From 5d472eaf6dfca28b28b36b34056b4dca39ef9fd8 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 15 Oct 2026 06:27:30 +0000
Subject: [PATCH] docs: update CLI and helm reference for v2.48.0

---
 .../kosli_assert_pullrequest_azure.md         |   2 +
 .../kosli_assert_pullrequest_bitbucket.md     |   2 +
 .../kosli_assert_pullrequest_github.md        |   2 +
 .../kosli_assert_pullrequest_gitlab.md        |   2 +
 client_reference/kosli_attest_artifact.md     |   9 +-
 client_reference/kosli_attest_custom.md       |   9 +-
 client_reference/kosli_attest_decision.md     |   9 +-
 client_reference/kosli_attest_generic.md      |   9 +-
 client_reference/kosli_attest_jira.md         |   7 +-
 client_reference/kosli_attest_junit.md        |   9 +-
 .../kosli_attest_pullrequest_azure.md         |   5 +-
 .../kosli_attest_pullrequest_bitbucket.md     |   5 +-
 .../kosli_attest_pullrequest_github.md        |   5 +-
 .../kosli_attest_pullrequest_gitlab.md        |   5 +-
 client_reference/kosli_attest_sbom.md         |   9 +-
 client_reference/kosli_attest_snyk.md         |   9 +-
 client_reference/kosli_attest_sonar.md        |   2 +-
 client_reference/kosli_begin_trail.md         |   9 +-
 client_reference/kosli_diff_snapshots.md      |   4 +-
 client_reference/kosli_get_environment.md     |   6 +-
 client_reference/kosli_get_snapshot.md        | 146 +++++------
 client_reference/kosli_list_environments.md   |  28 +-
 client_reference/kosli_list_flows.md          |  12 +-
 client_reference/kosli_list_snapshots.md      |  46 ++--
 client_reference/kosli_log_environment.md     | 248 +++++++++---------
 client_reference/kosli_report_artifact.md     |   7 +-
 client_reference/overview.md                  |   2 +-
 27 files changed, 329 insertions(+), 279 deletions(-)

diff --git a/client_reference/kosli_assert_pullrequest_azure.md b/client_reference/kosli_assert_pullrequest_azure.md
index 2f67c00e..fe294935 100644
--- a/client_reference/kosli_assert_pullrequest_azure.md
+++ b/client_reference/kosli_assert_pullrequest_azure.md
@@ -12,6 +12,8 @@ kosli assert pullrequest azure [flags]
 Assert an Azure DevOps pull request for a git commit exists.  
 The command exits with non-zero exit code 
 if no pull requests were found for the commit.
+No local git repository is needed: `--commit` is looked up through the git provider's API.
+Outside a supported CI, set `--commit` to a full commit SHA: its `HEAD` default is not read from your local checkout.
 
 ## Flags
 | Flag | Type | Description |
diff --git a/client_reference/kosli_assert_pullrequest_bitbucket.md b/client_reference/kosli_assert_pullrequest_bitbucket.md
index 404c8ab8..ba2a0add 100644
--- a/client_reference/kosli_assert_pullrequest_bitbucket.md
+++ b/client_reference/kosli_assert_pullrequest_bitbucket.md
@@ -13,6 +13,8 @@ Assert a Bitbucket pull request for a git commit exists.
 The command exits with non-zero exit code if no pull requests were found for the commit.
 Authentication to Bitbucket can be done with an access token (recommended) or an Atlassian API token, passed via --bitbucket-username (your Atlassian account email) and --bitbucket-password.
 Bitbucket app passwords are no longer supported as of 28 July 2026; replace any app passwords with API tokens. Credentials need to have read access for both repos and pull requests.
+No local git repository is needed: `--commit` is looked up through the git provider's API.
+Outside a supported CI, set `--commit` to a full commit SHA: its `HEAD` default is not read from your local checkout.
 
 ## Flags
 | Flag | Type | Description |
diff --git a/client_reference/kosli_assert_pullrequest_github.md b/client_reference/kosli_assert_pullrequest_github.md
index f59f86db..e31ed242 100644
--- a/client_reference/kosli_assert_pullrequest_github.md
+++ b/client_reference/kosli_assert_pullrequest_github.md
@@ -12,6 +12,8 @@ kosli assert pullrequest github [flags]
 Assert a Github pull request for a git commit exists.  
 The command exits with non-zero exit code
 if no pull requests were found for the commit.
+No local git repository is needed: `--commit` is looked up through the git provider's API.
+Outside a supported CI, set `--commit` to a full commit SHA: its `HEAD` default is not read from your local checkout.
 
 ## Flags
 | Flag | Type | Description |
diff --git a/client_reference/kosli_assert_pullrequest_gitlab.md b/client_reference/kosli_assert_pullrequest_gitlab.md
index d5f21ab6..48f21a19 100644
--- a/client_reference/kosli_assert_pullrequest_gitlab.md
+++ b/client_reference/kosli_assert_pullrequest_gitlab.md
@@ -12,6 +12,8 @@ kosli assert pullrequest gitlab [flags]
 Assert a Gitlab merge request for a git commit exists.  
