stacktrace-cli 0.1.0__tar.gz → 0.2.1__tar.gz

{stacktrace_cli-0.1.0 → stacktrace_cli-0.2.1}/CLAUDE.md

@@ -11,8 +11,8 @@ and by CI pipelines that invoke `stacktrace`, and it builds on the open-source
 It is also the **design home for Stacktrace Detect** — the AIDR product this CLI
 grows into. The specs in `docs/specs/` and the decisions in `docs/adrs/` describe
 the whole system: session input, correlation against the composition graph, the
-three-stage detector, and the combined report. The code here is the placeholder that
-precedes them.
+three-stage detector, and the combined report. The code here implements them
+incrementally.
 
 ## Common commands
 
@@ -52,11 +52,13 @@ the single source of truth for the version string reported by `--version`.
 
 Build backend is hatchling with a src layout; the wheel's contents are declared
 explicitly by `[tool.hatch.build.targets.wheel] packages = ["src/stacktrace_cli"]`.
-The only runtime dependency is `openaca>=0.4.0`, which supplies the Agent
-Composition Analysis primitives this CLI is intended to drive.
+Runtime dependencies are `openaca` for the Agent Composition Analysis
+primitives this CLI drives, `openaidr` for session collection, and `httpx` for
+the remote channel. Each is pinned exactly before a release; see
+`docs/cutover-openaca-remote.md`.
 
-The package is currently pre-alpha: `main()` reports its version and points at
-the docs. Real functionality lands in later releases.
+`sessions`, `detect`, `monitor` and `remote` are native; `bom`, `policy` and
+`scan` are OpenACA's own command objects.
 
 **The design that functionality implements is in this repo.** Read
 `docs/specs/aidr.md` first — it is the umbrella: components, contracts, the two
@@ -121,6 +123,25 @@ nothing about detection.
   a review names a site, fix the invariant and extend the exhaustive test — a
   second finding of the same class means the first fix was at the wrong level.
 
+## Adding a command
+
+A command is a **pass-through** or it is **native**, never both — and a
+pass-through never gains a flag of its own. See
+[ADR-0021](docs/adrs/0021-two-command-kinds.md) for why.
+
+- **Pass-through** — add one string to `PASSTHROUGH` in
+  `src/stacktrace_cli/cli.py`, having decided it belongs. The loop registers
+  OpenACA's own command object under that name; there is nothing else to
+  write and nothing to keep in step with OpenACA.
+- **Native** — write a Click command or group and `add_command` it, the way
+  `remote` is. If it needs OpenACA it calls `openaca.core`
+  ([ADR-0020](docs/adrs/0020-openaca-consumption-boundary.md)), and whatever
+  it names there is added to the contract test in `tests/remote/`, because it
+  now holds duplicated knowledge of an interface.
+
+The section a command lands under in `--help` follows from which kind it is;
+there is no second list to update.
+
 ---
 
