifications
+// (approvals), block explanations, the MCP gateway lookup and the IPC client.
+/* eslint-disable @typescript-eslint/no-var-requires */
+const devConfirm = () => require('../devConfirm');
+const askDialog = () => require('../askDialog');
+const notify = () => require('../notify');
+const blockExplanation = () => require('../blockExplanation');
+const discoverProxy = () => require('./discoverProxy');
+const verdictIpc = () => require('../verdictIpc');
+const gateReports = () => require('../gateReports');
 function inferEvent(explicit, payload) {
     const e = (explicit || '').toLowerCase();
     if (e) {
@@ -439,7 +447,7 @@ function isGatewayWrappedMcpServer(payload, client, cwd = process.cwd()) {
         return false;
     const clientKey = client ? client.toLowerCase().replace(/-/g, '_') : undefined;
     try {
-        return (0, discoverProxy_1.isServerBehindFcdGateway)(server, cwd, clientKey);
+        return discoverProxy().isServerBehindFcdGateway(server, cwd, clientKey);
     }
     catch {
         return false;
@@ -595,14 +603,17 @@ function summarizeToolCall(toolName, toolArgs) {
     return parts.join(' ').slice(0, 500);
 }
 function spoolCallEvent(call, rest) {
+    (0, telemetry_1.spoolEvent)(callEvent(call, rest));
+}
+function callEvent(call, rest) {
     const { operation } = (0, actionPolicyEngine_1.inferToolContext)(call.toolName, call.toolArgs);
-    (0, telemetry_1.spoolEvent)({
+    return {
         ...rest,
         toolName: call.toolName,
         operation: rest.operation || operation,
         evidence: rest.evidence || (0, telemetry_1.evidenceFromToolArgs)(call.toolArgs),
         shellAst: rest.shellAst || (0, shellAstLoader_1.collectShellAstFacts)(),
-    });
+    };
 }
 /**
  * A `log` verdict ("Warn only" in the console) is a real warning, not a silent
@@ -706,6 +717,11 @@ async function readBackendError(resp, maxLength = 200) {
  * One immediate retry on network failure/timeout: ~1% of gate calls in the
  * field hit the timeout on transient jitter, and a single retry converts
  * nearly all of them into normal verdicts instead of degraded decisions.
+ *
+ * ONE deadline per attempt covers the headers AND the body: a backend that
+ * answers headers and then stalls the body (305 s measured) is a failed
+ * attempt — a gate failure — never an unbounded wait that ends in the IDE
+ * killing the hook and running the action.
  */
 async function fetchWithOneRetry(url, init, timeoutMs, onFailure, attempts = 2) {
     let lastError;
@@ -713,7 +729,14 @@ async function fetchWithOneRetry(url, init, timeoutMs, onFailure, attempts = 2)
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), timeoutMs);
         try {
-            return await fetch(url, { ...init, signal: controller.signal });
+            const resp = await fetch(url, { ...init, signal: controller.signal });
+            const body = await resp.text();
+            return {
+                ok: resp.ok,
+                status: resp.status,
+                text: async () => body,
+                json: async () => JSON.parse(body),
+            };
         }
         catch (err) {
             lastError = err;
@@ -800,7 +823,7 @@ function respondDegraded(ctx, detail, toolName, kind = 'unreachable', opts = {})
 function tryDeveloperConfirmation(ctx, call, verdict, payload, where) {
     if (verdict.verdict !== 'require_approval')
         return false;
-    const humanPresent = (0, devConfirm_1.isHumanPresent)();
+    const humanPresent = (0, callerEnv_1.isHumanPresent)();
     if ((0, actionPolicyEngine_1.effectiveApprovalScope)(verdict.approval, { humanPresent }) !== 'developer') {
         (0, hookIo_1.dbg)({ phase: 'dev_confirm_not_applicable', event: ctx.event, tool: call.toolName, humanPresent, scope: verdict.approval?.scope });
         return false;
@@ -813,7 +836,7 @@ function tryDeveloperConfirmation(ctx, call, verdict, payload, where) {
         policyName: verdict.policyName,
         matchedRule: verdict.matchedRule,
         // Memory / grants bind to the policy as written, not to the bundle ETag.
-        ruleHash: (0, devConfirm_1.actionPolicyRuleHash)(ctx.localPolicies?.find(policy => policy.id === verdict.policyId)),
+        ruleHash: devConfirm().actionPolicyRuleHash(ctx.localPolicies?.find(policy => policy.id === verdict.policyId)),
         remember: verdict.approval?.remember ?? 'none',
         grantCaps: { maxDays: verdict.approval?.maxDays, maxUses: verdict.approval?.maxUses },
         reason: verdict.reason,
@@ -841,7 +864,7 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
     const policyHash = source.policyHash || source.localFinding?.policyHash;
     const memoryHash = source.ruleHash || policyHash;
     // Sweep first: markers the human never answered are recorded as not approved.
-    for (const expired of (0, devConfirm_1.sweepExpiredConfirmations)()) {
+    for (const expired of devConfirm().sweepExpiredConfirmations()) {
         (0, telemetry_1.spoolEvent)({
             decision: 'block',
             toolName: expired.toolName,
@@ -854,7 +877,7 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
     // A remote-control bridge hands the machine to an outside AI: "Allow once" is once,
     // with no session memory. Only an explicit "Always allow" (a bridge-scoped grant) lasts.
     const sessionMemory = source.localFinding?.remoteControl || context['toolArgs.remoteControl'] ? 'none' : source.remember;
-    const remembered = sessionMemory === 'none' ? undefined : (0, devConfirm_1.isConfirmationRemembered)({ toolName: call.toolName, operation, argsDigest: (0, devConfirm_1.actionDigest)(call.toolArgs), policyId: source.policyId, matchedRule: source.matchedRule, policyHash: memoryHash }, sessId);
+    const remembered = sessionMemory === 'none' ? undefined : devConfirm().isConfirmationRemembered({ toolName: call.toolName, operation, argsDigest: devConfirm().actionDigest(call.toolArgs), policyId: source.policyId, matchedRule: source.matchedRule, policyHash: memoryHash }, sessId);
     if (remembered) {
         (0, hookIo_1.dbg)({ phase: 'dev_confirm_remembered', event, tool: call.toolName, operation, remember: remembered.remember, where: source.where });
         spoolCallEvent(call, {
@@ -875,11 +898,11 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
     // an org that switched "Always allow" off (`null`) honours no grant at all.
     // The grant binds the facts THIS rule fired on: a credential-command rule is
     // about the program, an egress / SSRF / exfil rule is about the host too.
