A real Claude Code PreToolUse hook implementing SPEC §3: reads the pending tool
action on stdin, decides it against a JCP capability+budget set via
jcp-bridge::LocalToolGate (outside the model), seals every allow/deny as a JCR-1
receipt, and emits Claude Code's permissionDecision JSON. An ungranted tool is
denied before it executes; unconfigured, it observes and discloses non-enforcement
(§7). Drops into .claude/settings.json as a PreToolUse command hook.
Also adds jcp-bridge::LocalToolGate::receipts() so an adapter can persist the
sealed decision log. 4 tests + a live allow/deny/observe run; clippy-clean.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
76092ae036