# CLAUDE：エージェントの副作用・復旧・人への引継ぎ

CURRENT_STATUS: UNKNOWN
OBSERVATION: UNOBSERVED
FRESHNESS: UNKNOWN
PAGE_TYPE: reference
CANONICAL_URL: /providers/pm-claude-core-05
CLAIM_IDS: none
EVIDENCE_IDS: EVD-PM-CLAUDE-CORE-05-URL-42E907E29544, EVD-PM-CLAUDE-CORE-05-URL-8A6DFE25191D, EVD-PM-CLAUDE-CORE-05-URL-83E0E00209AE, EVD-PM-CLAUDE-CORE-05-URL-4B13E3353A6A, EVD-PM-CLAUDE-CORE-05-URL-057BEF75A589, EVD-PM-CLAUDE-CORE-05-URL-6D32AB6800DD, EVD-PM-CLAUDE-CORE-05-URL-64905C5E9107, EVD-PM-CLAUDE-CORE-05-URL-FAB8CF0A2A32, EVD-PM-CLAUDE-CORE-05-URL-DFBCA3E051AF, PM-CLAUDE-CORE-05-DOCUMENT-READBACK
UNKNOWN_IDS: PM-CLAUDE-CORE-05-CURRENTNESS
OPS_IDS: none

## Summary
CORE-05のread/write境界、scoped permission、確認、receipt/readback、idempotency、補償、undo、human escalationをClaude API tools、MCP connector、Claude Agent SDK／Claude Codeへ対応づける。modelのtool_use、permission allow、hook通知、tool result、file checkpoint、外部systemのcommitを同一の「完了」にしない。Claude.ai、API、Agent SDK、Claude Code、Managed Agents、third-party MCPを同一surfaceとして扱わない。

## Current judgment
CORE-05のread/write境界、scoped permission、確認、receipt/readback、idempotency、補償、undo、human escalationをClaude API tools、MCP connector、Claude Agent SDK／Claude Codeへ対応づける。modelのtool_use、permission allow、hook通知、tool result、file checkpoint、外部systemのcommitを同一の「完了」にしない。Claude.ai、API、Agent SDK、Claude Code、Managed Agents、third-party MCPを同一surfaceとして扱わない。

## Scope
CORE-05のread/write境界、scoped permission、確認、receipt/readback、idempotency、補償、undo、human escalationをClaude API tools、MCP connector、Claude Agent SDK／Claude Codeへ対応づける。modelのtool_use、permission allow、hook通知、tool result、file checkpoint、外部systemのcommitを同一の「完了」にしない。Claude.ai、API、Agent SDK、Claude Code、Managed Agents、third-party MCPを同一surfaceとして扱わない。

## Confirmed

## UNKNOWN
- PM-CLAUDE-CORE-05-CURRENTNESS: 原資料の確定版から収録しています。外部根拠の最新性を今回の取込日で確認済みと扱いません。本文の未解決事項・残余制約を保持します。

## Evidence
- EVD-PM-CLAUDE-CORE-05-URL-42E907E29544 (RESEARCH): Anthropic, Handle tool calls: <[ — https://platform.claude.com/docs/en/agents-and-tools/tool-use/handle-tool-calls
- EVD-PM-CLAUDE-CORE-05-URL-8A6DFE25191D (RESEARCH): Anthropic, Configure permissions: <[ — https://code.claude.com/docs/en/agent-sdk/permissions
- EVD-PM-CLAUDE-CORE-05-URL-83E0E00209AE (RESEARCH): Anthropic, MCP connector: <[ — https://platform.claude.com/docs/en/agents-and-tools/mcp-connector
- EVD-PM-CLAUDE-CORE-05-URL-4B13E3353A6A (RESEARCH): Anthropic, File checkpointing: <[ — https://code.claude.com/docs/en/agent-sdk/file-checkpointing
- EVD-PM-CLAUDE-CORE-05-URL-057BEF75A589 (RESEARCH): Anthropic, Hooks: <[ — https://code.claude.com/docs/en/agent-sdk/hooks
- EVD-PM-CLAUDE-CORE-05-URL-6D32AB6800DD (RESEARCH): Anthropic, Secure deployment: <[ — https://code.claude.com/docs/en/agent-sdk/secure-deployment
- EVD-PM-CLAUDE-CORE-05-URL-64905C5E9107 (RESEARCH): anthropics/claude-code issue #36149: <[ — https://github.com/anthropics/claude-code/issues/36149
- EVD-PM-CLAUDE-CORE-05-URL-FAB8CF0A2A32 (RESEARCH): anthropics/claude-code issues #61097 and #79032: <[ — https://github.com/anthropics/claude-code/issues/61097
- EVD-PM-CLAUDE-CORE-05-URL-DFBCA3E051AF (RESEARCH): anthropics/claude-code issues #61097 and #79032: <[https://github.com/anthropics/claude-code/issues/61097](https://github.com/anthropics/claude-code/issues/61097)> ; <[ — https://github.com/anthropics/claude-code/issues/79032
- PM-CLAUDE-CORE-05-DOCUMENT-READBACK (IMPL): 原資料との収録照合

