{
  "slug": "toolreplay-agent-tool-call-audit-2026",
  "stage": "write",
  "subject": {
    "repository": "https://github.com/brandynfisher/ToolReplay",
    "commit": "a9f1374479e91ecfcb837658285bfc7a2258dd0b",
    "version": "toolreplay 0.6.0",
    "licence": "MIT"
  },
  "methodology": "First-party reproduction re-run during the write stage on 2026-10-08: the public repository was cloned into a private per-run scratch directory, checked out at the commit recorded by the research stage, and the shipped commands were re-executed with the package's src directory on PYTHONPATH. Each entry's stdout and exit code below were captured verbatim from that run. Two short probe transcripts constructed for this review are included inline with their SHA-256. Outputs were diffed against the research-stage capture: identical apart from the exit code, which this record stores in its own field. This is a reproduction of the repository's own shipped fixture plus constructed inputs - not a production transcript. Absolute scratch paths in the command lines below are shown as $TMPDIR, the per-run private scratch directory supplied by the harness.",
  "environment": {
    "python": "3.12.3",
    "platform": "Linux-6.17.0-1019-oracle-aarch64-with-glibc2.39",
    "note": "The research-stage brief recorded Python 3.12.13; this write-stage re-run used the system python3 reported above."
  },
  "probe_transcripts": [
    {
      "name": "constructed out-of-scope call (5 lines)",
      "path": "research/evidence/toolreplay-agent-tool-call-audit-2026/raw/session-extra-outofscope.jsonl",
      "sha256": "86fe13118cfc932d3fa5bbcd27ea88f7146ae4fddb9510629c454a5e5cfc20d0",
      "content": "{\"index\": 0, \"tool\": \"list_dir\", \"args\": {\"path\": \"docs\"}, \"response\": {\"entries\": [\"intro.md\", \"guide.md\"]}}\n{\"index\": 1, \"tool\": \"read_file\", \"args\": {\"path\": \"docs/intro.md\"}, \"response\": {\"bytes\": 214}}\n{\"index\": 2, \"tool\": \"delete_file\", \"args\": {\"path\": \"docs/guide.md\"}, \"response\": {\"ok\": true}}\n{\"index\": 3, \"tool\": \"search\", \"args\": {\"query\": \"install\"}, \"response\": {\"hits\": 3}}\n{\"index\": 4, \"tool\": \"search\", \"args\": {\"query\": \"install\"}, \"response\": {\"hits\": 3}}\n"
    },
    {
      "name": "constructed permitted tool on forbidden target (1 line)",
      "path": "research/evidence/toolreplay-agent-tool-call-audit-2026/raw/session-permitted-tool-bad-target.jsonl",
      "sha256": "2514f1d204b3d24b3b7b9496898077006f285590ed0118fd32935c49275676e0",
      "content": "{\"index\": 0, \"tool\": \"read_file\", \"args\": {\"path\": \"/etc/passwd\"}, \"response\": {\"bytes\": 1}}\n"
    }
  ],
  "runs": [
    {
      "command": "python -m toolreplay version",
      "stdout": "toolreplay 0.6.0\n",
      "stderr": "",
      "exit_code": 0
    },
    {
      "command": "python -m toolreplay replay samples/session-dirty.jsonl",
      "stdout": "calls: 6\ndivergence: index 5\nfindings: 2\nindex 2: redundant-call: tool 'read_file' repeats the identical call at index 1 with no state change between them\nindex 5: non-determinism: tool 'search' returned a different response than the identical call at index 3\n",
      "stderr": "",
      "exit_code": 1
    },
    {
      "command": "python -m toolreplay scope samples/session-dirty.jsonl samples/scope.json",
      "stdout": "calls: 6\nfindings: 1\nindex 4: permission-overreach: tool 'write_file' is not in the declared scope for agent 'docs-reader'\n",
      "stderr": "",
      "exit_code": 1
    },
    {
      "command": "python -m toolreplay replay samples/session-clean.jsonl",
      "stdout": "calls: 4\ndivergence: none\nfindings: 0\n",
