Comparing notes: signed egress receipts and per-call tool-action decisions

[Rul1an]

Pipelock has been on my radar since I read the line that a receipt is only as good as what the signature is over, and that the decision should come from a mediator outside the agent process. That is the exact principle I have been working from, just on a different surface. Where pipelock signs content-aware decisions over the mediated traffic (HTTP, MCP, A2A, egress), I have been on the per-call tool-action side: given a tool surface and a policy, decide before forwarding whether a privileged action like adding a deploy key was declared, scoped, and approved, and write a replayable record of that decision from outside the agent as well. I keep the boundaries explicit, since it is easy to overclaim: an allow is only the decision to forward and not proof the action landed, and a deny is fail-closed caution rather than a verdict on intent.

There is a one-minute demo if you want the shape: https://github.com/Rul1an/assay-agent-gate-demo has two open PRs, a red one where an agent tries an ungranted deploy key (denied before it forwards, surfaced in the Security tab) and a green one where the same action is declared and scoped. It runs offline against a mock.

The part that made me want to reach out is agent-egress-bench. Would you be up for trading conformance vectors between your egress benchmark and my privileged-action cases, so each of us can throw the other boundary some genuinely hard inputs? Your tools/list rug-pull check also looks like it is poking at the same thing I do when a tool surface changes after approval, so there may be more common ground than not. Peer curiosity, not a pitch.