stacktrace-cli 0.6.1__tar.gz → 0.7.1__tar.gz

{stacktrace_cli-0.6.1 → stacktrace_cli-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stacktrace-cli
-Version: 0.6.1
+Version: 0.7.1
 Summary: CLI for Stacktrace — Detection and Response platform for AI Agents.
 Project-URL: Homepage, https://stacktrace.ai
 Author-email: "Stacktrace AI, Inc" <founders@stacktrace.ai>
@@ -20,7 +20,7 @@ Classifier: Topic :: Security
 Requires-Python: >=3.11
 Requires-Dist: click>=8.1
 Requires-Dist: httpx<1.0.dev0,>=0.28.1
-Requires-Dist: openaca==0.7.0
+Requires-Dist: openaca==0.8.0
 Requires-Dist: openaidr==0.3.2
 Requires-Dist: posthog<8,>=7.0
 Description-Content-Type: text/markdown
@@ -51,7 +51,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.6.1 (openaca 0.7.0)
+stacktrace 0.7.1 (openaca 0.8.0)
 ```
 
 ## Quick start

{stacktrace_cli-0.6.1 → stacktrace_cli-0.7.1}/README.md

@@ -24,7 +24,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.6.1 (openaca 0.7.0)
+stacktrace 0.7.1 (openaca 0.8.0)
 ```
 
 ## Quick start

{stacktrace_cli-0.6.1 → stacktrace_cli-0.7.1}/docs/adrs/0006-trust-boundary-and-detection-upload.md

@@ -5,7 +5,7 @@ status: accepted
 date: 2026-08-28
 supersedes: null
 superseded-by: null
-amended-by: 0011, 0027, 0031, 0039, 0064, 0084
+amended-by: 0011, 0027, 0031, 0039, 0064, 0084, 0086
 ---
 
 ## Context

{stacktrace_cli-0.6.1 → stacktrace_cli-0.7.1}/docs/adrs/0018-remote-sync-config-and-facade-consumption.md

@@ -5,6 +5,8 @@ status: accepted
 date: 2026-09-03
 supersedes: null
 superseded-by: null
+amends: null
+amended-by: 0087
 ---
 
 ## Context

{stacktrace_cli-0.6.1 → stacktrace_cli-0.7.1}/docs/adrs/0027-a-finding-may-name-what-it-could-not-place.md

@@ -6,6 +6,7 @@ date: 2026-09-07
 supersedes: null
 superseded-by: null
 amends: 0006
+amended-by: 0086
 ---
 
 ## Context

{stacktrace_cli-0.6.1 → stacktrace_cli-0.7.1}/docs/adrs/0071-render-the-allowlisted-payload-per-destination.md

@@ -6,7 +6,7 @@ date: 2026-09-26
 supersedes: null
 superseded-by: null
 amends: 0067
-amended-by: 0073
+amended-by: 0073, 0088
 ---
 
