stacktrace-cli 0.2.1__tar.gz → 0.2.3__tar.gz

{stacktrace_cli-0.2.1 → stacktrace_cli-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stacktrace-cli
-Version: 0.2.1
+Version: 0.2.3
 Summary: CLI for Stacktrace — Detection and Response platform for AI Agents.
 Project-URL: Homepage, https://stacktrace.ai
 Author-email: "Stacktrace AI, Inc" <founders@stacktrace.ai>
@@ -126,9 +126,10 @@ because it is installed.
 ## What leaves your machine
 
 Two of `detect`'s three stages run entirely locally and need no model or
-credential. The third sends flagged sessions to the agent's *own* CLI — the
-provider that produced the transcript, never a different one — capped by
-`--budget`; `--no-escalate` turns it off and leaves the two local stages.
+credential, and they are the two a bare `detect` runs. The third sends flagged
+sessions to the agent's *own* CLI — the provider that produced the transcript,
+never a different one — and runs only when you pass `--escalate`, capped by
+`--budget`.
 
 `sessions` omits prompts, tool arguments and results unless you pass
 `--include-content`. `monitor` binds to loopback only, refuses a non-loopback

{stacktrace_cli-0.2.1 → stacktrace_cli-0.2.3}/README.md

@@ -101,9 +101,10 @@ because it is installed.
 ## What leaves your machine
 
 Two of `detect`'s three stages run entirely locally and need no model or
-credential. The third sends flagged sessions to the agent's *own* CLI — the
-provider that produced the transcript, never a different one — capped by
-`--budget`; `--no-escalate` turns it off and leaves the two local stages.
+credential, and they are the two a bare `detect` runs. The third sends flagged
+sessions to the agent's *own* CLI — the provider that produced the transcript,
+never a different one — and runs only when you pass `--escalate`, capped by
+`--budget`.
 
 `sessions` omits prompts, tool arguments and results unless you pass
 `--include-content`. `monitor` binds to loopback only, refuses a non-loopback

{stacktrace_cli-0.2.1 → stacktrace_cli-0.2.3}/docs/adrs/0004-three-stage-detector.md

@@ -5,6 +5,8 @@ status: accepted
 date: 2026-08-27
 supersedes: null
 superseded-by: null
+amends: null
+amended-by: 0029
 ---
 
