---
title: "Read your Fleet records"
description: "Check a policy push with its inclusion proof, find the people a key touched, read the forensic timeline and export evidence for an audit."
section: "guides"
status: "Planned for 1.4"
spec: "fleet-prove"
canonical: "https://mainsdk.dev/docs/guides/read-your-fleet-records"
updated: "2026-10-28"
---

# Read your Fleet records

> Check a policy push with its inclusion proof, find the people a key touched, read the forensic timeline and export evidence for an audit.

Status: Planned for 1.4 · Canonical: https://mainsdk.dev/docs/guides/read-your-fleet-records · Updated: 2026-10-28

You will read the signed record of what Fleet pushed to an app, scope a breach and export an evidence bundle. It takes about 15 minutes. Everything here is read-only: the commands change nothing in your apps.

## You need

- A Fleet state folder, `.mainsdk/fleet` by default. Point at another with `--state <dir>` or `MAINSDK_FLEET_DIR`.
- Fleet policy is declarative data signed by keys your tenant holds, never code.

## 1. See what reached an app

```sh
pnpm mainsdk fleet log --app app_01 --json
```

Each entry has the policy hash, the signers, the time and how many apps the push reached. Each also carries an inclusion proof in the transparency log, which the command verifies before it prints the entry. An entry that fails its proof is shown as failed, never dropped.

## 2. Scope a breach

```sh
pnpm mainsdk fleet scope --key key_01 --from 2027-09-01T09:00Z --to 2027-09-01T11:00Z
```

This lists the users and apps a key touched in the window, from the signed access records.

## 3. Read the timeline

```sh
pnpm mainsdk fleet timeline --app app_01 --from 2027-09-01T00:00Z
```

The timeline is hash-chained and signed. A record changed after the fact breaks the chain and the command says where.

## 4. Export evidence

```sh
pnpm mainsdk fleet evidence --standard soc2 --period 2027-07-01..2027-09-30 --out soc2.zip
```

The bundle holds the controls the standard maps, the records behind each, an OSCAL file and a PDF summary. Standards are `soc2`, `iso27001`, `dpdp` and `gdpr`; another name fails with `MAIN-FLEET-0011`.

## 5. Gate a deploy

```sh
pnpm mainsdk fleet admit --env production --marks main27
```

`admit` refuses a release that lacks a mark your policy requires (`MAIN-FLEET-0007`). `pnpm mainsdk check` also fails a build that includes a blocked package (`MAIN-FLEET-0006`).

## Next

- Spec `fleet-prove` for the criteria and `fleet-control` for pushes and kill switches.