MoorAI agent 0.79.9

INBOUND (stage "output"): none. The adapter replicates cli/moorai-hook.mjs handlePostToolUse in full -- the unconditional drop of threats 65 and 32 AND the per-threat INBOUND_GATES predicates for 15 and 17 -- and init() re-reads the checkout to assert its copy still matches the hook's regex literals in order, failing the run on drift. Reconciled against MoorAI's own scripts/score-webfetch-benign.mjs --split tune, which spawns the real hook: both report 27 false positives of 149 (18.12%), the same 27 sample ids, and the same per-threat split. Residual divergence: zero.

VECTOR 4 (outbound action): FIXED, and reconciled sample-for-sample. This adapter now implements the contract's optional scanAction and declares capabilities.action, so vector 4 is no longer scored by flattening tool calls to text -- there are zero degraded rows, and the harness's action -> text fallback has been deleted outright. scanAction spawns the REAL cli/moorai-hook.mjs as a subprocess, one per tool call, writing {tool_name, tool_input, session_id} to its stdin and reading permissionDecision back off its stdout; deny becomes a finding with action "block", ask becomes "justify", allow becomes no finding, and a spawn failure or an unrecognised decision throws so the row is INCONCLUSIVE rather than a silent miss. The finding id is the threat id parsed out of the hook's own reason string, so action findings share the id space of the text ones. SANDBOX: one throwaway HOME per run under the OS temp dir, shared by all 81 samples in corpus order (attacks then benign) exactly as the source scorer does, with the credential/benign/staging fixtures written where the corpus's placeholders point, cwd pinned to the sandbox, XDG/HOME scoped to it, and the policy server pointed at a closed port so the run is fully offline; close() deletes it. POSTURE: enrolled, no org policy -- an install token in ~/.moorai/config.json and nothing else, so cli/hook-core.mjs BUILTIN_DEFAULT_ACTIONS is the whole of the enforcement. That is score-vector24.mjs's "builtin" mode and it is the same posture the text side scores under (policy === null). RECONCILIATION against scripts/score-vector24.mjs --vector 4 --mode builtin at this same commit: 18/57 stopped and 1/24 benign false positive on BOTH sides, the same 39 missed sample ids and the same single false-positive id (v4-benign-003). Residual divergence: ZERO. For reference the previous flattened-text harness reported 20/57 prevented, 36/57 detected and 3/24 FP on these same samples -- the 36/57 detection figure had no hook analogue at all and is now gone rather than reconciled.

VECTOR 4 chains: the ONE remaining reading difference, and it is deliberate rather than residual. This harness headlines the CONSUME step for an attack (the step that causes the harm) and publishes the any-step reading alongside as recallAnyStep; score-vector24.mjs headlines any-step and reports the harm step separately. At the published builtin posture the two readings coincide exactly (18/57 either way, chains 2/7 broken at any step and 2/7 at the harm step), so this file's headline is not affected. Measured where they do differ, under an enforcing org policy: this harness reports 41/57 consume-step and 75.4% recallAnyStep, the source scorer reports 43/57 any-step -- the same 43, split by which reading you take. The two samples are v4-chain-002 and v4-chain-006, both denied at an earlier step and allowed at the harm step.

PREVENTION is derived under the BUILT-IN DEFAULT posture: no enrolled tenant policy, on both the text and the action side. Measured at this commit, the real hook goes from 18/57 stopped (1/24 FP) with no org policy to 43/57 (3/24 FP) under an enforcing one, and to 49/57 (11/24 FP) under the offline fail-closed default; an UNENROLLED device stops 0/57. Prevention here is understated by about that much. This is a parameter rather than a limitation -- MOORAI_POLICY=<policy.json> plants the policy in the hook's own cache for scanAction and hands the same object to threatActionFor for scanText, and the adapter prints a stderr banner whenever one is loaded -- but no number in THIS file was produced with it set.

MoorAI is at 0.79.9 rather than the 0.79.6 this file's predecessor measured. cli/, data/ and src/ are unchanged across that range, and every corpus except vector 4 scores identically to the 0.79.6 file (same caught, same false positives, corpus by corpus). The whole of the overall movement -- 230/286 to 212/286 recall, 66/875 to 64/875 false positives -- is the vector-4 harness change, not a product change.