stacktrace-cli 0.8.0__tar.gz → 0.10.0__tar.gz

stacktrace_cli-0.10.0/.github/workflows/bedrock-live.yml

@@ -0,0 +1,55 @@
+# Live Bedrock test in the sandbox account. Run by hand from the Actions tab.
+# Credentials come from GitHub's OIDC token, exchanged for a one-hour session
+# on a role that can only call Bedrock and read the invocation-logs bucket
+# (integrations/bedrock/tofu/ci.tf). No AWS key is stored anywhere.
+name: bedrock-live
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Branch, tag or SHA holding the test to run. Dispatch from main; this is what gets checked out.
+        required: false
+        default: main
+      model:
+        description: Inference profile ID. Empty picks a Claude Sonnet profile.
+        required: false
+        default: ""
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  live:
+    runs-on: ubuntu-latest
+    # The role trusts only jobs in this environment.
+    environment: bedrock-sandbox
+    timeout-minutes: 30
+    steps:
+      # GitHub dispatches only workflows on the default branch, and only to
+      # other refs after a first run, so the test's ref is an input instead.
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+      - uses: astral-sh/setup-uv@v6
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.BEDROCK_ROLE_ARN }}
+          aws-region: ${{ vars.BEDROCK_REGION || 'us-east-1' }}
+          role-duration-seconds: 3600
+      - run: uv sync
+      - name: Call each Bedrock API, read the logs back, run the rules
+        run: >
+          uv run --with boto3 python integrations/bedrock/live_test.py
+          --bucket "${{ vars.BEDROCK_LOGS_BUCKET }}"
+          --region "${{ vars.BEDROCK_REGION || 'us-east-1' }}"
+          ${{ inputs.model && format('--model {0}', inputs.model) || '' }}
+          --out bedrock-live
+      # Synthetic traffic only: scripted calls and a fake token.
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: bedrock-live
+          path: bedrock-live/
+          retention-days: 3

{stacktrace_cli-0.8.0 → stacktrace_cli-0.10.0}/CLAUDE.md

@@ -108,6 +108,10 @@ nothing about detection.
 - **OpenACA carries nothing AIDR** (ADR-0006). No finding family, no output row
   type, no scan flag, no rule namespace upstream. Detection rule identifiers are
   `stacktrace-*`, never `openaca-*`, and the combined report is assembled here.
+- **Cost is tokens, never dollars** (ADR-0099). Every cost figure, threshold,
+  severity, budget, label and doc line is in tokens or a ratio to the usual
+  ("3× the usual", "40M tokens more"). No price table, no dollar amount, no
+  currency, here or in Fleet. The family is still called `cost`.
 - **Session collection is not ours** (ADR-0002). It lives in `openaidr`, open
   source. Its types stop at our adapter; parsing an agent format here would
   duplicate the thing the split exists to prevent.
@@ -122,6 +126,12 @@ nothing about detection.
   `test_bom_shape.py`, `test_fingerprint_covers_what_the_analyzer_reads.py`. When
   a review names a site, fix the invariant and extend the exhaustive test — a
   second finding of the same class means the first fix was at the wrong level.
+  Cost has its own: `tests/cost/test_cost_findings_carry_no_session_text.py`,
+  `tests/cost/test_cost_is_tokens.py`, `test_cost_findings_are_dated_by_their_citations.py`,
+  and the range and usual checks in
+  `tests/monitor/test_render_cost.py`. When reviews keep re-arguing scope (a
+  time boundary, which sessions a rule reads), write the answer into the spec,
+  as `docs/specs/cost-phase-1.md` §1 "What a rule reads, and when" does.
 
