stacktrace-cli 0.6.0__py3-none-any.whl → 0.6.1__py3-none-any.whl

stacktrace_cli/__init__.py

@@ -2,7 +2,7 @@
 
 import logging as _logging
 
-__version__ = "0.6.0"
+__version__ = "0.6.1"
 
 # Only the daemon attaches a handler (ADR-0048). Without this one, a WARNING
 # logged in any other process would reach Python's last-resort handler and

stacktrace_cli/cli.py

@@ -539,6 +539,11 @@ def monitor(
     Loopback only, and free to leave open: a pass is skipped when nothing has
     changed, advisory lookups are asked once per component, and the two stages
     that need no model are the only ones that run.
+
+    The Inventory and Vulnerabilities tabs list every component your agents can
+    load. To check them for known vulnerabilities, the package names of
+    installed components -- not only the ones a session used -- are sent to
+    osv.dev. Skills and plugins with no package are never sent.
     """
     analyzer = resolve_analyzer(analyzer, reasoning)
     try:

stacktrace_cli/correlate/acquire.py

@@ -316,10 +316,32 @@ class Built:
     document: dict[str, Any]
 
 
+#: What an advisory answer is about: one component at one version. The
+#: `openaca:identity` this codebase assigns does not encode a version, so it is
+#: paired with the version the component declares. Keyed by identity alone, one
+#: scan kept one version per identity and handed its advisories to every
+#: version of that component in the run.
+AdvisoryKey = tuple[str, "str | None"]
+
+
+def advisory_key(component: dict[str, Any]) -> AdvisoryKey | None:
+    """A raw BOM component's `(identity, version)`, or None with no identity.
+
+    Read off the document, where `Component` reads the same two fields through
+    OpenACA's projection; `test_advisory_keys_read_the_same_off_both` holds the
+    two equal, since a key that differed would match nothing and read clean.
+    """
+    identity = _identity_of(component)
+    if identity is None:
+        return None
+    version = component.get("version")
+    return identity, version if isinstance(version, str) else None
+
+
 def advisories_for(
-    documents: Sequence[dict[str, Any]], identities: AbstractSet[str]
-) -> dict[str, tuple[Advisory, ...]] | None:
-    """Advisories for these identities alone, keyed by `openaca:identity`.
+    documents: Sequence[dict[str, Any]], keys: AbstractSet[AdvisoryKey]
+) -> dict[AdvisoryKey, tuple[Advisory, ...]] | None:
+    """Advisories for these components alone, keyed by `(identity, version)`.
 
     **Asked after correlation, not during acquisition.** Advisory matching costs
     a network round trip to osv.dev per package coordinate, and acquisition does
@@ -332,61 +354,62 @@ def advisories_for(
     there: one scan, over the union of what ran. Same measurement, 0.66s to
     0.14s, and osv.dev learns only about components this machine actually used.
 
-    Keyed by identity rather than `bom-ref` because a ref is local to one
-    document while an identity is the coordinate OSV matched — which is what lets
-    one scan answer for every composition in the run.
+    Keyed by `(identity, version)` rather than `bom-ref` because a ref is local
+    to one document while the pair is what OSV matched — which is what lets one
+    scan answer for every composition in the run, and each version for itself.
 
     Returns None when the scan could not run. None is not an empty result: a
     composition that was never checked must not read as one with nothing found.
     """
-    if not identities:
+    if not keys:
         # Nothing ran that could carry an advisory. That is a checked result with
         # nothing in it, not a failure to look, so it is `{}` rather than None.
         return {}
-    merged = _merge_for_scan(documents, identities)
+    merged, key_by_ref = _merge_for_scan(documents, keys)
     if not merged["components"]:
         return {}
     with tempfile.TemporaryDirectory() as scratch:
         path = Path(scratch) / "invoked.cdx.json"
         path.write_text(json.dumps(merged), encoding="utf-8")
-        return _scan(path, _identity_by_ref(merged))
+        return _scan(path, key_by_ref)
 
 
 def _merge_for_scan(
-    documents: Sequence[dict[str, Any]], identities: AbstractSet[str]
-) -> dict[str, Any]:
-    """One document holding each invoked component once, and nothing else.
-
-    Deduplicated on identity: the same component appears in every composition
-    built, and scanning it once per appearance is what this function exists to
-    avoid. `dependencies` is dropped rather than filtered — it describes
+    documents: Sequence[dict[str, Any]], keys: AbstractSet[AdvisoryKey]
+) -> tuple[dict[str, Any], dict[str, AdvisoryKey]]:
+    """One document holding each wanted component once, and which key each ref is.
+
+    Deduplicated on `(identity, version)`: the same component appears in every
+    composition built, and scanning it once per appearance is what this
+    function exists to avoid -- while two versions of one identity are two
+    components, each scanned for itself. `dependencies` is dropped rather than filtered — it describes
     installation structure that advisory matching does not read, and a pruned
     graph would be a second, worse description of one already recorded in the
     compositions themselves.
 
