stave-first-evaluation

name	stave-first-evaluation
description	Run Stave against a tiny example observation and read your first findings — no AWS account required
triggers	["first findings","see Stave work","what does a finding look like","try Stave without AWS","stave apply example"]
requires	["a built stave binary (run the stave-setup skill first)"]

stave-first-evaluation

What this skill does

Produces real findings from a one-asset example observation so you see the output shape — finding, evidence, reasoning, remediation. No AWS needed.

Time: ~10 minutes.

Steps

1. Confirm Stave is built

./stave version    # if this fails, run the stave-setup skill

2. Create a minimal observation

There is no bundled examples/observations/ dir, so create one. NOTE the two fields that must be exact or stave apply exits 2 (input error):

• source MUST be one of deployed | planned | local (NOT "example").
• schema_version MUST be obs.v0.1.

mkdir -p /tmp/stave-demo/obs
cat > /tmp/stave-demo/obs/2026-01-01T000000Z.json << 'EOF'
{
  "schema_version": "obs.v0.1",
  "source": "deployed",
  "generated_by": { "source_type": "manual" },
  "captured_at": "2026-01-01T00:00:00Z",
  "assets": [
    {
      "id": "arn:aws:iam::111111111111:user/demo-user",
      "type": "aws_iam_user",
      "vendor": "aws",
      "properties": {
        "identity": {
          "kind": "user",
          "name": "demo-user",
          "arn": "arn:aws:iam::111111111111:user/demo-user",
          "policies": { "has_admin_access": true, "service_wildcards_granted": true }
        }
      }
    }
  ]
}
EOF
jq . /tmp/stave-demo/obs/*.json > /dev/null && echo "valid JSON"

3. Run Stave (use --eval-time for deterministic output)

./stave apply --observations /tmp/stave-demo/obs/ --eval-time 2026-01-02T00:00:00Z

Expected: 2 violations on demo-user:

• CTL.IAM.POLICY.ADMIN.001 (the user has admin access)
• CTL.IAM.CROSSCLOUD.ADMIN.001

Exit code 3 = violations found (0 = clean, 2 = input error, 3 = violations, 4 = internal).

4. Read the output

Each finding shows: the control + asset, evidence (when the violation began), the root-cause property that triggered it, and remediation guidance.

5. Try the machine-readable formats

./stave apply --observations /tmp/stave-demo/obs/ --eval-time 2026-01-02T00:00:00Z --format json
./stave apply --observations /tmp/stave-demo/obs/ --eval-time 2026-01-02T00:00:00Z --format sarif

JSON follows the stable out.v0.1 schema; SARIF carries a runs array for code-scanning tools.

Success

You've produced findings from an observation and understand the output + exit codes. Next: lab-validation (needs a sandbox AWS account).