stacktrace-cli 0.14.0__tar.gz → 0.16.0__tar.gz

{stacktrace_cli-0.14.0 → stacktrace_cli-0.16.0}/.github/workflows/guard-staging.yml

@@ -9,7 +9,8 @@ name: guard-staging
 # litellm-staging environment: AWS_DEPLOY_ROLE_ARN, ECR_REPOSITORY_URL,
 # ENVOY_ECR_REPOSITORY_URL, SUBSCRIPTION_ECR_REPOSITORY_URL, ECS_CLUSTER,
 # ECS_SERVICE, ENVOY_SERVICE, SUBSCRIPTION_SERVICE, LOG_GROUP, MASTER_KEY_SECRET,
-# STAGING_ENDPOINT, ENVOY_ENDPOINT, SUBSCRIPTION_ENDPOINT, GUARD_MODE.
+# STAGING_ENDPOINT, ENVOY_ENDPOINT, SUBSCRIPTION_ENDPOINT, GUARD_MODE, and
+# GATEWAY_DAEMON=1 once tofu runs with fleet_enrollment = true (ADR-0151).
 
 on:
   workflow_dispatch:
@@ -128,16 +129,22 @@ jobs:
         env:
           MODE: ${{ vars.GUARD_MODE }}
           LOG_GROUP: ${{ vars.LOG_GROUP }}
+          # 1: each task runs the enrolled daemon, and the smoke test checks that
+          # the rm finding reached Fleet through it (infra/guard-staging/smoke.sh).
+          DAEMON: ${{ vars.GATEWAY_DAEMON }}
         run: |
           MASTER_KEY=$(aws secretsmanager get-secret-value --secret-id "${{ vars.MASTER_KEY_SECRET }}" \
             --query SecretString --output text)
           echo "::add-mask::$MASTER_KEY"
           fail=0
-          for endpoint in "${{ vars.STAGING_ENDPOINT }}" "${{ vars.ENVOY_ENDPOINT }}"; do
-            echo "== $endpoint"
-            ENDPOINT="$endpoint" MASTER_KEY="$MASTER_KEY" infra/guard-staging/smoke.sh || fail=1
-          done
+          # Each service logs under its own stream prefix (infra/guard-staging/main.tf).
+          echo "== ${{ vars.STAGING_ENDPOINT }}"
+          ENDPOINT="${{ vars.STAGING_ENDPOINT }}" MASTER_KEY="$MASTER_KEY" LOG_STREAM_PREFIX=litellm \
+            infra/guard-staging/smoke.sh || fail=1
+          echo "== ${{ vars.ENVOY_ENDPOINT }}"
+          ENDPOINT="${{ vars.ENVOY_ENDPOINT }}" MASTER_KEY="$MASTER_KEY" LOG_STREAM_PREFIX=envoy \
+            infra/guard-staging/smoke.sh || fail=1
           echo "== ${{ vars.SUBSCRIPTION_ENDPOINT }} (subscription)"
           ENDPOINT="${{ vars.SUBSCRIPTION_ENDPOINT }}" MASTER_KEY="$MASTER_KEY" SUBSCRIPTION=1 \
-            infra/guard-staging/smoke.sh || fail=1
+            LOG_STREAM_PREFIX=subscription infra/guard-staging/smoke.sh || fail=1
           exit $fail

