stacktrace-cli 0.2.3__tar.gz → 0.3.1__tar.gz

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.1}/.agents/skills/release-stacktrace/SKILL.md

@@ -102,9 +102,10 @@ shipped.
 
 ### Step 4. Bump the version, pin workspace dependencies, and gate
 
-`pyproject.toml`'s `version` and `src/stacktrace_cli/__init__.py`'s
-`__version__` are separate sources; the workflow fails the build if they
-disagree with the tag. Move them together:
+`pyproject.toml`'s `version`, `src/stacktrace_cli/__init__.py`'s
+`__version__` and the `--version` console block in `README.md` are three
+separate copies of the version string. The workflow fails the build if the
+first two disagree with the tag. Move them together:
 
 ```bash
 sed -i.bak 's/^version = ".*"/version = "<version>"/' pyproject.toml && rm pyproject.toml.bak
@@ -125,6 +126,16 @@ uv lock                                            # refresh uv.lock, now free t
 uv run stacktrace --version                        # sanity: prints <version>
 ```
 
+Paste that exact output over the console block under `## Installation` in
+`README.md`. `readme = "README.md"` makes that file the PyPI long description,
+and a description is baked into the artifact at upload — releases being
+immutable, a stale line there is only ever corrected by burning the next
+version number, which is what 0.3.1 was for. The block sat at `0.2.1` through
+three releases before anything checked it;
+`tests/test_readme_examples_are_real_output.py` now fails the build when it
+drifts, so this is a step you are reminded of rather than one you must
+remember.
+
 Now pin both to whatever `uv lock` just resolved — the one point in the
 procedure where the lockfile has just picked the newest available versions
 and a release is actually being cut:

stacktrace_cli-0.3.1/.claude/skills/release-stacktrace/SKILL.md

@@ -0,0 +1 @@
+../../../.agents/skills/release-stacktrace/SKILL.md

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stacktrace-cli
-Version: 0.2.3
+Version: 0.3.1
 Summary: CLI for Stacktrace — Detection and Response platform for AI Agents.
 Project-URL: Homepage, https://stacktrace.ai
 Author-email: "Stacktrace AI, Inc" <founders@stacktrace.ai>
@@ -49,7 +49,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.2.1 (openaca 0.6.0)
+stacktrace 0.3.1 (openaca 0.6.0)
 ```
 
 ## Quick start
@@ -128,13 +128,13 @@ because it is installed.
 Two of `detect`'s three stages run entirely locally and need no model or
 credential, and they are the two a bare `detect` runs. The third sends flagged
 sessions to the agent's *own* CLI — the provider that produced the transcript,
-never a different one — and runs only when you pass `--escalate`, capped by
+never a different one — and runs only when you pass `--reasoning`, capped by
 `--budget`.
 
 `sessions` omits prompts, tool arguments and results unless you pass
 `--include-content`. `monitor` binds to loopback only, refuses a non-loopback
-address rather than warning about it, and escalates nothing unless `--escalate`
-is given.
+address rather than warning about it, and analyses nothing with a model unless
+`--reasoning` is given.
 
 ## Status
 

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.1}/README.md

@@ -24,7 +24,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.2.1 (openaca 0.6.0)
+stacktrace 0.3.1 (openaca 0.6.0)
 ```
 
 ## Quick start
@@ -103,13 +103,13 @@ because it is installed.
 Two of `detect`'s three stages run entirely locally and need no model or
 credential, and they are the two a bare `detect` runs. The third sends flagged
 sessions to the agent's *own* CLI — the provider that produced the transcript,
-never a different one — and runs only when you pass `--escalate`, capped by
+never a different one — and runs only when you pass `--reasoning`, capped by
 `--budget`.
 
 `sessions` omits prompts, tool arguments and results unless you pass
 `--include-content`. `monitor` binds to loopback only, refuses a non-loopback
-address rather than warning about it, and escalates nothing unless `--escalate`
-is given.
+address rather than warning about it, and analyses nothing with a model unless
+`--reasoning` is given.
 
