📄️ Configuration
How Stave resolves settings from flags, project config, user config, and environment variables.
📄️ Limits
What Stave does and does not do. Scope boundaries, known limitations, and out-of-scope areas.
📄️ obs.v0.1
Reference for the obs.v0.1 observation snapshot schema.
📄️ Observation Export Schema
Field-by-field reference for the S3 observation property groups produced by Stave's export and ingest tooling.
📄️ out.v0.1
Reference for Stave evaluation output contract out.v0.1.
📄️ Stability
Stave's stability commitments, schema versioning, and dependency policy.
📄️ Evaluation Semantics
Deterministic evaluation behavior, predicate matching rules, and output semantics.
📄️ ctrl.v1
Reference for the ctrl.v1 control definition schema.
📄️ Severity Thresholds
How severity levels work and how to tune duration thresholds.
📄️ Observation Contract
Stable contract for observation snapshots used by Stave.
📄️ Output & Severity
How to read evaluation output, severity, remediation, and fix plans.
📄️ Output Formats
JSON, text, and markdown output options in Stave.
📄️ diagnose.v1
Reference for Stave diagnose output contract diagnose.v1.
🗃️ CLI Reference
56 items
🗃️ Controls Reference
8 items
📄️ Fact Export
The on-disk formats Stave produces for external reasoning engines: JSON / JSONL / SMT-LIB v2. Schema, predicate vocabulary, closed-world semantics, exit codes.
📄️ Changelog
All notable changes to this project will be documented in this file.
📄️ Command Reference
<!-- GENERATED by internal/tools/gencommanddocs — DO NOT EDIT.
📄️ OWASP Non-Human Identity Top 10 — Stave coverage
The OWASP Non-Human Identity (NHI) Top 10
📄️ Contract-First Schemas
Stave uses contract-first JSON schemas so validation is deterministic,
📄️ Engine Capabilities
What Stave's CEL-backed evaluation engine supports, what the shipped S3 / IAM / DocumentDB controls actually exercise, and what is retained as candidate code for future domains.
📄️ Stave Terminology Glossary
This glossary maps Stave's internal terminology to security industry standards
📄️ HIPAA CLI Evidence
Per-control AWS CLI evidence commands, expected output shapes, and pass/fail observation JSON for HIPAA S3 controls.
📄️ HIPAA Control Mapping
Mapping of HIPAA Security Rule sections to Stave S3 controls, with AWS CLI evidence and pass/fail observation shapes.
📄️ Minimum IAM Permissions for S3 Observation Collection
Stave evaluates local observation files. Users collect these observations
📄️ Identity Blast Radius
Observation properties, controls, the identity_blast_radius chain, and example output for identity blast radius.
📄️ Operator Contract
Three commands verify correctness after any change:
📄️ Scope and support
In scope
📄️ Security Policy
Scope