conduct-cli 0.6.37__tar.gz → 0.7.1__tar.gz

{conduct_cli-0.6.37 → conduct_cli-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.6.37
+Version: 0.7.1
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.6.37 → conduct_cli-0.7.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.6.37"
+version = "0.7.1"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.6.37 → conduct_cli-0.7.1}/src/conduct_cli/guard.py

@@ -751,9 +751,11 @@ def cmd_guard_install(args):
         # even when POLICY_PATH is missing or unreadable.
         cfg = _load_guard_config()
         cfg["fail_mode"] = policy.get("fail_mode", "fail_open")
+        cfg["advisory_mode"] = policy.get("advisory_mode", False)
         _save_guard_config(cfg)
         rule_count = len(policy.get("rules", []))
-        print(f"  {GREEN}Guard policies:{RESET} {rule_count} rule(s) active · fail mode: {cfg['fail_mode']}")
+        advisory_label = " · advisory" if cfg["advisory_mode"] else ""
+        print(f"  {GREEN}Guard policies:{RESET} {rule_count} rule(s) active · fail mode: {cfg['fail_mode']}{advisory_label}")
     except SystemExit:
         rule_count = 0
 
@@ -2444,6 +2446,185 @@ def cmd_guard_debug_hook(args):
     print(f"\n{BOLD}Exit code:{RESET} {exit_label}")
 