{stacktrace_cli-0.14.0 → stacktrace_cli-0.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stacktrace-cli
-Version: 0.14.0
+Version: 0.16.0
 Summary: CLI for Stacktrace — Detection and Response platform for AI Agents.
 Project-URL: Homepage, https://stacktrace.ai
 Author-email: "Stacktrace AI, Inc" <founders@stacktrace.ai>
@@ -21,7 +21,7 @@ Requires-Python: >=3.11
 Requires-Dist: click>=8.1
 Requires-Dist: httpx<1.0.dev0,>=0.28.1
 Requires-Dist: openaca==0.12.0
-Requires-Dist: openaidr==0.7.1
+Requires-Dist: openaidr==0.8.0
 Requires-Dist: posthog<8,>=7.0
 Requires-Dist: pydantic<3,>=2.10
 Description-Content-Type: text/markdown
@@ -52,7 +52,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.14.0
+stacktrace 0.16.0
 ```
 
 ## Python package namespace
@@ -251,13 +251,14 @@ enables telemetry again under a new identity (ADR-0039, ADR-0090).
 
 Beta, and under active development.
 
-`sessions`, `detect` and `monitor` work end to end today, for Claude Code and
-Devin sessions alike (Devin CLI and Devin Desktop's local agent). Session collection is
+`sessions`, `detect` and `monitor` work end to end today, for Claude Code,
+Devin (Devin CLI and Devin Desktop's local agent), Codex and Cursor (the Cursor
+CLI) sessions. Session collection is
 [OpenAIDR](https://github.com/open-agent-security/openaidr)'s, and further agent
 kinds arrive with it. The daemon observes every kind it reads, sub-agents included.
 [Agent support](docs/agent-support.md) lists what works for each agent, rule by
-rule, and what cannot. Codex is next
-([spec](docs/specs/codex-agent-kind.md)).
+rule, and what cannot. Cursor arrives with OpenAIDR 0.8.0
+([spec](docs/specs/cursor-agent-kind.md)).
 
 ## Built on
 

{stacktrace_cli-0.14.0 → stacktrace_cli-0.16.0}/README.md

@@ -24,7 +24,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.14.0
+stacktrace 0.16.0
 ```
 
 ## Python package namespace
@@ -223,13 +223,14 @@ enables telemetry again under a new identity (ADR-0039, ADR-0090).
 
 Beta, and under active development.
 
-`sessions`, `detect` and `monitor` work end to end today, for Claude Code and
-Devin sessions alike (Devin CLI and Devin Desktop's local agent). Session collection is
+`sessions`, `detect` and `monitor` work end to end today, for Claude Code,
+Devin (Devin CLI and Devin Desktop's local agent), Codex and Cursor (the Cursor
+CLI) sessions. Session collection is
 [OpenAIDR](https://github.com/open-agent-security/openaidr)'s, and further agent
 kinds arrive with it. The daemon observes every kind it reads, sub-agents included.
 [Agent support](docs/agent-support.md) lists what works for each agent, rule by
-rule, and what cannot. Codex is next
-([spec](docs/specs/codex-agent-kind.md)).
+rule, and what cannot. Cursor arrives with OpenAIDR 0.8.0
+([spec](docs/specs/cursor-agent-kind.md)).
 
 ## Built on
 

{stacktrace_cli-0.14.0 → stacktrace_cli-0.16.0}/docs/adrs/0112-a-person-is-known-by-the-accounts-on-the-host.md

@@ -6,7 +6,7 @@ date: 2026-10-11
 supersedes: null
 superseded-by: null
 amends: 0101, 0109, 0110
-amended-by: 0121
+amended-by: 0121, 0153
 ---
 
 ## Context

{stacktrace_cli-0.14.0 → stacktrace_cli-0.16.0}/docs/adrs/0118-observe-agents-through-adapters-and-a-shared-analyzer.md

@@ -6,7 +6,7 @@ date: 2026-10-11
 supersedes: null
 superseded-by: null
 amends: 0001, 0004, 0006, 0031, 0061
-amended-by: 0135
+amended-by: 0135, 0151
 ---
 
 ## Context

{stacktrace_cli-0.14.0 → stacktrace_cli-0.16.0}/docs/adrs/0119-read-sessions-from-an-ai-gateway-and-block-inline.md

@@ -6,7 +6,7 @@ date: 2026-10-10
 supersedes: null
 superseded-by: null
 amends: null
-amended-by: null
+amended-by: 0151
 ---
 
 ## Context

stacktrace_cli-0.16.0/docs/adrs/0151-step-one-puts-the-daemon-beside-the-gateway.md