-    const grantScope = (0, devConfirm_1.grantScopeFor)(event, call.toolName, call.toolArgs, operation, context, (0, devConfirm_1.grantRuleFactsFor)(source));
-    const grantLimits = (0, devConfirm_1.capGrantLimitsForScope)((0, devConfirm_1.resolveGrantLimits)(source.grantCaps, (0, runtimeConfig_1.getCachedDeveloperGrantPolicy)()), grantScope);
-    const grant = source.remember === 'none' ? undefined : (0, devConfirm_1.findDeveloperGrant)(grantScope, { policyId: source.policyId, matchedRule: source.matchedRule, policyHash: memoryHash }, grantLimits);
+    const grantScope = devConfirm().grantScopeFor(event, call.toolName, call.toolArgs, operation, context, devConfirm().grantRuleFactsFor(source));
+    const grantLimits = devConfirm().capGrantLimitsForScope(devConfirm().resolveGrantLimits(source.grantCaps, (0, runtimeConfig_1.getCachedDeveloperGrantPolicy)()), grantScope);
+    const grant = source.remember === 'none' ? undefined : devConfirm().findDeveloperGrant(grantScope, { policyId: source.policyId, matchedRule: source.matchedRule, policyHash: memoryHash }, grantLimits);
     if (grant) {
-        const covers = (0, devConfirm_1.describeGrantScope)(grant.scope, grant);
+        const covers = devConfirm().describeGrantScope(grant.scope, grant);
         (0, hookIo_1.dbg)({ phase: 'dev_confirm_granted', event, tool: call.toolName, operation, grant: grant.key, where: source.where });
         spoolCallEvent(call, {
             decision: 'allow',
@@ -893,11 +916,11 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
         (0, telemetry_1.triggerFlush)(false);
         return { outcome: 'allow', agentMsg: `FullCourtDefense: the developer has a standing "Always allow" for ${covers}.` };
     }
-    const marker = (0, devConfirm_1.raiseDeveloperConfirmation)({
+    const marker = devConfirm().raiseDeveloperConfirmation({
         event,
         toolName: call.toolName,
         operation,
-        argsDigest: (0, devConfirm_1.actionDigest)(call.toolArgs),
+        argsDigest: devConfirm().actionDigest(call.toolArgs),
         policyId: source.policyId,
         policyName: source.policyName,
         policyHash: memoryHash,
@@ -973,7 +996,7 @@ function settlePostExecution(explicitEvent, payload) {
         const call = buildToolCall(inner, payload);
         if (!call)
             return;
-        const settled = (0, devConfirm_1.settleDeveloperConfirmation)(inner, call.toolName, (0, devConfirm_1.actionDigest)(call.toolArgs));
+        const settled = devConfirm().settleDeveloperConfirmation(inner, call.toolName, devConfirm().actionDigest(call.toolArgs));
         if (!settled)
             return;
         (0, hookIo_1.dbg)({ phase: 'dev_confirm_settled', event: inner, tool: call.toolName, confirmLatencyMs: settled.confirmLatencyMs, remember: settled.marker.remember });
@@ -1134,7 +1157,7 @@ function sessionId(p) {
         return fromPayload;
     return `cursor-${os.hostname()}`;
 }
-function machineMetadata(client = 'cursor') {
+function machineMetadata(client = 'cursor', opts = {}) {
     let username = 'unknown';
     try {
         username = os.userInfo().username;
@@ -1143,9 +1166,11 @@ function machineMetadata(client = 'cursor') {
     // Stable fleet machine identity: lets the backend attribute this decision to
     // THIS machine exactly (timeline + behavior baseline), instead of matching
     // by hostname. Best-effort — identity must never break the hook.
+    // `noNativeRead` (a report queued before the verdict): cached or pinned id
+    // only, never a reg.exe / ioreg read; its deliverer adds a missing id.
     let machineId;
     try {
-        machineId = (0, machineIdentity_1.getMachineIdentity)().machineId;
+        machineId = opts.noNativeRead ? (0, machineIdentity_1.machineIdForDisplay)() : (0, machineIdentity_1.getMachineIdentity)().machineId;
     }
     catch { /* ignore */ }
     return {
@@ -1170,10 +1195,10 @@ function machineMetadata(client = 'cursor') {
 function localBlockUserMessage(finding, event = 'shell', call, note) {
     return explainLocalSafetyStop('block', event, call || { toolName: 'prompt', toolArgs: {} }, finding, note).userMessage;
 }
-/** Fleet machine id for deep links — best-effort, never throws. */
+/** Fleet machine id for deep links — best-effort, never throws, never a reg.exe read on the verdict path. */
 function explanationMachineId() {
     try {
-        return (0, machineIdentity_1.getMachineIdentity)().machineId;
+        return (0, machineIdentity_1.machineIdForDisplay)();
     }
     catch {
         return undefined;
@@ -1194,7 +1219,7 @@ function explainPolicyStop(outcome, event, call, verdict, policies, note) {
         operation = inferred.operation;
     }
     catch { /* explanation must never fail the hook */ }
-    return (0, blockExplanation_1.buildBlockExplanation)({
+    return blockExplanation().buildBlockExplanation({
         outcome,
         event,
         toolName: call.toolName,
@@ -1209,14 +1234,14 @@ function explainPolicyStop(outcome, event, call, verdict, policies, note) {
             operation,
             reason: verdict.reason,
         },
-        consoleUrl: (0, notify_1.consoleUrl)(),
+        consoleUrl: notify().consoleUrl(),
         machineId: explanationMachineId(),
         developerName: developerId(),
         note,
     });
 }
 function explainLocalSafetyStop(outcome, event, call, finding, note) {
-    return (0, blockExplanation_1.buildBlockExplanation)({
+    return blockExplanation().buildBlockExplanation({
         outcome,
         event,
         toolName: call.toolName,
@@ -1229,20 +1254,20 @@ function explainLocalSafetyStop(outcome, event, call, finding, note) {
             explanation: finding.explanation,
             reason: finding.reason,
         },
-        consoleUrl: (0, notify_1.consoleUrl)(),
+        consoleUrl: notify().consoleUrl(),
         machineId: explanationMachineId(),
         developerName: developerId(),
         note,
     });
 }
 function explainGuardStop(kind, event, call, reason, ruleId) {
-    return (0, blockExplanation_1.buildBlockExplanation)({
+    return blockExplanation().buildBlockExplanation({
         outcome: 'block',
         event,
         toolName: call.toolName,
         toolArgs: call.toolArgs,
         source: { kind, ruleId, reason },
-        consoleUrl: (0, notify_1.consoleUrl)(),
+        consoleUrl: notify().consoleUrl(),
         machineId: explanationMachineId(),
         developerName: developerId(),
     });
@@ -1254,7 +1279,7 @@ function spoolLocalFinding(input) {
         decision: input.decision || 'block',
         toolName: input.toolName,
         operation: input.operation,
-        reason: recorded ? (0, blockExplanation_1.recordedReason)(input.finding.reason, recorded) : input.finding.reason,
+        reason: recorded ? blockExplanation().recordedReason(input.finding.reason, recorded) : input.finding.reason,
         ruleId: input.finding.ruleId,
         category: input.finding.category,
         categoryId: input.finding.categoryId,
@@ -1337,12 +1362,20 @@ function processIo(stdin, stdinErr) {
  * snapshot, policy engine) is warm here — verdicts resolve in milliseconds.
