stacktrace-cli 0.6.1__py3-none-any.whl → 0.7.1__py3-none-any.whl

stacktrace_cli/__init__.py

@@ -2,7 +2,7 @@
 
 import logging as _logging
 
-__version__ = "0.6.1"
+__version__ = "0.7.1"
 
 # Only the daemon attaches a handler (ADR-0048). Without this one, a WARNING
 # logged in any other process would reach Python's last-resort handler and

stacktrace_cli/daemon/cli.py

@@ -210,14 +210,13 @@ def _reject_unobservable_kinds(config: DaemonConfig) -> None:
 
 
 @daemon.command()
-def status() -> None:
+@click.option("--verbose", is_flag=True, help="Include detailed daemon diagnostics.")
+def status(verbose: bool) -> None:
     """Report whether this endpoint is working, without reading a log.
 
-    Every row answers a question someone asks when a machine looks quiet: a
-    watermark hours old means the scanner has stopped; a queue that grows with
-    a reader attached means the reader is not draining; a database that only
-    grows means retention is not pruning; and a configuration without its source
-    makes fleet-wide drift undebuggable (`docs/specs/daemon-scanning.md`).
+    The default output is a quick health check. Pass ``--verbose`` for the
+    diagnostic details used to investigate a quiet or misconfigured machine
+    (`docs/specs/daemon-scanning.md`).
     """
     from stacktrace_cli.build import version_label
 
@@ -242,7 +241,8 @@ def status() -> None:
     if live is not None:
         click.echo(f"version: {live.build}")
         click.echo(f"installed: {version_label()}")
-        click.echo(f"started: {live.started_at}")
+        if verbose:
+            click.echo(f"started: {live.started_at}")
 
     try:
         # One `_store()` call apiece, all against the same file: if the first
@@ -251,9 +251,10 @@ def status() -> None:
         # them can print a partial line before that first failure.
         click.echo(f"watermark: {_watermark_line(paths)}")
         click.echo(f"queue depth: {_queue_line(paths)}")
-        click.echo(f"cursors: {_cursor_line(paths)}")
         click.echo(f"parked: {_parked_line(paths)}")
-        click.echo(f"database: {_database_line(paths)}")
+        if verbose:
+            click.echo(f"cursors: {_cursor_line(paths)}")
+            click.echo(f"database: {_database_line(paths)}")
     except (sqlite3.DatabaseError, ValueError) as exc:
         # A corrupt file or a schema newer than this build reads raises here
         # (`_check_version`'s own refusal) -- precisely the moment the daemon
@@ -263,6 +264,9 @@ def status() -> None:
         click.echo(f"database: unreadable — {exc}")
     click.echo(f"last error: {last_error(paths.log) or 'none reported'}")
 
+    if not verbose:
+        return
+
     try:
         config = _effective_config(live.config if live is not None else None)
     except ValueError as exc:

stacktrace_cli/daemon/webhook.py

@@ -483,8 +483,9 @@ def _slack_payload(payload: dict[str, object]) -> dict[str, object]:
     if isinstance(kinds, list) and kinds:
         joined = ", ".join(_mrkdwn(kind) for kind in kinds)
         fields.append({"type": "mrkdwn", "text": f"*Evidence*\n{joined}"})
+    # Severity only (ADR-0088). Confidence is nearly always `high`, so in a
+    # channel it is a field that says nothing; the JSON format still carries it.
     fields.append({"type": "mrkdwn", "text": f"*Severity*\n{_mrkdwn(severity)}"})
-    fields.append({"type": "mrkdwn", "text": f"*Confidence*\n{_mrkdwn(payload['confidence'])}"})
 
     blocks: list[dict[str, object]] = [
         {"type": "section", "text": {"type": "mrkdwn", "text": f"*{title}*"}},

stacktrace_cli/detector/deterministic.py

@@ -38,11 +38,13 @@ import os
 import re
 import shlex
 from collections.abc import Sequence
+from urllib.parse import urlsplit
 
