{"contractVersion":"v0.2.7","payloadKind":"incident_evidence_bundle","generatedAt":"2026-07-31T18:30:00Z","appVersion":"0.1.0","policyPackVersion":"1.2.2","incidentRef":"action-mcp-claude-session-demo-toolu-demo01","agentActionEvents":[{"id":"action-claude-session-demo","sourceProduct":"claude","sourceEventId":"session-demo","sourceType":"local_history","agentRef":"claude:session:session-demo","runtimeInstanceRef":"device:local-mac","actorRef":"user:local","operationClass":"session","targetRef":"project:demo-app","projectRef":"demo-app","timestamp":"2026-07-31T17:38:00Z","outcome":"unknown","evidenceRefs":["claude-session-session-demo","runtime-claude-session-session-demo"],"confidence":0.78,"privacyClass":"metadata","provenance":{"sourceProduct":"claude","collectorId":"beproof.claude-history","collectorVersion":"1.0.4","sourceRecordId":"session-demo","deviceOrRuntimeRef":"device:local-mac","collectedAt":"2026-07-31T17:38:05Z","ingestedAt":"2026-07-31T17:39:00Z","transformationChain":["read_local_history","redact_secrets","normalize_agent_action_event"]}},{"id":"action-mcp-claude-session-demo-toolu-demo01","sourceProduct":"claude","sourceEventId":"toolu_demo01","sourceType":"local_history","agentRef":"claude:session:session-demo","runtimeInstanceRef":"device:local-mac","actorRef":"user:local","toolRef":"mcp:github:create_issue","operationClass":"mcp_tool_call","targetRef":"mcp:github:create_issue","projectRef":"demo-app","timestamp":"2026-07-31T17:38:12Z","outcome":"denied","evidenceRefs":["claude-session-session-demo","action-mcp-claude-session-demo-toolu-demo01"],"confidence":0.92,"privacyClass":"metadata","provenance":{"sourceProduct":"claude","collectorId":"beproof.claude-mcp-history","collectorVersion":"1.0.4","sourceRecordId":"session-demo:toolu_demo01","deviceOrRuntimeRef":"device:local-mac","collectedAt":"2026-07-31T17:38:12Z","ingestedAt":"2026-07-31T17:39:05Z","transformationChain":["read_local_history","extract_mcp_invocation_metadata","redact_secrets","normalize_agent_action_event"]}},{"id":"action-cursor-conv-demo","sourceProduct":"cursor","sourceEventId":"conv-demo","sourceType":"local_history","agentRef":"cursor:conv:conv-demo","runtimeInstanceRef":"device:local-mac","actorRef":"user:local","operationClass":"composer_session","targetRef":"project:demo-app","projectRef":"demo-app","timestamp":"2026-07-31T17:37:30Z","outcome":"unknown","evidenceRefs":["cursor-session-conv-demo","runtime-cursor-session-conv-demo"],"confidence":0.72,"privacyClass":"metadata","provenance":{"sourceProduct":"cursor","collectorId":"beproof.cursor-history","collectorVersion":"1.0.4","sourceRecordId":"conv-demo","deviceOrRuntimeRef":"device:local-mac","collectedAt":"2026-07-31T17:37:35Z","ingestedAt":"2026-07-31T17:39:10Z","transformationChain":["read_local_history","redact_secrets","normalize_agent_action_event"]}}],"policyDecisionEvents":[{"id":"policy-dec-mcp-network","actionEventRef":"action-mcp-claude-session-demo-toolu-demo01","policyRef":"policy:external-mcp-network","decision":"deny","decidedBy":"external-control:example-gateway","timestamp":"2026-07-31T17:38:13Z","evidenceRefs":["external:policy-decision:pd-mcp-42"],"confidence":0.9,"provenance":{"sourceProduct":"example-gateway","collectorId":"beproof.external-control-adapter","collectorVersion":"0.1.0","sourceRecordId":"pd-mcp-42","deviceOrRuntimeRef":"device:local-mac","collectedAt":"2026-07-31T17:38:14Z","ingestedAt":"2026-07-31T17:39:20Z","transformationChain":["ingest_external_policy_decision","normalize_policy_decision_event"]}}],