stacktrace-cli 0.12.0__tar.gz → 0.14.0__tar.gz

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/.github/workflows/ci.yml

@@ -5,6 +5,12 @@ on:
     branches: [main]
   pull_request:
 
+# A new push to a PR cancels the run for the push it replaces, as in Fleet.
+# Runs on main are never cancelled, so every merged commit is checked.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/CLAUDE.md

@@ -129,6 +129,23 @@ nothing about detection.
   `tests/monitor/test_render_cost.py`. When reviews keep re-arguing scope (a
   time boundary, which sessions a rule reads), write the answer into the spec,
   as `docs/specs/cost-phase-1.md` §1 "What a rule reads, and when" does.
+- Write an ADR only in a `/kind feature` PR. Bug fixes, cleanups, wording changes
+  and UI changes get no ADR.
+- A spec holds the design. An ADR holds one decision and its rejected alternatives.
+  Keep the Decision section of an ADR short. Write one paragraph, or a short
+  numbered list of choices. Put commands, flags, failure behavior and test plans
+  in the spec.
+- The specs in `docs/specs/` describe components and change with them. A feature
+  that changes a component updates the spec of that component in the same PR. A
+  feature that adds a component adds a new spec. Start a new spec from
+  `docs/specs/TEMPLATE.md`.
+- Write or update the spec first. Then write ADRs for the decisions whose rejected
+  alternative is plausible. List those ADRs in a "Decisions" table in the spec.
+  Link each ADR to the spec section that has the detail.
+- Do not write "This spec implements ADR-NNNN". The spec is the source of the
+  design.
+- Before a multi-step implementation plan, write the spec and its ADRs. The plan
+  references them. A plan is not a substitute for either.
 
 ## Adding a command
 
@@ -240,13 +257,23 @@ the alternative we rejected? If yes, write the ADR.
 full ADR. The cost of one Read is much smaller than the cost of
 re-deriving or re-litigating a decision.
 
-**Supersede, never edit.** Accepted ADRs are immutable. If a later
-decision contradicts an existing ADR, write a NEW ADR with
+**Supersede or amend, never edit.** Accepted ADRs are immutable. If a later
+decision contradicts an existing ADR, write a NEW ADR that supersedes or
+amends it, as the next rule decides. For a supersession, put
 `supersedes: NNNN` in its frontmatter, and update the old one's
 frontmatter to `status: superseded` + `superseded-by: NNNN`. Old PRs
 need to remain readable against the rules in effect at the time —
 silently editing an accepted ADR breaks that contract.
 
+**Amend or supersede: one test.** Ask if any decision in the old ADR still
+binds, whether or not the ADR numbers its decisions. If one does, amend: put
+`amends: NNNN` on the new ADR and `amended-by: NNNN` on the old one, and both
+stay active. If none does, supersede. Only this test decides. The size of
+the change, the importance of the replaced clause, and the old ADR's "When
+to revisit" text do not change the result. `docs/adrs/INDEX.md` gives the
+worked example. A reviewer reports the choice only when the finding names
+every decision in the old ADR and shows that none still binds.
+
 ## Commits and PRs
 
 - Frequent commits, one logical change per commit.
@@ -364,9 +391,18 @@ review catches the glaring issues, and later reviews check only what changed.
 - Batch related fixes into one tested update before requesting re-review.
   Avoid duplicate review requests for the same head.
 - An automated fixer pushes ordinary commits to the existing PR branch and
-  runs every required gate. It does not bypass gates, merge, rebase, or
-  force-push, or change workflows, permissions, credentials, or branch
-  protection. Report an environment failure or required rebase as a blocker.
+  runs every required gate. It does not bypass gates, merge, or change
+  workflows, permissions, credentials, or branch protection. It force-pushes
+  only after a rebase, as the next rule says. Report an environment failure
+  as a blocker.
+- When a PR branch conflicts with its base branch, the automated fixer
+  rebases it onto the current base branch. The base branch is normally
+  `main`. It resolves the conflicts, runs every required gate, and pushes
+  with `git push --force-with-lease`. It does not merge the base branch into
+  the PR branch. PR branches are rarely shared, so rewritten history is
+  acceptable. Report a conflict as a blocker when both sides change the same
+  logic and each resolution loses behavior. A rebase with no other change is
+  not a fix round.
 - After pushing fixes, wait for CI and a completed review of the current
   head. Silence, an older review, or a running review is not clearance.
 - Stop and ask for human input when the same failure repeats without progress.

