Observability

A review packet has passing tests but a missing MCP write receipt. Further agent writes are blocked while an authorised operator reconciles the outcome.

Claude Code review packets: unknown is not a pass

Passing tests cannot settle a missing MCP write receipt. Give unresolved effects a status that the approval gate cannot ignore.

A Claude Code incident replay forks into a faithful path using captured MCP evidence and a misleading path that calls today's live tools

Your Claude Code incident replay used today's tool output

The same prompt and repository commit produced a clean replay because an MCP tool returned newer evidence. The team had rerun the task, not reproduced the incident.

An allowed Claude Code CI retry passes through build and release systems before a fresh capability gate blocks production deployment

Claude Code had no deploy permission. Its MCP tool deployed anyway

A permitted CI retry reached production through an artifact event and a more powerful release service. Tool permissions missed the effect that mattered.

Claude Code's audit trail put the effect before the approval

Clock skew made an approved Claude Code run look unauthorized. Wall-clock timestamps cannot prove the order of a production agent’s approval, dispatch, commit, and revocation.

A Claude Code transcript passes through five independent evidence checks for identity, authority, durable effect, observation, and cleanup before a reviewer accepts the run

A Claude Code audit trail needs proof beyond the transcript

A Claude Code transcript can describe an MCP action without proving who was authorized, what committed, whether an independent read saw it, or what rollback left behind.

A Claude Code MCP write passes through an acknowledgement gate, durable commit check, and independent read before a durability receipt is issued

Claude Code got a success receipt before the write was durable

An MCP tool can return success after accepting a write but before durable storage. Define acknowledgement levels, verify the committed version, and give Claude Code a durability receipt.

Two parallel Claude Code writes request operation IDs from one atomic identity ledger, which issues unique IDs and blocks collisions before MCP dispatch

Claude Code gave two parallel writes the same operation ID

Two parallel Claude Code tool calls can share an operation ID and corrupt retry evidence. Allocate identity centrally, bind it to intent, and reject collisions before dispatch.

Two Claude Code eval cases are separated by a reset gate that verifies a clean sandbox before the second case starts

Claude Code passed the eval because the previous case cleaned up for it

A Claude Code eval can pass only because an earlier case left the sandbox in a helpful state. Give every case a fresh environment, a state fingerprint, and a reset receipt.

Three Claude Code subagents request reservations from one parent-owned budget ledger, which admits two calls and blocks the third before the shared ceiling is exceeded

Claude Code stayed under every child budget and still overspent

Three Claude Code subagents each stayed inside their local limit. Together they broke the run budget because nobody reserved spend at the parent boundary.

A new Claude Code run is blocked because its pooled MCP session still carries the previous tenant context

Claude Code changed tenants. The MCP session did not.

A new Claude Code run selected the right tenant, but its pooled MCP session kept the previous tenant context. Bind every session to the authority it carries.