 The command exits with non-zero exit code 
 if no merge requests were found for the commit.
+No local git repository is needed: `--commit` is looked up through the git provider's API.
+Outside a supported CI, set `--commit` to a full commit SHA: its `HEAD` default is not read from your local checkout.
 
 ## Flags
 | Flag | Type | Description |
diff --git a/client_reference/kosli_attest_artifact.md b/client_reference/kosli_attest_artifact.md
index 141fda34..fb4ee05b 100644
--- a/client_reference/kosli_attest_artifact.md
+++ b/client_reference/kosli_attest_artifact.md
@@ -42,7 +42,10 @@ The `.kosli_ignore` file is always treated as part of the artifact: its own entr
 Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible.
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
-This command requires access to a git repo to associate the artifact to the git commit it is originating from.
+
+This command always requires access to a git repository to associate the artifact to the git commit it originates from.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory. `--commit` defaults to the CI commit in some CIs, otherwise to HEAD.
+The command fails if no repository is found at `--repo-root`, even when `--fingerprint` is given.
 You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
 To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
 These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
@@ -54,7 +57,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--annotate` | stringToString | [optional] Annotate the attestation with data using key=value. |
 | `-t`, `--artifact-type` | string | The type of the artifact to calculate its SHA256 fingerprint. One of: [oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it). |
 | `-b`, `--build-url` | string | The url of CI pipeline that built the artifact. (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `-g`, `--commit` | string | [defaulted] The git commit from which the artifact was created. (defaulted in some CIs: [docs](/integrations/ci_cd), otherwise defaults to HEAD ). (default "HEAD") |
+| `-g`, `--commit` | string | [defaulted] The git commit from which the artifact was created. (defaulted in some CIs: [docs](/integrations/ci_cd), otherwise defaults to HEAD ). The commit is read from the git repository at `--repo-root`. (default "HEAD") |
 | `-u`, `--commit-url` | string | The url for the git commit that created the artifact. (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-N`, `--display-name` | string | [optional] Artifact display name, if different from file, image or directory name. |
 | `-D`, `--dry-run` | bool | [optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
@@ -71,7 +74,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-T`, `--trail` | string | The Kosli trail name. |
diff --git a/client_reference/kosli_attest_custom.md b/client_reference/kosli_attest_custom.md
index c756753c..c747f478 100644
--- a/client_reference/kosli_attest_custom.md
+++ b/client_reference/kosli_attest_custom.md
@@ -26,10 +26,13 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
-You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
-You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
+You can optionally associate the attestation to a git commit using `--commit`.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory. Without `--commit`, no git repository is needed.
+If `--commit` is only defaulted from CI and `--repo-root` is left at `.`, a missing repository or commit
+prints a warning and the attestation is sent without commit info.
 Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
 binding the attestation to the right artifact.
+You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
 To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
 These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
 In other CI systems, set them explicitly to capture repository metadata.
@@ -58,7 +61,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-T`, `--trail` | string | The Kosli trail name. |
diff --git a/client_reference/kosli_attest_decision.md b/client_reference/kosli_attest_decision.md
index e545b095..47aa1826 100644
--- a/client_reference/kosli_attest_decision.md
+++ b/client_reference/kosli_attest_decision.md
@@ -32,10 +32,13 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
-You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
-You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
+You can optionally associate the attestation to a git commit using `--commit`.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory. Without `--commit`, no git repository is needed.
+If `--commit` is only defaulted from CI and `--repo-root` is left at `.`, a missing repository or commit
+prints a warning and the attestation is sent without commit info.
 Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
 binding the attestation to the right artifact.
+You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
 To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
 These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
 In other CI systems, set them explicitly to capture repository metadata.
@@ -65,7 +68,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-T`, `--trail` | string | The Kosli trail name. |
diff --git a/client_reference/kosli_attest_generic.md b/client_reference/kosli_attest_generic.md
index e22eeba8..e393ae30 100644
--- a/client_reference/kosli_attest_generic.md
+++ b/client_reference/kosli_attest_generic.md
@@ -23,10 +23,13 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
-You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
-You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
+You can optionally associate the attestation to a git commit using `--commit`.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory. Without `--commit`, no git repository is needed.
+If `--commit` is only defaulted from CI and `--repo-root` is left at `.`, a missing repository or commit
+prints a warning and the attestation is sent without commit info.
 Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
 binding the attestation to the right artifact.
+You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
 To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
 These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
 In other CI systems, set them explicitly to capture repository metadata.
@@ -55,7 +58,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-T`, `--trail` | string | The Kosli trail name. |
diff --git a/client_reference/kosli_attest_jira.md b/client_reference/kosli_attest_jira.md
index ebcb5d18..b39ca4c3 100644
--- a/client_reference/kosli_attest_jira.md
+++ b/client_reference/kosli_attest_jira.md
@@ -80,10 +80,9 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
-You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
+This command always requires `--commit` (defaulted in some CIs) and access to the git repository containing it.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory.
 You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
-Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
-binding the attestation to the right artifact.
 To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
 These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
 In other CI systems, set them explicitly to capture repository metadata.