 ## Context

stacktrace_cli-0.2.3/docs/adrs/0028-the-console-shows-what-it-placed.md

@@ -0,0 +1,108 @@
+---
+id: 0028
+title: The console shows what it placed, and states no coverage
+status: accepted
+date: 2026-09-08
+supersedes: null
+superseded-by: null
+amends: null
+amended-by: null
+---
+
+## Context
+
+A reader opened `stacktrace monitor` on their own machine and asked why the
+busiest row on the page was red. The row was the grouped built-in row for one
+project — 4,467 calls over five days — and it carried `⚠ 16 refusals`. All 16
+were `user-rejected` in the transcript, and their recorded reasons were the
+Bash gate rather than a person: 29 `contains multiple operations`, 28 `requires
+approval`, 6 `changes directory before running git`, 3 `brace with quote
+character (expansion obfuscation)`, 2 `parser aborted`, 1 `contains
+for_statement` across the project's 70 denials. Nothing reached a tool.
+
+`sessions/outcome.py` already states the rule: *a denied call reached nothing,
+so it is evidence of nothing* — written after six sites had each grown their own
+`status == "rejected"` test. The page took that rule for its counters and then
+painted the row red anyway, which reports the permission prompt as the
+incident. ADR-0025 left this open deliberately: its Consequences name "a second
+counter every activity read surface must decide whether to show".
+
+The same page led with `⚠ unresolved` rows, an `Unresolved` row in the overview
+table, a legend line, and a `6,867/7,055 placed` header fraction. `unresolved`
+is a fact about the *record*, with four causes the reader cannot distinguish and
+none of which they can act on: absent from the composition, no composition for
+that agent kind, an ambiguous match, or a matched component whose type the
+category map does not know. The row names no component — `classify_call`
+returns no name for it by design (ADR-0027 admits a name at one position, and an
+activity row is not one) — so what reached the reader was "something happened
+and nothing here claims it", set in the page's warning colour.
+
+The rule that would have made such a call actionable, `unsanctioned-mcp-tool-use`,
+was withdrawn by ADR-0015. So no live rule is about an unplaceable call, and the
+page was warning about something it could not then explain.
+
+## Decision
+
+The console renders only activity it could place, and states no coverage
+figure. Rows whose category is `unresolved` are dropped at the page boundary;
+the `N/M placed` fraction and its `placing…` placeholder are gone from the
+header, which now counts sessions and the actions it actually shows; a refusal
+is counted in a row's `×N` and carries no badge and no colour; the
+no-composition banner is gone, leaving the two banners that report a *reader*
+which came back with nothing.
+
+The snapshot contract does not change. `_activity` still emits unresolved rows,
+`summary.coverage` and each session's `coverage` are still computed and still
+sent, `activity_for_upload` and the `denied` counter are untouched, and every
+detector rule reads what it always read. `stacktrace correlate` remains the
+surface where coverage and unplaceability are the subject; ADR-0026's clause
+holds, because a page that shows less has still invented nothing.
+
+## Alternatives considered
+
+- **Filter in `_activity`, server-side** — rejected. The snapshot is also the
+  `/api/state` contract and the thing `tests/monitor/test_render.py` holds; a
+  page decision that narrows the record makes the two disagree, and the next
+  surface built on the snapshot would inherit a filter it never asked for.
+- **Keep the rows, drop only the warning framing** — rejected by the person the
+  page is for. Neutral wording does not give the row a subject: with no
+  component name there is nothing for a reader to look up, so a quiet row is
+  the same non-answer in a calmer colour.
+- **Keep the coverage fraction** — rejected. The gap between numerator and
+  denominator *is* the count of rows the page no longer shows, so the header
+  restated by arithmetic exactly what the feed had stopped saying.
+- **Keep the red on refusals alone** — rejected. It is the page asserting the
+  opposite of `outcome.py`'s rule about the same call, and the measured reasons
+  above are a guardrail working, not an endpoint under attack.
+- **Reword the no-composition banner rather than remove it** — rejected after
+  trying it. "No Agent BOM found, so its components are not identified" is the
+  same claim one step back, and it sends a reader looking for rows that are no
+  longer there.
+
+## Consequences
+
+The page stops answering one question it used to answer badly: how much of the
+window it could not attribute. A reader who wants that runs `stacktrace
+correlate`, where the figure is the subject and the four causes are named
+separately; the fleet still receives it, because the upload path is untouched.
+
+The costs are real and worth naming. An agent kind with no Agent BOM now shows
+fewer categories in the overview table and says nothing about why — the built-in
+preview rows still appear, so the page does not go blank, but the absence is
+silent. A responder cannot see from the console that an MCP call went to a
+server no scan can find. And a denied-heavy endpoint — ADR-0025's own example of
+a fact visible on no surface — is still visible on none.
+
+**Watch for:** a second page-side filter added the same way, without an ADR,
+because this one made it look routine; and the header regaining any derived
+ratio, which is the shape this decision removed.
+
+## When to revisit
+
+If ADR-0015's `unsanctioned-mcp-tool-use` returns, revisit immediately: its
+evidence is exactly the rows this decision hides, and a finding whose subject
+cannot be seen on the page it is reported on is worse than either state alone.
+Also if the console gains an affordance for *why something is missing* — a
+per-kind detail view, say — which is where the coverage figure and the four
+causes belong, or if a remote surface starts reading the local snapshot and
+assuming the page's filtering rather than the record's contents.

