From 2d637d10d022b1d7f1cb5eb5447b9abd75890cc4 Mon Sep 17 00:00:00 2001
From: Alex Oliveira <4482374+aroff@users.noreply.github.com>
Date: Sat, 10 Oct 2026 11:21:57 +0000
Subject: [PATCH] feat(managed): https sources, the credential command and the
 apply report

A managed source can now be an https:// URL. Apply fetches the state and
each listed archive over https, with size limits and only https redirects.

- credential_command: run without a shell from the configuration folder,
  30 s at most; its first line is a bearer token sent only to the source's
  origin. A failure or a 401 falls back to the cached state and reports
  that a sign-in is needed. Without a terminal, FASTSKILL_INTERACTIVE=0.
- report_url: each apply sends a fixed JSON report (agents, skill entries
  and outcomes, quarantine, refusals, project skills) with a rising
  sequence; an accepted report clears the refusals it carried.
- request_url and report_url on another origin are ignored with a
  warning; a file source ignores editable, request_url and report_url,
  and managed status names them.
- managed status shows sign-in needed, ignored fields and where reports
  go; managed status --json --report prints the next report body.
---
 Cargo.lock                                    |  36 +-
 crates/fastskill-cli/src/commands/managed.rs  |  71 ++-
 .../src/commands/managed_tests.rs             |  80 ++-
 crates/fastskill-cli/src/registration.rs      |   4 +
 crates/fastskill-core/Cargo.toml              |   5 +-
 .../fastskill-core/src/core/managed/apply.rs  | 127 ++++-
 .../src/core/managed/apply_tests.rs           |  65 ++-
 .../src/core/managed/enrollment.rs            |  58 ++-
 .../fastskill-core/src/core/managed/gate.rs   | 111 ++++-
 .../fastskill-core/src/core/managed/layout.rs |   7 +
 crates/fastskill-core/src/core/managed/mod.rs |   9 +
 .../src/core/managed/records.rs               |   4 +
 .../fastskill-core/src/core/managed/remote.rs | 370 ++++++++++++++
 .../src/core/managed/remote_tests.rs          | 231 +++++++++
 .../fastskill-core/src/core/managed/report.rs | 459 ++++++++++++++++++
 .../src/core/managed/report_tests.rs          | 409 ++++++++++++++++
 .../fastskill-core/src/core/managed/store.rs  |  27 +-
 .../src/core/managed/test_https.rs            | 171 +++++++
 webdocs/cli-reference/managed-command.mdx     |  69 ++-
 19 files changed, 2225 insertions(+), 88 deletions(-)
 create mode 100644 crates/fastskill-core/src/core/managed/remote.rs
 create mode 100644 crates/fastskill-core/src/core/managed/remote_tests.rs
 create mode 100644 crates/fastskill-core/src/core/managed/report.rs
 create mode 100644 crates/fastskill-core/src/core/managed/report_tests.rs
 create mode 100644 crates/fastskill-core/src/core/managed/test_https.rs

diff --git a/Cargo.lock b/Cargo.lock
index 3647b18e..d78eb247 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -497,7 +497,7 @@ version = "3.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6dee98b0db6a962de883bf5d20362dee4d7ca0d12fe39a7c6c73c844e1cd7c1f"
 dependencies = [
- "darling 0.20.11",
+ "darling 0.23.0",
  "ident_case",
  "prettyplease",
  "proc-macro2",
@@ -1373,10 +1373,12 @@ dependencies = [
  "once_cell",
  "predicates",
  "proptest",
+ "rcgen",
  "regex",
  "reqwest 0.12.28",
  "ring",
  "rusqlite",
+ "rustls",
  "semver",
  "serde",
  "serde_json",
@@ -2794,6 +2796,16 @@ dependencies = [
  "hmac",
 ]
 
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64 0.22.1",
+ "serde_core",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -3217,6 +3229,19 @@ dependencies = [
  "rand_core 0.9.5",
 ]
 
+[[package]]
+name = "rcgen"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
+dependencies = [
+ "pem",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "yasna",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -5426,6 +5451,15 @@ dependencies = [
  "linked-hash-map",
 ]
 
+[[package]]
+name = "yasna"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+dependencies = [
+ "time",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.2"
diff --git a/crates/fastskill-cli/src/commands/managed.rs b/crates/fastskill-cli/src/commands/managed.rs
index cb36d9dc..ad42887b 100644
--- a/crates/fastskill-cli/src/commands/managed.rs
+++ b/crates/fastskill-cli/src/commands/managed.rs
@@ -33,7 +33,8 @@ pub fn group_metadata() -> GroupMetadata {
 #[derive(Debug, Default)]
 pub struct ManagedArgs {
     pub json: bool,
-    /// `status` only: include the last apply's full report.
+    /// `status` only: include what the last apply did and the report body; with `--json`, print
+    /// only the report body.
     pub report: bool,
 }
 
@@ -111,6 +112,7 @@ managed_args!(StatusArgs, {
         vec![
             "fastskill managed status",
             "fastskill managed status --report",
+            "fastskill managed status --json --report",
         ],
     );
     spec.args.push(ArgSpec {
@@ -119,7 +121,8 @@ managed_args!(StatusArgs, {
         long: Some("report"),
         value_type: ArgValueType::Bool,
         cardinality: Cardinality::Optional,
-        help: "Include everything the last apply did",
+        help: "Include everything the last apply did and the report body; with --json, print \
+               only the report body",
         ..Default::default()
     });
     spec
@@ -142,6 +145,8 @@ pub struct Environment {
     pub project_skills: Option<PathBuf>,
     /// Whether a person is watching; a hook runs without a terminal.
     pub interactive: bool,
+    /// FastSkill's configuration folder, where the credential command runs.
+    pub config_dir: PathBuf,
 }
 
 impl Environment {
@@ -151,6 +156,9 @@ impl Environment {
         Ok(Self {
             layout: ManagedLayout::for_current_user()?,
             settings,
+            config_dir: user_file_path()
+                .and_then(|file| file.parent().map(PathBuf::from))
+                .unwrap_or_else(std::env::temp_dir),
             user_settings_file: user_file_path(),
             home: dirs::home_dir()
                 .ok_or_else(|| CliError::Config("can't determine the home folder".to_string()))?,
@@ -170,6 +178,8 @@ impl Environment {
             project_skills: self.project_skills.clone(),
             may_enroll,
             now: chrono::Utc::now(),
+            interactive: self.interactive,
+            config_dir: self.config_dir.clone(),
         })
     }
 }
@@ -183,13 +193,21 @@ fn not_configured() -> CliError {
 }
 
 pub async fn execute_enroll(args: EnrollArgs) -> CliResult<()> {
-    let env = Environment::current()?;
-    emit(run_enroll(&env, &args.0)?)
+    emit(off_runtime(move || run_enroll(&Environment::current()?, &args.0)).await?)
 }
 
 pub async fn execute_apply(args: ApplyArgs) -> CliResult<()> {
-    let env = Environment::current()?;
-    emit(run_apply(&env, &args.0)?)
+    emit(off_runtime(move || run_apply(&Environment::current()?, &args.0)).await?)
+}
+
+/// Run an apply on a blocking thread: it makes blocking https requests and runs the
+/// credential command.
+async fn off_runtime(
+    work: impl FnOnce() -> CliResult<Rendered> + Send + 'static,
+) -> CliResult<Rendered> {
+    tokio::task::spawn_blocking(work)
+        .await
+        .map_err(|error| CliError::Config(format!("the apply stopped unexpectedly: {error}")))?
 }
 
 pub async fn execute_status(args: StatusArgs) -> CliResult<()> {
@@ -276,6 +294,9 @@ pub fn render_outcome(outcome: &ApplyOutcome) -> String {
     if let Some(problem) = &outcome.state_problem {
         lines.push(format!("Used the last accepted state: {problem}"));
     }
+    if outcome.sign_in_needed {
+        lines.push(SIGN_IN_NEEDED.to_string());
+    }
     if outcome.targets.is_empty() {
         lines.push("No agent targets were found for this user.".to_string());
     }
@@ -314,11 +335,29 @@ pub fn render_outcome(outcome: &ApplyOutcome) -> String {
     for (what, why) in &outcome.failures {
         lines.push(format!("  failed   {what}: {why}"));
     }
+    for warning in &outcome.warnings {
+        lines.push(format!("  warning  {warning}"));
+    }
+    if let Some(report) = &outcome.report {
+        lines.push(match (&report.problem, report.accepted) {
+            (_, true) => format!("  report   #{} accepted", report.sequence),
+            (Some(problem), _) => format!("  report   not accepted: {problem}"),
+            (None, false) => "  report   not accepted".to_string(),
+        });
+    }
     lines.join("\n")
 }
 
+const SIGN_IN_NEEDED: &str =
+    "Sign-in needed: the credential command didn't give a token the source accepts. Run \
+     `fastskill managed apply` in a terminal to sign in.";
+
 pub fn run_status(env: &Environment, args: &ManagedArgs) -> CliResult<String> {
     let status = managed::status(&env.layout, &env.settings, chrono::Utc::now())?;
+    if args.json && args.report {
+        // The exact body the next report carries, and nothing else (decision 15).
+        return Ok(serde_json::to_string_pretty(&status.report).unwrap_or_default());
+    }
     if args.json {
         return Ok(
             serde_json::to_string_pretty(&status_json(&status, args.report)).unwrap_or_default(),
@@ -338,6 +377,10 @@ fn status_json(status: &ManagedStatus, report: bool) -> Value {
         "expires_at": status.expires_at,
         "expired": status.expired,
         "state_problem": status.state_problem,
+        "sign_in_needed": status.sign_in_needed,
+        "ignored": status.ignored,
+        "report_to": status.report_note,
+        "warnings": last.map(|l| l.warnings.clone()).unwrap_or_default(),
         "targets": last.map(|l| l.targets.clone()).unwrap_or_default(),
         "collisions": last.map(|l| l.collisions.clone()).unwrap_or_default(),
         "owned": status.owned,
@@ -377,6 +420,15 @@ pub fn render_status(status: &ManagedStatus, report: bool) -> String {
     if let Some(problem) = &status.state_problem {
         lines.push(format!("State:    {problem}"));
     }
+    if status.sign_in_needed {
+        lines.push(SIGN_IN_NEEDED.to_string());
+    }
+    for ignored in &status.ignored {
+        lines.push(format!("Ignored:  {ignored}"));
+    }
+    if let Some(note) = &status.report_note {
+        lines.push(format!("Report:   {note}"));
+    }
     if let Some(last) = &status.last_apply {
         lines.push(format!(
             "Last apply: {} ({})",
@@ -393,10 +445,17 @@ pub fn render_status(status: &ManagedStatus, report: bool) -> String {
         for path in &last.collisions {
             lines.push(format!("  collision {}", path.display()));
         }
+        for warning in &last.warnings {
+            lines.push(format!("  warning   {warning}"));
+        }
         if report {
             lines.push(render_outcome(last));
         }
     }
+    if let (true, Some(body)) = (report, &status.report) {
+        lines.push("Report body:".to_string());
+        lines.push(serde_json::to_string_pretty(body).unwrap_or_default());
+    }
     lines.push(format!("Managed entries: {}", status.owned.len()));
     if status.quarantine.is_empty() {
         lines.push("Quarantine: empty".to_string());
diff --git a/crates/fastskill-cli/src/commands/managed_tests.rs b/crates/fastskill-cli/src/commands/managed_tests.rs
index ac33a7d7..d3fb9725 100644
--- a/crates/fastskill-cli/src/commands/managed_tests.rs
+++ b/crates/fastskill-cli/src/commands/managed_tests.rs
@@ -1,6 +1,7 @@
 use super::*;
 use fastskill_core::core::managed::{
     Enrollment, EntryChange, ManagedSource, PinnedKey, QuarantineReason, QuarantineRecord,
+    ReportDelivery,
 };
 use tempfile::TempDir;
 
@@ -21,6 +22,7 @@ fn environment(dir: &TempDir, configured: bool, interactive: bool) -> Environmen
         home: dir.path().join("home"),
         project_skills: None,
         interactive,
+        config_dir: dir.path().to_path_buf(),
     }
 }
 
@@ -255,7 +257,83 @@ fn status_of_an_enrolled_user() {
         report: true,
     };
     let value: Value = serde_json::from_str(&run_status(&env, &report).unwrap()).unwrap();
-    assert_eq!(value["last_apply"]["subject"], "team-a");
+    assert_eq!(value["format_version"], 1);
+    assert_eq!(value["sequence"], 1);
+    assert_eq!(value["machine_id"], value_of_machine(&env));
+    assert!(value.get("last_apply").is_none(), "{value}");
+}
+
+fn value_of_machine(env: &Environment) -> String {
+    let enrollment: Enrollment =
+        serde_json::from_slice(&std::fs::read(env.layout.enrollment_file()).unwrap()).unwrap();
+    enrollment.machine_id
+}
+
+#[test]
+fn sign_in_warnings_and_the_report_are_shown() {
+    let mut last = outcome(true);
+    last.sign_in_needed = true;
+    last.warnings = vec!["report_url is elsewhere".to_string()];
+    for (delivery, expected) in [
+        (
+            ReportDelivery {
+                sequence: 4,
+                accepted: true,
+                problem: None,
+            },
+            "report   #4 accepted",
+        ),
+        (
+            ReportDelivery {
+                sequence: 4,
+                accepted: false,
+                problem: Some("HTTP 500".to_string()),
+            },
+            "report   not accepted: HTTP 500",
+        ),
+        (ReportDelivery::default(), "report   not accepted"),
+    ] {
+        last.report = Some(delivery);
+        let text = render_outcome(&last);
+        for expected in [
+            expected,
+            "Sign-in needed",
+            "warning  report_url is elsewhere",
+        ] {
+            assert!(text.contains(expected), "{expected} in {text}");
+        }
+    }
+
+    let status = ManagedStatus {
+        source: Some("/s/state.dsse".to_string()),
+        enrollment: Some(Enrollment::new("/s/state.dsse", chrono::Utc::now())),
+        sign_in_needed: true,
+        ignored: vec!["report_url: a file source never gets a report".to_string()],
+        report_note: Some("none: a file source never gets a report".to_string()),
+        report: Some(managed::Report::build(managed::report::ReportInput {
+            source: &ManagedSource::File(PathBuf::from("/s/state.dsse")),
+            enrollment: &Enrollment::new("/s/state.dsse", chrono::Utc::now()),
+            issued_at: None,
+            completed: true,
+            snapshot: &last.snapshot,
+            quarantine: &[],
+            refusals: &managed::report::Refusals::default(),
+        })),
+        last_apply: Some(last),
+        ..ManagedStatus::default()
+    };
+    let text = render_status(&status, true);
+    for expected in [
+        "Sign-in needed",
+        "Ignored:  report_url",
+        "Report:   none: a file source",
+        "  warning   report_url is elsewhere",
+        "Report body:",
+        "\"format_version\": 1",
+    ] {
+        assert!(text.contains(expected), "{expected} in {text}");
+    }
+    assert!(!render_status(&status, false).contains("Report body:"));
 }
 
