Observability

A secret enters a Claude Code run, a data boundary replaces it with a safe reference, and a propagation receipt verifies every downstream surface

Claude Code redacted the secret after it had already spread

Redacting Claude Code’s final answer does not remove a secret from tool logs, traces, caches, and review packets. Track sensitive data through the whole run with a propagation receipt.

A timed-out Claude Code MCP request leaves a paid remote job running while a guarded retry looks up the operation and attaches to the existing job

Claude Code timed out, retried, and paid twice

A timed-out MCP call may still be running and charging your account. Give paid tool operations a stable ID, a spend ceiling, and a retry receipt before Claude Code tries again.

A Claude Code patch enters an independent evidence review before the agent explanation is revealed in a second pass

Do not let Claude Code explain its patch to the evaluator first

A polished Claude Code handoff can anchor the reviewer before the evidence is checked. Give an independent evaluator the task contract, patch, and raw test results first, then reveal the agent’s explanation.

A Claude Code trace with a missing MCP tool event is blocked by a completeness gate before replay and review

Make Claude Code prove its trace is complete before replay

A clean replay can be dangerously reassuring when the original trace dropped the tool call that changed production. Add sequence checks, expected-event accounting, and a completeness receipt before review.

Claude Code compacts its conversation while an external control-state checkpoint preserves authority, denied actions, pending effects, and evidence bindings

Keep Claude Code's safety state outside its context window

Context compaction can preserve the task while losing the decision that blocked a dangerous tool call. Store authority, denials, and unresolved effects in a control checkpoint outside the transcript.

Three individually valid Claude Code MCP reads are rejected because their source versions form a mixed production snapshot

Reject a Claude Code plan built from a mixed snapshot

Claude Code can read three correct facts and still build a plan for a system state that never existed. Record a coherent read set and reject evidence that crosses a consistency boundary.

An effect ledger records completed, failed, and pending MCP steps, then selects resume, compensate, or stop based on verified production state

Recover a partially completed Claude Code MCP workflow

A multi-step Claude Code run can fail after several external writes have already succeeded. Use an effect ledger to resume, compensate, or stop without repeating completed work.

A Claude Code test denominator records expected, discovered, selected, executed, skipped, and missing tests before a review can pass

Make Claude Code report the tests it did not run

A green test result says little when the agent selected the wrong suite or skipped the risky path. Add a test denominator to every Claude Code review packet.

MCP tool output is labelled untrusted, reduced to evidence, checked against the original Claude Code scope, and recorded in a reviewable trace

Do not let MCP tool output rewrite Claude Code's instructions

An MCP response can contain instruction-shaped text that pushes Claude Code beyond its approved task. Put a trust boundary between tool evidence and agent authority.

A Claude Code stop request revokes run authority, drains queued MCP work, reconciles in-flight effects, and produces a verified stop receipt

Stopping Claude Code does not cancel queued MCP work

A stopped Claude Code run can leave queued MCP calls and provider jobs alive. Use a cancellation barrier to revoke authority, drain pending work, and prove the run is quiet.