 ## Adding a command
 
@@ -269,9 +279,10 @@ silently editing an accepted ADR breaks that contract.
 - Calibrate priority by impact and urgency:
   - P0: critical, broadly applicable failure requiring immediate action.
   - P1: serious defect that should be fixed before this change lands.
-  - P2: normal-priority defect eligible for automatic fixing.
+  - P2: normal-priority defect.
   - P3: low-priority suggestion.
-  Do not inflate priority to make a finding eligible for automatic fixing.
+- Report only P0 and P1 findings. Do not post P2 or P3 findings, inline or
+  in the review summary. Do not inflate priority to get a finding reported.
 - On subsequent reviews, verify earlier fixes and inspect their effects on
   callers and dependencies. Older code within the PR remains reviewable.
 - When review history supports it, identify a finding as:

{stacktrace_cli-0.8.0 → stacktrace_cli-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stacktrace-cli
-Version: 0.8.0
+Version: 0.10.0
 Summary: CLI for Stacktrace — Detection and Response platform for AI Agents.
 Project-URL: Homepage, https://stacktrace.ai
 Author-email: "Stacktrace AI, Inc" <founders@stacktrace.ai>
@@ -20,8 +20,8 @@ Classifier: Topic :: Security
 Requires-Python: >=3.11
 Requires-Dist: click>=8.1
 Requires-Dist: httpx<1.0.dev0,>=0.28.1
-Requires-Dist: openaca==0.8.0
-Requires-Dist: openaidr==0.4.0
+Requires-Dist: openaca==0.10.1
+Requires-Dist: openaidr==0.6.1
 Requires-Dist: posthog<8,>=7.0
 Description-Content-Type: text/markdown
 
@@ -51,7 +51,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.8.0 (openaca 0.8.0)
+stacktrace 0.10.0 (openaca 0.10.1)
 ```
 
 ## Quick start
@@ -178,6 +178,21 @@ so naming the vendor is your act rather than ours (ADR-0033). Without both,
 stage three is not asked. `detect --analyzer jev` alone reads back what such a
 run already paid for and commissions nothing (ADR-0035).
 
+**With Fleet configured** (`stacktrace remote configure`), the daemon sends
+its findings, and its token usage for the cost ledger: tokens per run,
+session, model and minute, and per run the repository's name (`owner/repo`,
+from its `origin` remote), the branch, the session's own title (never the
+prompt) and the opaque id of the account the agent is signed into, Claude
+Code's or Devin's. With each account go its display name (else the part of its
+email before the `@`), its plan, and a key that groups one person's accounts:
+a hash of the email and the Fleet organization, never the email itself. A
+finding carries its session's account the same way. Prompts, tool arguments,
+results and paths are not sent (ADR-0096, ADR-0104, ADR-0101, ADR-0112).
+
+To learn who Devin is signed in as, `stacktrace` runs Devin's own `devin auth
+status`, which asks Devin's server. It asks again only after Devin's sign-in
+changes, or ten minutes after an ask that named no one (ADR-0110).
+
 `sessions` omits prompts, tool arguments and results unless you pass
 `--include-content`. `monitor` binds to loopback only, and refuses a
 non-loopback address rather than warning about it.
@@ -215,9 +230,10 @@ enables telemetry again under a new identity (ADR-0039, ADR-0090).
 
 Beta, and under active development.
 
-`sessions`, `detect` and `monitor` work end to end today. Session collection
-currently reads Claude Code transcripts; further agent kinds are in progress
-upstream in [OpenAIDR](https://github.com/open-agent-security/openaidr).
+`sessions`, `detect` and `monitor` work end to end today, for Claude Code and
+Devin sessions alike (Devin CLI and Devin Desktop's local agent). Session collection is
+[OpenAIDR](https://github.com/open-agent-security/openaidr)'s, and further agent
+kinds arrive with it. The daemon observes every kind it reads, sub-agents included.
 
 ## Built on
 

{stacktrace_cli-0.8.0 → stacktrace_cli-0.10.0}/README.md

@@ -24,7 +24,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.8.0 (openaca 0.8.0)
+stacktrace 0.10.0 (openaca 0.10.1)
 ```
 
 ## Quick start
@@ -151,6 +151,21 @@ so naming the vendor is your act rather than ours (ADR-0033). Without both,
 stage three is not asked. `detect --analyzer jev` alone reads back what such a
 run already paid for and commissions nothing (ADR-0035).
 
