Log Every Touch of a Regulatory-Filing Path
Distinct from a general-purpose audit log: this register exists specifically to answer "who or what touched this filing, and when" for a document that regulators or auditors may later ask about by name, kept separately so it's easy to hand over without filtering the general tool-call log.
1. Save this as the hook script
#!/usr/bin/env python3
"""PostToolUse hook — logs any tool call touching a regulatory-filing
path. Wire with matcher "*"."""
import json, re, sys, datetime
from pathlib import Path
data = json.load(sys.stdin)
path = (data.get("tool_input") or {}).get("file_path", "")
if not re.search(r"(?i)(10-k|10-q|call[-_]report|/filings/)", path):
sys.exit(0)
log_path = Path(data.get("cwd", ".")) / ".claude" / "filing_touch_log.jsonl"
log_path.parent.mkdir(parents=True, exist_ok=True)
entry = {"ts": datetime.datetime.utcnow().isoformat() + "Z",
"tool_name": data.get("tool_name"), "path": path}
with open(log_path, "a") as f:
f.write(json.dumps(entry) + "\n")
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/log-regulatory-filing-path-touches.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"PostToolUse": [
{
"matcher": "*",
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/log-regulatory-filing-path-touches.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks