The read boundary says when it fires

[tobert]

Two run_kaish calls through MCP yesterday — one served, one refused at the boundary — produced exactly one span and zero log lines about the path outside the allowed set. kaibo logged 329 info + 12 warn that day and none of them was the refusal.

For a product whose whole claim is read-only containment, the boundary firing is the most interesting event there is, and it left no trace at all. An operator watching a fleet could not tell a boundary that never fired from one that fired a hundred times — and #184 shipped three fixes to exactly that boundary with no way to see it exercised in the field.

Observability, not correctness. Nothing here changes what kaibo refuses.

The funnel

Every containment refusal already routes through one function, Resolver::containment_error. resolve_root, resolve_attachments, and read_contained_file all call it, and they are reached from five MCP tools and four CLI subcommands. One warn there covers the whole class, and a fourth surface added later is reported the moment it uses the shared check.

Where the path goes, and why

The split between the field and the message is kaibo's existing export policy, not a new one:

• outcome = "refused" is a field, and outcome is already on SAFE_ATTRIBUTES — so that a refusal happened always exports, with no allowlist change.
• The paths live in the message body, which CONTENT_ATTRIBUTES holds back from traces unless the operator sets capture_content.

A caller-named path is content by the same rule that keeps gen_ai.tool.arguments off the safe list — the comment there says "which names paths" in as many words. The alternative was adding a path to SAFE_ATTRIBUTES; Amy chose this one, because it needs no new policy. The logs signal carries the line whole, which is what that signal is for.

run_kaish opens its span before the check

It used to build the span after resolve_root, so a refused call was the one outcome of the tool that produced no span at all. tool_span.rs had already settled the same question for the inner tools — a malformed-args refusal is reported as outcome = error rather than never appearing, "the honest reading of did this call work" — and this is the MCP surface catching up. The span now brackets the whole call, so its duration includes the check and the worker spawn; nothing asserted the old bracket.

The review found a real bug in the first cut

A cross-family pass (kaibo cast crusoe — explorer DeepSeek-V4-Flash, synth GLM-5.3) caught that the first cut recorded outcome = "refused" on every resolve_root error. It refuses four ways — no default root, a path that does not resolve, a path that is not a directory, and the boundary — and only the last is the boundary firing. A typo'd path made the span claim a boundary hit the logs knew nothing about, so an operator alerting on refused would have been counting typos.

Fixed by putting each writer where the knowledge is: containment_error records refused itself; Span::record is a no-op for a field the current span never declared, so it reaches exactly the spans built to receive it. The handler pre-sets error and lets that refinement land after it — which also means a future early return closes error rather than closing with nothing.

Every citation in that review was verified against source before I acted on any of it. Three prose corrections came from the same pass, and one drive-by: resolve_attachments' doc comment was sitting on read_contained_file, fused ahead of that function's own doc, leaving resolve_attachments undocumented.

What still doesn't reach traces

The other four handlers refuse before they have a phase to open a span around, so for them the logs signal is the only road. That's named in telemetry.rs's module doc rather than left for the next reader to rediscover; giving them handler-level spans is a larger change than this one. The sibling refusal for an attachment outside the session root stays quiet on purpose — that file is inside the allowed set, and the refusal is about which project the call mounts, not about the boundary.

Tests

Seven, all run against the pre-fix code and failing there: three refusal surfaces (zero events captured), the run_kaish pair (no span, no outcome field), and the vocabulary test that reproduces the reviewed bug. Two negative controls, both sabotage-checked rather than assumed:

• an allowed path stays quiet — moved the warn to fire on every resolve, went red.
• a nonexistent path reads error — restored the first cut's recording, went red.

New reusable capture helpers in test_support.rs, riding the existing serialized_capture guard so they inherit the callsite-interest protection that module already documents.

Suite: 1348 passed, 0 failed. Clippy clean.

🤖 Generated with Claude Code