 from stacktrace_cli.correlate.composition import Advisory, Component, Composition
 from stacktrace_cli.correlate.join import Resolution
 from stacktrace_cli.correlate.observed import (
     _MAX_SHELL_DEPTH,
+    _segment_capabilities,
     capabilities,
     command_segments,
     command_segments_with_ops,
@@ -90,6 +92,7 @@ def _credential_egress(call: ToolCallLike, ref: SessionRef) -> Detection | None:
     if not matches:
         return None
     kinds = sorted({m.kind for m in matches})
+    target = _outside_target(call)
     return Detection(
         rule_id="stacktrace-credential-egress",
         severity="high",
@@ -109,10 +112,13 @@ def _credential_egress(call: ToolCallLike, ref: SessionRef) -> Detection | None:
                 # arguments object, and a key is chosen by whoever wrote the
                 # call: an MCP server's schema, or a literal like
                 # `{"/private/customer/path": "sk-..."}` in a body the agent
-                # was handed. Offset is the descriptor ADR-0006 names, locates
-                # the match just as well for the responder who has the session,
-                # and cannot carry anything the other side wrote.
-                detail=f"at offset {match.offset} in the arguments of {tool_name_for(call)}",
+                # was handed. The offset is withheld too: a reader of an alert
+                # cannot use a character position, and the span already
+                # locates the call. Where it went is what they act on
+                # (ADR-0086).
+                detail=f"sent to {target}"
+                if target
+                else f"in the arguments of {tool_name_for(call)}",
             )
             for match in matches
         ),
@@ -131,6 +137,122 @@ def _command(call: ToolCallLike) -> str | None:
     return command if isinstance(command, str) and command else None
 
 
+#: Vendor CLIs that talk to one service, and the name a reader knows it by.
+#: A CLI that reaches whatever it is pointed at -- `curl`, `git`, `npm` -- is
+#: absent, because its name says nothing about who answered; the URL it was
+#: given does (`_shell_target`).
+_SERVICE_CLIS: dict[str, str] = {
+    "gh": "GitHub",
+    "glab": "GitLab",
+    "aws": "AWS",
+    "gcloud": "Google Cloud",
+    "az": "Azure",
+    "kubectl": "Kubernetes",
+    "vercel": "Vercel",
+    "netlify": "Netlify",
+    "railway": "Railway",
+    "flyctl": "Fly",
+    "heroku": "Heroku",
+    "wrangler": "Cloudflare",
+    "stripe": "Stripe",
+    "supabase": "Supabase",
+    "firebase": "Firebase",
+    "doctl": "DigitalOcean",
+}
+
+
+#: An MCP server or tool name that may be named: identifier characters only,
+#: so never a sentence (no spaces) and never a path (no slashes) (ADR-0086).
+_NAMEABLE = re.compile(r"[A-Za-z0-9][A-Za-z0-9_.:-]{0,63}")
+
+#: A host as `urlsplit` returns it: lowercase letters, digits, dots, hyphens.
+_HOSTNAME = re.compile(r"[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?")
+
+
+def _host(value: object) -> str | None:
+    """The host of an `http(s)://` URL, and nothing else of it.
+
+    Scheme, userinfo, port, path and query all stay behind: they are where
+    tokens and customer identifiers sit, and the host is what answered.
+    """
+    if not isinstance(value, str) or not value.lower().startswith(("http://", "https://")):
+        return None
+    try:
+        parts = urlsplit(value)
+        host = parts.hostname
+    except ValueError:
+        return None
+    if not host or not _HOSTNAME.fullmatch(host):
+        return None
+    # `hostname` is lowercased, which hides a case-sensitive credential shape
+    # (`AKIA…`) from `find_secrets`, so the host is scanned as it was written.
+    if find_secrets(parts.netloc.rpartition("@")[2]):
+        return None
+    return host
+
+
+def _shell_target(command: str) -> str | None:
+    """The one service or host a shell command reached, or None.
+
+    A vendor CLI names its service (`GitHub (gh)`). Any other segment that
+    reaches the network must name exactly one URL host. A command that reached
+    two places (`gh … && curl …`), or a network segment with no URL (`git
+    push origin`), names nothing: the record does not say which one answered,
+    and naming the wrong one sends the reader to the wrong service.
+
+    Reads `command_segments`, the one shell parser, and asks it only which
+    programs ran, whether each reached the network, and its URL arguments.
+    """
+    targets: set[str] = set()
+    for program, arguments in command_segments(command):
+        if program in _SERVICE_CLIS:
+            targets.add(f"{_SERVICE_CLIS[program]} ({program})")
+            continue
+        if not any(
+            name == "network_egress" for name, _ in _segment_capabilities(program, arguments)
+        ):
+            continue
+        hosts = {host for argument in arguments if (host := _host(argument))}
+        if len(hosts) != 1:
+            return None
+        targets |= hosts
+    return targets.pop() if len(targets) == 1 else None
+
+
+def _outside_target(call: ToolCallLike) -> str | None:
+    """Who answered this call, where the record names one (ADR-0086).
+
+    `linear MCP · search_issues` for an MCP call, the URL's host for WebFetch,
+    and `_shell_target` for a shell command. The server and tool names are the
+    session's and the server's own words, so they are named only when shaped
+    like identifiers, and nothing secret-shaped is named at all.
+
+    The one place a finding names the tool an MCP server chose, and only for
+    the citations ADR-0086 lists. Everywhere else `tool_name_for` holds.
+    """
+    # A denied call reached nothing, so nothing answered it, whatever its
+    # error text says.
+    if denied(call):
+        return None
+    target: str | None
+    if call.mcp_server:
+        if not _NAMEABLE.fullmatch(call.mcp_server):
+            return None
+        # `customer-support-mcp` already says what it is.
+        server = call.mcp_server
+        target = server if server.lower().endswith("mcp") else f"{server} MCP"
+        if _NAMEABLE.fullmatch(call.tool_name):
+            target += f" · {call.tool_name}"
+    elif call.tool_name == "WebFetch":
+        target = _host((call.arguments or {}).get("url"))
+    else:
+        command = _command(call)
+        target = _shell_target(command) if command else None
+    if target is None or find_secrets(target):
+        return None
+    return target
+
+
 def _block_body(call: ToolCallLike) -> str | None:
     """The body `_agent_blocked` classifies a block from.
 