 #[test]
diff --git a/crates/fastskill-cli/src/registration.rs b/crates/fastskill-cli/src/registration.rs
index 65bae1e0..2e419b7f 100644
--- a/crates/fastskill-cli/src/registration.rs
+++ b/crates/fastskill-cli/src/registration.rs
@@ -63,6 +63,7 @@ where
     let id: Arc<str> = Arc::from(path.leaf().unwrap_or(""));
     let handler = Arc::new(handler);
     let managed = follows_managed_policy(path);
+    let command_name: Arc<str> = Arc::from(path.0.join(" "));
 
     Command {
         id,
@@ -78,8 +79,11 @@ where
             // `'static` and does not hold the borrow, which frees `ctx` for the
             // drain below.
             let fut = handler(ctx, typed);
+            let command_name = command_name.clone();
             Box::pin(async move {
                 if managed {
+                    // A refused install is kept for the managed report under this name.
+                    fastskill_core::core::managed::set_current_command(&command_name);
                     managed_policy(Situation::for_current_user(Utc::now()).command_policy())?;
                 }
                 match output::mode() {
diff --git a/crates/fastskill-core/Cargo.toml b/crates/fastskill-core/Cargo.toml
index 9013a371..fb52cca4 100644
--- a/crates/fastskill-core/Cargo.toml
+++ b/crates/fastskill-core/Cargo.toml
@@ -47,7 +47,7 @@ walkdir.workspace = true
 zip.workspace = true
 
 # HTTP client for embedding API (rustls for musl compatibility)
-reqwest.workspace = true
+reqwest = { workspace = true, features = ["blocking"] }
 
 # HTTP server
 axum.workspace = true
@@ -97,6 +97,9 @@ insta = "1.47"
 assert_cmd = "2.2"
 predicates = "3.0"
 proptest = "1.11"
+# A local https server for the managed source tests
+rcgen = { version = "0.13", default-features = false, features = ["crypto", "ring", "pem"] }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
 
 [features]
 default = ["filesystem-storage"]
diff --git a/crates/fastskill-core/src/core/managed/apply.rs b/crates/fastskill-core/src/core/managed/apply.rs
index e2135938..86ef8b65 100644
--- a/crates/fastskill-core/src/core/managed/apply.rs
+++ b/crates/fastskill-core/src/core/managed/apply.rs
@@ -10,12 +10,19 @@
 //!    collisions and removing owned entries that are no longer listed;
 //! 4. quarantines blocked content in the targets and the project skills folder, even when the
 //!    state has expired;
-//! 5. records ownership, the accepted state and what happened.
+//! 5. records ownership, the accepted state and what happened, and sends the report when the
+//!    state names one on an `https://` source's origin.
+//!
+//! An `https://` source is fetched with the token its credential command prints (decision 6).
+//! When that command fails, the last accepted state is used and the outcome says sign-in is
+//! needed. Apply makes blocking requests: call it from a plain thread.
 
 use super::config::{ManagedSettings, ManagedSource};
 use super::layout::{read_record, write_record, ManagedLayout};
 use super::quarantine::{quarantine, remove_entry, QuarantineReason, QuarantineRecord};
 use super::records::{Enrollment, EntryMode, OwnedEntry, Ownership};
+use super::remote::{run_credential_command, Remote, RemoteError};
+use super::report::{ReportDelivery, ReportSnapshot};
 use super::state::{Allowed, ManagedState};
 use super::store::ManagedStore;
 use super::OpenedState;
@@ -37,6 +44,10 @@ pub struct ApplyContext {
     /// Enroll when this user isn't enrolled yet.
     pub may_enroll: bool,
     pub now: DateTime<Utc>,
+    /// Whether a person can answer the credential command's prompts.
+    pub interactive: bool,
+    /// FastSkill's configuration folder, where the credential command runs.
+    pub config_dir: PathBuf,
 }
 
 /// Whether an apply ran.
@@ -81,6 +92,18 @@ pub struct ApplyOutcome {
     pub project_clashes: Vec<PathBuf>,
     /// Skills or entries that failed, with why.
     pub failures: Vec<(String, String)>,
+    /// The credential command failed or the source refused the token: the user must sign in.
+    #[serde(default)]
+    pub sign_in_needed: bool,
+    /// Problems that don't stop an apply, such as a `report_url` on another origin.
+    #[serde(default)]
+    pub warnings: Vec<String>,
+    /// What happened to the report, when one was due.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub report: Option<ReportDelivery>,
+    /// What the report is built from.
+    #[serde(default)]
+    pub snapshot: ReportSnapshot,
 }
 
 /// Apply the configured managed state.
@@ -117,7 +140,8 @@ pub fn apply(context: &ApplyContext) -> Result<ApplyResult, ServiceError> {
         )));
     }
 
-    let opened = fetch_and_open(context, &source, &enrollment, &mut outcome)?;
+    let remote = connect(context, &source, &mut outcome);
+    let opened = fetch_and_open(context, &source, remote.as_ref(), &enrollment, &mut outcome)?;
     enrollment.recorded = enrollment.recorded.accept(&opened.state);
     write_record(&layout.enrollment_file(), &enrollment)?;
 
@@ -126,7 +150,11 @@ pub fn apply(context: &ApplyContext) -> Result<ApplyResult, ServiceError> {
     outcome.issued_at = Some(state.issued_at);
     outcome.expires_at = Some(state.expires_at);
     outcome.expired = state.is_expired(context.now);
-    outcome.targets = targets(context);
+    let covered = covered_targets(context);
+    outcome.targets = covered.iter().map(|(dir, _)| dir.clone()).collect();
+    outcome
+        .warnings
+        .extend(super::report::state_warnings(state, &source));
 
     let mut ownership: Ownership = read_record(&layout.ownership_file())?;
     let mut run = Run {
@@ -136,7 +164,7 @@ pub fn apply(context: &ApplyContext) -> Result<ApplyResult, ServiceError> {
         outcome: &mut outcome,
     };
     if !run.outcome.expired {
-        run.deploy_listed(&source);
+        run.deploy_listed(&source, remote.as_ref());
         run.remove_unlisted();
     }
     run.sweep_targets();
@@ -156,19 +184,71 @@ pub fn apply(context: &ApplyContext) -> Result<ApplyResult, ServiceError> {
 
     write_record(&layout.ownership_file(), &ownership)?;
     outcome.completed = outcome.failures.is_empty();
+    outcome.snapshot = super::report::snapshot(context, &covered, &ownership, &outcome);
+    super::report::send(
+        context,
+        &source,
+        state,
+        remote.as_ref(),
+        &mut enrollment,
+        &mut outcome,
+    )?;
     write_record(&layout.last_apply_file(), &outcome)?;
     Ok(ApplyResult::Done(Box::new(outcome)))
 }
 
+/// The https client for this run, with the credential command's token when one is configured.
+/// A failed command leaves no token and marks sign-in as needed.
+fn connect(
+    context: &ApplyContext,
+    source: &ManagedSource,
+    outcome: &mut ApplyOutcome,
+) -> Option<Remote> {
+    let token = match (&context.settings.credential_command, source) {
+        (Some(command), ManagedSource::Https(_)) => {
+            match run_credential_command(command, &context.config_dir, context.interactive) {
+                Ok(token) => Some(token),
+                Err(error) => {
+                    outcome.sign_in_needed = true;
+                    outcome.state_problem = Some(format!("sign-in needed: {error}"));
+                    None
+                }
+            }
+        }
+        _ => None,
+    };
+    match Remote::new(source, token) {
+        Ok(remote) => Some(remote),
+        Err(error) => {
+            outcome
+                .failures
+                .push(("https".to_string(), error.to_string()));
+            None
+        }
+    }
+}
+
 /// Open the source's state and cache it, or open the cached one when the source's can't be
 /// used.
 fn fetch_and_open(
     context: &ApplyContext,
     source: &ManagedSource,
+    remote: Option<&Remote>,
     enrollment: &Enrollment,
     outcome: &mut ApplyOutcome,
 ) -> Result<OpenedState, ServiceError> {
-    let fetched = fetch(source).and_then(|bytes| {
+    let fetched = if outcome.sign_in_needed {
+        Err(RemoteError {
+            message: outcome.state_problem.clone().unwrap_or_default(),
+            sign_in: true,
+        })
+    } else {
+        fetch(source, remote)
+    };
+    if fetched.as_ref().is_err_and(|error| error.sign_in) {
+        outcome.sign_in_needed = true;
+    }
+    let fetched = fetched.map_err(ServiceError::from).and_then(|bytes| {
         super::open(&bytes, &context.settings, &enrollment.recorded, context.now)
             .map(|opened| (bytes, opened))
             .map_err(ServiceError::from)
@@ -196,23 +276,31 @@ fn fetch_and_open(
 }
 
 /// Read the state's envelope from the source.
-pub fn fetch(source: &ManagedSource) -> Result<Vec<u8>, ServiceError> {
-    match source {
-        ManagedSource::File(path) => std::fs::read(path).map_err(|error| {
-            ServiceError::Io(std::io::Error::new(
-                error.kind(),
-                format!("can't read the managed state {}: {error}", path.display()),
-            ))
+pub fn fetch(source: &ManagedSource, remote: Option<&Remote>) -> Result<Vec<u8>, RemoteError> {
+    match (source, remote) {
+        (ManagedSource::File(path), _) => std::fs::read(path).map_err(|error| RemoteError {
+            message: format!("can't read the managed state {}: {error}", path.display()),
+            sign_in: false,
+        }),
+        (ManagedSource::Https(_), Some(remote)) => remote.get_state(),
+        (ManagedSource::Https(url), None) => Err(RemoteError {
+            message: format!("can't fetch the managed state from {url}: https isn't available"),
+            sign_in: false,
         }),
-        ManagedSource::Https(url) => Err(ServiceError::InvalidOperation(format!(
-            "reading the managed state from {url} isn't supported by this FastSkill yet"
-        ))),
     }
 }
 
 /// The Agent targets: the fewest per-user skills folders that reach the configured agents, or
 /// the agents present for this user.
 pub fn targets(context: &ApplyContext) -> Vec<PathBuf> {
+    covered_targets(context)
+        .into_iter()
+        .map(|(dir, _)| dir)
+        .collect()
+}
+
+/// The Agent targets with the agents each one covers.
+pub fn covered_targets(context: &ApplyContext) -> Vec<(PathBuf, Vec<&'static str>)> {
     let detected;
     let keys: Vec<&str> = match &context.settings.targets {
         Some(targets) => targets.iter().map(String::as_str).collect(),
@@ -222,9 +310,6 @@ pub fn targets(context: &ApplyContext) -> Vec<PathBuf> {
         }
     };
     aikit_sdk::fewest_skill_dirs(&context.home, &keys)
-        .into_iter()
-        .map(|(dir, _)| dir)
-        .collect()
 }
 
 /// The digest of a target entry's content, following one link at the entry itself.
@@ -275,11 +360,11 @@ impl Run<'_> {
         }
     }
 
-    fn deploy_listed(&mut self, source: &ManagedSource) {
+    fn deploy_listed(&mut self, source: &ManagedSource, remote: Option<&Remote>) {
         let store = ManagedStore::new(&self.context.layout);
         let targets = self.outcome.targets.clone();
         for skill in &self.state.skills {
-            let published = match store.ensure(skill, source) {
+            let published = match store.ensure(skill, source, remote) {
                 Ok(path) => path,
                 Err(error) => {
                     self.fail(skill.id.clone(), error);
@@ -443,7 +528,7 @@ impl Run<'_> {
 
 /// The skill entries of a folder with their digests, leaving out hidden entries such as a
 /// deploy's temporary ones and anything that isn't a readable skill folder.
-fn entries(folder: &Path) -> Vec<(PathBuf, String)> {
+pub(crate) fn entries(folder: &Path) -> Vec<(PathBuf, String)> {
     let Ok(read) = std::fs::read_dir(folder) else {
         return Vec::new();
     };
diff --git a/crates/fastskill-core/src/core/managed/apply_tests.rs b/crates/fastskill-core/src/core/managed/apply_tests.rs
index 8bc3e91b..d1edffe1 100644
--- a/crates/fastskill-core/src/core/managed/apply_tests.rs
+++ b/crates/fastskill-core/src/core/managed/apply_tests.rs
@@ -10,27 +10,26 @@ use super::state::StateSkill;
 use super::store::{artifact_path, ManagedStore};
 use super::tests::{pinned, sign};
 use crate::core::content_digest::content_digest;
-use crate::core::service::ServiceError;
 use chrono::{DateTime, Duration, Utc};
 use serde_json::{json, Value};
 use std::io::Write;
 use std::path::{Path, PathBuf};
 
-fn now() -> DateTime<Utc> {
+pub(super) fn now() -> DateTime<Utc> {
     "2026-10-09T12:00:00Z".parse().unwrap()
 }
 
-struct Fixture {
-    _dir: tempfile::TempDir,
-    root: PathBuf,
-    state_file: PathBuf,
-    layout: ManagedLayout,
-    project: PathBuf,
-    count: usize,
+pub(super) struct Fixture {
+    pub(super) _dir: tempfile::TempDir,
+    pub(super) root: PathBuf,
+    pub(super) state_file: PathBuf,
+    pub(super) layout: ManagedLayout,
+    pub(super) project: PathBuf,
+    pub(super) count: usize,
 }
 
 impl Fixture {
-    fn new() -> Self {
+    pub(super) fn new() -> Self {
         let dir = tempfile::tempdir().unwrap();
         let root = dir.path().canonicalize().unwrap();
         std::fs::create_dir_all(root.join("home/.claude")).unwrap();
@@ -46,11 +45,11 @@ impl Fixture {
         }
     }
 