 ## Status
 

stacktrace_cli-0.3.1/docs/releases/v0.3.0.md

@@ -0,0 +1,53 @@
+# 0.3.0 — the third stage is asked for by name
+
+`--escalate` is now `--reasoning`. The old name described the pipeline's own
+mechanic — stage two promoting a session to stage three — rather than what you
+get for it, which is a reasoning model reading the session. The flag now says
+that, on `stacktrace detect`, `stacktrace monitor` and `remote sync detect`
+alike.
+
+**This release renames a flag and two JSON fields with no aliases.** Everything
+you need to change is in the table below; nothing else about the pipeline moved,
+and the defaults are exactly what 0.2.3 shipped.
+
+## What to change
+
+| 0.2.3 | 0.3.0 |
+| --- | --- |
+| `detect --escalate` | `detect --reasoning` |
+| `monitor --escalate` | `monitor --reasoning` |
+| `remote sync detect --escalate` | `remote sync detect --reasoning` |
+| `--no-escalate` | *(nothing — omit `--reasoning`)* |
+| `summary.escalated` | `summary.reasoning_requested` |
+| `unknowns[].escalated_on` | `unknowns[].reasoning_reasons` |
+| `POST /api/escalate` | `POST /api/reasoning` |
+
+**If you typed `--no-escalate`, ignore what the CLI suggests.** Click offers
+`--no-cache` as the nearest match, which is the wrong flag and an expensive one
+to take: it disables the verdict cache, so a run re-buys answers you have
+already paid for. There is no replacement for `--no-escalate`. Stage three has
+been opt-in since 0.2.3, so leaving `--reasoning` off is the whole of it.
+
+## Highlights
+
+- **`--reasoning` is a plain flag, not an on/off pair.** `--no-reasoning` does
+  not exist, because there is nothing to turn off: stage three is opt-in on all
+  three commands (ADR-0029). A pair would imply a default worth overriding.
+
+- **The vocabulary moved with the flag, so one word covers the whole path.**
+  The stage that answers was already called `reasoning`; the signal that reaches
+  it is now a `ReasoningRequest` rather than an `Escalation`. `--help`, the text
+  output and `--format json` agree. A run that declined now reads `re-run with
+  --reasoning to analyse them`, and the summary line reads `3 for reasoning, 2
+  analysed`.
+
+- **Your stored verdicts survive the upgrade.** The verdict cache is keyed on
+  what the prompt is a function of, not on the names this codebase uses
+  internally, so a session graded under 0.2.3 is still answered from cache under
+  0.3.0. The stage-three prompt is unchanged and still recorded as `v1`, which
+  is what keeps two machines' answers comparable across the rename.
+
+- **The monitor's page and route follow.** `POST /api/reasoning` replaces
+  `POST /api/escalate`, and the page's button reads against the same budget it
+  always did. A monitor and a CLI of the same version are required, as before —
+  the page is served by the process it is talking to.

