[CI-warning] [BYPASS] actions under .claude/.bypass have no enforcement-side audit trail — add always-on bypass-annotated logging

[akaszubski]

Summary

When .claude/.bypass is active, hooks are fully disabled — including session_activity_logger context that records WHAT state files and configs a command mutates. Actions taken during bypass windows appear in logs only as raw Bash PostToolUse entries with no enforcement-layer annotation, making post-hoc audit (e.g., by continuous-improvement-analyst) unable to distinguish "coordinator manipulated pipeline state" from "coordinator ran a test". In session 983c4c8d the CI analyst could not substantiate coordinator-reported record_agent_completion force-writes because the bypass window has no enforcement-side audit trail.

Implementation Approach

1. Add a minimal always-on audit shim: even when .bypass short-circuits enforcement, the unified_pre_tool entry point logs a one-line JSONL record {bypass_active: true, tool, command_head} before returning allow. Cost: one append, no validation.
2. Stamp bypass windows: when a session first observes .bypass, log [BYPASS-WINDOW-OPEN]; when it disappears, [BYPASS-WINDOW-CLOSE] — gives analysts bracketed regions to scrutinize.
3. Optionally include state-file mutation detection (paths under /tmp/pipeline_* and .claude/) in the shim's command_head capture.

Test Scenarios

1. With .bypass present, a Bash tool call still produces a bypass-annotated JSONL entry (enforcement skipped, audit kept).
2. Bypass window open/close markers appear exactly once per transition.
3. With .bypass absent, no behavior change (no extra log noise).
4. Logger failure does not block the tool call (fail-open preserved).

Acceptance Criteria

• PreToolUse under bypass emits bypass-annotated JSONL audit record
• Window open/close markers logged on transitions
• Zero enforcement behavior change; fail-open preserved
• CI analyst can enumerate all tool calls inside bypass windows from the activity log alone

Related

#1195 (validator skips under bypass), #1196 (root cause forcing bypass). Evidence: session 983c4c8d — 3 bypass windows, CI analyst unable to verify coordinator state-write claims.

Session: 983c4c8d (2026-06-10) | Plugin Version: 3.50.0 (c41558b)