 ## Behavioral guidelines

stacktrace_cli-0.2.1/PKG-INFO

@@ -0,0 +1,154 @@
+Metadata-Version: 2.5
+Name: stacktrace-cli
+Version: 0.2.1
+Summary: CLI for Stacktrace — Detection and Response platform for AI Agents.
+Project-URL: Homepage, https://stacktrace.ai
+Author-email: "Stacktrace AI, Inc" <founders@stacktrace.ai>
+License-Expression: LicenseRef-Proprietary
+Keywords: agent-security,ai-security,openaca,stacktrace
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: Other/Proprietary License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Requires-Python: >=3.11
+Requires-Dist: click>=8.1
+Requires-Dist: httpx<1.0.dev0,>=0.28.1
+Requires-Dist: openaca==0.6.0
+Requires-Dist: openaidr==0.1.0
+Description-Content-Type: text/markdown
+
+# stacktrace-cli
+
+Detection and response for AI coding agents, from the command line.
+
+Coding agents read files, run shell commands and call MCP servers on their own
+initiative, and they write a transcript of every bit of it to disk.
+`stacktrace` reads those transcripts, correlates what ran against the
+components the agent is built from, and reports the security and reliability
+findings in it — locally, on the machine the agent worked on.
+
+The PyPI distribution is `stacktrace-cli`; the command it installs is
+`stacktrace`. The two names differ because the bare `stacktrace` name on PyPI
+belongs to an unrelated project.
+
+## Installation
+
+```bash
+uv tool install stacktrace-cli     # isolated; recommended
+# or
+pip install stacktrace-cli
+```
+
+Requires Python 3.11 or newer.
+
+```console
+$ stacktrace --version
+stacktrace 0.2.1 (openaca 0.6.0)
+```
+
+## Quick start
+
+```bash
+stacktrace sessions      # what the agents on this machine did
+stacktrace detect        # what is wrong with it
+stacktrace monitor       # the same, live in a browser
+```
+
+## Commands
+
+| Command | |
+|---|---|
+| `sessions` | Print what the agents on this machine actually did. |
+| `detect` | Find security and reliability findings in what agents did. |
+| `monitor` | Watch this machine's agents in a browser, live. |
+| `remote` | Configure remote endpoint services and upload to Stacktrace Cloud. |
+| `scan` | Scan a repository or endpoint for agent-composition findings. |
+| `bom` | Generate an Agent BOM for a repository or endpoint. |
+| `policy` | Validate and compile restrictive endpoint policies. |
+
+The last three are composition analysis, supplied by
+[`openaca`](https://pypi.org/project/openaca/) and available under either
+name.
+
+## What it looks like
+
+```console
+$ stacktrace sessions --since 2d --include-content
+claude-code:s1  [claude-code]  2026-08-27T09:00:00+00:00  2 turns  2 calls
+  assistant: Reading the changelog before drafting the release notes.
+    ok                28c  Read
+        result: ## 0.4.0 - correlate, detect
+  assistant: Filing the release-notes follow-up.
+                        -  github/create_issue
+
+Summary — 1 sessions, 2 turns, 2 tool calls
+
+  agent kinds
+          1  claude-code
+
+  tools called (2 distinct)
+          1  Read
+          1  github/create_issue
+
+  MCP servers reached (1 distinct)
+          1  github
+
+  0 subagent turns · 0 results abridged upstream · 1 ok
+
+1 of 2 calls returned with no outcome the collector could establish; the agent's parser supplies no success signal.
+```
+
+A blank status column is the collector's `unknown`, not a pending call: the
+client recorded no outcome that could be established, and the closing line
+counts those rather than filling one in.
+
+## What `detect` finds
+
+Four kinds of finding, under two families that carry separate severity
+ladders — a stalled loop and a leaked credential do not belong on one scale.
+
+**Security** — a credential reaching an outbound call; an injected instruction
+the agent then followed; a vulnerable component actually reached, with the
+vulnerability behind it.
+
+**Reliability** — a loop that stalled; a call that hung.
+
+Findings are correlated against an Agent BOM before they are judged, so a
+vulnerable component is reported when something actually used it rather than
+because it is installed.
+
+## What leaves your machine
+
+Two of `detect`'s three stages run entirely locally and need no model or
+credential. The third sends flagged sessions to the agent's *own* CLI — the
+provider that produced the transcript, never a different one — capped by
+`--budget`; `--no-escalate` turns it off and leaves the two local stages.
+
+`sessions` omits prompts, tool arguments and results unless you pass
+`--include-content`. `monitor` binds to loopback only, refuses a non-loopback
+address rather than warning about it, and escalates nothing unless `--escalate`
+is given.
+
+## Status
+
+Beta, and under active development.
+
+`sessions`, `detect` and `monitor` work end to end today. Session collection
+currently reads Claude Code transcripts; further agent kinds are in progress
+upstream in [OpenAIDR](https://github.com/open-agent-security/openaidr).
+
+## Built on
+
+Two Apache-2.0 packages, neither of which depends on this one:
+[`openaca`](https://pypi.org/project/openaca/) for agent composition analysis,
+and [`openaidr`](https://pypi.org/project/openaidr/) for session collection.
+
+## Licence
+
+Proprietary. © Stacktrace AI, Inc. — [stacktrace.ai](https://stacktrace.ai)

