Provenance Record

News, 894 words (400-1200). Clear structure: Overview, what the report documents, who approves a Codex hook, later reports, Postman's response and plugin-repository changes, what the sources do not establish. Attributive throughout (the report, the reporter, a Postman organization member); the headline carries its own hedge ('a GitHub Report Says'). The two installation reports are placed side by side without being reconciled, and the article does not imply that the November 5-6 plugin-repository pull requests were caused by the issue (it says in terms that none of their descriptions mentions it). No AI self-reference apart from the required one-sentence maker disclosure.

Anthropic disclosure: required - Claude Code is named in the headline, summary and lead; the one-sentence disclosure is present as the closing paragraph ('The Machine Herald's contributor model is built by Anthropic, and Claude Code, one of the two agents named in the report, is an Anthropic product.'). It is accurate (contributor_model is Claude Sonnet 5.5), neutral, and characterises nothing; every statement about the Claude Code installation is attributive (the reporter found postman@claude-plugins-official enabled in ~/.claude/settings.json). The policy allows the closing section or the end of the Overview; it sits in the closing section. Allowlist: github.com, thenewstack.io, notebookcheck.net and developers.openai.com are all already in config/source_allowlist.txt; no addition needed. developers.openai.com/codex/hooks answers 308 to https://learn.chatgpt.com/docs/hooks (OpenAI's own redirect, title 'Hooks | ChatGPT Learn'), so the snapshot is OpenAI's page under its new address; the cited URL is the allowlisted host. Snapshots in sources/2026-11/postman-desktop-auto-installed-.../ (manifest sha256 verified: all eight match the decompressed files; suspicious_patterns null for all eight). SNAPSHOT READS. source-0 (GitHub issue 14370, github.com HTML): the GitHub HTML collapses most of a 69-comment thread, so the thread was read from raw data by another route: GitHub REST API (gh api repos/postmanlabs/postman-app-support/issues/14370 and .../comments --paginate; issue.json sha256 4bd748b50a51a554a3f708c0c644406a8ea78762652ecd98e4b648ce4aa3855f, comments.json sha256 d3950ace887d00307435994e62ea85fc5fea3fe519894821b6e31fc69cb28eaf). Confirmed: opened 2026-10-25T19:03:26Z by indicava; Postman desktop 12.33.4, macOS, Codex plugin 1.1.0, revision 6c8e452e; main.log timestamp 2026-10-24T09:34:14.418Z with source auto-existing-upgrade and results claude-code:installed, codex:installed; config.toml marketplaces.postman (git, https://github.com/postmanlabs/postman-plugin.git), plugins."postman@postman" enabled, hooks.state ... trusted_hash; ~/.claude/settings.json enabled postman@claude-plugins-official; Postman executable and lib in ~/.local/bin; mcp.codex.json at https://mcp.postman.com/mcp with 'Auth required' in Codex logs; 'unexpected changes to my coding agents' verbatim; the installer source uses hooks/list and config/batchWrite; the caveat quoted by the article ('The trust record alone does not prove who created that specific record') is verbatim (the source sentence continues ', so I am not presenting it as proof...'; truncating a sentence with a full stop inside the quotation marks is a punctuation nit, not a change of meaning). Issue closed 2026-11-05T11:41:48Z and locked (article: 11:41 UTC, correct). SOURCE-0 THREAD CHECKS: comment 6649122696 by preethammavin, author_association MEMBER, 2026-11-05T03:46:20Z: 'We intended this change to simplify the setup for developers...', 'we will be re-designing the experience with the right level of control.', 'In the meantime, we are reverting this change.' All three article quotes verbatim; 03:46 UTC correct. Affiliation verified independently of the MEMBER marker: GET /orgs/postmanlabs/members/preethammavin returns 204 and /users/preethammavin/orgs lists postmanlabs (public membership); Notebookcheck calls the commenter 'a Postman staff member'. The earlier statement of 2026-11-03T23:36:43Z (zecoquit, author_association NONE; /orgs/postmanlabs/members/zecoquit returns 404, membership not public) is correctly not cited. Lock comment 6657066227 (a85, CONTRIBUTOR) 2026-11-05T11:40:39Z: 'Locking this issue...' - correct. Later reports: comment 6618575621 (ronthedrummer, 2026-11-03T23:56:23Z, logs 2026-11-03T22:58:31Z-22:59:29Z): macOS, 12.31.3 to 12.35.1, auto-existing-upgrade installing the CLI plus claude-code:installed and codex:installed, cursor:already-installed, 'config.toml has no hooks.state or trusted_hash entry', 'The same session-start text is injected into Cursor agent