@@ -298,9 +420,18 @@ def _blocked_remediation(
 
 def _block_span(session: SessionLike, turn: TurnLike) -> str:
     """A turn-level span: the same session and turn key a call span is built
-    from, without a call index, because there is no call. It cannot collide
-    with one -- a call span always carries the index."""
-    return f"{session.session_id}:{turn.key}"
+    from, with index 0.
+
+    The index is there because the span grammar requires one: the upload
+    contract and Fleet both refuse a span that does not end in `:<n>`, so a
+    block reported in a reply never reached Fleet. It cannot collide with a
+    call span, because this is only ever built for a turn with no calls.
+
+    Accepted: a reply-only block that rang under the retired
+    `stacktrace-agent-blocked` rule (before 0.6.0) is matched by that rule's
+    old anchor, which had no index, so it can ring once more on a machine
+    that upgrades from before 0.6.0 straight to this version."""
+    return f"{session.session_id}:{turn.key}:0"
 
 
 def block_spans_by_turn(session: SessionLike) -> dict[str, TurnLike]:
@@ -439,12 +570,16 @@ def _agent_blocked(session: SessionLike, ref: SessionRef) -> tuple[Detection, ..
                 if not denied(call):
                     worked_at.append((turn.position, index))
                 continue
+            # Who refused, where a service did. A spend limit or a safety
+            # check is the client refusing, and naming the host the call was
+            # aimed at would blame it instead.
+            target = _outside_target(call) if reason.attribution == "upstream" else None
             found.setdefault(reason.code, []).append(
                 Evidence(
                     span=call.span,
                     kind=reason.code,
                     detail=_blocked_detail(
-                        tool_name_for(call),
+                        target or tool_name_for(call),
                         reason.specific(_block_body(call)),
                     ),
                 )
@@ -1581,7 +1716,7 @@ def _credential_persisted(session: SessionLike, ref: SessionRef) -> tuple[Detect
                         Evidence(
                             span=call.span,
                             kind=match.kind,
-                            detail=f"{match.kind} at offset {match.offset}",
+                            detail=f"written to a file by {tool_name_for(call)}",
                         )
                         for match in matches
                     ),
@@ -1773,6 +1908,8 @@ def _tool_retry_storm(session: SessionLike, ref: SessionRef) -> tuple[Detection,
             last_key = key
 