  * Mirrors hookCommand's fail-open contract: any unexpected exception yields
  * an allow verdict, never an error the thin client would surface.
+ * `exitsProcess`: the caller is a one-shot hook process that ends with this
+ * verdict (the slim entry's fallback, native hooks) — see HookIo.exitsProcess.
+ * `deferGateReports`: native hooks — see HookIo.deferGateReports.
  */
 async function evaluateHookRequest(args, stdinRaw, config, opts = {}) {
     // Structural shell facts (shadow by default). A missing/slow parser means
     // "no facts" and the regex floor decides alone — never a wait, never fail-open.
-    await (0, shellAstLoader_1.ensureShellAst)();
-    return evaluateBuffered(args, stdinRaw, '', config, { isTTY: false, exitsProcess: false, viaDaemon: opts.viaDaemon });
+    // A one-shot process (`exitsProcess`) starts the parser only where it may
+    // decide (primary mode, see hookCommandInner).
+    if (!opts.exitsProcess)
+        await (0, shellAstLoader_1.ensureShellAst)();
+    return evaluateBuffered(args, stdinRaw, '', config, {
+        isTTY: false, exitsProcess: opts.exitsProcess === true, deferGateReports: opts.exitsProcess === true && opts.deferGateReports === true, viaDaemon: opts.viaDaemon,
+    });
 }
 /**
  * Run the hook against a buffered io and return the verdict instead of writing
@@ -1361,6 +1394,7 @@ async function evaluateBuffered(args, stdinRaw, stdinErr, config, mode) {
         writeErr: (text) => { errOut += text; },
         exit: (code) => { throw new HookExitSignal(code); },
         exitsProcess: mode.exitsProcess,
+        deferGateReports: mode.deferGateReports,
         viaDaemon: mode.viaDaemon,
     };
     try {
@@ -1393,10 +1427,14 @@ async function evaluateBuffered(args, stdinRaw, stdinErr, config, mode) {
  * through respond() inside and never reach this catch.
  */
 async function hookCommand(args, config) {
-    // Start of the developer's wait. Taken once here and carried (in-memory) so
-    // every event this hook spools reports real latency, and the daemon can
-    // report the FULL wait rather than just its own slice. No probe, no timer.
-    const startedAt = Date.now();
+    // Start of the developer's wait: when the IDE spawned this process (boot and
+    // module load included). Carried (in-memory) so every event this hook spools
+    // reports real latency, and the daemon can report the FULL wait rather than
+    // just its own slice. No probe, no timer.
+    const startedAt = (0, hookIo_1.processStartedAt)();
+    (0, callerEnv_1.applyIdeTimeoutArg)(args.ideTimeout);
+    // Uploads requested during the evaluation start after the verdict is out.
+    (0, telemetry_1.deferFlushUntilExit)();
     return (0, telemetry_1.markVerdictTiming)({ startedAt, path: 'local' }, () => hookCommandOuter(args, config, startedAt));
 }
 /**
@@ -1432,29 +1470,31 @@ async function hookCommandOuter(args, config, startedAt) {
         // THIN-CLIENT FAST PATH: when the resident daemon is up, it computes the
         // verdict with everything warm (ms, no per-event config/bundle/snapshot
         // loading here). Bounded hard: a missing pipe fails in <1ms, a daemon that
-        // does not accept the call within ~2.5s is cut off; an accepted call is
+        // does not accept the call within PRE_ACK_BUDGET_MS is cut off (it has
+        // started nothing; it never starts the call afterwards); an accepted call is
         // the daemon's to decide (one evaluation per call, #1517) up to the IDE
         // wait cutoff. ANY non-verdict outcome falls through to the full local
         // evaluation below. FCD_VERDICT_IPC=off opts out.
         if (process.env.FCD_VERDICT_IPC !== 'off') {
-            const ipc = await (0, verdictIpc_1.requestDaemonVerdict)(args, raw, undefined, startedAt);
+            const ipc = await verdictIpc().requestDaemonVerdict(args, raw, undefined, startedAt);
             if (ipc.outcome === 'verdict') {
                 (0, hookIo_1.dbg)({ phase: 'ipc_verdict', event: args.event, exitCode: ipc.exitCode });
-                await (0, askDialog_1.emitVerdictForIde)(args, { stdout: ipc.stdout || '', stderr: ipc.stderr || '', exitCode: ipc.exitCode ?? 0 }, 'ipc');
+                await askDialog().emitVerdictForIde(args, { stdout: ipc.stdout || '', stderr: ipc.stderr || '', exitCode: ipc.exitCode ?? 0 }, 'ipc');
             }
             // Daemon down / busy / refused — evaluate locally as always. Logged so a
-            // machine that silently stopped using the fast path is diagnosable.
-            (0, hookIo_1.dbg)({ phase: 'ipc_unavailable', event: args.event, detail: ipc.detail, ...(ipc.accepted ? { accepted: true } : {}) });
-        }
-        // Structural shell facts for the local evaluation (shadow by default; the
-        // daemon path above initialises its own copy once). Bounded: a slow or
-        // missing parser resolves to "no facts" and the regex floor decides alone.
-        const astReady = await (0, shellAstLoader_1.ensureShellAst)();
-        (0, hookIo_1.dbg)({ phase: 'shell_ast', ready: astReady, status: (0, shellAstLoader_1.shellAstStatus)() });
+            // machine that silently stopped using the fast path is diagnosable, and
+            // the reason rides every event this evaluation spools.
+            (0, hookIo_1.dbg)({ phase: 'ipc_unavailable', event: args.event, detail: ipc.detail, ipcMiss: ipc.miss, ...(ipc.accepted ? { accepted: true } : {}) });
+            (0, telemetry_1.setVerdictIpcMiss)(ipc.miss);
+        }
+        // Structural shell facts: this one-shot process starts the parser only in
+        // primary mode (hookCommandInner). In shadow the parser never changes a
+        // verdict, so its WASM start-up would only cost CPU; the regex floor decides.
+        (0, hookIo_1.dbg)({ phase: 'shell_ast', ready: (0, shellAstLoader_1.shellAstStatus)().ready, status: (0, shellAstLoader_1.shellAstStatus)() });
         // Buffered so an `ask` can be put to the developer in OUR dialog before the
         // IDE reads the verdict; exitsProcess stays true — this process ends right after.
         const result = await evaluateBuffered(args, raw, stdinErr, config, { isTTY: !!process.stdin.isTTY, exitsProcess: true });
-        await (0, askDialog_1.emitVerdictForIde)(args, result, 'local');
+        await askDialog().emitVerdictForIde(args, result, 'local');
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -1490,7 +1530,7 @@ function failOpenOutcome(event, message, args, config, pendingStop) {
         }
         catch { /* never throw */ }
         try {
-            (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation: `${toolName}:hook_error`, reason: `Hook error while ${pendingStop} — denied: ${message.slice(0, 200)}`, offlineEnforced: true });
+            (0, telemetry_1.spoolEvent)({ verdictPath: 'fail_open', decision: 'block', toolName, operation: `${toolName}:hook_error`, reason: `Hook error while ${pendingStop} — denied: ${message.slice(0, 200)}`, offlineEnforced: true });
             (0, telemetry_1.triggerFlush)(true);
         }
         catch { /* never throw */ }
@@ -1518,6 +1558,9 @@ function failOpenOutcome(event, message, args, config, pendingStop) {
     catch { /* never throw */ }
     try {
         (0, telemetry_1.spoolEvent)({
+            // Explicit as well: a process-level crash handler runs outside the
+            // evaluation's timing store, where setVerdictPath has nothing to label.