 ## Context

stacktrace_cli-0.7.1/docs/adrs/0086-a-refusal-names-who-answered-the-call.md

@@ -0,0 +1,110 @@
+---
+id: 0086
+title: A refusal, retry or sent credential names who the call reached
+status: accepted
+date: 2026-10-01
+supersedes: null
+superseded-by: null
+amends: 0006, 0027
+amended-by: null
+---
+
+## Context
+
+A Fleet Slack alert for `stacktrace-blocked-upstream` read *Subject: Bash
+(tool) (built-in)*, *Evidence: upstream_refused*. The person reading it could
+not tell who refused. A `stacktrace-tool-retry-storm` alert had the same gap:
+it never said what the agent kept calling, so a service browning out looked
+the same as an agent sending a bad request. A `stacktrace-credential-egress`
+alert said a token was in a call's arguments, at a character offset no reader
+can use, and not where it was sent.
+
+Each citation's `detail` was built from `tool_name_for(call)`. For a shell call
+that is `Bash`, and for every MCP call it is the fixed `an MCP connector`. Both
+were deliberate. ADR-0006 constraint 3 keeps names the other side chose out of
+a finding, and ADR-0027 lets an unplaced server's alias sit only in
+`Participant.name`. The result is that the alert names the agent's own tool and
+never the thing that refused.
+
+## Decision
+
+The `detail` of a citation on `stacktrace-blocked-throttled`,
+`stacktrace-blocked-upstream`, `stacktrace-tool-retry-storm` and
+`stacktrace-credential-egress` names who the call reached
+(`deterministic._outside_target`). For a sent credential it reads `sent to
+<target>`, and the character offset is no longer named:
+
+- **MCP call:** `linear MCP · search_issues`, the server alias and the tool.
+  Each part is named only when it is shaped like an identifier (letters,
+  digits, `_ . : -`, at most 64), so it is never a sentence or a path. A
+  server that fails the shape names nothing. A tool that fails it leaves
+  `linear MCP`. This holds for a placed or an unplaced server.
+- **WebFetch:** the host of its `url`.
+- **Shell call:** a vendor CLI from a closed list names its service
+  (`GitHub (gh)`). Any other segment that reaches the network must carry
+  exactly one `http(s)://` URL, and its host is named. A command that reaches
+  two places, or a network segment with no URL, names nothing.
+
+Only the host of a URL is named. Scheme, userinfo, port, path and query never
+are. A target that matches a credential shape is dropped. When nothing is
+named, the detail reads as before (`Bash`, `an MCP connector`).
+
+A block the client raised, a spend limit or a safety check, keeps the tool
+name. The call never reached the service, so naming the service would blame
+it.
+
+This amends ADR-0006 constraint 3 and ADR-0027 for these four rules' citation
+`detail` only. Every other field and rule is unchanged, and the retry storm's
+remediation keeps `tool_name_for`. `tests/test_untrusted_content_never_travels.py`
+states the bound as `_PERMITTED_AS_A_TARGET` and `_TARGET_RULES`.
+
+## Alternatives considered
+
+- **Name only a vendor CLI's service, never a host or an MCP tool.** Rejected.
+  It was the first version of this change. It left every MCP refusal and every
+  `curl` refusal naming nothing, and those are the cases a reader most needs.
+- **Read the service from the error text.** Rejected. The service writes its
+  own error body and can put any name there. `blocked.py` already refuses to
+  copy captures out of it. The target here comes from the call the agent made.
+- **Name the first target when a command reaches several.** Rejected. The
+  record does not say which segment failed, and naming the wrong one sends the
+  reader to the wrong service.
+- **Name the full URL.** Rejected. Paths and queries carry tokens, account ids
+  and customer data. The upload contract already refuses a URL with a path or
+  query.
+- **Carry the target as a new Subject or wire field.** Rejected for this
+  change. `Participant` has a closed set of kinds, and Fleet checks
+  `subject_kind` with a constraint. A new kind changes the upload contract,
+  Fleet's schema and its console. The detail already travels and is already
+  stored.
+
+## Consequences
+
+A refusal names `linear MCP · search_issues`, `api.ledgerline.io` or
+`GitHub (gh)`. Fleet shows this once its Slack message prints evidence detail
+(Fleet ADR-0072). Local surfaces that print detail show it at once.
+
+An MCP server can now put a word of its choosing into a finding through its
+tool name. The identifier shape bounds it to one token, the upload redactor
+and contract gate still walk it, and Fleet secret-scans it again before Slack.
+A host can now leave the machine for these four rules. That includes internal
+hostnames.
+
+A command whose URL sits in a variable (`curl "$URL"`), or that runs through a
+wrapper `command_segments` does not unwrap (`npx vercel`, `sudo gh`), names
+nothing. Each fails towards the old wording, never towards a wrong name.
+
+Two known limits are accepted rather than parsed around, because handling
+each means reading per-program flags:
+
+- A URL argument is taken to be where the request went. A command whose only
+  literal URL is a proxy or a referer (`curl -x http://proxy:3128 "$URL"`)
+  names that host.
+- A vendor CLI keeps its service name when pointed at another endpoint
+  (`aws --endpoint-url …`, `gh --hostname …`).
+
+## When to revisit
+
+Revisit if a deployment cannot send hostnames or MCP tool names to Fleet, if
+the identifier shape lets through a tool name that carries data, or if the
+target needs to become a structured field of its own.

stacktrace_cli-0.7.1/docs/adrs/0087-deploy-compiled-policy-with-a-privileged-scheduled-job.md

