granttap-mcp 0.8.16 → 0.8.18

package/LICENSE

@@ -1,86 +1,21 @@
-GrantTap Commercial Source License 1.0
-
-Copyright (c) 2026 Serhii Ziborov. All rights reserved.
-
-This license governs the source code and software distributed from the
-granttap-mcp repository and package (the "Software"), except for third-party
-components that identify their own license terms.
-
-1. Definitions
-
-"GrantTap" means Serhii Ziborov doing business as GrantTap.
-
-"Authorized Access" means an active paid GrantTap subscription, an official
-GrantTap trial, or a separate written commercial agreement with GrantTap.
-
-"Authorized User" means a person or legal entity covered by Authorized Access.
-
-2. Source inspection and contribution
-
-You may download, inspect, and make local modifications to the source solely to
-evaluate the Software, perform security review, or prepare a contribution to
-the official GrantTap repository. You may create a public fork solely for that
-contribution workflow if the fork retains this license and does not publish a
-release, binary, hosted service, or independently usable distribution.
-
-These rights do not permit production use, commercial use, or use to provide a
-service to another person.
-
-3. Authorized product use
-
-During Authorized Access, GrantTap grants the Authorized User a limited,
-non-exclusive, non-transferable, non-sublicensable license to install, execute,
-and internally modify the Software on devices the Authorized User owns or
-controls, solely to use the official GrantTap product and services.
-
-When Authorized Access ends, the Authorized User must stop using the Software
-except where a separate written agreement says otherwise.
-
-4. Restrictions
-
-Unless GrantTap gives prior written permission, you may not:
-
-- sell, sublicense, redistribute, or publish the Software or a derivative work;
-- offer the Software or a derivative work as a hosted or managed service;
-- use the Software to build or operate a competing product or service;
-- use the Software as a standalone general-purpose coding-agent runtime outside
-  the official GrantTap product;
-- bypass subscription, license, access-control, or entitlement checks;
-- remove or alter copyright, license, attribution, or proprietary notices; or
-- use GrantTap names or marks to imply endorsement of a modified distribution.
-
-5. Ownership
-
-The Software is licensed, not sold. GrantTap retains all right, title, and
-interest in the Software and its derivative works. No trademark, patent, or
-other rights are granted except the limited copyright rights stated here.
-
-6. Third-party components
-
-Third-party components remain governed by their respective licenses. Those
-licenses and notices are not replaced by this license. See
-THIRD_PARTY_NOTICES.md where distributed.
-
-7. Termination
-
-This license terminates automatically if you breach its terms. On termination,
-you must stop using and distributing the Software and delete copies that you
-are not legally required to retain. Sections 4 through 9 survive termination.
-
-8. Disclaimer of warranty
-
-THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF
-ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS
-FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.
-
-9. Limitation of liability
-
-TO THE MAXIMUM EXTENT PERMITTED BY LAW, GRANTTAP AND ITS CONTRIBUTORS WILL NOT
-BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR
-PUNITIVE DAMAGES, OR FOR LOSS OF DATA, PROFITS, REVENUE, OR BUSINESS, ARISING
-FROM OR RELATED TO THE SOFTWARE OR THIS LICENSE.
-
-10. Commercial terms
-
-Authorized Access, pricing, and separate commercial licenses are available
-through https://granttap.com.
+MIT License
+
+Copyright (c) 2026 Serhii Ziborov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -2,7 +2,7 @@
 
 [![npm](https://img.shields.io/npm/v/granttap-mcp)](https://www.npmjs.com/package/granttap-mcp)
 [![CI](https://github.com/sergii-ziborov/granttap-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/sergii-ziborov/granttap-mcp/actions/workflows/ci.yml)
-[![License](https://img.shields.io/badge/license-GrantTap%20Commercial-7c3aed.svg)](LICENSE)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
 GrantTap is a Personal live control center for local coding agents.
 
@@ -13,9 +13,9 @@ hooks, local adapters, and TypeScript wire schemas. Agents and provider
 credentials stay on your computer. Native iPhone and Apple Watch traffic is
 end-to-end encrypted.
 
