stacktrace-cli 0.13.0__tar.gz → 0.15.0__tar.gz

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/.github/workflows/guard-staging.yml

@@ -9,7 +9,8 @@ name: guard-staging
 # litellm-staging environment: AWS_DEPLOY_ROLE_ARN, ECR_REPOSITORY_URL,
 # ENVOY_ECR_REPOSITORY_URL, SUBSCRIPTION_ECR_REPOSITORY_URL, ECS_CLUSTER,
 # ECS_SERVICE, ENVOY_SERVICE, SUBSCRIPTION_SERVICE, LOG_GROUP, MASTER_KEY_SECRET,
-# STAGING_ENDPOINT, ENVOY_ENDPOINT, SUBSCRIPTION_ENDPOINT, GUARD_MODE.
+# STAGING_ENDPOINT, ENVOY_ENDPOINT, SUBSCRIPTION_ENDPOINT, GUARD_MODE, and
+# GATEWAY_DAEMON=1 once tofu runs with fleet_enrollment = true (ADR-0151).
 
 on:
   workflow_dispatch:
@@ -128,16 +129,22 @@ jobs:
         env:
           MODE: ${{ vars.GUARD_MODE }}
           LOG_GROUP: ${{ vars.LOG_GROUP }}
+          # 1: each task runs the enrolled daemon, and the smoke test checks that
+          # the rm finding reached Fleet through it (infra/guard-staging/smoke.sh).
+          DAEMON: ${{ vars.GATEWAY_DAEMON }}
         run: |
           MASTER_KEY=$(aws secretsmanager get-secret-value --secret-id "${{ vars.MASTER_KEY_SECRET }}" \
             --query SecretString --output text)
           echo "::add-mask::$MASTER_KEY"
           fail=0
-          for endpoint in "${{ vars.STAGING_ENDPOINT }}" "${{ vars.ENVOY_ENDPOINT }}"; do
-            echo "== $endpoint"
-            ENDPOINT="$endpoint" MASTER_KEY="$MASTER_KEY" infra/guard-staging/smoke.sh || fail=1
-          done
+          # Each service logs under its own stream prefix (infra/guard-staging/main.tf).
+          echo "== ${{ vars.STAGING_ENDPOINT }}"
+          ENDPOINT="${{ vars.STAGING_ENDPOINT }}" MASTER_KEY="$MASTER_KEY" LOG_STREAM_PREFIX=litellm \
+            infra/guard-staging/smoke.sh || fail=1
+          echo "== ${{ vars.ENVOY_ENDPOINT }}"
+          ENDPOINT="${{ vars.ENVOY_ENDPOINT }}" MASTER_KEY="$MASTER_KEY" LOG_STREAM_PREFIX=envoy \
+            infra/guard-staging/smoke.sh || fail=1
           echo "== ${{ vars.SUBSCRIPTION_ENDPOINT }} (subscription)"
           ENDPOINT="${{ vars.SUBSCRIPTION_ENDPOINT }}" MASTER_KEY="$MASTER_KEY" SUBSCRIPTION=1 \
-            infra/guard-staging/smoke.sh || fail=1
+            LOG_STREAM_PREFIX=subscription infra/guard-staging/smoke.sh || fail=1
           exit $fail

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/CLAUDE.md

@@ -129,6 +129,23 @@ nothing about detection.
   `tests/monitor/test_render_cost.py`. When reviews keep re-arguing scope (a
   time boundary, which sessions a rule reads), write the answer into the spec,
   as `docs/specs/cost-phase-1.md` §1 "What a rule reads, and when" does.
+- Write an ADR only in a `/kind feature` PR. Bug fixes, cleanups, wording changes
+  and UI changes get no ADR.
+- A spec holds the design. An ADR holds one decision and its rejected alternatives.
+  Keep the Decision section of an ADR short. Write one paragraph, or a short
+  numbered list of choices. Put commands, flags, failure behavior and test plans
+  in the spec.
+- The specs in `docs/specs/` describe components and change with them. A feature
+  that changes a component updates the spec of that component in the same PR. A
+  feature that adds a component adds a new spec. Start a new spec from
+  `docs/specs/TEMPLATE.md`.
+- Write or update the spec first. Then write ADRs for the decisions whose rejected
+  alternative is plausible. List those ADRs in a "Decisions" table in the spec.
+  Link each ADR to the spec section that has the detail.
+- Do not write "This spec implements ADR-NNNN". The spec is the source of the
+  design.
+- Before a multi-step implementation plan, write the spec and its ADRs. The plan
+  references them. A plan is not a substitute for either.
 