+            verdictPath: 'fail_open',
             decision: suspended || denyForError ? 'block' : 'allow',
             toolName,
             operation: `${toolName}:hook_error`,
@@ -1588,31 +1631,46 @@ async function hookCommandInner(args, config, io) {
     // the full window, and the action can simply be re-run once approved.
     const approvalTimeoutMs = Number(args.approvalTimeoutMs) > 0 ? Number(args.approvalTimeoutMs) : 60_000;
     const approvalPollMs = Math.max(1000, Number(args.approvalPollMs) > 0 ? Number(args.approvalPollMs) : 3000);
+    // The signed detector, compiled in-process on the engine's first inference
+    // (no-op where the daemon's Worker loader owns it).
+    (0, detectorInProcess_1.ensureEvaluationDetector)();
+    // A one-shot process starts the shell parser only where it may decide; an
+    // env-forced primary mode starts it as early as before.
+    if (io.exitsProcess && (0, shellAstLoader_1.resolveShellAstMode)(process.env.FCD_SHELL_AST_MODE, undefined) === 'primary')
+        void (0, shellAstLoader_1.ensureShellAst)();
+    // A one-shot process starts a policy refresher only after its verdict is
+    // written (at exit), never before it.
+    if (io.exitsProcess && !io.viaDaemon)
+        (0, runtimeConfig_1.deferBackgroundRefreshUntilExit)();
     // HOT PATH: never spawn powershell.exe for a DPAPI decrypt from a hook —
     // that is up to 15s per shell, per IDE event, and EDRs flag the spawn. The
     // key resolves from the native Credential Manager / machine key file /
     // config / env only. Machines whose key exists solely as a DPAPI blob are
     // self-healed by the daemon: its (non-hot-path) resolution migrates the key
     // into the native store within one cycle, and hooks read it from there.
-    const creds = (0, config_1.resolveCliCredentials)(config, {
-        shieldId: args.shieldId,
-        shieldKey: args.shieldKey,
-        apiUrl: args.apiUrl,
-    }, { skipDpapi: true });
+    // The key only authenticates network calls, so it is resolved on first use:
+    // a verdict decided from the offline cache never opens a credential store.
+    const credOverrides = { shieldId: args.shieldId, shieldKey: args.shieldKey, apiUrl: args.apiUrl };
+    const creds = (0, config_1.resolveCliCredentialsWithoutKey)(config, credOverrides);
     const shieldId = creds.shieldId;
-    const shieldKey = creds.shieldKey;
+    let resolvedKey;
+    const shieldKey = () => (resolvedKey ??= { value: (0, config_1.resolveCliCredentials)(config, credOverrides, { skipDpapi: true }).shieldKey }).value;
     const apiUrl = creds.apiUrl;
     let effectivePolicyHash;
     let localPolicies;
     // Server-authoritative enforcement mode: the console flips shield.mode and the
-    // machine applies it on the next poll. Cached locally (stale-while-error), so
-    // this is instant when fresh and bounded (~1.5s) only when stale.
+    // machine applies it on the next poll. Served from the local cache at any
+    // age with no network; only a machine with NO cache makes one bounded
+    // (~1.5s) attempt, single-flight machine-wide.
     let machineSuspended = false;
     let modeResolved = false;
     let runtimeBundleFlags = {};
     if (shieldId) {
         try {
-            const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({ apiUrl, shieldId, shieldKey, developerName: developerId(), machineName: os.hostname(), hotPath: true });
+            const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
+                apiUrl, shieldId, get shieldKey() { return shieldKey(); }, developerName: developerId(), machineName: os.hostname(), hotPath: true, viaDaemon: io.viaDaemon,
+                beforeNetwork: () => beforeVerdictNetworkWait('runtime policy refresh'),
+            });
             runtimeBundleFlags = bundle;
             // Kill-switch holds even on a 'default' bundle: with the cache missing
             // but a signed last-known-suspended marker standing, getRuntimeBundle
@@ -1639,12 +1697,19 @@ async function hookCommandInner(args, config, io) {
                 (0, hookIo_1.dbg)({ phase: 'mode_resolved', mode: bundle.mode, source: bundle.source, shadow, failClosed, suspended: machineSuspended });
             }
         }
-        catch { /* keep the local default */ }
+        catch (err) {
+            // The thin client took this call over (see beforeVerdictNetworkWait).
+            if (err instanceof DaemonDeclined)
+                throw err;
+            /* keep the local default */
+        }
     }
     // Shell AST mode: FCD_SHELL_AST_MODE env, else the bundle's `shellAstMode`
     // (server-controlled rollout), else shadow — facts recorded, verdicts unchanged.
     (0, shellAstLoader_1.applyShellAstMode)((0, shellAstLoader_1.resolveShellAstMode)(process.env.FCD_SHELL_AST_MODE, runtimeBundleFlags.shellAstMode));
     (0, hookIo_1.dbg)({ phase: 'shell_ast_mode', mode: (0, actionPolicyEngine_1.getShellAstMode)(), fromEnv: process.env.FCD_SHELL_AST_MODE, fromBundle: runtimeBundleFlags.shellAstMode });
+    if (io.exitsProcess && (0, actionPolicyEngine_1.getShellAstMode)() === 'primary')
+        void (0, shellAstLoader_1.ensureShellAst)();
     // Monitor-first: no authoritative bundle (fresh/uncached/fetch failed) => report-only.
     if (!modeResolved && !forceEnforce) {
         shadow = true;
@@ -1652,6 +1717,8 @@ async function hookCommandInner(args, config, io) {
     }
     if (forceEnforce && !modeResolved)
         shadow = false;
+    // Nothing recorded yet: a daemon whose client stopped waiting stops here.
+    await beforeVerdictSideEffects('verdict', shadow);
     // Keep device liveness fresh during active use (throttled, detached — never blocks).
     if (shieldId)
         (0, telemetry_1.triggerFlush)(false);
@@ -1758,7 +1825,7 @@ async function hookCommandInner(args, config, io) {
             }
             agentMsg = [prepared.agentMsg, agentMsg].filter(Boolean).join(' ');
         }
-        if (ask && !(0, devConfirm_1.isHumanPresent)()) {
+        if (ask && !(0, callerEnv_1.isHumanPresent)()) {
             // Nobody can answer an IDE ask here, and an agent in an auto-approve mode
             // (Claude Code bypass, Gemini CLI yolo) runs the action on an ask.