-The source is public for inspection and contribution, but GrantTap MCP is
-proprietary paid software rather than open source. Production use requires an
-active GrantTap subscription or a separate commercial agreement.
+The MCP runtime, plugins, and CLI are open source under the MIT License. The
+iPhone and Apple Watch app is a separate, proprietary product; use of GrantTap's
+hosted service is governed by its own terms.
 
 [Website](https://granttap.com) · [npm](https://www.npmjs.com/package/granttap-mcp) ·
 [Security model](SECURITY.md) ·
@@ -54,15 +54,38 @@ and completion events through the existing `notify` tool, and read state from a
 Mesh resource. Full transcripts and hidden reasoning are never mesh payloads.
 Claims have TTLs; a colliding claim is rejected before it is recorded so agents
 can choose different work or contact the owner before escalating to Needs You.
+Observed edit-tool requests are intent claims, not confirmed writes. Resource
+identity includes the repository; equal relative paths from separate repositories
+do not conflict, and another checkout is a coordination warning. The path
+matcher respects segment boundaries, so `src/auth.ts` and `src/auth.ts.bak`
+are distinct. A live repository reading refreshes HEAD after commit or checkout.
+
+When a separately distributed, verified GrantTap Engine is enabled on the
+computer, the bridge sends content-free Invocation events before its small Usage
+buffer is trimmed. Claude Code, Codex, and Cursor transcript scanners record
+native call identity, request, reported outcome, resource path, and explicit
+source gaps. The Engine owns the durable journal and bounded cursor history;
+the phone requests the latest or older page under the Project E2EE key. A
+reported successful tool call alone does not prove a filesystem change, and
+unavailable Engine history is reported as unavailable.
+The bridge does not yet produce verified filesystem-change events or attach
+revision-bound impact/consumer links to individual Invocations. It leaves that
+evidence unknown instead of treating an edit request or reported success as a
+confirmed content change.
+Claude Code and Codex denials with native call IDs are recorded as separate,
+metadata-only hook events with the applied rule and policy revision; an
+unidentified Cursor decision is not assigned to an invented call. Script and
+`SKILL.md` fingerprints include a content hash when the local file is readable,
+separate from their path identity. Missing content evidence remains unknown.
 
 <p align="center">
   <img src="docs/images/iphone-projects-shared.png" width="200" alt="Projects: one owned by this phone, one shared by another">
   <img src="docs/images/iphone-project-mesh.png" width="200" alt="A Project: Governance, members and computers, Mesh status, repositories, Tasks">
-  <img src="docs/images/iphone-task-route.png" width="200" alt="A Task: its executions, its claims, and who else is in its files">
+  <img src="docs/images/iphone-task-route.png" width="200" alt="A Task: executions, Runtime history, and resource claims">
   <img src="docs/images/iphone-handoff.png" width="200" alt="Task handoff: destination, push, and readiness checks">
 </p>
 
-<p align="center"><em>Projects, one of them shared by another phone · a Project with its Governance, members, computers, repositories, and Tasks · a Task with its executions and claims · a handoff with its readiness checks</em></p>
+<p align="center"><em>Projects, one of them shared by another phone · a Project with its Governance, members, computers, repositories, and Tasks · a Task with executions, Runtime history, and claims · a handoff with its readiness checks</em></p>
 
 For Claude Code, Codex, and Cursor, the provider hook runs inside the agent's
 own session and sees the exact call. GrantTap attributes every `notify` to the
@@ -204,8 +227,8 @@ history stays on the device.
 
 ## Install
 
-Installation and production use require Authorized Access under the
-[GrantTap Commercial Source License](LICENSE).
+The local runtime and plugins are available under the [MIT License](LICENSE).
+The iPhone and Apple Watch app and hosted service have separate terms.
 