 ## Adding a command
 

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stacktrace-cli
-Version: 0.13.0
+Version: 0.15.0
 Summary: CLI for Stacktrace — Detection and Response platform for AI Agents.
 Project-URL: Homepage, https://stacktrace.ai
 Author-email: "Stacktrace AI, Inc" <founders@stacktrace.ai>
@@ -20,8 +20,8 @@ Classifier: Topic :: Security
 Requires-Python: >=3.11
 Requires-Dist: click>=8.1
 Requires-Dist: httpx<1.0.dev0,>=0.28.1
-Requires-Dist: openaca==0.11.0
-Requires-Dist: openaidr==0.7.0
+Requires-Dist: openaca==0.12.0
+Requires-Dist: openaidr==0.7.1
 Requires-Dist: posthog<8,>=7.0
 Requires-Dist: pydantic<3,>=2.10
 Description-Content-Type: text/markdown
@@ -52,7 +52,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.13.0
+stacktrace 0.15.0
 ```
 
 ## Python package namespace

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/README.md

@@ -24,7 +24,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.13.0
+stacktrace 0.15.0
 ```
 
 ## Python package namespace

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0036-deliver-eligible-findings-to-slack-from-the-daemon.md

@@ -6,7 +6,7 @@ date: 2026-09-20
 supersedes: null
 superseded-by: null
 amends: 0031
-amended-by: 0067
+amended-by: 0067, 0148
 ---
 
 Subsystem: the daemon and its delivery sinks. The integration view across the

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0073-name-what-fired-and-which-component.md

@@ -6,7 +6,7 @@ date: 2026-09-26
 supersedes: null
 superseded-by: null
 amends: 0067, 0071
-amended-by: 0084, 0085, 0138
+amended-by: 0084, 0085, 0138, 0147, 0149
 ---
 
 ## Context

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0083-each-block-reason-is-its-own-rule.md

@@ -6,7 +6,7 @@ date: 2026-09-30
 supersedes: null
 superseded-by: null
 amends: 0039
-amended-by: null
+amended-by: 0146
 ---
 
 ## Context

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0086-a-refusal-names-who-answered-the-call.md

@@ -6,7 +6,7 @@ date: 2026-10-01
 supersedes: null
 superseded-by: null
 amends: 0006, 0027
-amended-by: null
+amended-by: 0146, 0149
 ---
 
 ## Context

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0109-a-detection-carries-its-runs-title-and-the-persons-name.md

@@ -6,7 +6,7 @@ date: 2026-10-11
 supersedes: null
 superseded-by: null
 amends: 0006, 0096, 0101
-amended-by: 0110, 0112, 0140
+amended-by: 0110, 0112, 0140, 0147
 ---
 
 ## Context

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0112-a-person-is-known-by-the-accounts-on-the-host.md

@@ -6,7 +6,7 @@ date: 2026-10-11
 supersedes: null
 superseded-by: null
 amends: 0101, 0109, 0110
-amended-by: 0121
+amended-by: 0121, 0153
 ---
 
 ## Context

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0118-observe-agents-through-adapters-and-a-shared-analyzer.md

@@ -6,7 +6,7 @@ date: 2026-10-11
 supersedes: null
 superseded-by: null
 amends: 0001, 0004, 0006, 0031, 0061
-amended-by: 0135
+amended-by: 0135, 0151
 ---
 
 ## Context

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0119-read-sessions-from-an-ai-gateway-and-block-inline.md

@@ -6,7 +6,7 @@ date: 2026-10-10
 supersedes: null
 superseded-by: null
 amends: null
-amended-by: null
+amended-by: 0151
 ---
 
 ## Context

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0131-activate-hook-policy-without-a-privileged-runtime.md

@@ -6,7 +6,7 @@ date: 2026-10-16
 supersedes: null
 superseded-by: null
 amends: 0018, 0090, 0135
-amended-by: 0143
+amended-by: 0143, 0150
 ---
 
 ## Context

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0133-a-clients-own-error-record-is-a-third-block-channel.md

@@ -6,7 +6,7 @@ date: 2026-10-16
 supersedes: null
 superseded-by: null
 amends: null
-amended-by: null
+amended-by: 0146
 ---
 
