A hooks table needs a failure column.

Video caption

A hooks table needs a failure column.

Cloud, delegation, resume and timeouts change reachability.

One route, one fault, one external result per row.

A policy that fails open is a different policy.

#EricFieldNotes

Full written post / accessibility read

A pre-tool hook can deny a covered call. A post-tool hook can inspect what happened but cannot reverse it. A hook table that lists events without when they run, where they run and how they fail invites false confidence.

Cursor's current docs distinguish local and cloud hook support; Claude Code documents event and exit semantics; Codex has its own hook surfaces. None of those descriptions is proof that one team's exact tool path is covered.

Attempt a harmless forbidden action through every supported route. Record whether the hook fired, what it returned, whether the tool ran, and whether the target state changed. Repeat with timeout, malformed output and hook-process failure.

Publish the coverage matrix with the hook config and service permissions. Do this because 'we installed the hook' is a deployment fact; 'the forbidden action cannot complete' is a claim that requires a route-by-route test.

#EricFieldNotes

Four-beat scene transcript

1. A hooks table needs a failure column.

A pre-tool hook can deny a covered call. A post-tool hook can inspect what happened but cannot reverse it. A hook table that lists events without when they run, where they run and how they fail invites false confidence.

Visual: Pre and post events do different work.

2. The missing row is usually operational.

Cursor's current docs distinguish local and cloud hook support; Claude Code documents event and exit semantics; Codex has its own hook surfaces. None of those descriptions is proof that one team's exact tool path is covered.

Visual: Cloud, delegation, resume and timeouts change reachability.

3. Fill the matrix with observations.

Attempt a harmless forbidden action through every supported route. Record whether the hook fired, what it returned, whether the tool ran, and whether the target state changed. Repeat with timeout, malformed output and hook-process failure.

Visual: One route, one fault, one external result per row.

4. Keep the failure semantics beside the rule.

Publish the coverage matrix with the hook config and service permissions. Do this because 'we installed the hook' is a deployment fact; 'the forbidden action cannot complete' is a claim that requires a route-by-route test.

Visual: A policy that fails open is a different policy.

Research and claim limits

• Cursor hooks documentation (S04)
• Codex hooks reference (S44)
• Claude Code hooks reference (S45)

The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.