 Install the GrantTap plugin directly from this repository's marketplace:
 
@@ -223,8 +246,9 @@ grok plugin marketplace add sergii-ziborov/granttap-mcp
 grok plugin install granttap --trust
 ```
 
-Import `sergii-ziborov/granttap-mcp` as a private Git plugin in Cursor. A public
-listing requires an open-source plugin license and Cursor review. Reload Cursor, then open
+For Cursor, use the reviewed **GrantTap** Marketplace listing when it is visible
+to your account, or import the public `sergii-ziborov/granttap-mcp` repository
+once. Reload Cursor, then open
 **Cursor Customize → MCPs → GrantTap → Authenticate**. Complete authorization
 and any one-time QR pairing on `https://granttap.com/connect`.
 
@@ -521,9 +545,8 @@ typecheck, and release checks pass.
 
 ## License
 
-GrantTap MCP is distributed under the proprietary
-[GrantTap Commercial Source License 1.0](LICENSE). Public source access does not
-grant open-source, redistribution, hosted-service, or competing-product rights.
+GrantTap MCP, its CLI, and bundled plugins are distributed under the
+[MIT License](LICENSE). The iPhone and Apple Watch app is licensed separately.
 Third-party dependencies retain their own terms; see
 [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
 

package/THIRD_PARTY_NOTICES.md

@@ -1,8 +1,8 @@
 # Third-party notices
 
-GrantTap MCP is proprietary software distributed under the GrantTap Commercial
-Source License. Third-party components retain their own licenses; the GrantTap
-license does not replace or restrict those terms.
+GrantTap MCP is distributed under the MIT License. Third-party components
+retain their own licenses; the GrantTap license does not replace or restrict
+those terms.
 
 The npm package declares, rather than vendors, these direct runtime
 dependencies. Their packages carry the applicable license texts:

package/apps/bridge/src/bin/claude-hook.ts

@@ -88,6 +88,9 @@ async function handlePreToolUse(input: HookInput): Promise<void> {
       recordProjectDecision(input.session_id, {
         at: Date.now(), toolName: input.tool_name ?? "tool", reason: projectDecision.reason,
         ruleId: projectDecision.rule_id,
+        provider: "claude", nativeCallId: input.tool_use_id,
+        policyRevision: projectDecision.policy_revision,
+        artifactHash: projectDecision.artifactHash,
       });
     }
     writePermission("deny", projectDecision.reason);

package/apps/bridge/src/bin/codex-policy-hook.ts

@@ -43,6 +43,9 @@ async function main(): Promise<void> {
     if (input.session_id) {
       recordProjectDecision(input.session_id, {
         at: Date.now(), toolName: input.tool_name ?? "tool", reason: decision.reason, ruleId: decision.rule_id,
+        provider: "codex", nativeCallId: input.tool_use_id,
+        policyRevision: decision.policy_revision,
+        artifactHash: decision.artifactHash,
       });
     }
     deny(decision.reason);

package/apps/bridge/src/capabilities/README.md

@@ -2,4 +2,4 @@
 
 This module discovers provider-configured MCP servers and available skills. Metadata probing is isolated because it may start an MCP transport; local descriptors and skill discovery remain read-only.
 
-License: this module is distributed under the GrantTap Commercial Source License in the repository-root `LICENSE` file.
+License: this module is distributed under the MIT License in the repository-root `LICENSE` file.

package/apps/bridge/src/capabilities/skills.ts

@@ -7,6 +7,30 @@ import { ancestors } from "./descriptors";
 /** Skills available globally and along the task's repository path. */
 export function workspaceSkills(cwd: string | undefined): SkillInfo[] {
   const found = new Map<string, SkillInfo>();
+  for (const root of skillRoots(cwd)) {
+    for (const skill of skillsIn(root)) {
+      if (!found.has(skill.name)) found.set(skill.name, skill);
+    }
+  }
+  return [...found.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/** The source file behind a named skill, in the same precedence as the catalog. */