stacktrace_cli-0.2.1/README.md

@@ -0,0 +1,129 @@
+# stacktrace-cli
+
+Detection and response for AI coding agents, from the command line.
+
+Coding agents read files, run shell commands and call MCP servers on their own
+initiative, and they write a transcript of every bit of it to disk.
+`stacktrace` reads those transcripts, correlates what ran against the
+components the agent is built from, and reports the security and reliability
+findings in it — locally, on the machine the agent worked on.
+
+The PyPI distribution is `stacktrace-cli`; the command it installs is
+`stacktrace`. The two names differ because the bare `stacktrace` name on PyPI
+belongs to an unrelated project.
+
+## Installation
+
+```bash
+uv tool install stacktrace-cli     # isolated; recommended
+# or
+pip install stacktrace-cli
+```
+
+Requires Python 3.11 or newer.
+
+```console
+$ stacktrace --version
+stacktrace 0.2.1 (openaca 0.6.0)
+```
+
+## Quick start
+
+```bash
+stacktrace sessions      # what the agents on this machine did
+stacktrace detect        # what is wrong with it
+stacktrace monitor       # the same, live in a browser
+```
+
+## Commands
+
+| Command | |
+|---|---|
+| `sessions` | Print what the agents on this machine actually did. |
+| `detect` | Find security and reliability findings in what agents did. |
+| `monitor` | Watch this machine's agents in a browser, live. |
+| `remote` | Configure remote endpoint services and upload to Stacktrace Cloud. |
+| `scan` | Scan a repository or endpoint for agent-composition findings. |
+| `bom` | Generate an Agent BOM for a repository or endpoint. |
+| `policy` | Validate and compile restrictive endpoint policies. |
+
+The last three are composition analysis, supplied by
+[`openaca`](https://pypi.org/project/openaca/) and available under either
+name.
+
+## What it looks like
+
+```console
+$ stacktrace sessions --since 2d --include-content
+claude-code:s1  [claude-code]  2026-08-27T09:00:00+00:00  2 turns  2 calls
+  assistant: Reading the changelog before drafting the release notes.
+    ok                28c  Read
+        result: ## 0.4.0 - correlate, detect
+  assistant: Filing the release-notes follow-up.
+                        -  github/create_issue
+
+Summary — 1 sessions, 2 turns, 2 tool calls
+
+  agent kinds
+          1  claude-code
+
+  tools called (2 distinct)
+          1  Read
+          1  github/create_issue
+
+  MCP servers reached (1 distinct)
+          1  github
+
+  0 subagent turns · 0 results abridged upstream · 1 ok
+
+1 of 2 calls returned with no outcome the collector could establish; the agent's parser supplies no success signal.
+```
+
+A blank status column is the collector's `unknown`, not a pending call: the
+client recorded no outcome that could be established, and the closing line
+counts those rather than filling one in.
+
+## What `detect` finds
+
+Four kinds of finding, under two families that carry separate severity
+ladders — a stalled loop and a leaked credential do not belong on one scale.
+
+**Security** — a credential reaching an outbound call; an injected instruction
+the agent then followed; a vulnerable component actually reached, with the
+vulnerability behind it.
+
+**Reliability** — a loop that stalled; a call that hung.
+
+Findings are correlated against an Agent BOM before they are judged, so a
+vulnerable component is reported when something actually used it rather than
+because it is installed.
+
+## What leaves your machine
+
+Two of `detect`'s three stages run entirely locally and need no model or
+credential. The third sends flagged sessions to the agent's *own* CLI — the
+provider that produced the transcript, never a different one — capped by
+`--budget`; `--no-escalate` turns it off and leaves the two local stages.
+
+`sessions` omits prompts, tool arguments and results unless you pass
+`--include-content`. `monitor` binds to loopback only, refuses a non-loopback
+address rather than warning about it, and escalates nothing unless `--escalate`
+is given.
+
+## Status
+
+Beta, and under active development.
+
+`sessions`, `detect` and `monitor` work end to end today. Session collection
+currently reads Claude Code transcripts; further agent kinds are in progress
+upstream in [OpenAIDR](https://github.com/open-agent-security/openaidr).
+
+## Built on
+
+Two Apache-2.0 packages, neither of which depends on this one:
+[`openaca`](https://pypi.org/project/openaca/) for agent composition analysis,
+and [`openaidr`](https://pypi.org/project/openaidr/) for session collection.
+
+## Licence
+
+Proprietary. © Stacktrace AI, Inc. — [stacktrace.ai](https://stacktrace.ai)

