[RefImpl] Host-side trace follow-ups that wait on PR #229 #285

Target runtime or language

AGT reference implementation: packages/host-adapter/, hosts/claude-code/, packages/guardian/src/audit-to-otlp.ts

What this proves

This is part of issue #274. These items wait for PR #229, which rewrites the host adapter, the Claude Code shim, and the handshake. They are not assigned yet.

1. Audit entries carry no tool name, so converter spans lack gen_ai.tool.name, which the mapping requires on step spans.
2. A Guardian response that can't be parsed is recorded as kind unknown, so it converts to other instead of malformed_response.
3. A malformed ask is denied with no audit entry. Issue [Bug]: acs.decision trace event cannot carry reason_codes, policy_references, cited_provenance_ids, or chain_hash, so replay from the trace alone is not possible #228 says the Observed Agent records every decision failure. See also PR Record every decision failure and count them at session end #273.
4. The Claude Code shim sends no request_id_ref on steps/toolCallResult and no capability (see PR Fix the HMAC key derivation, define key_id, and record an unresolved request_id_ref #272).
5. The shim and HTTP_PROXY. The shim sends hook payloads through any HTTP_PROXY. The README documents a workaround (PR Keep a user's proxy exemptions, warn when loopback would reach a proxy, and stop everything before a rerun #279), but there is no code fix.
   • On Bun 1.3.14, fetch, fetch with proxy: "", and node:http all went through the proxy, so the fix must use the environment the process starts with.
   • Acceptance: with a counting proxy and no NO_PROXY, the shim makes zero proxy connections on Bun 1.3.11 and 1.3.14, or it refuses with a clear message.
6. The converter drops a host-side -32005 entry. A proxy that answers -32005 to every step can make a fail-open step disappear from both streams. The reference host mints a fresh request id per request, so a -32005 in its audit log is not a real replay. The issue [Bug]: acs.decision trace event cannot carry reason_codes, policy_references, cited_provenance_ids, or chain_hash, so replay from the trace alone is not possible #228 rule against a failure event for a replay applies to the Guardian. This needs a Spec ruling. Read the code from a structured field, not from the message text.
7. The converter skips host handshake failures. After PR Carry the decision's replay facts and decision failures on Trace #275 they should become handshake_failure on the acs.session span.
8. PR fix(agt): implement ACS-Core wire safeguards #229's allow-by-default hooks are not in methods_evaluated, so they get no span. They need a span plus a marker, so they don't read as policy allows.
9. Origin and content type. The Guardian accepts a cross-site text/plain POST with any Origin, and on integration it does not yet reject replays or stale timestamps (spec §10.3). Until it does, a local process or a web page can add events to a real pair. Track this with PR fix(agt): implement ACS-Core wire safeguards #229. In the meantime, the README should say that joins can be forged.

Do you intend to implement this yourself

No. This waits for PR #229, and then it will be assigned.

Current Priority Scope

Feeds the runnable Guardian reference implementation