@@ -0,0 +1,174 @@
+---
+id: 0151
+title: Step one puts the daemon beside the gateway, names the person, and enforces Fleet policy there; Core is step two
+status: proposed
+date: 2026-10-19
+supersedes: null
+superseded-by: null
+amends: 0118, 0119
+amended-by: null
+---
+
+## Context
+
+Stacktrace has two gateway adapters on main: a LiteLLM guardrail and an Envoy
+Lua filter (ADR-0119). Both ask `stacktrace guard serve` one question about a
+model response: may its tool calls reach the agent? The guard runs the three
+`BLOCKING_RULES` and answers `allow` or `block`. It fails open.
+
+The guard writes its findings to a JSONL file or to stdout. It has no path to
+Fleet. It has no enrollment, no credentials, no retry queue and no
+notification sinks. It does not know Fleet policy. It knows the person only
+through a separate `call` record that LiteLLM writes, which no finding carries.
+
+The user daemon already has the parts the guard lacks. It stores findings in
+`FindingStore`. It uploads them to Fleet through the enrolled drain. It fans
+notifications out to Slack and to webhooks. It fetches the organization's
+policy from Fleet and turns it into decisions with the OpenACA evaluator
+(ADR-0135, ADR-0136). Claude Code hooks ask it a yes or no question over a
+private Unix socket and block on "no" (ADR-0131, ADR-0143).
+
+The earlier direction was gateway, then a guard service, then a new Core
+service, then Fleet. ADR-0150 and Plan 018 (proposed, on
+`claude/core-service-plan`) describe Core. Core is not built.
+
+At the 2026-10-19 founder sync, Vinod proposed a simpler first step: run the
+daemon beside the gateway, as it runs beside agents today. Micheal agreed, and
+asked for three more things: name the person behind each call, enforce Fleet
+policy at the gateway, and keep the move to Core cheap. The
+[gateway and daemon spec](../specs/gateway-daemon.md) gives the mechanism. The
+[architecture one-pager](https://claude.ai/artifact/MCGpTPuUzH14C6EMKfR8Cx)
+shows the flow, the requirements it meets and the step after it.
+
+## Decision
+
+1. **The daemon answers the gateway.** The daemon runs on the gateway host,
+   beside the gateway, in the same container group or on the same machine.
+   With `STACKTRACE_GATEWAY_LISTEN` set, it serves ADR-0119's contract
+   (`/v1/evaluate`, `/v1/observe`, `/healthz`) on loopback. It replaces
+   `stacktrace guard serve` for an enrolled host. The rules, the reply and the
+   fail-open behaviour are the guard's own. The listener is off by default.
+2. **The decision is made on the gateway host.** The adapter asks the daemon
+   over loopback, or evaluates in-process. A decision never waits on a network
+   round trip to another host. This is the same constraint ADR-0150 sets for
+   Core.
+3. **The gateway names the person.** The adapter adds a `principal` to each
+   request: `{"id": "...", "source": "litellm-key" | "envoy-jwt" | ...}`. It
+   comes only from the gateway's own authentication (LiteLLM's key check, an
+   Envoy auth filter), never from a header the client sets. The daemon accepts
+   it only on an authenticated channel: loopback with `STACKTRACE_GUARD_TOKEN`.
+   Without a verified identity the principal is absent, not guessed. The
+   daemon keys a gateway session by agent kind, session id and principal, and
+   every finding it stores carries the principal as `actor`. The event
+   identity uses the same key, so two people who send one session id never
+   share an event.
+4. **The gateway enforces Fleet policy.** The daemon already fetches the
+   organization's policy. It also serves the decisions to the gateway path.
+   The adapter maps each tool call in a model response to a policy subject:
+   - an MCP tool call to its server (`mcp__github__create_issue` is server
+     `github` for Claude Code; each agent kind has its own naming map),
+   - a `Skill` call to the skill it names,
+   - a `Task` or `Agent` call with a namespaced `subagent_type` to that plugin
+     agent.
+   In `enforce`, an explicit `deny` blocks the response, with the hook's own
+   message: the rule's description and where to see the policy. In `observe`, a
+   deny does not block. The daemon records the action as `allowed`, and keeps
+   the policy rule. A deny on one call blocks the whole response, so no call in it runs. A subject the policy does
+   not name gets the category default only when the organization turns that on
+   for gateways; otherwise it passes. Built-in tools are not policy subjects;
+   the three `BLOCKING_RULES` still apply to them. No policy, a policy past its
+   time to live, or an unreadable response passes and is recorded as a
+   fallback.
+5. **One decision function.** The hook path and the gateway path call the same
+   function to turn the policy into a decision for a named subject. It is
+   extracted from `policy_runtime.py`, so a deny in Fleet means the same thing
+   on a laptop and at the gateway.
+6. **The gateway's findings reach Fleet.** Each finding is written to
+   `FindingStore` with `actor`, `action` (`blocked`, `allowed`, `observed`) and
+   the policy revision or rule pack version that produced it. The Fleet drain
+   uploads it under the gateway host's enrollment. A verdict with no finding
+   (an allow, a fallback, or a policy deny that no rule matched) stays in the