stacktrace_cli-0.3.1/docs/releases/v0.3.1.md

@@ -0,0 +1,38 @@
+# 0.3.1 — the README says what the CLI says
+
+A documentation fix, and the test that keeps it fixed. Nothing in the pipeline
+moved; `0.3.1` behaves exactly as `0.3.0` does.
+
+The `stacktrace --version` block in `README.md` read `stacktrace 0.2.1` while
+the wheel beside it was `0.3.0`. Because `readme = "README.md"` makes that file
+the PyPI long description, the project page for 0.2.2, 0.2.3 and 0.3.0 each
+opened with a console block contradicting the release it described.
+
+## Highlights
+
+- **The README's version example is now asserted against the CLI.** The block
+  is produced by invoking `--version` and must appear in `README.md` verbatim,
+  so the line cannot drift from the build again — it joins the sessions example,
+  which has been checked this way for some time. The flag is invoked rather than
+  its text rebuilt from `__version__`, which also puts the `openaca` half of the
+  line under the same check.
+
+- **The guard runs in the gate that publishes.** It sits in
+  `tests/test_readme_examples_are_real_output.py` rather than in
+  `test_release_readiness.py`, whose `release_gate` marker is deselected by
+  `addopts` — a check placed there would not be collected by the `pytest` step
+  the publish workflow runs.
+
+## Install
+
+`uv tool install stacktrace-cli==0.3.1` or `pip install stacktrace-cli==0.3.1`.
+
+## Compatibility
+
+No behaviour changes. The 0.3.0 rename of `--escalate` to `--reasoning` is the
+last one that needed anything of you; see `docs/releases/v0.3.0.md` if you are
+coming from 0.2.3.
+
+The 0.3.0 project page on PyPI still shows the stale `0.2.1` line. A PyPI
+description is baked into the artifact at upload and releases are immutable, so
+that page cannot be corrected in place — this release is the correction.

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.1}/docs/specs/aidr.md

@@ -42,8 +42,8 @@ version in a named manifest.
 | A discovery tool | OpenACA's existing scan already inventories agent tooling |
 | A fleet service | Only detector findings may travel, agent-keyed and content-free; sessions never leave the machine (ADR-0006) |
 
-One exception, named rather than rounded away: escalating a session for semantic
-analysis sends it to the provider that session already came from. See
+One exception, named rather than rounded away: requesting reasoning on a session
+sends it to the provider that session already came from. See
 [Trust boundary](#trust-boundary).
 
 ## Core tenets
@@ -56,7 +56,7 @@ enforced rather than merely intended.
 |---|---|---|
 | **Trust** — sensitive data does not cross the trust boundary | Transcripts, correlation records and session models are read only on the machine that produced them and have no upload path. What may travel is a detector finding: a verdict, component coordinates, confidence and observed capabilities, keyed to the agent — never conversation, and never an evidence excerpt | ADR-0006, and the local-only markers carried in the session model |
 | **Quality** — precision first; recall from a second source | A false alarm spends a human hour, so precision is a product decision, not a tuning parameter. Recall is bought by **adding an independent kind of evidence**, never by loosening a threshold | The detector's principles; the match outcome carried through correlation |
-| **Cost** — scalable unit economics | Deterministic rules first, then scoring against the component graph. Neither uses a model. **Only what they cannot resolve reaches inference** | The three-stage detector; no local model; a bounded escalation budget |
+| **Cost** — scalable unit economics | Deterministic rules first, then scoring against the component graph. Neither uses a model. **Only what they cannot resolve reaches inference** | The three-stage detector; no local model; a bounded reasoning budget |
 | **Security** — read-only sensing | The JSONL and SQLite caches agents already write, opened read-only. No process hooks, no proxy, no injected agent, no listener in the sensing path | Collection design; ADR-0001 |
 
 Two of these deserve their consequences stated plainly, because they are the ones
@@ -151,7 +151,7 @@ Each is specified where its component is, alongside the sub-component it joins:
 | Contract | Inside | Joins | Specified in |
 |---|---|---|---|
 | **Collection interface** | OpenAIDR | The per-kind readers to OpenAIDR's collector | [One contract, per agent kind](https://github.com/open-agent-security/openaidr/blob/main/docs/specs/session-collection.md#one-contract-per-agent-kind) |
-| **Escalation signal** | Detector | `priors` to `reasoning` — the detector's second and third stages | [The escalation signal](detector.md#the-escalation-signal) |
+| **Reasoning request** | Detector | `priors` to `reasoning` — the detector's second and third stages | [The reasoning request](detector.md#the-reasoning-request) |
 | **Analyzer adapter** | Detector | `reasoning` to the per-kind command-line agent it invokes | [The analyzer adapter](detector.md#the-analyzer-adapter) |
 