stacktrace_cli-0.2.3/docs/adrs/0029-stage-three-returns-to-opt-in.md

@@ -0,0 +1,115 @@
+---
+id: 0029
+title: Stage three returns to opt-in
+status: accepted
+date: 2026-09-09
+supersedes: null
+superseded-by: null
+amends: 0004
+amended-by: null
+---
+
+## Context
+
+ADR-0004 was amended on 2026-09-03 to default `--escalate` **on** for
+`stacktrace detect`. The reasoning was sound and the amendment said so plainly:
+a stage nobody turns on never runs, and rules that depend on it — `injection-
+marker` above all — can only ever be evaluated against zero verdicts. It also
+named its own exit: *"Revisit once there is a measured escalation rate and
+verdict yield to argue from; if the yield does not justify the spend, the
+honest move is back to opt-in rather than a narrower cap."*
+
+What forces the revisit now is not the yield. It is that the default was only
+ever changed in one of the three places that carry it, and the other two — plus
+everything we publish — kept saying the opposite:
+
+| Surface | Default |
+| --- | --- |
+| `run_detector()` | `escalate=False` |
+| `stacktrace monitor` | `False` — *"a page left open is the wrong place for that to be implicit"* |
+| `remote sync detect` | `False` (ADR-0023) |
+| `stacktrace detect` | `True` |
+
+The published quickstart tells a new user to run `stacktrace detect
+--no-escalate`, annotated *"# Investigate without model escalation"* — a
+documented first command whose only purpose is to undo the default. The site's
+data-handling section makes the same promise in prose: *"Start with detection
+that doesn't send session content to a model."* `docs/plans/004-detector.md`
+still describes the stage as opt-in. One surface out of four, contradicted by
+its own documentation, is not a default; it is a divergence.
+
+Be honest about the evidence this ADR does **not** have. The escalation rate is
+low — an audit on 2026-09-02 measured 3 escalations across 635 sessions, 1 on
+evidence and 2 sampled — but that audit predates the amendment and so describes
+behaviour under the opt-in default it is being used to restore. Verdict yield,
+the other half of what ADR-0004 asked for, has not been measured. Stage 3 has
+also still never run against a real analyzer: the `live_cli` test is opt-in and
+deselected. So this is not the evidence-based revisit ADR-0004 anticipated. It
+is a consistency and consent decision taken ahead of that evidence.
+
+## Decision
+
+`stacktrace detect` defaults `--escalate` off, matching `run_detector`,
+`monitor` and `sync detect`. A bare `stacktrace detect` sends no session content
+off the machine.
+
+Two things travel with it. The verdict cache is no longer gated on `escalate`:
+`run_detector` already states that a verdict already paid for is an answer this
+run *has*, and that `escalate` governs whether new ones may be commissioned, not
+whether old ones may be read — `cli.py` contradicted that, and flipping the
+default without fixing it would have made every stored verdict silently
+unreadable on the default path. And a run that declines to escalate still counts
+and names the sessions that qualified, as `reasoning_not_requested`, so a run
+without stage 3 does not read as a clean one.
+
+## Alternatives considered
+
+- **Leave it on and fix only the docs.** Rejected: the quickstart, the
+  data-handling copy and the plan all describe opt-in, and three of four code
+  surfaces implement it. Changing four things to match one is the wrong
+  direction, and the one is the surface that spends the user's money.
+- **Keep it on until verdict yield is measured, as ADR-0004 asked.** Rejected on
+  consent rather than evidence: the measurement requires a bare `detect` to keep
+  sending transcript content to a provider by default, and the same measurement
+  is obtainable from users who opt in. The amendment accepted that cost
+  deliberately; what it did not anticipate is that we would simultaneously
+  publish the opposite promise.
+- **A narrower cap instead of opt-in.** Rejected by ADR-0004 itself, in advance:
+  *"the honest move is back to opt-in rather than a narrower cap."*
+- **Prompt interactively on first run.** Rejected: `detect` is scriptable and
+  runs unattended; a prompt makes the non-interactive path either hang or pick a
+  default, which is this decision again with extra machinery.
+
+## Consequences
+
+A bare `stacktrace detect` is now local plus the osv.dev coordinate lookup, and
+nothing else leaves. That is the promise the site already makes, kept.
+
+The cost is the one the amendment identified and it returns in full: stage 3
+runs only when asked, so verdict yield and the rules that depend on it stay
+unmeasured unless we go and measure them. That work does not disappear — it
+moves from "collected passively from every user" to "collected deliberately",
+and it should be done, because `injection-marker` cannot be evaluated at all
+without it.
+
+Watch for the stage going dark again. `reasoning_not_requested` in the reasoning
+accounting is the signal: if it is the dominant outcome across real runs for a
+release or two, the stage is not being reached and the rules behind it are still
+untuned. That is the same failure the 2026-09-03 amendment reacted to, and the
+answer will need to be something other than flipping the default a second time.
+
+Users relying on the implicit default silently lose stage 3. `--no-escalate`
+keeps working, so no invocation breaks; the release note carries the change.
+
+## When to revisit
+
+- **Verdict yield gets measured** and justifies the spend — then this is a
+  candidate to revert, but with the docs and the other three surfaces changed in
+  the same commit, which is what went wrong the first time.
+- **`reasoning_not_requested` dominates** real runs for two releases, per above.
+- **Stage 3 runs against a real analyzer** and the `live_cli` test stops being
+  deselected — until then the default-on path was shipping the least-validated
+  stage.
+- **The escalation stops costing the user.** The whole argument is that the
+  stage spends someone else's quota and crosses a content boundary. A stage that
+  did neither would not need to be asked for.