{stacktrace_cli-0.1.0 → stacktrace_cli-0.2.1}/docs/adrs/0006-trust-boundary-and-detection-upload.md

@@ -5,7 +5,7 @@ status: accepted
 date: 2026-08-28
 supersedes: null
 superseded-by: null
-amended-by: 0011
+amended-by: 0011, 0027
 ---
 
 ## Context

{stacktrace_cli-0.1.0 → stacktrace_cli-0.2.1}/docs/adrs/0008-console-in-separate-demo-package.md

@@ -1,10 +1,10 @@
 ---
 id: 0008
 title: Ship the local trace console as a separate demo package
-status: accepted
+status: superseded
 date: 2026-08-27
 supersedes: null
-superseded-by: null
+superseded-by: 0026
 ---
 
 ## Context

stacktrace_cli-0.2.1/docs/adrs/0026-the-console-becomes-a-product-surface.md

@@ -0,0 +1,108 @@
+---
+id: 0026
+title: The console becomes a product surface, served by the engine
+status: accepted
+date: 2026-09-06
+supersedes: 0008
+superseded-by: null
+amends: null
+amended-by: null
+---
+
+## Context
+
+ADR-0008 kept the trace console out of the engine and gave three reasons. Two
+were about *kind*: a served page with taste-driven layout is different software
+from a library, and their release cadences and review standards differ. One was
+about *order*: making the console the product surface "before the engine's
+claims are validated inverts the order — the engine comes first, and nothing yet
+measures its central claim."
+
+That last reason names its own expiry, and it has arrived. 0.1.0 ships
+`sessions`, `detect` over nine rules and three stages, and both upload paths;
+the detector's claims are measured by its own corpus and by the hosted side
+receiving them. The engine came first, and did.
+
+What forces the decision now is a product one rather than a technical one: the
+data is only useful if a person can follow it, and a sequence reads better as a
+timeline than as a findings list — 0008's own opening sentence. A developer who
+has to run `detect`, read JSON, and re-run it to see what changed is being asked
+to be the renderer. `stacktrace monitor` is that renderer, and it has to ship
+where the data is.
+
+## Decision
+
+The engine serves a local console. `stacktrace monitor` starts an HTTP server
+bound to loopback, opens a browser, and renders live sessions and detections
+from in-process calls into the same surfaces `detect` uses.
+
+The three clauses of 0008 that this reverses, stated plainly:
+
+1. **The engine gains a serving surface and a browser-facing asset.** `site/`
+   ships as package data in the wheel.
+2. **The console performs no analysis of its own.** *This one survives.* Monitor
+   calls `collect_sessions`, `acquire_correlated_view` and `run_detector`; it
+   adds no rule, no grade and no heuristic, and it never writes the verdict
+   cache. A finding on the page is a finding `detect` would print.
+3. **The tenets govern the console now**, because it is a product surface rather
+   than a demonstration. Trust, quality, cost and security apply — which is why
+   the page computes only the two free stages by default, and why the one action
+   it offers is gated four ways.
+
+## Alternatives considered
+
