Evidence record / grok-build
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-grok-build-local-http-approval-hooks-work-but-refused-requests-still-fail-open
Local HTTP approval hooks work, but refused requests still fail open. Local approval services become a documented usable integration. URL errors are surfaced, but a request refused at execution remains a hook error that allows the call. Proxy/DNS configuration can therefore defeat the intended policy without an affirmative deny.
Channel: tagged-release (stable 1.0.52). Half: both. Date: 2026-10-11 (1.0.52 note and shipped-guide documentation).
Operator consequence: Try loopback approval services with an independent boundary for consequential actions. Test invalid URLs, DNS failures, proxy modes, timeouts and denied replies on the actual route. Verify that failure stops the action rather than trusting a loaded managed-policy hook.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-grok-build-local-http-approval-hooks-work-but-refused-requests-still-fail-open
Profile citations
- grok-build / claim / local-http-hook-failure
Source links
Primary links, including exact changelog lines when available.
- official docs2026-10-13-grok-build-local-http-approval-hooks-work-but-refused-requests-still-fail-openstorage.googleapis.com/grok-build-public-artifacts/cli/changelogs/1.0.52.external.mdofficial docs2026-10-13-grok-build-local-http-approval-hooks-work-but-refused-requests-still-fail-openstorage.googleapis.com/grok-build-public-artifacts/cli/grok-1.0.52-linux-x86_64
Versioned source: run artifact