{stacktrace_cli-0.2.1 → stacktrace_cli-0.2.3}/docs/adrs/INDEX.md

@@ -60,3 +60,5 @@ supersedes anything yet.
 - [0026](0026-the-console-becomes-a-product-surface.md) — **The console becomes a product surface, served by the engine.** Supersedes ADR-0008 on its own stated condition: the engine came first, 0.1.0 shipped, and the data is only useful if a person can follow it. `stacktrace monitor` serves a loopback page from in-process calls, so the wheel now carries a `site/` asset — the cost 0008 refused, accepted here explicitly. What survives from 0008 is the clause that matters: the console renders and never computes, so a finding on the page is one `detect` would print. Read before adding anything to the console that the detector does not produce.
 - [0025](0025-a-denied-call-is-activity-never-an-invocation.md) — **A denied call is activity, and never an invocation.** ADR-0017 makes a declined repeat a stall while `outcome.py` keeps a denied call out of every count, so a denied-only session produced a finding with no activity and the Cloud rejected the whole run; a separate `denied` counter resolves it without either rule bending, and coverage keeps summing `invocations` alone. Read before changing what `activity[]` counts, or before folding `denied` into a coverage-like ratio.
 - [0027](0027-a-finding-may-name-what-it-could-not-place.md) — **A finding may name the component it could not place.** Narrows ADR-0006 constraint 3 for one field: an unplaced subject carries the name the session addressed it by, never as an identity. Read before removing a name from a finding on trust-boundary grounds, or before widening this to a second field.
+- [0028](0028-the-console-shows-what-it-placed.md) — **The console shows what it placed, and states no coverage.** Unplaceable rows, the `N/M placed` header fraction and the red on refusals are gone from `stacktrace monitor`: an unplaced row names no component, and `outcome.py`'s rule about a denied call makes reddening one the page contradicting its own counters. The snapshot contract, the upload and every rule are unchanged. Read before adding a page-side filter, before restoring a coverage ratio to the console, or if `unsanctioned-mcp-tool-use` returns.
+- [0029](0029-stage-three-returns-to-opt-in.md) — **Stage three returns to opt-in.** Amends ADR-0004: `stacktrace detect` defaults `--escalate` off, matching `run_detector`, `monitor` and `sync detect`, all of which never changed — the 2026-09-03 amendment landed in one of four surfaces while the quickstart, the data-handling copy and `plans/004` kept promising opt-in. Taken on consistency and consent, not on the verdict yield 0004 asked for, which is still unmeasured. The verdict cache is ungated from `escalate` in the same change. Read before changing an escalation default, or before arguing stage 3 should be on again.

{stacktrace_cli-0.2.1 → stacktrace_cli-0.2.3}/docs/plans/007-detection-upload.md

@@ -243,8 +243,8 @@ rewrite*.
 - [x] **Step 1: Keep `sync endpoint`'s side-effect order.** Load config, refuse
   if unconfigured, client, replay spool, **detect**, register, upload per kind.
   Detecting before registering keeps a failed run from creating an asset.
-- [x] **Step 2: `--escalate` defaults off**, the inverse of `stacktrace detect`
-  (ADR-0023).
+- [x] **Step 2: `--escalate` defaults off** — a scheduled unattended run must
+  not spend provider quota or cross a content boundary implicitly (ADR-0023).
 - [x] **Step 3: `--dry-run` prints NDJSON from the same builder.**
 - [x] **Step 4: Cap evidence, refuse everything else.** Keep `evidence[0]` —
   the anchor the Cloud identifies a call-scoped detection by — and order, with