 
+# ── OWASP Agentic Top 10 mapping ──────────────────────────────────────────────
+
+_PRIV_KEYWORDS = ["privilege", "escalat", "role_abuse", "admin_access", "no-sudo", "nosudo", "runasroot"]
+
+_OWASP_MAP: list[tuple[list[str], str, str]] = [
+    (["prompt_inject", "injection", "jailbreak", "override_system", "indirect_prompt"],
+     "A01", "Prompt Injection"),
+    (["secret", "credential", "token_leak", "api_key_leak", "password", "sensitive_data", "pii", "exfil"],
+     "A02", "Sensitive Information Disclosure"),
+    (["supply_chain", "dependency", "package", "malicious_package", "unsigned"],
+     "A03", "Supply Chain Vulnerabilities"),
+    (["excessive_agency", "no-rm-rf", "norms", "rmrf", "scope", "overreach", "unauthorized_action", "out_of_scope", "shell_destruct"],
+     "A04", "Excessive Agency"),
+    (["model_theft", "model_extract", "weights"],
+     "A05", "Model Theft"),
+    (["communication", "callback", "exfiltrate_output", "covert_channel"],
+     "A06", "Agentic Communication Vulnerabilities"),
+    (["unmonitored", "no_audit", "policy_eval_error", "policy_signature_invalid"],
+     "A07", "Insufficient Monitoring and Logging"),
+    (["hallucin", "unverified", "over_reliance", "fabricat"],
+     "A08", "Over-reliance on Model Outputs"),
+    (_PRIV_KEYWORDS,
+     "A09", "Privilege Escalation"),
+    (["budget", "rate_limit", "dos", "denial", "hard_cap", "spend"],
+     "A10", "Model Denial of Service"),
+]
+
+_OWASP_UNKNOWN = ("A??", "Uncategorised")
+
+
+def _map_owasp(rule_id: str) -> tuple[str, str]:
+    key = (rule_id or "").lower()
+    for keywords, code, title in _OWASP_MAP:
+        if any(k in key for k in keywords):
+            return code, title
+    return _OWASP_UNKNOWN
+
+
+def cmd_verify(args) -> None:
+    """conduct verify — map guard audit events to OWASP Agentic Top 10; exit non-zero in CI."""
+    import json as _json
+    import datetime as _dt
+
+    evidence_path = getattr(args, "evidence", None)
+    strict        = getattr(args, "strict", False)
+    fmt           = getattr(args, "format", "text")
+    since_str     = getattr(args, "since", None) or "24h"
+
+    # ── load events ──────────────────────────────────────────────────────────
+    if evidence_path:
+        try:
+            raw = _json.loads(Path(evidence_path).read_text())
+        except FileNotFoundError:
+            print(f"{RED}✗ File not found: {evidence_path}{RESET}", file=sys.stderr)
+            sys.exit(2)
+        except _json.JSONDecodeError as exc:
+            print(f"{RED}✗ Invalid JSON: {exc}{RESET}", file=sys.stderr)
+            sys.exit(2)
+        events = raw if isinstance(raw, list) else raw.get("events", [])
+    else:
+        cfg          = _require_guard_config()
+        workspace_id = cfg.get("workspace_id")
+        user_email   = cfg.get("user_email", "")
+        api_key      = cfg.get("api_key", "")
+        base_url     = _api_url(cfg)
+        since_iso    = _parse_since(since_str)
+        resp = _req(
+            "GET",
+            (
+                f"{base_url}/guard/events"
+                f"?workspace_id={workspace_id}"
+                f"&user_email={user_email}"
+                f"&since={since_iso}"
+                f"&limit=200"
+            ),
+            api_key=api_key,
+        )
+        events = resp if isinstance(resp, list) else resp.get("events", [])
+
+    if not events:
+        if fmt == "json":
+            print(_json.dumps({"status": "pass", "violations": 0, "findings": []}, indent=2))
+        else:
+            print(f"{GREEN}✓ No guard events found — nothing to verify.{RESET}")
+        return
+
+    # ── classify ──────────────────────────────────────────────────────────────
+    findings: list[dict] = []
+    for ev in events:
+        decision = ev.get("decision", "allowed")
+        rule_id  = ev.get("rule_id") or ev.get("rule_message") or ""
+        owasp_code, owasp_title = _map_owasp(rule_id)
+        findings.append({
+            "timestamp":   (ev.get("timestamp") or ev.get("created_at") or "")[:19].replace("T", " ") or "—",
+            "tool":        ev.get("ai_tool") or "—",
+            "action":      (ev.get("tool_call") or "—")[:40],
+            "decision":    decision,
+            "rule_id":     rule_id or "—",
+            "owasp":       owasp_code,
+            "owasp_title": owasp_title,
+            "entry_hash":  (ev.get("entry_hash") or "")[:12] or None,
+            "policy_hash": (ev.get("policy_hash") or "")[:12] or None,
+        })
+
+    blocked_count = sum(1 for f in findings if f["decision"] == "blocked")
+    warned_count  = sum(1 for f in findings if f["decision"] == "warned")
+    total         = len(findings)
+
+    owasp_counts: dict[str, int] = {}
+    for f in findings:
+        if f["decision"] in ("blocked", "warned"):
+            owasp_counts[f["owasp"]] = owasp_counts.get(f["owasp"], 0) + 1
+
+    # ── output ───────────────────────────────────────────────────────────────
+    if fmt == "json":
+        out = {
+            "status":             "fail" if (strict and blocked_count) else "pass",
+            "generated_at":       _dt.datetime.utcnow().isoformat() + "Z",
+            "summary":            {"total": total, "blocked": blocked_count, "warned": warned_count},
+            "owasp_distribution": owasp_counts,
+            "findings":           findings,
+        }
+        print(_json.dumps(out, indent=2))
+    else:
+        print()
+        print(f"{BOLD}conduct verify — OWASP Agentic Top 10 Report{RESET}")
+        print("─" * 78)
+
+        if owasp_counts:
+            print(f"\n{BOLD}OWASP Distribution{RESET}")
+            for _kws, code, title in _OWASP_MAP:
+                count = owasp_counts.get(code, 0)
+                if count:
+                    bar   = "█" * min(count, 20)
+                    label = f"{code}: {title}"
+                    print(f"  {label:<40} {RED}{bar} {count}{RESET}")
+            unk = owasp_counts.get("A??", 0)
+            if unk:
+                print(f"  {'A??: Uncategorised':<40} {GRAY}{'█' * min(unk, 20)} {unk}{RESET}")
+
+        print(f"\n{BOLD}{'Timestamp':<20} {'Tool':<14} {'Decision':<10} {'OWASP':<5} Rule{RESET}")
+        print("─" * 78)
+        for f in findings:
+            if f["decision"] == "blocked":
+                dec_col = f"{RED}blocked{RESET}"
+            elif f["decision"] == "warned":
+                dec_col = f"{YELLOW}warned{RESET}"
+            elif f["decision"] == "audited":
+                dec_col = f"{BLUE}audited{RESET}"
+            else:
+                dec_col = f"{GRAY}{f['decision']}{RESET}"
+            chain_note = f"  {GRAY}chain:{f['entry_hash']}{RESET}" if f["entry_hash"] else ""
+            print(
+                f"  {f['timestamp']:<20} {f['tool']:<14} {dec_col:<10} "
+                f"{f['owasp']:<5} {f['rule_id']}{chain_note}"
+            )
+
+        print()
+        if blocked_count:
+            status_icon  = f"{RED}✗{RESET}"
+            status_label = f"{RED}FAIL{RESET}" if strict else f"{YELLOW}WARN{RESET}"
+        else:
+            status_icon  = f"{GREEN}✓{RESET}"
+            status_label = f"{GREEN}PASS{RESET}"
+
+        print(
+            f"  {status_icon} {status_label}  "
+            f"{total} events  ·  "
+            f"{RED if blocked_count else GRAY}{blocked_count} blocked{RESET}  ·  "
+            f"{YELLOW if warned_count else GRAY}{warned_count} warned{RESET}"
+        )
+        if strict and blocked_count:
+            print(f"\n  {RED}Strict mode: non-zero exit — {blocked_count} blocked event(s).{RESET}")
+        print()
+
+    if strict and blocked_count:
+        sys.exit(1)
+
+
 def dispatch_guard(args, guard_p):
     """Dispatch to the correct guard handler. Called from main()."""
     guard_command = getattr(args, "guard_command", None)

{conduct_cli-0.6.37 → conduct_cli-0.7.1}/src/conduct_cli/hooks/pretooluse.py

@@ -224,6 +224,11 @@ def _get_fail_mode() -> str:
     return mode if mode in ("fail_open", "fail_closed") else "fail_open"
 