 The per-kind rows are pluggable slots, not components: supporting another agent
@@ -223,7 +223,7 @@ go; session input, the Correlator and the Detector do identical work in both.
 | Serves | Production: agent-keyed findings to Stacktrace Cloud (ADR-0006) | Development and demonstration: the local trace console |
 | Trigger | One run over a window of sessions | Changed files, as agents work |
 | Emit | Run to quiescence, emit complete findings | Draw a span when parsed, enrich it in place |
-| Escalation | Looser cap, off-peak | Tight cap, background, never inline |
+| Reasoning request | Looser cap, off-peak | Tight cap, background, never inline |
 
 **Mode lives in the driver, never inside a component.** No component can ask which
 mode it is running in, and nothing in the session model, correlation record or
@@ -235,12 +235,12 @@ cold pass without the tail — which is what stops two modes becoming two pipeli
 | Collect, project to spans | sub-second per changed file | Every change, or once per scheduled run |
 | Correlate | fast **only** against a cached graph | Graph rebuilt on manifest change |
 | `deterministic`, `priors` | milliseconds per evaluation | On each new span, against the session's accumulated evidence — never one span in isolation |
-| `reasoning` | seconds | Background, flagged sessions only, within the escalation budget |
+| `reasoning` | seconds | Background, flagged sessions only, within the reasoning budget |
 
 **Rule: nothing waits for the slowest stage.** Interactively, a tool call appears
 when parsed and its outcome, identity and findings attach later as enrichments to
 a row that already exists. On a scheduled run the same rule means one slow
-escalation does not hold the whole run.
+reasoning request does not hold the whole run.
 
 Three consequences that would otherwise look arbitrary. None of them is a
 concession to the console — each holds in both modes:
@@ -259,7 +259,7 @@ concession to the console — each holds in both modes:
   to re-read. Incremental collection is what makes that affordable: full pass at
   cold start, then changed files only.
 
-**The escalation budget is the one genuine per-mode parameter**, and the driver
+**The reasoning budget is the one genuine per-mode parameter**, and the driver
 sets it. `reasoning` is the only stage that costs seconds, a network call and
 money, so how much of the flagged set may reach it is a consumer decision, not a
 property of the detector. Everything else about the two modes is scheduling.

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.1}/docs/specs/detection-upload.md

@@ -291,7 +291,7 @@ Detecting before registering keeps a failed run from creating an asset.
 |---|---|---|
 | `--agent-kind`, `--bom`, `--budget`, `--sample-budget`, `--cache/--no-cache`, `--project-map`, `--root` | as `stacktrace detect` | |
 | `--since` | `7d` | |
-| `--escalate/--no-escalate` | **`--no-escalate`** | Stage 3 spends the developer's provider quota and crosses a boundary; unattended is the wrong place for that to be implicit |
+| `--reasoning` | **off** | Stage 3 spends the developer's provider quota and crosses a boundary; unattended is the wrong place for that to be implicit |
 | `--dry-run` | off | NDJSON via the same builder the real path uses, so the preview **is** the payload. ADR-0006 constraint 4 requires it |
 | `--quiet`, `--allow-offline-cache` | off | as `sync endpoint` |
 

{stacktrace_cli-0.2.3 → stacktrace_cli-0.3.1}/docs/specs/detector.md

@@ -52,28 +52,28 @@ folds them together with OpenACA's three families into one envelope we assemble
 
 **`deterministic` and `priors` need no model, network or credential.** That is
 what lets AIDR be adopted and evaluated before anyone debates language models on
-developer machines — `--no-escalate` leaves exactly those two running, and they
+developer machines — a bare `detect` leaves exactly those two running, and they
 are the stages a first evaluation should be judged on.
 