             if counters.get(key, 0) >= _RETRY_THRESHOLD:
+                # What the agent kept calling, not the tool it called it with.
+                target = _outside_target(call) or tool_name_for(call)
                 det = Detection(
                     rule_id="stacktrace-tool-retry-storm",
                     severity="low",
@@ -1783,7 +1920,7 @@ def _tool_retry_storm(session: SessionLike, ref: SessionRef) -> tuple[Detection,
                         Evidence(
                             span=span,
                             kind="identical_retry",
-                            detail=f"{tool_name_for(call)} called with identical parameters",
+                            detail=f"{target} called with identical parameters",
                         )
                         for span in storm_spans
                     ),

stacktrace_cli/detector/finding.py

@@ -97,6 +97,9 @@ def tool_name_for(call: ToolCallLike) -> str:
     the ADR puts it — `Detection.components` where it was placed, a
     `Participant.name` where it was not.
 
+    ADR-0086 is the one exception: `deterministic._outside_target` names the
+    server and tool in the citations of the rules it lists, and nowhere else.
+
     Lives here rather than beside one rule because both stages need it, and a
     second copy of this argument is a second chance to get it wrong — which is
     the class `test_untrusted_content_never_travels.py` exists to close.

stacktrace_cli/monitor/server.py

@@ -43,6 +43,10 @@ _ASSETS: dict[str, str] = {
     "/app.js": "app.js",
     "/styles.css": "styles.css",
     "/inventory.js": "inventory.js",
+    # The same icons Fleet's web app ships, copied rather than shared.
+    "/favicon.ico": "favicon.ico",
+    "/icon.svg": "icon.svg",
+    "/apple-icon.png": "apple-icon.png",
     # Vendored rather than fetched, so they are served rather than linked. An
     # allow-list of exact names is why they have to be named here: a font
     # missing from it 404s and the page falls back silently, which is the
@@ -57,6 +61,9 @@ _CONTENT_TYPES: dict[str, str] = {
     "app.js": "text/javascript; charset=utf-8",
     "styles.css": "text/css; charset=utf-8",
     "inventory.js": "text/javascript; charset=utf-8",
+    "favicon.ico": "image/x-icon",
+    "icon.svg": "image/svg+xml",
+    "apple-icon.png": "image/png",
     "fonts/dm-sans-latin.woff2": "font/woff2",
     "fonts/dm-mono-400-latin.woff2": "font/woff2",
     "fonts/dm-mono-500-latin.woff2": "font/woff2",

stacktrace_cli/monitor/site/app.js

@@ -700,16 +700,22 @@ function eventsFrom(sessions) {
 
 /* Components *invoked*, by kind. The demo's strip counted what was installed;
  * this snapshot carries only what was reached, so the chip says "invoked"
- * rather than borrowing a word for a number it does not hold. */
+ * rather than borrowing a word for a number it does not hold.
+ *
+ * Every kind counted here is one `renderComposition` draws a chip for, so the
+ * chips add up to the total. A built-in sub-agent has no component type and
+ * the category `subagent`, which no chip named; anything else unnamed is
+ * "Other" rather than a number the total holds and no chip shows. */
 function compositionOf(sessions) {
   const byType = {};
   const seen = new Set();
   for (const session of sessions) {
     for (const row of session.activity || []) {
       if (unplaceable(row)) continue;
-      const type = row.component_type || row.category;
+      const raw = row.component_type || row.category;
+      const type = raw === "subagent" ? "agent" : COMPONENT_KINDS[raw] ? raw : "other";
       const key = type + "\n" + (row.component_identity || row.component_name || row.tool_name);
-      if (!type || seen.has(key)) continue;
+      if (!raw || seen.has(key)) continue;
       seen.add(key);
       byType[type] = (byType[type] || 0) + 1;
     }
@@ -779,7 +785,7 @@ let lastPolicies = [];
 let lastComplete = false;
 let lastSessionCount = 0;
 
