PostToolUse Hooks for Audit Logs: A Production Pattern with Code

If your team is running Claude Code in production, you can probably tell me what it can do. The harder question is what it actually did last Tuesday at 3pm - which Bash calls ran, against which repo, with what exit code. The PostToolUse hook is the lifecycle event you have to use, and most documentation skips past it in two paragraphs. The previous article in this series treated PreToolUse as a tiny state machine - a gate that decides what Claude Code is allowed to do next. PostToolUse is the other half of that pair.