             (0, hookIo_1.dbg)({ phase: 'ask_without_human_denied', event, policyId: askEnvelope?.policyId });
@@ -1815,8 +1882,8 @@ async function hookCommandInner(args, config, io) {
         // developer's session (askDialog.ts); it is removed before the IDE reads the verdict.
         // The same client the runtime event records as `agentClient`: the dialog names the agent the console shows.
         if (ask && askEnvelope)
-            decision = (0, askDialog_1.attachAskEnvelope)(decision, { ...askEnvelope, agentClient: client });
-        (0, hookIo_1.dbg)({ phase: 'verdict', event, format: hookFormat, blocked, decision: ask && askEnvelope ? { ...decision, [askDialog_1.ASK_ENVELOPE_FIELD]: '(envelope)' } : decision });
+            decision = askDialog().attachAskEnvelope(decision, { ...askEnvelope, agentClient: client });
+        (0, hookIo_1.dbg)({ phase: 'verdict', event, format: hookFormat, blocked, decision: ask && askEnvelope ? { ...decision, [askDialog().ASK_ENVELOPE_FIELD]: '(envelope)' } : decision });
         if (hookFormat === 'claude' && event === 'prompt' && denied) {
             // Claude Desktop/Code variants do not all honor the structured
             // UserPromptSubmit decision consistently. Exit 2 is the documented hard
@@ -1877,7 +1944,7 @@ async function hookCommandInner(args, config, io) {
         await enforceActionPolicy({
             event, payload, apiUrl: apiUrl, shieldId: shieldId, shieldKey,
             shadow, failClosed, timeoutMs, approvalMode, approvalTimeoutMs, approvalPollMs, respond, deferLocalWarnings, deferLocalAsk, hasPendingLocalAsk,
-            effectivePolicyHash, localPolicies, client, exitsProcess: io.exitsProcess, viaDaemon: Boolean(io.viaDaemon),
+            effectivePolicyHash, localPolicies, client, exitsProcess: io.exitsProcess, deferGateReports: io.deferGateReports === true, viaDaemon: Boolean(io.viaDaemon),
             notePendingStop: (what) => {
                 io.pendingStop = what;
                 if (!io.viaDaemon)
@@ -1898,12 +1965,16 @@ async function hookCommandInner(args, config, io) {
         const snapshot = await (0, localSafetySnapshot_1.loadLocalSafetySnapshot)({
             apiUrl: apiUrl,
             shieldId: shieldId,
-            shieldKey,
+            get shieldKey() { return shieldKey(); },
             developerName: developerId(),
             machineName: os.hostname(),
             expectedPolicyHash: effectivePolicyHash,
             preferCached: shadow,
+            hotPath: true,
+            viaDaemon: io.viaDaemon,
+            beforeNetwork: () => beforeVerdictNetworkWait('Local Safety refresh'),
         });
+        await beforeVerdictSideEffects('prompt verdict', shadow);
         const promptOutcome = (0, deterministicGuard_1.resolveDeterministicOutcome)(opts => (0, deterministicGuard_1.scanDeterministicPrompt)(text, opts), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
         deferLocalWarnings(promptOutcome.warnings, 'prompt', 'prompt');
         // The prompt path only judges what is literally IN the text — a real secret
@@ -1918,7 +1989,7 @@ async function hookCommandInner(args, config, io) {
             if (shadow) {
                 // Truth-in-reporting: this prompt RAN (shadow/monitor) — 'warn', never 'block'.
                 spoolLocalFinding({ finding: localBlock, toolName: 'prompt', operation: 'prompt', decision: 'warn', recorded: 'would_block' });
-                respond(false, undefined, `[FullCourtDefense shadow] ${(0, blockExplanation_1.recordedReason)(localBlock.reason, 'would_block')}`);
+                respond(false, undefined, `[FullCourtDefense shadow] ${blockExplanation().recordedReason(localBlock.reason, 'would_block')}`);
                 return;
             }
             spoolLocalFinding({ finding: localBlock, toolName: 'prompt', operation: 'prompt' });
@@ -1947,6 +2018,42 @@ function declineInDaemon(ctx, what) {
     (0, hookIo_1.dbg)({ phase: 'daemon_declined', what });
     throw new DaemonDeclined(`${what}: runs in the hook process`);
 }
+/**
+ * The verdict is about to wait on the network (the synchronous gate, which is
+ * also what opens an org approval; the Shield text scan; an inline refresh of
+ * the policy bundle or the Local Safety snapshot). The client is told
+ * (announceNetworkWait). A client that already gave up is evaluating this call
+ * itself: hand it back rather than make the same call — or open the same
+ * approval — twice.
+ */
+function beforeVerdictNetworkWait(what) {
+    // Only a verdict-server request has a client to tell; a one-shot hook (the
+    // enforce core) never loads the server module for it.
+    if ((0, telemetry_1.verdictPathNow)() !== 'ipc' || verdictIpc().announceNetworkWait())
+        return;
+    (0, hookIo_1.dbg)({ phase: 'daemon_declined', what, reason: 'client_gone' });
+    throw new DaemonDeclined(`${what}: the hook took the call over`);
+}
+/**
+ * A phase boundary before the evaluation records anything or consumes
+ * anything (spool, taint, session memory, a maxUses developer grant). In the
+ * daemon, a thin client that stopped waiting is evaluating — and recording —
+ * the call itself: hand it back rather than decide it twice. A client stops
+ * waiting on an accepted call at its IDE wait cutoff, or — on a monitor
+ * machine whose hook can answer the call itself (the same allow) — at the
+ * give-up time it sent (MONITOR_IPC_BUDGET_MS after it asked; see
+ * clientStillWaiting). Elsewhere (a hook's own process, a replay of the local
+ * queue) it returns at once.
+ */
+async function beforeVerdictSideEffects(what, monitor) {
+    if ((0, telemetry_1.verdictPathNow)() !== 'ipc')
+        return;
+    const startedAt = (0, telemetry_1.verdictStartedAt)() ?? Date.now();
+    if (await verdictIpc().clientStillWaiting((0, callerEnv_1.ideWaitCutoff)(startedAt, (0, callerEnv_1.ideHookTimeoutMs)()), monitor))
+        return;
+    (0, hookIo_1.dbg)({ phase: 'daemon_declined', what, reason: 'client_gone' });
+    throw new DaemonDeclined(`${what}: the hook took the call over`);
+}
 /**
  * Approve-once for a taint-guard block: hold the action, alert the human at
  * the keyboard, and poll for their one-time decision from their OWN terminal
@@ -1976,7 +2083,7 @@ async function runTaintApproveOnce(ctx, event, call, sessId, taintFinding) {
         return hardBlock();
     // Approve-once is answered from the developer's own terminal: with nobody
     // there, the wait could only end in the IDE's timeout.
