Read your Fleet records

Check a policy push with its inclusion proof, find the people a key touched, read the forensic timeline and export evidence for an audit.

Planned for 1.4

Status Status is where the work is: Planned (in a milestone, not started), Building (tickets in progress), Preview (usable, may change), then the stability it ships at.

Stability The promise an interface ships with.

Stable Follows semantic versioning; breaking changes need a new major, 12 months of overlap and a codemod.
Beta Usable in production; may change before it becomes stable.
Experimental May change or go away; needs an explicit opt-in in main.yaml.

Stability levels

View as Markdown Open in Claude Edit

Updated 2026-10-28

You will read the signed record of what Fleet pushed to an app, scope a breach and export an evidence bundle. It takes about 15 minutes. Everything here is read-only: the commands change nothing in your apps.

You need

A Fleet state folder, .mainsdk/fleet by default. Point at another with --state <dir> or MAINSDK_FLEET_DIR.
Fleet policy is declarative data signed by keys your tenant holds, never code.

1. See what reached an app

pnpm mainsdk fleet log --app app_01 --json

Each entry has the policy hash, the signers, the time and how many apps the push reached. Each also carries an inclusion proof in the transparency log, which the command verifies before it prints the entry. An entry that fails its proof is shown as failed, never dropped.

2. Scope a breach

pnpm mainsdk fleet scope --key key_01 --from 2027-09-01T09:00Z --to 2027-09-01T11:00Z

This lists the users and apps a key touched in the window, from the signed access records.

3. Read the timeline

pnpm mainsdk fleet timeline --app app_01 --from 2027-09-01T00:00Z

The timeline is hash-chained and signed. A record changed after the fact breaks the chain and the command says where.

4. Export evidence

pnpm mainsdk fleet evidence --standard soc2 --period 2027-07-01..2027-09-30 --out soc2.zip

The bundle holds the controls the standard maps, the records behind each, an OSCAL file and a PDF summary. Standards are soc2, iso27001, dpdp and gdpr; another name fails with MAIN-FLEET-0011.

5. Gate a deploy

pnpm mainsdk fleet admit --env production --marks main27

admit refuses a release that lacks a mark your policy requires (MAIN-FLEET-0007). pnpm mainsdk check also fails a build that includes a blocked package (MAIN-FLEET-0006).

Spec fleet-prove for the criteria and fleet-control for pushes and kill switches.

Was this page helpful?