 
+def _get_advisory_mode() -> bool:
+    cfg = load_config()
+    return bool(cfg.get("advisory_mode", False))
+
+
 # ── Budget cache ──────────────────────────────────────────────────────────────
 
 def _load_budget_cache():
@@ -452,6 +457,10 @@ def main() -> None:
 
     _, action, rule_id, message = check_policy(tool_name, tool_input)
 
+    if _get_advisory_mode() and action in ("block", "warn", "approval"):
+        post_event(tool_name, tool_input, "audited", rule_id, f"[advisory] {message}", session_id, drain_via=_this_file)
+        sys.exit(0)
+
     decision = {"block": "blocked", "warn": "warned", "approval": "blocked"}.get(action, "allowed")
     if action == "warn" and session_id and rule_id and _already_warned_this_session(session_id, rule_id):
         sys.exit(0)

{conduct_cli-0.6.37 → conduct_cli-0.7.1}/src/conduct_cli/main.py

@@ -3097,6 +3097,11 @@ def main():
     sub.add_parser("sync", help="Sync Guard policies (and Security Loop policies if installed)")
 
     # conduct test-guard / test-security / test-security-verify
+    verify_p = sub.add_parser("verify", help="Map guard events to OWASP Agentic Top 10 and verify chain integrity")
+    verify_p.add_argument("--evidence", metavar="FILE", default=None, help="JSON evidence file (guard events). Omit to fetch from API.")
+    verify_p.add_argument("--strict",   action="store_true",           help="Exit 1 if any blocked events found (CI mode)")
+    verify_p.add_argument("--format",   choices=["text", "json"],      default="text", help="Output format (default: text)")
+    verify_p.add_argument("--since",    default="24h",                 help="Time window when fetching from API (e.g. 7d, 24h)")
     sub.add_parser("test-guard",            help="Fire a synthetic event per guard policy rule and show decisions")
     sub.add_parser("test-security",         help="Post a synthetic finding per security classifier pattern")
     sub.add_parser("test-security-verify",  help="Post test findings and verify full triage pipeline end-to-end")
@@ -3190,6 +3195,8 @@ def main():
         cmd_skill(args)
     elif args.command == "sync":
         cmd_sync(args)
+    elif args.command == "verify":
+        _guard.cmd_verify(args)
     elif args.command == "test-guard":
         cmd_test_guard(args)
     elif args.command == "test-security":

{conduct_cli-0.6.37 → conduct_cli-0.7.1}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.6.37
+Version: 0.7.1
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.6.37 → conduct_cli-0.7.1}/src/conduct_cli.egg-info/SOURCES.txt

@@ -24,6 +24,7 @@ src/conduct_cli/hooks/pretooluse.py
 src/conduct_cli/hooks/session_parser.py
 src/conduct_cli/hooks/session_start.py
 src/conduct_cli/hooks/stop.py
+tests/test_advisory_and_hook.py
 tests/test_bash_operator_signature.py
 tests/test_command_word_matcher.py
 tests/test_guard_policy.py

conduct_cli-0.7.1/tests/test_advisory_and_hook.py

@@ -0,0 +1,565 @@
+"""
+CLI tests covering advisory mode (P1), pretooluse hook flow, and conduct verify (P3).
+
+Covers:
+  Advisory mode config:
+    - _get_advisory_mode returns False by default
+    - _get_advisory_mode returns True when advisory_mode set in config
+    - guard sync mirrors advisory_mode from policy into config
+
+  Advisory mode hook behavior:
+    - block rule + advisory ON  → exits 0, posts "audited" decision
+    - block rule + advisory OFF → exits 2, posts "blocked" decision
+    - warn rule  + advisory ON  → exits 0, posts "audited" decision
+    - approval rule + advisory ON → exits 0, posts "audited" decision
+    - allow (no match) + advisory ON → exits 0, posts "allowed"
+
+  Fail-closed gate:
+    - fail_closed + no policy file → exits 2, posts "blocked" guard-unavailable
+    - fail_open  + no policy file → passes through to policy check
+
+  conduct verify (P3):
+    - OWASP mapping covers all 10 categories + unknown fallback
+    - evidence file: pass with no blocked events → exit 0
+    - evidence file: blocked events + --strict → exit 1
+    - evidence file: blocked events without --strict → exit 0
+    - empty evidence → exit 0, no-op message
+    - bad file path → exit 2
+    - invalid JSON → exit 2
+    - --format json: status=fail when strict+blocked, status=pass otherwise
+    - chain hashes appear in output when present
+
+  Budget hard cap:
+    - hard_blocked=True → exits 2 regardless of advisory mode
+
+  Warn dedup:
+    - same session + same rule → exits 0 on second warn (already warned)
+    - different session → warns again
+
+  Policy eval error interaction with advisory (P4 × P1):
+    - policy eval throws + advisory OFF → exits 2 (fail-closed wins)
+    - policy eval throws + advisory ON  → exits 2 (fail-closed wins; advisory only covers rule matches)
+"""
+from __future__ import annotations
+
+import json
+import sys
+from io import StringIO
+from pathlib import Path
+from unittest.mock import MagicMock, patch, call
+
+import pytest
+
+CONDUCT_CLI_SRC = Path(__file__).resolve().parent.parent / "src"
+if str(CONDUCT_CLI_SRC) not in sys.path:
+    sys.path.insert(0, str(CONDUCT_CLI_SRC))
+
+import conduct_cli.guard as guard_mod
+from conduct_cli.guard import POLICY_PATH, CONFIG_PATH
+
+
+# ── helpers ───────────────────────────────────────────────────────────────────
+
+def _hook_input(tool="Bash", cmd="echo hi", session="sess-1") -> str:
+    return json.dumps({
+        "tool_name": tool,
+        "tool_input": {"command": cmd},
+        "session_id": session,
+    })
+
+
+def _block_policy(rule_id="no-echo", pattern="echo", action="block") -> dict:
+    return {
+        "version": "test",
+        "rules": [{"rule_id": rule_id, "match_tool": "*", "match_pattern": pattern, "action": action, "message": f"rule {rule_id}"}],
+    }
+
+
+def _write(path: Path, data: dict) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(data))
+
+
+# ── advisory config ───────────────────────────────────────────────────────────
+
+class TestGetAdvisoryMode:
+    def test_default_false(self, tmp_path, monkeypatch):
+        cfg = tmp_path / "config.json"
+        _write(cfg, {"workspace_id": "ws1"})
+        monkeypatch.setattr(guard_mod, "CONFIG_PATH", cfg)
+        import conduct_cli.hooks.pretooluse as pt
+        monkeypatch.setattr(pt, "load_config", lambda: {"workspace_id": "ws1"})
+        assert pt._get_advisory_mode() is False
+
+    def test_true_when_set(self, tmp_path, monkeypatch):
+        import conduct_cli.hooks.pretooluse as pt
+        monkeypatch.setattr(pt, "load_config", lambda: {"advisory_mode": True})
+        assert pt._get_advisory_mode() is True
+
+    def test_false_when_explicitly_false(self, tmp_path, monkeypatch):
+        import conduct_cli.hooks.pretooluse as pt
+        monkeypatch.setattr(pt, "load_config", lambda: {"advisory_mode": False})
+        assert pt._get_advisory_mode() is False
+
+
+# ── advisory hook behavior ────────────────────────────────────────────────────
+
+class TestAdvisoryHookBehavior:
+    """Patch check_policy to return a specific action, verify advisory bypass logic."""
+
+    def _run(self, monkeypatch, *, advisory: bool, action: str, rule_id: str = "r1", message: str = "msg"):
+        import conduct_cli.hooks.pretooluse as pt
+
+        monkeypatch.setattr(pt, "_get_fail_mode", lambda: "fail_open")
+        monkeypatch.setattr(pt, "_get_advisory_mode", lambda: advisory)
+        monkeypatch.setattr(pt, "_load_budget_cache", lambda: (False, None))
+        monkeypatch.setattr(pt, "_fetch_budget_status", lambda: (False, None))
+        monkeypatch.setattr(pt, "_maybe_sync_policy", lambda: None)
+        monkeypatch.setattr(pt, "_should_periodic_flush", lambda: False)
+        # Return the desired action regardless of policy file content