-/* Whether the reader opened or closed the list with "What we check", or
+/* Whether the reader opened or closed the list with "Scanned Policies", or
  * `null` while they have not and the list follows the view: open while a
  * range loads or a pass checks, and when a finished pass found nothing;
  * folded only once a finished pass has findings, so the cards lead.
@@ -838,8 +844,8 @@ const POLICY_WORD = { checking: "checking", clear: "clear", idle: "" };
  * the pass has finished -- the false silence ADR-0004 rules out.
  *
  * Finished, a clean window keeps the list, every policy ticked clear, and a
- * window with findings folds it to its one line so the cards lead. "What we
- * check" opens or folds the list for the view on screen (`policyListOpen`). */
+ * window with findings folds it to its one line so the cards lead. "Scanned
+ * Policies" opens or folds the list for the view on screen (`policyListOpen`). */
 function renderPolicyCheck(view) {
   lastPolicyView = view;
   const node = el("policy-check");
@@ -892,7 +898,7 @@ function renderPolicyCheck(view) {
   const open = policyListOpen === null ? !findings : policyListOpen;
   lastPolicyOpen = open;
   const toggle = '<button type="button" class="pc-toggle" aria-expanded="' + open + '">' +
-    "What we check " + (open ? "▴" : "▾") + "</button>";
+    "Scanned Policies " + (open ? "▴" : "▾") + "</button>";
   const found = {};
   for (const alert of alerts) found[alert.rule_id] = (found[alert.rule_id] || 0) + 1;
   const rows = lastPolicies.map(function (policy) {
@@ -910,7 +916,7 @@ function renderPolicyCheck(view) {
     (open ? '<ul class="pc-list">' + rows + "</ul>" : ""));
 }
 
-/* "What we check": open the list if it is folded, fold it if it is open. */
+/* "Scanned Policies": open the list if it is folded, fold it if it is open. */
 function togglePolicyList() {
   policyListOpen = !lastPolicyOpen;
   renderPolicyCheck(lastPolicyView);

stacktrace_cli/monitor/site/icon.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" fill="none">
+<rect width="48" height="48" rx="11" fill="#17130e"></rect>
+<g transform="translate(24 24) scale(0.72) translate(-24 -24)"><path d="M38 8H18A8.5 8.5 0 0 0 18 25H20.5" stroke="#ede3d0" stroke-width="5" stroke-linecap="round" fill="none"></path>
+  <path d="M27.5 25H30A8.5 8.5 0 0 1 30 42H12" stroke="#ede3d0" stroke-width="5" stroke-linecap="round" fill="none"></path>
+  <circle cx="38" cy="8" r="5" fill="#e8681f"></circle>
+  <circle cx="12" cy="42" r="5" fill="#e8681f"></circle></g>
+</svg>

stacktrace_cli/monitor/site/index.html

@@ -4,6 +4,9 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Stacktrace — monitor</title>
+<link rel="icon" href="favicon.ico" sizes="any">
+<link rel="icon" href="icon.svg" type="image/svg+xml">
+<link rel="apple-touch-icon" href="apple-icon.png">
 <link rel="stylesheet" href="styles.css">
 </head>
 <body>
@@ -86,12 +89,6 @@
     </div>
   </section>
 
-  <div class="panel-head panel-head-logs">
-    <span class="panel-kick">Live</span>
-    <h2>What your agents are doing</h2>
-    <span class="panel-note">read from this machine's own transcripts</span>
-  </div>
-
   <div class="logs">
     <section class="logcol">
       <header class="logcol-head">

stacktrace_cli/monitor/site/inventory.js

@@ -39,9 +39,10 @@ function typeLabel(type, many) {
   return titled(type);
 }
 
-/* The scanner's labels, in tile order. A label outside these gets a tile of
- * its own rather than being folded into one: the page never re-grades. */
-const INV_SEVERITIES = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN"];
+/* The scanner's labels, in tile order. A label outside these -- UNKNOWN among
+ * them -- gets a tile of its own only when a vulnerability carries it, rather
+ * than being folded into one: the page never re-grades. */
+const INV_SEVERITIES = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
 
