Bound the hook's worst-case inputs, and make the host a project remembers consistent

.github/dependabot.yml

@@ -1,18 +1,16 @@
 # rashomon dependency updates
 #
-# This file used to say there was no `gomod` entry because the module declared
-# no requirements -- standard library only, on the grounds that a PreToolUse
-# hook which blocks tool calls when it panics has no room for a supply chain --
-# and to add one the day that stopped being true. That day arrived with the
-# destinations work: reading the proxy's store needs a SQLite driver.
+# The module declares no requirements: standard library only, on the grounds
+# that a PreToolUse hook which blocks tool calls when it panics has no room
+# for a supply chain. It carried one dependency for a while, a pure-Go SQLite
+# driver that read a proxy's store, and the proxy went with its era. The
+# `gomod` entry stays, so that the next dependency is watched from its first
+# day rather than from the day somebody remembers this file.
 #
-# The recorder's guarantee did not change, and it is not the absence of
-# dependencies that holds it up. modernc.org/sqlite is pure Go, so it adds no
-# C toolchain and no cgo; it reaches the hook's own dependency graph not at all
-# (a test asserts internal/hook imports no networking package, and a second
-# asserts only internal/launch may import os/exec); and it is opened read-only
-# against a database this program never writes. What a dependency DOES add is
-# a supply chain, which is what this entry watches.
+# The recorder's guarantee is not the absence of dependencies: a test asserts
+# that no package in the binary imports a networking package, and another
+# that nothing imports os/exec. What a dependency DOES add is a supply chain,
+# which is what the entry watches.
 version: 2
 
 updates:

.github/workflows/ci.yaml

@@ -136,14 +136,6 @@ jobs:
       #     message in the log right above it;
       #   - each dynamic test must positively `--- PASS`, so renaming or
       #     deleting one cannot slip past a grep that only hunts skips.
-      #
-      # What this job still does NOT cover: TestRead_AgainstARealProxyStore
-      # (internal/wire/real_store_check_test.go) stays opt-in behind
-      # RASHOMON_REAL_STORE=/path/to/causal.db and has never run, here or
-      # anywhere. It is the one test that would catch the Altrace proxy
-      # drifting causal.db's schema out from under internal/wire's reader,
-      # and it needs a store the real proxy wrote, which the proxy team has
-      # yet to provide. When such a fixture lands, wire it into this job.
       - name: H-17 dynamic tests (a SKIP is a failure)
         shell: bash
         run: |
@@ -272,3 +264,78 @@ jobs:
         env:
           GOOS: windows
         run: go vet ./...
+
+  perf-linux:
+    name: Perf gates (linux)
+    runs-on: ubuntu-latest
+    # Benchmarks run 3x20 iterations, the RSS harness runs the release binary
+    # some three hundred times; the bound is DEL-17's.
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          # The rows in test/perf/budgets.json were measured under go1.27.2
+          # (its go_version), and allocation figures are the toolchain's:
+          # BenchmarkBuild/188 makes 21,660 allocations per op under 1.25.8
+          # and 6,832 under 1.27.2. benchgate and the harness refuse any other
+          # toolchain, so this pin moves only with a remeasurement.
+          go-version: "1.27.2"
+          cache: true
+          cache-dependency-path: go.sum  # See the test job.
+
+      # Allocations and allocation counts do not depend on the runner's load,
+      # which is why they gate on every PR and wall time never does (RES-36).
+      # The best of three runs is compared against test/perf/budgets.json at
+      # ten percent over.
+      # shell: bash runs with -o pipefail; without it the step's status is
+      # benchgate's alone, and a go test that failed to build or crashed
+      # midway would pass on whatever partial output reached the gate.
+      - name: Benchmark allocations against the budgets
+        shell: bash
+        run: |
+          set -o pipefail
+          go test -run '^$' -bench . -benchtime 20x -count 3 ./... | tee bench.txt | go run ./scripts/benchgate
+
+      # Peak RSS of the release binary per entry and per RES-28 case, the
+      # median of nine runs, and the init budget from the runtime's own trace
+      # (RES-2). Linux figures are gated against the reference rows until the
+      # platform's own baseline is recorded in budgets.json. `go test` passes
+      # a run in which every gate skipped; RASHOMON_PERF_REQUIRE_ALL fails it
+      # unless every entry row, every case gating in this tree and the init
+      # budget were compared.
+      - name: Peak RSS and init budget
+        env:
+          RASHOMON_PERF_REQUIRE_ALL: "1"
+        run: go test -tags perf ./test/perf -run 'TestRES2_|TestRES28' -count=1 -v
+
+  perf-macos:
+    name: Perf gates (macos)
+    runs-on: macos-latest
+    # The macOS runner is a 3-core M1 with 7 GB, not the M3 reference; its
+    # tolerance is 15% until 2026-11-06 while its variance is learned, then
+    # 10% (test/perf/budgets.json, platforms.darwin/arm64).
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version: "1.27.2"  # Measured under it; see the perf-linux job.
+          cache: true
+          cache-dependency-path: go.sum  # See the test job.
+
+      - name: Peak RSS and init budget
+        env:
+          RASHOMON_PERF_REQUIRE_ALL: "1"  # See the perf-linux job.
+        run: go test -tags perf ./test/perf -run 'TestRES2_|TestRES28|TestRES30_' -count=1 -v
+
+      # internal/store and test/acceptance's race suite runs on ubuntu-latest
+      # (the test job) but not here, so the darwin branch of REC-34's group
+      # commit -- sync_darwin.go, and the acceptance tests that exercise a
+      # real barrier and a real flush -- had no CI coverage at all: nothing
+      # ever ran them anywhere automated. This is a plain test, not the
+      # mutation sweep, which stays on ubuntu-latest in its own job.
+      - name: REC-34 group commit (darwin)
+        run: go test -race -count=1 -run 'TestREC34' ./internal/store ./test/acceptance

.github/workflows/release.yaml

@@ -65,10 +65,10 @@ jobs:
       - name: Vet
         run: go vet ./...
 