+        fake_rule = {"rule_id": rule_id, "action": action}
+        monkeypatch.setattr(pt, "check_policy", lambda tn, ti, **kw: (fake_rule, action, rule_id, message))
+
+        posted: list[dict] = []
+        monkeypatch.setattr(pt, "post_event", lambda tn, ti, d, r, m, s, **kw: posted.append({"decision": d, "message": m}))
+        monkeypatch.setattr(sys, "stdin", StringIO(_hook_input()))
+
+        exit_code = None
+        try:
+            pt.main()
+        except SystemExit as e:
+            exit_code = e.code
+        return exit_code, posted
+
+    def test_block_advisory_on_exits_0(self, monkeypatch):
+        code, posted = self._run(monkeypatch, advisory=True, action="block")
+        assert code == 0
+        assert posted[0]["decision"] == "audited"
+
+    def test_block_advisory_off_exits_2(self, monkeypatch):
+        code, posted = self._run(monkeypatch, advisory=False, action="block")
+        assert code == 2
+        assert posted[0]["decision"] == "blocked"
+
+    def test_warn_advisory_on_exits_0(self, monkeypatch):
+        code, posted = self._run(monkeypatch, advisory=True, action="warn")
+        assert code == 0
+        assert posted[0]["decision"] == "audited"
+
+    def test_approval_advisory_on_exits_0(self, monkeypatch):
+        code, posted = self._run(monkeypatch, advisory=True, action="approval")
+        assert code == 0
+        assert posted[0]["decision"] == "audited"
+
+    def test_no_match_advisory_on_exits_0(self, monkeypatch):
+        """No rule match — exits 0 even without advisory."""
+        import conduct_cli.hooks.pretooluse as pt
+        monkeypatch.setattr(pt, "_get_fail_mode", lambda: "fail_open")
+        monkeypatch.setattr(pt, "_get_advisory_mode", lambda: True)
+        monkeypatch.setattr(pt, "_load_budget_cache", lambda: (False, None))
+        monkeypatch.setattr(pt, "_fetch_budget_status", lambda: (False, None))
+        monkeypatch.setattr(pt, "_maybe_sync_policy", lambda: None)
+        monkeypatch.setattr(pt, "_should_periodic_flush", lambda: False)
+        monkeypatch.setattr(pt, "check_policy", lambda tn, ti, **kw: (None, "allow", None, None))
+        monkeypatch.setattr(pt, "post_event", lambda *a, **kw: None)
+        monkeypatch.setattr(sys, "stdin", StringIO(_hook_input()))
+
+        with pytest.raises(SystemExit) as exc:
+            pt.main()
+        assert exc.value.code == 0
+
+    def test_advisory_message_prefixed(self, monkeypatch):
+        import conduct_cli.hooks.pretooluse as pt
+        monkeypatch.setattr(pt, "_get_fail_mode", lambda: "fail_open")
+        monkeypatch.setattr(pt, "_get_advisory_mode", lambda: True)
+        monkeypatch.setattr(pt, "_load_budget_cache", lambda: (False, None))
+        monkeypatch.setattr(pt, "_fetch_budget_status", lambda: (False, None))
+        monkeypatch.setattr(pt, "_maybe_sync_policy", lambda: None)
+        monkeypatch.setattr(pt, "_should_periodic_flush", lambda: False)
+        monkeypatch.setattr(pt, "check_policy", lambda tn, ti, **kw: ({}, "block", "r1", "bad thing"))
+
+        messages: list[str] = []
+        monkeypatch.setattr(pt, "post_event", lambda tn, ti, d, r, m, s, **kw: messages.append(m))
+        monkeypatch.setattr(sys, "stdin", StringIO(_hook_input()))
+
+        try:
+            pt.main()
+        except SystemExit:
+            pass
+        assert messages and messages[0].startswith("[advisory]")
+
+
+# ── fail-closed gate ──────────────────────────────────────────────────────────
+
+class TestFailClosedGate:
+    def test_fail_closed_no_policy_exits_2(self, monkeypatch, tmp_path):
+        import conduct_cli.hooks.pretooluse as pt
+
+        missing = tmp_path / "nowhere.json"
+        monkeypatch.setattr(pt, "active_policy_path", lambda: missing)
+        monkeypatch.setattr(pt, "_get_fail_mode", lambda: "fail_closed")
+        monkeypatch.setattr(pt, "_get_advisory_mode", lambda: False)
+        monkeypatch.setattr(pt, "_should_periodic_flush", lambda: False)
+        monkeypatch.setattr(pt, "_maybe_sync_policy", lambda: None)
+
+        posted: list[dict] = []
+        def _fake_post(tn, ti, decision, rule_id, msg, sid, **kw):
+            posted.append({"decision": decision, "rule_id": rule_id})
+        monkeypatch.setattr(pt, "post_event", _fake_post)
+        monkeypatch.setattr(sys, "stdin", StringIO(_hook_input()))
+
+        with pytest.raises(SystemExit) as exc:
+            pt.main()
+        assert exc.value.code == 2
+        assert posted[0]["decision"] == "blocked"
+        assert posted[0]["rule_id"] == "guard-unavailable"
+
+    def test_fail_open_no_policy_passes(self, monkeypatch, tmp_path):
+        import conduct_cli.hooks.pretooluse as pt
+
+        missing = tmp_path / "nowhere.json"
+        monkeypatch.setattr(pt, "active_policy_path", lambda: missing)