+   daemon's log in step one. Fleet has no record type for it yet. Fleet groups a gateway's findings by `actor`, not
+   by asset. On the wire, `actor` travels as ADR-0112's person: the run's
+   `session.account` and an `accounts[]` card with its `person_key`, which
+   Fleet already accepts. Fleet stays agnostic to where a finding came from,
+   so the gateway enrolls as an ordinary asset. The fields that say what the
+   gateway did need Fleet to declare them first. The spec lists
+   them under "What Fleet needs".
+7. **The hook protocol does not change.** ADR-0135's socket, its fixed action
+   and its version stay as they are. The gateway does not use it: the adapters
+   call out over HTTP, and the rules read the request's whole history, not one
+   action. The hook frame is 64 KiB and has no principal.
+8. **The contract is the seam to Core.** `principal`, `action`, the version
+   that decided, and the event id (session, rule, anchor span) are defined once
+   and are the fields Core's observe and decide APIs accept. The adapters then
+   move to Core by changing one URL.
+9. **Core is step two.** When Core serves observe and decide, the adapters send
+   to Core, Core holds the findings, and session-context rules (retry storms,
+   cost) start to run on gateway traffic. The daemon listener retires for
+   gateways. ADR-0150 and Plan 018, or their successors, govern that step.
+10. **This amends ADR-0118 decision 2 for step one only.** Until Core serves the
+    gateway, the daemon on the gateway host evaluates `BLOCKING_RULES` and
+    Fleet policy for it. No other rule blocks.
+11. **This amends ADR-0119** on where the contract runs and on its fields. The
+    daemon hosts it for an enrolled gateway host. The capability is called
+    "guard", and it will follow Core's interface. `stacktrace guard serve` goes
+    away. Until then, the entrypoint falls back to `guard serve` only on a host
+    that is not enrolled. Requests gain `principal`; replies and stored records
+    gain `action` and the deciding version.
+
+## Alternatives considered
+
+- **A separate guard service that sends to Core.** This was the earlier
+  direction. It lost because Core does not exist yet, so the guard has nowhere
+  to send. Without Core it must also get enrollment, credentials, a durable
+  queue and an uploader. The daemon has all four, and they have shipped.
+- **Go straight to Core.** It lost on time and on evidence. Core is 13 planned
+  tasks away, and the gateway-to-Core latency is not measured. Step one gives
+  Fleet gateway findings and policy enforcement now, and moving to Core is a
+  URL change for each adapter.
+- **Use the hook's `authorize` message as it is.** It lost on two facts. The
+  adapters call out over HTTP: LiteLLM from a guardrail callback, Envoy from a
+  Lua `httpCall`. The hook protocol is JSON lines on a Unix socket. The rules
+  also read the request's whole history, not one action. A request can be up
+  to 32 MiB (`gateway/service.py:45`), and the hook frame is 64 KiB. Adding
+  arguments and history to `authorize` would make it `/v1/evaluate`. Adding a
+  principal would break its version 1 contract for every installed plugin.
+- **Take the person from a request header.** It lost because any client could
+  name anyone, and the daemon sits in front of every person on the host.
+- **Enforce policy only on laptops, through hooks.** It lost on coverage. Hooks
+  cover Claude Code only. A gateway also covers Codex, SDK and production
+  agents, and any machine without the plugin.
+- **Strip denied tools from the request instead of blocking the call.** It lost
+  because ADR-0119 never edits traffic, and the model would then call a tool it
+  cannot see described.
+- **Envoy `ext_authz`.** It lost because it sees the downstream request only.
+  The tool call to judge is in the upstream response.
+
+## Consequences
+
+- Gateway findings, blocks and the person behind them reach Fleet, Slack and
+  webhooks with no new service.
+- One Fleet policy is enforced in two places: on the laptop through hooks, and
+  centrally at the gateway.
+- Policy at the gateway matches by name only. The hook path resolves a
+  component from local evidence; the gateway sees only the name the model
+  sees. A user can rename an MCP server in their own configuration to pass a
+  deny. The hooks stay the authority for components; the gateway is the
+  backstop.
+- Slash commands are not enforced at the gateway. They expand on the client.
+- A per-person policy becomes possible, because the gateway knows the
+  principal. It is not decided here.
+- The rules and the policy check run in the daemon process, beside its scans.
+  Nobody has measured gateway load against the daemon's scan cadence.
+- A listener on a non-loopback address does not start without
+  `STACKTRACE_GUARD_TOKEN`.
+- Fleet must accept and show `actor` and `action`. That is a Fleet change.
+
+## When to revisit
+
+- When Core serves observe and decide for a gateway. Then step two starts.
+- When one gateway host's load makes the daemon miss its scan cadence or the
+  3000 ms adapter budget.
+- When renamed servers are seen passing a gateway deny. Then fingerprint a
+  server by the tools it declares in the request.