+**With Fleet configured** (`stacktrace remote configure`), the daemon sends
+its findings, and its token usage for the cost ledger: tokens per run,
+session, model and minute, and per run the repository's name (`owner/repo`,
+from its `origin` remote), the branch, the session's own title (never the
+prompt) and the opaque id of the account the agent is signed into, Claude
+Code's or Devin's. With each account go its display name (else the part of its
+email before the `@`), its plan, and a key that groups one person's accounts:
+a hash of the email and the Fleet organization, never the email itself. A
+finding carries its session's account the same way. Prompts, tool arguments,
+results and paths are not sent (ADR-0096, ADR-0104, ADR-0101, ADR-0112).
+
+To learn who Devin is signed in as, `stacktrace` runs Devin's own `devin auth
+status`, which asks Devin's server. It asks again only after Devin's sign-in
+changes, or ten minutes after an ask that named no one (ADR-0110).
+
 `sessions` omits prompts, tool arguments and results unless you pass
 `--include-content`. `monitor` binds to loopback only, and refuses a
 non-loopback address rather than warning about it.
@@ -188,9 +203,10 @@ enables telemetry again under a new identity (ADR-0039, ADR-0090).
 
 Beta, and under active development.
 
-`sessions`, `detect` and `monitor` work end to end today. Session collection
-currently reads Claude Code transcripts; further agent kinds are in progress
-upstream in [OpenAIDR](https://github.com/open-agent-security/openaidr).
+`sessions`, `detect` and `monitor` work end to end today, for Claude Code and
+Devin sessions alike (Devin CLI and Devin Desktop's local agent). Session collection is
+[OpenAIDR](https://github.com/open-agent-security/openaidr)'s, and further agent
+kinds arrive with it. The daemon observes every kind it reads, sub-agents included.
 
 ## Built on
 

{stacktrace_cli-0.8.0 → stacktrace_cli-0.10.0}/docs/adrs/0006-trust-boundary-and-detection-upload.md

@@ -5,7 +5,7 @@ status: accepted
 date: 2026-08-28
 supersedes: null
 superseded-by: null
-amended-by: 0011, 0027, 0031, 0039, 0064, 0084, 0086
+amended-by: 0011, 0027, 0031, 0039, 0064, 0084, 0086, 0096, 0109
 ---
 
 ## Context

{stacktrace_cli-0.8.0 → stacktrace_cli-0.10.0}/docs/adrs/0026-the-console-becomes-a-product-surface.md

@@ -6,7 +6,7 @@ date: 2026-09-06
 supersedes: 0008
 superseded-by: null
 amends: null
-amended-by: null
+amended-by: 0097
 ---
 
 ## Context

{stacktrace_cli-0.8.0 → stacktrace_cli-0.10.0}/docs/adrs/0031-one-host-daemon-observes-native-session-logs.md

@@ -6,7 +6,7 @@ date: 2026-09-17
 supersedes: null
 superseded-by: null
 amends: 0006
-amended-by: 0032, 0036, 0037, 0038, 0039, 0045, 0046, 0066, 0072
+amended-by: 0032, 0036, 0037, 0038, 0039, 0045, 0046, 0066, 0072, 0107, 0113
 ---
 
 ## Context

{stacktrace_cli-0.8.0 → stacktrace_cli-0.10.0}/docs/adrs/0037-reuse-openaidr-append-cursors-in-the-daemon.md

@@ -6,7 +6,7 @@ date: 2026-09-18
 supersedes: null
 superseded-by: null
 amends: 0031
-amended-by: 0038, 0045
+amended-by: 0038, 0045, 0107
 ---
 
 ## Context

{stacktrace_cli-0.8.0 → stacktrace_cli-0.10.0}/docs/adrs/0038-poll-normalized-sessions-for-supplemental-changes.md

@@ -6,7 +6,7 @@ date: 2026-09-21
 supersedes: null
 superseded-by: null
 amends: 0031, 0037
-amended-by: 0045
+amended-by: 0045, 0107
 ---
 
 ## Context

{stacktrace_cli-0.8.0 → stacktrace_cli-0.10.0}/docs/adrs/0045-scan-every-session-and-outlive-them.md

@@ -6,7 +6,7 @@ date: 2026-09-22
 supersedes: null
 superseded-by: null
 amends: 0031, 0037, 0038
-amended-by: 0056, 0058, 0066, 0072
+amended-by: 0056, 0058, 0066, 0072, 0107
 ---
 