@@ -121,7 +120,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-T`, `--trail` | string | The Kosli trail name. |
diff --git a/client_reference/kosli_attest_junit.md b/client_reference/kosli_attest_junit.md
index 25e3a3c1..8a62cf37 100644
--- a/client_reference/kosli_attest_junit.md
+++ b/client_reference/kosli_attest_junit.md
@@ -27,10 +27,13 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
-You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
-You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
+You can optionally associate the attestation to a git commit using `--commit`.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory. Without `--commit`, no git repository is needed.
+If `--commit` is only defaulted from CI and `--repo-root` is left at `.`, a missing repository or commit
+prints a warning and the attestation is sent without commit info.
 Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
 binding the attestation to the right artifact.
+You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
 To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
 These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
 In other CI systems, set them explicitly to capture repository metadata.
@@ -58,7 +61,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-R`, `--results-dir` | string | [defaulted] The path to a directory with JUnit test results. By default, the directory will be uploaded to Kosli's evidence vault. (default ".") |
diff --git a/client_reference/kosli_attest_pullrequest_azure.md b/client_reference/kosli_attest_pullrequest_azure.md
index 125d105f..6daf4794 100644
--- a/client_reference/kosli_attest_pullrequest_azure.md
+++ b/client_reference/kosli_attest_pullrequest_azure.md
@@ -25,6 +25,9 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
+This command always requires `--commit` (defaulted in some CIs) and access to the git repository containing it.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory.
+
 ## Flags
 | Flag | Type | Description |
 | :--- | :--- | :--- |
@@ -52,7 +55,7 @@ To drop the file from the fingerprint safely, move its entries to `--exclude` an
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-T`, `--trail` | string | The Kosli trail name. |
diff --git a/client_reference/kosli_attest_pullrequest_bitbucket.md b/client_reference/kosli_attest_pullrequest_bitbucket.md
index de143b5f..ffa73033 100644
--- a/client_reference/kosli_attest_pullrequest_bitbucket.md
+++ b/client_reference/kosli_attest_pullrequest_bitbucket.md
@@ -27,6 +27,9 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
+This command always requires `--commit` (defaulted in some CIs) and access to the git repository containing it.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory.
+
 ## Flags
 | Flag | Type | Description |
 | :--- | :--- | :--- |
@@ -55,7 +58,7 @@ To drop the file from the fingerprint safely, move its entries to `--exclude` an
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-T`, `--trail` | string | The Kosli trail name. |
diff --git a/client_reference/kosli_attest_pullrequest_github.md b/client_reference/kosli_attest_pullrequest_github.md
index 52ef8dd9..26a8c69c 100644
--- a/client_reference/kosli_attest_pullrequest_github.md
+++ b/client_reference/kosli_attest_pullrequest_github.md
@@ -25,6 +25,9 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
+This command always requires `--commit` (defaulted in some CIs) and access to the git repository containing it.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory.
+
 ## Flags
 | Flag | Type | Description |
 | :--- | :--- | :--- |
@@ -52,7 +55,7 @@ To drop the file from the fingerprint safely, move its entries to `--exclude` an
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-T`, `--trail` | string | The Kosli trail name. |
diff --git a/client_reference/kosli_attest_pullrequest_gitlab.md b/client_reference/kosli_attest_pullrequest_gitlab.md
index 812c5564..8dca7881 100644
--- a/client_reference/kosli_attest_pullrequest_gitlab.md
+++ b/client_reference/kosli_attest_pullrequest_gitlab.md
@@ -25,6 +25,9 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
+This command always requires `--commit` (defaulted in some CIs) and access to the git repository containing it.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory.
+
 ## Flags
 | Flag | Type | Description |
 | :--- | :--- | :--- |
@@ -52,7 +55,7 @@ To drop the file from the fingerprint safely, move its entries to `--exclude` an
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-T`, `--trail` | string | The Kosli trail name. |
diff --git a/client_reference/kosli_attest_sbom.md b/client_reference/kosli_attest_sbom.md
index 7c010ff9..096d79eb 100644
--- a/client_reference/kosli_attest_sbom.md
+++ b/client_reference/kosli_attest_sbom.md
@@ -41,10 +41,13 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
-You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
-You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
+You can optionally associate the attestation to a git commit using `--commit`.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory. Without `--commit`, no git repository is needed.
+If `--commit` is only defaulted from CI and `--repo-root` is left at `.`, a missing repository or commit
+prints a warning and the attestation is sent without commit info.
 Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
 binding the attestation to the right artifact.
+You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
 To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
 These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
 In other CI systems, set them explicitly to capture repository metadata.
@@ -71,7 +74,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--sbom-file` | string | The path to the SBOM file. CycloneDX (JSON, XML) and SPDX (JSON, tag-value) are supported. |
diff --git a/client_reference/kosli_attest_snyk.md b/client_reference/kosli_attest_snyk.md
index 9380aaf7..1094f00e 100644
--- a/client_reference/kosli_attest_snyk.md
+++ b/client_reference/kosli_attest_snyk.md
@@ -31,10 +31,13 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
-You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
-You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
+You can optionally associate the attestation to a git commit using `--commit`.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory. Without `--commit`, no git repository is needed.
