stacktrace-cli 0.2.3__tar.gz → 0.3.0__tar.gz

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stacktrace-cli
-Version: 0.2.3
+Version: 0.3.0
 Summary: CLI for Stacktrace — Detection and Response platform for AI Agents.
 Project-URL: Homepage, https://stacktrace.ai
 Author-email: "Stacktrace AI, Inc" <founders@stacktrace.ai>
@@ -128,13 +128,13 @@ because it is installed.
 Two of `detect`'s three stages run entirely locally and need no model or
 credential, and they are the two a bare `detect` runs. The third sends flagged
 sessions to the agent's *own* CLI — the provider that produced the transcript,
-never a different one — and runs only when you pass `--escalate`, capped by
+never a different one — and runs only when you pass `--reasoning`, capped by
 `--budget`.
 
 `sessions` omits prompts, tool arguments and results unless you pass
 `--include-content`. `monitor` binds to loopback only, refuses a non-loopback
-address rather than warning about it, and escalates nothing unless `--escalate`
-is given.
+address rather than warning about it, and analyses nothing with a model unless
+`--reasoning` is given.
 
 ## Status
 

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.0}/README.md

@@ -103,13 +103,13 @@ because it is installed.
 Two of `detect`'s three stages run entirely locally and need no model or
 credential, and they are the two a bare `detect` runs. The third sends flagged
 sessions to the agent's *own* CLI — the provider that produced the transcript,
-never a different one — and runs only when you pass `--escalate`, capped by
+never a different one — and runs only when you pass `--reasoning`, capped by
 `--budget`.
 
 `sessions` omits prompts, tool arguments and results unless you pass
 `--include-content`. `monitor` binds to loopback only, refuses a non-loopback
-address rather than warning about it, and escalates nothing unless `--escalate`
-is given.
+address rather than warning about it, and analyses nothing with a model unless
+`--reasoning` is given.
 
 ## Status
 

stacktrace_cli-0.3.0/docs/releases/v0.3.0.md

@@ -0,0 +1,53 @@
+# 0.3.0 — the third stage is asked for by name
+
+`--escalate` is now `--reasoning`. The old name described the pipeline's own
+mechanic — stage two promoting a session to stage three — rather than what you
+get for it, which is a reasoning model reading the session. The flag now says
+that, on `stacktrace detect`, `stacktrace monitor` and `remote sync detect`
+alike.
+
+**This release renames a flag and two JSON fields with no aliases.** Everything
+you need to change is in the table below; nothing else about the pipeline moved,
+and the defaults are exactly what 0.2.3 shipped.
+
+## What to change
+
+| 0.2.3 | 0.3.0 |
+| --- | --- |
+| `detect --escalate` | `detect --reasoning` |
+| `monitor --escalate` | `monitor --reasoning` |
+| `remote sync detect --escalate` | `remote sync detect --reasoning` |
+| `--no-escalate` | *(nothing — omit `--reasoning`)* |
+| `summary.escalated` | `summary.reasoning_requested` |
+| `unknowns[].escalated_on` | `unknowns[].reasoning_reasons` |
+| `POST /api/escalate` | `POST /api/reasoning` |
+
+**If you typed `--no-escalate`, ignore what the CLI suggests.** Click offers
+`--no-cache` as the nearest match, which is the wrong flag and an expensive one
+to take: it disables the verdict cache, so a run re-buys answers you have
+already paid for. There is no replacement for `--no-escalate`. Stage three has
+been opt-in since 0.2.3, so leaving `--reasoning` off is the whole of it.
+
+## Highlights
+
+- **`--reasoning` is a plain flag, not an on/off pair.** `--no-reasoning` does
+  not exist, because there is nothing to turn off: stage three is opt-in on all
+  three commands (ADR-0029). A pair would imply a default worth overriding.
+
+- **The vocabulary moved with the flag, so one word covers the whole path.**
+  The stage that answers was already called `reasoning`; the signal that reaches
+  it is now a `ReasoningRequest` rather than an `Escalation`. `--help`, the text
+  output and `--format json` agree. A run that declined now reads `re-run with
+  --reasoning to analyse them`, and the summary line reads `3 for reasoning, 2
+  analysed`.
+
+- **Your stored verdicts survive the upgrade.** The verdict cache is keyed on
+  what the prompt is a function of, not on the names this codebase uses
+  internally, so a session graded under 0.2.3 is still answered from cache under
+  0.3.0. The stage-three prompt is unchanged and still recorded as `v1`, which
+  is what keeps two machines' answers comparable across the rename.
+
+- **The monitor's page and route follow.** `POST /api/reasoning` replaces
+  `POST /api/escalate`, and the page's button reads against the same budget it
+  always did. A monitor and a CLI of the same version are required, as before —
+  the page is served by the process it is talking to.

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.0}/docs/specs/aidr.md

@@ -42,8 +42,8 @@ version in a named manifest.
 | A discovery tool | OpenACA's existing scan already inventories agent tooling |
 | A fleet service | Only detector findings may travel, agent-keyed and content-free; sessions never leave the machine (ADR-0006) |
 
-One exception, named rather than rounded away: escalating a session for semantic
-analysis sends it to the provider that session already came from. See
+One exception, named rather than rounded away: requesting reasoning on a session
+sends it to the provider that session already came from. See
 [Trust boundary](#trust-boundary).
 
 ## Core tenets
@@ -56,7 +56,7 @@ enforced rather than merely intended.
 |---|---|---|
 | **Trust** — sensitive data does not cross the trust boundary | Transcripts, correlation records and session models are read only on the machine that produced them and have no upload path. What may travel is a detector finding: a verdict, component coordinates, confidence and observed capabilities, keyed to the agent — never conversation, and never an evidence excerpt | ADR-0006, and the local-only markers carried in the session model |
 | **Quality** — precision first; recall from a second source | A false alarm spends a human hour, so precision is a product decision, not a tuning parameter. Recall is bought by **adding an independent kind of evidence**, never by loosening a threshold | The detector's principles; the match outcome carried through correlation |
-| **Cost** — scalable unit economics | Deterministic rules first, then scoring against the component graph. Neither uses a model. **Only what they cannot resolve reaches inference** | The three-stage detector; no local model; a bounded escalation budget |
+| **Cost** — scalable unit economics | Deterministic rules first, then scoring against the component graph. Neither uses a model. **Only what they cannot resolve reaches inference** | The three-stage detector; no local model; a bounded reasoning budget |
 | **Security** — read-only sensing | The JSONL and SQLite caches agents already write, opened read-only. No process hooks, no proxy, no injected agent, no listener in the sensing path | Collection design; ADR-0001 |
 
 Two of these deserve their consequences stated plainly, because they are the ones
@@ -151,7 +151,7 @@ Each is specified where its component is, alongside the sub-component it joins:
 | Contract | Inside | Joins | Specified in |
 |---|---|---|---|
 | **Collection interface** | OpenAIDR | The per-kind readers to OpenAIDR's collector | [One contract, per agent kind](https://github.com/open-agent-security/openaidr/blob/main/docs/specs/session-collection.md#one-contract-per-agent-kind) |
-| **Escalation signal** | Detector | `priors` to `reasoning` — the detector's second and third stages | [The escalation signal](detector.md#the-escalation-signal) |
+| **Reasoning request** | Detector | `priors` to `reasoning` — the detector's second and third stages | [The reasoning request](detector.md#the-reasoning-request) |
 | **Analyzer adapter** | Detector | `reasoning` to the per-kind command-line agent it invokes | [The analyzer adapter](detector.md#the-analyzer-adapter) |
 
 The per-kind rows are pluggable slots, not components: supporting another agent
@@ -223,7 +223,7 @@ go; session input, the Correlator and the Detector do identical work in both.
 | Serves | Production: agent-keyed findings to Stacktrace Cloud (ADR-0006) | Development and demonstration: the local trace console |
 | Trigger | One run over a window of sessions | Changed files, as agents work |
 | Emit | Run to quiescence, emit complete findings | Draw a span when parsed, enrich it in place |
-| Escalation | Looser cap, off-peak | Tight cap, background, never inline |
+| Reasoning request | Looser cap, off-peak | Tight cap, background, never inline |
 
 **Mode lives in the driver, never inside a component.** No component can ask which
 mode it is running in, and nothing in the session model, correlation record or
@@ -235,12 +235,12 @@ cold pass without the tail — which is what stops two modes becoming two pipeli
 | Collect, project to spans | sub-second per changed file | Every change, or once per scheduled run |
 | Correlate | fast **only** against a cached graph | Graph rebuilt on manifest change |
 | `deterministic`, `priors` | milliseconds per evaluation | On each new span, against the session's accumulated evidence — never one span in isolation |
-| `reasoning` | seconds | Background, flagged sessions only, within the escalation budget |
+| `reasoning` | seconds | Background, flagged sessions only, within the reasoning budget |
 
 **Rule: nothing waits for the slowest stage.** Interactively, a tool call appears
 when parsed and its outcome, identity and findings attach later as enrichments to
 a row that already exists. On a scheduled run the same rule means one slow
-escalation does not hold the whole run.
+reasoning request does not hold the whole run.
 
 Three consequences that would otherwise look arbitrary. None of them is a
 concession to the console — each holds in both modes:
@@ -259,7 +259,7 @@ concession to the console — each holds in both modes:
   to re-read. Incremental collection is what makes that affordable: full pass at
   cold start, then changed files only.
 