-    if (!(0, devConfirm_1.isHumanPresent)())
+    if (!(0, callerEnv_1.isHumanPresent)())
         return hardBlock();
     declineInDaemon(ctx, 'taint approve-once');
     const approval = (0, taintLedger_1.createTaintApproval)({
@@ -1994,7 +2101,7 @@ async function runTaintApproveOnce(ctx, event, call, sessId, taintFinding) {
         : 120000; // local developer decision — short window, they are at the keyboard
     const targetText = taintFinding.sink.targets.join(', ') || 'an external destination';
     // forceWindow: a toast can be swallowed by Focus Assist; this decision must be seen.
-    (0, notify_1.notifyOs)({
+    notify().notifyOs({
         forceWindow: true,
         title: 'FullCourtDefense — approve once?',
         message: `Agent action held: ${call.toolName} -> ${targetText}\n`
@@ -2017,7 +2124,7 @@ async function runTaintApproveOnce(ctx, event, call, sessId, taintFinding) {
             offlineEnforced: true,
         });
         (0, telemetry_1.triggerFlush)(true);
-        (0, notify_1.notifyOs)({ title: 'FullCourtDefense — approved once', message: `${call.toolName} -> ${targetText} will continue.` });
+        notify().notifyOs({ title: 'FullCourtDefense — approved once', message: `${call.toolName} -> ${targetText} will continue.` });
         return true;
     }
     spoolCallEvent(call, {
@@ -2034,6 +2141,59 @@ async function runTaintApproveOnce(ctx, event, call, sessId, taintFinding) {
     respond(true, explained.userMessage, `FullCourtDefense blocked this ${event} locally (${taintFinding.ruleId}): ${taintFinding.reason} The developer was asked and did not approve. Do not retry. ${explained.agentMessage}`);
     return false;
 }
+/**
+ * Native hooks: queue a block-mode local-first allow's check-tool-call report
+ * (gateReports.ts) instead of sending it from a process that exits with this
+ * verdict. The record spooled if it cannot be delivered is stamped now, as the
+ * failed immediate report's was. Inside the fast-probe window (a gate failure
+ * under 60 s old) the upload starts at this process's exit — the report may
+ * end that window for every process on the machine — instead of on the 30 s
+ * routine cadence. Evaluations that read gate health settle queued reports
+ * first either way (settleGateReports). The queue holds the body (its shield)
+ * and the fallback record only: whoever sends it uses its own configured API
+ * URL and key for that shield. False when nothing was queued (the caller
+ * spools).
+ */
+function queueAllowReport(ctx, call, ruleId, gateBody) {
+    try {
+        const decidedAt = Date.now();
+        const waitStartedAt = (0, telemetry_1.verdictStartedAt)();
+        const fallback = (0, telemetry_1.buildSpoolEvent)(callEvent(call, {
+            decision: 'allow', policyHash: ctx.effectivePolicyHash, ruleId,
+            reason: 'local policy allow (block mode, local-first); gate report failed — spooled', offlineEnforced: true,
+            occurredAt: new Date(decidedAt).toISOString(),
+            latencyMs: waitStartedAt === undefined ? undefined : Math.max(0, decidedAt - waitStartedAt),
+        }));
+        if (!gateReports().queueGateReport({ decidedAt, body: gateBody({ noNativeRead: true }), fallback }))
+            return false;
+        (0, telemetry_1.triggerFlush)((0, policyGateHealth_1.gateRecentlyDown)());
+        (0, hookIo_1.dbg)({ phase: 'gate_report_queued', event: ctx.event, tool: call.toolName });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Native allow reports queued on this machine land before this evaluation
+ * reads gate health or calls the gate (gateReports.ts settleGateReports).
+ */
+async function settleGateReports(ctx, forGateCall) {
+    try {
+        await gateReports().settleGateReports({
+            apiUrl: ctx.apiUrl,
+            shieldId: ctx.shieldId,
+            shieldKey: ctx.shieldKey,
+            forGateCall,
+            machineId: () => (0, machineIdentity_1.getMachineIdentity)().machineId,
+            spool: (fallback) => { (0, telemetry_1.appendSpoolEvent)(fallback); (0, telemetry_1.triggerFlush)(false); },
+            onSettled: (scope, outcome) => (0, hookIo_1.dbg)({
+                phase: 'gate_reports_settled', event: ctx.event, scope, ...outcome, ...(scope === 'streak' ? { gateDown: (0, policyGateHealth_1.gateRecentlyDown)() } : {}),
+            }),
+        });
+    }
+    catch { /* best-effort: the evaluation continues as it would have */ }
+}
 async function enforceActionPolicy(ctx) {
     const { event, payload, apiUrl, shieldId, shieldKey, shadow, timeoutMs, respond, deferLocalWarnings, deferLocalAsk, hasPendingLocalAsk, effectivePolicyHash } = ctx;
     const call = buildToolCall(event, payload);
@@ -2045,12 +2205,18 @@ async function enforceActionPolicy(ctx) {
     const snapshot = await (0, localSafetySnapshot_1.loadLocalSafetySnapshot)({
         apiUrl,
         shieldId,
-        shieldKey,
+        get shieldKey() { return shieldKey(); },
         developerName: developerId(),
         machineName: os.hostname(),
         expectedPolicyHash: effectivePolicyHash,
         preferCached: shadow,
+        hotPath: true,
+        viaDaemon: ctx.viaDaemon,
+        beforeNetwork: () => beforeVerdictNetworkWait('Local Safety refresh'),
     });
+    // From here the evaluation records (spool, taint, session memory) and may
+    // consume a developer grant: a daemon whose client stopped waiting stops.
+    await beforeVerdictSideEffects('action verdict', shadow);
     const toolOutcome = (0, deterministicGuard_1.resolveDeterministicOutcome)(opts => (0, deterministicGuard_1.scanDeterministicToolCall)(call.toolName, call.toolArgs, opts), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot, {
         cwd: typeof call.toolArgs.cwd === 'string' ? call.toolArgs.cwd : process.cwd(),
         inspectScripts: event === 'shell',
@@ -2063,7 +2229,7 @@ async function enforceActionPolicy(ctx) {
         if (shadow) {
             // Truth-in-reporting: this action RAN (shadow/monitor) — 'warn', never 'block'.
             spoolLocalFinding({ finding: localBlock, toolName: call.toolName, operation: event, decision: 'warn', recorded: 'would_block' });
-            respond(false, undefined, `[FullCourtDefense shadow] ${call.toolName}: ${(0, blockExplanation_1.recordedReason)(localBlock.reason, 'would_block')}`);
+            respond(false, undefined, `[FullCourtDefense shadow] ${call.toolName}: ${blockExplanation().recordedReason(localBlock.reason, 'would_block')}`);
             return;
         }
         spoolLocalFinding({ finding: localBlock, toolName: call.toolName, operation: event });
@@ -2078,11 +2244,11 @@ async function enforceActionPolicy(ctx) {
     //   no human (CI, ephemeral, FCD_HUMAN_PRESENT=0) -> block, never a silent allow.