-      # The module gained a dependency graph when it started reading the
-      # proxy's SQLite store. Publishing a binary with a known-vulnerable
-      # module in it is the failure this catches, and a release is the last
-      # moment it is cheap to catch.
+      # go.mod names no module, so this checks the standard library and the
+      # toolchain itself rather than a dependency graph. Publishing a binary
+      # built with a known-vulnerable stdlib version is the failure this
+      # catches, and a release is the last moment it is cheap to catch.
       - name: govulncheck
         run: go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./...
 

CONTRIBUTING.md

@@ -1,9 +1,9 @@
 # Contributing
 
-This program records what a Claude Code session declared, what ran, and what
-the wire saw, and says in fixed vocabulary what it does not know. Two
-properties carry everything else, and a change that weakens either is a change
-that should not land, however much else it improves.
+This program records what a Claude Code session declared and what ran, and
+says in fixed vocabulary what it does not know. Two properties carry
+everything else, and a change that weakens either is a change that should not
+land, however much else it improves.
 
 **It never records content.** No prompt, response, file content, tool output or
 argument value reaches a record or a file in the store. The exceptions are the
@@ -25,9 +25,9 @@ never as a negative finding.
     go build ./cmd/rashomon
     go test ./...
 
-Go 1.25 or later (`go.mod` says 1.25.0). The one non-standard dependency is a
-pure-Go SQLite driver, linked for a proxy-store reader the alpha leaves dormant
-(#28).
+Go 1.25 or later (`go.mod` says 1.25.0). There are no dependencies outside the
+standard library, and a test fails the build if one brings a networking package
+in.
 
 Run the tool against a scratch store rather than your own while you work:
 
@@ -94,7 +94,6 @@ is noise.
 | `internal/store` | the append-only record store and its locking |
 | `internal/settings` | reading and editing Claude Code settings files |
 | `internal/report` | reconciling the three records and rendering them |
-| `internal/wire` | reading the proxy's store |
 | `internal/install` | the hook entries, and what counts as one of ours |
 
 `internal/shape` deserves a note. It is the single file anyone has to audit to
@@ -116,8 +115,6 @@ Stated so nobody rediscovers them as bugs:
 - **Two H-17 halves are Linux-only.** They gate on `unshare` and `strace`, so
   they skip on macOS. CI installs both on the Linux runner and treats a skip as
   a failure, which is where that coverage actually happens.
-- **`TestRead_AgainstARealProxyStore` is opt-in** behind `RASHOMON_REAL_STORE`
-  and has never run against a store the proxy itself wrote.
 
 ## Reporting a security issue
 

README.md

@@ -125,9 +125,10 @@ transcript; that quote is never stored.
 
 **Does it send anything anywhere?**
 It has no account, no telemetry and no network code of its own, and what it
-records is kept in a folder on your machine. No rashomon package imports a
-networking package, and CI checks that on every pull request, every push to
-main and every release tag. On Linux, CI also runs the
+records is kept in a folder on your machine. No package in the rashomon
+binary, its own or a dependency's, imports crypto/tls, net, net/http,
+net/http/httptrace or os/exec, and CI checks that on every pull request, every
+push to main and every release tag. On Linux, CI also runs the
 declaration hook with the network switched off; the other hooks, the report and
 the end-of-turn line have no such runtime test yet.
 
@@ -147,9 +148,10 @@ from changing its records. It is a second, independent account of what happened,
 to set beside the agent's own.
 
 **Can I see network activity?**
-rashomon itself observes no network traffic in this alpha: the report says
-`destinations: not observed in this alpha`, and `--chain` lists only the hosts
-each command *named*. If you run Claude Code inside the
+rashomon itself observes no network traffic: the report lists the hosts each
+command *named* (`hosts named by tool calls`), and `--chain` shows them beside
+the call that named them; nothing in it observed whether a host was reached.
+If you run Claude Code inside the
 [nono](https://github.com/nolabs-ai/nono) sandbox,
 `rashomon report --nono-audit <path to nono's audit-events.ndjson>` adds what
 nono allowed and refused in that session's window. If the session has no end
@@ -162,8 +164,8 @@ Plugin: open `/plugin` in Claude Code and turn it off. Command line:
 until you delete that folder.
 
 **Is it finished?**
-No. This is an alpha: Windows is not supported yet, and network destinations are
-not observed in this release.
+No. This is an alpha: Windows is not supported yet, and rashomon observes no
+network traffic; the report lists the hosts commands named.
 
 ## Inside a sandbox
 
@@ -211,8 +213,7 @@ What was measured, on macOS with nono 0.79.0 and Claude Code 2.1.285:
 - `rashomon forget --host` also keeps the host out of the sandbox section, even
   when rashomon's own records never named it.
 
-Not yet measured: Linux (Landlock), and the comparison with the Altrace proxy's
-records.
+Not yet measured: Linux (Landlock).
 
 ## Commands