{stacktrace_cli-0.2.1 → stacktrace_cli-0.2.3}/docs/plans/008-monitor.md

@@ -177,7 +177,7 @@ def analyse(
     return Analysis(run=run, view=acquired.view, window_start=window_start, window_end=window_end)
 ```
 
-- [x] **Step 4: Rewire `cli.py`'s `detect`.** Replace the three calls with one `analyse(...)`; keep the `try/except ValueError → ClickException` around it and the `VerdictCache(default_directory()) if cache and escalate else None` argument. Keep `_parse_since` as a thin alias if anything else imports it; delete it if nothing does.
+- [x] **Step 4: Rewire `cli.py`'s `detect`.** Replace the three calls with one `analyse(...)`; keep the `try/except ValueError → ClickException` around it and the `VerdictCache(default_directory()) if cache else None` argument — the cache is opened whenever `--cache` allows it and never gated on `escalate`, which governs whether new stage-3 work may be commissioned and not whether a verdict already paid for may be read. Keep `_parse_since` as a thin alias if anything else imports it; delete it if nothing does.
 
 - [x] **Step 5: Rewire `sync_detect.py`'s `_collect_detect_run`.** One `analyse(...)` call; keep `SyncError` translation, keep the working-directory collection and the per-kind activity walk, and read `window_start`/`window_end`/`collection_failures` off the `Analysis` instead of computing them.
 

stacktrace_cli-0.2.3/docs/releases/v0.2.2.md

@@ -0,0 +1,76 @@
+# 0.2.2 — what the console shows
+
+`stacktrace monitor` shipped in 0.2.0 with two kinds of warning on it, and this
+release removes both. Neither pointed at something a reader could act on: one
+marked a call the correlator could not attribute, which names no component by
+design, and the other marked a call a permission prompt had already blocked.
+The engine is untouched — no rule, payload field, command or output shape
+moves — and the whole delta is what one page renders.
+
+## Highlights
+
+- **A blocked call is no longer an alarm.** A refusal is counted in its row's
+  `×N` and says nothing more: no `⚠ N refusals` badge, no red row. On the
+  machine that prompted this, 16 declined `Bash` calls out of 4,467 turned the
+  busiest row on the page red — and all 16 were the Bash gate refusing a
+  compound command, a `cd` before `git`, or an obfuscated brace. Nothing
+  reached a tool. `sessions/outcome.py` has held since 0.1.0 that a denied call
+  reached nothing, so it is evidence of nothing; the page took that rule for
+  its counters and then reddened the row anyway, which reports the permission
+  prompt as the incident. ADR-0025 left this to each surface deliberately, and
+  the console now answers it.
+
+- **The console shows only activity it could place.** The `⚠ unresolved` rows,
+  the `Unresolved` row in the overview table and the legend line describing
+  them are gone. An unplaced row carries no component name — that is a design
+  constraint, not an omission (ADR-0027 admits a name at one position, and an
+  activity row is not one) — so what reached the reader was "something happened
+  and nothing here claims it", with four causes behind it they could not
+  distinguish and none they could act on. The rule that would have made such a
+  call actionable was withdrawn by ADR-0015, so nothing on the page could
+  explain the warning it was showing.
+
+- **The header states no coverage figure.** `6,867/7,055 placed` and the
+  `placing…` placeholder it used while correlation ran are both gone: the gap
+  between those two numbers *is* the count of rows the page withholds, so the
+  header restated by arithmetic exactly what the rows had stopped saying. It
+  now reports sessions and the actions it actually shows — previously it read
+  `summary.actions`, the total over every call in the window, and so claimed
+  more actions than the feed below it could account for.
+
+- **A legend line that described nothing.** `✓ resolved to something you
+  installed` is removed. The page has never drawn that checkmark: the glyph
+  appeared in the legend and in no row, summary or card.
+
+- **The decision is recorded rather than implied.** ADR-0028 states it, lists
+  the five alternatives and is explicit about the costs — an agent kind with no
+  Agent BOM is now silent on the page, and ADR-0025's denied-heavy endpoint is
+  still visible on no surface. `docs/specs/monitor.md` said the opposite in four
+  places and now describes what ships.
+
+## Install
+
+`uv tool install stacktrace-cli==0.2.2` or `pip install stacktrace-cli==0.2.2`.
+
+## Compatibility
+
+Nothing to do, and nothing outside the console changes. `stacktrace detect`,
+`stacktrace correlate` and `stacktrace sync detect` produce byte-identical