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stacktrace-cli
-Version: 0.12.0
+Version: 0.14.0
 Summary: CLI for Stacktrace — Detection and Response platform for AI Agents.
 Project-URL: Homepage, https://stacktrace.ai
 Author-email: "Stacktrace AI, Inc" <founders@stacktrace.ai>
@@ -20,8 +20,8 @@ Classifier: Topic :: Security
 Requires-Python: >=3.11
 Requires-Dist: click>=8.1
 Requires-Dist: httpx<1.0.dev0,>=0.28.1
-Requires-Dist: openaca==0.10.1
-Requires-Dist: openaidr==0.7.0
+Requires-Dist: openaca==0.12.0
+Requires-Dist: openaidr==0.7.1
 Requires-Dist: posthog<8,>=7.0
 Requires-Dist: pydantic<3,>=2.10
 Description-Content-Type: text/markdown
@@ -52,7 +52,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.12.0 (openaca 0.10.1)
+stacktrace 0.14.0
 ```
 
 ## Python package namespace
@@ -107,9 +107,14 @@ stacktrace webhook disable
 ```
 
 `configure` prompts for an optional HMAC-SHA256 signing secret without echoing
-it. The endpoint receives a narrow JSON document containing the event ID, rule,
-severity, confidence and session identity—not transcript content, finding prose
-or evidence. Delivery is at least once, so receivers should deduplicate on
+it. The endpoint receives a narrow JSON document: the event ID, detection time,
+rule, severity, confidence and session identity, plus, when the finding has
+them, the rule's catalogue title, the component it concerns (type and name) and
+the kinds of evidence it cites. For `stacktrace-destructive-action` the
+evidence kind is `rm -rf` and the paths it deleted outside the workspace,
+redacted so an absolute path is never sent (ADR-0073, ADR-0084). Transcript
+content, remediation text and evidence detail are not sent. Delivery is at
+least once, so receivers should deduplicate on
 `event_id`. The URL and secret are stored in a mode-0600 host configuration
 file. HTTP is accepted only for loopback development endpoints.
 

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/README.md

@@ -24,7 +24,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.12.0 (openaca 0.10.1)
+stacktrace 0.14.0
 ```
 
 ## Python package namespace
@@ -79,9 +79,14 @@ stacktrace webhook disable
 ```
 
 `configure` prompts for an optional HMAC-SHA256 signing secret without echoing
-it. The endpoint receives a narrow JSON document containing the event ID, rule,
-severity, confidence and session identity—not transcript content, finding prose
-or evidence. Delivery is at least once, so receivers should deduplicate on
+it. The endpoint receives a narrow JSON document: the event ID, detection time,
+rule, severity, confidence and session identity, plus, when the finding has
+them, the rule's catalogue title, the component it concerns (type and name) and
+the kinds of evidence it cites. For `stacktrace-destructive-action` the
+evidence kind is `rm -rf` and the paths it deleted outside the workspace,
+redacted so an absolute path is never sent (ADR-0073, ADR-0084). Transcript
+content, remediation text and evidence detail are not sent. Delivery is at
+least once, so receivers should deduplicate on
 `event_id`. The URL and secret are stored in a mode-0600 host configuration
 file. HTTP is accepted only for loopback development endpoints.
 