 ## Context

{stacktrace_cli-0.8.0 → stacktrace_cli-0.10.0}/docs/adrs/0061-the-drain-sends-findings-only.md

@@ -6,7 +6,7 @@ date: 2026-09-23
 supersedes: 0047
 superseded-by: null
 amends: 0057
-amended-by: null
+amended-by: 0104
 ---
 
 ## Context

{stacktrace_cli-0.8.0 → stacktrace_cli-0.10.0}/docs/adrs/0065-asset-external-id-resolves-by-a-ladder.md

@@ -6,7 +6,7 @@ date: 2026-09-24
 supersedes: null
 superseded-by: null
 amends: null
-amended-by: 0078
+amended-by: 0078, 0105
 ---
 
 ## Context

{stacktrace_cli-0.8.0 → stacktrace_cli-0.10.0}/docs/adrs/0078-a-seeded-display-prefix-replaces-the-hostname-label.md

@@ -6,7 +6,7 @@ date: 2026-09-30
 supersedes: null
 superseded-by: null
 amends: 0065
-amended-by: null
+amended-by: 0105
 ---
 
 ## Context

stacktrace_cli-0.10.0/docs/adrs/0092-cost-is-its-own-rule-family.md

@@ -0,0 +1,49 @@
+---
+id: 0092
+title: Cost is its own rule family
+status: proposed
+date: 2026-10-05
+supersedes: null
+superseded-by: null
+amends: null
+amended-by: 0113
+---
+
+## Context
+
+Cost Phase 1 adds cost rules (`docs/specs/cost-phase-1.md`). The catalogue has
+two families, security and reliability, and Fleet's `detection_rules` check
+constraint allows only those two (migration 0016). ADR-0013 created reliability
+because stuck sessions needed their own heading and handling. Cost now needs the
+same, as one of the product's main use cases.
+
+## Decision
+
+Cost rules form a third family, **`cost`**, named `stacktrace-cost-*`, with a
+`COST_RULES` set in the catalogue. `rules.family_of` derives it, never stored on
+a finding (ADR-0013). `stacktrace-blocked-quota` stays reliability, because the
+agent got stuck, and cost findings may cite it as evidence.
+
+## Alternatives considered
+
+- **Reliability, separated by name prefix.** This was the first proposal. It is
+  rejected for three reasons:
+  - Fleet users count, filter and route by family, and a prefix is invisible to
+    them.
+  - Cost goes to the people who own the budget, not to whoever runs the agent.
+  - Reliability asks whether the session worked; a runaway can work perfectly
+    and still use far more tokens than it needs.
+- **Security.** Rejected: costly behaviour is not an attack.
+
+## Consequences
+
+- One Fleet migration adds `cost` to the family check constraint, done in Phase
+  1 before any cost finding exists, so no stored data moves.
+- The CLI catalogue, the monitor's `by_family` summary, the Fleet console and
+  Slack each gain a third family.
+- Phase 2 can route notifications per family.
+
+## When to revisit
+
+If a cost rule turns out to be mainly about a session failing rather than
+using too many tokens, move that rule to reliability.

stacktrace_cli-0.10.0/docs/adrs/0093-environment-cost-baselines-count-tokens-keyed-by-model.md