@@ -0,0 +1,195 @@
+---
+id: 0087
+title: Deploy compiled policy with a privileged scheduled job
+status: proposed
+date: 2026-09-30
+supersedes: null
+superseded-by: null
+amends: 0018
+amended-by: null
+---
+
+## Context
+
+Fleet publishes an organization policy and `stacktrace remote policy compile`
+can turn it into Claude Code managed settings, but an operator must rerun and
+privileged-install that artifact after every change. Automatic deployment is a
+launch requirement, and MDM cannot be a prerequisite.
+
+The ordinary daemon should not install the file. It runs as the developer,
+reads transcript and agent configuration content, launches analyzers and
+adapters, and owns user-readable state. Running all of it as root gives far
+more code privilege than the one required filesystem write. The launch bridge
+also needs to work before the later daemon policy API and hook enforcement
+architecture exists.
+
+This bridge assumes a cooperative endpoint administrator and developer. It
+automates distribution and protects the privileged installation path from
+accidental corruption and local privilege escalation; it is not a claim that
+Claude managed settings resist a developer or agent deliberately acting with
+that developer's permissions.
+
+The inputs also change on two clocks. A Fleet revision can change at any time,
+while the result for one revision can change as endpoint composition or
+advisories change. Compiling only on revision changes would leave new local
+components and newly published vulnerabilities unevaluated indefinitely.
+
+Finally, a managed-settings artifact can contain hooks, helpers and environment
+variables that execute commands or redirect credentials. Treating compiler
+output as harmless JSON would make the policy path a root-mediated
+code-execution channel.
+
+## Decision
+
+Stacktrace deploys the Claude managed-settings artifact through a root-owned
+scheduled one-shot job, installed once with administrator approval. launchd on
+macOS or a systemd timer on Linux invokes an absolute, root-owned Stacktrace
+policy runtime under `/opt/stacktrace-policy` every minute and at boot. The
+existing uv-installed developer CLI and daemon remain unchanged. The one-line
+remote installer downloads uv in the root context, installs the same
+Stacktrace release into the policy runtime and installs the service after one
+sudo approval; it never runs the developer-owned uv or Stacktrace executable
+as root.
+Stacktrace writes each launchd or systemd definition relative to a
+descriptor-walked root-owned directory after rejecting symlinks, non-root
+writability and extended ACLs on every component.
+The job fetches Fleet policy using a separate root-only enrollment, recompiles
+immediately when the revision changes and unconditionally once an hour, and
+atomically installs the last validated result as `50-openaca-policy.json` at
+mode `0644`.
+
+The root parent fetches and installs. Compilation runs in a child after dropping
+to the pinned developer UID, GID and groups. It uses Python's isolated-import
+mode from a verified root-owned working directory, calls OpenACA through its
+public facade, and returns its dry-run report over a private pipe; no
+user-writable staging file exists. Root accepts only the exact non-executable
+policy-control keys emitted by the pinned compiler and rejects every unknown
+key or shape. Any failure before the artifact's durable rename preserves the
+prior artifact and installed revision unchanged. A failure in the directory
+sync or independent state write after the rename is recovered by recompiling
+and repeating the idempotent atomic install on the next poll. Missing or corrupt
+state after enrollment fails static; same-deployment re-enrollment preserves a
+valid revision anchor rather than constructing a new one from Fleet. An
+explicitly confirmed organization switch on the same API origin and pinned
+account stops the timer, removes the previous organization's artifact, resets
+the organization-scoped revision anchor and installs the new enrollment before
+reconciliation resumes. API-origin or pinned-account changes remain refused.
+Fresh bootstrap is the only other reset: enrollment is first marked incomplete,
+the empty state anchor is written, and enrollment is then marked complete. A
+retry may recreate only that incomplete empty anchor before any service or
+artifact exists; a completed enrollment with missing state remains
+`state_lost`.
+
+The job preserves Fleet's policy revision in the client contract, rechecks it
+after compilation, and discards a candidate if the revision changed mid-run.
+It uses no configuration fingerprint: revision change is the fast trigger and
+the hourly full compile is the reconciliation fallback, matching the daemon's
+current composition-refresh cadence rather than its six-hour BOM-delivery
+cadence.
+
+This amends ADR-0018 only for privileged deployment: the user remote channel
+continues to own `~/.config/stacktrace/remote.toml`, while the scheduled root
+job requires a separate root-only copy because an unprivileged user config
+cannot be authoritative input to a root service. The OpenACA facade and
+one-directional dependency decisions remain unchanged.
+
+## Alternatives considered
+
+- **Run the whole Stacktrace daemon as root.** Rejected because transcript
+  parsing, network upload, analyzer and adapter subprocesses, logs, the socket
+  and the daemon database would all gain root privilege, and the daemon would
+  resolve the wrong home directory unless more user-selection machinery were
+  added.
+- **Have the user daemon compile and a root helper copy its file.** Rejected