stacktrace_cli-0.14.0/SECURITY.md

@@ -0,0 +1,41 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Email **security@stacktrace.ai**. Please do not open a public issue, post in a
+public channel, or disclose details before we have released a fix.
+
+A useful report says:
+
+- the `stacktrace --version` output and your operating system;
+- what you did, what happened, and what you expected;
+- whether the issue can expose session content, credentials or file paths, or
+  send anything off the machine that [docs/trust.md](docs/trust.md) says stays
+  on it.
+
+We acknowledge a report within three business days and keep you informed until
+it is resolved. Once a fix is released we credit you in the release notes,
+unless you ask us not to.
+
+## Supported versions
+
+Fixes ship in a new release on PyPI (`stacktrace-cli`). Only the latest release
+is supported: upgrade with `uv tool upgrade stacktrace-cli` or
+`pip install -U stacktrace-cli`. A published version is never re-uploaded, so a
+fix always arrives as a new version number.
+
+## Scope
+
+In scope: the `stacktrace` command, its daemon, and every path by which it
+sends data off the machine (see [docs/trust.md](docs/trust.md)).
+
+Session collection and composition analysis come from two open-source
+dependencies, [`openaidr`](https://github.com/open-agent-security/openaidr) and
+[`openaca`](https://pypi.org/project/openaca/). Report an issue in either one
+to us at the same address; we coordinate the fix upstream.
+
+## Good-faith research
+
+We will not pursue legal action against research that is done in good faith,
+stays within your own machines and accounts, avoids harm to other people's
+data, and gives us reasonable time to fix the issue before disclosure.

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0006-trust-boundary-and-detection-upload.md

@@ -5,7 +5,7 @@ status: accepted
 date: 2026-08-28
 supersedes: null
 superseded-by: null
-amended-by: 0011, 0027, 0031, 0039, 0064, 0084, 0086, 0096, 0109, 0118
+amended-by: 0011, 0027, 0031, 0039, 0064, 0084, 0086, 0096, 0109, 0118, 0138, 0139
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0018-remote-sync-config-and-facade-consumption.md

@@ -6,7 +6,7 @@ date: 2026-09-03
 supersedes: null
 superseded-by: null
 amends: null
-amended-by: 0087
+amended-by: 0087, 0131
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0020-openaca-consumption-boundary.md

@@ -5,6 +5,7 @@ status: accepted
 date: 2026-09-03
 supersedes: null
 superseded-by: null
+amended-by: 0136
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0024-the-upload-carries-observations.md

@@ -6,7 +6,7 @@ date: 2026-09-05
 supersedes: null
 superseded-by: null
 amends: null
-amended-by: null
+amended-by: 0139
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0031-one-host-daemon-observes-native-session-logs.md

@@ -6,7 +6,7 @@ date: 2026-09-17
 supersedes: null
 superseded-by: null
 amends: 0006
-amended-by: 0032, 0036, 0037, 0038, 0039, 0045, 0046, 0066, 0072, 0107, 0113, 0118
+amended-by: 0032, 0036, 0037, 0038, 0039, 0045, 0046, 0066, 0072, 0107, 0113, 0118, 0135
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0036-deliver-eligible-findings-to-slack-from-the-daemon.md

@@ -6,7 +6,7 @@ date: 2026-09-20
 supersedes: null
 superseded-by: null
 amends: 0031
-amended-by: 0067
+amended-by: 0067, 0148
 ---
 
 Subsystem: the daemon and its delivery sinks. The integration view across the

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0070-package-the-cloud-agent-environment-bootstrap.md

@@ -6,7 +6,7 @@ date: 2026-09-25
 supersedes: null
 superseded-by: null
 amends: null
-amended-by: 0123
+amended-by: 0123, 0143
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0072-host-supervisors-own-daemon-restarts.md

@@ -6,7 +6,7 @@ date: 2026-09-25
 supersedes: 0066
 superseded-by: null
 amends: 0031, 0045, 0058
-amended-by: null
+amended-by: 0143
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0073-name-what-fired-and-which-component.md

@@ -6,7 +6,7 @@ date: 2026-09-26
 supersedes: null
 superseded-by: null
 amends: 0067, 0071
-amended-by: 0084, 0085
+amended-by: 0084, 0085, 0138, 0147, 0149
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0083-each-block-reason-is-its-own-rule.md

@@ -6,7 +6,7 @@ date: 2026-09-30
 supersedes: null
 superseded-by: null
 amends: 0039
-amended-by: null
+amended-by: 0146
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0086-a-refusal-names-who-answered-the-call.md

@@ -6,7 +6,7 @@ date: 2026-10-01
 supersedes: null
 superseded-by: null
 amends: 0006, 0027
-amended-by: null
+amended-by: 0146, 0149
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0090-count-completed-commands-locate-by-ip-send-through-the-managed-proxy.md

