Description
The rules in terraform/grafana-agento11y.tf match only claude-code agent names and Claude tool names (Bash, Read, Edit, Write, Grep, WebFetch). Guard calls carry no tags, so rules scope by agent name only. Codex supports preflight deny; pi supports preflight transform but not deny, and sends lowercase tool names; Codex hosted tools such as WebSearch are not hooked. This task owns terraform/grafana-agento11y.tf and the guard-policy experiment suites. Priority order must keep deny rules below 10 (docs/security.md).
Acceptance Criteria
- #1 A destructive shell call and a read of a secret file are denied for both Codex and pi on live traffic, and the outcomes appear on agento11y_hook_rule_outcomes_total under the new rule ids
- #2 A secret in tool arguments is redacted before the tool runs for both agents
- #3 The PII story per agent is implemented and documented: Codex preflight deny, pi preflight redaction (redacted, not blocked) unless the spike shows a better option
- #4 Rule matches cannot fire on Claude Code or other users of the stack, and existing Claude Code rules and alerts are unchanged or extended deliberately (for example the guard-denied alert regex)
- #5 A guard-policy experiment suite exists for each new agent’s tool vocabulary, alongside apps/agents/config/suites/claude-code-guard-policy.yaml
Definition of Done
- #1 just check
Implementation Plan
Implement exact demo-scoped Codex/pi guard names and native tool vocabulary; retain Claude rules. Add manual guard suites with real redaction assertions and runner agent selection. Validate locally, then verify actual tool denial/transformation and emitted rule metrics on live agent sessions after deployment.
Implementation Notes
Live proof: all 22 direct hook cases pass. Real Codex and pi tool calls to rm -rf ./build and cat .env were blocked, with synthetic sentinel retained and no workarounds. Both real CLIs executed an echo containing a fake sk- marker only after rewriting it to [REDACTED], verified from the resulting file. Mimir contains deny outcomes under both agents destructive-shell/secret-file rule ids. Initial parallel guard creation returned partial HTTP500; authoritative readback then serial apply created only the seven missing rules successfully. Full rollout should use -parallelism=1 for this backend behavior.
Acceptance evidence retained locally in /tmp/touchline-live-spikes/guard-results.json and per-agent guard/secret/redact results. Exact CLI conversations and rule-id deny metrics establish destructive/secret-read denial and before-execution argument redaction. Prompt PII behavior API verified; per-CLI prompt capture check remains before checking criterion 3.
Real prompt PII checks: Codex preflight denial produced zero input/output tokens and no generations; pi model response referred to [REDACTED], while its exported input retained the original synthetic prompt. Documented distinction: pi context transform is not transcript redaction. Existing Claude resources and exact new demo-agent matches remain unchanged/isolated; both manual suites execute and validate.
Final Summary
Exact demo-agent guard rules and manual suites implemented. All 22 API cases pass; both real CLIs deny destructive/secret-read calls and redact arguments before execution. Prompt behavior and pi transcript-capture limit documented; rule-id outcome metrics observed. Full local gate and reviews passed.