+  for this temporary bridge because it adds a staging file, a daemon-to-root
+  handoff and another wake protocol when the scheduled command can fetch,
+  compile and install in one pass. The later hook architecture can consolidate
+  clients around the daemon API deliberately instead of preserving this
+  throwaway handoff.
+- **Install a setuid helper.** Rejected because a compiled setuid input surface
+  is more dangerous than a scheduled job, interpreted entry points cannot be
+  setuid, and the design still needs a one-time root install. No persistent
+  root authority should be callable by the governed user.
+- **Run a long-lived root policy service or add a privileged socket.** Rejected
+  because a timer plus one-shot command already supplies retries and boot
+  execution. A resident service and request protocol add lifecycle and attack
+  surface without improving the launch guarantee.
+- **Use `policyHelper`.** Rejected because it is Claude-specific, still needs a
+  protected root-owned configuration entry, runs only when its managed source
+  is selected, and its emitted object becomes the session's complete managed
+  settings. It does not solve source precedence or the cross-agent direction.
+- **Require MDM.** Rejected as a launch prerequisite. MDM remains a supported
+  way for customers to deploy the same root-owned runtime and service files.
+- **Compile only when Fleet's revision changes.** Rejected because endpoint
+  composition and advisory data can change under the same semantic policy.
+- **Fingerprint every OpenACA input and compile when it changes.** Rejected for
+  launch because it duplicates discovery knowledge and creates invalidation
+  state. Hourly reconciliation is simpler and already matches the product's
+  current composition-freshness trade.
+- **Compile in Fleet and make root only download an artifact.** Deferred rather
+  than rejected permanently. Fleet does not yet have authoritative fresh
+  project/user composition for the endpoint, and the current policy compiler
+  evaluates local configuration and advisories.
+- **Install the changing policy through hooks now.** Deferred to the portable
+  enforcement architecture. It is the strategic path, but it does not remove
+  the launch requirement to deploy the Claude artifact already supported.
+
+## Consequences
+
+One administrator action makes subsequent policy revisions automatic on
+laptops and self-hosted hosts without keeping Stacktrace's transcript pipeline
+privileged. Policy changes normally land within a minute; local composition and
+advisory drift converge within an hour even when Fleet policy is unchanged.
+
+There are temporarily two Stacktrace installations on such a machine: the
+developer's uv tool environment for the CLI and daemon, and the root-owned
+policy-only runtime. Re-running the same one-line installer pins both to the
+same released version, stops the timer before replacing its runtime and then
+reinstalls it. This duplication is accepted for the short-lived Claude bridge
+and disappears with hook-based enforcement. One user per machine is the
+supported scope.
+
+Every interactive `stacktrace remote configure` retries reconciliation of an
+already-installed, same-version root policy runtime, including when
+credentials are unchanged. Reconciliation is idempotent, so no retry marker is
+stored in the developer's config; a second interactive run retries a failed,
+declined or interrupted update. Noninteractive configuration never inspects
+the privileged runtime or opens a sudo prompt. An interactive configuration
+with a missing or version-mismatched root runtime directs the developer back
+to the one-line installer, which remains the only bootstrap and upgrade path
+for `/opt`.
+
+The file's installation is not proof that every key is effective. Claude can
+select a higher-ranked server or MDM source; current versions combine some
+restrictive MCP keys across sources, but not every key the compiler emits.
+Anthropic-hosted sessions never read the endpoint file. Local status therefore
+reports the published and installed revisions separately and does not claim
+enforcement; `/status` or `claude doctor` remains the verification surface.
+
+The strict root validator deliberately creates upgrade friction. If OpenACA
+adds a legitimate emitted key, policy apply retains the last good artifact
+until Stacktrace updates its allowlist. That is preferable to silently turning
+an automated fleet channel into remote code execution.
+
+## When to revisit
+
+- Replace minute polling with long-poll or push when measured Fleet scale makes
+  the request volume material.
+- Remove the hourly local compile when Fleet can provide a trustworthy artifact
+  derived from fresh endpoint composition and advisory data.
+- Replace this Claude-specific bridge when portable hook enforcement has equal
+  or better rollout, failure and receipt semantics on supported agents.
+- Add multi-user host support only with an explicit artifact and enrollment
+  ownership model for each user.
+- Revisit local effective-policy verification when Claude publishes a stable,
+  machine-readable source and key-status interface.
+
+## References
+
+- [Automatic managed-policy deployment](../specs/managed-policy-deployment.md)
+- [Claude Code managed settings](https://code.claude.com/docs/en/managed-settings)
+- ADR-0018 — remote configuration and OpenACA facade consumption
+- ADR-0020 — the OpenACA consumption boundary
+- ADR-0032 — hourly composition refresh
+- ADR-0041 — target host platforms
+- ADR-0072 — host service managers own persistent lifecycle