+        monkeypatch.setattr(pt, "_get_fail_mode", lambda: "fail_open")
+        monkeypatch.setattr(pt, "_get_advisory_mode", lambda: False)
+        monkeypatch.setattr(pt, "_load_budget_cache", lambda: (False, None))
+        monkeypatch.setattr(pt, "_fetch_budget_status", lambda: (False, None))
+        monkeypatch.setattr(pt, "_maybe_sync_policy", lambda: None)
+        monkeypatch.setattr(pt, "_should_periodic_flush", lambda: False)
+        monkeypatch.setattr(pt, "post_event", lambda *a, **kw: None)
+        monkeypatch.setattr(sys, "stdin", StringIO(_hook_input()))
+
+        with pytest.raises(SystemExit) as exc:
+            pt.main()
+        assert exc.value.code == 0
+
+
+# ── budget hard cap ───────────────────────────────────────────────────────────
+
+class TestBudgetHardCap:
+    def test_hard_cap_exits_2(self, monkeypatch, tmp_path):
+        import conduct_cli.hooks.pretooluse as pt
+
+        policy_path = tmp_path / "policy.json"
+        _write(policy_path, {"version": "test", "rules": []})
+        monkeypatch.setattr(pt, "active_policy_path", lambda: policy_path)
+        monkeypatch.setattr(pt, "_get_fail_mode", lambda: "fail_open")
+        monkeypatch.setattr(pt, "_get_advisory_mode", lambda: False)
+        monkeypatch.setattr(pt, "_load_budget_cache", lambda: (True, "Monthly cap reached"))
+        monkeypatch.setattr(pt, "_maybe_sync_policy", lambda: None)
+        monkeypatch.setattr(pt, "_should_periodic_flush", lambda: False)
+
+        posted: list[dict] = []
+        monkeypatch.setattr(pt, "post_event", lambda tn, ti, d, r, m, s, **kw: posted.append({"decision": d, "rule_id": r}))
+        monkeypatch.setattr(sys, "stdin", StringIO(_hook_input()))
+
+        with pytest.raises(SystemExit) as exc:
+            pt.main()
+        assert exc.value.code == 2
+        assert posted[0]["decision"] == "blocked"
+        assert posted[0]["rule_id"] == "budget-hard-cap"
+
+    def test_hard_cap_wins_over_advisory(self, monkeypatch, tmp_path):
+        """Budget hard cap blocks even when advisory mode is on."""
+        import conduct_cli.hooks.pretooluse as pt
+
+        policy_path = tmp_path / "policy.json"
+        _write(policy_path, {"version": "test", "rules": []})
+        monkeypatch.setattr(pt, "active_policy_path", lambda: policy_path)
+        monkeypatch.setattr(pt, "_get_fail_mode", lambda: "fail_open")
+        monkeypatch.setattr(pt, "_get_advisory_mode", lambda: True)  # advisory ON
+        monkeypatch.setattr(pt, "_load_budget_cache", lambda: (True, "Cap reached"))
+        monkeypatch.setattr(pt, "_maybe_sync_policy", lambda: None)
+        monkeypatch.setattr(pt, "_should_periodic_flush", lambda: False)
+        monkeypatch.setattr(pt, "post_event", lambda *a, **kw: None)
+        monkeypatch.setattr(sys, "stdin", StringIO(_hook_input()))
+
+        with pytest.raises(SystemExit) as exc:
+            pt.main()
+        assert exc.value.code == 2
+
+
+# ── warn dedup ────────────────────────────────────────────────────────────────
+
+class TestWarnDedup:
+    def _run_warn(self, monkeypatch, session_id: str):
+        import conduct_cli.hooks.pretooluse as pt
+
+        monkeypatch.setattr(pt, "_get_fail_mode", lambda: "fail_open")
+        monkeypatch.setattr(pt, "_get_advisory_mode", lambda: False)
+        monkeypatch.setattr(pt, "_load_budget_cache", lambda: (False, None))
+        monkeypatch.setattr(pt, "_fetch_budget_status", lambda: (False, None))
+        monkeypatch.setattr(pt, "_maybe_sync_policy", lambda: None)
+        monkeypatch.setattr(pt, "_should_periodic_flush", lambda: False)
+        monkeypatch.setattr(pt, "check_policy", lambda tn, ti, **kw: ({}, "warn", "rule-w1", "watch out"))
+        monkeypatch.setattr(pt, "_already_warned_this_session", lambda s, r: False)
+        monkeypatch.setattr(pt, "_record_session_warn", lambda s, r: None)
+
+        posted: list[str] = []
+        monkeypatch.setattr(pt, "post_event", lambda tn, ti, d, r, m, s, **kw: posted.append(d))
+        monkeypatch.setattr(sys, "stdin", StringIO(_hook_input(session=session_id)))
+
+        try:
+            pt.main()
+        except SystemExit:
+            pass
+        return posted
+
+    def test_first_warn_posts(self, monkeypatch):
+        posted = self._run_warn(monkeypatch, "sess-abc")
+        assert "warned" in posted
+
+    def test_second_warn_same_session_skips(self, monkeypatch, tmp_path):
+        import conduct_cli.hooks.pretooluse as pt
+        warns: dict[str, set] = {}
+
+        def _fake_already(session, rule):
+            return rule in warns.get(session, set())
+
+        def _fake_record(session, rule):
+            warns.setdefault(session, set()).add(rule)
+
+        monkeypatch.setattr(pt, "_already_warned_this_session", _fake_already)
+        monkeypatch.setattr(pt, "_record_session_warn", _fake_record)