## Practice
PM-CLAUDE-CORE-05は公開仕様、固定release anchor、version/platform限定issueの範囲でbounded closeとする。公開資料から一様なdry-run/approval digest、external idempotency、exactly-once、receipt/readback、compensation、rollback、human understanding、hook retentionを推測しない。Core claimは変更せず、既存実験の帰属も維持したためGemini/GPT Product Mappingの遡及監査は不要。live、tenant、organization値は各問いとOverlayへ残す。
## 資料の識別情報
Source SHA-256 f3e072ac0823d476a687248c9a7bac46cc334d8782fc1ef848c31385cd70f0d1

## Product Mapping — Claude / CORE-05
PRODUCT_MAPPING_ID: PM-CLAUDE-CORE-05-v0.1

PROVIDER: CLAUDE / ANTHROPIC

CORE_PACKET: PKT-GEMINI-A-CORE-05-v0.1

AS_OF: 2026-09-09 22:00 JST

STATUS: PUBLIC_SURFACES_MAPPED / HISTORICAL_FAILURE_SIGNALS_BOUNDED / LIVE_ORG_VALUES_UNKNOWN

LAYER: PRODUCT_MAPPING (not Enterprise AI Core; not Organization Overlay)

## Scope
CORE-05のread/write境界、scoped permission、確認、receipt/readback、idempotency、補償、undo、human escalationをClaude API tools、MCP connector、Claude Agent SDK／Claude Codeへ対応づける。modelのtool_use、permission allow、hook通知、tool result、file checkpoint、外部systemのcommitを同一の「完了」にしない。Claude.ai、API、Agent SDK、Claude Code、Managed Agents、third-party MCPを同一surfaceとして扱わない。

## Core → Claude mapping rows
1. ROW: PM-C05-CLAUDE-001; Core contract: proposal / execution separation; Claude / Anthropic surface and current evidence: Claude APIのclient toolはmodelがtool_use blockを返し、applicationが実行して対応するtool_resultを返す。server toolとAgent SDK loopは実行場所が異なる; Mapping decision: proposed / permission_decided / executed / tool_use_id / tool_result / external_receipt / readback / acceptedを別event化。tool_useを実行・承認・commitの証拠にしない; Required verification / UNKNOWN: server-side dispatch、application IAM、外部transaction、business acceptanceはUNKNOWN

2. ROW: PM-C05-CLAUDE-002; Core contract: scoped permission / business authorization; Claude / Anthropic surface and current evidence: Agent SDKの実効判定順はhooks→deny→ask→permission mode→allow→canUseTool。hookのallowはdeny/askを越えず、MCP user-interaction toolはcallback対象となる; Mapping decision: effective rules、mode、hook/callback、principal、resource、operation、argument digestを記録。tool permissionをsource ACL、recipient権限、業務認可へ昇格しない; Required verification / UNKNOWN: managed policy、organization settings、source-system ACL、実principal bindingはOrganization OverlayでUNKNOWN

