Aggregate all assessment dimensions into a single structured
report document: posture score, findings summary, SLA compliance,
top findings, active chains, ATT&CK coverage, framework readiness,
team attribution, and executive summary.
Consumers render the report however needed — Jinja template,
Python script, Pandoc, or direct API consumption.
Inputs:
--history PATH History directory (required)
--snapshot PATH Snapshot to assess (required)
--sla-profile-file PATH SLA policy
--team-manifest PATH Team manifest
--format STRING json (default) | markdown
--out PATH Write to file
--title STRING Report title
--period STRING Reporting period label
Exit Codes:
0 Report generated
2 Invalid input
4 Internal error
Usage:
stave report [flags]
Examples:
stave report --history ./history --snapshot latest.json
stave report --history ./history --snapshot latest.json \
--sla-profile-file sla.yaml --team-manifest teams.yaml \
--format markdown --out report.md
Flags:
--chains string chains directory (default "chains")
-i, --controls string controls directory (default "controls")
-f, --format string output format: json | markdown (default "json")
-h, --help help for report
--history string history directory (required)
--out string write to file
--period string reporting period label
--sla-profile-file string SLA policy file
--snapshot string snapshot to assess (required)
--team-breakdown Include per-team findings breakdown in report
--team-manifest string team manifest
--title string report title (default "Security Posture Report")
Global Flags:
--allow-symlink-output Allow writing output through symlinks (default: refuse)
--force Allow overwriting existing output files
--log-file string Write logs to file (default: stderr)
--log-format string Log format: text|json (default "text")
--log-level string Log level: debug|info|warn|error (overrides -v)
--log-timestamps Include timestamps in logs (breaks determinism)
--log-timings Include timing information (breaks determinism)
--no-color Disable ANSI colors in output
--path-mode string Path rendering in errors/logs: base (basename only) or full (absolute paths) Resolved default may come from STAVE_* env vars, stave.yaml, user config, or built-in.
--quiet Suppress output (exit code only) Resolved default may come from STAVE_* env vars, stave.yaml, user config, or built-in.
--require-offline Assert offline operation: fail if proxy env vars (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY) are set
--sanitize Sanitize infrastructure identifiers (bucket names, ARNs, policies) from output Resolved default may come from STAVE_* env vars, stave.yaml, user config, or built-in.
--strict Enable strict integrity checks for embedded registries and references
-v, --verbose count Increase verbosity (-v=INFO, -vv=DEBUG)
-y, --yes Auto-confirm all interactive prompts (distinct from --force which controls file overwriting)