+
+        # First call records the warn
+        _fake_record("sess-xyz", "no-echo")
+
+        monkeypatch.setattr(pt, "check_policy", lambda tn, ti, **kw: ({}, "warn", "no-echo", "watch out"))
+        monkeypatch.setattr(pt, "_get_fail_mode", lambda: "fail_open")
+        monkeypatch.setattr(pt, "_get_advisory_mode", lambda: False)
+        monkeypatch.setattr(pt, "_load_budget_cache", lambda: (False, None))
+        monkeypatch.setattr(pt, "_fetch_budget_status", lambda: (False, None))
+        monkeypatch.setattr(pt, "_maybe_sync_policy", lambda: None)
+        monkeypatch.setattr(pt, "_should_periodic_flush", lambda: False)
+
+        posted: list[str] = []
+        monkeypatch.setattr(pt, "post_event", lambda tn, ti, d, r, m, s, **kw: posted.append(d))
+        monkeypatch.setattr(sys, "stdin", StringIO(_hook_input(session="sess-xyz")))
+
+        try:
+            pt.main()
+        except SystemExit:
+            pass
+
+        assert posted == [], "second warn same session should be skipped"
+
+
+# ── advisory_mode mirrored on sync ────────────────────────────────────────────
+
+class TestSyncMirrorsAdvisoryMode:
+    def test_advisory_true_written_to_config(self, tmp_path, monkeypatch):
+        cfg_path = tmp_path / "config.json"
+        pol_path = tmp_path / "policy.json"
+        _write(cfg_path, {"workspace_id": "ws1"})
+
+        monkeypatch.setattr(guard_mod, "CONFIG_PATH", cfg_path)
+        monkeypatch.setattr(guard_mod, "POLICY_PATH", pol_path)
+
+        policy = {"version": "v1", "rules": [], "fail_mode": "fail_open", "advisory_mode": True}
+        monkeypatch.setattr(guard_mod, "_load_guard_config", lambda: {"workspace_id": "ws1"})
+
+        saved: list[dict] = []
+        monkeypatch.setattr(guard_mod, "_save_guard_config", lambda cfg: saved.append(dict(cfg)))
+        monkeypatch.setattr(guard_mod, "_save_policy", lambda p: None)
+
+        # Simulate the sync block
+        cfg = guard_mod._load_guard_config()
+        cfg["fail_mode"] = policy.get("fail_mode", "fail_open")
+        cfg["advisory_mode"] = policy.get("advisory_mode", False)
+        guard_mod._save_guard_config(cfg)
+
+        assert saved[0]["advisory_mode"] is True
+
+    def test_advisory_false_default(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(guard_mod, "_load_guard_config", lambda: {"workspace_id": "ws1"})
+        saved: list[dict] = []
+        monkeypatch.setattr(guard_mod, "_save_guard_config", lambda cfg: saved.append(dict(cfg)))
+        monkeypatch.setattr(guard_mod, "_save_policy", lambda p: None)
+
+        policy = {"version": "v1", "rules": [], "fail_mode": "fail_open"}
+        cfg = guard_mod._load_guard_config()
+        cfg["fail_mode"] = policy.get("fail_mode", "fail_open")
+        cfg["advisory_mode"] = policy.get("advisory_mode", False)
+        guard_mod._save_guard_config(cfg)
+
+        assert saved[0]["advisory_mode"] is False
+
+
+# ── conduct verify (P3) ──────────────────────────────────────────────────────
+
+class TestOWASPMapping:
+    """_map_owasp covers all 10 categories and falls back to A??."""
+
+    def _map(self, rule_id: str) -> str:
+        from conduct_cli.guard import _map_owasp
+        return _map_owasp(rule_id)[0]
+
+    def test_a01_prompt_injection(self):
+        assert self._map("prompt_inject_tool") == "A01"
+
+    def test_a02_sensitive_data(self):
+        assert self._map("sensitive_data_read") == "A02"
+
+    def test_a03_supply_chain(self):
+        assert self._map("supply_chain_pkg") == "A03"
+
+    def test_a04_excessive_agency(self):
+        assert self._map("excessive_agency_shell") == "A04"
+
+    def test_a07_monitoring(self):
+        assert self._map("policy_eval_error") == "A07"
+
+    def test_a07_sig_invalid(self):
+        assert self._map("policy_signature_invalid") == "A07"
+
+    def test_a09_privilege(self):
+        assert self._map("privilege_escalat_detected") == "A09"
+
+    def test_a10_budget(self):
+        assert self._map("budget_hard_cap") == "A10"
+
+    def test_unknown_falls_back(self):
+        assert self._map("some_random_rule") == "A??"
+
+    def test_empty_rule_id(self):
+        assert self._map("") == "A??"
+
+
+_EVIDENCE_BLOCKED = [
+    {"timestamp": "2026-07-06T10:00:00", "ai_tool": "Claude",
+     "tool_call": "Bash", "decision": "blocked",
+     "rule_id": "excessive_agency_shell",
+     "entry_hash": "abc123def456", "policy_hash": "pol789"},
+]
+
+_EVIDENCE_WARN_ONLY = [
+    {"timestamp": "2026-07-06T10:01:00", "ai_tool": "Claude",
+     "tool_call": "Read", "decision": "warned",
+     "rule_id": "sensitive_data_read"},
+]
+
+_EVIDENCE_CLEAN = [
+    {"timestamp": "2026-07-06T10:02:00", "ai_tool": "Claude",
+     "tool_call": "Bash", "decision": "allowed", "rule_id": None},
+]
+
+
+class TestVerifyCommand:
+    def _run(self, args_list: list[str], capsys) -> int:
+        import argparse
+        from conduct_cli.guard import cmd_verify
+
+        parser = argparse.ArgumentParser()
+        parser.add_argument("--evidence", default=None)
+        parser.add_argument("--strict", action="store_true")
+        parser.add_argument("--format", default="text")
+        parser.add_argument("--since", default="24h")
+        args = parser.parse_args(args_list)
+
+        try:
+            cmd_verify(args)
+            return 0
+        except SystemExit as exc:
+            return int(exc.code) if exc.code is not None else 0
+
+    def test_clean_evidence_exits_0(self, tmp_path, capsys):
+        f = tmp_path / "ev.json"
+        f.write_text(__import__("json").dumps(_EVIDENCE_CLEAN))
+        code = self._run(["--evidence", str(f)], capsys)
+        assert code == 0
+
+    def test_blocked_without_strict_exits_0(self, tmp_path, capsys):
+        f = tmp_path / "ev.json"
+        f.write_text(__import__("json").dumps(_EVIDENCE_BLOCKED))
+        code = self._run(["--evidence", str(f)], capsys)
+        assert code == 0
+
+    def test_blocked_with_strict_exits_1(self, tmp_path, capsys):
+        f = tmp_path / "ev.json"
+        f.write_text(__import__("json").dumps(_EVIDENCE_BLOCKED))
+        code = self._run(["--evidence", str(f), "--strict"], capsys)
+        assert code == 1
+
+    def test_warn_only_with_strict_exits_0(self, tmp_path, capsys):
+        f = tmp_path / "ev.json"
+        f.write_text(__import__("json").dumps(_EVIDENCE_WARN_ONLY))
+        code = self._run(["--evidence", str(f), "--strict"], capsys)
+        assert code == 0
+
+    def test_missing_file_exits_2(self, tmp_path, capsys):
+        code = self._run(["--evidence", str(tmp_path / "missing.json")], capsys)
+        assert code == 2
+
+    def test_invalid_json_exits_2(self, tmp_path, capsys):
+        f = tmp_path / "bad.json"
+        f.write_text("not valid {{{")
+        code = self._run(["--evidence", str(f)], capsys)
+        assert code == 2
+
+    def test_empty_array_no_error(self, tmp_path, capsys):
+        f = tmp_path / "empty.json"
+        f.write_text("[]")
+        code = self._run(["--evidence", str(f)], capsys)
+        assert code == 0
+        out = capsys.readouterr().out
+        assert "nothing to verify" in out.lower() or "no guard events" in out.lower()
+
+    def test_json_format_status_fail_when_strict_and_blocked(self, tmp_path, capsys):
+        import json
+        f = tmp_path / "ev.json"
+        f.write_text(json.dumps(_EVIDENCE_BLOCKED))
+        self._run(["--evidence", str(f), "--strict", "--format", "json"], capsys)
+        out = capsys.readouterr().out
+        data = json.loads(out)
+        assert data["status"] == "fail"
+        assert data["summary"]["blocked"] == 1
+
+    def test_json_format_status_pass_without_strict(self, tmp_path, capsys):
+        import json
+        f = tmp_path / "ev.json"
+        f.write_text(json.dumps(_EVIDENCE_BLOCKED))
+        self._run(["--evidence", str(f), "--format", "json"], capsys)
+        out = capsys.readouterr().out
+        data = json.loads(out)
+        assert data["status"] == "pass"
+
+    def test_chain_hash_appears_in_text_output(self, tmp_path, capsys):
+        f = tmp_path / "ev.json"
+        f.write_text(__import__("json").dumps(_EVIDENCE_BLOCKED))
+        self._run(["--evidence", str(f)], capsys)
+        out = capsys.readouterr().out
+        assert "chain:abc123def456" in out
+
+    def test_owasp_distribution_shown(self, tmp_path, capsys):
+        f = tmp_path / "ev.json"
+        f.write_text(__import__("json").dumps(_EVIDENCE_BLOCKED + _EVIDENCE_WARN_ONLY))
+        self._run(["--evidence", str(f)], capsys)
+        out = capsys.readouterr().out
+        assert "A04" in out
+        assert "A02" in out
+
+    def test_envelope_json_input(self, tmp_path, capsys):
+        """Accept {'events': [...]} envelope as well as raw array."""
+        import json
+        f = tmp_path / "ev.json"
+        f.write_text(json.dumps({"events": _EVIDENCE_CLEAN}))
+        code = self._run(["--evidence", str(f)], capsys)
+        assert code == 0
+
+
+# ── invalid stdin ─────────────────────────────────────────────────────────────
+
+class TestInvalidStdin:
+    def test_malformed_json_exits_0(self, monkeypatch):
+        import conduct_cli.hooks.pretooluse as pt
+        monkeypatch.setattr(sys, "stdin", StringIO("not json {{{"))
+        with pytest.raises(SystemExit) as exc:
+            pt.main()
+        assert exc.value.code == 0
+
+    def test_empty_stdin_exits_0(self, monkeypatch):
+        import conduct_cli.hooks.pretooluse as pt
+        monkeypatch.setattr(sys, "stdin", StringIO(""))
+        with pytest.raises(SystemExit) as exc:
+            pt.main()
+        assert exc.value.code == 0