-    **Every kept component's `bom-ref` is rewritten to its identity.** The
-    CycloneDX spec scopes `bom-ref` uniqueness to a single document, never
-    across documents, so two source BOMs are free to reuse the same local ref
-    for two different components. Carrying an original ref forward into the
-    merged document could then collide, and `_identity_by_ref` would collapse
-    the collision onto whichever identity it saw last — misattributing that
-    ref's advisories to the wrong component. Identity is already this dict's
-    own key, so it is already unique across every document being merged.
+    **Every kept component's `bom-ref` is rewritten, and the new ref maps back
+    to its key.** The CycloneDX spec scopes `bom-ref` uniqueness to a single
+    document, never across documents, so two source BOMs are free to reuse the
+    same local ref for two different components. Carrying an original ref
+    forward into the merged document could then collide and misattribute that
+    ref's advisories to the wrong component. A ref minted here per kept key is
+    unique across every document being merged by construction.
     """
     base = documents[0] if documents else {}
-    kept: dict[str, dict[str, Any]] = {}
+    kept: dict[AdvisoryKey, dict[str, Any]] = {}
     for document in documents:
         for component in document.get("components") or []:
-            identity = _identity_of(component)
-            if identity is not None and identity in identities and identity not in kept:
-                kept[identity] = {**component, "bom-ref": identity}
-    return {
+            key = advisory_key(component)
+            if key is not None and key in keys and key not in kept:
+                kept[key] = {**component, "bom-ref": f"scan-{len(kept)}"}
+    merged = {
         "bomFormat": base.get("bomFormat", "CycloneDX"),
         "specVersion": base.get("specVersion", "1.6"),
         "version": base.get("version", 1),
         "metadata": base.get("metadata", {}),
         "components": list(kept.values()),
     }
+    return merged, {component["bom-ref"]: key for key, component in kept.items()}
 
 
 def _identity_of(component: dict[str, Any]) -> str | None:
@@ -397,40 +420,10 @@ def _identity_of(component: dict[str, Any]) -> str | None:
     return None
 
 
-def identity_versions(
-    documents: Sequence[dict[str, Any]], identities: AbstractSet[str]
-) -> dict[str, str | None]:
-    """Each wanted identity's own declared version, the first time it is found.
-
-    The identity this codebase assigns does not encode a version — that is
-    what lets one scan answer for a component across every composition it
-    appears in — so a cache keyed on identity alone cannot tell an upgrade
-    from no change at all. Pairing identity with this lets a long-lived
-    lookup cache do that.
-    """
-    versions: dict[str, str | None] = {}
-    for document in documents:
-        for component in document.get("components") or []:
-            identity = _identity_of(component)
-            if identity is None or identity not in identities or identity in versions:
-                continue
-            version = component.get("version")
-            versions[identity] = version if isinstance(version, str) else None
-    return versions
-
-
-def _identity_by_ref(document: dict[str, Any]) -> dict[str, str]:
-    return {
-        str(component["bom-ref"]): identity
-        for component in document.get("components") or []
-        if component.get("bom-ref") and (identity := _identity_of(component))
-    }
-
-
 def _scan(
-    bom_path: Path, identity_by_ref: dict[str, str]
-) -> dict[str, tuple[Advisory, ...]] | None:
-    """Run `openaca scan bom` and re-key its findings from refs onto identities.
+    bom_path: Path, key_by_ref: dict[str, AdvisoryKey]
+) -> dict[AdvisoryKey, tuple[Advisory, ...]] | None:
+    """Run `openaca scan bom` and re-key its findings from refs onto keys.
 