+If `--commit` is only defaulted from CI and `--repo-root` is left at `.`, a missing repository or commit
+prints a warning and the attestation is sent without commit info.
 Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
 binding the attestation to the right artifact.
+You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
 To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
 These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
 In other CI systems, set them explicitly to capture repository metadata.
@@ -62,7 +65,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-R`, `--scan-results` | string | The path to Snyk scan SARIF results file from 'snyk test' and 'snyk container test'. By default, the Snyk results will be uploaded to Kosli's evidence vault. |
diff --git a/client_reference/kosli_attest_sonar.md b/client_reference/kosli_attest_sonar.md
index 0e370afc..8f11838b 100644
--- a/client_reference/kosli_attest_sonar.md
+++ b/client_reference/kosli_attest_sonar.md
@@ -78,7 +78,7 @@ To drop the file from the fingerprint safely, move its entries to `--exclude` an
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--sonar-api-token` | string | [required] SonarQube API token. |
diff --git a/client_reference/kosli_begin_trail.md b/client_reference/kosli_begin_trail.md
index d46ad40f..5e8494b1 100644
--- a/client_reference/kosli_begin_trail.md
+++ b/client_reference/kosli_begin_trail.md
@@ -11,8 +11,11 @@ kosli begin trail TRAIL-NAME [flags]
 
 Begin or update a Kosli flow trail.
 
-You can optionally associate the trail to a git commit using `--commit` (requires access to a git repo). And you
-can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
+You can optionally associate the trail to a git commit using `--commit`.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory. Without `--commit`, no git repository is needed.
+If `--commit` is only defaulted from CI and `--repo-root` is left at `.`, a missing repository or commit
+prints a warning and the trail is begun without commit info.
+You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
 To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
 These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
 In other CI systems, set them explicitly to capture repository metadata.
@@ -34,7 +37,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--redact-commit-info` | strings | [optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of [author, message, branch]. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-f`, `--template-file` | string | [optional] The path to a yaml template file. |
diff --git a/client_reference/kosli_diff_snapshots.md b/client_reference/kosli_diff_snapshots.md
index a0577bfb..671573fe 100644
--- a/client_reference/kosli_diff_snapshots.md
+++ b/client_reference/kosli_diff_snapshots.md
@@ -66,7 +66,7 @@ kosli diff snapshots aws-beta aws-prod --output=json
 ```json
 {
   "snappish1": {
-    "snapshot_id": "aws-beta#8716",
+    "snapshot_id": "aws-beta#8720",
     "artifacts": [
       {
         "fingerprint": "077acb1cee6e27ab5b2bbbc3f22c4959d99901a560d2d17e064f6245eb6e2f0f",
@@ -151,7 +151,7 @@ kosli diff snapshots aws-beta aws-prod --output=json
     ]
   },
   "snappish2": {
-    "snapshot_id": "aws-prod#5480",
+    "snapshot_id": "aws-prod#5483",
     "artifacts": [
       {
         "fingerprint": "0fe7da2f4c8a0afd88f81bb066bbdd30e02e45f4872f6a0a4538f527185d729f",
diff --git a/client_reference/kosli_get_environment.md b/client_reference/kosli_get_environment.md
index 5933a997..8450232f 100644
--- a/client_reference/kosli_get_environment.md
+++ b/client_reference/kosli_get_environment.md
@@ -50,9 +50,9 @@ kosli get environment aws-prod --output=json
   "name": "aws-prod",
   "type": "ECS",
   "description": "The ECS cluster for production cyber-dojo",
-  "last_modified_at": 1791908818.4536595,
-  "last_reported_at": 1791908818.4536595,
-  "last_changed_at": 1791880018.4897547,
+  "last_modified_at": 1792045558.6029706,
+  "last_reported_at": 1792045558.6029706,
+  "last_changed_at": 1792045498.5715408,
   "state": true,
   "include_scaling": false,
   "tags": {
diff --git a/client_reference/kosli_get_snapshot.md b/client_reference/kosli_get_snapshot.md
index 2dddf164..a115606b 100644
--- a/client_reference/kosli_get_snapshot.md
+++ b/client_reference/kosli_get_snapshot.md
@@ -64,7 +64,7 @@ kosli get snapshot aws-prod --output=json
 
 ```json
 {
-  "index": 5480,
+  "index": 5483,
   "is_latest": true,
   "next_snapshot_timestamp": null,
   "artifact_compliance_count": {
@@ -72,10 +72,10 @@ kosli get snapshot aws-prod --output=json
     "false": 0,
     "null": 0
   },
-  "timestamp": 1791880018.4897547,
+  "timestamp": 1792045498.5715408,
   "type": "ECS",
   "compliant": true,
-  "html_url": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5480",
+  "html_url": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5483",
   "artifacts": [
     {
       "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:83553f5@sha256:da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
@@ -116,7 +116,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -124,7 +124,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -161,7 +161,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": "COMPLIANT"
                   }
@@ -169,7 +169,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": "COMPLIANT"
                   }
@@ -211,7 +211,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -219,7 +219,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -263,7 +263,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_satisfied",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -271,7 +271,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_satisfied",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -308,7 +308,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": "COMPLIANT"
