JournalDAY 71 / X

FIELD NOTE / X

A hooks comparison needs a failure injection.

The complete written thought and the evidence behind it. The video edition will follow its public release.

Journal September 25, 2026 · X target December 7, 2026

A hooks comparison needs a failure injection.

Video caption

A hooks comparison needs a failure injection. It may run after the effect or fail open. Scope tools and credentials beyond them. #EricFieldNotes

Full written post / accessibility read

A table saying Cursor, Claude Code or Codex has a pre-tool hook tells me little about enforcement. I want to know which local, cloud, delegated and resumed paths invoke it; what happens on timeout; and whether a bad command reached the service.

Post-tool handlers observe after successful calls and cannot undo a transfer. Some runtimes document continuation on certain hook failures. A team can see hook logs, assume control, and never test the missing or timed-out path.

Use a disposable command that appends a marker to a synthetic target when it executes. Prove that marker path works with an authorized control. Then attempt the forbidden route locally, in cloud, through a subagent and after resume where supported. Inject hook errors and timeouts; require no new marker, external readback and the exact event sequence.

Version registration, scripts and the fault matrix together. Do this because a hook is enforceable only on paths that actually call it, with known failure behavior; a narrow service credential protects routes your hook misses.

#EricFieldNotes

Four-beat scene transcript

1. A hooks comparison needs a failure injection.

A table saying Cursor, Claude Code or Codex has a pre-tool hook tells me little about enforcement. I want to know which local, cloud, delegated and resumed paths invoke it; what happens on timeout; and whether a bad command reached the service.

Visual: The documented happy path is only one route.

2. A hook event is not a denial receipt.

Post-tool handlers observe after successful calls and cannot undo a transfer. Some runtimes document continuation on certain hook failures. A team can see hook logs, assume control, and never test the missing or timed-out path.

Visual: It may run after the effect or fail open.

3. Run a denial matrix.

Use a disposable command that appends a marker to a synthetic target when it executes. Prove that marker path works with an authorized control. Then attempt the forbidden route locally, in cloud, through a subagent and after resume where supported. Inject hook errors and timeouts; require no new marker, external readback and the exact event sequence.

Visual: A harmless canary must reveal if the tool ran.

4. Treat hooks as tested coverage.

Version registration, scripts and the fault matrix together. Do this because a hook is enforceable only on paths that actually call it, with known failure behavior; a narrow service credential protects routes your hook misses.

Visual: Scope tools and credentials beyond them.

Research and claim limits

The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.

More notes from the work ↗