-    fn home(&self) -> PathBuf {
+    pub(super) fn home(&self) -> PathBuf {
         self.root.join("home")
     }
 
-    fn settings(&self) -> ManagedSettings {
+    pub(super) fn settings(&self) -> ManagedSettings {
         ManagedSettings {
             source: Some(ManagedSource::File(self.state_file.clone())),
             keys: vec![pinned("k1", 1)],
@@ -60,7 +59,7 @@ impl Fixture {
         }
     }
 
-    fn context(&self) -> ApplyContext {
+    pub(super) fn context(&self) -> ApplyContext {
         ApplyContext {
             layout: self.layout.clone(),
             settings: self.settings(),
@@ -68,15 +67,17 @@ impl Fixture {
             project_skills: Some(self.project.clone()),
             may_enroll: true,
             now: now(),
+            interactive: false,
+            config_dir: self.root.clone(),
         }
     }
 
-    fn target(&self) -> PathBuf {
+    pub(super) fn target(&self) -> PathBuf {
         targets(&self.context()).remove(0)
     }
 
     /// A skill folder named `id` whose body is `body`, outside any target.
-    fn folder(&mut self, id: &str, body: &str) -> PathBuf {
+    pub(super) fn folder(&mut self, id: &str, body: &str) -> PathBuf {
         self.count += 1;
         let folder = self.root.join(format!("src/{}/{id}", self.count));
         write_skill(&folder, id, body);
@@ -84,7 +85,7 @@ impl Fixture {
     }
 
     /// A listed skill with an archive in the source folder, relative to the state file.
-    fn skill(&mut self, id: &str, body: &str) -> StateSkill {
+    pub(super) fn skill(&mut self, id: &str, body: &str) -> StateSkill {
         let folder = self.folder(id, body);
         let name = format!("{id}-{}.zip", self.count);
         zip_folder(&folder, &self.root.join("source").join(&name));
@@ -95,7 +96,7 @@ impl Fixture {
         }
     }
 
-    fn publish(&self, skills: &[StateSkill], extra: Value) {
+    pub(super) fn publish(&self, skills: &[StateSkill], extra: Value) {
         let mut state = json!({
             "format_version": 1,
             "issued_at": "2026-10-09T11:00:00Z",
@@ -112,23 +113,23 @@ impl Fixture {
         std::fs::write(&self.state_file, envelope).unwrap();
     }
 
-    fn apply(&self) -> ApplyOutcome {
+    pub(super) fn apply(&self) -> ApplyOutcome {
         self.apply_with(&self.context())
     }
 
-    fn apply_with(&self, context: &ApplyContext) -> ApplyOutcome {
+    pub(super) fn apply_with(&self, context: &ApplyContext) -> ApplyOutcome {
         match apply(context).unwrap() {
             ApplyResult::Done(outcome) => *outcome,
             ApplyResult::Busy => panic!("busy"),
         }
     }
 
-    fn ownership(&self) -> Ownership {
+    pub(super) fn ownership(&self) -> Ownership {
         read_record(&self.layout.ownership_file()).unwrap()
     }
 }
 
-fn write_skill(folder: &Path, id: &str, body: &str) {
+pub(super) fn write_skill(folder: &Path, id: &str, body: &str) {
     std::fs::create_dir_all(folder).unwrap();
     std::fs::write(
         folder.join("SKILL.md"),
@@ -137,7 +138,7 @@ fn write_skill(folder: &Path, id: &str, body: &str) {
     .unwrap();
 }
 
-fn zip_folder(folder: &Path, archive: &Path) {
+pub(super) fn zip_folder(folder: &Path, archive: &Path) {
     let file = std::fs::File::create(archive).unwrap();
     let mut zip = zip::ZipWriter::new(file);
     let name = folder.file_name().unwrap().to_str().unwrap();
@@ -574,7 +575,7 @@ fn a_corrupt_store_entry_is_fetched_again() {
     assert!(store.verified(&pdf.digest).unwrap().is_none());
     assert!(!store.path(&pdf.digest).exists());
     let source = ManagedSource::File(fixture.state_file.clone());
-    let path = store.ensure(&pdf, &source).unwrap();
+    let path = store.ensure(&pdf, &source, None).unwrap();
     assert_eq!(content_digest(&path).unwrap(), pdf.digest);
 }
 
@@ -593,8 +594,22 @@ fn artifact_paths_and_https_sources() {
     assert!(artifact_path("https://example.com/a.zip", &file).is_err());
     let https = ManagedSource::parse("https://skills.example.com/state").unwrap();
     assert!(artifact_path("https://skills.example.com/a.zip", &https).is_err());
-    let error = fetch(&https).unwrap_err();
-    assert!(matches!(error, ServiceError::InvalidOperation(_)));
+    let error = fetch(&https, None).unwrap_err();
+    assert!(error.message.contains("https isn't available"), "{error}");
+    assert!(!error.sign_in);
+    let listed = StateSkill {
+        id: "pdf".to_string(),
+        digest: format!("sha256-tree-v2:{}", "0".repeat(64)),
+        artifact: "https://skills.example.com/a.zip".to_string(),
+    };
+    let fixture = Fixture::new();
+    let error = ManagedStore::new(&fixture.layout)
+        .ensure(&listed, &https, None)
+        .unwrap_err();
+    assert!(
+        error.to_string().contains("https isn't available"),
+        "{error}"
+    );
 }
 
 #[test]
diff --git a/crates/fastskill-core/src/core/managed/enrollment.rs b/crates/fastskill-core/src/core/managed/enrollment.rs
index ef9941d6..b1faf75e 100644
--- a/crates/fastskill-core/src/core/managed/enrollment.rs
+++ b/crates/fastskill-core/src/core/managed/enrollment.rs
@@ -2,11 +2,12 @@
 //! 17).
 
 use super::apply::{apply, entry_digest, ApplyContext, ApplyOutcome, ApplyResult};
-use super::config::ManagedSettings;
+use super::config::{ManagedSettings, ManagedSource};
 use super::layout::{read_record, write_record, ManagedLayout};
 use super::quarantine::{self, quarantine, remove_entry, QuarantineReason, QuarantineRecord};
 use super::records::{Enrollment, OwnedEntry, Ownership};
-use super::state::Recorded;
+use super::report::{self, Report, ReportInput};
+use super::state::{ManagedState, Recorded};
 use crate::core::service::ServiceError;
 use chrono::{DateTime, Utc};
 use std::path::{Path, PathBuf};
@@ -30,6 +31,7 @@ pub fn enroll(context: &ApplyContext) -> Result<ApplyResult, ServiceError> {
         let mut enrollment = Enrollment::new(source.as_str(), context.now);
         if previous.is_enrolled() && source.matches(&previous.source) {
             enrollment.machine_id = previous.machine_id;
+            enrollment.report_sequence = previous.report_sequence;
             enrollment.recorded = Recorded {
                 subject: None,
                 highest_issued_at: previous.recorded.highest_issued_at,
@@ -136,6 +138,14 @@ pub struct ManagedStatus {
     pub owned: Vec<OwnedEntry>,
     pub last_apply: Option<ApplyOutcome>,
     pub quarantine: Vec<QuarantineRecord>,
+    /// The last apply found that the user must sign in (decision 6).
+    pub sign_in_needed: bool,
+    /// State fields this source ignores, each with why (decision 21).
+    pub ignored: Vec<String>,
+    /// The body the next report would carry, built from the last apply.
+    pub report: Option<Report>,
+    /// Where reports go, or why none is sent.
+    pub report_note: Option<String>,
 }
 
 /// Read the status from the records and the cached state, changing nothing.
@@ -153,10 +163,14 @@ pub fn status(
             .as_ref()
             .map(|source| source.as_str().to_string()),
         owned: ownership.entries,
+        sign_in_needed: last_apply.sign_in_needed,
         last_apply: last_apply.applied_at.is_some().then_some(last_apply),
         quarantine: quarantine::list(layout)?,
         ..ManagedStatus::default()
     };
+    let Some(source) = settings.source.as_ref() else {
+        return Ok(status);
+    };
     if enrollment.is_enrolled() {
         match open_cached(layout, settings, &enrollment, now) {
             Ok(opened) => {
@@ -164,14 +178,54 @@ pub fn status(
                 status.issued_at = Some(opened.state.issued_at);
                 status.expires_at = Some(opened.state.expires_at);
                 status.expired = opened.state.is_expired(now);
+                status.ignored = ignored_fields(&opened.state, source);
+                status.report_note = Some(
+                    match report::destination(opened.state.report_url.as_deref(), source) {
+                        Ok(Some(url)) => format!("sent to {url}"),
+                        Ok(None) => "none: the state names no report_url".to_string(),
+                        Err(problem) => format!("none: {problem}"),
+                    },
+                );
             }
             Err(problem) => status.state_problem = Some(problem),
         }
+        let last = status.last_apply.clone().unwrap_or_default();
+        status.report = Some(Report::build(ReportInput {
+            source,
+            enrollment: &enrollment,
+            issued_at: last.issued_at,
+            completed: last.completed,
+            snapshot: &last.snapshot,
+            quarantine: &status.quarantine,
+            refusals: &report::refusals(layout)?,
+        }));
         status.enrollment = Some(enrollment);
     }
     Ok(status)
 }
 
+/// The fields a file source's state sets that only an `https://` source honors (decision 21).
+fn ignored_fields(state: &ManagedState, source: &ManagedSource) -> Vec<String> {
+    if !matches!(source, ManagedSource::File(_)) {
+        return Vec::new();
+    }
+    let mut ignored = Vec::new();
+    if state.editable.is_some() {
+        ignored.push(
+            "editable: a file source always uses blocked-only, so editable local skills skip \
+             the allow-list"
+                .to_string(),
+        );
+    }
+    if state.request_url.is_some() {
+        ignored.push("request_url: a file source has no origin to send people to".to_string());
+    }
+    if state.report_url.is_some() {
+        ignored.push("report_url: a file source never gets a report".to_string());
+    }
+    ignored
+}
+
 /// Verify the cached state again, or say why it can't be used.
 pub(crate) fn open_cached(
     layout: &ManagedLayout,
diff --git a/crates/fastskill-core/src/core/managed/gate.rs b/crates/fastskill-core/src/core/managed/gate.rs
index 61be410c..dc2832d7 100644
--- a/crates/fastskill-core/src/core/managed/gate.rs
+++ b/crates/fastskill-core/src/core/managed/gate.rs
@@ -159,10 +159,37 @@ impl Situation {
                  {APPLY_HINT}",
                 state.expires_at
             ))),
-            Self::State { state, source, .. } => check_state(state, source, candidate),
+            Self::State { state, source, .. } => {
+                check_state(state, source, candidate).map_err(|refusal| refused(refusal.message))
+            }
         }
     }
 
+    /// [`Situation::check`], keeping a refusal of a known digest in `layout` for the next
+    /// report when the source is `https://` (decisions 15 and 21).
+    pub fn check_recording(
+        &self,
+        candidate: Candidate<'_>,
+        layout: &ManagedLayout,
+    ) -> Result<(), ServiceError> {
+        let Self::State {
+            state,
+            source: source @ ManagedSource::Https(_),
+            expired: false,
+        } = self
+        else {
+            return self.check(candidate);
+        };
+        check_state(state, source, candidate).map_err(|refusal| {
+            if let Some(digest) = &refusal.digest {
+                if let Err(error) = super::report::record_refusal(layout, digest) {
+                    tracing::warn!("couldn't keep the refusal for the managed report: {error}");
+                }
+            }
+            refused(refusal.message)
+        })
+    }
+
     /// Check several candidates, stopping at the first refusal.
     pub fn check_all<'a>(
         &self,
@@ -221,28 +248,51 @@ impl Situation {
     }
 }
 
+/// Why a candidate was refused, with its digest when it was known.
+struct Refusal {
+    message: String,
+    digest: Option<String>,
+}
+
+impl Refusal {
+    fn new(message: String, digest: Option<&str>) -> Self {
+        Self {
+            message,
+            digest: digest.map(str::to_string),
+        }
+    }
+}
+
 fn check_state(
     state: &ManagedState,
     source: &ManagedSource,
     candidate: Candidate<'_>,
-) -> Result<(), ServiceError> {
+) -> Result<(), Refusal> {
     if candidate.editable
         && state.allowed == Allowed::Listed
         && state.editable(source) == Editable::Refused
     {
-        return Err(refused(format!(
-            "{} is an editable local skill, and the managed state refuses those",
-            candidate.id
-        )));
+        return Err(Refusal::new(
+            format!(
+                "{} is an editable local skill, and the managed state refuses those",
+                candidate.id
+            ),
+            None,
+        ));
     }
     let digest = match (candidate.digest, candidate.path) {
         (Some(digest), _) => digest.to_string(),
-        (None, Some(path)) => digest_of(path)?,
+        (None, Some(path)) => {
+            digest_of(path).map_err(|error| Refusal::new(error.to_string(), None))?
+        }
         (None, None) => {
-            return Err(refused(format!(
-                "{} has no content digest to check against the managed state",
-                candidate.id
-            )))
+            return Err(Refusal::new(
+                format!(
+                    "{} has no content digest to check against the managed state",
+                    candidate.id
+                ),
+                None,
+            ))
         }
     };
     if let Some(blocked) = state.blocked(&digest) {
@@ -251,20 +301,26 @@ fn check_state(
             .as_deref()
             .map(|message| format!(": {message}"))
             .unwrap_or_default();
-        return Err(refused(format!(
-            "{} ({digest}) is blocked by the managed state{message}",
-            candidate.id
-        )));
+        return Err(Refusal::new(
+            format!(
+                "{} ({digest}) is blocked by the managed state{message}",
+                candidate.id
+            ),
+            Some(&digest),
+        ));
     }
     if not_allowed(state, source, &digest, candidate.editable) {
         let link = state
             .request_link(source, &digest)
             .map(|link| format!("; request it at {link}"))
             .unwrap_or_default();
-        return Err(refused(format!(
-            "{} ({digest}) isn't allowed by the managed state{link}",
-            candidate.id
-        )));
+        return Err(Refusal::new(
+            format!(
+                "{} ({digest}) isn't allowed by the managed state{link}",
+                candidate.id
+            ),
+            Some(&digest),
+        ));
     }
     Ok(())
 }
@@ -312,9 +368,10 @@ impl ManagedGate {
         }
     }
 