     const localAsk = toolOutcome.askFinding;
     if (localAsk) {
-        (0, hookIo_1.dbg)({ phase: 'local_deterministic_ask', event, tool: call.toolName, ruleId: localAsk.ruleId, humanPresent: (0, devConfirm_1.isHumanPresent)(), shadow });
+        (0, hookIo_1.dbg)({ phase: 'local_deterministic_ask', event, tool: call.toolName, ruleId: localAsk.ruleId, humanPresent: (0, callerEnv_1.isHumanPresent)(), shadow });
         if (shadow) {
             spoolLocalFinding({ finding: localAsk, toolName: call.toolName, operation: event, decision: 'warn', recorded: 'would_ask' });
         }
-        else if (!(0, devConfirm_1.isHumanPresent)()) {
+        else if (!(0, callerEnv_1.isHumanPresent)()) {
             spoolLocalFinding({ finding: localAsk, toolName: call.toolName, operation: event });
             const explained = explainLocalSafetyStop('block', event, call, localAsk, 'This rule asks the developer to confirm, but no developer is present on this machine (CI / ephemeral), so it is blocked.');
             respond(true, explained.userMessage, `FullCourtDefense blocked this ${event} locally (${localAsk.ruleId}): the rule requires the developer's confirmation and no human is present here. Do not retry. ${explained.agentMessage}`);
@@ -2091,7 +2257,7 @@ async function enforceActionPolicy(ctx) {
         else {
             // Memory and grants bind to THIS rule (item + configured action), not to the
             // bundle hash the snapshot carries — that changes with any org edit or enrollment.
-            deferLocalAsk?.(localAsk, call, (0, devConfirm_1.localSafetyRuleHash)(localAsk, snapshot?.customBlocks));
+            deferLocalAsk?.(localAsk, call, devConfirm().localSafetyRuleHash(localAsk, snapshot?.customBlocks));
         }
     }
     // --- Taint-guard self-protection (always enforced before anything taint) ---
@@ -2142,9 +2308,15 @@ async function enforceActionPolicy(ctx) {
         respond(false);
         return;
     }
-    const headers = { 'Content-Type': 'application/json' };
-    if (shieldKey)
-        headers['x-shield-key'] = shieldKey;
+    // Built only when a request is actually sent: the key store and the machine
+    // id are not touched by a verdict decided locally.
+    const gateHeaders = () => {
+        const headers = { 'Content-Type': 'application/json' };
+        const key = shieldKey();
+        if (key)
+            headers['x-shield-key'] = key;
+        return headers;
+    };
     // MONITOR CONTRACT (latency half): a monitor/shadow machine makes ZERO
     // synchronous network calls — the developer never waits on the gate, not
     // even for the first event after a cache expiry. Cached org policies are
@@ -2164,7 +2336,7 @@ async function enforceActionPolicy(ctx) {
     }
     // The gate request body is shared by the synchronous check (approvals /
     // no-cache fallback) and the fire-and-forget audit report (local-first allow).
-    const gateBody = JSON.stringify({
+    const gateBody = (opts = {}) => JSON.stringify({
         shieldId,
         // For MCP calls this mirrors the gateway's runtime-agnostic per-server identity
         // (`<developer>-<server>`), so ONE per-agent policy matches the same server on the
@@ -2177,9 +2349,9 @@ async function enforceActionPolicy(ctx) {
         source: 'cursor_hook',
         // Lets the server record the effective approval scope (developer-scoped rules degrade
         // to org where nobody can answer an IDE prompt: CI, ephemeral workloads).
-        humanPresent: (0, devConfirm_1.isHumanPresent)(),
+        humanPresent: (0, callerEnv_1.isHumanPresent)(),
         ...(event === 'mcp' && mcpServerName(payload) ? { mcpServer: mcpServerName(payload) } : {}),
-        ...machineMetadata(ctx.client),
+        ...machineMetadata(ctx.client, opts),
     });
     const gateUrl = `${apiUrl}/api/agent-security/runtime/check-tool-call`;
     // BLOCK MODE, LOCAL-FIRST: the bundle's cached org policies (refreshed by
@@ -2215,24 +2387,44 @@ async function enforceActionPolicy(ctx) {
                 return;
             }
             if (ctx.exitsProcess) {
+                if (ctx.deferGateReports && queueAllowReport(ctx, call, localVerdict.policyId, gateBody)) {
+                    respond(false);
+                    return;
+                }
                 // Standalone hook (CI runner, container, daemon down): respond() ends
                 // the process, so a fire-and-forget gate report would die in flight and
                 // the allowed action would never reach the fleet — the machine would
-                // read "N blocked of N recent" with every allow missing. Same delivery
-                // as a block: spool (sync file append) + detached flusher that outlives
-                // this process. The IDE is not kept waiting on the network.
+                // read "N blocked of N recent" with every allow missing. The audit goes
+                // to the spool (sync file append) and rides the routine upload: at
+                // most one detached flusher per 30 s, started after the verdict — not
+                // one per allowed action. Blocks and findings still request theirs at
+                // once. The IDE is not kept waiting on the network.
                 spoolCallEvent(call, { decision: 'allow', policyHash: effectivePolicyHash, ruleId: localVerdict.policyId, reason: 'local policy allow (block mode, local-first)' });
-                (0, telemetry_1.triggerFlush)(true);
+                (0, telemetry_1.triggerFlush)(false);
                 respond(false);
                 return;
             }
             // Daemon-evaluated: the process lives on, so the audit rides async — the
             // server records the action + its own verdict; if it is unreachable the
-            // spool keeps the trail (idempotent on eventId).
-            void fetch(gateUrl, { method: 'POST', headers, body: gateBody, signal: AbortSignal.timeout(4000) })
+            // spool keeps the trail (idempotent on eventId). A failed report records
+            // the wait for THIS verdict, decided now — not the report's own 4 s
+            // timeout (or a sleep gap), which read as fake slow hooks in fleet health.
+            const decidedAt = Date.now();
+            const waitStartedAt = (0, telemetry_1.verdictStartedAt)();
+            const verdictLatencyMs = waitStartedAt === undefined ? undefined : Math.max(0, decidedAt - waitStartedAt);
+            // Off the verdict path, allow reports native hooks queued land first:
+            // they used to reach the server before this one (settleGateReports).
+            const body = gateBody();
+            void settleGateReports(ctx, true)
+                .then(() => fetch(gateUrl, { method: 'POST', headers: gateHeaders(), body, signal: AbortSignal.timeout(4000) }))
+                // Success only once the body arrived (same 4s signal covers it).