+export function skillDefinitionPath(name: string, cwd: string | undefined): string | undefined {
+  for (const root of skillRoots(cwd)) {
+    let entries: string[];
+    try { entries = readdirSync(root); }
+    catch { continue; }
+    for (const entry of entries) {
+      if (entry.startsWith(".")) continue;
+      const path = join(root, entry, "SKILL.md");
+      if (frontmatter(path)?.name === name) return path;
+    }
+  }
+  return undefined;
+}
+
+function skillRoots(cwd: string | undefined): string[] {
   const roots = [
     join(homedir(), ".cursor", "skills-cursor"),
     join(homedir(), ".agents", "skills"),
@@ -21,12 +45,7 @@ export function workspaceSkills(cwd: string | undefined): SkillInfo[] {
       );
     }
   }
-  for (const root of roots) {
-    for (const skill of skillsIn(root)) {
-      if (!found.has(skill.name)) found.set(skill.name, skill);
-    }
-  }
-  return [...found.values()].sort((a, b) => a.name.localeCompare(b.name));
+  return roots;
 }
 
 function skillsIn(root: string): SkillInfo[] {

package/apps/bridge/src/config/README.md

@@ -6,5 +6,5 @@ and device pairing serialization. `../config.ts` is its public entry point.
 Behavior is covered by `tests/config.test.ts`, `tests/capabilities.test.ts`, and
 `tests/core.test.ts`.
 
-License: this module is distributed under the GrantTap Commercial Source License
+License: this module is distributed under the MIT License
 in the repository-root `LICENSE` file.

package/apps/bridge/src/engine/README.md

@@ -17,9 +17,19 @@ bypass, paused gating, and auto-accept. Codex carries ASK from `PreToolUse` to
 `PermissionRequest` with a single-use exact-call marker; Cursor evaluates shell
 and redacted MCP fingerprints directly. A disabled or unavailable engine
 preserves the established GrantTap flow, and no hook request is retried inside
-its 50 ms policy budget.
+its 2,000 ms policy budget. Repository impact is not computed synchronously in
+the hook; unavailable impact remains explicitly unavailable.
+
+`invocation-ingest.ts` reads bounded complete transcript lines and exact-call
+hook denial metadata without forwarding tool arguments, output, or reason text.
+Cursor decisions without a native call ID stay unattributed. Events are replayed
+with stable IDs after an IPC failure. `invocation-query.ts` returns bounded
+Engine history to the phone under the Project key, while
+`invocation-scope.ts` exposes one Task slice through the caller's existing
+opaque Mesh capability. The Engine, not this bridge or Usage telemetry, owns
+the durable journal.
 
 The proprietary engine source and Project database do not live in this package.
 
-License: this module is distributed under the GrantTap Commercial Source License
+License: this module is distributed under the MIT License
 in the repository-root `LICENSE` file.

package/apps/bridge/src/engine/engine-client.ts

@@ -196,6 +196,8 @@ function expectedResultOperation(
   if (operation === "project.get") return "project.found";
   if (operation === "project.list_bindings") return "project.bindings";
   if (operation === "project.upsert_binding") return "project.binding_upserted";
+  if (operation === "invocation.observe") return "invocation.observed";
+  if (operation === "invocation.history") return "invocation.history";
   if (operation === "policy.get") return "policy.found";
   if (operation === "policy.apply") return "policy.applied";
   if (operation === "policy.coverage") return "policy.coverage";

package/apps/bridge/src/engine/engine-invocation-protocol.ts

@@ -0,0 +1,117 @@
+/** The Engine's content-free, durable per-call evidence wire contract. */
+export type InvocationPhase =
+  | "requested" | "reported_success" | "reported_failure" | "reported_unknown"
+  | "denied" | "change_observed" | "source_gap";
+export type InvocationSource = "transcript" | "hook" | "filesystem" | "scanner";
+
+export type InvocationEvent = {
+  event_id: string;
