Constrain controlled CLI sessions and prove native budget overshoot

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/evidence/2026-09-09-native-cli-tools.json

@@ -0,0 +1,118 @@
+{
+  "case": "tools",
+  "binary_version": "2.1.266 (Claude Code)",
+  "binary_sha256": "19842705e989393fce936804df6d2ab034860e24b8f8880357981d87ffd83fac",
+  "argv": [
+    "/opt/claude",
+    "--print",
+    "--permission-mode",
+    "dontAsk",
+    "--allowedTools",
+    "Read,Write,Edit,Glob,Grep,Bash(git add:*),Bash(git commit:*),Bash(git status),Bash(git log:*),Bash(git diff:*),Bash(date:*),Bash(ls:*)",
+    "--output-format",
+    "json",
+    "--max-budget-usd",
+    "1",
+    "--max-turns",
+    "4",
+    "--bare",
+    "--setting-sources",
+    "",
+    "--strict-mcp-config",
+    "--mcp-config",
+    "{\"mcpServers\":{}}",
+    "--disallowedTools",
+    "mcp__*",
+    "--tools",
+    "Read,Write,Edit,Glob,Grep,Bash",
+    "--no-session-persistence",
+    "--model",
+    "claude-sonnet-4-6"
+  ],
+  "scope": "synthetic API in isolated network namespace; no real credential or provider request",
+  "returncode": 0,
+  "terminal": {
+    "type": "result",
+    "subtype": "success",
+    "is_error": false,
+    "total_cost_usd": 0.0009000000000000001,
+    "num_turns": 4,
+    "usage": {
+      "input_tokens": 200,
+      "cache_creation_input_tokens": 0,
+      "cache_read_input_tokens": 0,
+      "output_tokens": 20,
+      "output_tokens_details": {
+        "thinking_tokens": 0
+      },
+      "server_tool_use": {
+        "web_search_requests": 0,
+        "web_fetch_requests": 0
+      },
+      "service_tier": "standard",
+      "cache_creation": {
+        "ephemeral_1h_input_tokens": 0,
+        "ephemeral_5m_input_tokens": 0
+      },
+      "inference_geo": "",
+      "iterations": [],
+      "speed": "standard"
+    },
+    "permission_denials": [
+      {
+        "tool_name": "Bash",
+        "tool_use_id": "tool_denied",
+        "tool_input": {
+          "command": "printf bypass > /work/denied-ran",
+          "description": "Fixture forbidden operation"
+        }
+      }
+    ]
+  },
+  "requests": [
+    {
+      "path": "/v1/messages?beta=true",
+      "model": "claude-sonnet-4-6",
+      "max_tokens": 32000,
+      "tools": [
+        "Bash",
+        "Edit",
+        "Read"
+      ],
+      "tool_results": [],
+      "ambient_context_loaded": false
+    },
+    {
+      "path": "/v1/messages?beta=true",
+      "model": "claude-sonnet-4-6",
+      "max_tokens": 32000,
+      "tools": [
+        "Bash",
+        "Edit",
+        "Read"
+      ],
+      "tool_results": [
+        {
+          "id": "tool_allowed",
+          "is_error": false
+        },
+        {
+          "id": "tool_create",
+          "is_error": false
+        },
+        {
+          "id": "tool_denied",
+          "is_error": true
+        }
+      ],
+      "ambient_context_loaded": false
+    }
+  ],
+  "markers": {
+    "hook-ran": false,
+    "mcp-ran": false,
+    "denied-ran": false
+  },
+  "created_file": "fixture-created\n",
+  "network_namespace": "net:[4026532321]"
+}