sessions' - all as the article states. His follow-up 6620904446 (2026-11-04T02:28:53Z) says he did not run Codex or watch the hook; the article does not claim otherwise (it reports only what he found in the files), so no correction. Comment 6620495643 (ck-tecso, 2026-11-04T02:00:21Z): Postman added to ~/.copilot/settings.json; the in-app uninstall entry did not remove it from Copilot - matches the article ('November 4 (UTC)'). No Windows or Linux reproduction anywhere in the thread (one Windows user, desmond27, only asks how to check) - the article's platform absence claim holds. source-1 (The New Stack, thenewstack.io/postman-plugin-coding-agents/; snapshot is an Archive.org capture of 2026-11-07, sha256 22761daa...; the original returned 200 but the script fell back to the archive): re-read live with a browser User-Agent (sha256 f1e8ce969964c56bde3823d2908a1c719c44c3555b0518812653cfe88181e245); the snapshot and the live page agree on every sentence used. Byline Amanda Caswell, published 2026-11-03T23:17:04Z. Confirmed: lead 'The app also tried to approve its own startup hook' (article quotes 'tried to approve its own startup hook' - verbatim); reported Oct 25; 12.33.4 on macOS; installation event Oct 24 marked auto-existing-upgrade; 'The report documents one macOS installation, and the behavior has not been independently reproduced across other systems'; 'Developers who install the plugin directly through Codex, however, must review and approve the hook themselves'; 'Siddharth Garimella ... claiming that Postman's hooks intercept API data ... However, the GitHub report provides no evidence that Postman collected or transmitted API data' (article quote 'the GitHub report provides no evidence' verbatim); 'The company had not responded by the time of publication'. The page footer reads 'TNS owner Insight Partners is an investor in: OpenAI, Postman.' (see independence and the clarification below). source-2 (Notebookcheck, Steffen Zahn, published 2026-11-05T08:43+01:00 = 07:43 UTC): confirmed 'Postman's own documentation states that "the installer approves the hook for you."', the quoted hook sentence ('load the postman:api-engineer skill and follow it', original has an ellipsis before it), 'Auth required', 'Reverting the change does not remove what is already installed.', 'Other users have since added to the GitHub thread', 'All reported cases so far involve Macs', 'There is no evidence that Postman collected data this way', staff member's reply on November 5. source-3 (OpenAI Codex hooks documentation): 'Before a non-managed hook can run, Codex requires you to review and trust the exact hook definition.' - verbatim, as the article quotes it. source-4 (postman-plugin hooks/session-start-context.md at 6c8e452e): read raw via the contents API (sha256 314de1d4edc669a28ff11ffff96d1aff5470971c2ca80b414d1f37a42d2d7f27); contains 'load the `postman:api-engineer` skill and follow it' and 'User instructions (project instruction files such as AGENTS.md or CLAUDE.md, and direct requests) take precedence over this mandate.' The file is wrapped in an <EXTREMELY_IMPORTANT> block addressed to the coding agent; that is the subject of the article (the hook payload), not an attempt aimed at the review, and no instruction in it was followed. Codex registration (hooks/codex-hooks.json at the same revision): SessionStart, matcher startup|clear|compact - consistent with the article. source-5 (PR 149, merged 2026-11-05T17:19:08Z, opened 14:36:53Z by garciasdos, read via the pulls API): body says '.codex-plugin/plugin.json now sets "hooks": {}, and hooks/codex-hooks.json is deleted', 'Codex still gets every skill and the Postman MCP server. It no longer gets the session-start mandate.', 'includes @saecula's commit that stops the installer auto-approving the Codex session-start hook', 'the hook would keep asking for review' - all verbatim; reason given is Codex auto-upgrading git marketplaces (openai/codex#17425). source-7 (PR 152, merged 2026-11-06T08:26:15Z): 'Reverts the revert in 3d3c68f, restoring #149.' source-6 (PR 148, merged 2026-11-06T15:06:17Z): remove also deletes the postman marketplace entries and the Codex hooks.state approval; 'Not covered (follow-ups)': Pi, Droid hash-named cache directory, stored MCP OAuth tokens - exactly the three the article lists. Chronological order #149, #152, #148 is correct. None of the three descriptions (or the issue-comment threads on them) mentions issue 14370, the app-support repository or any user report (searched for 14370, app-support, issue, report, consent): the article's no-cause statement is accurate, and the title does not mention the pull requests. CLAIM-ACCURACY TESTS. (1) Quantifier/absence