+- **Keep 0008 and ship the console as a separate optional distribution**
+  (`stacktrace-console`, or an extra) — rejected. It preserves the letter of
+  0008 at the cost of the thing 0008 was protecting: a second distribution has
+  its own version, its own install step and its own drift against three read
+  contracts, and every user who wants to *see* their data pays an install to do
+  it. The cadence argument that justified separation for a demo does not survive
+  the surface becoming the product.
+
+- **Amend 0008 to carve out one read-only local surface** — rejected as
+  dishonest bookkeeping. The carve-out is the whole of clause 1; an amendment
+  that removes a decision's first clause is a supersession wearing a smaller
+  word.
+
+- **Leave rendering to the hosted console** — rejected. The hosted side is
+  agent-scoped and receives only what ADR-0006 authorizes: no prompt, no
+  argument, no result, no matched value. The local console is precisely where a
+  responder may see the matched string, which ADR-0006 calls out as deliberate
+  asymmetry. A fleet view cannot replace a machine view; it is a different
+  question.
+
+- **Ship the console but compute nothing** (render the last `detect` run's
+  cache) — rejected. "Live sessions, stale findings" is the failure mode a
+  reader cannot see: the page looks current, and a leak that happened after the
+  last run is absent from it.
+
+## Consequences
+
+**What this enables.** A developer watches an alias resolve into a real
+component while a session is still running — 0008's own description of the
+demonstration, now available without a demo. The three published read contracts
+gain their first in-repo consumer, so a change to span identity breaks a test
+here rather than silently landing enrichments on the wrong rows elsewhere.
+
+**What it costs, and 0008 was right about both.**
+
+- **Every consumer of the wheel carries a UI they did not ask for.** `site/` is
+  three files and no JavaScript dependency, so the cost is bytes rather than a
+  dependency tree — but a library consumer still ships them.
+- **Visual iteration now happens inside the engine's release process.** A
+  layout change rides a release built for a detection engine. The mitigation is
+  that the console's own priorities stay 0008's — latency, then fidelity — and
+  that no page change can alter a finding, because monitor computes none.
+
+**What to watch for.** A rule that fires only in the console, or a grade the
+page adjusts for legibility. Either would make clause 2 false, and clause 2 is
+the one keeping this from being a fork of the detector.
+
+## When to revisit
+
+Revisit if the console acquires a reason to compute something the detector does
+not — that is the point at which it stops being a renderer and needs its own
+decision. Revisit if the wheel's browser-facing assets grow beyond static files,
+because a build step is the cadence problem 0008 warned about actually arriving.
+Do not revisit on the grounds that a library consumer carries the UI: that cost
+is accepted here explicitly, not overlooked.