+output to 0.2.1, the upload payload is unchanged, and every detector rule reads
+what it always read. No finding is suppressed — ADR-0026's clause that the
+console renders and never judges still holds, and a page that shows fewer
+activity rows invents nothing.
+
+The `/api/state` document is also unchanged: it still carries the unplaced
+activity rows and both coverage figures. The filter is applied in the page, so
+anything reading that endpoint sees the same record 0.2.1 served.
+
+Two things you will notice if you relied on them. Coverage is no longer on the
+console — run `stacktrace correlate`, where it is the subject and the four
+causes of an unplaced call are named separately. And an agent kind with no
+Agent BOM no longer raises a banner: its built-in rows still appear, so the
+page does not go blank, but the absence is reported by `correlate` rather than
+on screen.
+
+Still pre-alpha, with no back-compat hedging: interfaces can change between
+releases without a deprecation window.

stacktrace_cli-0.2.3/docs/releases/v0.2.3.md

@@ -0,0 +1,102 @@
+# 0.2.3 — stage three is opt-in
+
+`stacktrace detect` no longer sends anything session-derived off your machine
+unless you ask it to. The third stage — the one that hands flagged sessions to
+the agent's own CLI — is now behind `--escalate`, which is what the quickstart,
+the data-handling page and three of the four code surfaces already said it was.
+Alongside it, a fix worth reading if you installed with `install.sh`: `correlate`
+was reaching whichever OpenACA your PATH happened to name rather than the one
+this package pins.
+
+## Highlights
+
+- **`stacktrace detect` defaults `--escalate` off.** A bare run is the two
+  stages that need no model and no credential, plus the osv.dev advisory
+  lookup, which sends package coordinates only. `--escalate` turns the third
+  stage on and `--budget` still caps it. The default had been on since
+  2026-09-03 while `run_detector`, `stacktrace monitor` and `remote sync detect`
+  all defaulted it off and the published quickstart told new users to pass
+  `--no-escalate`; one surface out of four, contradicted by its own
+  documentation, was a divergence rather than a default. ADR-0029 records the
+  decision and is explicit that it is a consent decision taken ahead of the
+  verdict-yield evidence ADR-0004 asked for, which is still unmeasured.
+
+  A run that declines to escalate is not a clean run. Sessions that qualified
+  are counted in the reasoning accounting as `reasoning_not_requested`; the
+  session ids are in `--format json`, not the text output, which aggregates
+  them under the reason.
+
+- **A verdict you already paid for is readable on the default path.** Both
+  `detect` and `remote sync detect` built their verdict cache only when
+  escalation was on, so with the new default every stored verdict would have
+  gone unread and the same sessions would have been billed twice on the next
+  `--escalate` run. `run_detector` has always held that the flag governs whether
+  new verdicts may be commissioned, not whether old ones may be read; the two
+  call sites disagreed with it. An exhaustiveness test now covers every cache
+  construction site rather than the two that were found by hand.
+
+- **`correlate` runs the OpenACA this package pins.** Acquisition invoked the
+  bare name `openaca`, a PATH lookup — and `uv tool install stacktrace-cli`,
+  which is what `install.sh` runs, links only the `stacktrace` entry point, so
+  the pinned OpenACA sat one directory away, reachable but unnamed. A machine
+  with a stale global copy silently scanned with the wrong version; a machine
+  with none got a bare `FileNotFoundError`. `stacktrace --version` could not
+  reveal it, because it reports the metadata inside the environment while the
+  subprocess ran something else. The console script is now located through
+  `importlib.metadata`, authenticated against the digest its own install
+  recorded, and fails closed with a legible error where ownership cannot be
+  established. Verified against four real install topologies. The ADR-0007 seam
+  is unchanged.
+
+- **One default, stated once.** The escalation default had also drifted into
+  `docs/specs/detector.md`, `docs/specs/detection-upload.md`, test descriptions,
+  wrapped help text, and `docs/plans/008-monitor.md`, which still instructed the
+  cache gate this release removes. A test now reads the active specs, plans and
+  help text and fails on a stale wording, in any of the three names the repo
+  uses for the stage.
+
+- **The console names the log column `Agent Session Trace`,** dropping the
+  third word from `Agent Session Log Trace` — session, log and trace were three