-**The escalation budget is the one genuine per-mode parameter**, and the driver
+**The reasoning budget is the one genuine per-mode parameter**, and the driver
 sets it. `reasoning` is the only stage that costs seconds, a network call and
 money, so how much of the flagged set may reach it is a consumer decision, not a
 property of the detector. Everything else about the two modes is scheduling.

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.0}/docs/specs/detection-upload.md

@@ -291,7 +291,7 @@ Detecting before registering keeps a failed run from creating an asset.
 |---|---|---|
 | `--agent-kind`, `--bom`, `--budget`, `--sample-budget`, `--cache/--no-cache`, `--project-map`, `--root` | as `stacktrace detect` | |
 | `--since` | `7d` | |
-| `--escalate/--no-escalate` | **`--no-escalate`** | Stage 3 spends the developer's provider quota and crosses a boundary; unattended is the wrong place for that to be implicit |
+| `--reasoning` | **off** | Stage 3 spends the developer's provider quota and crosses a boundary; unattended is the wrong place for that to be implicit |
 | `--dry-run` | off | NDJSON via the same builder the real path uses, so the preview **is** the payload. ADR-0006 constraint 4 requires it |
 | `--quiet`, `--allow-offline-cache` | off | as `sync endpoint` |
 

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.0}/docs/specs/detector.md

@@ -52,28 +52,28 @@ folds them together with OpenACA's three families into one envelope we assemble
 
 **`deterministic` and `priors` need no model, network or credential.** That is
 what lets AIDR be adopted and evaluated before anyone debates language models on
-developer machines — `--no-escalate` leaves exactly those two running, and they
+developer machines — a bare `detect` leaves exactly those two running, and they
 are the stages a first evaluation should be judged on.
 
 **That is a claim about the stages, not about the run.** Correlation happens
 before any of them and matches advisories over what was invoked, which is a
-network round trip to osv.dev (`docs/specs/correlation.md`). So `--no-escalate`
+network round trip to osv.dev (`docs/specs/correlation.md`). So omitting `--reasoning`
 is not an offline mode, and the CLI's help says so: what it turns off is the
 only stage that sends anything *session-derived* off the machine. Package
 coordinates travel either way; prompts, arguments and results travel only when
-escalation runs, and then to the session's own provider and no other.
+reasoning runs, and then to the session's own provider and no other.
 
 **`reasoning` is opt-in and capped** (ADR-0029). A stage that spends the
 developer's quota and crosses that content boundary is asked for rather than
-assumed, so it runs only under `--escalate`. Three things bound its cost when it
+assumed, so it runs only under `--reasoning`. Three things bound its cost when it
 is asked for: the `--budget` cap, the verdict cache — so an unchanged session is
 never paid for twice — and the flag itself.
 
 **The ordering is the unit economics.** Microseconds, then milliseconds, then —
 only for the residue neither could resolve — seconds of inference. The per-session
 cost of the ordinary case is effectively zero, so session volume does not scale
-the model bill. Escalation is capped per run for the same reason: an unbounded
-escalation path would make cost a function of how noisy a day was.
+the model bill. Reasoning is capped per run for the same reason: an unbounded
+reasoning path would make cost a function of how noisy a day was.
 
 **And the ordering is also the precision story.** Each stage emits only what it
 can defend at its own level of evidence. `deterministic` does not guess at intent;
@@ -205,8 +205,8 @@ development machine, running stages one and two.
 | `stacktrace-tool-shadowing` | 0 | Requires `outcome == "ambiguous"`. **The join produced 0 ambiguous resolutions in 27,280.** Structurally unfireable, not under-tuned |
 | `stacktrace-unpinned-invoked` | 0 findings, recorded on 47 sessions | Escalated only *in combination*, and its only possible partner was `tool-shadowing`. So the threshold of two could never be met and every firing was discarded. It is also a static property of the BOM, which is OpenACA's posture surface rather than a runtime signal |
 
-**The combination escalation route went with them.** It required
-`len(escalating) >= 2` over a set with exactly two members, one of which could
+**The combination route went with them.** It required
+`len(requesting) >= 2` over a set with exactly two members, one of which could
 not fire — arithmetic that cannot come out. `docs/adrs/0013` records the
 decision; the deferred table below records what each rule would need.
 
@@ -448,14 +448,14 @@ left half moved to the declared side, where the graph is authoritative. This is
 the rule that most needs the join to exist, and the reason it is worth the two
 halves.
 