 **That is a claim about the stages, not about the run.** Correlation happens
 before any of them and matches advisories over what was invoked, which is a
-network round trip to osv.dev (`docs/specs/correlation.md`). So `--no-escalate`
+network round trip to osv.dev (`docs/specs/correlation.md`). So omitting `--reasoning`
 is not an offline mode, and the CLI's help says so: what it turns off is the
 only stage that sends anything *session-derived* off the machine. Package
 coordinates travel either way; prompts, arguments and results travel only when
-escalation runs, and then to the session's own provider and no other.
+reasoning runs, and then to the session's own provider and no other.
 
 **`reasoning` is opt-in and capped** (ADR-0029). A stage that spends the
 developer's quota and crosses that content boundary is asked for rather than
-assumed, so it runs only under `--escalate`. Three things bound its cost when it
+assumed, so it runs only under `--reasoning`. Three things bound its cost when it
 is asked for: the `--budget` cap, the verdict cache — so an unchanged session is
 never paid for twice — and the flag itself.
 
 **The ordering is the unit economics.** Microseconds, then milliseconds, then —
 only for the residue neither could resolve — seconds of inference. The per-session
 cost of the ordinary case is effectively zero, so session volume does not scale
-the model bill. Escalation is capped per run for the same reason: an unbounded
-escalation path would make cost a function of how noisy a day was.
+the model bill. Reasoning is capped per run for the same reason: an unbounded
+reasoning path would make cost a function of how noisy a day was.
 
 **And the ordering is also the precision story.** Each stage emits only what it
 can defend at its own level of evidence. `deterministic` does not guess at intent;
@@ -205,8 +205,8 @@ development machine, running stages one and two.
 | `stacktrace-tool-shadowing` | 0 | Requires `outcome == "ambiguous"`. **The join produced 0 ambiguous resolutions in 27,280.** Structurally unfireable, not under-tuned |
 | `stacktrace-unpinned-invoked` | 0 findings, recorded on 47 sessions | Escalated only *in combination*, and its only possible partner was `tool-shadowing`. So the threshold of two could never be met and every firing was discarded. It is also a static property of the BOM, which is OpenACA's posture surface rather than a runtime signal |
 
-**The combination escalation route went with them.** It required
-`len(escalating) >= 2` over a set with exactly two members, one of which could
+**The combination route went with them.** It required
+`len(requesting) >= 2` over a set with exactly two members, one of which could
 not fire — arithmetic that cannot come out. `docs/adrs/0013` records the
 decision; the deferred table below records what each rule would need.
 
@@ -448,14 +448,14 @@ left half moved to the declared side, where the graph is authoritative. This is
 the rule that most needs the join to exist, and the reason it is worth the two
 halves.
 
-**Escalation has four routes, and none is a single supply-chain prior.** One
+**Reasoning request has four routes, and none is a single supply-chain prior.** One
 unpinned component is Tuesday; an unpinned component whose tool name is also
-shadowed is seconds of inference well spent — so two or more escalating priors is
-the first route. The second is a stage-1 injection marker, which escalates on its
+shadowed is seconds of inference well spent — so two or more requesting priors is
+the first route. The second is a stage-1 injection marker, which requests reasoning on its
 own: `stacktrace-injected-instruction-followed` exists precisely to ask whether
 the agent acted on that marker, and gating it behind unrelated supply-chain
-priors would make the rule unreachable in its defining case. A single escalating
-prior firing alone is recorded as a reason a later escalation may cite, and
+priors would make the rule unreachable in its defining case. A single requesting
+prior firing alone is recorded as a reason a later reasoning request may cite, and
 otherwise dropped.
 
 The third and fourth routes exist because the first two both select for
@@ -479,7 +479,7 @@ analysed, and a shipped rule would fire only by accident:
   that are already covered, which is the blind spot it exists for. Its budget
   bounds how many quiet sessions compete for a slot, not how many extra
   invocations a run may make -- selected samples join the one pending list the
-  run-level budget caps, ranked below every evidence-backed escalation.
+  run-level budget caps, ranked below every evidence-backed reasoning request.
 