 ## Context

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0135-enforce-policy-through-the-daemon-and-agent-hooks.md

@@ -6,7 +6,7 @@ date: 2026-09-29
 supersedes: null
 superseded-by: null
 amends: 0031, 0118
-amended-by: 0136, 0131, 0143
+amended-by: 0136, 0131, 0143, 0150
 ---
 
 ## Context

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0136-bound-policy-evidence-collection-as-one-bundle.md

@@ -6,7 +6,7 @@ date: 2026-10-16
 supersedes: null
 superseded-by: null
 amends: 0020, 0135
-amended-by: 0143
+amended-by: 0143, 0150
 ---
 
 ## Context

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0139-remediation-finding-contract.md

@@ -4,7 +4,7 @@ title: Rules declare remediation grouping and shared presentation
 status: proposed
 date: 2026-10-17
 amends: 0006, 0024
-amended-by: 0141
+amended-by: 0141, 0146
 ---
 
 ## Context

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0141-two-remediation-models-one-credential-identity-and-a-letters-only-fragment.md

@@ -6,7 +6,7 @@ date: 2026-10-18
 supersedes: null
 superseded-by: null
 amends: 0139, 0140
-amended-by: null
+amended-by: 0146, 0147
 ---
 
 ## Context

{stacktrace_cli-0.13.0 → stacktrace_cli-0.15.0}/docs/adrs/0143-the-plugin-owns-session-hooks-on-every-host.md

@@ -6,7 +6,7 @@ date: 2026-10-18
 supersedes: null
 superseded-by: null
 amends: 0070, 0072, 0123, 0131, 0135, 0136
-amended-by: null
+amended-by: 0150
 ---
 