      "stderr": "",
      "exit_code": 0
    },
    {
      "command": "python -m toolreplay verify $TMPDIR/tr/out/sealed.jsonl",
      "stdout": "chain: intact\n",
      "stderr": "",
      "exit_code": 0
    },
    {
      "command": "python -m toolreplay verify $TMPDIR/tr/out/tampered.jsonl",
      "stdout": "chain: broken\nfirst broken link: index 3\nexpected: 34d19a9dfb112baa07afa37994ddcbbebe2973674385f3942340653d08d205bd\nfound: 40aadf3b8156217f0b5b1d95010b6b79f82a26ccf5e780aed0f5f311f865028a\n",
      "stderr": "",
      "exit_code": 1
    },
    {
      "command": "python -m toolreplay replay $TMPDIR/tr/out/x1.jsonl",
      "stdout": "calls: 5\ndivergence: none\nfindings: 1\nindex 4: redundant-call: tool 'search' repeats the identical call at index 3 with no state change between them\n",
      "stderr": "",
      "exit_code": 1
    },
    {
      "command": "python -m toolreplay scope $TMPDIR/tr/out/x1.jsonl samples/scope.json",
      "stdout": "calls: 5\nfindings: 1\nindex 2: permission-overreach: tool 'delete_file' is not in the declared scope for agent 'docs-reader'\n",
      "stderr": "",
      "exit_code": 1
    },
    {
      "command": "python -m toolreplay scope $TMPDIR/tr/out/x2.jsonl samples/scope.json",
      "stdout": "calls: 1\nfindings: 0\n",
      "stderr": "",
      "exit_code": 0
    },
    {
      "command": "python -m unittest discover -s tests",
      "stdout": "",
      "stderr": "..................................\n----------------------------------------------------------------------\nRan 34 tests in 0.014s\n\nOK\n",
      "exit_code": 0
    }
  ],
  "determinism_checks": {
    "seal_twice_identical": true,
    "seal_sha256": "679bb1da938e7fc38664feae97d82847016ad200082344f7d725c8ff535fb103",
    "replay_twice_identical": true
  },
  "malformed_input_probe": {
    "content": "{\"index\":0,\"tool\":\"read_file\",\"args\":{\"path\":\"a\"},\"response\":{\"bytes\":1},\"extra\":1}\n",
    "sha256": "29b29da9b78defba6f4a19ad9977b2558dbb0ba07633a039f37c0ec888ce9de7",
    "stdout": "",
    "stderr": "error: line 1: unexpected field(s): extra\n",
    "exit_code": 2
  },
  "shipped_sample_sha256": "93589d7a8b5f87dbdfbec93d8bb45de3d2a9abff5d4517f8ac5b68832357e3b3",
  "shipped_sealed_sha256": {
    "sealed.jsonl": "679bb1da938e7fc38664feae97d82847016ad200082344f7d725c8ff535fb103",
    "tampered.jsonl": "e8bd22501e10d9d5780bf170a9d085c63d269bbc34238e51c621f29f44502328",
    "s1.jsonl": "679bb1da938e7fc38664feae97d82847016ad200082344f7d725c8ff535fb103",
    "s2.jsonl": "679bb1da938e7fc38664feae97d82847016ad200082344f7d725c8ff535fb103"
  },
  "recorded_at": "2026-10-08T14:37:39Z",
  "raw_capture_sha256": {
    "replay-dirty.txt": "d807fe579c3baa0d6aaf11ffb1caccf8fd87a4db74fe0aef6d81abdf45703331",
    "scope-dirty.txt": "0325df14583b61d4eb787143a937455239e31c65ac60f60a92a7046e3cd527e2",
    "replay-clean.txt": "e63760bc6c094b7b88434b7ccf000a658309c102392b2aa49812b8baa4aa2a67",
    "verify-intact.txt": "9f48c296126c324979b4d9c7473b258677f18b9ca77837474ffe768ac5a6c514",
    "verify-tampered.txt": "5a107ec3a0355267fa8d5280bc0ea4bdf1557271b163f627c507b1d4ab15c79c",
    "tests.txt": "f4867d20c9d449119a1ba8ec4e99d65d39592d1db408ab66f3c8e07ae934c0b6"
  },
  "artifacts_note": "This JSON is the review's only published evidence file. The repository snapshots under sources/ and the raw capture under raw/ are third-party downloads and private author working files; they are not republished here. The two probe transcripts a reader needs are inlined above with their SHA-256, and the shipped sample plus scope file are public in the repository, so every check in the article is repeatable from primary sources alone."
}