 **The session is passed whole, and the bound is a tripwire rather than a
 window.** An earlier draft of this spec specified a window around the spans of
@@ -513,10 +513,10 @@ fired on presence would score near-zero precision against a corpus that is 100%
 injected.
 
 **Stage three emits; it never withdraws.** There is no suppression verdict — no
-"no finding" answer that cancels the escalation which produced it. A stage that
+"no finding" answer that cancels the reasoning request which produced it. A stage that
 reasons about a transcript must not be able to talk the pipeline out of a fact,
-and every escalation route is a stage-one fact, so there is nothing a verdict
-could honestly withdraw. What would bring suppression back is an escalating prior
+and every route into reasoning is a stage-one fact, so there is nothing a verdict
+could honestly withdraw. What would bring suppression back is a requesting prior
 that is a *reading* rather than a fact (ADR-0013).
 
 **`entrypoint` changes what drift means.** A programmatic entrypoint means no
@@ -532,7 +532,7 @@ reported to the analyzer as neither — never defaulted to interactive, which
 would present a machine-generated `user` turn as a person's authorisation and is
 the failure this clause exists to prevent.
 
-## The escalation signal
+## The reasoning request
 
 The contract between `priors` and `reasoning`, stated so either can be built
 without the other.
@@ -544,14 +544,14 @@ without the other.
 | Stage-1 findings on this session | Their spans are where a semantic question is worth asking. **Descriptors only** — see the payload rule below |
 | Spans of interest | So a verdict can cite them rather than describe them |
 | Coverage | So a verdict knows how much of the session `priors` could actually read |
-| Budget | What remains of this run's escalation allowance |
+| Budget | What remains of this run's reasoning allowance |
 
-**`priors` remains the only producer.** Stage 1 does not escalate: it emits, and
+**`priors` remains the only producer.** Stage 1 does not request reasoning: it emits, and
 `priors` composes the signal from whatever stage 1 already emitted on that
 session. One producer, one consumer, and a deterministic finding can still raise
-a session's priority without inventing a second escalation path.
+a session's priority without inventing a second route into reasoning.
 
-**There are two routes, and both are stage-one facts.** Each escalates because
+**There are two routes, and both are stage-one facts.** Each requests reasoning because
 a fact is established and its *meaning* is not. A third — a drift precursor, a
 denied call whose capability the agent then reached another way — went with
 `refusal-circumvention` in ADR-0015; `denial_kind` is still on the seam, so the
@@ -562,7 +562,7 @@ route is cheap to restore if drift proves under-reached without it.
 | `stacktrace-injection-marker` | Instruction-shaped content reached the session. Whether the agent *acted on it* is unanswerable deterministically |
 | `stacktrace-credential-egress` | A credential-shaped string reached an outbound call. Whether it is a credential or a fixture's placeholder is the single largest false-positive class `exclusions.md` names — an admission that this is the model's question |
 
-**Reliability findings never escalate.** `progress-stall` and `hung-call` are
+**Reliability findings never request reasoning.** `progress-stall` and `hung-call` are
 facts about whether the session got stuck, and no amount of inference makes a
 repeated call more or less repeated. They are also excluded from the *security*
 test the quiet-session sample applies, so a session whose only finding is a
@@ -570,7 +570,7 @@ stall stays sample-eligible — otherwise the sample would skip exactly the
 sessions where something went wrong in a way no security rule reads.
 
 **Attacker-derived content never enters a high-trust slot.** A decoded injection
-payload is named by class and span in the escalation signal — never quoted into
+payload is named by class and span in the reasoning request — never quoted into
 it. The prompt's *why this was escalated* position is read by the analyzer as
 pipeline testimony, and a quoted payload sitting there is the same attacker text
 promoted from data to instruction. It reaches evidence and logs; it does not reach
@@ -578,7 +578,7 @@ the prompt. Prefacing it with *this is not an instruction* does not help, and ad
 no signal the transcript does not already carry.
 