stacktrace_cli-0.2.1/docs/adrs/0027-a-finding-may-name-what-it-could-not-place.md

@@ -0,0 +1,112 @@
+---
+id: 0027
+title: A finding may name the component it could not place
+status: accepted
+date: 2026-09-07
+supersedes: null
+superseded-by: null
+amends: 0006
+---
+
+## Context
+
+ADR-0006 constraint 3 keeps session content off the wire *by construction*: a
+detection carries a rule id and non-content descriptors, "never an excerpt of
+an argument, result or prompt", and the family is uploadable whole so no
+projection exists to be got wrong. That constraint has held every finding this
+product has shipped and is not in question here.
+
+One case has now met the condition ADR-0006 wrote for its own revision:
+
+> Revisit if a detection type proves genuinely unactionable without an evidence
+> excerpt — that would be a real argument against constraint 3, and the answer
+> is more likely a better non-content descriptor than an excerpt.
+
+A finding's **subject** is what the finding is about. Where correlation places
+the call, the subject is a BOM component and constraint 3 was never in play.
+Where correlation cannot place it, the only name that exists is the one the
+session used — `call.mcp_server` for a server, `arguments["skill"]` for a
+skill — and the second of those is, read literally, an excerpt of an argument.
+
+Removing it leaves the highest-severity finding this detector produces reading:
+
+    high  stacktrace-credential-egress
+          Credential-shaped material reached an outbound call
+          on a mcp_server (not in inventory)
+
+A responder cannot act on that. They cannot rotate the right credential, revoke
+the right access, or find the thing, because the document does not say what the
+thing was. The unplaced case is also the one where naming matters *most*: a
+credential reaching a component no Agent BOM declares is the least expected and
+least explicable event this product reports.
+
+Empirically it is not rare. On the machine this was written against, 156 calls
+across 15 distinct names were unplaced, including the one `high`
+credential-egress finding in the window.
+
+## Decision
+
+**A detection may carry the name the session addressed a component by, when
+correlation could not place it.** This narrows ADR-0006 constraint 3; every
+other clause of 0006 stays in force, and constraint 3 continues to forbid
+excerpts of prompts, results and arguments in every other position.
+
+Four bounds make it a descriptor rather than an opening.
+
+1. **One field, one purpose.** The name appears only as
+   `Participant.name` on a finding's subject or a named party to it. No rule
+   may interpolate it into prose; `Evidence.detail` remains closed to it, which
+   is the drift ADR-0006 names as *"reached by writing a helpful sentence"*.
+
+2. **It is never an identity.** `Participant.identity` stays null for an
+   unplaced party, so the name can resolve no lookup, join to no inventory and
+   render as no link. A consumer must mark it as unverified. Two machines can
+   call unrelated servers `support`; this ADR does not make that name mean
+   anything beyond the session that said it.
+
+3. **Bounded and validated at the boundary.** Length-capped on the wire, and
+   walked by the same disclosure gate every other leaf passes, so a name
+   carrying a path or a credential shape is refused rather than trimmed.
+
+4. **The local surfaces are unchanged and remain the fuller answer.** `monitor`
+   and `stacktrace detect` read the session directly and may always say more
+   than the upload does. This ADR is only about what leaves the machine.
+
+## Consequences
+
+The `credential-egress` above reads `on support (not in inventory)`, in Fleet
+as well as locally, and a responder has somewhere to start.
+
+The residual exposure is a short, model-influenceable string reaching a hosted
+service. It is real and it is accepted here rather than argued away: an
+attacker who can choose the `skill` argument already drives the agent's tool
+calls, and has channels with far more bandwidth than a capped name field in a
+detection upload. What this ADR must not become is precedent — the argument
+above is about *the subject of a finding being unnameable otherwise*, and does
+not extend to any other field.
+
+`tests/test_untrusted_content_never_travels.py` keeps every other canary,
+including the ones for prompts, results, arguments and the tool name an MCP
+server chose. It gains the case this ADR permits, so the exemption is stated
+where the invariant is enforced rather than only here.
+
+## Alternatives rejected
+
+- **Drop the name, keep the type** (`a skill (not in inventory)`). This was
+  implemented and is what prompted the ADR. It is compliant and unactionable,
+  which makes it the wrong trade for a product whose output is meant to be
+  acted on. A rule that produces findings nobody can use protects nothing.
+
+- **Carry the server alias, drop the skill argument.** Defensible on the letter
+  of constraint 3 — a server alias is not an argument excerpt — and rejected as
+  a distinction a reader cannot see. It would make one finding nameable and its
+  neighbour not, for a reason invisible on the page, and leaves the same
+  residual exposure for the case it permits.
+
+- **Send a hash of the name.** Rejected. It is stable across machines, which is
+  the one property the name must not have, and it is unreadable, which is the
+  one property a responder needs.
+
+- **Amend nothing and surface the name only in `monitor`.** Rejected as the
+  status quo restated: triage happens in Fleet, and a console on one laptop
+  does not answer for a fleet.