-**Escalation has four routes, and none is a single supply-chain prior.** One
+**Reasoning request has four routes, and none is a single supply-chain prior.** One
 unpinned component is Tuesday; an unpinned component whose tool name is also
-shadowed is seconds of inference well spent — so two or more escalating priors is
-the first route. The second is a stage-1 injection marker, which escalates on its
+shadowed is seconds of inference well spent — so two or more requesting priors is
+the first route. The second is a stage-1 injection marker, which requests reasoning on its
 own: `stacktrace-injected-instruction-followed` exists precisely to ask whether
 the agent acted on that marker, and gating it behind unrelated supply-chain
-priors would make the rule unreachable in its defining case. A single escalating
-prior firing alone is recorded as a reason a later escalation may cite, and
+priors would make the rule unreachable in its defining case. A single requesting
+prior firing alone is recorded as a reason a later reasoning request may cite, and
 otherwise dropped.
 
 The third and fourth routes exist because the first two both select for
@@ -479,7 +479,7 @@ analysed, and a shipped rule would fire only by accident:
   that are already covered, which is the blind spot it exists for. Its budget
   bounds how many quiet sessions compete for a slot, not how many extra
   invocations a run may make -- selected samples join the one pending list the
-  run-level budget caps, ranked below every evidence-backed escalation.
+  run-level budget caps, ranked below every evidence-backed reasoning request.
 
 **The session is passed whole, and the bound is a tripwire rather than a
 window.** An earlier draft of this spec specified a window around the spans of
@@ -513,10 +513,10 @@ fired on presence would score near-zero precision against a corpus that is 100%
 injected.
 
 **Stage three emits; it never withdraws.** There is no suppression verdict — no
-"no finding" answer that cancels the escalation which produced it. A stage that
+"no finding" answer that cancels the reasoning request which produced it. A stage that
 reasons about a transcript must not be able to talk the pipeline out of a fact,
-and every escalation route is a stage-one fact, so there is nothing a verdict
-could honestly withdraw. What would bring suppression back is an escalating prior
+and every route into reasoning is a stage-one fact, so there is nothing a verdict
+could honestly withdraw. What would bring suppression back is a requesting prior
 that is a *reading* rather than a fact (ADR-0013).
 
 **`entrypoint` changes what drift means.** A programmatic entrypoint means no
@@ -532,7 +532,7 @@ reported to the analyzer as neither — never defaulted to interactive, which
 would present a machine-generated `user` turn as a person's authorisation and is
 the failure this clause exists to prevent.
 
-## The escalation signal
+## The reasoning request
 
 The contract between `priors` and `reasoning`, stated so either can be built
 without the other.
@@ -544,14 +544,14 @@ without the other.
 | Stage-1 findings on this session | Their spans are where a semantic question is worth asking. **Descriptors only** — see the payload rule below |
 | Spans of interest | So a verdict can cite them rather than describe them |
 | Coverage | So a verdict knows how much of the session `priors` could actually read |
-| Budget | What remains of this run's escalation allowance |
+| Budget | What remains of this run's reasoning allowance |
 
-**`priors` remains the only producer.** Stage 1 does not escalate: it emits, and
+**`priors` remains the only producer.** Stage 1 does not request reasoning: it emits, and
 `priors` composes the signal from whatever stage 1 already emitted on that
 session. One producer, one consumer, and a deterministic finding can still raise
-a session's priority without inventing a second escalation path.
+a session's priority without inventing a second route into reasoning.
 
-**There are two routes, and both are stage-one facts.** Each escalates because
+**There are two routes, and both are stage-one facts.** Each requests reasoning because
 a fact is established and its *meaning* is not. A third — a drift precursor, a
 denied call whose capability the agent then reached another way — went with
 `refusal-circumvention` in ADR-0015; `denial_kind` is still on the seam, so the
@@ -562,7 +562,7 @@ route is cheap to restore if drift proves under-reached without it.
 | `stacktrace-injection-marker` | Instruction-shaped content reached the session. Whether the agent *acted on it* is unanswerable deterministically |
 | `stacktrace-credential-egress` | A credential-shaped string reached an outbound call. Whether it is a credential or a fixture's placeholder is the single largest false-positive class `exclusions.md` names — an admission that this is the model's question |
 
-**Reliability findings never escalate.** `progress-stall` and `hung-call` are
+**Reliability findings never request reasoning.** `progress-stall` and `hung-call` are
 facts about whether the session got stuck, and no amount of inference makes a
 repeated call more or less repeated. They are also excluded from the *security*
 test the quiet-session sample applies, so a session whose only finding is a
@@ -570,7 +570,7 @@ stall stays sample-eligible — otherwise the sample would skip exactly the
 sessions where something went wrong in a way no security rule reads.
 
