What shipped in MVP2.0

A tested foundation for real protection, with a clear boundary between working contracts and future integrations.

The foundation is complete

MVP2.0 is the first implementation phase of the real-protection plan. It preserves the native SwiftUI app and synthetic Cloud Demo while adding strict versioned IPC contracts. It is a development preview, not an active security gate for your real sessions.

The local suite now has 43 passing tests: the original 23 plus 20 security contract tests. All three executables compile in debug and optimized configurations. Bundle relocation, resource failure, native launch and 20 light/dark render cases pass.

These checks validate software behavior in this phase. No real-host denial or real Anthropic analysis has been demonstrated yet, and the app correctly keeps real activity Not integrated.

What the new contracts enforce

IPC v2 uses explicit length-prefixed JSON, byte/depth/string/cardinality limits, strict typed fields and duplicate-key rejection before decoding. Decimal precision survives original-input canonicalization. Unknown versions, ambiguous input, malformed frames and mismatched reply IDs are rejected.

Each invocation gets a fresh 128-bit nonce generated by the operating system. Review messages bind the provider, session, event, tool call, action fingerprint, nonce and request identity. Demo-origin requests and critical quick-allow review messages cannot enter this live review contract.

A hook reply can only deny or impose no additional override. It cannot grant native permissions, rewrite the action or assert execution. Binding checks are working code; caller authentication, service-owned expiry and atomic approval consumption still need implementation.

See the v2 protocol reference for exact bounds and preserved v1 compatibility.

Try the safe helper demonstration

./scripts/build.sh
build/TraceRook.app/Contents/MacOS/tracerook-hook --protocol-version
build/TraceRook.app/Contents/MacOS/tracerook-hook --self-test
build/TraceRook.app/Contents/MacOS/TraceRookAgent --self-test

The protocol command prints 2. The hook self-test validates a synthetic adapter fixture and an in-memory v2 request/reply round trip. The service self-test validates bundled fixtures and budget framing. Neither command starts a listener, installs an integration or grants host permissions.

Continue to explore the native sample review with the preview guide. Do not install this foundation bridge into agent settings as a live hook; its operational path remains disabled.

Installed hosts are not verified coverage

The read-only audit found Claude Code 2.1.290 and Codex 0.162.0-alpha.2 on the development Mac. Those versions have not passed a TraceRook live deny test. No tool class is marked Protected, and detecting a binary is not proof that its hooks run.

Future evidence must identify exact versions, adapter and binary identity, tool class and an actual harmless deny with an absent canary side effect. Hook trust, native permissions, skipped callbacks and timeout behavior remain independent constraints.

The next PR implements authenticated service IPC, SQLite and real UI state. Safe host installation and actual callbacks follow after that security boundary exists. Real Anthropic BYOK is a separate MVP2.5 milestone.

Read the authoritative records

Read the release roadmap for the remaining gates. Real analysis, verified blocking, signed distribution and accessibility need their own evidence before a protection beta can ship.