{stacktrace_cli-0.1.0 → stacktrace_cli-0.2.1}/docs/adrs/INDEX.md

@@ -41,7 +41,7 @@ supersedes anything yet.
 - [0005](0005-detection-family-and-report-assembly.md) — **Detections are their own finding family, assembled here.** Why a detection is not an observation, and why `stacktrace` merges the four families rather than OpenACA emitting a fourth. `stacktrace-*` identifiers. Read before adding a finding family, touching output assembly, or contributing anything upstream.
 - [0006](0006-trust-boundary-and-detection-upload.md) — **Sessions never leave the machine; detections upload agent-keyed.** No upload path for anything session-derived; findings carry descriptors, never excerpts; place identity stays in the envelope. Read before adding a detection field, touching redaction, or describing AIDR as fully local or anonymous.
 - [0007](0007-proprietary-package-on-open-dependencies.md) — **Proprietary package on open dependencies.** Why this is not inside OpenACA or OpenAIDR, and why the dependency arrow never reverses. Read before moving code between repos.
-- [0008](0008-console-in-separate-demo-package.md) — **Trace console ships as a separate demo package.** Read before adding a served UI, transport, or web asset to this repo.
+- [0008](0008-console-in-separate-demo-package.md) — **Trace console ships as a separate demo package.** Read before adding a served UI, transport, or web asset to this repo. **Superseded by [0026](0026-the-console-becomes-a-product-surface.md).**
 - [0010](0010-detection-severity-and-confidence-ladders.md) — **Detections define their own severity and confidence ladders.** Amends ADR-0005: `openaca.core` exports no ladder to reuse, and CVSS labels grade advisories a detection does not have. Read before changing a finding's grade, or before assuming the four families share one scale.
 - [0011](0011-verdict-cache.md) — **A bounded local verdict cache, and what it may hold.** Amends ADR-0006: a reasoning verdict is an expensive pure function of a session, so it may persist — carrying rule ids, grades, spans and analyzer identity, and never conversation. Read before persisting anything session-derived, or before letting an upload path read local state.
 - [0012](0012-observation-evidence-kinds-and-transport.md) — **Observation is graded by what could misread it; an MCP transport is positive-only evidence.** Severity and confidence are orthogonal and neither is read off the other; a precondition sets a finding's grade, corroboration takes the best; `stdio` is never evidence of local execution. Read before changing a rule's confidence, adding an evidence kind, or treating an absent transport as local.
@@ -57,4 +57,6 @@ supersedes anything yet.
 - [0022](0022-detection-scope-is-a-catalogue-column.md) — **Detection scope is a per-rule catalogue column, set by cardinality.** Fleet identifies a detection by rule plus anchor, so scope decides what counts as the same finding seen again; `advisory-reach` and `progress-stall` both read as session-shaped and fire more than once per session, and session scope would merge those firings into one row permanently. Deriving scope from `bool(evidence)` is rejected — every rule always cites something. Read before adding a rule, or before changing how one groups its findings.
 - [0023](0023-sync-detect-collects-and-does-not-escalate.md) — **`sync detect` re-collects in-process, and defaults `--escalate` off.** The inverse of `stacktrace detect`, because a scheduled unattended run spending provider quota and crossing a content boundary on a timer is a recurring charge nobody approved per-run; consuming `detect --format json` was rejected as a projection of a projection. Read before changing a sync default, or before aligning the two commands' flags.
 - [0024](0024-the-upload-carries-observations.md) — **The upload carries observations; the Cloud derives catalogue text and coverage.** `title`, `remediation`, `family`, `verdict.stage` and `coverage` are all dropped — the first four are catalogue facts the Cloud seeds, and coverage is summed from `activity[]`. Not a privacy projection (ADR-0006 settled that) but a non-duplication one. Read before adding a field to the upload payload, or before "fixing" a bare `rule_id` in the console.
+- [0026](0026-the-console-becomes-a-product-surface.md) — **The console becomes a product surface, served by the engine.** Supersedes ADR-0008 on its own stated condition: the engine came first, 0.1.0 shipped, and the data is only useful if a person can follow it. `stacktrace monitor` serves a loopback page from in-process calls, so the wheel now carries a `site/` asset — the cost 0008 refused, accepted here explicitly. What survives from 0008 is the clause that matters: the console renders and never computes, so a finding on the page is one `detect` would print. Read before adding anything to the console that the detector does not produce.
 - [0025](0025-a-denied-call-is-activity-never-an-invocation.md) — **A denied call is activity, and never an invocation.** ADR-0017 makes a declined repeat a stall while `outcome.py` keeps a denied call out of every count, so a denied-only session produced a finding with no activity and the Cloud rejected the whole run; a separate `denied` counter resolves it without either rule bending, and coverage keeps summing `invocations` alone. Read before changing what `activity[]` counts, or before folding `denied` into a coverage-like ratio.
+- [0027](0027-a-finding-may-name-what-it-could-not-place.md) — **A finding may name the component it could not place.** Narrows ADR-0006 constraint 3 for one field: an unplaced subject carries the name the session addressed it by, never as an identity. Read before removing a name from a finding on trust-boundary grounds, or before widening this to a second field.