stacktrace_cli-0.16.0/docs/adrs/0153-a-gateway-person-reaches-fleet-as-an-account-card.md

@@ -0,0 +1,62 @@
+---
+id: 0153
+title: A gateway person reaches Fleet as an account and its card
+status: proposed
+date: 2026-10-20
+supersedes: null
+superseded-by: null
+amends: 0112
+amended-by: null
+---
+
+## Context
+
+ADR-0151 names the person behind each gateway call from the gateway's own
+authentication. #272 stored that person as `actor` and kept it off the wire,
+because Fleet refuses undeclared fields. A gateway finding then reached Fleet
+with no person: the staging finding showed "—" where the person goes.
+
+ADR-0112 already gives Fleet a person model: a run's `session.account` and an
+`accounts[]` card, whose `person_key` joins the same email across agent kinds.
+It defines the account as the one the agent is signed in as on the host. A
+gateway principal is a different kind of account. The design is in the
+[gateway spec](../specs/gateway-daemon.md#the-person-behind-each-call).
+
+## Decision
+
+A gateway person reaches Fleet as ADR-0112's person, with no new field. The
+finding's `session.account` is a digest of the verified principal's source and
+id, and the payload carries a card for it. When the principal is an email
+address, the card keeps ADR-0112's email digest, so its person key is the one a
+laptop run under that email gets. Any other principal, such as a JWT `sub`, gets
+a card with no person key and no name. `actor` stays local and never travels.
+This amends ADR-0112: an account can also be one a gateway verified.
+
+## Alternatives considered
+
+- **Send `actor` as a new detection field.** Rejected: it needs a Fleet change,
+  it duplicates the person model Fleet already has, and it sends the principal
+  itself.
+- **Use the client's `metadata.user_id`.** Rejected: the client sets it, so
+  anyone could claim to be anyone.
+- **Send the principal's id as the account.** Rejected: an email would travel,
+  which ADR-0112 clause 4 forbids.
+- **Send no person until Fleet adds a field.** Rejected: Fleet can already show
+  a person from a card, and a gateway finding with no person is the gap the
+  staging run showed.
+
+## Consequences
+
+- One person's laptop runs and gateway calls show as one Person in Fleet when
+  the gateway names them by email.
+- A principal that is no email shows as an account with no name. Fleet shows
+  the account id until the person is named another way.
+- A person who uses two gateways with different sources gets two accounts. The
+  person key still joins them when both are the same email.
+
+## When to revisit
+
+- When Fleet holds gateway principals as their own kind of identity, apart from
+  host sign-ins.
+- When a gateway names people by something other than an email, such as an
+  identity provider's user id that Fleet can resolve.

stacktrace_cli-0.16.0/docs/adrs/0155-a-remote-mcp-servers-exact-url-reaches-fleet.md