-    /// Check one candidate against the situation now.
+    /// Check one candidate against the situation now. The current user's gate keeps refusals
+    /// for the next report; a fixed one doesn't.
     pub fn check(&self, candidate: Candidate<'_>) -> Result<(), ServiceError> {
-        self.situation().check(candidate)
+        self.check_all([candidate])
     }
 
     /// Check several candidates against one reading of the situation.
@@ -322,7 +379,17 @@ impl ManagedGate {
         &self,
         candidates: impl IntoIterator<Item = Candidate<'a>>,
     ) -> Result<(), ServiceError> {
-        self.situation().check_all(candidates)
+        let situation = self.situation();
+        let layout = match &self.fixed {
+            Some(_) => None,
+            None => ManagedLayout::for_current_user().ok(),
+        };
+        candidates
+            .into_iter()
+            .try_for_each(|candidate| match &layout {
+                Some(layout) => situation.check_recording(candidate, layout),
+                None => situation.check(candidate),
+            })
     }
 }
 
diff --git a/crates/fastskill-core/src/core/managed/layout.rs b/crates/fastskill-core/src/core/managed/layout.rs
index 8660e8ca..2013716f 100644
--- a/crates/fastskill-core/src/core/managed/layout.rs
+++ b/crates/fastskill-core/src/core/managed/layout.rs
@@ -8,6 +8,7 @@
 //!   state.dsse        the last accepted envelope
 //!   ownership.json    every target entry FastSkill created
 //!   last-apply.json   what the last apply did
+//!   refusals.json     refused installs not yet reported, with refusals.lock
 //!   staging/          downloads and extraction, private to the user
 //!   store/<digest>/   published skills, never modified after publication
 //! <data>/quarantine/<time>-<n>/
@@ -57,6 +58,12 @@ impl ManagedLayout {
     pub fn last_apply_file(&self) -> PathBuf {
         self.managed().join("last-apply.json")
     }
+    pub fn refusals_file(&self) -> PathBuf {
+        self.managed().join("refusals.json")
+    }
+    pub fn refusals_lock(&self) -> PathBuf {
+        self.managed().join("refusals.lock")
+    }
     pub fn staging(&self) -> PathBuf {
         self.managed().join("staging")
     }
diff --git a/crates/fastskill-core/src/core/managed/mod.rs b/crates/fastskill-core/src/core/managed/mod.rs
index 4a3ad096..319ff54a 100644
--- a/crates/fastskill-core/src/core/managed/mod.rs
+++ b/crates/fastskill-core/src/core/managed/mod.rs
@@ -19,6 +19,10 @@
 //! - [`gate`]: the install gate, the two managed reconciliation statuses and what a command may
 //!   do without a valid state (decisions 4, 13 and 14).
 //!
+//! - [`remote`]: fetching an `https://` source and its artifacts with the credential
+//!   command's token, and [`report`]: the fixed report an apply sends (decisions 5, 6, 15 and
+//!   21).
+//!
 //! [`open`] is the one entry point that turns envelope bytes into a state FastSkill may use.
 
 pub mod apply;
@@ -29,8 +33,12 @@ pub mod gate;
 pub mod layout;
 pub mod quarantine;
 pub mod records;
+pub mod remote;
+pub mod report;
 pub mod state;
 pub mod store;
+#[cfg(test)]
+mod test_https;
 