@@ -6,7 +6,7 @@ date: 2026-10-02
 supersedes: null
 superseded-by: null
 amends: 0039
-amended-by: null
+amended-by: 0131
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0096-cost-usage-may-leave-as-token-totals-and-work-identifiers.md

@@ -6,7 +6,7 @@ date: 2026-10-06
 supersedes: null
 superseded-by: null
 amends: 0006
-amended-by: 0103, 0109, 0115, 0116, 0130
+amended-by: 0103, 0109, 0115, 0116, 0130, 0140
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0101-what-names-a-run-in-fleet.md

@@ -6,7 +6,7 @@ date: 2026-10-08
 supersedes: null
 superseded-by: null
 amends: null
-amended-by: 0109, 0110, 0112, 0121
+amended-by: 0109, 0110, 0112, 0121, 0140
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0109-a-detection-carries-its-runs-title-and-the-persons-name.md

@@ -6,7 +6,7 @@ date: 2026-10-11
 supersedes: null
 superseded-by: null
 amends: 0006, 0096, 0101
-amended-by: 0110, 0112
+amended-by: 0110, 0112, 0140, 0147
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0113-size-triggers-behaviour-explains-session-cost-carries-reasons.md

@@ -6,7 +6,7 @@ date: 2026-10-11
 supersedes: null
 superseded-by: null
 amends: 0031, 0092, 0093
-amended-by: null
+amended-by: 0142
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0118-observe-agents-through-adapters-and-a-shared-analyzer.md

@@ -6,7 +6,7 @@ date: 2026-10-11
 supersedes: null
 superseded-by: null
 amends: 0001, 0004, 0006, 0031, 0061
-amended-by: null
+amended-by: 0135
 ---
 
 ## Context

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0123-the-cloud-boot-hook-brings-the-client-up-to-the-latest-release.md

@@ -6,7 +6,7 @@ date: 2026-10-13
 supersedes: null
 superseded-by: null
 amends: 0070
-amended-by: null
+amended-by: 0143
 ---
 
 ## Context

stacktrace_cli-0.14.0/docs/adrs/0131-activate-hook-policy-without-a-privileged-runtime.md

