Fix/selective post tool cloud reporting

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [Unreleased]
+
+### Changed
+- Native `PreToolUse` actions remain the primary Cloud records, while routine successful `PostToolUse` observations now stay local and only failures, elevated risks, anomalous results, or material new findings are uploaded as separate redacted events.
+- Native web-fetch audit events now retain a bounded sanitized destination instead of a generic placeholder, without uploading URL credentials, fragments, query values, or sensitive path segments.
+- Native file, configuration-change, model-switch, and policy-reason events now retain bounded allowlisted summaries instead of generic placeholders, without uploading paths, contents, patch bodies, endpoints, credentials, or raw reason text.
+
 ## [1.2.1] - 2026-09-29
 
 ### Added

docs/claude-code.md

@@ -34,6 +34,8 @@ Hook execution is bounded to 30 seconds. Claude Code may continue the original a
 
 `PostToolUse` scans `tool_response`. AgentGuard uses `updatedToolOutput` only for verified response shapes: Read, Bash/PowerShell, WebFetch/WebSearch, and MCP content results. Redaction preserves the verified string/object/array shape. Unknown output schemas are not guessed or destructively rewritten; sensitive unknown output is marked `partial`/`would_block`, and `PostToolBatch` remains the continuation gate.
 
+Routine successful `PostToolUse` observations remain in the local audit and are not uploaded. Failures, elevated risks, anomalous results, and other material new findings are uploaded as separate Cloud events containing only redacted summaries and bounded status metadata.
+
 `PostToolUseFailure` records only redacted failure type/summary and coverage. It cannot replace or block a failed tool's output. Whether a particular Claude Code version includes failed results in a following `PostToolBatch.tool_calls[].tool_response` is `unverified` until tested on that version; if absent, the failure-output path is `unsupported`.
 
 `PostToolBatch` scans each official `tool_calls[].tool_response` result Claude is about to use, records bounded file-path, byte, and redaction counts, and can stop the agentic loop before the next model call. Tool reads and side effects have already occurred. Existing transcript content is not removed, and a resumed session is not guaranteed to suppress retransmission.
@@ -54,4 +56,10 @@ An `@file` path without an explicit exact deny is `unsupported` and is not count
 
 Raw prompts, command arguments, tool output, failure text, configuration content, credentials, and PII are evaluated locally. Native Claude hook audit and Cloud records keep prompts and tool output local, while shell actions may retain a redacted command preview. Protected-file actions retain only a bounded, validated explanation such as `cat .env` or `cat .ssh/id_ed25519.pub`, without the absolute path, remaining arguments, redirects, substitutions, or command tail. Hook stdout/stderr never echoes raw input.
 
+`PreToolUse` is the primary Cloud action record. Raw stdout and stderr are never uploaded from either lifecycle stage; reportable Post events carry only the redacted risk summary and necessary status fields.
+
+WebFetch Pre events may retain only a bounded destination preview. URL credentials, fragments, query values, and sensitive or opaque path segments are removed before Cloud sync.
+
+File-tool and ConfigChange events may retain a validated basename or bounded file count; absolute paths and all file/configuration content stay local. Model-switch events may retain validated model labels, a bounded source label, and a non-negative context-token count. Endpoint-like and credential-like labels are replaced with `unknown`.
+
 Claude Code provides strong staged prompt/tool/context protection, but it does not expose the final model HTTP destination, Authorization credential, complete assembled payload, full response, all retries/fallbacks, or auxiliary model calls. Model-transport rules therefore remain `partial` or `unsupported`; AgentGuard does not claim complete model-traffic interception.

docs/codex.md

@@ -54,6 +54,9 @@ from a repository subdirectory does not bypass them.
   result prevents the original result from continuing to the next model step.
   The tool has already run, so filesystem, network, and other side effects are
   not undone.
+  Routine successful observations remain local; only failures, elevated risks,
+  anomalous results, or other material new findings are uploaded as separate
+  Cloud events.
 - `PreCompact` and `PostCompact` record only the trigger and redacted policy
   metadata. AgentGuard does not open or parse `transcript_path`, and compact
   metadata is not sent to AgentGuard Cloud.
@@ -83,6 +86,14 @@ tool output, credentials, or PII. Native shell actions may retain a redacted
 command preview. Protected-file actions retain only a bounded, validated
 explanation such as `cat .env` or `cat .ssh/id_ed25519.pub`, without the
 absolute path, remaining arguments, redirects, substitutions, or command tail.
+Raw stdout and stderr are never uploaded. `PreToolUse` remains the primary
+Cloud action record, while only material `PostToolUse` findings are uploaded as
+separate events.
+Web-fetch Pre events may retain only a bounded destination preview; URL
+credentials, fragments, query values, and sensitive or opaque path segments
+are removed.
+File-tool Pre events may retain a validated basename or bounded file count.
+Absolute paths, file contents, edit bodies, and patch bodies remain local.
 
 ## Coverage and known gaps
 

docs/privacy-boundary.md

@@ -33,6 +33,24 @@ Only redacted, Cloud-eligible runtime audit previews are uploaded by default:
   Protected-file access uses only a bounded, validated target summary such as
   `cat .env` or `cat .ssh/id_ed25519.pub`; absolute paths, additional
   arguments, redirects, substitutions, and command tails are omitted.
+- Native web-fetch Pre events retain only a bounded `http`/`https` destination.
+  URL credentials, fragments, query values, sensitive path segments, and
+  opaque token-like path segments are removed; safe query names may remain.
+- Native file reads and writes retain only a validated basename or bounded file
+  count. Absolute paths, file contents, edit bodies, and patch bodies stay
+  local. Configuration changes use the same boundary.
+- Native model-switch events retain only validated model labels, a bounded
+  source label, and the non-negative context-token count. Endpoint-like or
+  credential-like labels are replaced with `unknown`.
+- Native policy reasons use static titles selected by allowlisted rule ID;
+  descriptions, evidence, and remediation text remain redacted.
+- Native `PreToolUse` events are the primary Cloud action records. Routine
+  successful `PostToolUse` observations stay in the local audit. A post-tool
+  event is uploaded separately only when it adds a failure, elevated risk,
+  anomalous result, PII summary, or another material security finding.
+- Raw stdout and stderr are never uploaded from either lifecycle stage.
+  Reportable post-tool events contain only the redacted risk summary and
+  bounded status metadata.
 - Decision, risk score, risk level, reasons, and policy version
 - Lifecycle stage, coverage level, enforcement status, missing-fact names, and
   request correlation IDs
@@ -75,10 +93,10 @@ Cloud endpoints also apply server-side redaction, but clients should not rely on
 ## Offline behavior
 
 If Cloud is unreachable, AgentGuard continues local enforcement and spools
-Cloud-eligible redacted audit events for later retry. Routine model requests and
-model responses are filtered again at the Cloud client boundary, including
-when an older spool is drained. It must never fail open for local `block`
-decisions.
+Cloud-eligible redacted audit events for later retry. Routine post-tool
+observations, routine model requests, and model responses are filtered again
+at the Cloud client boundary, including when an older spool is drained. It
+must never fail open for local `block` decisions.
 
 Local policies are normalized when loaded, so caches written before the LLM
 privacy fields existed inherit the bundled privacy defaults. Cloud availability