 #[cfg(test)]
 mod apply_tests;
@@ -45,6 +53,7 @@ pub use gate::{Candidate, CommandPolicy, ManagedGate, ManagedSkillStatus, Situat
 pub use layout::{ApplyLock, ManagedLayout};
 pub use quarantine::{QuarantineReason, QuarantineRecord};
 pub use records::{Enrollment, EntryMode, OwnedEntry, Ownership};
+pub use report::{set_current_command, Report, ReportDelivery};
 pub use state::{
     Allowed, BlockedDigest, Editable, ManagedState, Recorded, StateSkill, FORMAT_VERSION,
     MAX_CLOCK_SKEW,
diff --git a/crates/fastskill-core/src/core/managed/records.rs b/crates/fastskill-core/src/core/managed/records.rs
index 5f59a010..3fa0dd47 100644
--- a/crates/fastskill-core/src/core/managed/records.rs
+++ b/crates/fastskill-core/src/core/managed/records.rs
@@ -14,6 +14,9 @@ pub struct Enrollment {
     /// A random id for this user's reports, never derived from hardware (decision 15).
     pub machine_id: String,
     pub enrolled_at: Option<DateTime<Utc>>,
+    /// The sequence number of the last report built for this machine id (decision 15).
+    #[serde(default)]
+    pub report_sequence: u64,
     #[serde(flatten)]
     pub recorded: Recorded,
 }
@@ -25,6 +28,7 @@ impl Enrollment {
             source: source.to_string(),
             machine_id: uuid::Uuid::new_v4().to_string(),
             enrolled_at: Some(now),
+            report_sequence: 0,
             recorded: Recorded::default(),
         }
     }
diff --git a/crates/fastskill-core/src/core/managed/remote.rs b/crates/fastskill-core/src/core/managed/remote.rs
new file mode 100644
index 00000000..825475b1
--- /dev/null
+++ b/crates/fastskill-core/src/core/managed/remote.rs
@@ -0,0 +1,370 @@
+//! Fetching over `https://`: the credential command, where its token may go, redirects and size
+//! limits (ADR-0016 decisions 1, 5, 6 and 15).
+//!
+//! The token is held only for one command run. It is never stored, logged, printed or looked
+//! at, and it is sent only to the managed source's origin. A redirect to another origin drops it,
+//! and a redirect to anything but `https://` is refused.
+//!
+//! Requests are blocking: call this from a plain thread, not from inside an async task.
+
+use super::config::ManagedSource;
+use reqwest::blocking::{Client, RequestBuilder, Response};
+use reqwest::header::{HeaderValue, AUTHORIZATION};
+use std::io::Read;
+use std::path::Path;
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+/// How long the credential command may run.
+pub const CREDENTIAL_TIMEOUT: Duration = Duration::from_secs(30);
+/// The most the credential command may print.
+pub const MAX_CREDENTIAL_OUTPUT: usize = 16 * 1024;
+/// The largest managed state envelope accepted.
+pub const MAX_STATE_BYTES: u64 = 8 * 1024 * 1024;
+/// The largest skill artifact accepted.
+pub const MAX_ARTIFACT_BYTES: u64 = 512 * 1024 * 1024;
+/// The environment variable that tells the credential command no one can answer a prompt.
+pub const INTERACTIVE_ENV: &str = "FASTSKILL_INTERACTIVE";
+
+const MAX_REDIRECTS: usize = 10;
+const CONNECT_TIMEOUT: Duration = Duration::from_secs(30);
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(600);
+
+/// Why a fetch failed. `sign_in` says the user must sign in again: the credential command
+/// failed, or the source answered 401.
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+#[error("{message}")]
+pub struct RemoteError {
+    pub message: String,
+    pub sign_in: bool,
+}
+
+impl RemoteError {
+    fn failed(message: impl Into<String>) -> Self {
+        Self {
+            message: message.into(),
+            sign_in: false,
+        }
+    }
+
+    fn sign_in(message: impl Into<String>) -> Self {
+        Self {
+            message: message.into(),
+            sign_in: true,
+        }
+    }
+}
+
+impl From<RemoteError> for crate::core::service::ServiceError {
+    fn from(error: RemoteError) -> Self {
+        Self::InvalidOperation(error.message)
+    }
+}
+
+/// A token from the credential command. Its `Debug` form never shows it.
+#[derive(Clone)]
+pub struct Token(HeaderValue);
+
+impl std::fmt::Debug for Token {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("Token(..)")
+    }
+}
+
+/// Run the credential command and take the first line it prints as the token.
+///
+/// The command runs without a shell, from `working_dir`, for at most [`CREDENTIAL_TIMEOUT`]. Its
+/// standard error reaches the terminal when `interactive`, so it can prompt; otherwise it's
+/// discarded and [`INTERACTIVE_ENV`] is set to `0`. Errors never include what it printed.
+pub fn run_credential_command(
+    command: &[String],
+    working_dir: &Path,
+    interactive: bool,
+) -> Result<Token, RemoteError> {
+    let Some((program, args)) = command.split_first() else {
+        return Err(RemoteError::sign_in("the credential command is empty"));
+    };
+    let mut process = Command::new(program);
+    process.args(args).stdout(Stdio::piped());
+    if working_dir.is_dir() {
+        process.current_dir(working_dir);
+    } else {
+        process.current_dir(std::env::temp_dir());
+    }
+    if interactive {
+        process.stdin(Stdio::inherit()).stderr(Stdio::inherit());
+    } else {
+        process
+            .stdin(Stdio::null())
+            .stderr(Stdio::null())
+            .env(INTERACTIVE_ENV, "0");
+    }
+    let mut child = process.spawn().map_err(|error| {
+        RemoteError::sign_in(format!(
+            "the credential command {program:?} couldn't start: {error}"
+        ))
+    })?;
+    let stdout = child.stdout.take();
+    let reader = std::thread::spawn(move || {
+        let mut output = Vec::new();
+        if let Some(stdout) = stdout {
+            // One byte over the limit is enough to know it's too much.
+            let _ = stdout
+                .take(MAX_CREDENTIAL_OUTPUT as u64 + 1)
+                .read_to_end(&mut output);
+        }
+        output
+    });
+
+    let deadline = Instant::now() + CREDENTIAL_TIMEOUT;
+    let mut reader = Some(reader);
+    let mut output = None;
+    let status = loop {
+        if reader.as_ref().is_some_and(|reader| reader.is_finished()) {
+            let read = reader.take().and_then(|reader| reader.join().ok());
+            if read
+                .as_ref()
+                .is_some_and(|read| read.len() > MAX_CREDENTIAL_OUTPUT)
+            {
+                let _ = child.kill();
+                let _ = child.wait();
+                return Err(too_much_output());
+            }
+            output = read;
+        }
+        match child.try_wait() {
+            Ok(Some(status)) => break status,
+            Ok(None) if Instant::now() >= deadline => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return Err(RemoteError::sign_in(format!(
+                    "the credential command didn't finish within {} seconds",
+                    CREDENTIAL_TIMEOUT.as_secs()
+                )));
+            }
+            Ok(None) => std::thread::sleep(Duration::from_millis(20)),
+            Err(error) => {
+                let _ = child.kill();
+                return Err(RemoteError::sign_in(format!(
+                    "the credential command couldn't be waited for: {error}"
+                )));
+            }
+        }
+    };
+    let output = match reader {
+        Some(reader) => reader.join().unwrap_or_default(),
+        None => output.unwrap_or_default(),
+    };
+    if !status.success() {
+        return Err(RemoteError::sign_in(format!(
+            "the credential command exited with {status}"
+        )));
+    }
+    if output.len() > MAX_CREDENTIAL_OUTPUT {
+        return Err(too_much_output());
+    }
+    let first = output.split(|byte| *byte == b'\n').next().unwrap_or(&[]);
+    let first = first.strip_suffix(b"\r").unwrap_or(first);
+    if first.is_empty() {
+        return Err(RemoteError::sign_in(
+            "the credential command printed no token",
+        ));
+    }
+    let mut value = std::str::from_utf8(first)
+        .ok()
+        .and_then(|token| HeaderValue::from_str(&format!("Bearer {token}")).ok())
+        .ok_or_else(|| {
+            RemoteError::sign_in("the credential command printed a line that can't be a token")
+        })?;
+    value.set_sensitive(true);
+    Ok(Token(value))
+}
+
+fn too_much_output() -> RemoteError {
+    RemoteError::sign_in(format!(
+        "the credential command printed more than {} KiB",
+        MAX_CREDENTIAL_OUTPUT / 1024
+    ))
+}
+
+/// An https client for one command run, holding the token for the source's origin.
+#[derive(Debug)]
+pub struct Remote {
+    client: Client,
+    source: ManagedSource,
+    token: Option<Token>,
+}
+
+impl Remote {
+    /// A client for `source`. `token` goes only to the source's origin.
+    pub fn new(source: &ManagedSource, token: Option<Token>) -> Result<Self, RemoteError> {
+        let policy = reqwest::redirect::Policy::custom(|attempt| {
+            if attempt.url().scheme() != "https" {
+                let message = format!(
+                    "refused a redirect to {}: only https:// is followed",
+                    attempt.url()
+                );
+                attempt.error(message)
+            } else if attempt.previous().len() >= MAX_REDIRECTS {
+                attempt.error("too many redirects")
+            } else {
+                // reqwest drops Authorization when the scheme, host or port changes.
+                attempt.follow()
+            }
+        });
+        let builder = Client::builder()
+            .redirect(policy)
+            .https_only(true)
+            .connect_timeout(CONNECT_TIMEOUT)
+            .timeout(REQUEST_TIMEOUT)
+            .user_agent(concat!("fastskill/", env!("CARGO_PKG_VERSION")));
+        let client = test_roots::add(builder)
+            .build()
+            .map_err(|error| RemoteError::failed(format!("can't set up https: {error}")))?;
+        Ok(Self {
+            client,
+            source: source.clone(),
+            token,
+        })
+    }
+
+    /// Whether a token is held.
+    pub fn has_token(&self) -> bool {
+        self.token.is_some()
+    }
+
+    /// The source's envelope.
+    pub fn get_state(&self) -> Result<Vec<u8>, RemoteError> {
+        let ManagedSource::Https(url) = &self.source else {
+            return Err(RemoteError::failed("the managed source isn't https://"));
+        };
+        let response = self.send(
+            self.request(reqwest::Method::GET, url.as_str()),
+            "the managed state",
+        )?;
+        let mut bytes = Vec::new();
+        read_limited(response, MAX_STATE_BYTES, &mut bytes, "the managed state")?;
+        Ok(bytes)
+    }
+
+    /// Download `url` into the file at `into`.
+    pub fn download(&self, url: &str, into: &Path) -> Result<(), RemoteError> {
+        let what = format!("the artifact {url}");
+        let response = self.send(self.request(reqwest::Method::GET, url), &what)?;
+        let mut file = std::fs::File::create(into)
+            .map_err(|error| RemoteError::failed(format!("can't write {what}: {error}")))?;
+        read_limited(response, MAX_ARTIFACT_BYTES, &mut file, &what)
+    }
+
+    /// POST a JSON body to `url`; `Ok` when the source accepted it.
+    pub fn post_json(&self, url: &str, body: Vec<u8>) -> Result<(), RemoteError> {
+        let request = self
+            .request(reqwest::Method::POST, url)
+            .header(reqwest::header::CONTENT_TYPE, "application/json")
+            .body(body);
+        self.send(request, "the report").map(drop)
+    }
+
+    fn request(&self, method: reqwest::Method, url: &str) -> RequestBuilder {
+        let request = self.client.request(method, url);
+        match &self.token {
+            Some(Token(value)) if self.source.same_origin(url) => {
+                request.header(AUTHORIZATION, value.clone())
+            }
+            _ => request,
+        }
+    }
+
+    fn send(&self, request: RequestBuilder, what: &str) -> Result<Response, RemoteError> {
+        let response = request.send().map_err(|error| {
+            RemoteError::failed(format!("can't fetch {what}: {}", chain(&error)))
+        })?;
+        let status = response.status();
+        if status.is_success() {
+            return Ok(response);
+        }
+        let message = format!("fetching {what} failed with HTTP {status}");
+        if status == reqwest::StatusCode::UNAUTHORIZED {
+            Err(RemoteError::sign_in(message))
+        } else {
+            Err(RemoteError::failed(message))
+        }
+    }
+}
+
+/// Copy at most `limit` bytes of `response` into `into`, refusing anything longer.
+fn read_limited(
+    response: Response,
+    limit: u64,
+    into: &mut impl std::io::Write,
+    what: &str,
+) -> Result<(), RemoteError> {
+    if response
+        .content_length()
+        .is_some_and(|length| length > limit)
+    {
+        return Err(too_large(what, limit));
+    }
+    let copied = std::io::copy(&mut response.take(limit + 1), into)
+        .map_err(|error| RemoteError::failed(format!("can't read {what}: {error}")))?;
+    if copied > limit {
+        return Err(too_large(what, limit));
+    }
+    Ok(())
+}
+
+fn too_large(what: &str, limit: u64) -> RemoteError {
+    RemoteError::failed(format!(
+        "{what} is larger than {} MiB",
+        limit / (1024 * 1024)
+    ))
+}
+
+/// An error and its causes, which is where reqwest puts the useful part.
+fn chain(error: &dyn std::error::Error) -> String {
+    let mut text = error.to_string();
+    let mut cause = error.source();
+    while let Some(next) = cause {
+        text.push_str(": ");
+        text.push_str(&next.to_string());
+        cause = next.source();
+    }
+    text
+}
+
+/// Extra trusted roots, which only tests set, for their local https servers.
+mod test_roots {
+    use reqwest::blocking::ClientBuilder;
+
+    #[cfg(not(test))]
+    pub fn add(builder: ClientBuilder) -> ClientBuilder {
+        builder
+    }
+
+    #[cfg(test)]
+    thread_local! {
+        static ROOT: std::cell::RefCell<Option<reqwest::Certificate>> =
+            const { std::cell::RefCell::new(None) };
+    }
+
+    #[cfg(test)]
+    pub fn add(builder: ClientBuilder) -> ClientBuilder {
+        match ROOT.with(|root| root.borrow().clone()) {
+            Some(root) => builder.add_root_certificate(root),
+            None => builder,
+        }
+    }
+
+    /// Trust `root` for clients built on this thread.
+    #[cfg(test)]
+    pub fn trust(root: reqwest::Certificate) {
+        ROOT.with(|slot| *slot.borrow_mut() = Some(root));
+    }
+}
+
+#[cfg(test)]
+pub(crate) use test_roots::trust as trust_test_root;
+
+#[cfg(test)]
+#[path = "remote_tests.rs"]
+mod tests;
diff --git a/crates/fastskill-core/src/core/managed/remote_tests.rs b/crates/fastskill-core/src/core/managed/remote_tests.rs
new file mode 100644
index 00000000..b5ea00fa
--- /dev/null
+++ b/crates/fastskill-core/src/core/managed/remote_tests.rs
@@ -0,0 +1,231 @@
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use super::*;
+use crate::core::managed::test_https::{Route, TestCa, TestServer};
+
+fn source(server: &TestServer) -> ManagedSource {
+    ManagedSource::parse(&server.url("/state")).unwrap()
+}
+
+#[cfg(unix)]
+fn shell(script: &str) -> Vec<String> {
+    vec!["sh".to_string(), "-c".to_string(), script.to_string()]
+}
+
+#[cfg(unix)]
+fn token(script: &str, interactive: bool) -> Result<Token, RemoteError> {
+    run_credential_command(&shell(script), &std::env::temp_dir(), interactive)
+}
+
+#[test]
+#[cfg(unix)]
+fn the_token_is_the_first_line_and_goes_only_to_the_source_origin() {
+    let ca = TestCa::trusted();
+    let origin = TestServer::start(&ca);
+    let other = TestServer::start(&ca);
+    origin.route("/state", Route::Body(b"envelope".to_vec()));
+    origin.route("/a.zip", Route::Body(b"same origin".to_vec()));
+    other.route("/b.zip", Route::Body(b"other origin".to_vec()));
+    let token = token("printf 'secret-token\\r\\nignored\\n'", true).unwrap();
+    assert_eq!(format!("{token:?}"), "Token(..)");
+    let remote = Remote::new(&source(&origin), Some(token)).unwrap();
+    assert!(remote.has_token());
+
+    assert_eq!(remote.get_state().unwrap(), b"envelope");
+    let dir = tempfile::tempdir().unwrap();
+    remote
+        .download(&origin.url("/a.zip"), &dir.path().join("a"))
+        .unwrap();
+    remote
+        .download(&other.url("/b.zip"), &dir.path().join("b"))
+        .unwrap();
+    assert_eq!(
+        std::fs::read(dir.path().join("b")).unwrap(),
+        b"other origin"
+    );
+
+    let bearer = Some("Bearer secret-token".to_string());
+    assert_eq!(origin.seen_at("/state")[0].authorization, bearer);
+    assert_eq!(origin.seen_at("/a.zip")[0].authorization, bearer);
+    assert_eq!(other.seen_at("/b.zip")[0].authorization, None);
+}
+
+#[test]
+#[cfg(unix)]
+fn a_redirect_to_another_origin_drops_the_token() {
+    let ca = TestCa::trusted();
+    let origin = TestServer::start(&ca);
+    let other = TestServer::start(&ca);
+    origin.route("/state", Route::Redirect(other.url("/moved")));
+    other.route("/moved", Route::Body(b"envelope".to_vec()));
+    let remote = Remote::new(&source(&origin), Some(token("echo t", false).unwrap())).unwrap();
+    assert_eq!(remote.get_state().unwrap(), b"envelope");
+    assert_eq!(
+        origin.seen_at("/state")[0].authorization.as_deref(),
+        Some("Bearer t")
+    );
+    assert_eq!(other.seen_at("/moved")[0].authorization, None);
+}
+
+#[test]
+fn a_redirect_to_http_is_refused() {
+    let ca = TestCa::trusted();
+    let origin = TestServer::start(&ca);
+    origin.route(
+        "/state",
+        Route::Redirect(origin.url("/plain").replace("https://", "http://")),
+    );
+    let error = Remote::new(&source(&origin), None)
+        .unwrap()
+        .get_state()
+        .unwrap_err();
+    assert!(!error.sign_in);
+    assert!(
+        error.message.contains("only https:// is followed"),
+        "{error}"
+    );
+    assert!(origin.seen_at("/plain").is_empty());
+}
+
+#[test]
+fn too_many_redirects_stop() {
+    let ca = TestCa::trusted();
+    let origin = TestServer::start(&ca);
+    origin.route("/state", Route::Redirect(origin.url("/state")));
+    let error = Remote::new(&source(&origin), None)
+        .unwrap()
+        .get_state()
+        .unwrap_err();
+    assert!(error.message.contains("too many redirects"), "{error}");
+}
+
+#[test]
+fn a_401_means_sign_in_and_other_failures_do_not() {
+    let ca = TestCa::trusted();
+    let origin = TestServer::start(&ca);
+    origin.route("/state", Route::Status(401));
+    origin.route("/report", Route::Status(500));
+    let remote = Remote::new(&source(&origin), None).unwrap();
+    assert!(!remote.has_token());
+    let error = remote.get_state().unwrap_err();
+    assert!(error.sign_in);
+    assert!(error.message.contains("401"), "{error}");
+    let error = remote
+        .post_json(&origin.url("/report"), b"{}".to_vec())
+        .unwrap_err();
+    assert!(!error.sign_in);
+    assert!(error.message.contains("500"), "{error}");
+    let seen = origin.seen_at("/report");
+    assert_eq!(seen[0].method, "POST");
+    assert_eq!(seen[0].body, b"{}");
+    let missing = remote
+        .download(
+            &origin.url("/missing.zip"),
+            &std::env::temp_dir().join("never"),
+        )
+        .unwrap_err();
+    assert!(missing.message.contains("404"), "{missing}");
+}
+
+#[test]
+fn bodies_over_the_limit_are_refused() {
+    let ca = TestCa::trusted();
+    let origin = TestServer::start(&ca);
+    origin.route("/big", Route::Body(vec![b'x'; 64]));
+    let remote = Remote::new(&source(&origin), None).unwrap();
+    let fetch = || {
+        remote
+            .send(
+                remote.request(reqwest::Method::GET, &origin.url("/big")),
+                "it",
+            )
+            .unwrap()
+    };
+    let error = read_limited(fetch(), 16, &mut Vec::new(), "the body").unwrap_err();
+    assert!(error.message.contains("larger than"), "{error}");
+    let mut body = Vec::new();
+    read_limited(fetch(), 64, &mut body, "the body").unwrap();
+    assert_eq!(body.len(), 64);
+}
+
+#[test]
+fn unreachable_sources_and_file_sources_fail_without_sign_in() {
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    let port = listener.local_addr().unwrap().port();
+    drop(listener);
+    let closed = ManagedSource::parse(&format!("https://localhost:{port}/state")).unwrap();
+    let error = Remote::new(&closed, None).unwrap().get_state().unwrap_err();
+    assert!(!error.sign_in);
+    assert!(
+        error.message.starts_with("can't fetch the managed state"),
+        "{error}"
+    );
+
+    let file = ManagedSource::File(std::env::temp_dir().join("state.dsse"));
+    let error = Remote::new(&file, None).unwrap().get_state().unwrap_err();
+    assert!(error.message.contains("isn't https://"), "{error}");
+    let service: crate::core::service::ServiceError = error.into();
+    assert!(matches!(
+        service,
+        crate::core::service::ServiceError::InvalidOperation(_)
+    ));
+}
+
+#[test]
+fn a_credential_command_that_cannot_start_needs_sign_in() {
+    let error = run_credential_command(&[], &std::env::temp_dir(), false).unwrap_err();
+    assert!(error.sign_in);
+    assert!(error.message.contains("empty"), "{error}");
+    let missing = vec!["fastskill-no-such-credential-helper".to_string()];
+    let error = run_credential_command(&missing, Path::new("/no/such/folder"), false).unwrap_err();
+    assert!(error.sign_in);
+    assert!(error.message.contains("couldn't start"), "{error}");
+}
+
+#[test]
+#[cfg(unix)]
+fn credential_command_failures_never_show_what_it_printed() {
+    for (script, expected) in [
+        ("echo leaked; exit 3", "exited with"),
+        ("printf ''", "printed no token"),
+        ("printf '\\n'", "printed no token"),
+        ("head -c 20000 /dev/zero | tr '\\0' 'a'", "more than 16 KiB"),
+        ("printf 'bad\\001token'", "can't be a token"),
+    ] {
+        let error = token(script, false).unwrap_err();
+        assert!(error.sign_in, "{script}");
+        assert!(error.message.contains(expected), "{script}: {error}");
+        assert!(!error.message.contains("leaked"), "{error}");
+    }
+}
+
+#[test]
+#[cfg(unix)]
+fn credential_command_output_over_the_limit_stops_a_command_that_keeps_running() {
+    let started = Instant::now();
+    let error = token("yes leaked", false).unwrap_err();
+    assert!(error.message.contains("more than 16 KiB"), "{error}");
+    assert!(started.elapsed() < CREDENTIAL_TIMEOUT);
+}
+
+#[test]
+#[cfg(unix)]
+fn the_credential_command_runs_in_the_configuration_folder_and_knows_when_no_one_can_answer() {
+    let ca = TestCa::trusted();
+    let origin = TestServer::start(&ca);
+    origin.route("/state", Route::Body(Vec::new()));
+    let folder = tempfile::tempdir().unwrap();
+    std::fs::write(folder.path().join("marker"), "here").unwrap();
+    let script = format!("cat marker; echo \"-${{{INTERACTIVE_ENV}:-unset}}\"");
+    for (interactive, expected) in [(false, "Bearer here-0"), (true, "Bearer here-unset")] {
+        let command = shell(&format!("printf '%s' \"$({script})\" | tr -d '\\n'"));
+        let token = run_credential_command(&command, folder.path(), interactive).unwrap();
+        let remote = Remote::new(&source(&origin), Some(token)).unwrap();
+        remote.get_state().unwrap();
+        let seen = origin.seen_at("/state");
+        assert_eq!(
+            seen.last().unwrap().authorization.as_deref(),
+            Some(expected)
+        );
+    }
+}
diff --git a/crates/fastskill-core/src/core/managed/report.rs b/crates/fastskill-core/src/core/managed/report.rs
new file mode 100644
index 00000000..018efbfb
--- /dev/null
+++ b/crates/fastskill-core/src/core/managed/report.rs
@@ -0,0 +1,459 @@
+//! The report an apply sends to the state's `report_url`, and the refusals it carries
+//! (ADR-0016 decisions 6, 15 and 21).
+//!
+//! The body is fixed: ids, digests, outcomes, agent names and counts, never prompts, file
+//! contents, paths, usernames, project names, repository URLs or usage. `managed status --json
+//! --report` prints the same body without sending it.
+
+use super::apply::{entries, ApplyContext, ApplyOutcome};
+use super::config::ManagedSource;
+use super::layout::{create_private_dir, read_record, write_record, ManagedLayout};
+use super::quarantine::{self, QuarantineReason, QuarantineRecord};
+use super::records::{Enrollment, EntryMode, Ownership};
+use super::remote::Remote;
+use super::state::ManagedState;
+use crate::core::service::ServiceError;
+use chrono::{DateTime, Utc};
+use fs2::FileExt;
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+use std::sync::Mutex;
+
+/// The report format this FastSkill sends.
+pub const REPORT_FORMAT_VERSION: u32 = 1;
+
+/// What happened to a skill entry in an Agent target.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum SkillOutcome {
+    Deployed,
+    Adopted,
+    Collision,
+    Quarantined,
+    /// Not FastSkill's, and left alone.
+    Unmanaged,
+}
+
+/// One skill in an Agent target, without its path.
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+pub struct ReportSkill {
+    pub id: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub digest: Option<String>,
+    /// `managed` for what FastSkill placed; `None` when FastSkill can't know.
+    pub origin_kind: Option<String>,
+    pub editable: bool,
+    pub outcome: SkillOutcome,
+}
+
+/// A covered agent, by name.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ReportAgent {
+    pub name: String,
+    pub hook: bool,
+}
+
+/// One quarantined item, without its paths.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ReportQuarantine {
+    pub id: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub digest: Option<String>,
+    pub reason: QuarantineReason,
+    pub quarantined_at: DateTime<Utc>,
+}
+
+impl From<&QuarantineRecord> for ReportQuarantine {
+    fn from(record: &QuarantineRecord) -> Self {
+        Self {
+            id: record
+                .former_path
+                .file_name()
+                .map(|name| name.to_string_lossy().into_owned())
+                .unwrap_or_default(),
+            digest: record.digest.clone(),
+            reason: record.reason,
+            quarantined_at: record.quarantined_at,
+        }
+    }
+}
+
+/// A skill in the current project's skills folder.
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+pub struct ProjectSkill {
+    pub id: String,
+    pub digest: String,
+}
+
+/// An install the managed state refused: the digest and the command, never its arguments.
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+pub struct Refusal {
+    pub digest: String,
+    pub command: String,
+}
+
+/// The refusals kept for this user until a report carrying them is accepted.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Refusals {
+    #[serde(default)]
+    pub entries: Vec<Refusal>,
+}
+
+/// What an apply saw in the targets and the project, kept with its outcome so the report can
+/// be built again later.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ReportSnapshot {
+    #[serde(default)]
+    pub agents: Vec<ReportAgent>,
+    #[serde(default)]
+    pub skills: Vec<ReportSkill>,
+    #[serde(default)]