 **Attacker-derived content never enters a high-trust slot.** A decoded injection
-payload is named by class and span in the escalation signal — never quoted into
+payload is named by class and span in the reasoning request — never quoted into
 it. The prompt's *why this was escalated* position is read by the analyzer as
 pipeline testimony, and a quoted payload sitting there is the same attacker text
 promoted from data to instruction. It reaches evidence and logs; it does not reach
@@ -578,7 +578,7 @@ the prompt. Prefacing it with *this is not an instruction* does not help, and ad
 no signal the transcript does not already carry.
 
 A stage that cannot run is not a stage that found nothing: if `reasoning` is
-unavailable, the escalation is recorded as *unknown* with the priors that
+unavailable, the reasoning request is recorded as *unknown* with the priors that
 triggered it, so the reason for concern survives even when the analysis does not.
 
 ## The reasoning stage
@@ -651,7 +651,7 @@ cannot be attributed, which is worse for a stage whose findings must be
 checkable.
 
 There is no fourth invocation. A suppression question would have nothing to ask
-about: measured on 74 escalation-eligible sessions it was **never once
+about: measured on 74 reasoning-eligible sessions it was **never once
 reachable**, because every route is either a stage-one fact — out of
 suppression's reach by design — or the evidence-free `sampled` route, which
 carries no prior to withdraw.
@@ -909,7 +909,7 @@ expect, and is deliberately absent (ADR-0004).
 | Its work is already split | Compositional questions → `priors`, better because the graph is authoritative rather than inferred. Semantic questions → `reasoning`, better because the model is stronger |
 | The cost is not the weights | A multi-gigabyte artifact through a path built for a small pure-Python package; an inference runtime absent from typical machines; resource governance; quantized inference varying across hardware, so a confidence value would mean different things on different laptops |
 
-Deferred, not refused forever. If escalation volume ever justifies a cheap local
+Deferred, not refused forever. If reasoning volume ever justifies a cheap local
 filter, this is where it goes.
 
 ## Rules not in the catalogue
@@ -943,17 +943,17 @@ narrowing of scope rather than a judgement on any rule's quality.
 
 | Rule | Stage | Returns when |
 |---|---|---|
-| `stacktrace-guardrail-modification` | deterministic | **A reason to emit rather than escalate.** The 53 real config writes are worth a person's attention and the 84 authoring writes are not, and the split is already known — what is missing is a route that asks *did someone ask for this* instead of asserting it happened. See ADR-0013 |
+| `stacktrace-guardrail-modification` | deterministic | **A reason to emit rather than request reasoning.** The 53 real config writes are worth a person's attention and the 84 authoring writes are not, and the split is already known — what is missing is a route that asks *did someone ask for this* instead of asserting it happened. See ADR-0013 |
 | `stacktrace-destructive-action` | deterministic | Nothing: the escaped-workspace half is implementable today and produced 1 real finding in 30 days. It is withheld because the `history_discarded` half produced the other 12 and a rule is re-added whole or not at all. Re-add scoped to `recursive_delete_outside_workspace` alone |
 | `stacktrace-tool-shadowing` | priors | **An `ambiguous` resolution.** The join has produced none in 27,280. Either the join never emits one, in which case shadowing needs a different definition, or it does and the corpus has not exercised it — a question for `correlate/join.py` before this returns |
-| `stacktrace-unpinned-invoked` | priors | **A second escalating prior to combine with,** or a reason to escalate alone. Neither exists, and as a static BOM property it belongs to OpenACA's posture rules |
+| `stacktrace-unpinned-invoked` | priors | **A second requesting prior to combine with,** or a reason to request reasoning alone. Neither exists, and as a static BOM property it belongs to OpenACA's posture rules |
 | `stacktrace-unsanctioned-mcp-tool-use` | priors | A decision to widen the catalogue again (ADR-0015). Nothing technical blocks it: it fired 4 times on the measured corpus and its input — an `absent_from_composition` resolution keyed `mcp_server` — is unchanged |
 | `stacktrace-unattended-privileged-action` | deterministic | The same. It was the largest surviving security rule at 12 findings, and its inputs (`entrypoint`, `permission_mode`, observed capabilities) all remain on the seam |
 | `stacktrace-provider-refusal` | deterministic | The same; `provider_refusals` still arrives on the session seam and fired 3 times |
-| `stacktrace-refusal-circumvention` | deterministic | The same. Restoring it also restores the third escalation route, which is the reason to want it back before the other four |
+| `stacktrace-refusal-circumvention` | deterministic | The same. Restoring it also restores the third route into reasoning, which is the reason to want it back before the other four |
 | `stacktrace-capability-crossing` | priors | The same, plus the input it always lacked: resolutions carrying a component candidate that declares sensitive access (275 of 27,280 carried any candidate at all) |
 Suppression was withdrawn with them, and is not a rule: it returns only when an
-escalating prior is a *reading* rather than a fact, because only then is there
+requesting prior is a *reading* rather than a fact, because only then is there
 something a verdict could honestly withdraw (ADR-0013).
 