+  words for one thing. The one-item legend above the columns (`MCP = a link to
+  an outside service`) is gone: an MCP row already carries its category tag and
+  names the server it reached.
+
+- **`detect` stops printing the per-reason "Could not settle" breakdown.** It
+  listed internal reason ids — `mcp_transport_unavailable` dominates on a normal
+  machine — at a reader who cannot act on them one call at a time. The unsettled
+  count stays in the summary line, `--format json` still carries every `Unknown`
+  whole with its spans and detail, and the reasoning stage still names its own
+  outcomes.
+
+## Install
+
+`uv tool install stacktrace-cli==0.2.3` or `pip install stacktrace-cli==0.2.3`.
+
+## Compatibility
+
+**One behaviour change, and the patch version does not signal it: `stacktrace
+detect` no longer escalates by default.** If you relied on a bare `detect`
+reaching stage 3, pass `--escalate` to restore it. Nothing breaks — the
+`--no-escalate` you may already be passing still means what it meant — but a
+default run now produces no reasoning-stage findings, and sessions that would
+have been analysed appear as `reasoning_not_requested` instead. `monitor` and
+`remote sync detect` are unaffected; they already defaulted off.
+
+If you had accumulated verdicts from earlier `--escalate` runs, they are served
+again on the default path rather than ignored, so a `detect` after upgrading may
+report reasoning findings without spending anything.
+
+Text output changes in two places: the `Could not settle:` block is gone, and
+the reasoning accounting's not-requested row names a flag rather than a reason
+id. `--format json` is unchanged — no field added, removed or renamed — and the
+upload payload is untouched, so anything parsing either sees what 0.2.2 served.
+
+On the console, the log column is renamed and the legend line is removed. No
+rule, finding, severity or payload field moves.
+
+If `install.sh` put stacktrace on your machine and you had separately installed
+or upgraded OpenACA to work around a scan failure, that workaround is no longer
+needed; the pinned 0.6.0 is what runs now.
+
+Still pre-alpha, with no back-compat hedging: interfaces can change between
+releases without a deprecation window.

{stacktrace_cli-0.2.1 → stacktrace_cli-0.2.3}/docs/specs/detection-upload.md

@@ -291,7 +291,7 @@ Detecting before registering keeps a failed run from creating an asset.
 |---|---|---|
 | `--agent-kind`, `--bom`, `--budget`, `--sample-budget`, `--cache/--no-cache`, `--project-map`, `--root` | as `stacktrace detect` | |
 | `--since` | `7d` | |
-| `--escalate/--no-escalate` | **`--no-escalate`** | Inverse of `stacktrace detect`. Stage 3 spends the developer's provider quota and crosses a boundary; unattended is the wrong place for that to be implicit |
+| `--escalate/--no-escalate` | **`--no-escalate`** | Stage 3 spends the developer's provider quota and crosses a boundary; unattended is the wrong place for that to be implicit |
 | `--dry-run` | off | NDJSON via the same builder the real path uses, so the preview **is** the payload. ADR-0006 constraint 4 requires it |
 | `--quiet`, `--allow-offline-cache` | off | as `sync endpoint` |
 

{stacktrace_cli-0.2.1 → stacktrace_cli-0.2.3}/docs/specs/detector.md

@@ -63,11 +63,11 @@ only stage that sends anything *session-derived* off the machine. Package
 coordinates travel either way; prompts, arguments and results travel only when
 escalation runs, and then to the session's own provider and no other.
 
-**`reasoning` is on by default and capped** (ADR-0004, amended). It shipped
-opt-in and consequently never ran, so its rules could not be tuned against any
-verdict at all; the default is inverted to gather that evidence. The `--budget`
-cap, the verdict cache and `--no-escalate` are what bound the cost of that
-decision.
+**`reasoning` is opt-in and capped** (ADR-0029). A stage that spends the
+developer's quota and crosses that content boundary is asked for rather than
+assumed, so it runs only under `--escalate`. Three things bound its cost when it
+is asked for: the `--budget` cap, the verdict cache — so an unchanged session is
+never paid for twice — and the flag itself.
 
 **The ordering is the unit economics.** Microseconds, then milliseconds, then —
 only for the residue neither could resolve — seconds of inference. The per-session

{stacktrace_cli-0.2.1 → stacktrace_cli-0.2.3}/docs/specs/monitor.md

@@ -141,8 +141,11 @@ An unplaced stage is honest in two specific ways, and both are load-bearing:
   property over the whole built-in vocabulary, not just the names a fixture
   uses.
 - **Coverage is `None`, not `0/0`.** Correlation computes coverage, so an