+    pub quarantined_now: Vec<ReportQuarantine>,
+    #[serde(default)]
+    pub project_skills: Vec<ProjectSkill>,
+}
+
+/// The report body.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Report {
+    pub format_version: u32,
+    pub machine_id: String,
+    pub sequence: u64,
+    pub issued_at: Option<DateTime<Utc>>,
+    pub completed: bool,
+    pub agents: Vec<ReportAgent>,
+    pub skills: Vec<ReportSkill>,
+    pub quarantine: Vec<ReportQuarantine>,
+    pub quarantined_now: Vec<ReportQuarantine>,
+    pub refusals: Vec<Refusal>,
+    pub project_skills: Vec<ProjectSkill>,
+}
+
+/// Everything a report is built from.
+pub struct ReportInput<'a> {
+    pub source: &'a ManagedSource,
+    pub enrollment: &'a Enrollment,
+    pub issued_at: Option<DateTime<Utc>>,
+    pub completed: bool,
+    pub snapshot: &'a ReportSnapshot,
+    pub quarantine: &'a [QuarantineRecord],
+    pub refusals: &'a Refusals,
+}
+
+impl Report {
+    /// The next report from this machine id. Refusals and project skills are left out unless
+    /// the source is `https://` (decision 21).
+    pub fn build(input: ReportInput<'_>) -> Self {
+        let https = matches!(input.source, ManagedSource::Https(_));
+        Self {
+            format_version: REPORT_FORMAT_VERSION,
+            machine_id: input.enrollment.machine_id.clone(),
+            sequence: input.enrollment.report_sequence + 1,
+            issued_at: input.issued_at,
+            completed: input.completed,
+            agents: input.snapshot.agents.clone(),
+            skills: input.snapshot.skills.clone(),
+            quarantine: input
+                .quarantine
+                .iter()
+                .map(ReportQuarantine::from)
+                .collect(),
+            quarantined_now: input.snapshot.quarantined_now.clone(),
+            refusals: if https {
+                input.refusals.entries.clone()
+            } else {
+                Vec::new()
+            },
+            project_skills: if https {
+                input.snapshot.project_skills.clone()
+            } else {
+                Vec::new()
+            },
+        }
+    }
+}
+
+/// Where a report goes, or why none is sent: no `report_url`, a file source, or a URL on
+/// another origin (decisions 6 and 21).
+pub fn destination(
+    report_url: Option<&str>,
+    source: &ManagedSource,
+) -> Result<Option<String>, String> {
+    let Some(url) = report_url else {
+        return Ok(None);
+    };
+    match source {
+        ManagedSource::File(_) => Err("a file source never gets a report".to_string()),
+        ManagedSource::Https(_) if source.same_origin(url) => Ok(Some(url.to_string())),
+        ManagedSource::Https(_) => Err(format!(
+            "report_url {url:?} isn't on the managed source's origin, so no report was sent"
+        )),
+    }
+}
+
+/// What happened to the report of one apply.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ReportDelivery {
+    pub sequence: u64,
+    pub accepted: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub problem: Option<String>,
+}
+
+/// What an apply saw, for the report: the covered agents, every skill entry in the targets,
+/// this run's quarantine actions and the project's skills.
+pub(crate) fn snapshot(
+    context: &ApplyContext,
+    covered: &[(PathBuf, Vec<&'static str>)],
+    ownership: &Ownership,
+    outcome: &ApplyOutcome,
+) -> ReportSnapshot {
+    let mut names: Vec<&str> = covered
+        .iter()
+        .flat_map(|(_, agents)| agents.iter().copied())
+        .collect();
+    names.sort_unstable();
+    names.dedup();
+    let store = context.layout.store();
+    let mut skills = Vec::new();
+    for (target, _) in covered {
+        for (path, digest) in entries(target) {
+            let id = file_name(&path);
+            let owned = ownership.find(target, &id);
+            let (outcome, origin_kind, editable) = if outcome.collisions.contains(&path) {
+                (SkillOutcome::Collision, None, false)
+            } else if let Some(owned) = owned {
+                let placed = if owned.mode == EntryMode::Adopted {
+                    SkillOutcome::Adopted
+                } else {
+                    SkillOutcome::Deployed
+                };
+                (placed, Some("managed".to_string()), false)
+            } else {
+                (SkillOutcome::Unmanaged, None, links_outside(&path, &store))
+            };
+            skills.push(ReportSkill {
+                id,
+                digest: Some(digest),
+                origin_kind,
+                editable,
+                outcome,
+            });
+        }
+    }
+    for record in &outcome.quarantined {
+        let in_target = record
+            .former_path
+            .parent()
+            .is_some_and(|parent| covered.iter().any(|(target, _)| target == parent));
+        if in_target {
+            skills.push(ReportSkill {
+                id: file_name(&record.former_path),
+                digest: record.digest.clone(),
+                origin_kind: None,
+                editable: false,
+                outcome: SkillOutcome::Quarantined,
+            });
+        }
+    }
+    skills.sort();
+    skills.dedup();
+    let mut project_skills: Vec<ProjectSkill> = context
+        .project_skills
+        .as_deref()
+        .map(entries)
+        .unwrap_or_default()
+        .into_iter()
+        .map(|(path, digest)| ProjectSkill {
+            id: file_name(&path),
+            digest,
+        })
+        .collect();
+    project_skills.sort();
+    project_skills.dedup();
+    ReportSnapshot {
+        agents: names
+            .into_iter()
+            .map(|name| ReportAgent {
+                name: name.to_string(),
+                hook: false,
+            })
+            .collect(),
+        skills,
+        quarantined_now: outcome
+            .quarantined
+            .iter()
+            .map(ReportQuarantine::from)
+            .collect(),
+        project_skills,
+    }
+}
+
+fn file_name(path: &Path) -> String {
+    path.file_name()
+        .map(|name| name.to_string_lossy().into_owned())
+        .unwrap_or_default()
+}
+
+/// Whether the entry is a link to a folder outside the managed store, as an editable local
+/// skill is.
+fn links_outside(path: &Path, store: &Path) -> bool {
+    let is_link = path
+        .symlink_metadata()
+        .is_ok_and(|metadata| metadata.file_type().is_symlink());
+    let store = std::fs::canonicalize(store).unwrap_or_else(|_| store.to_path_buf());
+    is_link && std::fs::canonicalize(path).is_ok_and(|resolved| !resolved.starts_with(&store))
+}
+
+/// Warnings about fields of an `https://` source's state that point at another origin.
+pub(crate) fn state_warnings(state: &ManagedState, source: &ManagedSource) -> Vec<String> {
+    let mut warnings = Vec::new();
+    if let (ManagedSource::Https(_), Some(template)) = (source, state.request_url.as_deref()) {
+        if state.request_link(source, "x").is_none() {
+            warnings.push(format!(
+                "request_url {template:?} isn't on the managed source's origin, so refusals \
+                 show no request link"
+            ));
+        }
+    }
+    warnings
+}
+
+/// Send the report when the state names one on the source's origin, and record what
+/// happened. The sequence number goes up with each report sent; an accepted report clears the
+/// refusals it carried.
+pub(crate) fn send(
+    context: &ApplyContext,
+    source: &ManagedSource,
+    state: &ManagedState,
+    remote: Option<&Remote>,
+    enrollment: &mut Enrollment,
+    outcome: &mut ApplyOutcome,
+) -> Result<(), ServiceError> {
+    let url = match destination(state.report_url.as_deref(), source) {
+        Ok(Some(url)) => url,
+        Ok(None) => return Ok(()),
+        Err(problem) => {
+            if matches!(source, ManagedSource::Https(_)) {
+                outcome.warnings.push(problem);
+            }
+            return Ok(());
+        }
+    };
+    let layout = &context.layout;
+    let Some(remote) = remote.filter(|_| !outcome.sign_in_needed) else {
+        outcome.report = Some(ReportDelivery {
+            sequence: enrollment.report_sequence,
+            accepted: false,
+            problem: Some("not sent: sign-in is needed".to_string()),
+        });
+        return Ok(());
+    };
+    let refusals = refusals(layout)?;
+    let quarantine = quarantine::list(layout)?;
+    let report = Report::build(ReportInput {
+        source,
+        enrollment,
+        issued_at: outcome.issued_at,
+        completed: outcome.completed,
+        snapshot: &outcome.snapshot,
+        quarantine: &quarantine,
+        refusals: &refusals,
+    });
+    enrollment.report_sequence = report.sequence;
+    write_record(&layout.enrollment_file(), enrollment)?;
+    let body =
+        serde_json::to_vec(&report).map_err(|error| ServiceError::Custom(error.to_string()))?;
+    let mut delivery = ReportDelivery {
+        sequence: report.sequence,
+        accepted: false,
+        problem: None,
+    };
+    match remote.post_json(&url, body) {
+        Ok(()) => {
+            delivery.accepted = true;
+            clear_refusals(layout, &report.refusals)?;
+        }
+        Err(error) => {
+            outcome.sign_in_needed |= error.sign_in;
+            delivery.problem = Some(error.message);
+        }
+    }
+    outcome.report = Some(delivery);
+    Ok(())
+}
+
+static CURRENT_COMMAND: Mutex<Option<String>> = Mutex::new(None);
+
+/// Name the command this process runs (`skill add`, `bundle update`, …), so a refusal can be
+/// recorded with it.
+pub fn set_current_command(command: &str) {
+    if let Ok(mut current) = CURRENT_COMMAND.lock() {
+        *current = Some(command.to_string());
+    }
+}
+
+fn current_command() -> String {
+    CURRENT_COMMAND
+        .lock()
+        .ok()
+        .and_then(|current| current.clone())
+        .unwrap_or_else(|| "unknown".to_string())
+}
+
+/// Keep a refusal of `digest` by the current command, once per digest and command. Only an
+/// enrolled user keeps refusals.
+pub fn record_refusal(layout: &ManagedLayout, digest: &str) -> Result<(), ServiceError> {
+    if !layout.enrollment_file().is_file() {
+        return Ok(());
+    }
+    let refusal = Refusal {
+        digest: digest.to_string(),
+        command: current_command(),
+    };
+    update_refusals(layout, |refusals| {
+        if !refusals.entries.contains(&refusal) {
+            refusals.entries.push(refusal);
+            refusals.entries.sort();
+        }
+    })
+}
+
+/// The kept refusals.
+pub fn refusals(layout: &ManagedLayout) -> Result<Refusals, ServiceError> {
+    read_record(&layout.refusals_file())
+}
+
+/// Forget the refusals an accepted report carried; newer ones stay.
+pub fn clear_refusals(layout: &ManagedLayout, sent: &[Refusal]) -> Result<(), ServiceError> {
+    update_refusals(layout, |refusals| {
+        refusals.entries.retain(|refusal| !sent.contains(refusal));
+    })
+}
+
+fn update_refusals(
+    layout: &ManagedLayout,
+    change: impl FnOnce(&mut Refusals),
+) -> Result<(), ServiceError> {
+    create_private_dir(&layout.managed())?;
+    let lock = lock_file(&layout.refusals_lock())?;
+    lock.lock_exclusive()?;
+    let mut refusals: Refusals = read_record(&layout.refusals_file())?;
+    change(&mut refusals);
+    let written = write_record(&layout.refusals_file(), &refusals);
+    let _ = lock.unlock();
+    written
+}
+
+fn lock_file(path: &Path) -> std::io::Result<std::fs::File> {
+    std::fs::OpenOptions::new()
+        .create(true)
+        .read(true)
+        .write(true)
+        .truncate(false)
+        .open(path)
+}
+
+#[cfg(test)]
+#[path = "report_tests.rs"]
+mod tests;
diff --git a/crates/fastskill-core/src/core/managed/report_tests.rs b/crates/fastskill-core/src/core/managed/report_tests.rs
new file mode 100644
index 00000000..9a627cf6
--- /dev/null
+++ b/crates/fastskill-core/src/core/managed/report_tests.rs
@@ -0,0 +1,409 @@
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use super::*;
+use crate::core::managed::apply::ApplyContext;
+use crate::core::managed::apply_tests::{now, write_skill, Fixture};
+use crate::core::managed::enrollment::status;
+use crate::core::managed::gate::{Candidate, Situation};
+use crate::core::managed::state::StateSkill;
+use crate::core::managed::test_https::{Route, TestCa, TestServer};
+use crate::core::managed::tests::sign;
+use serde_json::{json, Value};
+
+/// A managed source served over https by a local test server.
+struct Https {
+    fixture: Fixture,
+    server: TestServer,
+    _ca: TestCa,
+}
+
+impl Https {
+    fn new() -> Self {
+        let ca = TestCa::trusted();
+        let server = TestServer::start(&ca);
+        server.route("/report", Route::Body(Vec::new()));
+        Self {
+            fixture: Fixture::new(),
+            server,
+            _ca: ca,
+        }
+    }
+
+    fn source(&self) -> ManagedSource {
+        ManagedSource::parse(&self.server.url("/state")).unwrap()
+    }
+
+    fn context(&self) -> ApplyContext {
+        let mut context = self.fixture.context();
+        context.settings.source = Some(self.source());
+        context
+    }
+
+    /// A listed skill whose archive the server serves.
+    fn skill(&mut self, id: &str, body: &str) -> StateSkill {
+        let mut skill = self.fixture.skill(id, body);
+        let archive =
+            std::fs::read(self.fixture.root.join("source").join(&skill.artifact)).unwrap();
+        let path = format!("/{}", skill.artifact);
+        self.server.route(&path, Route::Body(archive));
+        skill.artifact = self.server.url(&path);
+        skill
+    }
+
+    fn publish(&self, skills: &[StateSkill], extra: Value) {
+        let mut state = json!({
+            "format_version": 1,
+            "issued_at": "2026-10-09T11:00:00Z",
+            "expires_at": "2026-10-16T11:00:00Z",
+            "source": self.server.url("/state"),
+            "subject": "team-a",
+            "skills": skills,
+            "allowed": "any",
+            "report_url": self.server.url("/report"),
+        });
+        for (key, value) in extra.as_object().unwrap() {
+            state[key] = value.clone();
+        }
+        let envelope = sign(&serde_json::to_vec(&state).unwrap(), &[("k1", 1)]);
+        self.server.route("/state", Route::Body(envelope));
+    }
+
+    fn apply(&self) -> ApplyOutcome {
+        self.fixture.apply_with(&self.context())
+    }
+
+    fn reports(&self) -> Vec<Report> {
+        self.server
+            .seen_at("/report")
+            .iter()
+            .map(|seen| serde_json::from_slice(&seen.body).unwrap())
+            .collect()
+    }
+}
+
+#[test]
+fn an_https_apply_deploys_from_the_source_and_reports_with_a_rising_sequence() {
+    let mut https = Https::new();
+    let pdf = https.skill("pdf", "one");
+    https.publish(std::slice::from_ref(&pdf), json!({}));
+    write_skill(&https.fixture.project.join("notes"), "notes", "mine");
+
+    let first = https.apply();
+    assert!(first.completed, "{first:?}");
+    assert!(!first.sign_in_needed && first.warnings.is_empty());
+    assert_eq!(first.deployed.len(), 1);
+    let delivery = first.report.unwrap();
+    assert_eq!((delivery.sequence, delivery.accepted), (1, true));
+
+    let second = https.apply();
+    assert_eq!(second.report.unwrap().sequence, 2);
+    let reports = https.reports();
+    assert_eq!(reports.len(), 2);
+    let report = &reports[0];
+    assert_eq!(report.format_version, REPORT_FORMAT_VERSION);
+    assert_eq!(report.sequence, 1);
+    assert!(report.completed);
+    assert_eq!(report.agents[0].name, "claude");
+    assert!(!report.agents[0].hook);
+    let skill = report
+        .skills
+        .iter()
+        .find(|skill| skill.id == "pdf")
+        .unwrap();
+    assert_eq!(skill.outcome, SkillOutcome::Deployed);
+    assert_eq!(skill.origin_kind.as_deref(), Some("managed"));
+    assert_eq!(skill.digest.as_deref(), Some(pdf.digest.as_str()));
+    assert_eq!(report.project_skills.len(), 1);
+    assert_eq!(report.project_skills[0].id, "notes");
+    assert_eq!(reports[1].sequence, 2);
+
+    let body = String::from_utf8(https.server.seen_at("/report")[0].body.clone()).unwrap();
+    assert!(
+        !body.contains(https.fixture.root.to_str().unwrap()),
+        "{body}"
+    );
+    let enrollment: Enrollment = read_record(&https.fixture.layout.enrollment_file()).unwrap();
+    assert_eq!(enrollment.report_sequence, 2);
+
+    let shown = status(&https.fixture.layout, &https.context().settings, now()).unwrap();
+    assert!(shown.ignored.is_empty());
+    assert_eq!(
+        shown.report_note,
+        Some(format!("sent to {}", https.server.url("/report")))
+    );
+    assert_eq!(shown.report.unwrap().sequence, 3);
+}
+
+#[test]
+fn an_accepted_report_clears_the_refusals_it_carried_and_a_failed_one_keeps_them() {
+    let mut https = Https::new();
+    let pdf = https.skill("pdf", "one");
+    https.publish(&[pdf], json!({}));
+    let layout = https.fixture.layout.clone();
+    record_refusal(&layout, "sha256-tree-v2:before").unwrap();
+    assert!(refusals(&layout).unwrap().entries.is_empty());
+    https.apply();
+
+    set_current_command("skill add");
+    let digest = format!("sha256-tree-v2:{}", "a".repeat(64));
+    record_refusal(&layout, &digest).unwrap();
+    record_refusal(&layout, &digest).unwrap();
+    assert_eq!(refusals(&layout).unwrap().entries.len(), 1);
+    https.apply();
+    let carried = &https.reports()[1].refusals;
+    assert_eq!(
+        carried,
+        &vec![Refusal {
+            digest: digest.clone(),
+            command: "skill add".to_string()
+        }]
+    );
+    assert!(refusals(&layout).unwrap().entries.is_empty());
+
+    https.server.route("/report", Route::Status(500));
+    record_refusal(&layout, &digest).unwrap();
+    let failed = https.apply();
+    let delivery = failed.report.unwrap();
+    assert!(!delivery.accepted && !failed.sign_in_needed);
+    assert!(delivery.problem.unwrap().contains("500"));
+    assert_eq!(refusals(&layout).unwrap().entries.len(), 1);
+
+    https.server.route("/report", Route::Status(401));
+    assert!(https.apply().sign_in_needed);
+}
+
+#[test]
+fn a_failed_sign_in_applies_the_cached_state_and_sends_no_report() {
+    let mut https = Https::new();
+    let pdf = https.skill("pdf", "one");
+    https.publish(&[pdf], json!({}));
+    https.apply();
+
+    let mut context = https.context();
+    context.settings.credential_command = Some(vec!["fastskill-no-such-helper".to_string()]);
+    let outcome = https.fixture.apply_with(&context);
+    assert!(outcome.sign_in_needed);
+    assert!(outcome.completed);
+    assert!(
+        outcome
+            .state_problem
+            .as_deref()
+            .unwrap()
+            .contains("couldn't start"),
+        "{outcome:?}"
+    );
+    let delivery = outcome.report.unwrap();
+    assert!(!delivery.accepted);
+    assert_eq!(
+        delivery.problem.as_deref(),
+        Some("not sent: sign-in is needed")
+    );
+    assert_eq!(https.server.seen_at("/state").len(), 1);
+    assert_eq!(https.reports().len(), 1);
+    assert!(
+        status(&https.fixture.layout, &context.settings, now())
+            .unwrap()
+            .sign_in_needed
+    );
+
+    https.server.route("/state", Route::Status(401));
+    let outcome = https.apply();
+    assert!(outcome.sign_in_needed && outcome.completed);
+    assert!(outcome.state_problem.unwrap().contains("401"));
+}
+
+#[test]
+#[cfg(unix)]
+fn the_token_reaches_the_state_the_artifacts_and_the_report() {
+    let mut https = Https::new();
+    let pdf = https.skill("pdf", "one");
+    https.publish(std::slice::from_ref(&pdf), json!({}));
+    let mut context = https.context();
+    context.settings.credential_command = Some(vec![
+        "sh".to_string(),
+        "-c".to_string(),
+        "echo signed-in".to_string(),
+    ]);
+    assert!(https.fixture.apply_with(&context).report.unwrap().accepted);
+    let seen = https.server.seen();
+    assert_eq!(seen.len(), 3);
+    for request in seen {
+        assert_eq!(request.authorization.as_deref(), Some("Bearer signed-in"));
+    }
+}
+
+#[test]
+fn urls_on_another_origin_get_a_warning_and_no_report() {
+    let mut https = Https::new();
+    let pdf = https.skill("pdf", "one");
+    https.publish(
+        &[pdf],
+        json!({
+            "report_url": "https://elsewhere.example.com/report",
+            "request_url": "https://elsewhere.example.com/request/{digest}",
+        }),
+    );
+    let outcome = https.apply();
+    assert!(outcome.report.is_none());
+    assert_eq!(outcome.warnings.len(), 2, "{:?}", outcome.warnings);
+    assert!(outcome
+        .warnings
+        .iter()
+        .any(|warning| warning.contains("report_url")));
+    assert!(outcome
+        .warnings
+        .iter()
+        .any(|warning| warning.contains("request_url")));
+    assert!(https.reports().is_empty());
+}
+
+#[test]
+fn a_file_source_ignores_the_https_fields_and_is_never_reported_to() {
+    let mut fixture = Fixture::new();
+    let pdf = fixture.skill("pdf", "one");
+    fixture.publish(
+        &[pdf],
+        json!({
+            "editable": "refused",
+            "request_url": "https://skills.example.com/request/{digest}",
+            "report_url": "https://skills.example.com/report",
+        }),
+    );
+    let outcome = fixture.apply();
+    assert!(outcome.report.is_none() && outcome.warnings.is_empty());
+    let layout = fixture.layout.clone();
+    record_refusal(&layout, "sha256-tree-v2:x").unwrap();
+
+    let shown = status(&layout, &fixture.settings(), now()).unwrap();
+    assert_eq!(shown.ignored.len(), 3, "{:?}", shown.ignored);
+    assert!(shown.ignored[0].starts_with("editable"));
+    assert_eq!(
+        shown.report_note.as_deref(),
+        Some("none: a file source never gets a report")
+    );
+    let report = shown.report.unwrap();
+    assert!(report.refusals.is_empty() && report.project_skills.is_empty());
+    assert_eq!(report.sequence, 1);
+}
+
+#[test]
+fn destinations() {
+    let https = ManagedSource::parse("https://skills.example.com/state").unwrap();
+    let file = ManagedSource::File(std::env::temp_dir().join("state.dsse"));
+    assert_eq!(destination(None, &https), Ok(None));
+    assert_eq!(
+        destination(Some("https://skills.example.com/r"), &https),
+        Ok(Some("https://skills.example.com/r".to_string()))
+    );
+    assert!(destination(Some("https://other.example.com/r"), &https)
+        .unwrap_err()
+        .contains("isn't on the managed source's origin"));
+    assert!(destination(Some("https://skills.example.com/r"), &file).is_err());
+}
+
+#[test]
+fn the_snapshot_names_adopted_collided_and_unmanaged_entries() {
+    let mut fixture = Fixture::new();
+    let pdf = fixture.skill("pdf", "one");
+    let docs = fixture.skill("docs", "two");
+    fixture.publish(&[pdf, docs], json!({}));
+    let target = fixture.target();
+    write_skill(&target.join("pdf"), "pdf", "one");
+    write_skill(&target.join("docs"), "docs", "mine");
+    #[cfg(unix)]
+    {
+        let editable = fixture.folder("mine", "local");
+        std::os::unix::fs::symlink(&editable, target.join("mine")).unwrap();
+    }
+    let outcome = fixture.apply();
+    let outcomes: Vec<(String, SkillOutcome)> = outcome
+        .snapshot
+        .skills
+        .iter()
+        .map(|skill| (skill.id.clone(), skill.outcome))
+        .collect();
+    assert!(outcomes.contains(&("pdf".to_string(), SkillOutcome::Adopted)));
+    assert!(outcomes.contains(&("docs".to_string(), SkillOutcome::Collision)));
+    #[cfg(unix)]
+    {
+        let mine = outcome
+            .snapshot
+            .skills
+            .iter()
+            .find(|skill| skill.id == "mine")
+            .unwrap();
+        assert_eq!(mine.outcome, SkillOutcome::Unmanaged);
+        assert!(mine.editable && mine.origin_kind.is_none());
+    }
+}
+
+#[test]
+fn quarantined_entries_appear_in_the_report() {
+    let mut fixture = Fixture::new();
+    let pdf = fixture.skill("pdf", "one");
+    fixture.publish(std::slice::from_ref(&pdf), json!({}));
+    fixture.apply();
+    let target = fixture.target();
+    std::fs::write(target.join("pdf/SKILL.md"), "changed").unwrap();
+    fixture.publish(&[], json!({}));
+    let outcome = fixture.apply();
+    assert_eq!(outcome.snapshot.quarantined_now.len(), 1);
+    assert_eq!(outcome.snapshot.quarantined_now[0].id, "pdf");
+    let quarantined = outcome
+        .snapshot
+        .skills
+        .iter()
+        .find(|skill| skill.outcome == SkillOutcome::Quarantined)
+        .unwrap();
+    assert_eq!(quarantined.id, "pdf");
+    let shown = status(&fixture.layout, &fixture.settings(), now()).unwrap();
+    assert_eq!(shown.report.unwrap().quarantine.len(), 1);
+}
+
+#[test]
+fn only_an_unexpired_https_state_keeps_refusals() {
+    let fixture = Fixture::new();
+    let layout = fixture.layout.clone();
+    std::fs::create_dir_all(layout.managed()).unwrap();
+    write_record(&layout.enrollment_file(), &Enrollment::default()).unwrap();
+    let blocked = format!("sha256-tree-v2:{}", "b".repeat(64));
+    let situation = |source: ManagedSource, expired: bool| {
+        let state = json!({
+            "format_version": 1,
+            "issued_at": "2026-10-09T11:00:00Z",
+            "expires_at": "2026-10-16T11:00:00Z",
+            "source": source.as_str(),
+            "subject": "team-a",
+            "skills": [],
+            "allowed": "any",
+            "blocked": [{ "digest": blocked }],
+        });
+        Situation::State {
+            state: Box::new(ManagedState::parse(&serde_json::to_vec(&state).unwrap()).unwrap()),
+            source,
+            expired,
+        }
+    };
+    let https = ManagedSource::parse("https://skills.example.com/state").unwrap();
+    let file = ManagedSource::File(std::env::temp_dir().join("state.dsse"));
+    let candidate = Candidate::digest("bad", &blocked);
+
+    for (source, expired) in [(file, false), (https.clone(), true)] {
+        let checked = situation(source, expired).check_recording(candidate, &layout);
+        assert!(checked.is_err(), "expired: {expired}");
+        assert!(refusals(&layout).unwrap().entries.is_empty());
+    }
+    let error = situation(https.clone(), false)
+        .check_recording(candidate, &layout)
+        .unwrap_err();
+    assert!(error.to_string().contains("blocked"), "{error}");
+    assert_eq!(refusals(&layout).unwrap().entries[0].digest, blocked);
+    let fine = format!("sha256-tree-v2:{}", "c".repeat(64));
+    situation(https, false)
+        .check_recording(Candidate::digest("fine", &fine), &layout)
+        .unwrap();
+    assert_eq!(refusals(&layout).unwrap().entries.len(), 1);
+
+    clear_refusals(&layout, &refusals(&layout).unwrap().entries).unwrap();
+    assert!(refusals(&layout).unwrap().entries.is_empty());
+}
diff --git a/crates/fastskill-core/src/core/managed/store.rs b/crates/fastskill-core/src/core/managed/store.rs
index ba58a844..50e0f31c 100644
--- a/crates/fastskill-core/src/core/managed/store.rs
+++ b/crates/fastskill-core/src/core/managed/store.rs
@@ -3,6 +3,7 @@
 