 A stage that cannot run is not a stage that found nothing: if `reasoning` is
-unavailable, the escalation is recorded as *unknown* with the priors that
+unavailable, the reasoning request is recorded as *unknown* with the priors that
 triggered it, so the reason for concern survives even when the analysis does not.
 
 ## The reasoning stage
@@ -651,7 +651,7 @@ cannot be attributed, which is worse for a stage whose findings must be
 checkable.
 
 There is no fourth invocation. A suppression question would have nothing to ask
-about: measured on 74 escalation-eligible sessions it was **never once
+about: measured on 74 reasoning-eligible sessions it was **never once
 reachable**, because every route is either a stage-one fact — out of
 suppression's reach by design — or the evidence-free `sampled` route, which
 carries no prior to withdraw.
@@ -909,7 +909,7 @@ expect, and is deliberately absent (ADR-0004).
 | Its work is already split | Compositional questions → `priors`, better because the graph is authoritative rather than inferred. Semantic questions → `reasoning`, better because the model is stronger |
 | The cost is not the weights | A multi-gigabyte artifact through a path built for a small pure-Python package; an inference runtime absent from typical machines; resource governance; quantized inference varying across hardware, so a confidence value would mean different things on different laptops |
 
-Deferred, not refused forever. If escalation volume ever justifies a cheap local
+Deferred, not refused forever. If reasoning volume ever justifies a cheap local
 filter, this is where it goes.
 
 ## Rules not in the catalogue
@@ -943,17 +943,17 @@ narrowing of scope rather than a judgement on any rule's quality.
 
 | Rule | Stage | Returns when |
 |---|---|---|
-| `stacktrace-guardrail-modification` | deterministic | **A reason to emit rather than escalate.** The 53 real config writes are worth a person's attention and the 84 authoring writes are not, and the split is already known — what is missing is a route that asks *did someone ask for this* instead of asserting it happened. See ADR-0013 |
+| `stacktrace-guardrail-modification` | deterministic | **A reason to emit rather than request reasoning.** The 53 real config writes are worth a person's attention and the 84 authoring writes are not, and the split is already known — what is missing is a route that asks *did someone ask for this* instead of asserting it happened. See ADR-0013 |
 | `stacktrace-destructive-action` | deterministic | Nothing: the escaped-workspace half is implementable today and produced 1 real finding in 30 days. It is withheld because the `history_discarded` half produced the other 12 and a rule is re-added whole or not at all. Re-add scoped to `recursive_delete_outside_workspace` alone |
 | `stacktrace-tool-shadowing` | priors | **An `ambiguous` resolution.** The join has produced none in 27,280. Either the join never emits one, in which case shadowing needs a different definition, or it does and the corpus has not exercised it — a question for `correlate/join.py` before this returns |
-| `stacktrace-unpinned-invoked` | priors | **A second escalating prior to combine with,** or a reason to escalate alone. Neither exists, and as a static BOM property it belongs to OpenACA's posture rules |
+| `stacktrace-unpinned-invoked` | priors | **A second requesting prior to combine with,** or a reason to request reasoning alone. Neither exists, and as a static BOM property it belongs to OpenACA's posture rules |
 | `stacktrace-unsanctioned-mcp-tool-use` | priors | A decision to widen the catalogue again (ADR-0015). Nothing technical blocks it: it fired 4 times on the measured corpus and its input — an `absent_from_composition` resolution keyed `mcp_server` — is unchanged |
 | `stacktrace-unattended-privileged-action` | deterministic | The same. It was the largest surviving security rule at 12 findings, and its inputs (`entrypoint`, `permission_mode`, observed capabilities) all remain on the seam |
 | `stacktrace-provider-refusal` | deterministic | The same; `provider_refusals` still arrives on the session seam and fired 3 times |
-| `stacktrace-refusal-circumvention` | deterministic | The same. Restoring it also restores the third escalation route, which is the reason to want it back before the other four |
+| `stacktrace-refusal-circumvention` | deterministic | The same. Restoring it also restores the third route into reasoning, which is the reason to want it back before the other four |
 | `stacktrace-capability-crossing` | priors | The same, plus the input it always lacked: resolutions carrying a component candidate that declares sensitive access (275 of 27,280 carried any candidate at all) |
 Suppression was withdrawn with them, and is not a rule: it returns only when an
-escalating prior is a *reading* rather than a fact, because only then is there
+requesting prior is a *reading* rather than a fact, because only then is there
 something a verdict could honestly withdraw (ADR-0013).
 