 ## Context

stacktrace_cli-0.15.0/docs/adrs/0146-eight-rules-send-remediation-targets.md

@@ -0,0 +1,138 @@
+---
+id: 0146
+title: Eight more rules send remediation targets, one target kind for each rule
+status: proposed
+date: 2026-10-18
+supersedes: null
+superseded-by: null
+amends: 0083, 0086, 0133, 0139, 0141
+amended-by: 0149
+---
+
+## Context
+
+ADR-0139 gave two rules a list of `finding_targets`: credential egress and
+vulnerable packages. Fleet groups each by its target, and every channel shows
+one title for it. ADR-0141 says to decide the model for any other rule in its
+own ADR.
+
+A customer could not read Fleet's finding page for the other rules. The
+product owner reviewed a catalogue of every rule on 2026-10-18. It gave each
+rule a title, an explanation, a fix, more detail and a grouping by its fix.
+The product owner then gave these decisions:
+
+- Move eight rules to the framework.
+- Report a recursive delete only when it is `high`.
+- Read `~` and `$HOME` in a delete.
+- Remove the Publishing rule.
+- Leave the infrastructure, completion and cost rules as they are.
+
+## Decision
+
+1. **Eight rules send `finding_targets`.** Each rule has one target kind of its
+   own. `KIND_RULES` in `finding_contract.py` maps each kind to its rule.
+   `KIND_FIELDS` names the fields that each kind carries. The contract refuses
+   a target that sets a field of another kind.
+
+   | Rule | Kind | Fields | Groups by | Title |
+   | --- | --- | --- | --- | --- |
+   | `credential-persisted` | `stored_credential` | fingerprint, mask, credential kind | kind, fingerprint | Credential written to a file: **{mask}** |
+   | `destructive-action` | `deleted_folder` | span, folder | kind, span | Recursive delete removed **{folder}** |
+   | `mcp-transient-failure` | `mcp_signin` | service | kind, service | MCP sign-in failed, then recovered: **{service}** |
+   | `blocked-quota` | `spend_limit` | account | kind, account | Spend limit reached |
+   | `blocked-policy` | `safety_check` | session id, service | kind, session id | **{service}** stopped the agent |
+   | `blocked-throttled` | `rate_limit` | service, status | kind, service, status | Rate limited by **{service}** |
+   | `blocked-upstream` | `access_denied` | service, status | kind, service, status | Access denied by **{service}** |
+   | `tool-retry-storm` | `retried_call` | service, attempts | kind, service | **{service}** retried without change |
+
+2. **A new key includes its kind.** A credential that is both sent and stored
+   then has two keys. Fleet finds a group's name by its key alone. The keys of
+   the first two kinds do not change, so their groups keep their history.
+
+3. **A target names no path and no session text.**
+   - `folder` is one of four fixed words: `root`, `workspace`, `system` and
+     `home`. The paths stay in the evidence `kind` (ADR-0084), and redaction
+     cleans them on upload.
+   - `service` is the call's `_outside_target` without the tool name. A
+     block that the client reports in a reply names `the model provider`. A
+     call with no target names `an unnamed service`. A retried call keeps the
+     tool name, as its citation does. A safety check names `A safety check`
+     or `An automatic approval reviewer`. This amends ADR-0086 for this field
+     only, with the same shape rules.
+   - `status` is `401`, `403`, `429`, `529` or empty.
+   - `account` is the run's `session.account` (ADR-0112). The upload adds it.
+     A run with no account sends no `spend_limit` target. Fleet never shows
+     the account.
+   - `session_id` is the finding's own session. `span` is a span that the
+     finding cites.
+
+4. **The explanation and the fix follow the status.** A 401 says that the
+   service rejected the sign-in, and the fix is to sign in again. A 403 says
+   that the service denied access, and the fix is to grant the permission.
+   A 529 says that the provider was overloaded, and there is no limit to raise.
+
+5. **A rule can have no fix.** A retried call has an empty remediation. Every
+   channel then leaves out the Remediation section.
+
+6. **A title counts several targets with the rule's own noun.** `title_for`
+   moves into `finding_contract.py`. Fleet's list, detail page and Slack then
+   use the client's title. This amends ADR-0141 clauses 4 and 6.
+
+7. **A block's remediation states the fix and nothing about one session.**
+   Fleet groups many sessions under one fix. The count of events, a repeated
+   reply, and whether the session ended on the block move to the target's
+   reasons. Each channel shows them under More Detail for that occurrence. The
+   title of a Codex approval reviewer comes from the target, not from the
+   notice. This amends ADR-0083 and ADR-0133.
+
+8. **`destructive-action` reports a `high` delete only.** A delete near the
+   workspace (`medium`) or deep in another tree (`low`) is not a finding. The
+   rule reads `~`, `~/...`, `$HOME` and `${HOME}` against the home folder
+   that the workspace path shows: `/Users/<name>`, `/home/<name>` or `/root`.
+   With no such home folder, the rule declines the target, as before.
+
+9. **`stacktrace-unrequested-publication` is removed.** No stage ran its gate.
+   It moves to `RETIRED_SCOPES` with the scope `call`.
+
+## Alternatives considered
+
+- **Keep the `credential` kind for a stored credential.** Rejected. The rule
+  comes from the kind, and Fleet checks that each target belongs to its rule.
+- **Put the deleted path in the target.** Rejected. The client builds the
+  title before redaction, and nothing redacts a target. Fleet would get a raw
+  path, and the Monitor and Fleet titles would differ.
+- **Group a delete by host and path.** Rejected because the path does not
+  travel. A delete groups by its call. Each delete needs its own restore.
+- **Name the account in the spend limit title.** Rejected. The account is an
+  opaque id (ADR-0112). Fleet shows the person in its Users section.
+- **Name the session in the safety check title.** Rejected. ADR-0109 gates
+  the session title, and nothing gates a target.
+- **Group a throttle by the service only.** Rejected. A 429 has a limit to
+  raise, and a 529 does not.
+- **Keep the outcome sentence in the remediation.** Rejected. A sentence
+  about one session is false for a group of sessions.
+- **Drop the outcome sentence.** Rejected. A reader decides whether to resume
+  a session from it.
+- **Keep `medium` and `low` deletes.** Rejected by the product owner.
+  Readers skip a finding that is usually harmless (ADR-0013).
+- **Expand `~` with the detector's own `HOME`.** Rejected. The detector need
+  not run as the session's user.
+- **Move all fifteen rules.** Rejected by the product owner. The cost rules
+  have their own layout, and two security rules are not in use.
+
+## Consequences
+
+- Fleet must accept the new kinds before a client sends them. An older Fleet
+  refuses the whole run.
+- A Fleet row of these rules with no target keeps its old grouping.
+- Monitor and the webhook show new titles for these rules.
+- Nobody gets a finding for a `medium` or `low` delete. The gateway also
+  stops blocking them.
+- Fleet must show a block's reasons on each session, not as one list for the
+  group.
+- The contract file grows. Both copies must stay the same.
+
+## When to revisit
+
+Revisit when a responder needs the deleted path in Fleet. Revisit when a rule
+needs two target kinds.

