> For the complete documentation index, see [llms.txt](https://osintelligence-llc.gitbook.io/osintelligence/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://osintelligence-llc.gitbook.io/osintelligence/part-iii-the-evidence-what-broke/11-the-hook-telemetry-record.md).

# 11 · The Hook Telemetry Record

**The Hook Telemetry Record: Sixty-Four Days of Deterministic AI Governance in Production**

*Chapter 11 · Part III: What Broke · Field record · v1.0.0*

**Author:** Jamey Kistner, OSINTelligence LLC

**Keywords:** deterministic governance · tool-call gate · production telemetry · hard blocks · fail-open instrument · sovereign AI operating system

> **The direct companion to *****The Sovereign Triad***** (Chapter 1).** This record is the empirical substantiation the Triad's central claim rests on: the deterministic-gate layer (FC-1) that the Triad names as the first of its three components, observed here firing at production scale. The measurement exists because the architecture needed proof it fires. The gates it counts are the ones *Stateless by Construction* (Chapter 4) installs and *The Drift Taxonomy* (Chapter 9) was written to catch. Cited in-series by title.
>
> **The internal counterpart to *****The Public Case Record***** (Chapter 12).** Where that chapter shows soft enforcement failing on other organizations' systems, this one shows the mechanical gates firing on this operator's: the same governance argument measured from the two opposite sides, the outside and the inside.

> **What is new here.** The contribution is the measurement itself: deterministic enforcement at the tool-call boundary is shown to be continuous and load-bearing rather than rare-but-theoretical, 1,142 hard blocks across fourteen gates over sixty-four days of ordinary production work, each a mechanical refusal of an action a capable model attempted. The refusal distribution is the second finding and it is diagnostic, not incidental: 72% of blocks concentrate on exactly two boundaries, skill-routing and write-protection, which localizes where an agent under load actually strains against governance and turns the record into a map of where hardening earns its cost. The instrument that produced it is itself the third contribution, an austere, fail-open, un-switchable recorder whose own design obeys the governance it measures, so the record of mechanical governance is mechanically governed and cannot be silently tended, only read or deleted.
>
> **Deepest water.** §4.1, the block ledger and Figure 2, where the fourteen-hook refusal distribution resolves to skill-routing plus write-protection at 72%; §4.2, the two streams from one instrument, the enforcement stream that carries the safety claim separated in-schema from the capture stream (297,305 retrievals, \~1.5M vector hits) that compounds the corpus, so neither number contaminates the other; and the honest limit of §6, that this is one operator on one machine and that the multi-second mean latency is the capture stream, never a gate-speed claim, the gates themselves decide in sub-millisecond string, path, and hash checks.

### 1. Abstract

The first version of this report, sealed in early May 2026, described a telemetry instrument that had just been wired into a production AI coding agent and asked what it might show. This version answers the question with data. Over the sixty-four days from 2026-05-11 to 2026-07-15, a single set of deterministic enforcement hooks recorded **390,515 governance events** across 146 distinct sessions on one operator's sovereign AI operating system, running on consumer hardware. This report is the analysis of that record.

The instrument is deliberately austere: one function, log\_fire(), appends a single JSON line per hook invocation to a daily file, fails open on every error, adds sub-millisecond overhead, and has no off-switch: the operator's only brake is to delete the file. It does not decide; it records what the deterministic gates decided. That austerity is the point: the same discipline the governed system runs under (mechanical, inspectable, un-negotiable) governs the record of its own governance.

The headline finding is that deterministic enforcement is not rare-but-theoretical; it is continuous and load-bearing. The gates issued **1,142 hard blocks**, mechanical refusals of an action the model attempted, distributed across fourteen distinct enforcement hooks, while a parallel capture stream logged **297,305 memory retrievals** returning nearly 1.5 million vector hits, the mechanism by which the sovereign training corpus compounds daily rather than in batches. The record substantiates, at production scale and over a two-month horizon, the deterministic-gate layer (FC-1) that the Sovereign Triad names as the first of its three components, and it does so as observed data, not architectural conjecture.

### 2. Why measure the gates

The governing claim of this research program is that soft enforcement surfaces (system prompts, memory files, constitutional principles, rule documents) fail under sustained cognitive load: a model optimizing for task completion will, given enough context pressure, reinterpret or forget any rule it is merely asked to honor. The program's response is to move the enforceable subset of governance off the soft surface and onto a hard one: a deterministic gate at the tool-call boundary that evaluates a proposed action against a fixed specification and admits or denies it mechanically, with no reasoning the model can talk its way through.