@@ -0,0 +1,78 @@
+---
+id: 0093
+title: Environment cost baselines count tokens and are keyed by model
+status: proposed
+date: 2026-10-05
+supersedes: null
+superseded-by: null
+amends: null
+amended-by: 0099, 0113, 0114
+---
+
+## Context
+
+`stacktrace-cost-runaway-session` must catch a session running away, while it
+runs, against this developer's normal. Three things move "normal" without
+anything going wrong: a price change, a new default model, and idle time.
+
+## Decision
+
+- The daemon keeps p50, p95 and p99 of **cumulative tokens by active minute**,
+  and of 5-minute burn, from this environment's finished sessions over 30 days.
+- It also keeps a **day curve**: cumulative tokens by local time of day per
+  working day, per model. That curve gives the personal-anomaly rule "your usual
+  by now", and needs 10 working days of history.
+  The rule's score is log(today ÷ usual) divided by the spread: 1.48 × the
+  median absolute deviation of that log, at least 0.25. The spec's "beyond the
+  normal range" is a score of 3 or more; "far beyond" is 6 or more.
+- It also keeps **behaviour curves** per run: sub-agents started in 10 minutes,
+  repeats with an unchanged result, input per response, cache reads and cache
+  writes, as p5 and p99, and fresh input at p95. A waste rule fires only when
+  the behaviour and the cost are both unusual for this developer, so no waste
+  rule rests on a fixed limit alone.
+- The summaries are keyed by cohort, `(repo, entrypoint, model)`, falling back
+  to `(entrypoint, model)`, then `(model)`. Each level needs at least 20
+  sessions; with none, the rule is silent.
+- **Tokens, not dollars**, throughout: floors and severity too (ADR-0099).
+- **Recorded tokens on both sides.** Baselines and rules count only what the
+  transcripts record.
+  - The client's own totals are not read at all (ADR-0099): they arrive after
+    the work, with no time of their own, and add about half a percent.
+  - A comparison then undercounts alike on both sides.
+  - On a run with many sub-agents, whose output is often a lower bound, a rule
+    fires later, never falsely sooner.
+- The baseline is backfilled from transcripts at start, excludes sessions with
+  an open cost finding, and is written only by the daemon (ADR-0046).
+- Rules get a frozen snapshot as an input.
+- **The table holds one numeric summary per finished session**, not the
+  percentiles: the summary's curves and behaviour measures, its cohort, run,
+  day and login type. The snapshot computes the percentiles from these rows,
+  which is what lets it drop a flagged run or a row older than 30 days.
+  - Numbers only, never content, so it is an exception to ADR-0006 constraint 1
+    on the same terms as the verdict cache (ADR-0011). It is not the sessions
+    table ADR-0046 rejected, which would have held session models.
+  - It is additive, so `SCHEMA_VERSION` does not move (ADR-0057).
+  - The monitor reads the same snapshot, read-only, for "your usual" (ADR-0097).
+
+## Alternatives considered
+
+- **Dollar baselines.** Rejected: a price change would fire everywhere.
+- **One baseline across models.** Rejected: a model launch would fire everywhere.
+- **Thresholds on finished-session totals.** Rejected: they fire after the
+  tokens are used.
+- **Recompute from transcripts every scan.** Rejected: it repeats the cold pass
+  ADR-0011 and ADR-0037 avoid.
+- **Rules querying the store directly.** Rejected: it breaks the single writer,
+  and output would depend on when it was read.
+
+## Consequences
+
+- Price changes and model launches can't trigger the rule on their own.
+- It costs a new store table and a backfill.
+- A developer with too few sessions gets no runaway findings until Phase 2
+  sends peer numbers.
+
+## When to revisit
+
+If the cohorts prove too thin in measurement, or Phase 2's fleet-wide numbers
+make the narrow levels unnecessary.

stacktrace_cli-0.10.0/docs/adrs/0094-estimate-cost-from-tokens-the-agent-figure-is-a-cross-check.md