 /* Full class names rather than built by concatenation, so the check that every
  * class the page emits is styled can see each one. */
@@ -72,7 +73,7 @@ function checkCell(row) {
     case "not_checked":
       return { text: "Not checked", cls: "inv-check inv-check-warn" };
     case "no_package":
-      return { text: "No package", cls: "inv-check inv-check-dim" };
+      return { text: "None", cls: "inv-check inv-check-dim" };
     default:
       return { text: "Checking…", cls: "inv-check inv-check-dim" };
   }
@@ -95,6 +96,10 @@ const invOpen = new Set();
 
 /* --- the URL -------------------------------------------------------------- */
 
+/* The Vulnerabilities tab's views. A bookmarked one no longer listed reads
+ * as the default rather than as a view with no chip pressed. */
+const INV_VIEWS = ["vulnerabilities", "posture"];
+
 /* Which filters each tab writes to the hash. */
 const INV_HASH_KEYS = {
   inventory: ["agent", "type", "show", "inactive"],
@@ -109,6 +114,7 @@ function readHash(hash) {
   const filter = Object.assign({}, INV_DEFAULTS);
   for (const key of INV_HASH_KEYS[tab] || []) {
     if (!params.has(key)) continue;
+    if (key === "view" && !INV_VIEWS.includes(params.get(key))) continue;
     filter[key] = key === "inactive" ? params.get(key) === "1" : params.get(key);
   }
   return { tab: INV_TABS.includes(tab) ? tab : "live", filter: filter };
@@ -188,14 +194,17 @@ const instances = (issues) =>
   issues.reduce((sum, issue) => sum + issue.affected.length + issue.subjects.length, 0);
 
 /* The Vulnerabilities tab's tiles. Distinct vulnerabilities by label, then
- * posture issues and observations as instances: two trusted directories are
- * two posture issues on one row. */
+ * posture issues as instances: two trusted directories are two posture issues
+ * on one row. */
 function severityTiles(doc, filter) {
   const scope = Object.assign({}, filter, { severity: "" });
   const counts = new Map(INV_SEVERITIES.map((s) => [s, 0]));
   for (const v of vulnerabilityRows(doc, scope)) {
     counts.set(label(v.severity), (counts.get(label(v.severity)) || 0) + 1);
   }
+  /* The selected label keeps its tile, at 0 if nothing in scope carries it,
+   * so a filter that is on always has a tile to show it and to clear it. */
+  if (filter.severity && !counts.has(filter.severity)) counts.set(filter.severity, 0);
   const checked = doc.checked === "done";
   const tiles = Array.from(counts.entries()).map(([severity, count]) => ({
     key: "severity", value: severity, label: titled(severity.toLowerCase()),
@@ -205,10 +214,6 @@ function severityTiles(doc, filter) {
     key: "view", value: "posture", label: "Posture issues",
     count: instances(issueRows(doc.posture, doc, scope)),
   });
-  tiles.push({
-    key: "view", value: "observations", label: "Observations",
-    count: instances(issueRows(doc.observations, doc, scope)),
-  });
   return tiles;
 }
 
@@ -405,7 +410,7 @@ function renderVulnerabilitiesTab(doc) {
   html += '<p class="inv-summary">' + esc(vulnerabilitiesLine(doc, invFilter)) + "</p>";
   html += '<div class="inv-filters"><span class="inv-group">' +
     chip("view", "vulnerabilities", "Vulnerabilities") + chip("view", "posture", "Posture issues") +
-    chip("view", "observations", "Observations") + "</span>" + agentSelect("vul-agent", doc) +
+    "</span>" + agentSelect("vul-agent", doc) +
     "</div>";
 
   if (invFilter.view === "vulnerabilities") {
@@ -428,9 +433,8 @@ function renderVulnerabilitiesTab(doc) {
     return html + table(["Vulnerability", "Severity", "Fixed in", "Affects"], body);
   }
 