A claim of that kind invites an obvious question: does it actually fire? A gate that never triggers is either perfectly obeyed or quietly broken, and prose cannot tell the two apart. The only honest answer is a record: every fire, every decision, every refusal, captured as it happens and counted afterward. This report is that record for the first sixty-four days it existed at scale. It is a data paper, not an architecture paper: the architecture is argued in the companion works (*The Sovereign Triad* (Chapter 1) for the three-component framing, *Stateless by Construction* (Chapter 4) for the on-disk-state discipline the hooks enforce); here the question is narrower and empirical: what did the gates do when a capable model worked under them, all day, for two months?

### 3. The instrument

Every hook, on every invocation, calls one helper. It writes one JSON line to `~/.claude/hook-state/telemetry/<YYYY-MM-DD>.jsonl` and returns. The schema is eight fields:

![The eight-field JSONL schema](https://137900913-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fxx2bv6VR9dSJDJ9HsDER%2Fuploads%2FrdaIiAO75H6lxkhCfvR8%2Fgb-ch11-fig1.png?alt=media)

Four design constraints make the record trustworthy, and each is itself an instance of the governance philosophy it measures. **Fail-open on every error:** telemetry must never change hook behavior, so any exception in logging is swallowed and the gate decides regardless. **Sub-millisecond overhead:** a single open-append-close, below the OS atomic-write threshold, so the instrument cannot become a load-bearing cost. **No off-switch:** there is no enforce/silent toggle and no mode flag, per the program's standing discipline that any softening slot invites future logic to read it and conditionally enforce; the operator's only brake is to delete the file, an act that leaves an absence rather than a silent downgrade. **Observational-only labels:** the session mode (normal, debug, plan, autonomous) lives inside the unstructured extra field, never as a top-level column, precisely so no gate can ever be tempted to branch on it. The instrument embodies the thesis: the record of mechanical governance is itself mechanically governed.

### 4. The sixty-four-day record

The window runs 2026-05-11 through 2026-07-15, sixty-four days carrying data (two calendar days produced no file and are reported as absent, not as zero). Across that window the instrument recorded **390,515 fires from twenty-nine distinct hooks across 146 sessions**, a mean of 6,102 fires per day, peaking at 11,230 on 2026-06-15. The scale alone answers the first-version question: enforcement at the tool-call boundary is not an occasional event but the continuous texture of the working day.

![The corpus at a glance](https://137900913-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fxx2bv6VR9dSJDJ9HsDER%2Fuploads%2FLGRbmQEzkGeydGQ56rnU%2Fgb-ch11-fig2.png?alt=media)

***Figure 1.** The corpus at a glance. Every number is a count of JSONL lines written by the fail-open instrument of §3; none is estimated.*

Each fire that decides carries a decision label. The distribution separates the record into its functional layers: enforcement (allow / block), context delivery (inject), escalation checks, and skill-token minting.

| Decision      | Count  | What it records                                                                    |
| ------------- | ------ | ---------------------------------------------------------------------------------- |
| allow         | 36,347 | gate evaluated the action and permitted it                                         |
| inject        | 15,942 | context delivered at the moment of need (companion doc, attestation state, memory) |
| no‑escalation | 11,728 | escalation monitor checked; nothing to raise                                       |
| mint          | 631    | skill-authorization token issued                                                   |
| block         | 1,142  | action mechanically refused before execution                                       |

***Table 1.** Decision distribution over the deciding fires. Only the 1,142 blocks are refusals; inject/mint/no-escalation are non-blocking decisions and are not counted as enforcement actions.*

#### 4.1 The block ledger

The 1,142 blocks are the load-bearing evidence. Each is a moment where a capable model attempted an action and a deterministic gate refused it at a layer the model does not control. They are not evenly distributed: fourteen enforcement hooks fired blocks, and the shape of that distribution is itself the finding, most refusals cluster on the skill-routing and write-protection boundaries, exactly the two surfaces where an agent under load most often tries to take a shortcut.

![Blocks by hook](https://137900913-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fxx2bv6VR9dSJDJ9HsDER%2Fuploads%2FddVNtEVE2cM0ELsMo1yQ%2Fgb-ch11-fig3.png?alt=media)

***Figure 2.** Where the gates refuse. Skill-routing (skill\_enforcement\_gate + bash\_skill\_intent\_check = 589) and write-protection (write\_barrier = 239) account for 72% of all refusals, the two boundaries an agent under load most often probes.*

Read as behavior rather than counts, the ledger tells a coherent story. The largest bar, skill\_enforcement\_gate at 459, is the model attempting a tool call outside the registered-skill allowlist, the mechanical form of "just this once." The second, write\_barrier at 239, is the model attempting to edit a sealed, protected, or enforcement-infrastructure file, including, by design, the gates that govern it. Together with bash\_skill\_intent\_check (130 attempts to accomplish a gated action by dropping to a raw shell command), these three hooks are the same refusal in three disguises: an agent under load reaching for the path of least resistance, and a deterministic layer that does not move. The long tail, ritual gates, read-before-edit gates, roadmap-coupling gates, is the rest of the operating discipline holding at lower frequency.