 use super::config::ManagedSource;
 use super::layout::{create_private_dir, ManagedLayout};
+use super::remote::Remote;
 use super::state::StateSkill;
 use crate::core::content_digest::{content_digest, CONTENT_DIGEST_PREFIX};
 use crate::core::service::ServiceError;
@@ -47,16 +48,34 @@ impl ManagedStore {
     }
 
     /// Make `skill` available in the store, fetching it from its artifact when it isn't there.
+    /// An `https://` artifact is downloaded into private staging first.
     pub fn ensure(
         &self,
         skill: &StateSkill,
         source: &ManagedSource,
+        remote: Option<&Remote>,
     ) -> Result<PathBuf, ServiceError> {
         if let Some(path) = self.verified(&skill.digest)? {
             return Ok(path);
         }
-        let archive = artifact_path(&skill.artifact, source)?;
-        self.publish_archive(skill, &archive)
+        if !skill.artifact.contains("://") {
+            let archive = artifact_path(&skill.artifact, source)?;
+            return self.publish_archive(skill, &archive);
+        }
+        let remote = remote.ok_or_else(|| {
+            ServiceError::InvalidOperation(format!(
+                "can't fetch the artifact {:?}: https isn't available",
+                skill.artifact
+            ))
+        })?;
+        let staging = self.layout.staging();
+        create_private_dir(&staging)?;
+        let download = tempfile::Builder::new()
+            .prefix("download-")
+            .suffix(".zip")
+            .tempfile_in(&staging)?;
+        remote.download(&skill.artifact, download.path())?;
+        self.publish_archive(skill, download.path())
     }
 