stacktrace_cli-0.15.0/docs/adrs/0147-the-webhook-names-the-run-and-the-person-and-an-egress-label-keeps-its-last-four.md

@@ -0,0 +1,105 @@
+---
+id: 0147
+title: The webhook names the run and the person, links to Fleet, and an egress label keeps its last four
+status: proposed
+date: 2026-10-18
+supersedes: null
+superseded-by: null
+amends: 0073, 0109, 0141
+amended-by: null
+---
+
+## Context
+
+The live policy suite's `credential-egress` case sends a classic OpenAI `sk-` key with `curl`.
+The daemon's Slack webhook posted two messages for it:
+
+- "OpenAI API key sk-…e8e2 sent to the model in a prompt"
+- "Credential exposure for OpenAI API key"
+
+The second one does not say which key to rotate.
+ADR-0141 clause 3 lets an egress label show a mask only for four issuer prefixes.
+Fleet's grammar takes a mask with no prefix (Fleet ADR-0094, `_SUFFIX_MASK`).
+So the client dropped the last four characters when it only had to drop the prefix.
+
+The Slack message from the webhook also has no session name and no person.
+Fleet's own Slack message shows both (Fleet ADR-0093, ADR-0109).
+ADR-0073 keeps out of the webhook any field written about one session.
+A run's title is such a field, so the webhook did not send it.
+
+The labels were also weak.
+"Subject" for a credential sent by `curl` was "Bash (tool) (built-in)".
+"Evidence" was the raw kind, such as `openai_key`.
+The footer showed a finding ID to copy, and the message had no way to open the finding in Fleet.
+
+## Decision
+
+1. **An egress label keeps its last four.**
+   A credential that is not a private key gets its kind's name, then the issuer prefix if Fleet shows it, then `…` and the last four characters.
+   A prefix Fleet does not show is dropped, not the whole mask.
+   A classic OpenAI key reads "OpenAI API key …e8e2".
+   A private key still reads by its kind's name alone.
+   This amends ADR-0141 clause 3.
+2. **The webhook carries the run's names and the person.**
+   `session.title`, else `session.opening_words`, and `session.person`, join the projection.
+   They are the values the Fleet upload sends, read from the same store under the same gate (ADR-0101 clause 5, ADR-0140).
+   The person is named only when the run's account is the account signed in now (ADR-0109 clause 3).
+   Each is left out when there is none, bounded at 200 characters, and rendered as inert text.
+   This amends ADR-0073's rule that no field written about one session may be mapped, for these three fields only.
+   Evidence detail, spans, remediation and prompts still do not travel.
+3. **The Slack message names these fields for a reader.**
+   "Affected" lists the targets.
+   "Component" shows the subject, and only when the finding has no targets.
+   "Finding Detail" shows the evidence kinds, with a credential kind by its name.
+   "Session" shows the title, or the quoted opening words.
+   "User(s)" shows the person.
+   "Detected" stays in the footer with the time, so it is not a field label.
+   These are the words Fleet's own Slack message uses (Fleet ADR-0096), taken from the finding detail page.
+4. **The Slack message links to the finding in Fleet.**
+   A "View in Fleet" button sits under the fields.
+   The footer's finding ID is the link text for the same page.
+   The address is the origin of the `dashboard_url` in Fleet's last upload response, kept in `schema_meta`.
+   The path is the one Fleet's own button builds: the rule, the agent kind and the group key.
+   The group key is a target's key, after the upload adds a spend limit's account, or `target:` and a prompt credential's key.
+   Both come from `finding_contract.py`, which Fleet holds an identical copy of.
+   A finding keyed by an id only Fleet assigns opens Fleet's findings list.
+   Before any upload, there is no button, and the ID stays plain text.
+   The JSON format does not carry the link.
+
+## Alternatives considered
+
+- **Keep the egress label to the kind's name for other prefixes**: rejected.
+  A responder cannot tell which key to rotate, and Fleet already takes the last four.
+- **Show the `sk-` prefix too**: rejected.
+  Fleet refuses a prefix outside its four, and refuses the whole run with it.
+- **Leave the names to Fleet's Slack message**: rejected.
+  A machine with a webhook and no Fleet Slack connection gets no names at all.
+- **Send the person to the webhook without the account check**: rejected.
+  It names whoever is signed in today on any run (ADR-0109 clause 3).
+- **Keep "Subject" beside "Affected"**: rejected.
+  For a finding with targets, the component is often the Bash tool, which a responder cannot act on.
+- **Link by Fleet's detection id**: rejected.
+  Fleet assigns it after the upload, and the webhook sends before or beside the upload.
+- **Derive the console address from `api_url`**: rejected.
+  The API and the console have different hosts in production and different ports locally.
+
+## Consequences
+
+- The person's name now leaves the machine to the webhook URL, which the person configured.
+  That can be a third-party workspace, which is wider than the org's own Fleet that ADR-0109 named.
+  A destination that must not learn names should not be a webhook destination.
+- A run's title and opening words now reach the webhook.
+  Both passed the upload contract's string rules, and opening words are letters only (ADR-0141 clause 5).
+- The names are recorded only while Fleet is configured (`UsageRecorder.record`).
+  A machine with a webhook and no Fleet sends no Session and no User(s).
+- A receiver that validates the JSON format with `additionalProperties: false` must accept three new `session` keys.
+  `version` stays `1`, as in ADR-0073.
+- A link waits for the first upload after a restart only on a new store; the address persists.
+  A link can point at a group Fleet has not stored yet, when the webhook sends before the upload.
+  The page then shows no members until the upload lands.
+- More egress labels carry four characters of a credential: AWS, Slack, Stripe, Google and classic OpenAI keys.
+  Four characters do not let anyone recover the key.
+
+## When to revisit
+
+Revisit when the webhook gets names on a machine without Fleet, or when Fleet widens its label grammar.