                   }
@@ -316,7 +316,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": "COMPLIANT"
                   }
@@ -360,7 +360,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null,
                     "for_control": "SDLC-CTRL-0002"
@@ -369,7 +369,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null,
                     "for_control": "SDLC-CTRL-0002"
@@ -414,7 +414,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -422,7 +422,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -459,7 +459,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": "COMPLIANT"
                   }
@@ -467,7 +467,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": "COMPLIANT"
                   }
@@ -509,7 +509,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -517,7 +517,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -561,7 +561,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -569,7 +569,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -606,7 +606,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": "COMPLIANT"
                   }
@@ -614,7 +614,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": "COMPLIANT"
                   }
@@ -656,18 +656,18 @@ kosli get snapshot aws-prod --output=json
                   }
                 },
                 {
-                  "type": "rule_satisfied",
+                  "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null,
                     "for_control": "SDLC-CTRL-0022"
                   }
                 },
                 {
-                  "type": "rule_not_applicable",
+                  "type": "rule_satisfied",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null,
                     "for_control": "SDLC-CTRL-0022"
@@ -712,7 +712,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -720,7 +720,7 @@ kosli get snapshot aws-prod --output=json
                 {
                   "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": null
                   }
@@ -761,17 +761,17 @@ kosli get snapshot aws-prod --output=json
                   }
                 },
                 {
-                  "type": "rule_satisfied",
+                  "type": "rule_not_applicable",
                   "context": {
-                    "flow_name": "snyk-aws-prod-per-artifact",
+                    "flow_name": "snyk-aws-beta-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": "COMPLIANT"
                   }
                 },
                 {
-                  "type": "rule_not_applicable",
+                  "type": "rule_satisfied",
                   "context": {
-                    "flow_name": "snyk-aws-beta-per-artifact",
+                    "flow_name": "snyk-aws-prod-per-artifact",
                     "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
                     "artifact_status": "COMPLIANT"
                   }
@@ -876,7 +876,7 @@ kosli get snapshot aws-prod --output=json
           "flow_reasons_for_non_compliance": []
         },
         {
-          "flow_name": "snyk-aws-prod-per-artifact",
+          "flow_name": "snyk-aws-beta-per-artifact",
           "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
           "template_reference_name": "web",
           "git_commit": "359c98460f5c3aefb136a77eef08d1be4c4ca08d",
@@ -889,17 +889,17 @@ kosli get snapshot aws-prod --output=json
             "timestamp": 1790759058.0,
             "url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d"
           },
-          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78?artifact_id=f91d5972-8862-4b72-981d-53d39cab",
-          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
+          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78?artifact_id=d729fc92-ba16-4ca8-8825-e1b35b66",
+          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact",
           "deployment_diff": {
-            "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/30111f180ac4e3611cdbd7d805381a0bb9f53cff...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
-            "previous_git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff",
-            "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff",
-            "previous_fingerprint": "e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418",
-            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:236898f@sha256:e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418",
+            "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/359c98460f5c3aefb136a77eef08d1be4c4ca08d...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
+            "previous_git_commit": "359c98460f5c3aefb136a77eef08d1be4c4ca08d",
+            "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d",
+            "previous_fingerprint": "299aafbad77b4604fd2260ada0659e3f64a770f3411010827087cda34b52dc9e",
+            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:3b4ef04@sha256:299aafbad77b4604fd2260ada0659e3f64a770f3411010827087cda34b52dc9e",
             "previous_artifact_compliance_state": "COMPLIANT",
             "previous_running": false,
-            "previous_trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418",
+            "previous_trail_name": "web-299aafbad77b4604fd2260ada0659e3f64a770f3411010827087cda34b52dc9e",
             "previous_template_reference_name": "web"
           },
           "commit_lead_time": 1047380.0,
@@ -907,7 +907,7 @@ kosli get snapshot aws-prod --output=json
           "flow_reasons_for_non_compliance": []
         },
         {
-          "flow_name": "snyk-aws-beta-per-artifact",
+          "flow_name": "snyk-aws-prod-per-artifact",
           "trail_name": "web-da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
           "template_reference_name": "web",