stacktrace_cli-0.7.1/docs/adrs/0088-slack-alerts-leave-out-confidence.md

@@ -0,0 +1,44 @@
+---
+id: 0088
+title: The local Slack alert leaves out confidence
+status: accepted
+date: 2026-10-01
+supersedes: null
+superseded-by: null
+amends: 0071
+amended-by: null
+---
+
+## Context
+
+ADR-0071 lists confidence among what a Slack message names. In practice nearly
+every finding is graded `high`, so the field repeats the same word on every
+alert and tells a reader in a channel nothing. Fleet's Slack alert drops it for
+the same reason (Fleet ADR-0072).
+
+## Decision
+
+The `--format slack` body shows Subject, Evidence and Severity, and no
+Confidence field. This replaces "confidence" in ADR-0071's list of what a Slack
+message names. The JSON format, the payload allowlist (ADR-0067) and
+`stacktrace findings` are unchanged and still carry confidence.
+
+## Alternatives considered
+
+- **Keep confidence in Slack.** Rejected. It is the same word on almost every
+  alert, so it costs a field and adds nothing.
+- **Show confidence only when it is not `high`.** Rejected. A field that
+  appears on some alerts and not others reads as a layout bug, and the finding
+  page has the grade for anyone who needs it.
+- **Drop it from the JSON payload too.** Rejected. That is a contract change
+  for endpoints that may read it.
+
+## Consequences
+
+The local alert and Fleet's alert show the same three fields again. A reader
+who wants the grade runs `stacktrace findings` or opens the Fleet page.
+
+## When to revisit
+
+Revisit if graded-down findings become common enough that the grade changes
+what a reader does.

{stacktrace_cli-0.6.1 → stacktrace_cli-0.7.1}/docs/adrs/INDEX.md

@@ -34,6 +34,8 @@ supersedes anything yet.
 
 ## Active
 
+- [0087](0087-deploy-compiled-policy-with-a-privileged-scheduled-job.md) — **Deploy compiled policy with a privileged scheduled job.** A root-owned launchd/systemd timer polls Fleet every minute, compiles as the pinned developer on every revision change and hourly otherwise, validates an exact non-executable key allowlist, and atomically installs `50-openaca-policy.json`; the user daemon never supplies root's input. Amends ADR-0018 with a separate root-only enrollment. Read before putting policy installation in the daemon, adding a privileged copier/socket/setuid helper, compiling only on revision changes, or treating installed settings as proof they are effective.
+
 - [0069](0069-webhooks-deliver-what-retention-holds.md) — **Webhooks deliver what retention holds, and configuration takes no lock.** Amends ADR-0068: no retention floors for the webhook, configuration read before each request without a lock (one in-flight request may reach the previous endpoint), and the daemon never removes a webhook cursor. Read before adding a floor for a subscriber, locking configuration against delivery, or letting a config read release anything.
 - [0068](0068-webhooks-retry-the-retained-backlog.md) — **Webhooks retry the retained backlog.** Amends ADR-0067: no configuration-time cutoff, no retry cap. Its per-request locking and retention-floor release are replaced by ADR-0069 (no lock, no floors) — see that entry for the semantics actually in force.
 
@@ -55,7 +57,7 @@ supersedes anything yet.
 - [0015](0015-narrow-the-security-catalogue.md) — **Withdraw five security rules, narrowing the catalogue.** `unsanctioned-mcp-tool-use`, `unattended-privileged-action`, `provider-refusal`, `refusal-circumvention` and `capability-crossing` are removed — 19 of 42 measured findings, and a scope decision rather than ADR-0013's kind of quality measurement. Reverses ADR-0013's argument for keeping `capability-crossing` without disputing it. Read before re-adding a rule, or before assuming a missing rule was never built.
 - [0016](0016-stall-grouping-is-session-wide.md) — **`progress-stall` groups over the whole session, not a contiguous run.** Contiguity was proposed twice and is rejected on recall — a real retry loop is interleaved with the reads that investigate it — and the trade cannot be settled without the 540-session corpus. Read before changing how the stall rule groups calls, or before reporting an interleaved group as a new false positive.
 - [0017](0017-a-declined-repeat-is-a-stall.md) — **A declined repeat is a stall, and the finding says which outcome it saw.** `outcome.py`'s *a denied call is evidence of nothing* governs what a call **reached**; a stall is a claim about the agent's own repetition, which a denial establishes as well as an error does. What was wrong was the prose — a declined group was described as a tool failure with something to remediate. Read before narrowing a rule's failure predicate to `error`, or before treating `rejected` as outside every rule.
-- [0018](0018-remote-sync-config-and-facade-consumption.md) — **Remote sync keeps its own configuration and consumes OpenACA through the facade.** `~/.config/stacktrace/remote.toml` is this channel's own file and it never reads one OpenACA writes; the BOM, posture findings and observations come from `openaca.core` in-process, never from a subprocess and never from `tools.*`. Overlaps ADR-0020 on the facade half. Read before adding configuration to the remote channel or changing how it acquires OpenACA's data.
+- [0018](0018-remote-sync-config-and-facade-consumption.md) — **Remote sync keeps its own configuration and consumes OpenACA through the facade.** `~/.config/stacktrace/remote.toml` is this channel's own file and it never reads one OpenACA writes; the BOM, posture findings and observations come from `openaca.core` in-process, never from a subprocess and never from `tools.*`. Amended by ADR-0087 with a separate root-only enrollment for privileged scheduled policy deployment. Overlaps ADR-0020 on the facade half. Read before adding configuration to the remote channel or changing how it acquires OpenACA's data.
 - [0019](0019-delegated-commands-are-openaca-objects.md) — **Delegated commands are OpenACA's own Click command objects.** `add_command(openaca_cli.commands[name], name)` — not a wrapper, a subprocess, a hand-written re-declaration, or a runtime scan of OpenACA's command list. Overlaps ADR-0021 on CLI composition. Read before adding or changing a delegated command.
 - [0020](0020-openaca-consumption-boundary.md) — **Consume OpenACA as a library through `openaca.core`, in-process.** The seam is `openaca.core` / `openaca.cli` and nothing else; rejected shelling out to the CLI (two invocations disagree, `bom-ref` does not join across documents, a target path to strip, `--fail-on any` makes exit status unreadable), importing `tools.*` (no compatibility promise, and the one-way arrow means nobody upstream watches for the break), and vendoring. Overlaps ADR-0018 on the facade half. Read before reaching into OpenACA from a new module.
 - [0021](0021-two-command-kinds.md) — **A command is a pass-through or native, never both.** A mounted OpenACA command declares no flag of its own; rejected `stacktrace scan --upload` because noticing our flag means parsing argv first, which reduces "a new upstream flag works the day it ships" to "unless it collides with ours", plus wrapping and help-text rebranding. Overlaps ADR-0019 on CLI composition. Read before adding a command or an option to `src/stacktrace_cli/cli.py`.
@@ -114,3 +116,5 @@ supersedes anything yet.
 - [0083](0083-each-block-reason-is-its-own-rule.md) — **Each block reason is its own rule.** `stacktrace-agent-blocked` filed four reasons under one id, so everything keyed on the rule id alone — Fleet's seeded catalogue and roll-up, Slack, local notifications — read a spend limit, a safety block, a throttle and a service refusal as one finding. Now `stacktrace-blocked-quota`, `-policy`, `-throttled` and `-upstream`, each named by its `Reason`, each `session`-scoped by ADR-0022 cardinality. `agent-blocked` is retired to `rules.RETIRED_SCOPES` so stored rows still upload. Amends ADR-0039: `finding_delivered` no longer carries `reason`. Read before adding a block reason, before teaching Fleet a sub-rule key, or before putting a second property beside `rule` on a telemetry event.
 - [0084](0084-a-recursive-deletes-evidence-is-the-rm-that-ran.md) — **A recursive delete's evidence names what it deleted.** Amends ADR-0006 constraint 3 and ADR-0073's kind-is-a-classifier rule, for `stacktrace-destructive-action` only. Its evidence `kind` is `rm -rf` and the paths that escaped the workspace, whole, listed once, counted past 500 characters; never wrappers, flags or the rest of the call, because an alert saying only `recursive_delete` cannot be triaged and a reproduced command is a parser of its own. No new field: Fleet already stores and shows `kind`, so device and Fleet keep one schema. The redactor cleans `kind` word by word and drops credentials; the upload contract still checks it, so a display flaw is refused, never leaked. Read before putting session text in any other field or rule, or before making the display reproduce more of the command.
 - [0085](0085-show-when-and-which-finding-slack-delivered.md) — **Show when and which finding Slack delivered.** Amends ADR-0067, ADR-0068 and ADR-0073: `detected_at` is the first notifiable revision's queue creation time, Slack renders it in the viewer's locale beside the visible stable finding ID, and `webhook configure` previews the exact currently pending eligible count before enabling. The count is a snapshot, not a cutoff or confirmation policy; retained-history and at-least-once delivery semantics do not change. Read before redefining `detected_at`, hiding the ID again, or turning the preview into a second backlog policy.
+- [0086](0086-a-refusal-names-who-answered-the-call.md) — **A refusal, retry or sent credential names who the call reached.** Amends ADR-0006 constraint 3 and ADR-0027 for the citation `detail` of `stacktrace-blocked-throttled`, `stacktrace-blocked-upstream`, `stacktrace-tool-retry-storm` and `stacktrace-credential-egress` (`sent to <target>`) only: an MCP call names `server MCP · tool` (each part only if identifier-shaped, placed or not), WebFetch names its URL's host, and a shell call names a vendor CLI's service or the one URL host it reached. Only the host of a URL, never userinfo, port, path or query; nothing secret-shaped; nothing when a command reaches two places. Client-raised blocks keep the tool name. Not the error text, not the full URL, not a new Subject field. Read before naming a target anywhere else, or before widening what the identifier shape admits.
+- [0088](0088-slack-alerts-leave-out-confidence.md) — **The local Slack alert leaves out confidence.** Amends ADR-0071: `--format slack` shows Subject, Evidence and Severity, because confidence is `high` on nearly every finding. The JSON format, the payload allowlist and `stacktrace findings` still carry it. Read before adding a field back to the Slack body.

stacktrace_cli-0.7.1/docs/plans/015-managed-policy-deployment.md

@@ -0,0 +1,47 @@
+# Managed Policy Deployment Implementation Plan
+
+**Goal:** Automatically reconcile Fleet policy into Claude Code managed
+settings from the existing one-line onboarding flow without running the
+ordinary daemon or developer CLI as root.
+
+**Architecture:** `stacktrace_cli.remote.policy_service` is one deep module
+behind the four native CLI commands. It owns root-only enrollment and state,
+the one-minute reconciliation decision, the privilege-dropped compiler child,
+strict output validation, descriptor-relative atomic installation, and
+launchd/systemd definitions. `RemoteClient` exposes the complete policy
+envelope. A separate policy-only Stacktrace runtime lives under
+`/opt/stacktrace-policy`; the user daemon and developer uv tool environment
+remain outside the privileged path.
+
+**Spec:** [Automatic managed-policy deployment](../specs/managed-policy-deployment.md)
+and [ADR-0087](../adrs/0087-deploy-compiled-policy-with-a-privileged-scheduled-job.md).
+
+## Constraints
+
+- The public test seams are the `remote policy` CLI, the `RemoteClient`
+  envelope contract, and generated launchd/systemd definitions.
+- Work red-to-green in vertical slices; do not reimplement OpenACA policy
+  evaluation.
+- The developer CLI remains in its uv tool environment. A second root-owned
+  runtime at `/opt/stacktrace-policy` serves only the privileged timer and is
+  installed from a root-downloaded uv; no developer-owned executable runs with
+  sudo.
+- Missing or corrupt service state after enrollment fails static with
+  `state_lost`; installation creates the initial state anchor.
+- The existing token-bearing installer asks for sudo once on macOS, installs
+  the same released Stacktrace version into the policy runtime, installs the
+  LaunchDaemon and clears sudo state. That installer change lives in the
+  companion `stacktrace-site` repository.
+- Every gate in `scripts/git-hooks/pre-push` passes before push.
+
+## Tasks
+
+- [x] Preserve and validate the complete Fleet policy envelope.
+- [x] Amend the proposed spec and ADR for the separate policy runtime and
+  fail-static state loss.
+- [x] Add root enrollment/state models and atomic persistence.
+- [x] Add revision/hourly reconciliation and strict candidate validation.
+- [x] Add the bounded privilege-dropped compiler child.
+- [x] Add descriptor-relative managed-settings verification and atomic install.
+- [x] Add launchd/systemd rendering plus install/uninstall/status commands.
+- [x] Run targeted tests, the full repository gate, and inspect the final diff.

stacktrace_cli-0.7.1/docs/releases/v0.7.0.md

@@ -0,0 +1,87 @@
+# 0.7.0 — Fleet policy deploys itself
+
+0.6.x could compile your organization's Fleet policy into Claude Code managed
+settings, but a person still had to copy the result into a root-owned directory
+on every machine, every time the policy changed. This release installs it
+automatically, without MDM and without trusting anything the developer's
+account — or an agent running as it — can write.
+
+## Fleet policy is installed and kept current automatically
+
+On macOS, Fleet's one-line onboarding installer now asks for sudo once,
+installs this release into a separate root-owned runtime under
+`/opt/stacktrace-policy`, and runs its
+`remote policy install-service --user <developer> --api-url <fleet>`. That
+installs a root-owned scheduled job —
+launchd on macOS, a systemd timer on Linux — that runs every minute and at boot
+(ADR-0087):
+
+- **Fetches the policy itself**, with its own root-only enrollment and Fleet's
+  policy revision. Nothing the developer's account can write is ever an input
+  to the root job.
+- **Compiles as the developer, not as root.** A child process drops to the
+  enrolled user's UID, GID and groups and runs the OpenACA compiler on their
+  `~/.claude`; root only receives the result over a private pipe.
+- **Accepts only policy keys.** Root installs nothing but the exact,
+  non-executable policy-control keys the compiler emits, so a tampered or buggy
+  compile cannot slip a hook or helper command into managed settings.
+- **Installs atomically and fails static.** The artifact lands as
+  `managed-settings.d/50-openaca-policy.json`, root-owned and `0644`, by an
+  atomic rename. Any failure keeps the previous policy in force.
+- **Recompiles on change and hourly.** A new Fleet revision is picked up within
+  a minute; a full recompile every hour catches new components and new
+  advisories.
+
+The job only ever runs that root-owned runtime, never the developer's
+uv-installed CLI or uv. `remote policy status` shows what is
+installed and why the last run failed, `remote policy apply` runs one
+reconciliation now, and `remote policy uninstall-service` removes the job and
+leaves the last installed policy in place.
+
+## Vulnerability gates work on ordinary machines
+
+This release pins OpenACA 0.8.0. A policy with a vulnerability gate no longer
+refuses to compile because a plugin, hook or skill has no advisory coordinate:
+components that can be looked up are blocked on a match, and the rest are
+listed under `vulnerability_coverage` in the compile report (OpenACA ADR-0064).
+
+## Findings say who a call reached
+
+A throttled or upstream-blocked call, a retry storm, and a credential sent off
+the machine now name their target: the MCP server and tool, the WebFetch host,
+or the vendor CLI's service — and only when the name is shaped like an
+identifier, never a path or a sentence (ADR-0086). A denied call names no
+target.
+
+## Also in this release
+
+- **Slack alerts leave out confidence** (ADR-0088). A `--format slack` message
+  shows subject, evidence and severity; the JSON payload and
+  `stacktrace findings` still carry confidence.
+- **Monitor:** plainer Live tab headings, a simpler Inventory check cell and
+  Vulnerabilities tiles, a selected severity keeps its tile, and the strip's
+  chips add up to its "invoked" total.
+- **Bug fixes.** A URL host is scanned for credentials as it was written, and a
+  reply-only block gets a span the upload contract accepts.
+
+## Install
+
+`uv tool install stacktrace-cli==0.7.0` or `pip install stacktrace-cli==0.7.0`.
+
+## Compatibility
+
+Beta — no back-compat hedging.
+
+- **New privileged surface, opt-in.** Nothing changes on a machine until an
+  administrator runs `remote policy install-service` (or the onboarding
+  installer). That opt-in surface is the only privileged-policy change; it
+  doesn't touch the Slack format, finding targets, or Monitor changes below,
+  which apply whether or not policy deployment is installed.
+- **Managed settings file name.** The installed drop-in is
+  `50-openaca-policy.json`, the name OpenACA excludes from its own collision
+  check. Don't hand-place another drop-in with that name.
+- **Vulnerability-gated compiles now succeed with gaps** instead of failing.
+  Read `vulnerability_coverage` if you relied on the old error to detect
+  incomplete coverage.
+- **Slack message body.** `--format slack` no longer shows a Confidence field;
+  the JSON format is unchanged.