stacktrace_cli-0.15.0/docs/adrs/0148-credential-egress-notifies-at-medium-confidence-when-it-is-high.md

@@ -0,0 +1,59 @@
+---
+id: 0148
+title: Credential egress notifies at medium confidence when its severity is high
+status: proposed
+date: 2026-10-18
+supersedes: null
+superseded-by: null
+amends: 0036
+amended-by: null
+---
+
+## Context
+
+The notification gate notifies on `medium` severity and above, at `high` confidence only (`FindingStore._eligible`).
+`stacktrace-credential-egress` is `high` severity on every finding.
+Its confidence is the confidence of the egress it read.
+A tool that is network access, such as `WebFetch`, or a recorded MCP transport, gives `high`.
+A shell command such as `curl`, `gh` or `ssh` gives `medium`, because the network access is read from the command string.
+
+So a credential sent with `curl` was uploaded to Fleet and never notified.
+The live policy suite's `credential-egress` case showed it.
+Slack received only `credential-in-prompt`, which is `high` confidence.
+The egress finding, the more serious of the two, reached nobody until they opened Fleet.
+
+## Decision
+
+1. **Credential egress notifies at `medium` confidence when its severity is `high`.**
+   `FindingStore._MEDIUM_CONFIDENCE_WHEN_HIGH` names the rule.
+   `low` confidence still does not notify.
+2. **Every other rule keeps the high-confidence gate.**
+   A rule joins the set only by its own decision.
+3. **The finding keeps its own confidence.**
+   The notification and the webhook payload carry `medium`.
+   Nothing raises a grade to pass the gate.
+
+## Alternatives considered
+
+- **Grade `curl` egress `high`**: rejected.
+  A command string can be misread, and `observed.py` keeps the two grades apart for that reason.
+  The grade would claim more than the detector saw.
+- **Notify every rule at `medium` confidence**: rejected.
+  `mcp-transient-failure` is `medium` on every finding, by its spec, and would alert on each one.
+- **Keep the gate and test egress with `WebFetch`**: rejected.
+  Claude Code's `WebFetch` refuses loopback hosts and sends no headers, so no test can show a credential leaving through it.
+  The gate would still hide every `curl` egress in real use.
+
+## Consequences
+
+- A credential sent by `curl`, `gh`, `ssh` or another shell command now alerts in Slack and in the plugin.
+- A misread command string can now alert.
+  The finding says `medium` confidence, so a reader can tell.
+- ADR-0036 reads a missing `confidence` as `high`, because older records were all `high`.
+  That reading stays true for those records.
+  Records from now on always carry their own `confidence`.
+- `docs/specs/notification-delivery.md` names the exception.
+
+## When to revisit
+
+Revisit when the detector reads shell egress with `high` confidence, or when another rule's severity alone should decide.