           "git_commit": "359c98460f5c3aefb136a77eef08d1be4c4ca08d",
@@ -920,17 +920,17 @@ kosli get snapshot aws-prod --output=json
             "timestamp": 1790759058.0,
             "url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d"
           },
-          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78?artifact_id=34814ae0-9d8f-4205-808f-19d04278",
-          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact",
+          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78?artifact_id=79ccd054-6986-4b4d-9bf2-b1f326ea",
+          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
           "deployment_diff": {
-            "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/359c98460f5c3aefb136a77eef08d1be4c4ca08d...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
-            "previous_git_commit": "359c98460f5c3aefb136a77eef08d1be4c4ca08d",
-            "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d",
-            "previous_fingerprint": "299aafbad77b4604fd2260ada0659e3f64a770f3411010827087cda34b52dc9e",
-            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:3b4ef04@sha256:299aafbad77b4604fd2260ada0659e3f64a770f3411010827087cda34b52dc9e",
+            "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/30111f180ac4e3611cdbd7d805381a0bb9f53cff...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
+            "previous_git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff",
+            "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff",
+            "previous_fingerprint": "e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418",
+            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:236898f@sha256:e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418",
             "previous_artifact_compliance_state": "COMPLIANT",
             "previous_running": false,
-            "previous_trail_name": "web-299aafbad77b4604fd2260ada0659e3f64a770f3411010827087cda34b52dc9e",
+            "previous_trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418",
             "previous_template_reference_name": "web"
           },
           "commit_lead_time": 1047380.0,
@@ -1542,7 +1542,7 @@ kosli get snapshot aws-prod --output=json
       ],
       "pods": null,
       "annotation": {
-        "type": "unchanged",
+        "type": "changed",
         "was": 1,
         "now": 1
       },
@@ -1640,7 +1640,7 @@ kosli get snapshot aws-prod --output=json
             "timestamp": 1790759058.0,
             "url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d"
           },
-          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/2bb4255d1477046c8042e9973482a02e0d66b35ce31d86287a58342e990c0efa?artifact_id=8fb34f49-606d-4d84-8976-3cedc2b5",
+          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/2bb4255d1477046c8042e9973482a02e0d66b35ce31d86287a58342e990c0efa?artifact_id=fc23ac64-45c1-4396-92f5-58d0f88c",
           "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
           "deployment_diff": {
             "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/30111f180ac4e3611cdbd7d805381a0bb9f53cff...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
@@ -2264,7 +2264,7 @@ kosli get snapshot aws-prod --output=json
       ],
       "pods": null,
       "annotation": {
-        "type": "unchanged",
+        "type": "changed",
         "was": 3,
         "now": 3
       },
@@ -2362,7 +2362,7 @@ kosli get snapshot aws-prod --output=json
             "timestamp": 1790759058.0,
             "url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d"
           },
-          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/9b6ccf0845871128cd22f33e8ec0e0a29b1794e736b5ef783ade3c8bca11c80b?artifact_id=50737407-3a5d-47e8-a6dd-84fcde0c",
+          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/9b6ccf0845871128cd22f33e8ec0e0a29b1794e736b5ef783ade3c8bca11c80b?artifact_id=dd1919d0-2deb-4e33-a592-4526340c",
           "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
           "deployment_diff": {
             "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/359c98460f5c3aefb136a77eef08d1be4c4ca08d...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
@@ -2984,7 +2984,7 @@ kosli get snapshot aws-prod --output=json
       ],
       "pods": null,
       "annotation": {
-        "type": "unchanged",
+        "type": "changed",
         "was": 1,
         "now": 1
       },
@@ -3082,7 +3082,7 @@ kosli get snapshot aws-prod --output=json
             "timestamp": 1790759058.0,
             "url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d"
           },
-          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/2dffee94d09db0d3e291cef0fc416f007271ab578adcba8b35f359fda5f2a8a8?artifact_id=2f2e8a07-6950-44e0-9d1d-985bb6a6",
+          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/2dffee94d09db0d3e291cef0fc416f007271ab578adcba8b35f359fda5f2a8a8?artifact_id=dd0f73c8-7f95-49f2-8e8f-b433dc01",
           "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
           "deployment_diff": {
             "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/30111f180ac4e3611cdbd7d805381a0bb9f53cff...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
@@ -3704,7 +3704,7 @@ kosli get snapshot aws-prod --output=json
       ],
       "pods": null,
       "annotation": {
-        "type": "unchanged",
+        "type": "changed",
         "was": 1,
         "now": 1
       },
@@ -3802,7 +3802,7 @@ kosli get snapshot aws-prod --output=json
             "timestamp": 1790759058.0,
             "url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d"
           },
-          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/6726c2fe6436edca6caaeed069531e326f7bfdceeac41feed28bef90a036cc93?artifact_id=100a12ab-eed6-47e0-84ea-86374421",