     /// Extract `archive` into private staging, check its digest and identity, then rename it
@@ -116,7 +135,7 @@ impl ManagedStore {
 }
 
 /// Where a local artifact is: an absolute path, or one relative to the state file's folder.
-/// `https://` artifacts are fetched by the https source support, not here.
+/// Only a file source names local artifacts.
 pub fn artifact_path(artifact: &str, source: &ManagedSource) -> Result<PathBuf, ServiceError> {
     match source {
         ManagedSource::File(state_file) if !artifact.contains("://") => {
@@ -127,7 +146,7 @@ pub fn artifact_path(artifact: &str, source: &ManagedSource) -> Result<PathBuf,
             })
         }
         _ => Err(ServiceError::InvalidOperation(format!(
-            "fetching the artifact {artifact:?} over https isn't supported by this FastSkill yet"
+            "the artifact {artifact:?} isn't an https:// URL"
         ))),
     }
 }
diff --git a/crates/fastskill-core/src/core/managed/test_https.rs b/crates/fastskill-core/src/core/managed/test_https.rs
new file mode 100644
index 00000000..c5532044
--- /dev/null
+++ b/crates/fastskill-core/src/core/managed/test_https.rs
@@ -0,0 +1,171 @@
+//! A small local https server for the managed source tests: canned answers per path, and a log
+//! of what each request carried.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use rustls::pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer};
+use std::collections::HashMap;
+use std::io::{BufRead, BufReader, Read, Write};
+use std::net::TcpListener;
+use std::sync::{Arc, Mutex};
+
+/// A test certificate authority and a `localhost` certificate it signed.
+pub(crate) struct TestCa {
+    ca_pem: String,
+    leaf: CertificateDer<'static>,
+    leaf_key: Vec<u8>,
+}
+
+impl TestCa {
+    /// A new authority, trusted by https clients built on this thread.
+    pub(crate) fn trusted() -> Self {
+        let ca_key = rcgen::KeyPair::generate().unwrap();
+        let mut ca_params = rcgen::CertificateParams::new(Vec::<String>::new()).unwrap();
+        ca_params.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
+        let ca = ca_params.self_signed(&ca_key).unwrap();
+        let leaf_key = rcgen::KeyPair::generate().unwrap();
+        let leaf = rcgen::CertificateParams::new(vec!["localhost".to_string()])
+            .unwrap()
+            .signed_by(&leaf_key, &ca, &ca_key)
+            .unwrap();
+        let test_ca = Self {
+            ca_pem: ca.pem(),
+            leaf: leaf.der().clone(),
+            leaf_key: leaf_key.serialize_der(),
+        };
+        super::remote::trust_test_root(
+            reqwest::Certificate::from_pem(test_ca.ca_pem.as_bytes()).unwrap(),
+        );
+        test_ca
+    }
+}
+
+/// What the server answers on one path.
+#[derive(Debug, Clone)]
+pub(crate) enum Route {
+    Body(Vec<u8>),
+    Status(u16),
+    Redirect(String),
+}
+
+/// One request the server received.
+#[derive(Debug, Clone)]
+pub(crate) struct Seen {
+    pub method: String,
+    pub path: String,
+    pub authorization: Option<String>,
+    pub body: Vec<u8>,
+}
+
+/// A running server on `https://localhost:<port>`.
+pub(crate) struct TestServer {
+    port: u16,
+    routes: Arc<Mutex<HashMap<String, Route>>>,
+    seen: Arc<Mutex<Vec<Seen>>>,
+}
+
+impl TestServer {
+    pub(crate) fn start(ca: &TestCa) -> Self {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let provider = Arc::new(rustls::crypto::ring::default_provider());
+        let config = rustls::ServerConfig::builder_with_provider(provider)
+            .with_safe_default_protocol_versions()
+            .unwrap()
+            .with_no_client_auth()
+            .with_single_cert(
+                vec![ca.leaf.clone()],
+                PrivateKeyDer::Pkcs8(PrivatePkcs8KeyDer::from(ca.leaf_key.clone())),
+            )
+            .unwrap();
+        let config = Arc::new(config);
+        let routes = Arc::new(Mutex::new(HashMap::new()));
+        let seen = Arc::new(Mutex::new(Vec::new()));
+        let (thread_routes, thread_seen) = (routes.clone(), seen.clone());
+        std::thread::spawn(move || {
+            for stream in listener.incoming() {
+                let Ok(stream) = stream else { continue };
+                let (config, routes, seen) =
+                    (config.clone(), thread_routes.clone(), thread_seen.clone());
+                std::thread::spawn(move || {
+                    let connection = rustls::ServerConnection::new(config).unwrap();
+                    let stream = rustls::StreamOwned::new(connection, stream);
+                    let _ = serve(stream, &routes, &seen);
+                });
+            }
+        });
+        Self { port, routes, seen }
+    }
+
+    pub(crate) fn url(&self, path: &str) -> String {
+        format!("https://localhost:{}{path}", self.port)
+    }
+
+    pub(crate) fn route(&self, path: &str, route: Route) {
+        self.routes.lock().unwrap().insert(path.to_string(), route);
+    }
+
+    pub(crate) fn seen(&self) -> Vec<Seen> {
+        self.seen.lock().unwrap().clone()
+    }
+
+    pub(crate) fn seen_at(&self, path: &str) -> Vec<Seen> {
+        self.seen()
+            .into_iter()
+            .filter(|seen| seen.path == path)
+            .collect()
+    }
+}
+
+fn serve(
+    stream: impl Read + Write,
+    routes: &Mutex<HashMap<String, Route>>,
+    seen: &Mutex<Vec<Seen>>,
+) -> std::io::Result<()> {
+    let mut reader = BufReader::new(stream);
+    let mut line = String::new();
+    reader.read_line(&mut line)?;
+    let mut parts = line.split_whitespace();
+    let method = parts.next().unwrap_or_default().to_string();
+    let path = parts.next().unwrap_or_default().to_string();
+    let mut authorization = None;
+    let mut length = 0;
+    loop {
+        let mut header = String::new();
+        reader.read_line(&mut header)?;
+        let header = header.trim_end();
+        if header.is_empty() {
+            break;
+        }
+        if let Some((name, value)) = header.split_once(':') {
+            match name.to_ascii_lowercase().as_str() {
+                "authorization" => authorization = Some(value.trim().to_string()),
+                "content-length" => length = value.trim().parse().unwrap_or(0),
+                _ => {}
+            }
+        }
+    }
+    let mut body = vec![0; length];
+    reader.read_exact(&mut body)?;
+    seen.lock().unwrap().push(Seen {
+        method,
+        path: path.clone(),
+        authorization,
+        body,
+    });
+    let route = routes.lock().unwrap().get(&path).cloned();
+    let (status, extra, body) = match route {
+        Some(Route::Body(body)) => (200, String::new(), body),
+        Some(Route::Status(status)) => (status, String::new(), Vec::new()),
+        Some(Route::Redirect(to)) => (302, format!("Location: {to}\r\n"), Vec::new()),
+        None => (404, String::new(), Vec::new()),
+    };
+    let stream = reader.get_mut();
+    write!(
+        stream,
+        "HTTP/1.1 {status} X\r\nContent-Length: {}\r\nConnection: close\r\n{extra}\r\n",
+        body.len()
+    )?;
+    stream.write_all(&body)?;
+    stream.flush()
+}
diff --git a/webdocs/cli-reference/managed-command.mdx b/webdocs/cli-reference/managed-command.mdx
index 25cbbefb..1c29cae3 100644
--- a/webdocs/cli-reference/managed-command.mdx
+++ b/webdocs/cli-reference/managed-command.mdx
@@ -47,8 +47,65 @@ targets = ["claude"]
 required = true
 ```
 
-This release reads the state from a local file. The skill archives it lists are read from paths
-next to it.
+## Sources
+
+The source is either a local file or an `https://` URL.
+
+- **A file source** reads the state from a path. The skill archives it lists are read from paths
+  next to it, or from absolute paths.
+- **An `https://` source** fetches the state from the URL, and each listed skill archive from
+  its `https://` URL. Redirects to anything but `https://` are refused. The state can be at most
+  8 MiB and each archive at most 512 MiB.
+
+When the source needs a sign-in, name a credential command:
+
+```toml
+source = "https://skills.example.com/state"
+credential_command = ["example-login", "token"]
+```
+
+The command runs without a shell, from FastSkill's configuration folder, for at most 30
+seconds. The first line it prints, at most 16 KiB, is the token, sent as
+`Authorization: Bearer <token>`. The token is never stored or printed, and it is sent only to
+the source's origin (scheme, host and port): a request to another origin, including a redirect
+to one, goes without it. When there is a terminal, the command can prompt on it; without one,
+such as from an agent hook, `FASTSKILL_INTERACTIVE=0` is set so it can fail at once instead of
+waiting.
+
+When the command fails, or the source answers `401`, apply uses the last accepted state and
+reports **sign-in needed**; run `fastskill managed apply` in a terminal to sign in again.
+
+### Fields only an `https://` source honors
+
+| State field | What it does |
+| --- | --- |
+| `report_url` | Where each apply sends its report. Must be on the source's origin. |
+| `request_url` | A link template with `{digest}`, shown when an install is refused, so people can ask for the skill. Must be on the source's origin. |
+| `editable` | `blocked-only` (default) lets editable local skills skip the allow-list; `refused` refuses them when only listed skills are allowed. |
+
+A `report_url` or `request_url` on another origin is ignored with a warning. A file source
+ignores all three, and `fastskill managed status` names each one it ignores.
+
+## The report
+
+When the state names a `report_url`, each apply sends a JSON report to it, signed in with the
+same token. The body is fixed and holds no prompts, file contents, paths, usernames, project
+names or repository URLs:
+
+- `format_version`, `machine_id` and `sequence`, which goes up by one with each report;
+- `issued_at` of the state applied and whether the apply `completed`;
+- the covered `agents`, by name;
+- every skill entry in the agent folders: its id, digest, whether FastSkill placed it
+  (`origin_kind`), whether it is an editable local skill, and its outcome (`deployed`,
+  `adopted`, `collision`, `quarantined` or `unmanaged`);
+- the `quarantine`, and what this apply quarantined (`quarantined_now`), by id, digest and
+  reason;
+- `refusals`: installs the state refused since the last accepted report, by digest and command
+  name, never its arguments;
+- `project_skills`: the ids and digests in the current project's skills folder.
+
+`fastskill managed status --json --report` prints the body the next report would carry, without
+sending it.
 
 ## Subcommands
 
@@ -79,13 +136,15 @@ complete every step exits with an error after its report.
 
 ### status
 
-Show the source, the machine id, the state's subject and expiry, the last apply's targets and
-collisions, and the quarantine. Nothing is changed.
+Show the source, the machine id, the state's subject and expiry, whether a sign-in is needed,
+the fields this source ignores, where reports go, the last apply's targets, collisions and
+warnings, and the quarantine. Nothing is changed.
 
 ```bash
 fastskill managed status
-fastskill managed status --report   # include everything the last apply did
+fastskill managed status --report          # include everything the last apply did, and the report body
 fastskill managed status --json
+fastskill managed status --json --report   # only the body the next report carries
 ```
 
 ### unenroll