Record coding-agent sessions. Make the PR reviewable.

Claude Code and Cursor can edit files, run commands, and open PRs. With Primust in the path before the session, each run emits a portable credential so branch protection and human review can evaluate the recorded session.

§ 01 — Premise

The diff is not the review record. The session is.

A PR shows the end state. Review still needs the session context: which files changed, which commands ran, which checks reviewed the exact diff, which policy gates fired, and which actions were blocked.

Primust emits a VPEC as each coding-agent session closes. The PR carries that credential, and branch protection can require proof floor, provable surface, and specific gap codes before merge.

§ 02 — The two agents we ship first

Claude Code · Cursor.

Claude Code

primust-hook · hooks + MCP bridge

The MCP bridge observes every tool call. A PostToolUse hook writes the session VPEC on exit. primust-hook is a Go binary — IT-deployable, per-invocation, zero permanent state.

Cursor

primust-hook + Cursor extension · background agents + composer hooks

The extension taps Composer edits and background-agent runs. primust-hook binds tool invocations and terminal commands to the session. Same binary, same governance, local or CI.

§ 03 — Install

One command. Zero permanent state.

primust-hook is a per-invocation Go binary. It runs for the duration of a single agent action, writes its VPEC, and exits. No daemon. No background process. Nothing persistent to audit, rotate, or fail-closed.

Claude Code~/.claude/settings.json

$ pip install primust
$ primust init  # auto-wires the hook

Cursorextension marketplace

$ pip install primust
$ primust init
$ cursor --install-extension primust

Enterprise deploys via managed-settings (macOS/Linux paths in ClaudeCode/managed-settings.json) so IT owns the key + policy-pack selection; developer machines can't opt out.

§ 04 — What's recorded

Seven event kinds. Every session, every agent.

tool_call

every file edit, bash command, read, or MCP tool

tool, args commit, exit code, took_ms, policy verdict

file_edit

Edit / Write / MultiEdit tool invocations

path, before/after commit, lines changed, bytes diff

bash_command

every Bash tool invocation

argv, cwd, exit code, stdout/stderr commit, egress hosts

policy_gate

a declared check ran on the proposed action

id, verdict, floor, reason, visibility

blocked

an action the policy pack forbade

attempted tool, args commit, reason code, policy ref

egress

any outbound network call during the session

host, method, path, bytes_out commit, verdict

reviewer

dual-sign gate satisfied (optional)

reviewer id, attestation method, signed_at

Content bodies never transit Primust — only commitment hashes. An auditor verifying the VPEC can prove the tool call happened without ever seeing what the tool returned.

§ 05 — PR gating

Block merges on the VPEC.

A GitHub Action runs primust verify against the VPEC the agent wrote. Fail the build on unacceptable proof floor, low surface, or specific gap codes.

# .github/workflows/primust.yml
- name: verify agent VPEC
  run: |
    primust verify ./agent.vpec \
      --require-floor execution \
      --min-surface 0.85 \
      --forbid-gap G-017,G-045

§ 06 — Sample output

One agent session. One portable credential.

Emitted when the session closes. Verifiable offline by anyone with the Apache-2.0 primust-verify CLI.

primust verify ./pr-4721.vpec

✓ verified · offline

// agent-commit.vpec.json
{
  "vpec":              "primust/v1",
  "kind":              "agent.commit",
  "agent":             "claude-code@1.8.2",
  "repo":              "acme-corp/payments",
  "operations":        { edits: 17, bash: 4, reads: 31 },
  "policy_gates":      [ "no_secrets", "no_prod_db", "coverage>=0.8" ],
  "blocked":           [ "writes_to .env", "curl api.stripe.com" ],
  "diff_commit":       "poseidon2:c41a…d8e3",
  "provable_surface":  0.91,
  "proof_level_floor": "execution",
  "reviewer":          "nicolas@acme.io",
  "signed_at":         "2026-03-16T14:22:08Z"
}