     `scan bom` is used rather than `scan endpoint` because it is a pure function
     of a document we already hold, so nothing can drift between the composition
@@ -483,7 +476,7 @@ def _scan(
     if not isinstance(findings, list):
         return None
 
-    matched: dict[str, list[Advisory]] = {}
+    matched: dict[AdvisoryKey, list[Advisory]] = {}
     for finding in findings:
         if not isinstance(finding, dict):
             return None
@@ -505,13 +498,13 @@ def _scan(
             return None
         if not all(_text_or_absent(value) for value in (fixed_in, source, severity, title)):
             return None
-        identity = identity_by_ref.get(ref)
-        if identity is None:
+        key = key_by_ref.get(ref)
+        if key is None:
             # Not malformed: we sent the components, and a ref we do not hold is
             # a finding about something outside this scan rather than a response
             # we cannot read.
             continue
-        matched.setdefault(identity, []).append(
+        matched.setdefault(key, []).append(
             Advisory(
                 id=identifier,
                 severity=severity or "UNKNOWN",
@@ -520,7 +513,7 @@ def _scan(
                 source=source,
             )
         )
-    return {identity: tuple(items) for identity, items in matched.items()}
+    return {key: tuple(items) for key, items in matched.items()}
 
 
 def _text_or_absent(value: object) -> bool:

stacktrace_cli/correlate/composition.py

@@ -152,10 +152,10 @@ def composition_from_bom(
     generated_at: datetime,
     generated_at_is_observed: bool,
     #: Keyed by **bom-ref**, matching `Composition.advisories`. Note that
-    #: `acquire.advisories_for` returns an *identity*-keyed map — one scan can
-    #: answer for every composition that way — so a caller re-keys before
-    #: arriving here, as `_attach_advisories` does. Passing the identity-keyed
-    #: map straight through would silently match nothing.
+    #: `acquire.advisories_for` returns an `(identity, version)`-keyed map — one
+    #: scan can answer for every composition that way — so a caller re-keys
+    #: before arriving here, as `_attach_advisories` does. Passing that map
+    #: straight through would silently match nothing.
     advisories: dict[str, tuple[Advisory, ...]] | None = None,
 ) -> Composition:
     """Project a CycloneDX Agent BOM into a composition, or reject it."""

stacktrace_cli/correlate/orchestrate.py

@@ -41,10 +41,10 @@ from pathlib import Path
 from typing import Any
 
 from stacktrace_cli.correlate.acquire import (
+    AdvisoryKey,
     Built,
     advisories_for,
     build_bom,
-    identity_versions,
     load_bom,
 )
 from stacktrace_cli.correlate.composition import Advisory, Composition
@@ -141,8 +141,8 @@ def _key(project: Path | None) -> str | None:
 BuildAll = Callable[[Sequence[tuple[str, Path | None]]], dict[tuple[str, str | None], Built]]
 
 
-def _invoked_identities(correlated: object) -> set[str]:
-    """Every component identity a session actually reached.
+def _invoked_keys(correlated: object) -> set[AdvisoryKey]:
+    """Every component a session actually reached, as `(identity, version)`.
 
     Every candidate of every resolved call, ambiguous ones included: the call
     happened, and which of two same-named components answered it is undecided
@@ -154,7 +154,7 @@ def _invoked_identities(correlated: object) -> set[str]:
     would still be sent to osv.dev: an unnecessary disclosure and scan cost
     for a component nothing actually ran.
     """
-    identities: set[str] = set()
+    keys: set[AdvisoryKey] = set()
     for session in correlated.sessions:  # type: ignore[attr-defined]
         calls = {call.span: call for turn in session.session.turns for call in turn.tool_calls}
         for span, resolution in session.resolutions.items():
@@ -163,22 +163,22 @@ def _invoked_identities(correlated: object) -> set[str]:
                 continue
             for candidate in resolution.candidates:
                 if candidate.identity:
-                    identities.add(candidate.identity)
-    return identities
+                    keys.add((candidate.identity, candidate.version))
+    return keys
 
 
-#: `advisories_for`'s shape: the documents to search and the identities that
+#: `advisories_for`'s shape: the documents to search and the components that
 #: were actually invoked, answering `None` for "not checked at all", which must
 #: stay distinguishable from "checked and found nothing".
 AdvisoryLookup = Callable[
-    ["Sequence[dict[str, Any]]", "AbstractSet[str]"],
-    "dict[str, tuple[Advisory, ...]] | None",
+    ["Sequence[dict[str, Any]]", "AbstractSet[AdvisoryKey]"],
+    "dict[AdvisoryKey, tuple[Advisory, ...]] | None",
 ]
 AttachAdvisories = Callable[[CorrelatedView, "Sequence[Built]"], CorrelatedView]
 
 
 class CachingAdvisoryLookup:
-    """`advisories_for`, asked once per identity for the life of the process.
+    """`advisories_for`, asked once per `(identity, version)` for the life of the process.
 