"enforcementEvents":[{"id":"enf-mcp-network-block","actionEventRef":"action-mcp-claude-session-demo-toolu-demo01","policyDecisionRef":"policy-dec-mcp-network","enforcedBy":"external-control:example-gateway","result":"succeeded","timestamp":"2026-07-31T17:38:14Z","evidenceRefs":["external:enforcement:enf-mcp-42"],"confidence":0.95,"provenance":{"sourceProduct":"example-gateway","collectorId":"beproof.external-control-adapter","collectorVersion":"0.1.0","sourceRecordId":"enf-mcp-42","deviceOrRuntimeRef":"device:local-mac","collectedAt":"2026-07-31T17:38:15Z","ingestedAt":"2026-07-31T17:39:22Z","transformationChain":["ingest_external_enforcement","normalize_enforcement_event"]}}],"evidenceLinks":[{"id":"link-claude-agent-action-session-demo","fromRef":"claude:session:session-demo","toRef":"action-claude-session-demo","fromRole":"agent","toRole":"action","linkClass":"correlated_low","confidence":0.4,"reason":"Provider and project heuristic match only","provenance":{"sourceProduct":"claude","collectorId":"beproof.claude-history","collectorVersion":"1.0.4","sourceRecordId":"session-demo","deviceOrRuntimeRef":"device:local-mac","collectedAt":"2026-07-31T17:39:00Z","ingestedAt":"2026-07-31T17:39:00Z","transformationChain":["read_local_history","link_provider_project_heuristic"]}},{"id":"link-mcp-claude-session-tool-session-demo-toolu-demo01","fromRef":"action-claude-session-demo","toRef":"action-mcp-claude-session-demo-toolu-demo01","fromRole":"action","toRole":"action","linkClass":"causal","confidence":0.95,"reason":"MCP invocation metadata in the same Claude session transcript","provenance":{"sourceProduct":"claude","collectorId":"beproof.claude-mcp-history","collectorVersion":"1.0.4","sourceRecordId":"toolu_demo01","deviceOrRuntimeRef":"device:local-mac","collectedAt":"2026-07-31T17:38:12Z","ingestedAt":"2026-07-31T17:39:05Z","transformationChain":["read_local_history","link_session_mcp_invocation"]}},{"id":"link-claude-credential-session-demo","fromRef":"action-claude-session-demo","toRef":"credential:unknown","fromRole":"action","toRole":"credential","linkClass":"missing","confidence":0,"reason":"No credential reference available for this action","coverageGapReason":"credential_lineage"},{"id":"link-cursor-agent-action-conv-demo","fromRef":"cursor:conv:conv-demo","toRef":"action-cursor-conv-demo","fromRole":"agent","toRole":"action","linkClass":"correlated_low","confidence":0.4,"reason":"Provider and project heuristic match only","provenance":{"sourceProduct":"cursor","collectorId":"beproof.cursor-history","collectorVersion":"1.0.4","sourceRecordId":"conv-demo","deviceOrRuntimeRef":"device:local-mac","collectedAt":"2026-07-31T17:37:35Z","ingestedAt":"2026-07-31T17:39:10Z","transformationChain":["read_local_history","link_provider_project_heuristic"]}},{"id":"link-cursor-tool-conv-demo","fromRef":"action-cursor-conv-demo","toRef":"tool:unknown","fromRole":"action","toRole":"tool","linkClass":"missing","confidence":0,"reason":"Tool call evidence is unavailable for this session","coverageGapReason":"tool_evidence"},{"id":"link-action-policy-mcp-network","fromRef":"action-mcp-claude-session-demo-toolu-demo01","toRef":"policy-dec-mcp-network","fromRole":"action","toRole":"policy_decision","linkClass":"causal","confidence":0.9,"reason":"Shared actionEventRef between MCP action and policy