@@ -0,0 +1,69 @@
+---
+id: 0155
+title: A remote MCP server's exact URL reaches Fleet
+status: proposed
+date: 2026-10-20
+supersedes: null
+superseded-by: null
+amends: null
+amended-by: null
+---
+
+## Context
+
+The redaction pass reduces every http(s) URL in an `openaca:*` property to
+`scheme://host`. OpenACA blocks a remote MCP server by its exact URL, and this
+host compiles Fleet's policy against its own unredacted config. So the target
+Fleet offered for a server at `https://mcp.linear.app/mcp` was
+`https://mcp.linear.app`. A run of `compile_endpoint_policy` against a real
+`~/.claude.json` allowed the server under that entry. Only the full URL blocked
+it.
+
+The component's `openaca:identity`, `mcp-remote/<host>[:port]<path>`, already
+uploads the path. Fleet ADR-0101 admits the exact URL when it normalizes to
+that identity, and stops offering a URL without a path as a target.
+
+The design is in [Remote Sync](../specs/remote-sync.md#privacy-is-unchanged-and-that-is-the-point).
+
+## Decision
+
+The redaction pass keeps a remote MCP server's `openaca:url` and
+`openaca:install_source` whole when the component is an `mcp_server` and the
+URL normalizes to the component's own `openaca:identity`. Such a URL has no
+userinfo, query or fragment. The upload contract admits the same values. Every
+other URL, including the URLs inside `openaca:capabilities` evidence, is still
+reduced to `scheme://host`.
+
+## Alternatives considered
+
+- **Keep every URL at `scheme://host`, and let Fleet build the URL from the
+  identity.** Rejected. The identity drops the query and userinfo. A server at
+  `https://host/mcp?key=v` would get the target `https://host/mcp`, which
+  matches nothing on the host.
+- **Upload a hash of the exact URL.** Rejected. A policy entry needs the URL
+  itself. A hash cannot fill a target.
+- **Keep the path of every http(s) URL.** Rejected. A path that differs from
+  the identity's path is a new disclosure. The identity comparison keeps the
+  disclosure at what this client already uploads.
+- **Strip the query and keep the rest.** Rejected. The result is not the URL
+  on the host, so a block on it blocks nothing. Fleet cannot tell it from an
+  exact URL.
+
+## Consequences
+
+- (+) Fleet's Policy editor offers a URL target that blocks the server here.
+- (+) Nothing leaves the machine that the identity does not already state,
+  apart from the scheme, the host's case and a default port.
+- (–) A Fleet without ADR-0101 refuses a BOM that carries a URL path. Release
+  this change only after that Fleet deploys.
+- (–) The rule mirrors an OpenACA function. A test compares the two, so an
+  upstream change fails the suite.
+- (–) The redaction pass is no longer a pure transcription of openaca's. The
+  exception is marked where it runs.
+- (Watch) A URL path can carry a secret. The identity already uploads it, and
+  the upload contract's credential check refuses a value that looks like one.
+
+## When to revisit
+
+- OpenACA changes the `mcp-remote` identity form or adds URL prefix matching.
+- This client starts to redact identities that carry a secret path.

stacktrace_cli-0.16.0/docs/adrs/0156-the-client-localizes-fleet-policy-targets.md

@@ -0,0 +1,67 @@
+---
+id: 0156
+title: The client localizes Fleet's policy targets before it evaluates or compiles them
+status: accepted
+date: 2026-10-21
+supersedes: null
+superseded-by: null
+amends: null
+amended-by: null
+---
+
+## Context
+
+Fleet's catalog (Fleet ADR-0102 and ADR-0104) writes an exact policy target
+for each MCP server that an administrator approves or blocks. Fleet derives
+the target from the uploaded Agent BOM. The upload is redacted: a launch
+command loses its flags, such as `-y`. So Fleet writes
+`{"command": ["npx", "@acme/jira-mcp@1.4.2"]}`. On the machine, OpenACA's
+matcher compares exact targets with `npx -y @acme/jira-mcp@1.4.2`, and
+matches nothing. A simulation with the real client and Fleet showed that a
+decision made in Fleet did not block the server on the machine.
+
+A URL is uploaded whole only when it normalizes to the server's identity
+(ADR-0155). Any other URL is uploaded as `scheme://host`. Fleet writes a URL
+target only when the uploaded URL has a path (Fleet ADR-0101). An
+administrator can still type a host-only URL target.
+
+## Decision
+
+Before the client evaluates or compiles a fetched policy, it localizes the
+`admission.mcps` lists against the local components. For each local MCP
+server, the client computes the upload form with the same functions that
+prepare the upload. When a list target equals that upload form, the client
+adds the server's exact local target to the same list. The hook path, the
+`remote policy compile` command and the privileged apply worker all localize.
+No new data goes up. Plugins need no step: their `name@marketplace` is not
+redacted.
+
+## Alternatives considered
+
+- **Upload the exact launch command, so Fleet can write exact targets**:
+  rejected because flags can carry user paths, tenant names and secrets. An
+  exact URL is uploaded only because the identity already states its path
+  (ADR-0155). A command has no such identity.
+- **Change OpenACA's matcher to compare redacted forms**: rejected because
+  the matcher is a shared library whose exact semantics other callers
+  depend on, and a client step fixes the defect without a new OpenACA
+  release.
+- **Have Fleet guess the exact form, for example add `-y`**: rejected
+  because flags vary, and a guess matches only some machines.
+
+## Consequences
+
+- A Fleet decision on a launch command now acts on the machine, in the hooks
+  and in Claude's managed settings.
+- A decision on an upload form covers every local variant with the same
+  upload form. An approval covers each flag variant of the same command.
+- An exact URL target already equals the local target, so the join adds
+  nothing for it. A host-only URL target joins each local server whose
+  upload shows only that host: a URL with userinfo, a query or a fragment.
+- The localization must use the upload's own functions. A change to the
+  redaction must keep the two in step; the tests drive both.
+
+## When to revisit
+
+Revisit when Fleet can carry an exact, privacy-safe command target, for
+example a hash that the OpenACA policy language can match.

