[jaschadub]

Tool requests could bypass local checks through malformed input, an environment flag, unchecked editing aliases, or evaluator failures. The runtime integration also sent an incompatible payload, losing tool identity and arguments. This change gives both adapters one strict policy engine and requires a valid, explicit Cedar decision when project policies are configured.

• Require Python 3.11+ and Claude Code 2.1.295+; block hook startup failures and timeouts. Preserve ordinary source operations and operator opt-out.
• Cover all tool events, protect direct writes to control files and symlink targets, use bounded command checks, and retain full policy arguments.
• Make runtime MCP startup opt-in. Correct managed CLI/Landlock examples, configuration-pin and signature guidance, and the distinction between mutable local diagnostics and signed runtime journals.
• Remove tracked local development artifacts and obsolete setup instructions. Add focused CI on Python 3.11/3.14 and action dependency updates. Prepare plugin 0.6.0 without tagging or publishing.

Validation: shell syntax/ShellCheck and Python compilation pass; 79 existing shell assertions and 26 Python regression cases pass; seven real-runtime policy workflow checks pass. An installed-client test on 2.1.296 with a local synthetic provider confirms an allowed read, a Cedar-denied read, and blocking for missing/timed-out hooks. The managed DSL example parses with the current runtime. No account credentials or external model service were used.

Local hooks remain limited by shell, external-tool, filesystem-race and harness behavior; they are not OS containment. Cursor's adapter and installer are tested directly; installed Cursor UI qualification remains outstanding. The current runtime structured-response contract is intentionally required.