You'll notice
Policy checks for spawning agents and calling tools now restore pinned fields a hook altered, not just flag them
What
The policy checks that run on agent.spawn and tool.call events now actively restore certain pinned fields if a hook rewrite changed them: the parent agent ID and related fields for agent.spawn, and the agent ID for tool.call. Previously these checks only flagged a mismatch rather than fixing it.
Why
This stops a hook from being able to alter security-relevant identifiers like the parent agent ID, restoring them to their correct values automatically rather than merely reporting that they were changed.