     `None` from the underlying lookup means *not checked at all*, which must
     stay distinguishable from *checked and found nothing* — an unchecked
@@ -194,19 +194,16 @@ class CachingAdvisoryLookup:
 
     def __init__(self, lookup: Callable[..., Any] = advisories_for) -> None:
         self._lookup = lookup
-        self._known: dict[tuple[str, str | None], tuple[Any, ...]] = {}
-        self._asked: set[tuple[str, str | None]] = set()
+        self._known: dict[AdvisoryKey, tuple[Any, ...]] = {}
+        self._asked: set[AdvisoryKey] = set()
 
     def __call__(
-        self, documents: Sequence[dict[str, Any]], identities: AbstractSet[str]
-    ) -> dict[str, tuple[Any, ...]] | None:
-        wanted = set(identities or ())
-        # Keyed by (identity, version) rather than identity alone: the identity
-        # this codebase assigns does not encode a version, so an upgrade or
-        # downgrade of an already-asked component must still be asked about.
-        versions = identity_versions(documents, wanted)
-        keys = {identity: (identity, versions.get(identity)) for identity in wanted}
-        unasked = {identity for identity in wanted if keys[identity] not in self._asked}
+        self, documents: Sequence[dict[str, Any]], keys: AbstractSet[AdvisoryKey]
+    ) -> dict[AdvisoryKey, tuple[Any, ...]] | None:
+        # The key carries the version, so an upgrade or downgrade of an
+        # already-asked component is a new key and is asked about.
+        wanted = set(keys or ())
+        unasked = wanted - self._asked
         if unasked:
             matched = self._lookup(documents, unasked)
             if matched is None:
@@ -214,15 +211,9 @@ class CachingAdvisoryLookup:
                 # answer for the ones we do know: a partial answer here would
                 # be indistinguishable from a complete one downstream.
                 return None
-            self._asked |= {keys[identity] for identity in unasked}
-            self._known.update(
-                {keys[identity]: advisories for identity, advisories in matched.items()}
-            )
-        return {
-            identity: self._known[keys[identity]]
-            for identity in wanted
-            if keys[identity] in self._known
-        }
+            self._asked |= unasked
+            self._known.update(matched)
+        return {key: self._known[key] for key in wanted if key in self._known}
 
 
 def advisory_attacher(lookup: AdvisoryLookup = advisories_for) -> AttachAdvisories:
@@ -255,9 +246,10 @@ def _attach_advisories(
     component on the machine to osv.dev, once per composition built; asked here
     it sends the union of what was invoked, once.
 
-    Re-keying is by identity, which is why one scan can answer for every
-    composition: a `bom-ref` is local to one document, while the identity is the
-    coordinate OSV matched on.
+    Re-keying is by `(identity, version)`, which is why one scan can answer for
+    every composition: a `bom-ref` is local to one document, while the pair is
+    what OSV matched on -- and a composition on another version of the same
+    component reads that version's answer, never this one's.
 
     **Enrichment is memoised by the original composition's identity.** Two
     sessions of the same kind (and project) share one `Composition` object —
@@ -268,10 +260,10 @@ def _attach_advisories(
     session independently would give two sessions that shared one composition
     two different enriched objects and break that dedup silently.
     """
-    identities = _invoked_identities(correlated)
-    matched = lookup([b.document for b in builts], identities)
+    keys = _invoked_keys(correlated)
+    matched = lookup([b.document for b in builts], keys)
     checked = matched is not None
-    by_identity = matched or {}
+    by_key = matched or {}
     memo: dict[int, Composition] = {}
 
     def enriched(composition: Composition | None) -> Composition | None:
@@ -283,9 +275,9 @@ def _attach_advisories(
         built = replace(
             composition,
             advisories={
-                component.bom_ref: by_identity[component.identity]
+                component.bom_ref: by_key[(component.identity, component.version)]
                 for component in composition.components
-                if component.identity and component.identity in by_identity
+                if component.identity and (component.identity, component.version) in by_key
             },
             advisories_checked=checked,
         )

stacktrace_cli/daemon/identity.py

@@ -15,7 +15,7 @@ import hashlib
 import json
 from typing import Any
 
-from stacktrace_cli.detector.rules import scope_of
+from stacktrace_cli.detector.rules import SUCCEEDS, scope_of
 