@@ -0,0 +1,87 @@
+---
+id: 0131
+title: Activate hook policy without a privileged runtime
+status: proposed
+date: 2026-10-16
+supersedes: null
+superseded-by: null
+amends: 0018, 0090, 0135
+amended-by: 0143, 0150
+---
+
+## Context
+
+The user wants existing policy configurations enforced through hooks.
+The user accepts the stated loading and context-injection gaps.
+Existing installations can have root-owned policy files and a scheduled runtime.
+An unprivileged installer cannot remove those files.
+
+## Decision
+
+Require Claude Code 2.1.274 or newer.
+Use `PreToolUse` for MCP tools, Skill calls and namespaced plugin-agent calls.
+Use `UserPromptExpansion` for direct slash-command expansion.
+Use native MCP provenance instead of guessing an owner from the tool-name prefix.
+Send only bounded selector fields to the daemon.
+Do not send prompts, arguments, transcripts, tool results or expansion text.
+
+Block only a confirmed policy restriction.
+Unknown or ambiguous subjects use the known category default.
+A blocked category default remains an intentional policy restriction.
+Missing vulnerability coordinates do not add component or plugin-sibling blocks.
+Retain the last completed snapshot during failed refreshes.
+Use known defaults before the first completed snapshot.
+
+Defer when no applicable policy or category can be established.
+
+Continue through native permissions on invalid input, protocol errors, daemon outages and invalid local configuration.
+Set both native command handlers to `onFailure: continue` with a five-second timeout.
+Command launch failures and timeouts do not add policy blocks.
+Neither `allow` nor `defer` grants a native permission.
+This contract replaces the earlier deny-on-uncertainty proposal.
+
+The shared installer installs or updates the official user plugin through native Claude commands.
+Plugin installation requires neither enrollment, policy evidence nor a running daemon.
+Plugin installation does not write enrollment or a local policy-mode flag.
+Plugin validation and native conformance tests check hook declarations and failure behavior.
+The daemon serves hook policy automatically after enrollment.
+Normal enrollment never provisions or updates the legacy privileged helper.
+
+Ignore the former `hook_policy_enabled` configuration key.
+Start a new Claude session after plugin installation.
+Use native plugin controls to enable or disable hook dispatch.
+
+Keep existing root-owned managed policy until the administrator completes migration.
+Install the plugin and check the new session's status.
+`hooks migration` prints a fixed administrator command chain.
+It does not execute that chain.
+The chain stops the legacy job and removes its artifact, enrollment, state, lock and private runtime.
+Other administrators' managed settings remain in force.
+
+Report migration as incomplete while any removed path remains.
+Disabling the plugin does not recreate managed policy.
+
+Amend ADR-0018 for the disposable policy child defined in ADR-0136.
+It calls the public OpenACA facade without CLI output parsing.
+Amend ADR-0090 for the internal `hooks admit` command.
+Do not initialize command analytics or send per-action command events from that path.
+Keep normal command telemetry for user-facing setup and status commands.
+
+Disclose plugin loading, startup hooks, LSP startup and preloaded skill-context injection as gaps.
+Also disclose MCP connections, resources, prompt attachment and disabled or unlaunched hooks.
+Require a new session after switching projects.
+Do not claim that hooks detect every unsupported in-session `/cd` switch.
+A previous call does not prove current adapter health.
+
+Release and pin the public evidence API before rollout.
+Use dependency overlays only for development tests.
+Do not commit an overlay or treat it as a published release.
+Complete native-host, released-pair installation, managed-plugin approval and cloud-bootstrap checks before general installer cutover.
+
+## Alternatives considered
+
+- Deny on identity, coverage or operational uncertainty: rejected by the user because implementation gaps must not block permitted work.
+- Keep managed settings as a required fallback: rejected because it retains the privileged runtime.
+- Delete root-owned files from the user installer: rejected because the administrator owns that transition.
+- Use only `PreToolUse`: rejected because direct slash-command expansion has a separate event.
+- Count every hook as a remote command: rejected because host callbacks are not developer command use.

{stacktrace_cli-0.12.0 → stacktrace_cli-0.14.0}/docs/adrs/0133-a-clients-own-error-record-is-a-third-block-channel.md

@@ -6,7 +6,7 @@ date: 2026-10-16
 supersedes: null
 superseded-by: null
 amends: null
-amended-by: null
+amended-by: 0146
 ---
 
 ## Context

stacktrace_cli-0.14.0/docs/adrs/0135-enforce-policy-through-the-daemon-and-agent-hooks.md