+          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/6726c2fe6436edca6caaeed069531e326f7bfdceeac41feed28bef90a036cc93?artifact_id=2b2d4d30-38d7-4aa4-8d09-c1a83e10",
           "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
           "deployment_diff": {
             "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/30111f180ac4e3611cdbd7d805381a0bb9f53cff...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
@@ -4424,7 +4424,7 @@ kosli get snapshot aws-prod --output=json
       ],
       "pods": null,
       "annotation": {
-        "type": "unchanged",
+        "type": "changed",
         "was": 1,
         "now": 1
       },
@@ -4522,7 +4522,7 @@ kosli get snapshot aws-prod --output=json
             "timestamp": 1790759058.0,
             "url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d"
           },
-          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/5f70df2163e8918675c92251f398bc1a88d0d7a9ce1eef39d1f603525de077b6?artifact_id=a80343d1-b8b8-4d38-a1c0-ea20db8e",
+          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/5f70df2163e8918675c92251f398bc1a88d0d7a9ce1eef39d1f603525de077b6?artifact_id=12ebc80b-b11c-430a-826c-07cd2199",
           "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
           "deployment_diff": {
             "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/30111f180ac4e3611cdbd7d805381a0bb9f53cff...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
@@ -5144,7 +5144,7 @@ kosli get snapshot aws-prod --output=json
       ],
       "pods": null,
       "annotation": {
-        "type": "unchanged",
+        "type": "changed",
         "was": 1,
         "now": 1
       },
@@ -5242,7 +5242,7 @@ kosli get snapshot aws-prod --output=json
             "timestamp": 1790759058.0,
             "url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d"
           },
-          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/ee739c0183759b660a740afe28fbbdb20b4c3b434faa48dab975aa8576173efb?artifact_id=0c7dfe88-06bc-4518-bf24-bdc7d427",
+          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/ee739c0183759b660a740afe28fbbdb20b4c3b434faa48dab975aa8576173efb?artifact_id=51d58236-be3e-449b-9288-28acfffa",
           "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
           "deployment_diff": {
             "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/30111f180ac4e3611cdbd7d805381a0bb9f53cff...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
@@ -5864,7 +5864,7 @@ kosli get snapshot aws-prod --output=json
       ],
       "pods": null,
       "annotation": {
-        "type": "unchanged",
+        "type": "changed",
         "was": 1,
         "now": 1
       },
@@ -5962,7 +5962,7 @@ kosli get snapshot aws-prod --output=json
             "timestamp": 1790759058.0,
             "url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d"
           },
-          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/807d0a7538fb9c739beab0b9f2793fe24c0a8bf079ef731ec2a2c2fe6464c463?artifact_id=f8c43ab2-3837-47b9-8138-014dde78",
+          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/807d0a7538fb9c739beab0b9f2793fe24c0a8bf079ef731ec2a2c2fe6464c463?artifact_id=4368703f-d309-4d95-a9bd-63cb51c8",
           "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
           "deployment_diff": {
             "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/30111f180ac4e3611cdbd7d805381a0bb9f53cff...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
@@ -6584,7 +6584,7 @@ kosli get snapshot aws-prod --output=json
       ],
       "pods": null,
       "annotation": {
-        "type": "unchanged",
+        "type": "changed",
         "was": 1,
         "now": 1
       },
@@ -6682,7 +6682,7 @@ kosli get snapshot aws-prod --output=json
             "timestamp": 1790759058.0,
             "url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d"
           },
-          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/0fe7da2f4c8a0afd88f81bb066bbdd30e02e45f4872f6a0a4538f527185d729f?artifact_id=66e1e6c0-24ec-49ab-ae15-22b6d41d",
+          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/0fe7da2f4c8a0afd88f81bb066bbdd30e02e45f4872f6a0a4538f527185d729f?artifact_id=23bf6146-4de3-4f5c-815a-e88ffe26",
           "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
           "deployment_diff": {
             "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/30111f180ac4e3611cdbd7d805381a0bb9f53cff...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
@@ -7304,7 +7304,7 @@ kosli get snapshot aws-prod --output=json
       ],
       "pods": null,
       "annotation": {
-        "type": "unchanged",
+        "type": "changed",
         "was": 1,
         "now": 1
       },
@@ -7402,7 +7402,7 @@ kosli get snapshot aws-prod --output=json
             "timestamp": 1790759058.0,
             "url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d"
           },
-          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/b4f37af37368717581502192e3dfc9a55526c528d2f0dd927ff562c856c1a81a?artifact_id=1011e9c3-d83f-4a25-a281-337a94df",
+          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/b4f37af37368717581502192e3dfc9a55526c528d2f0dd927ff562c856c1a81a?artifact_id=def08d42-5e47-482b-8ab0-53895ca0",
           "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
           "deployment_diff": {
             "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/30111f180ac4e3611cdbd7d805381a0bb9f53cff...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
@@ -8024,7 +8024,7 @@ kosli get snapshot aws-prod --output=json
       ],
       "pods": null,
       "annotation": {
-        "type": "unchanged",
+        "type": "changed",
         "was": 1,
         "now": 1
       },
@@ -8122,7 +8122,7 @@ kosli get snapshot aws-prod --output=json