 #: How much of the content digest is kept. Wide enough that the revisions of one
 #: finding cannot collide within the `UNIQUE (event_id, content_hash)` they share
@@ -59,6 +59,22 @@ def detection_event_id(agent_kind: str, session_id: str, detection: dict[str, An
     return _event_id(agent_kind, session_id, rule_id, anchor)
 
 
+def retired_detection_event_id(
+    agent_kind: str, session_id: str, detection: dict[str, Any]
+) -> str | None:
+    """The id this finding had under the retired rule it took over from, or
+    `None` where its rule replaced none (ADR-0083).
+
+    Rebuilt rather than looked up: the retired rule's own scope decides the
+    anchor, and `agent-blocked` anchored on the first blocked call, which is the
+    same `evidence[0]` its successor still cites first.
+    """
+    predecessor = SUCCEEDS.get(str(detection.get("rule_id")))
+    if predecessor is None:
+        return None
+    return detection_event_id(agent_kind, session_id, {**detection, "rule_id": predecessor})
+
+
 def unknown_event_id(agent_kind: str, session_id: str, unknown: dict[str, Any]) -> str:
     """`hash(agent_kind, session_id, stage, reason, spans)`.
 

stacktrace_cli/daemon/presentation.py

@@ -4,11 +4,14 @@ from __future__ import annotations
 
 import json
 
-from stacktrace_cli.detector.blocked import REASON_CODES, reason_for
+from stacktrace_cli.detector.blocked import REASON_CODES, REASONS, reason_for
 
 # Notification prose is selected by rule ID only (ADR-0031). In particular,
 # finding titles, component names and evidence never supply notification text.
 _GUIDANCE = {
+    # One per block reason, in `blocked.py`'s own words: each reason is its own
+    # rule (ADR-0083), so the rule id alone now selects the specific sentence.
+    **{reason.rule_id: (reason.title, reason.remedy) for reason in REASONS},
     "stacktrace-credential-egress": (
         "Credential-shaped material appeared in an outbound tool call",
         (
@@ -20,6 +23,7 @@ _GUIDANCE = {
         "A success claim conflicts with verification evidence",
         "Inspect the cited verification results before relying on the completion claim.",
     ),
+    # Retired by ADR-0083. Findings stored before the split still name it.
     "stacktrace-agent-blocked": (
         "The agent encountered a block while working",
         "Inspect the recorded block reason before retrying the task.",
@@ -70,6 +74,7 @@ def render_finding(finding: dict[str, object]) -> str:
     items = (
         [item for item in evidence if isinstance(item, dict)] if isinstance(evidence, list) else []
     )
+    # A finding stored before ADR-0083 carries its reason in the evidence.
     if rule_id == "stacktrace-agent-blocked" and items:
         code = items[0].get("kind")
         if isinstance(code, str) and code in REASON_CODES:

stacktrace_cli/daemon/store.py

@@ -50,6 +50,7 @@ from .identity import (
     canonical_json,
     content_hash,
     detection_event_id,
+    retired_detection_event_id,
     unknown_event_id,
 )
 from .presentation import rule_guidance
@@ -64,6 +65,11 @@ from .presentation import rule_guidance
 FINDING = "finding"
 UNKNOWN = "unknown"
 
+#: One definition of what the webhook may POST. The delivery query evaluates
+#: it per row so the cursor can still advance past an expired revision; the
+#: configure-time preview counts the same predicate.
+_WEBHOOK_DELIVERABLE_SQL = "kind = ? AND timeline_json IS NOT NULL AND created_at >= ?"
+
 #: How long a finding is kept locally. `daemon-uploads.md` puts a `--retention`
 #: flag in front of this; until then it is the default and the only value.
 DEFAULT_RETENTION = timedelta(days=90)
@@ -96,6 +102,9 @@ class QueuedRecord:
     #: Whether this exact revision crossed the local notification gate. Later
     #: revisions keep the same event id but do not ring again.
     notifiable: bool = False
+    #: Whether the webhook may POST this revision now: it crossed the gate and
+    #: remains inside the webhook's retention window.
+    deliverable: bool = False
 