@@ -0,0 +1,111 @@
+---
+id: 0135
+title: Enforce policy through the daemon and agent hooks
+status: proposed
+date: 2026-09-29
+supersedes: null
+superseded-by: null
+amends: 0031, 0118
+amended-by: 0136, 0131, 0143, 0150
+---
+
+## Context
+
+Fleet supplies organization policy. ADR-0087 installs its compiled restrictions through a privileged scheduled job.
+The replacement must use the existing user daemon and thin agent hooks.
+Normal setup and enforcement must not require sudo or a separate privileged policy runtime.
+Existing installations can require one administrator cleanup step.
+
+The policy language already supports MCPs, plugins, skill defaults, vulnerability gates and posture gates.
+The replacement must retain those policy configurations.
+The user accepts enforcement of hook-visible use and the stated loading and context-injection gaps.
+
+## Decision
+
+Keep validated policy inputs in the existing daemon database.
+Keep component decisions in memory.
+Use one background worker to collect and evaluate one evidence bundle for each fixed project scope.
+Use the existing private Unix socket for local decisions.
+Hooks do not fetch policy, scan components or evaluate policy.
+
+Claude Code is the first host.
+Cover MCP tool calls, Skill calls, direct slash-command expansion and namespaced plugin-agent calls.
+Plugin children inherit their owning plugin's policy.
+Keep the current OpenACA policy language and evaluator.
+Do not add individual standalone-skill lists, tool-argument rules or an approval outcome.
+
+This is the endpoint component-admission exception to ADR-0118 decision 2.
+The existing user daemon evaluates local composition, vulnerability and posture evidence through the public OpenACA facade.
+Core retains session-context rules, shared session state and hosted evaluation.
+This exception does not widen the content-export boundary.
+
+1. Store the revision floor and publication digest before semantic validation.
+   Store the validated desired policy separately.
+   A rejected document cannot erase the recorded revision or replace the last valid policy.
+   This amends ADR-0031 decision 4 for policy inputs and bounded diagnostics only.
+2. Bind inputs to the canonical API origin, verified organization and enrollment epoch.
+   Credential changes advance the epoch.
+   Asset registration alone does not change the epoch.
+   An A-to-B-to-A transition cannot restore an old decision.
+3. Collect one evidence bundle outside the input locks.
+   Publish its decisions only if the captured inputs and scope generation still match.
+   Do not persist decisions, composition or risk snapshots.
+4. Block a uniquely resolved subject only when the completed active snapshot establishes the block.
+   Retain that snapshot during asynchronous replacement and failed refreshes.
+   Do not expire its decisions on a timer.
+   Replace its decisions, defaults, revision and evidence identifiers atomically.
+   Unknown or ambiguous subjects use the known category default.
+   A blocked category default remains a policy restriction.
+   Missing vulnerability coordinates do not add component or plugin-sibling blocks.
+5. Continue through native permissions when the policy or category is unknown.
+   Protocol errors, daemon outages and hook launch or timeout failures do not create policy blocks.
+   Neither `allow` nor `defer` grants a native permission.
+6. Retain ADR-0062's lock for credential-dependent requests and input publication.
+   Collect evidence outside that lock.
+   Recheck enrollment before publication and authorization.
+   Check the input token before publication.
+   Authorization reads the active snapshot during replacement.
+7. Report revisions, evidence age, errors, declared coverage and the last observed call.
+   Do not treat an installed plugin or a previous call as proof of adapter health.
+8. Support one fixed project per Claude session.
+   Require a new session after a project switch.
+   Disclose that hooks cannot reliably detect every in-session `/cd` switch.
+
+ADR-0136 defines the evidence bundle and its refresh limits.
+ADR-0131 defines activation, migration and the uncertainty contract.
+The [enforcement spec](../specs/policy-enforcement.md) defines the current algorithm.
+The [rollout spec](../specs/hook-policy-rollout.md) separates source implementation from release and deployment gates.
+
+## Alternatives considered
+
+- **Keep managed settings as the normal path.** Rejected because it keeps the privileged runtime and ongoing sudo requirement.
+- **Put an evaluator in each plugin.** Rejected because it duplicates policy and evidence handling.
+- **Call Fleet for each invocation.** Rejected because network availability must not govern the local action path.
+- **Deny when identity, inventory or risk coverage is incomplete.** Rejected by the user because implementation gaps must not create policy restrictions.
+- **Persist effective decisions.** Deferred because component decisions require current identity and evidence.
+  Restore desired inputs after restart, then rebuild decisions.
+  Use known category defaults during rebuilding, or defer when no default can be established.
+- **Refresh only after a policy change.** Rejected because local inventory and advisory data can change at the same policy revision.
+- **Support `/cd` through hook working-directory fields.** Rejected because shell directory changes and configuration switches can produce the same observed fields.
+- **Add receipts, leases or adapter-health claims.** Deferred because the local decision path does not require them.
+
+## Consequences
+
+The same policy document governs hook-visible use without repeated managed-settings writes.
+A confirmed restriction blocks an invocation.
+A coverage or availability gap does not add a restriction.
+Native permissions remain in force.
+
+The hooks do not prevent plugin loading, startup hooks, LSP startup or earlier skill-context injection.
+They do not intercept MCP connections, resources or prompt attachment.
+Disabled or unlaunched hooks remain coverage gaps.
+Hooks do not provide complete mediation or a tamper-resistant boundary.
+
+The legacy managed-policy path remains available until each installation completes its explicit migration.
+No design or implementation PR merges, publishes or deploys automatically.
+
+## When to revisit
+
+Add another host only after its own conformance checks pass.
+Revisit project switching when the host exposes a reliable configuration-change signal.
+Add durable decisions or health reporting only when measured requirements justify their extra state.