+  invocation_id: string;
+  project_id: string;
+  task_id: string;
+  execution_id: string;
+  provider: string;
+  native_call_id: string;
+  session_id?: string | null;
+  tool_name: string;
+  phase: InvocationPhase;
+  source: InvocationSource;
+  occurred_at: number;
+  repository_id?: string | null;
+  worktree?: string | null;
+  resource?: string | null;
+  revision?: string | null;
+  content_hash?: string | null;
+  capability_artifact_hash?: string | null;
+  policy_revision?: number | null;
+  policy_rule_id?: string | null;
+};
+
+export type InvocationHistoryQuery = {
+  project_id: string;
+  task_id?: string | null;
+  after_sequence?: number | null;
+  limit?: number | null;
+  tail?: boolean;
+  before_sequence?: number | null;
+};
+
+export type SequencedInvocationEvent = { sequence: number; event: InvocationEvent };
+export type InvocationHistoryPage = {
+  events: SequencedInvocationEvent[];
+  next_sequence: number;
+  has_more: boolean;
+  previous_sequence: number;
+  has_older: boolean;
+};
+
+export type InvocationEngineOperation =
+  | { operation: "invocation.observe"; input: InvocationEvent }
+  | { operation: "invocation.history"; input: InvocationHistoryQuery };
+export type InvocationEngineResult =
+  | { operation: "invocation.observed"; sequence: number }
+  | { operation: "invocation.history"; page: InvocationHistoryPage };
+
+const phases = new Set<InvocationPhase>([
+  "requested", "reported_success", "reported_failure", "reported_unknown",
+  "denied", "change_observed", "source_gap",
+]);
+const sources = new Set<InvocationSource>(["transcript", "hook", "filesystem", "scanner"]);
+
+export function parseInvocationResult(result: Record<string, unknown>, invalid: () => never): boolean {
+  if (result.operation === "invocation.observed") {
+    if (!positiveInteger(result.sequence)) invalid();
+    return true;
+  }
+  if (result.operation !== "invocation.history") return false;
+  const page = record(result.page, invalid);
+  if (!Array.isArray(page.events) || page.events.length > 32
+    || !safeInteger(page.next_sequence) || typeof page.has_more !== "boolean"
+    || !safeInteger(page.previous_sequence) || typeof page.has_older !== "boolean") invalid();
+  let prior = 0;
+  for (const raw of page.events as unknown[]) {
+    const row = record(raw, invalid);
+    if (!positiveInteger(row.sequence) || row.sequence <= prior || row.sequence > page.next_sequence) invalid();
+    prior = row.sequence;
+    parseInvocationEvent(row.event, invalid);
+  }
+  return true;
+}
+
+function parseInvocationEvent(value: unknown, invalid: () => never): void {
+  const event = record(value, invalid);
+  for (const [key, max] of [
+    ["event_id", 128], ["invocation_id", 128], ["project_id", 128], ["task_id", 128],
+    ["execution_id", 128], ["provider", 32], ["native_call_id", 128], ["tool_name", 160],
+  ] as const) boundedString(event[key], max, invalid);
+  if (!phases.has(event.phase as InvocationPhase) || !sources.has(event.source as InvocationSource)
+    || !safeInteger(event.occurred_at)) invalid();
+  for (const key of ["repository_id", "worktree", "resource", "revision"] as const) {
+    if (event[key] != null) boundedString(event[key], 512, invalid);
+  }
+  if (event.session_id != null) boundedString(event.session_id, 128, invalid);
+  for (const key of ["content_hash", "capability_artifact_hash"] as const) {
+    if (event[key] != null && (typeof event[key] !== "string" || !/^[a-f0-9]{64}$/i.test(event[key]))) invalid();
+  }
+  if (event.policy_revision != null && !safeInteger(event.policy_revision)) invalid();
+  if (event.policy_rule_id != null) boundedString(event.policy_rule_id, 128, invalid);
+  if (event.phase === "change_observed" && (event.source !== "filesystem"
+    || !event.repository_id || !event.resource || !event.revision || !event.content_hash)) invalid();
+}
+
+function record(value: unknown, invalid: () => never): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) invalid();