 
 @dataclass(frozen=True)
@@ -190,7 +199,14 @@ class FindingStore:
                         payload, home=self.home, working_directories=working_directories
                     )
                     event_id = detection_event_id(session.agent_kind, session.session_id, payload)
-                    already_rung = self._already_notified(event_id)
+                    # Or rang before an upgrade, under the rule this one took
+                    # over from (ADR-0083).
+                    retired_id = retired_detection_event_id(
+                        session.agent_kind, session.session_id, payload
+                    )
+                    already_rung = self._already_notified(event_id) or (
+                        retired_id is not None and self._already_notified(retired_id)
+                    )
                     timeline = (
                         None
                         if already_rung or not self._eligible(payload)
@@ -367,12 +383,13 @@ class FindingStore:
         later revision of the same event must not hide it before an offline
         subscriber has advanced past it.
         """
+        cutoff = (datetime.now(UTC) - self.retention).isoformat()
         with self._lock:
             rows = self._connection.execute(
                 "SELECT seq, kind, event_id, findings_json, created_at,"
-                " timeline_json IS NOT NULL FROM findings"
+                " timeline_json IS NOT NULL, " + _WEBHOOK_DELIVERABLE_SQL + " FROM findings"
                 " WHERE agent_kind = ? AND seq > ? ORDER BY seq LIMIT ?",
-                (partition, seq, limit),
+                (FINDING, cutoff, partition, seq, limit),
             ).fetchall()
         return tuple(
             QueuedRecord(
@@ -382,10 +399,45 @@ class FindingStore:
                 payload=json.loads(findings_json),
                 created_at=str(created_at),
                 notifiable=bool(notifiable),
+                deliverable=bool(deliverable),
             )
-            for row_seq, kind, event_id, findings_json, created_at, notifiable in rows
+            for (
+                row_seq,
+                kind,
+                event_id,
+                findings_json,
+                created_at,
+                notifiable,
+                deliverable,
+            ) in rows
         )
 
+    def pending_delivery_count(self, *, subscriber: str) -> int:
+        """Notifiable finding revisions this subscriber has not passed yet.
+
+        A delivery drain scans every row, but it POSTs only finding revisions
+        with a notification timeline. This count follows that distinction so
+        a configure-time preview does not include unknowns, ineligible rows or
+        later revisions of a finding that already rang.
+
+        Uses the same deliverability predicate as `delivery_after()`: Fleet
+        may retain an older physical row for its own cursor, but the webhook
+        still delivers only what is inside its retention window (ADR-0069).
+        """
+        cutoff = (datetime.now(UTC) - self.retention).isoformat()
+        total = 0
+        for partition in self.partitions():
+            cursor = self.cursor(partition, subscriber=subscriber)
+            with self._lock:
+                row = self._connection.execute(
+                    "SELECT COUNT(*) FROM findings"
+                    " WHERE agent_kind = ? AND seq > ?"
+                    " AND " + _WEBHOOK_DELIVERABLE_SQL,
+                    (partition, cursor, FINDING, cutoff),
+                ).fetchone()
+            total += int(row[0])
+        return total
+
     def has_queued_rows(self, *, subscriber: str = FLEET) -> bool:
         """Whether any partition has a row this subscriber has not passed yet.
 
@@ -890,11 +942,10 @@ class FindingStore:
 
     @staticmethod
     def _delivery_properties(session: SessionKey, finding: dict[str, Any]) -> dict[str, str]:
-        """The closed-set facts about one delivery: rule, severity, the sink, and
-        for `stacktrace-agent-blocked` the reason code, which lives in its anchor
-        evidence's `kind` (`detector/deterministic.py`). Nothing else on the
-        finding is read."""
-        properties = {
+        """The closed-set facts about one delivery: rule, severity and the sink.
+        Nothing else on the finding is read -- a block's reason is its rule
+        (ADR-0083), so there is no reason code to read out of its evidence."""
+        return {
             "rule": str(finding["rule_id"]),
             "severity": str(finding["severity"]),
             # The only sink with a delivery mark on `main`; ADR-0036's others
@@ -903,9 +954,3 @@ class FindingStore:
             "session_id": session.session_id,
             "agent_kind": session.agent_kind,
         }
-        if properties["rule"] == "stacktrace-agent-blocked":
-            evidence = finding.get("evidence") or [{}]
-            reason = evidence[0].get("kind")
-            if isinstance(reason, str):
-                properties["reason"] = reason
-        return properties