-  unplaced stage does not have it. `0/0` would read as *nothing placed* rather
-  than *not counted yet*; the header says `placing…` until it knows.
+  unplaced stage does not have it, and the snapshot says so rather than
+  claiming a figure. The page no longer renders one either way (ADR-0028): the
+  header counts sessions and the actions it shows, and the fraction — whose gap
+  was the count of rows the page withholds — is gone, along with the `placing…`
+  placeholder that stood in for it.
 
 Batches are then judged **newest first**, because someone watching a machine
 cares about what just happened and should not scroll for it. The last stage
@@ -185,10 +188,18 @@ name".** Routine built-ins — Bash, Read, Edit — are the constant background
 every session: 5,795 of one three-day window's 7,065 calls. They collapse **per
 project** into one counted row for the agent, which is what makes `Claude Code ·
 working — files, commands & searches · ×1,719` a line a person reads instead of
-1,719 lines they do not. Skills, MCP servers, sub-agents, commands and anything
-unresolved are rare and consequential, so each **call** keeps its own row, keyed
-by span and never coalesced: two runs of one skill are two things that happened.
-A three-day window is ~66 rows.
+1,719 lines they do not. Skills, MCP servers, sub-agents and commands
+are rare and consequential, so each **call** keeps its own row, keyed by span
+and never coalesced: two runs of one skill are two things that happened. A
+three-day window is ~66 rows.
+
+**A call correlation could not place gets no row at all** (ADR-0028). It names
+no component — `classify_call` returns no name for one by design — so the row
+could only say that something happened and nothing here claims it, which is not
+a thing a reader can act on, and the rule that would have made it actionable
+was withdrawn by ADR-0015. The rows are dropped at the page boundary and
+nowhere else: `_activity` still emits them, and `stacktrace correlate` still
+reports them with each of the four causes named.
 
 **The summary's "Most used" column names the top three, and says what it left
 out.** A truncated list beside a total reads as a breakdown, and then the
@@ -207,8 +218,13 @@ exactly the terms the component name is: an ambiguous match names no alias,
 because printing the first candidate's configured name over the second's is the
 narrowing correlation refuses to do.
 
-A refusal rides the row it belongs to (`⚠ 90 refusals`) rather than taking one
-of its own, because `Bash ×3 denied` beside `Bash ×38` was half the noise.
+A refusal is counted in the row's `×N` and says nothing more (ADR-0028). It
+took neither a row of its own — `Bash ×3 denied` beside `Bash ×38` was half the
+noise — nor a badge and a colour, which is the page asserting the opposite of
+`outcome.py`'s rule about the same call: a denied call reached nothing, so it is
+evidence of nothing. On the machine that prompted this, 16 declined `Bash` calls
+out of 4,467 turned the busiest row on the page red, and all 16 were the Bash
+gate refusing a compound command.
 
 **Every panel is additive.** A stage re-sends every session and every finding
 the stages before it carried, so a render that replaced the columns threw away
@@ -399,7 +415,7 @@ only on click, so the ceiling is visible before it is hit.
 | No sessions on this machine | An empty page that **says so**. A blank column reads as a broken renderer |
 | A reader failed before correlation (`collection_failures`) | Rendered as a banner. A run that never got to look must not read as a clean one |
 | A session with no agent kind | Counted and named as unplaceable, never rendered under an invented kind |
-| A session with no composition | Rendered with every call unresolved and coverage low — not hidden |
+| A session with no composition | Its calls are read, and the page shows what it can place them to. Since ADR-0028 there is no banner and no coverage figure: the built-in preview rows still appear, and the absence itself is reported by `stacktrace correlate` rather than by the console |
 | The port is taken | Refuse with the port named, rather than silently choosing another and printing a URL the user did not expect |
 
 ## Files

{stacktrace_cli-0.2.1 → stacktrace_cli-0.2.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stacktrace-cli"
-version = "0.2.1"
+version = "0.2.3"
 description = "CLI for Stacktrace — Detection and Response platform for AI Agents."
 readme = "README.md"
 requires-python = ">=3.11"

{stacktrace_cli-0.2.1 → stacktrace_cli-0.2.3}/src/stacktrace_cli/__init__.py

@@ -1,3 +1,3 @@
 """The `stacktrace` command-line interface — detection and response for AI agents."""
 
-__version__ = "0.2.1"
+__version__ = "0.2.3"