 One wiring note remains:
@@ -984,7 +984,7 @@ Three things a detection carries that the other families do not:
 |---|---|
 | **Session reference** | Identity, agent kind, start, turn count — and **no content**. It exists to identify a session, never to transport conversation. Drift here would breach the local-only boundary from inside the data model, which is why it is stated as a constraint rather than left to reviewers |
 | **Observed capabilities** | Drawn from the existing closed capability taxonomy (OpenACA ADR-0041), naming what the session was seen exercising. This puts behavioural evidence on the same axis as the static *declared* / *curated* / *inferred* descriptors. The taxonomy is **not widened** to accommodate it |
-| **Provenance of the verdict** | Which stage produced it, and for escalated findings which analyzer, model and prompt version. Without this, two verdicts from two machines are not comparable |
+| **Provenance of the verdict** | Which stage produced it, and for requested findings which analyzer, model and prompt version. Without this, two verdicts from two machines are not comparable |
 
 ## What this component owns
 
@@ -994,12 +994,12 @@ Three things a detection carries that the other families do not:
 | Combined report assembly | New — work ADR-0005 got for free by living upstream | Read OpenACA's three families, merge, sort and render four into one envelope in JSON, SARIF and text (ADR-0005) |
 | The `stacktrace-*` rule namespace and its validation | New, small | Fails loudly on an unknown identifier |
 | Payload redaction before upload | New | Ours, so OpenACA's upload contract stays family-agnostic (ADR-0006, ADR-0005) |
-| Escalation to an external process | New capability, new risk surface | Adapter per agent kind, read-only invocation, explicit unknown on absence — see the safety rules above |
+| Reasoning request to an external process | New capability, new risk surface | Adapter per agent kind, read-only invocation, explicit unknown on absence — see the safety rules above |
 
 **Nothing here is contributed upstream.** OpenACA gains no family, no output row
 type, no scan flag and no rule namespace (ADR-0005). The envelope shape is reused
 rather than redefined, so one report still carries behaviour and composition
-together. The genuinely new surface is escalation, which is why the constraints
+together. The genuinely new surface is reasoning, which is why the constraints
 on it are stated as rules rather than guidance.
 
 ## Where this stands
@@ -1015,7 +1015,7 @@ arm, because evaluation is out of scope for the first pass.
 | Security findings | **20** |
 | Reliability findings | 17 |
 | Largest single rule's share | 5 of the 20 |
-| Sessions escalated to `reasoning` | 3 |
+| Sessions sent to `reasoning` | 3 |
 | `capability-crossing` findings | **0** |
 | `uninventoried_component` unknowns | 6 |
 | Resolutions carrying any BOM candidate | 275 of 27,280 (**1%**) |
@@ -1035,8 +1035,8 @@ Four of those rows are the ones to read, and none of them is the headline:
 - **The 6 `uninventoried_component` unknowns were new noise of a different
   kind** — honest, and not free. They were what `unsanctioned-mcp-tool-use`
   produced instead of a finding it could not place, and both went in ADR-0015.
-- **The 3 escalations no longer trace to a single test fixture.** Every
-  escalation on the pre-triage run came from one session reading another
+- **The 3 reasoning requests no longer trace to a single test fixture.** Every
+  reasoning request on the pre-triage run came from one session reading another
   security tool's own detector; requiring that injection characters were
   *placed* rather than merely present removed that class.
 

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.0}/docs/specs/monitor.md

@@ -18,8 +18,8 @@ Supersedes the console's separation from the engine (ADR-0008 → ADR-0026).
    per refresh, no parsing our own stdout.
 3. Leaving the page open all day is free: no model, no provider quota, and
    osv.dev is asked once per component rather than once per tick. The single
-   exception is a person clicking escalate, which § *Escalation* gates.
-4. The one action the page offers — escalating a session to stage 3 — cannot be
+   exception is a person clicking the reasoning button, which § *Reasoning* gates.
+4. The one action the page offers — sending a session to stage 3 — cannot be
    taken by anything but a person who asked for it.
 