+                .then(resp => resp.text())
                 .then(() => (0, policyGateHealth_1.recordGateSuccess)())
                 .catch(() => {
-                spoolCallEvent(call, { decision: 'allow', policyHash: effectivePolicyHash, ruleId: localVerdict.policyId, reason: 'local policy allow (block mode, local-first); gate report failed — spooled', offlineEnforced: true });
+                spoolCallEvent(call, {
+                    decision: 'allow', policyHash: effectivePolicyHash, ruleId: localVerdict.policyId, reason: 'local policy allow (block mode, local-first); gate report failed — spooled', offlineEnforced: true,
+                    occurredAt: new Date(decidedAt).toISOString(), latencyMs: verdictLatencyMs,
+                });
                 (0, telemetry_1.triggerFlush)(false);
             });
             respond(false);
@@ -2261,6 +2453,10 @@ async function enforceActionPolicy(ctx) {
             declineInDaemon(ctx, 'org approval');
         }
     }
+    // Allow reports native hooks queued land first (they used to be sent before
+    // those processes exited): they may end a failure streak, and the server's
+    // verdict below reads the baseline they feed.
+    await settleGateReports(ctx, true);
     // PROXY RESILIENCE (fast probe): when the gate failed within the last 60s
     // (bank proxy without the api hostname allowlisted, backend outage), skip
     // the synchronous call entirely — the offline stance is decided in ~1ms from
@@ -2280,12 +2476,13 @@ async function enforceActionPolicy(ctx) {
     // 8s x 2 (~16s) — local-first above means almost no call ever waits here.
     const gateTimeoutMs = Math.min(timeoutMs, 4000);
     const gateAttempts = 2;
+    beforeVerdictNetworkWait('policy gate');
     let result;
     try {
         const resp = await fetchWithOneRetry(gateUrl, {
             method: 'POST',
-            headers,
-            body: gateBody,
+            headers: gateHeaders(),
+            body: gateBody(),
         }, gateTimeoutMs, (attempt, err) => (0, hookIo_1.dbg)({ phase: 'policy_retry', event, attempt, error: err }), gateAttempts);
         if (!resp.ok) {
             (0, hookIo_1.dbg)({ phase: 'policy_http_error', event, status: resp.status, failClosed: ctx.failClosed });
@@ -2299,7 +2496,7 @@ async function enforceActionPolicy(ctx) {
                 // (below) remain the best enforcement stance, but the distress code
                 // must say auth_broken so the org-admin alert email names the real
                 // fix (re-enroll) instead of "check connectivity".
-                (0, distress_1.reportDistress)('hook', distress_1.DISTRESS.AUTH_BROKEN, `check-tool-call HTTP ${resp.status}${shieldKey ? '' : ' (no shield key resolved)'}`);
+                (0, distress_1.reportDistress)('hook', distress_1.DISTRESS.AUTH_BROKEN, `check-tool-call HTTP ${resp.status}${shieldKey() ? '' : ' (no shield key resolved)'}`);
             }
             else if (failure === 'rejected') {
                 (0, distress_1.reportDistress)('hook', distress_1.DISTRESS.BACKEND_REJECTED, `check-tool-call HTTP ${resp.status}${backendReason ? `: ${backendReason}` : ''}`);
@@ -2359,9 +2556,9 @@ async function enforceActionPolicy(ctx) {
             respond(false, undefined, `[FullCourtDefense shadow] would require approval for ${call.toolName}${policyName ? ` (${policyName})` : ''}: ${reason}`);
             return;
         }
-        const queueUrl = (0, notify_1.approvalsConsoleUrl)();
+        const queueUrl = notify().approvalsConsoleUrl();
         if (ctx.approvalMode === 'block' || !result.approvalActionId) {
-            (0, notify_1.notifyOs)({
+            notify().notifyOs({
                 title: 'FullCourtDefense — approval required',
                 message: `${call.toolName} needs human approval${policyName ? ` (${policyName})` : ''}.`,
                 url: queueUrl,
@@ -2378,22 +2575,22 @@ async function enforceActionPolicy(ctx) {
         // Make the wait visible on the machine: the hook process has no UI and its
         // stderr is invisible inside IDEs, so a native toast is the only reliable
         // signal that a human needs to act NOW (the approval window is minutes).
-        (0, notify_1.notifyOs)({
+        notify().notifyOs({
             title: 'FullCourtDefense — approval required',
             message: `${call.toolName} is paused waiting for human approval${policyName ? ` (${policyName})` : ''}. Approve or reject in the console.`,
             url: queueUrl,
         });
         const outcome = await waitForApproval({
-            apiUrl, shieldId, shieldKey, actionId: result.approvalActionId,
+            apiUrl, shieldId, shieldKey: shieldKey(), actionId: result.approvalActionId,
             deadline: humanWaitDeadline(ctx.approvalTimeoutMs), pollMs: ctx.approvalPollMs,
         });
         if (outcome.status === 'approved') {
             ctx.notePendingStop('');
-            (0, notify_1.notifyOs)({ title: 'FullCourtDefense — approved', message: `${call.toolName} was approved and will continue.` });
+            notify().notifyOs({ title: 'FullCourtDefense — approved', message: `${call.toolName} was approved and will continue.` });
             respond(false, undefined, `FullCourtDefense: human approved this ${event}.`);
             return;
         }
-        (0, notify_1.notifyOs)({
+        notify().notifyOs({
             title: 'FullCourtDefense — not approved',
             message: `${call.toolName}: ${outcome.message}`,
             url: outcome.status === 'timeout' ? queueUrl : undefined,
@@ -2460,6 +2657,8 @@ async function enforceShieldText(ctx) {
         (0, telemetry_1.triggerFlush)(false);
         respond(false);
     }
+    // Queued native allow reports that may end a failure streak land first.
+    await settleGateReports(ctx, false);
     // PROXY RESILIENCE (fast probe): same rule as the action-policy gate — a
     // recently-failed gate is not re-probed on every prompt; the degraded stance
     // resolves instantly instead of paying the full timeout per event.
@@ -2470,6 +2669,7 @@ async function enforceShieldText(ctx) {
     }
     const gateTimeoutMs = timeoutMs;
     const gateAttempts = 2;
+    beforeVerdictNetworkWait('Shield text scan');
     try {
         const headers = {
             'Content-Type': 'application/json',
@@ -2478,8 +2678,9 @@ async function enforceShieldText(ctx) {
             'x-session-id': sessionId(payload),
             ...attributionFor(event, payload),
         };
-        if (shieldKey)
-            headers['x-shield-key'] = shieldKey;
+        const key = shieldKey();
+        if (key)
+            headers['x-shield-key'] = key;
         const resp = await fetchWithOneRetry(`${apiUrl}/api/shield/proxy/${shieldId}`, {
             method: 'POST',
             headers,
@@ -2491,9 +2692,9 @@ async function enforceShieldText(ctx) {
             respondDegraded(ctx, gateHttpFailureDetail(failure, resp.status, backendReason, 'Shield service'), 'prompt', failure);
             return;
         }
-        // A clean round-trip ends any failure streak (grace-window state).
-        (0, policyGateHealth_1.recordGateSuccess)();
         const data = await resp.json().catch(() => ({}));
+        // A clean round-trip — body included — ends any failure streak.
+        (0, policyGateHealth_1.recordGateSuccess)();
         const sh = (data._shield || {});
         const action = String(sh.action || '');
         const isBlocked = action.startsWith('blocked');