-  const posture = invFilter.view === "posture";
-  const issues = issueRows(posture ? doc.posture : doc.observations, doc, invFilter);
-  if (!issues.length) return html + emptyBody(posture ? "No posture issues." : "No observations.");
+  const issues = issueRows(doc.posture, doc, invFilter);
+  if (!issues.length) return html + emptyBody("No posture issues.");
   const body = issues.map((issue) =>
     '<tr class="inv-row"><td>' + esc(issue.summary) +
     (issue.sent_to_fleet ? "" : ' <span class="inv-marker">Not sent to Fleet</span>') +
@@ -439,7 +443,7 @@ function renderVulnerabilitiesTab(doc) {
     "</td><td>" + esc(fmt(issue.affected.length + issue.subjects.length)) + "</td></tr>" +
     '<tr class="inv-under"><td colspan="4">' + componentLines(issue.affected) +
     subjectLines(issue.subjects) + "</td></tr>").join("");
-  return html + table([posture ? "Posture issue" : "Observation", "Severity", "Fix", "Affects"], body);
+  return html + table(["Posture issue", "Severity", "Fix", "Affects"], body);
 }
 
 /* The one note these tabs draw above themselves: that they describe this

stacktrace_cli/monitor/site/styles.css

@@ -299,7 +299,7 @@ body.watch-mode .hero, body.watch-mode .band, body.watch-mode .status, body.watc
    ran; an alert is a sentence, a citation list and a remediation, and it was
    the one being wrapped. Order in the markup is trace-then-alerts, so the
    ratio reads 2:3. */
-.logs { display:grid; grid-template-columns:minmax(0,2fr) minmax(0,3fr); gap:1.2rem; align-items:start; }
+.logs { display:grid; grid-template-columns:minmax(0,2fr) minmax(0,3fr); gap:1.2rem; align-items:start; margin-top:1.6rem; }
 @media (max-width:860px){ .logs { grid-template-columns:1fr; } }
 
 /* Each feed is a panel with a real edge. Unbordered columns read as loose text
@@ -539,10 +539,8 @@ body.watch-mode .hero, body.watch-mode .band, body.watch-mode .status, body.watc
 /* ---------- overview section: two trend tables ---------- */
 .overview { margin:0 0 0.4rem; }
 /* ---------- section headers ----------
-   One treatment for both readings, so Overview and the live feeds read as two
-   halves of the same page rather than two widgets. The mono eyebrow and its
-   coral dot are stacktrace-site's `.eyebrow`; the rule under the title is what
-   gives the section its weight against the run bar above it. */
+   The rule under the title is what gives the section its weight against the
+   run bar above it. */
 .panel-head {
   display:flex; align-items:baseline; gap:0.7rem; flex-wrap:wrap;
   margin:0 0 0.9rem; padding-bottom:0.5rem;
@@ -551,13 +549,6 @@ body.watch-mode .hero, body.watch-mode .band, body.watch-mode .status, body.watc
 .panel-head h2 {
   margin:0; font-size:1.35rem; font-weight:700; letter-spacing:-0.03em; color:var(--ink);
 }
-.panel-kick {
-  display:inline-flex; align-items:center; gap:0.45em;
-  font-family:var(--mono); font-size:0.62rem; font-weight:500;
-  letter-spacing:0.14em; text-transform:uppercase; color:var(--ink-dim);
-}
-.panel-kick::before { content:""; width:7px; height:7px; border-radius:50%; background:var(--coral); }
-.panel-note { margin-left:auto; font-family:var(--mono); font-size:0.68rem; color:var(--ink-faint); }
 /* The window reads at nearly the heading's weight, because every number under
    it is "in this window" and a range mistaken for the default is a page
    misread rather than a detail missed. */
@@ -578,7 +569,6 @@ body.watch-mode .hero, body.watch-mode .band, body.watch-mode .status, body.watc
 .range-btn[aria-pressed="true"] {
   color:var(--paper); background:var(--ink); border-color:var(--ink);
 }
-.panel-head-logs { margin-top:2rem; }
 
 .ov-win { font-family:var(--mono); font-size:0.66rem; font-weight:400; color:var(--ink-faint); font-style:italic; }
 .ov-grid { display:grid; grid-template-columns:1fr 1fr; gap:1.1rem; }