 ## Non-goals
@@ -37,7 +37,7 @@ Supersedes the console's separation from the engine (ADR-0008 → ADR-0026).
 
 ```
 stacktrace monitor [--port N] [--host 127.0.0.1] [--interval 2]
-                   [--escalate] [--budget 10] [--no-open]
+                   [--reasoning] [--budget 10] [--no-open]
                    [--agent-kind K]... [--since 7d] [--bom P]... [--root P]
                    [--project-map OLD=NEW]...
 ```
@@ -50,8 +50,8 @@ is monitor's.
 | `--port` | ephemeral | A fixed port is for bookmarking; the default avoids a collision with whatever else is on 8000 |
 | `--host` | `127.0.0.1` | Loopback. A non-loopback value is **refused**, not warned about: this page renders working directories and matched values, and *remote access* is a non-goal above. The flag exists so that `--host 0.0.0.0` fails with a reason instead of appearing to work |
 | `--interval` | `2` (seconds) | The floor between ticks, not a guarantee. A tick that takes longer than the interval does not queue another |
-| `--escalate` | off | Whether the escalate endpoint **exists**. Off, so the page has no spending action unless asked for (ADR-0023's reasoning, one surface over). **This flag alone is the whole opt-in** |
-| `--budget` | `10` | Escalations this monitor process may spend, total — not per tick, not per session. `detect`'s own default, and nobody is expected to pass it: it is a ceiling for the ordinary case, not a decision the user makes each run. Lower it for a shared or long-lived session |
+| `--reasoning` | off | Whether the reasoning endpoint **exists**. Off, so the page has no spending action unless asked for (ADR-0023's reasoning, one surface over). **This flag alone is the whole opt-in** |
+| `--budget` | `10` | Reasoning requests this monitor process may spend, total — not per tick, not per session. `detect`'s own default, and nobody is expected to pass it: it is a ceiling for the ordinary case, not a decision the user makes each run. Lower it for a shared or long-lived session |
 | `--no-open` | off | Print the URL instead of opening a browser |
 
 Exit codes: `1` on a usage error or a port that cannot be bound. SIGINT is how
@@ -75,7 +75,7 @@ caller rather than its third copy.
 # src/stacktrace_cli/analysis.py — the composition root for the read pipeline
 def analyse(
     *, agent_kinds, since, bom_paths, project_map, root,
-    escalate=False, budget=..., sample_budget=..., cache=None,
+    reasoning=False, budget=..., sample_budget=..., cache=None,
     advisories=None,
 ) -> Analysis        # .run: DetectorRun, .view: CorrelatedView, plus the window
 ```
@@ -231,7 +231,7 @@ the stages before it carried, so a render that replaced the columns threw away
 the reader's place in them several times a second. Activity dedupes on `span`,
 findings on `(rule_id, session_id, cited spans)` — the detector is
 deterministic, so those three identify a finding across stages. Only the
-summaries, which are counts, are recomputed. The escalate button therefore
+summaries, which are counts, are recomputed. The reasoning button therefore
 lives in its own element inside each card, repainted as the budget moves
 without rebuilding the card around it.
 
@@ -293,7 +293,7 @@ a client needs to remember.
                   "tool_name": "get_issue", "status": "succeeded"}]
   }],
   "alerts": [ /* an entry of `render_json`'s `detections[]`, verbatim */ ],
-  "escalate": {"enabled": false, "remaining": 0, "running": []},
+  "reasoning": {"enabled": false, "remaining": 0, "running": []},
   "banners": ["claude-code: transcript directory unreadable"]
 }
 ```
@@ -314,7 +314,7 @@ unplaceable session, a tick that raised. A page with an empty column and no
 banner is indistinguishable from a working page with nothing to show, which is
 the one confusion this document refuses.
 
-`escalate.running` carries the session ids currently out for analysis, so a
+`reasoning.running` carries the session ids currently out for analysis, so a
 second click on the same session is refused by the page rather than by the
 budget — a stage-3 run takes tens of seconds and a spinner is not a lock.
 
@@ -329,12 +329,12 @@ not carry. It is also why `--host` warns.
 |---|---|
 | `GET /` and `/{app.js,styles.css}` | Static, from package data. `Cache-Control: no-store` |
 | `GET /api/state?since=N` | Long-poll. Returns immediately when `revision > N`; otherwise blocks until the next tick or a timeout, then returns the current snapshot |
-| `POST /api/escalate` | Only registered when `--escalate` was passed. § *Escalation* |
+| `POST /api/reasoning` | Only registered when `--reasoning` was passed. § *Reasoning* |
 
 The long-poll returns on timeout rather than hanging forever, so a laptop that
 slept does not leave a socket the server is still holding.
 
-## Escalation
+## Reasoning
 
 ### Why the button exists at all
 
@@ -348,13 +348,13 @@ and 2 can see that a marker arrived and that a component was reached; only stage
 Which puts the reader in the position the button removes. They are watching a
 session where something looks wrong, the page can tell them a marker was
 injected, and the next question — *did the agent follow it?* — is answerable only
-by leaving the page, finding the session id, and running `detect --escalate` in a
+by leaving the page, finding the session id, and running `detect --reasoning` in a
 terminal. The finding they want is one click and forty seconds away, and the
 interface makes them assemble a command instead.
 
 **So the button is there because the question arises while looking at the page,
 and nowhere else.** That is also the whole of its justification: it is not a
-convenience for running the detector, and monitor never escalates on its own.
+convenience for running the detector, and monitor never requests reasoning on its own.
 