{stacktrace_cli-0.14.0 → stacktrace_cli-0.16.0}/docs/adrs/INDEX.md

@@ -184,3 +184,7 @@ supersedes anything yet.
 - [0149](0149-a-credential-switch-replaces-the-mcp-sign-in-rule.md) — **A credential switch after a refusal replaces the MCP sign-in rule, and the retry storm is removed** (proposed). `stacktrace-credential-switched` fires when a service refuses a call with an auth error and a later call to it succeeds with a credential the refused call did not carry: in its arguments after the agent read it, or in an agent config file the agent wrote between them. Never after a person's turn, never without a new credential. High confidence when the agent read the credential first. Its `switched_credential` target groups by the new credential and carries the refused credential's mask, so every channel shows both, and the webhook adds `before`. The fix revokes the new credential and takes it out of reach. `stacktrace-mcp-transient-failure` and `stacktrace-tool-retry-storm` move to `RETIRED_SCOPES`; the recovered-refusal filter stays. Amends ADR-0073, ADR-0086 and ADR-0146. Rejected: keeping either rule, reviving `scavenged-credential` as it was, firing on any credential read. Read before changing how a credential switch is detected.
 
 - [0150: Codex hooks use the shared policy runtime](0150-codex-hooks-use-the-shared-policy-runtime.md). CLI first; desktop and cloud require separate conformance.
+- [0151](0151-step-one-puts-the-daemon-beside-the-gateway.md) — **Step one puts the daemon beside the gateway, names the person, and enforces Fleet policy there; Core is step two** (proposed). With `STACKTRACE_GATEWAY_LISTEN` set, the enrolled daemon on the gateway host serves ADR-0119's `/v1/evaluate` on loopback, runs `BLOCKING_RULES` and Fleet policy (MCP servers, skills, plugin agents, matched by name through the hooks' shared decision function), and uploads findings and verdicts with `actor` and `action`. The `principal` comes only from the gateway's own auth. The hook protocol (ADR-0135) is unchanged. The contract is the seam to Core: adapters move by URL. Amends ADR-0118 decision 2 and ADR-0119 for step one. Rejected: a guard service feeding Core, Core first, the hook socket as is, a header-named person, laptop-only policy, stripping tools, Envoy `ext_authz`. Read before routing a gateway to the daemon or to Core, or enforcing policy at a gateway.
+- [0153](0153-a-gateway-person-reaches-fleet-as-an-account-card.md) — **A gateway person reaches Fleet as an account and its card** (proposed). A gateway finding's `session.account` is a digest of the verified principal, and the payload carries an `accounts[]` card for it. An email principal keeps ADR-0112's email digest, so its person key matches a laptop run under that email; any other principal gets a card with no key and no name. `actor` stays local. Amends ADR-0112. Rejected: an `actor` field, the client's `metadata.user_id`, the principal as the account, no person. Read before changing how a gateway names its person in Fleet.
+- [0155](0155-a-remote-mcp-servers-exact-url-reaches-fleet.md) — **A remote MCP server's exact URL reaches Fleet** (proposed). The redaction pass keeps `openaca:url` and `openaca:install_source` whole on an `mcp_server` when the URL normalizes to the component's own `mcp-remote` identity, so it has no userinfo, query or fragment; the upload contract admits the same values. Every other URL is still reduced to `scheme://host`. Pairs with Fleet ADR-0101; release after that Fleet deploys. Rejected: building the URL from the identity, a URL hash, keeping every path, stripping only the query. Read before changing how a URL is redacted for upload.
+- [0156: The client localizes Fleet's policy targets before it evaluates or compiles them](0156-the-client-localizes-fleet-policy-targets.md). Fleet writes upload-form targets, such as a launch command without its flags; the client adds each matching local server's exact target. An exact URL target (ADR-0155) adds nothing. Rejected: uploading exact commands, changing OpenACA's matcher, guessing flags in Fleet.