3. ROW: PM-C05-CLAUDE-003; Core contract: trusted result / evidence boundary; Claude / Anthropic surface and current evidence: tool_use_idとtool_resultを対応づけ、失敗はis_errorで返せる。外部tool resultはuntrusted contentとしてtool-result block内に保持するよう文書化される; Mapping decision: modelへ戻るresult、provider request ID、外部receipt、authoritative readbackを分離。untrusted result中の命令を次actionのauthorityへ使わない; Required verification / UNKNOWN: toolが返すsuccessの真実性、署名receipt、結果完全性、改ざん耐性はtool別にUNKNOWN

4. ROW: PM-C05-CLAUDE-004; Core contract: MCP least privilege / downstream boundary; Claude / Anthropic surface and current evidence: Messages APIのMCP connectorはremote HTTP/SSE server、OAuth bearer、server/tool allowlist・denylist・per-tool configurationを持つ。beta headerはmcp-client-2025-11-20で旧2025-04-04はdeprecated。ZDR対象外; Mapping decision: import/selection/approvalを下流IAM・commitから分離し、server URL、tool name/schema、auth scope、beta version、policy digest、resultを固定する; Required verification / UNKNOWN: third-party server retention、OAuth実scope、external receipt、tenant policy、beta移行はUNKNOWN

5. ROW: PM-C05-CLAUDE-005; Core contract: dry-run / confirmation parity; Claude / Anthropic surface and current evidence: 公開資料には全tool共通のcanonical dry-run digest、preview→execute atomic binding、承認後argument差分の一様な保証を確認できない; Mapping decision: application側でtyped previewとcanonical operation digestを生成し、target/arguments/source snapshot/policy変更時は旧承認を失効。高risk操作はread-only previewとcommitを分ける; Required verification / UNKNOWN: Claude各UIの表示順、理解率、timeout、再承認条件、人対象有効性はUNKNOWN

6. ROW: PM-C05-CLAUDE-006; Core contract: retry / duplicate side effect; Claude / Anthropic surface and current evidence: Claude Code issue #36149はv2.1.79・Windows 11・stdio MCPで同一callが異なるtool_use_idにより2回dispatchされたという再現報告を記録する; Mapping decision: historical/operator failure signalとして、caller operation ID、parameter digest、external dedup、receipt/readback、blind retry禁止を要求する; Required verification / UNKNOWN: v2.1.259、他OS/transport、current connectorでの再現性は未確認。現行一般欠陥とはしない

7. ROW: PM-C05-CLAUDE-007; Core contract: undo / compensation boundary; Claude / Anthropic surface and current evidence: Agent SDK file checkpointingはWrite/Edit/NotebookEdit等の追跡対象ファイルに限定され、Bash、remote file、directory、通常のsubagent edit等を戻さず、conversationも巻き戻さない; Mapping decision: checkpoint restoreを外部transaction rollbackや会話state復元と呼ばない。対象外effectには事前backup、compensation、external readback、RECOVERY_FAILEDを設ける; Required verification / UNKNOWN: real filesystem、subagent、remote/MCP effect、partial rollbackはlive試験なしではUNKNOWN

8. ROW: PM-C05-CLAUDE-008; Core contract: human escalation / fail-closed; Claude / Anthropic surface and current evidence: issue #79032はv2.1.215 Linuxでauto-accept safety classifier不在時にmanual fallbackなく停止した報告、#61097はremote Routineのconnector approval UI欠落を報告しAnthropicがaddressedと記載した履歴; Mapping decision: historical bounded signalとして、approval service不能時のfail-closed、manual route、timeout/owner、resume identity、no blind bypassを必須にする; Required verification / UNKNOWN: current release、全platform、組織policy、実fallback availabilityはUNKNOWN。修正済み主張を現行保証へ一般化しない

9. ROW: PM-C05-CLAUDE-009; Core contract: hook / audit / final acceptance; Claude / Anthropic surface and current evidence: Pre/PostToolUse等のhooksは介入・通知点を提供するが、webhook failure例や遅延があり、eventは外部systemのauthoritative receiptではない。固定release anchorはPython SDK v0.2.152／commit a8b1e28／bundled CLI 2.1.259; Mapping decision: hook event、permission decision、tool result、external receipt/readback、verifier、final acceptanceを別々に保存。hook failureで証拠chainが欠けたらEXECUTION_UNVERIFIED; Required verification / UNKNOWN: delivery、ordering、retention、redaction、immutable audit、SLOはdeployment/Organization依存