+  return value as Record<string, unknown>;
+}
+
+function safeInteger(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+
+function positiveInteger(value: unknown): value is number {
+  return safeInteger(value) && value > 0;
+}
+
+function boundedString(value: unknown, max: number, invalid: () => never): void {
+  if (typeof value !== "string" || value.trim() === "" || value.length > max || /[\u0000-\u001f]/.test(value)) invalid();
+}

package/apps/bridge/src/engine/engine-protocol.ts

@@ -3,6 +3,15 @@ import {
   type EnginePolicyOperation,
   type EnginePolicyResult,
 } from "./engine-policy-protocol";
+import {
+  parseInvocationResult,
+  type InvocationEngineOperation,
+  type InvocationEngineResult,
+} from "./engine-invocation-protocol";
+
+export type {
+  InvocationEvent, InvocationHistoryPage, InvocationHistoryQuery, InvocationPhase, InvocationSource,
+} from "./engine-invocation-protocol";
 
 export const ENGINE_PROTOCOL_VERSION = 1 as const;
 export const MAX_ENGINE_FRAME_BYTES = 64 * 1024;
@@ -53,7 +62,7 @@ export type EngineProjectBinding = {
   last_seen_at: number;
 };
 
-export type EngineOperation = EnginePolicyOperation
+export type EngineOperation = EnginePolicyOperation | InvocationEngineOperation
   | { operation: "engine.ping" }
   | { operation: "engine.version" }
   | {
@@ -77,7 +86,7 @@ export type EngineRequest = {
   request_id: string;
 } & EngineOperation;
 
-export type EngineResult = EnginePolicyResult
+export type EngineResult = EnginePolicyResult | InvocationEngineResult
   | { operation: "engine.pong"; engine_version: string }
   | {
     operation: "engine.version";
@@ -202,7 +211,8 @@ function parseResult(value: unknown): EngineResult {
     result.bindings.forEach(parseBinding);
   } else if (operation === "project.binding_upserted") {
     parseBinding(result.binding);
-  } else if (!parsePolicyResult(result, invalidResult)) {
+  } else if (!parsePolicyResult(result, invalidResult)
+    && !parseInvocationResult(result, invalidResult)) {
     throw new EngineProtocolError("engine result operation is unsupported");
   }
   return result as EngineResult;

package/apps/bridge/src/engine/invocation-decision-parse.ts

@@ -0,0 +1,35 @@
+import { sourceGapFact, type InvocationFact } from "./invocation-parse";
+
+/** Metadata-only hook refusal. No arguments, outputs, or explanation text. */
+export function parseInvocationDecision(
+  line: string, provider: "claude" | "codex" | "cursor", offset: number,
+): InvocationFact[] {
+  let value: unknown;
+  try { value = JSON.parse(line) as unknown; }
+  catch { return [sourceGapFact(offset)]; }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return [sourceGapFact(offset)];
+  }
+  const record = value as Record<string, unknown>;
+  if (record.provider !== provider) return [];
+  if (typeof record.nativeCallId !== "string" || !record.nativeCallId.trim()
+    || record.nativeCallId.length > 128 || /[\u0000-\u001f]/.test(record.nativeCallId)
+    || typeof record.toolName !== "string" || !record.toolName.trim()
+    || record.toolName.length > 160 || /[\u0000-\u001f]/.test(record.toolName)
+    || typeof record.at !== "number" || !Number.isSafeInteger(record.at) || record.at < 0) {
+    return [sourceGapFact(offset)];
+  }
+  const revision = record.policyRevision;
+  const rule = record.ruleId;
+  const artifact = record.artifactHash;
+  return [{
+    callId: record.nativeCallId, toolName: record.toolName, phase: "denied",
+    source: "hook", occurredAt: record.at,
+    ...(typeof revision === "number" && Number.isSafeInteger(revision) && revision >= 0
+      ? { policyRevision: revision } : {}),
+    ...(typeof rule === "string" && rule.trim() && rule.length <= 128
+      && !/[\u0000-\u001f]/.test(rule) ? { policyRuleId: rule } : {}),
+    ...(typeof artifact === "string" && /^[a-f0-9]{64}$/i.test(artifact)
+      ? { capabilityArtifactHash: artifact.toLowerCase() } : {}),
+  }];
+}