 ### Why it is not merely a button
 
@@ -368,10 +368,10 @@ Four gates, all required:
 
 | Gate | Stops |
 |---|---|
-| The endpoint is registered only under `--escalate` | Spending by a monitor nobody asked to spend |
+| The endpoint is registered only under `--reasoning` | Spending by a monitor nobody asked to spend |
 | `Origin`/`Referer` must be absent or loopback | A remote page: the browser sets `Origin` on cross-origin POSTs and a page cannot forge it. Absent is allowed because a local non-browser client could run the CLI anyway |
 | A token minted at startup, carried in the opened URL, echoed in a request header | A local *browser* page that guessed the port |
-| `--budget` (default 10), decremented per escalation, disabling at zero | An unbounded bill from a held-down button. At 24–61 s and $0.013–$0.038 per session, the default caps a monitor's whole lifetime at well under a dollar — which is why it can have a default rather than being asked for |
+| `--budget` (default 10), decremented per reasoning request, disabling at zero | An unbounded bill from a held-down button. At 24–61 s and $0.013–$0.038 per session, the default caps a monitor's whole lifetime at well under a dollar — which is why it can have a default rather than being asked for |
 
 ### The prompt
 
@@ -390,7 +390,7 @@ rather than left to the render layer, because what it says *is* the consent:
 > - Answers the three questions the other stages cannot: whether an injected
 >   instruction was acted on, whether the agent drifted from the request, and
 >   whether a completion claims work it did not do.
-> - **7 of 10** escalations left for this monitor session.
+> - **7 of 10** reasoning run(s) left for this monitor session.
 >
 > *Already analysed once? A session that has not changed since is answered from
 > the local verdict cache and costs nothing (ADR-0011).*
@@ -404,7 +404,7 @@ turns into repeat clicks. It **says what the reader gets**, so the trade is
 legible rather than a leap of faith. And it **shows the remaining budget**, so
 running out is not a surprise at click seven.
 
-A refused escalation says which gate refused it — a silent no-op reads as a
+A refused reasoning request says which gate refused it — a silent no-op reads as a
 broken page. A refusal for budget says so in the button's own label rather than
 only on click, so the ceiling is visible before it is hit.
 
@@ -426,7 +426,7 @@ src/stacktrace_cli/
   monitor/
     state.py        Snapshot, revision, the waiter set the long-poll blocks on
     watch.py        The tick: mtime gate, one analyse() call, snapshot publication
-    server.py       Handler, routes, the four escalation gates
+    server.py       Handler, routes, the four reasoning gates
     site/           index.html, app.js, styles.css — package data
                     app.js owns the feed's grouping, pacing and ordering
   cli.py            EDITED — detect calls analyse(); monitor registered
@@ -451,13 +451,13 @@ they test without a socket. `server.py` is tested against a real
 ## Robustness bar
 
 Aims to get right: the page never shows a finding the detector did not produce;
-no tick spends provider quota without a person having passed `--escalate` and
+no tick spends provider quota without a person having passed `--reasoning` and
 clicked through the prompt; the server never binds anything but loopback; an
 empty or failed collection is visibly empty or failed rather than blank; and
 `detect` and `sync detect` behave exactly as they did before the extraction.
 
 Above the bar however small: a page that can invent, alter or suppress a
-detection; an escalation reachable without all four gates; a bind to a
+detection; a reasoning request reachable without all four gates; a bind to a
 non-loopback address; and any behaviour change in the two commands this work
 refactors — the extraction is proven by their existing tests passing
 *unedited*, so a diff that touches them is the finding.
@@ -468,8 +468,8 @@ text, not the design.
 ## References
 
 - ADR-0026 — the console becomes a product surface (supersedes ADR-0008)
-- ADR-0004 — provider affinity for escalation
+- ADR-0004 — provider affinity for reasoning
 - ADR-0006 — the trust boundary, and why a path may appear locally
 - ADR-0011 — the verdict cache, read here and never written
-- ADR-0023 — `sync detect` does not escalate; the same reasoning gates `--escalate`
+- ADR-0023 — `sync detect` does not escalate; the same reasoning gates `--reasoning`
 - ADR-0024 — one source per fact, applied to `alerts`

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stacktrace-cli"
-version = "0.2.3"
+version = "0.3.0"
 description = "CLI for Stacktrace — Detection and Response platform for AI Agents."
 readme = "README.md"
 requires-python = ">=3.11"

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.0}/src/stacktrace_cli/__init__.py

@@ -1,3 +1,3 @@
 """The `stacktrace` command-line interface — detection and response for AI agents."""
 
-__version__ = "0.2.3"
+__version__ = "0.3.0"