stacktrace_cli-0.15.0/docs/adrs/0149-a-credential-switch-replaces-the-mcp-sign-in-rule.md

@@ -0,0 +1,94 @@
+---
+id: 0149
+title: A credential switch after a refusal replaces the MCP sign-in rule, and the retry storm is removed
+status: proposed
+date: 2026-10-19
+supersedes: null
+superseded-by: null
+amends: 0073, 0086, 0146
+amended-by: null
+---
+
+## Context
+
+ADR-0146 moved `stacktrace-mcp-transient-failure` and
+`stacktrace-tool-retry-storm` to the remediation framework. The product owner
+then asked of each rule whether a person can act on it.
+
+The MCP sign-in rule fires when an MCP call fails with an auth error and a
+later call to the same tool succeeds. The record does not say which credential
+a call used. So the rule cannot tell a token refresh from an agent that used a
+credential it found. Its fix asked a person to check something that had
+already recovered. The case that matters is the second one: the agent got past
+a refusal with a credential that nobody gave it.
+
+The retry storm fires on three identical failing calls. It has no fix. A
+refusal, a throttle or a spend limit behind the failures is already a block
+finding with its own fix.
+
+`stacktrace-scavenged-credential` caught part of the credential case until
+0.4.0. It fired on no session of the measured corpus and was removed. The
+product owner accepts a rule that seldom fires when each finding is useful.
+
+## Decision
+
+1. **`stacktrace-credential-switched` replaces the MCP sign-in rule.** It is a
+   security rule, graded `high`. It fires when a service refuses a call with
+   an auth error, and a later call to the same service succeeds with a
+   credential that the refused call did not carry. The credential is in the
+   successful call's arguments, and the agent read it first in the result of
+   an earlier call. Or the agent wrote it into an agent config file between
+   the two calls. A credential-shaped string in the arguments can be the
+   content of a document, so a credential that the agent did not read does
+   not count.
+2. **It never fires when a person or the client acted.** A person's turn
+   between the two calls closes the episode. With no new credential in sight,
+   such as a token the client refreshed, there is no finding.
+3. **Its confidence says where the credential came from.** It is `high` when
+   the agent read each new credential in an earlier result. It is `medium`
+   when the agent wrote a credential into a config file and did not read it
+   first.
+4. **Its target is the new credential.** The kind is `switched_credential`.
+   It carries the credential's digest, mask and kind, as credential exposure
+   does, and Fleet groups by the digest. It also carries the mask of the
+   refused credential (`previous_label`, empty when the call carried none),
+   the service and the refusal's status. Every channel shows both
+   credentials. The webhook adds a `before` field to its JSON, one line for
+   each refused credential and its service. Its Slack message shows the line
+   as Before, as Fleet's message does.
+5. **The fix is to revoke the new credential and take it out of reach.**
+   "Revoke or rotate this {credential}. Then remove it from where the agent can
+   read it. If the agent needs this access, grant it to the agent's own
+   credential."
+6. **The retry storm is removed.** Its kind, `retried_call`, and the
+   `attempts` field leave the contract.
+7. **Both old ids move to `RETIRED_SCOPES`** with the scope `call`, so a
+   stored finding still uploads.
+8. **The filter stays.** An auth refusal that the same MCP tool later
+   answered is still not an "Access denied" finding.
+9. **The citations name the service**, on ADR-0086's terms.
+
+## Alternatives considered
+
+- **Keep the MCP sign-in rule.** Rejected. Most of its findings are token
+  refreshes, and it has no fix.
+- **Bring back `scavenged-credential` as it was.** Rejected. It saw only a
+  credential in the call's arguments. Most MCP servers sign in through their
+  config, so the config write is the likely path.
+- **Fire on any credential the agent read after a refusal.** Rejected. Reading
+  a credential is not using it. Credential exposure and credential in a file
+  already report a credential that goes somewhere.
+- **Keep the retry storm without a fix.** Rejected. A person cannot act on it.
+
+## Consequences
+
+- The rule fires rarely. A finding means that the agent got past an access
+  control.
+- A credential that the agent passes without its value in the record, such
+  as `export TOKEN=$(cat .env)`, is not seen.
+- Three identical failing calls with no block reason are no longer reported.
+
+## When to revisit
+
+Revisit when the record says which credential each call used. Revisit when a
+measured corpus shows findings that a person could not act on.