 One wiring note remains:
@@ -984,7 +984,7 @@ Three things a detection carries that the other families do not:
 |---|---|
 | **Session reference** | Identity, agent kind, start, turn count — and **no content**. It exists to identify a session, never to transport conversation. Drift here would breach the local-only boundary from inside the data model, which is why it is stated as a constraint rather than left to reviewers |
 | **Observed capabilities** | Drawn from the existing closed capability taxonomy (OpenACA ADR-0041), naming what the session was seen exercising. This puts behavioural evidence on the same axis as the static *declared* / *curated* / *inferred* descriptors. The taxonomy is **not widened** to accommodate it |
-| **Provenance of the verdict** | Which stage produced it, and for escalated findings which analyzer, model and prompt version. Without this, two verdicts from two machines are not comparable |
+| **Provenance of the verdict** | Which stage produced it, and for requested findings which analyzer, model and prompt version. Without this, two verdicts from two machines are not comparable |
 
 ## What this component owns
 
@@ -994,12 +994,12 @@ Three things a detection carries that the other families do not:
 | Combined report assembly | New — work ADR-0005 got for free by living upstream | Read OpenACA's three families, merge, sort and render four into one envelope in JSON, SARIF and text (ADR-0005) |
 | The `stacktrace-*` rule namespace and its validation | New, small | Fails loudly on an unknown identifier |
 | Payload redaction before upload | New | Ours, so OpenACA's upload contract stays family-agnostic (ADR-0006, ADR-0005) |
-| Escalation to an external process | New capability, new risk surface | Adapter per agent kind, read-only invocation, explicit unknown on absence — see the safety rules above |
+| Reasoning request to an external process | New capability, new risk surface | Adapter per agent kind, read-only invocation, explicit unknown on absence — see the safety rules above |
 
 **Nothing here is contributed upstream.** OpenACA gains no family, no output row
 type, no scan flag and no rule namespace (ADR-0005). The envelope shape is reused
 rather than redefined, so one report still carries behaviour and composition
-together. The genuinely new surface is escalation, which is why the constraints
+together. The genuinely new surface is reasoning, which is why the constraints
 on it are stated as rules rather than guidance.
 
 ## Where this stands
@@ -1015,7 +1015,7 @@ arm, because evaluation is out of scope for the first pass.
 | Security findings | **20** |
 | Reliability findings | 17 |
 | Largest single rule's share | 5 of the 20 |
-| Sessions escalated to `reasoning` | 3 |
+| Sessions sent to `reasoning` | 3 |
 | `capability-crossing` findings | **0** |
 | `uninventoried_component` unknowns | 6 |
 | Resolutions carrying any BOM candidate | 275 of 27,280 (**1%**) |
@@ -1035,8 +1035,8 @@ Four of those rows are the ones to read, and none of them is the headline:
 - **The 6 `uninventoried_component` unknowns were new noise of a different
   kind** — honest, and not free. They were what `unsanctioned-mcp-tool-use`
   produced instead of a finding it could not place, and both went in ADR-0015.
-- **The 3 escalations no longer trace to a single test fixture.** Every
-  escalation on the pre-triage run came from one session reading another
+- **The 3 reasoning requests no longer trace to a single test fixture.** Every
+  reasoning request on the pre-triage run came from one session reading another
   security tool's own detector; requiring that injection characters were
   *placed* rather than merely present removed that class.