@@ -0,0 +1,63 @@
+---
+id: 0094
+title: Cost is tokens × price at the time of use; the agent's own figure is a cross-check
+status: superseded
+date: 2026-10-05
+supersedes: null
+superseded-by: 0099
+amends: null
+amended-by: null
+---
+
+## Context
+
+Phase 1 shows dollars and uses them as floors. Claude Code already
+writes a running `totalCostUSD` in `cost-state` records, in 109 of 181 measured
+sessions. Using it is the obvious shortcut.
+
+## Decision
+
+- The CLI prices each response's token buckets from a **versioned,
+  effective-dated price table**, at the price **in effect when the response
+  happened**.
+- A model with no price is **unpriced**: shown in tokens, never priced at zero.
+- Every dollar says which rate produced it: at list price, or at the org's own
+  rates once entered (Phase 2). The arithmetic is exact for what it prices —
+  tokens by model, type and date — but that excludes two billing dimensions
+  the agent's own figure does include: the 10% multiplier Anthropic applies to
+  a response on US data residency, and per-request fees such as web search,
+  which aren't token charges at all ([cost.md §4.3](../specs/cost.md#43-what-cost-is)).
+- Claude Code's own figure is compared per session as a **cross-check only**.
+- Tokens the transcripts miss, such as some sub-agent work, are taken from
+  Claude Code's per-model token totals and priced the same way, as one
+  "unrecorded" line — reconciled once per **run**, against the run's own
+  latest cumulative figure, never once per session: a resumed session's figure
+  already includes its earlier spend, and a parent's already includes its
+  sub-agents', so summing each session's own remainder would double-count
+  both. Its dollars are never used.
+
+## Alternatives considered
+
+- **Use Claude Code's `cost-state` as the cost.** Rejected, for four reasons:
+  - it is a per-session running total, so it can't price a window, a run or a
+    response;
+  - it is missing in 72 of 181 sessions;
+  - it is Claude Code's alone, and Codex records none;
+  - it can't take org rates or be re-priced.
+- **Price in OpenAIDR.** Rejected by OpenAIDR ADR-0015: a price is
+  interpretation.
+- **The provider's usage API.** Not available in the environment: it needs an
+  admin key, lags, and has no per-session detail. It is Phase 2's reconciliation
+  source.
+
+## Consequences
+
+- One method prices every agent, window and run.
+- The price table must be maintained, and every price change noted in a release.
+- A persistent gap against the cross-check, beyond the data-residency and
+  per-request gaps above, points to a missing price or a counting error.
+
+## When to revisit
+
+If a provider records per-response cost in the transcript: carry it as recorded,
+and make the estimate the cross-check.

stacktrace_cli-0.10.0/docs/adrs/0095-cost-findings-reach-fleet-each-rule-can-be-muted.md

@@ -0,0 +1,53 @@
+---
+id: 0095
+title: Every cost finding shows in Fleet; each cost rule's Slack notifications can be switched off
+status: proposed
+date: 2026-10-05
+supersedes: null
+superseded-by: null
+amends: null
+amended-by: null
+---
+
+## Context
+
+Fleet posts every newly stored finding to Slack (`detections.py`, first
+insert), with no filter by rule or severity. Phase 1 accepts that: its few
+environment rules are checked on recorded sessions before they ship. Phase 2
+adds Fleet's own rules, which compare people with the org and cannot be fully
+tested before real org data exists. A rule that turns out noisy would keep
+paging Fleet users until the next release.
+
+## Decision
+
+- Cost findings drain to Fleet over the existing upload, with **no wire change**,
+  and show in its console per environment and run from day one.
+- In Phase 1, Fleet posts every cost finding to Slack, like any other finding.
+- From Phase 2, Fleet's catalogue gives each cost rule a **`notify` switch**,
+  on by default, and the Slack outbox skips rules with it off.
+- The Stacktrace team turns a rule's `notify` off when it proves noisy, and back
+  on once it is fixed. Its findings still show in Fleet.
+- Reviewing findings as right or wrong is available to the team but optional,
+  and never a gate before a rule notifies.
+- Developers get every cost finding locally either way.
+
+## Alternatives considered
+
+- **Keep findings local until Phase 2.** Rejected: Phase 1 would not be end to
+  end, and Fleet would have no evidence to evaluate.
+- **Hold every new rule off until its findings are reviewed.** Rejected: manual
+  review does not scale, and every new rule would wait on reviewers.
+- **No switch.** Rejected: a noisy rule would page until a release removed it,
+  and teach Fleet users to skip cost alerts.
+- **Send them as low severity.** Rejected: severity says how bad a finding is,
+  not whether a rule is trustworthy, and Slack V1 has no severity filter.
+
+## Consequences
+
+- A small Fleet change: a per-rule setting and one outbox condition.
+- Other rules keep today's behaviour, with `notify` on.
+
+## When to revisit
+
+When Fleet's Slack delivery gains severity or routing filters, which would make
+this flag redundant.

stacktrace_cli-0.10.0/docs/adrs/0096-cost-usage-may-leave-as-token-totals-and-work-identifiers.md