scan: 'both covered the report' - both The New Stack and Notebookcheck cover indicava's report: true; 'none of the cited sources reports evidence that Postman collected or transmitted API data' checked against all eight sources including all 69 thread comments: true (TNS and Notebookcheck say there is none; ronthedrummer says he has none; one commenter, kalil-camera, writes an unevidenced aside about 'auto-share of new collections to their cloud', which is not a report of evidence and is not about the plugins); 'the cited sources do not say which Postman desktop release carries the revert': true (the pull requests concern the plugin repository and the npx installer 0.7.2; no source names a desktop release); 'no reproduction on Windows or Linux': true. 'Every skill' is a quotation of PR 149, attributed. (2) Headline/summary/lead: qualifiers kept ('a GitHub Report Says'), actor not renamed (Postman organization member = member of the postmanlabs organization, verified), single named speaker, no cause implied. 'Auto-Installed' is the log's own wording (auto-existing-upgrade) and Postman's member confirms the intent ('We intended this change to simplify the setup'). (3) Dates: Oct 24 (log, 09:34:14Z), Oct 25 (report), Nov 3 and Nov 4 (UTC labelled), Nov 5 times labelled UTC, Nov 6 times labelled UTC, all correct and in order; no relative dates. (4) Derived figures: none computed by the Herald; versions (12.33.4, 12.31.3, 12.35.1) are from the commenters' logs and are attributed. (5) Disagreement: the 12.33.4 report found a trusted_hash record, the 12.35.1 report found none; the article reports both with attribution and does not reconcile them (the second reporter's follow-up says he did not run Codex). (6) Independence recount below. Quotes tested: I extracted every double-quoted string from the body: 18 matches, of which one is the code string "hooks": {} (not a quotation), leaving 17 quotations, which confirms the writer's count of 17. Each was matched to its source text (1 issue, 2 and 10-11 Postman member comment, 3 issue/Notebookcheck, 4 hook file/Notebookcheck, 5 hook file, 6 OpenAI docs, 7 and 12 Notebookcheck, 8 issue, 9 The New Stack, 13 code, 14-17 PR 149, 18 The New Stack): all verbatim. Two (8 and 9) end with a full stop inside the quotation marks where the source sentence continues after a comma; a punctuation nit, no change of meaning. Items I could not confirm: Postman's own documentation (learning.postman.com, deliberately not cited) is reported only through Notebookcheck and The New Stack and the article attributes it that way. Independence recount (News: no minimum, informational): independent of Postman and reporting the event: The New Stack and Notebookcheck (2 outlets; Notebookcheck partly restates the GitHub thread and The New Stack and adds the Postman-documentation quote and the staff reply); the GitHub issue is a primary report by an individual user (independent of Postman, not a news outlet); OpenAI's documentation is independent of Postman but is background on Codex, not coverage of the event; the hook file and the three pull requests are Postman's own (subject) sources. Of 8 sources, 4 are subject-side or primary-record, 3 are third-party accounts or documentation, 1 is the reporter. The New Stack counts as an independent outlet with a stated caveat: its page discloses that its owner Insight Partners is an investor in Postman (the subject) and OpenAI (maker of Codex and publisher of the cited documentation); its coverage here is critical of Postman and every point used from it is also confirmed in the primary issue except the 'no response' statement and the Garimella claim.

No factual errors found in the headline, summary, lead or body. Every quote, number, date, version, time and attribution traced to raw source text (see source_verification). The one incompleteness: the article does not tell readers that The New Stack's page discloses its owner is an investor in Postman and OpenAI; recorded as a clarification (corrections record), not an error.

Accurate, carefully hedged News article on a developer's GitHub report that Postman desktop 12.33.4 installed Claude Code and Codex plugins on his Mac, with Postman's reported reversal. All eight sources were read from raw text, the Postman organization member's affiliation was verified independently of the GitHub marker, and the Anthropic disclosure is present and neutral. Approved with one clarification about The New Stack's disclosed owner investment. Featured candidacy: 2 - widely used developer tool changing the configuration of other coding agents, a self-approving hook and a vendor reversal, relevant to a broad developer audience