Agenticcoding

Three individually valid Claude Code MCP reads are rejected because their source versions form a mixed production snapshot

Reject a Claude Code plan built from a mixed snapshot

Claude Code can read three correct facts and still build a plan for a system state that never existed. Record a coherent read set and reject evidence that crosses a consistency boundary.

A human approval becomes a single-use capability bound to one Claude Code operation, and the tool gateway rejects any replay after redemption

Treat Claude Code approval as a single-use capability

A human approval should authorize one exact Claude Code effect, not every retry that follows. Issue a single-use capability and record its redemption at the tool gateway.

An effect ledger records completed, failed, and pending MCP steps, then selects resume, compensate, or stop based on verified production state

Recover a partially completed Claude Code MCP workflow

A multi-step Claude Code run can fail after several external writes have already succeeded. Use an effect ledger to resume, compensate, or stop without repeating completed work.

A Claude Code test denominator records expected, discovered, selected, executed, skipped, and missing tests before a review can pass

Make Claude Code report the tests it did not run

A green test result says little when the agent selected the wrong suite or skipped the risky path. Add a test denominator to every Claude Code review packet.

MCP tool output is labelled untrusted, reduced to evidence, checked against the original Claude Code scope, and recorded in a reviewable trace

Do not let MCP tool output rewrite Claude Code's instructions

An MCP response can contain instruction-shaped text that pushes Claude Code beyond its approved task. Put a trust boundary between tool evidence and agent authority.

A Claude Code stop request revokes run authority, drains queued MCP work, reconciles in-flight effects, and produces a verified stop receipt

Stopping Claude Code does not cancel queued MCP work

A stopped Claude Code run can leave queued MCP calls and provider jobs alive. Use a cancellation barrier to revoke authority, drain pending work, and prove the run is quiet.

A timed-out Claude Code MCP write enters an unknown state, checks an operation journal, and either verifies the existing effect or retries with the same idempotency key

Treat a timed-out MCP write as an unknown outcome

A timed-out MCP write may have failed, succeeded, or finished after the client gave up. Use an operation journal and effect lookup before Claude Code retries it.

A Claude Code run pins an MCP capability manifest and stops when the live server schema, implementation, target scope, or side effects differ

Pin the MCP tool contract before Claude Code uses it

An MCP method can keep the same name while its schema, target scope, or side effects change. Pin a capability manifest so Claude Code cannot inherit a different tool after approval.

A Claude Code cost envelope that prices tool calls before execution, reserves budget at dispatch, records actual spend, and stops over-budget paths

Make Claude Code price the tool path before it starts

Token limits miss the expensive part of many Claude Code runs. A cost envelope prices search, MCP calls, evals, and retries before the agent can spend them.

A Claude Code evidence-linked trace connecting an observed failing deployment to a scoped plan, an authorised MCP tool call, the resulting effect, and a review decision

Make Claude Code cite the evidence behind every tool call

A tool-call log shows what Claude Code did. An evidence-linked trace shows which observation caused each action, which policy allowed it, and when the chain broke.