@@ -0,0 +1,86 @@
+---
+id: 0096
+title: Cost usage may leave as token totals and work identifiers
+status: accepted
+date: 2026-10-06
+supersedes: null
+superseded-by: null
+amends: 0006
+amended-by: 0103, 0109, 0115, 0116
+---
+
+## Context
+
+Cost Phase 2 (`docs/specs/cost-phase-2.md`) needs Fleet to judge an environment
+owner's spend against their own past and against the org. Phase 1 already sends
+findings and nothing else (ADR-0061, ADR-0095), and Fleet still has no usage.
+The phase 2 upload, a new endpoint beside `detect-runs`, would send token totals
+per run, session, model and minute, and per run the repo, branch, title and the
+Anthropic account the agent is signed into.
+
+That document is not a finding. [ADR-0006](0006-trust-boundary-and-detection-upload.md)
+constraint 1 says detection findings are the one thing that may travel — amended
+only by ADR-0039, for a different channel — and constraint 2 says the uploaded
+document carries no user. The account is sent because, on a shared dev box or CI
+runner, it names the person and the Fleet enrollment key does not. None of
+ADR-0092 through ADR-0095 amends constraint 1 or 2, so an implementer who followed
+the spec alone would cross the boundary those constraints still state.
+
+## Decision
+
+This amends ADR-0006 constraints 1 and 2 for one document: the cost usage upload,
+and the cost findings Fleet draws from it. The rest of ADR-0006 stays in force,
+including for every other finding family and for ADR-0039's telemetry.
+
+1. **Token totals may travel. The session may not.** Counts per run, session,
+   model, minute and token type (input, output, cache read, cache write — the
+   rates differ by type), plus a local reduction of the last 30 days to those
+   same counts. The session id is the key already allowed on a finding's session
+   reference, not the session. Transcripts, correlation records and session
+   models stay on the machine. There is still no upload path for them.
+2. **A closed set of work identifiers, and the provider account.** Per run: repo
+   name, branch name, title, and the Anthropic account the agent is signed into.
+   Per component: the tokens its definitions add to every call, whether it was
+   used, and how many calls carried it per model. Repo, branch and title are
+   names of the work, not a path, a working directory or a machine name. The
+   account may appear on a cost finding because that finding is about who spent;
+   it is how a shared environment names the person. No other finding family
+   gains a user.
+3. **Nothing else.** Prompts, tool arguments, tool results and paths do not
+   travel. A title that reproduces the prompt is a prompt and does not travel.
+   Absolute paths and secret-shaped strings are still refused (ADR-0006
+   constraint 4). ADR-0039 is unchanged: its events still exclude repository
+   names.
+
+The findings drain stays findings-only (ADR-0061). This is a separate endpoint.
+
+## Alternatives considered
+
+- **Cut the upload back to what ADR-0006 already allows.** Rejected. Findings
+  carry no usage, so Fleet cannot price an owner's past, separate a shared rise
+  from one person's, or say which work cost the money. That is the gap Phase 2
+  exists to close; Phase 1 already sends findings alone.
+- **Upload the transcripts and price them in Fleet.** Rejected. ADR-0006 already
+  rejected central analysis of session content. The 30-day backfill is computed
+  locally and only the aggregates leave.
+- **Put the rows on the findings drain.** Rejected. ADR-0061 keeps that drain
+  findings-only so the detection document does not grow a second shape.
+- **Drop repo, branch, title and the account, and send token totals under the
+  Fleet key alone.** Rejected. A shared box enrolls as one Fleet member, so the
+  key is not the person who signed the agent in, and a finding that cannot name
+  the work cannot be acted on.
+
+## Consequences
+
+- The cost spec may name these fields because this decision does. A field that
+  is not in the list above is still a breach.
+- Cost findings and their Slack text may repeat the account, the repo, the
+  branch and the title. Other families may not.
+- A title is the easiest way for conversation to leak through a field this
+  decision allows. Watch for one that is the prompt.
+
+## When to revisit
+
+If Phase 2 ships without this upload, supersede this amendment. If the account
+or the title is found to carry a credential or conversation in practice, narrow
+clause 2 rather than widening what else may travel.