## Safe verification profile
許可された非業務環境、非機密synthetic fixture、専用test accountだけで実施する。今回はAnthropic API、organization、SDK/CLI process、MCP server、filesystem、外部systemを操作していない。

- read-only client toolでproposal、permission、execution、tool_result、external readbackを別々に記録する。

- deny/ask/mode/allow/hook/canUseToolを組み合わせ、実際にconsultされたgateとsource-system ACLを照合する。

- preview後にtarget/argument/source snapshotを一つだけ変え、旧approvalがapplication digestで失効することを確認する。

- commit後response lossを注入し、異なるtool_use_idでも同一operation IDを重複実行しないことを検査する。

- MCP transport・beta version・tool filter・OAuth scopeを固定し、tool resultと外部authoritative stateを突合する。

- checkpoint対象内外を混在させ、local rewind、conversation、Bash、subagent、remote effectの残差を別表示する。

- approval service/classifier不可、timeout、resumeを注入し、fail-closed/manual escalation/no blind bypassを検査する。

- hook delivery欠落時もapplication ledger、receipt、readback、final acceptanceで状態を復元できるか確認する。

既存CORE-05の基本6 ruleと26 assertionsはCOMPILER_EXPERIMENTとして再利用するが、Claude/Anthropicのlive安全性や可用性の実測へ再分類しない。

## Evidence and provenance
- Anthropic, Handle tool calls: <[https://platform.claude.com/docs/en/agents-and-tools/tool-use/handle-tool-calls](https://platform.claude.com/docs/en/agents-and-tools/tool-use/handle-tool-calls)> (accessed 2026-09-09)

- Anthropic, Configure permissions: <[https://code.claude.com/docs/en/agent-sdk/permissions](https://code.claude.com/docs/en/agent-sdk/permissions)> (accessed 2026-09-09)

- Anthropic, MCP connector: <[https://platform.claude.com/docs/en/agents-and-tools/mcp-connector](https://platform.claude.com/docs/en/agents-and-tools/mcp-connector)> (accessed 2026-09-09)

- Anthropic, File checkpointing: <[https://code.claude.com/docs/en/agent-sdk/file-checkpointing](https://code.claude.com/docs/en/agent-sdk/file-checkpointing)> (accessed 2026-09-09)

- Anthropic, Hooks: <[https://code.claude.com/docs/en/agent-sdk/hooks](https://code.claude.com/docs/en/agent-sdk/hooks)> (accessed 2026-09-09)

- Anthropic, Secure deployment: <[https://code.claude.com/docs/en/agent-sdk/secure-deployment](https://code.claude.com/docs/en/agent-sdk/secure-deployment)> (accessed 2026-09-09)

- anthropics/claude-code issue #36149: <[https://github.com/anthropics/claude-code/issues/36149](https://github.com/anthropics/claude-code/issues/36149)> (opened 2026-03-19; accessed 2026-09-09)

- anthropics/claude-code issues #61097 and #79032: <[https://github.com/anthropics/claude-code/issues/61097](https://github.com/anthropics/claude-code/issues/61097)> ; <[https://github.com/anthropics/claude-code/issues/79032](https://github.com/anthropics/claude-code/issues/79032)> (opened 2026-05-21 / 2026-07-19; accessed 2026-09-09)

- fixed release anchor reused: EXT-C01-032

## Boundary decision
PM-CLAUDE-CORE-05は公開仕様、固定release anchor、version/platform限定issueの範囲でbounded closeとする。公開資料から一様なdry-run/approval digest、external idempotency、exactly-once、receipt/readback、compensation、rollback、human understanding、hook retentionを推測しない。Core claimは変更せず、既存実験の帰属も維持したためGemini/GPT Product Mappingの遡及監査は不要。live、tenant、organization値は各問いとOverlayへ残す。

NEXT: /agent/start.json
STOP: This is a knowledge projection, not an execution order.