decision","provenance":{"sourceProduct":"example-gateway","collectorId":"beproof.external-control-adapter","collectorVersion":"0.1.0","sourceRecordId":"pd-mcp-42","deviceOrRuntimeRef":"device:local-mac","collectedAt":"2026-07-31T17:39:20Z","ingestedAt":"2026-07-31T17:39:22Z","transformationChain":["ingest_external_policy_decision","link_shared_action_event_ref"]}},{"id":"link-policy-enforcement-mcp-network","fromRef":"policy-dec-mcp-network","toRef":"enf-mcp-network-block","fromRole":"policy_decision","toRole":"enforcement","linkClass":"causal","confidence":0.95,"reason":"Linked policyDecisionRef between decision and enforcement","provenance":{"sourceProduct":"example-gateway","collectorId":"beproof.external-control-adapter","collectorVersion":"0.1.0","sourceRecordId":"enf-mcp-42","deviceOrRuntimeRef":"device:local-mac","collectedAt":"2026-07-31T17:38:15Z","ingestedAt":"2026-07-31T17:39:22Z","transformationChain":["ingest_external_enforcement","link_policy_decision_ref"]}}],"sourceInventory":[{"sourceProduct":"claude","collectorId":"beproof.claude-history","collectorVersion":"1.0.4","status":"healthy","lastSuccessfulCollectionAt":"2026-07-31T17:39:00Z","lastAttemptAt":"2026-07-31T17:39:00Z","freshness":"recent","detail":"Claude session action evidence collected."},{"sourceProduct":"claude","collectorId":"beproof.claude-mcp-history","collectorVersion":"1.0.4","status":"healthy","lastSuccessfulCollectionAt":"2026-07-31T17:39:05Z","lastAttemptAt":"2026-07-31T17:39:05Z","freshness":"recent","detail":"MCP invocation metadata extracted from Claude session transcripts."},{"sourceProduct":"cursor","collectorId":"beproof.cursor-history","collectorVersion":"1.0.4","status":"healthy","lastSuccessfulCollectionAt":"2026-07-31T17:39:10Z","lastAttemptAt":"2026-07-31T17:39:10Z","freshness":"recent","detail":"Cursor composer session evidence collected."},{"sourceProduct":"cursor","collectorId":"cursor-usage-scanner","collectorVersion":"1.0.4","status":"degraded","lastSuccessfulCollectionAt":"2026-07-31T16:00:00Z","lastAttemptAt":"2026-07-31T17:35:00Z","freshness":"stale","coverageGapRefs":["tool_evidence"],"detail":"Composer sessions available; MCP tool-call history not exposed by Cursor ai-tracking DB."},{"sourceProduct":"example-gateway","collectorId":"beproof.external-control-adapter","collectorVersion":"0.1.0","status":"healthy","lastSuccessfulCollectionAt":"2026-07-31T17:39:22Z","lastAttemptAt":"2026-07-31T17:39:22Z","freshness":"recent","detail":"External control policy and enforcement events imported."}],"coverageGaps":[{"area":"causal_link","reason":"credential_lineage","createdAt":"2026-07-31T17:39:00Z","source":"link-claude-credential-session-demo"},{"area":"causal_link","reason":"tool_evidence","createdAt":"2026-07-31T17:39:10Z","source":"link-cursor-tool-conv-demo"}],"transformationChain":["read_local_history","extract_mcp_invocation_metadata","redact_secrets","normalize_agent_action_event","link_provider_project_heuristic","link_session_mcp_invocation","ingest_external_policy_decision","normalize_policy_decision_event","link_shared_action_event_ref","ingest_external_enforcement","normalize_enforcement_event","link_policy_decision_ref"],"manifest":{"version":"1.0","generatedAt":"2026-07-31T18:30:00Z","artifactSHA256":"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","appVersion":"0.1.0","policyPackVersion":"1.2.2","contractVersion":"v0.2.7","incidentRef":"action-mcp-claude-session-demo-toolu-demo01","manifestHash":"dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd","signingKeyId":"9ad87613db74e013ba423b66050b0cd9","signingPublicKey":"tHSQ09GJvW8f2+F62g8NCUc8hGMtf0H/8I+HFSEpPog=","signature":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","signatureAlgorithm":"ed25519-v1"}}