#### 4.2 Two streams from one instrument

The same hook layer produces two functionally distinct data streams, and the record makes their relative scale vivid. The enforcement-and-context stream, the blocks, injects, and gate allows analyzed above, is the smaller of the two. The larger, at **roughly 82% of all fires (≈319,000 events)**, is the capture stream: recall\_query\_capture alone fired 297,305 times, 76% of the entire record on its own, logging 12.7 MB of query text and returning 1,466,946 vector hits, with the memory-rollup and topic-prefetch hooks (auto\_memory\_post\_tool and its siblings) adding roughly 21,700 more. This stream is the mechanism by which the sovereign training corpus grows: every retrieval the model makes against operational memory, every turn-end rollup, every captured sub-task, is harvested into the corpus that trains the next cycle.

![The two streams](https://137900913-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fxx2bv6VR9dSJDJ9HsDER%2Fuploads%2F2Ry5Zy1ePEqTotiKzROH%2Fgb-ch11-fig4.png?alt=media)

***Figure 3.** The two streams. The capture stream (corpus-feeding) dwarfs the enforcement stream by volume, yet both run on the same austere instrument at no attention cost to the operator. The first measures how the corpus compounds; the second measures how the gates hold.*

The distinction matters for reading every other number in this report. Corpus growth is continuous, not batched: 1.47 million retrievals over sixty-four days is the flywheel of the companion architecture turning in real time, each retrieval both serving the current task and enriching the record that trains the next model. The enforcement stream, though smaller, is the one that carries the safety claim. Keeping them separate in the schema is what lets the record answer two different questions honestly without one contaminating the other.

### 5. Discussion

Three readings follow from the record. First, **deterministic enforcement is real and continuous.** The 1,142 blocks are not a stress-test artifact or a red-team result; they are the ambient friction of ordinary production work over two months, each one a moment where the model's intended action and the operator's governance diverged and the gate, not the model, decided the outcome. This is the empirical content behind the Sovereign Triad's first component: the deterministic-gate layer (FC-1) is observed here, at scale, doing exactly what the architecture claims it does.

Second, **the refusal distribution is diagnostic.** That 72% of blocks concentrate on skill-routing and write-protection is not incidental; it localizes where an agent under load actually strains against governance, and therefore where deterministic enforcement earns its cost. A program that had to choose which surfaces to harden first could read this distribution as a map. Third, **the instrument scales without becoming a burden.** 390,515 fail-open, sub-millisecond writes over sixty-four days imposed no measured operating cost and required no operator attention; the record accumulated itself. An instrument that must be tended is one that eventually is not; this one cannot be tended, only read or deleted.

### 6. Limitations

The report states what it measured and no more. **Latency is not a gate-speed claim.** The all-hook mean fire duration is 2,168.9 ms, but that figure is dominated by recall\_query\_capture, whose multi-second vector round-trips are the capture stream, not the gates. The enforcement gates themselves execute in sub-millisecond time (they perform string, path, and hash checks, not inference); the two must not be conflated, and this report deliberately does not publish a single "hook latency" number as though the gates were slow. A per-hook p99 split is the correct next instrument and is future work.

**The record is one operator, one machine, one agent.** These are 390,515 fires from a single sovereign deployment; they demonstrate that the instrument and the gates work at this scale in this environment, not that the block-distribution shape generalizes across operators, models, or task mixes. **Blocks are attempts refused, not intent.** A block records that an action was mechanically stopped; it does not claim the model was adversarial: most refusals are an agent under load reaching for efficiency, which is optimization pressure expressed as behavior, exactly the pressure the architecture exists to bound. And **the window has two absent days**, reported as absent rather than zero; the record is sixty-four days of data, not sixty-six consecutive days.

### 7. Conclusion

The preliminary version of this report asked whether an austere, fail-open, un-switchable telemetry instrument wired into a production AI agent would show anything worth reading. Sixty-four days later the answer is 390,515 events, 1,142 of them the deterministic gates refusing an action a capable model tried to take, and nearly 1.5 million retrievals feeding the corpus that trains the next cycle. The gates fire. They fire continuously, they fire hardest exactly where an agent under load strains against its constraints, and they fire at no cost to the operator who reads rather than tends them. Deterministic governance at the tool-call boundary is not a proposal in this system; it is a measured, two-month, production fact, and this is its record.

***

*The Sovereign Stack · The Hook Telemetry Record · Chapter 11 · Part III · v1.0.0 · License CC BY 4.0 · © Jamey Kistner, OSINTelligence LLC*

**Citation (preferred):** Kistner, J. (2026). *The Hook Telemetry Record: Sixty-Four Days of Deterministic AI Governance in Production*, version 1.0.0. OSINTelligence LLC. Cited in-series by title.

*The reference list and provenance follow as a sub-page of this chapter.*