             "timestamp": 1790759058.0,
             "url": "https://github.com/cyber-dojo/snyk-scanning/commit/359c98460f5c3aefb136a77eef08d1be4c4ca08d"
           },
-          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/896a2cd49408db95a29b752857d17c6b68df23d8a27b75e70f2e55aa0c3d367f?artifact_id=518f5551-b230-4bd1-bd64-452100de",
+          "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/896a2cd49408db95a29b752857d17c6b68df23d8a27b75e70f2e55aa0c3d367f?artifact_id=29565a9c-58aa-4e7c-b24e-67351c3a",
           "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
           "deployment_diff": {
             "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/30111f180ac4e3611cdbd7d805381a0bb9f53cff...359c98460f5c3aefb136a77eef08d1be4c4ca08d",
diff --git a/client_reference/kosli_list_environments.md b/client_reference/kosli_list_environments.md
index 93fdf47f..fd38b74e 100644
--- a/client_reference/kosli_list_environments.md
+++ b/client_reference/kosli_list_environments.md
@@ -63,9 +63,9 @@ kosli list environments --output=json
     "name": "aws-beta",
     "type": "ECS",
     "description": "The ECS cluster for staging cyber-dojo",
-    "last_modified_at": 1791908843.8936687,
-    "last_reported_at": 1791908843.8936687,
-    "last_changed_at": 1791880043.883292,
+    "last_modified_at": 1792045583.9629874,
+    "last_reported_at": 1792045583.9629874,
+    "last_changed_at": 1792045583.9629874,
     "state": true,
     "include_scaling": false,
     "tags": {
@@ -86,8 +86,8 @@ kosli list environments --output=json
     "name": "aws-beta-terraform-drift-detection",
     "type": "server",
     "description": "Detection of drift of the Infrastructure-as-code components of aws-beta",
-    "last_modified_at": 1791908708.489035,
-    "last_reported_at": 1791908708.489035,
+    "last_modified_at": 1792045509.015772,
+    "last_reported_at": 1792045509.015772,
     "last_changed_at": 1791808808.694194,
     "state": true,
     "include_scaling": false,
@@ -104,9 +104,9 @@ kosli list environments --output=json
     "name": "aws-prod",
     "type": "ECS",
     "description": "The ECS cluster for production cyber-dojo",
-    "last_modified_at": 1791908818.4536595,
-    "last_reported_at": 1791908818.4536595,
-    "last_changed_at": 1791880018.4897547,
+    "last_modified_at": 1792045558.6029706,
+    "last_reported_at": 1792045558.6029706,
+    "last_changed_at": 1792045498.5715408,
     "state": true,
     "include_scaling": false,
     "tags": {
@@ -128,8 +128,8 @@ kosli list environments --output=json
     "name": "aws-prod-terraform-drift-detection",
     "type": "server",
     "description": "Detection of drift of the Infrastructure-as-code components of aws-prod",
-    "last_modified_at": 1791908611.7309456,
-    "last_reported_at": 1791908611.7309456,
+    "last_modified_at": 1792045412.083085,
+    "last_reported_at": 1792045412.083085,
     "last_changed_at": 1791806912.0760446,
     "state": true,
     "include_scaling": false,
@@ -146,9 +146,9 @@ kosli list environments --output=json
     "name": "production",
     "type": "logical",
     "description": "Production environments for cyber-dojo",
-    "last_modified_at": 1791880018.4897547,
+    "last_modified_at": 1792045498.5715408,
     "last_reported_at": null,
-    "last_changed_at": 1791880018.4897547,
+    "last_changed_at": 1792045498.5715408,
     "state": true,
     "include_scaling": false,
     "tags": {},
@@ -165,9 +165,9 @@ kosli list environments --output=json
     "name": "staging",
     "type": "logical",
     "description": "Staging environments for cyber-dojo",
-    "last_modified_at": 1791880043.883292,
+    "last_modified_at": 1792045583.9629874,
     "last_reported_at": null,
-    "last_changed_at": 1791880043.883292,
+    "last_changed_at": 1792045583.9629874,
     "state": true,
     "include_scaling": false,
     "tags": {},
diff --git a/client_reference/kosli_list_flows.md b/client_reference/kosli_list_flows.md
index d6bf9a4c..1e10129d 100644
--- a/client_reference/kosli_list_flows.md
+++ b/client_reference/kosli_list_flows.md
@@ -63,7 +63,7 @@ kosli list flows --output=json
     "template": "version: 1\ntrail:\n  attestations:\n    - name: drift-detection\n      type: decision\n",
     "repo_url": "",
     "tags": {},
-    "latest_activity_at": 1791901238.073453,
+    "latest_activity_at": 1792014443.271743,
     "latest_state": "COMPLIANT"
   },
   {
@@ -75,7 +75,7 @@ kosli list flows --output=json
     "template": "version: 1\ntrail:\n  attestations:\n    - name: drift-detection\n      type: decision\n",
     "repo_url": "",
     "tags": {},
-    "latest_activity_at": 1791901231.2126298,
+    "latest_activity_at": 1792014437.8309128,
     "latest_state": "COMPLIANT"
   },
   {
@@ -273,8 +273,8 @@ kosli list flows --output=json
       "kind": "run",
       "repo_url": "https://github.com/cyber-dojo/secrets"
     },
-    "latest_activity_at": 1791884042.0315425,
-    "latest_state": "NON-COMPLIANT"
+    "latest_activity_at": 1791981126.0239997,
+    "latest_state": "COMPLIANT"
   },
   {
     "id": "a43239d6-fa3d-4e58-b7c4-f00b7432",
@@ -290,7 +290,7 @@ kosli list flows --output=json
       "workflow_url": "https://github.com/cyber-dojo/snyk-scanning/blob/main/.github/workflows/aws-beta.yml",
       "env": "aws-beta"
     },
-    "latest_activity_at": 1791879994.749658,
+    "latest_activity_at": 1792045567.7301688,
     "latest_state": "COMPLIANT"
   },
   {
@@ -324,7 +324,7 @@ kosli list flows --output=json
       "workflow_url": "https://github.com/cyber-dojo/snyk-scanning/blob/main/.github/workflows/aws-prod.yml",
       "env": "aws-prod"
     },
-    "latest_activity_at": 1791879906.3080175,
+    "latest_activity_at": 1792045493.7299936,
     "latest_state": "COMPLIANT"
   },
   {
diff --git a/client_reference/kosli_list_snapshots.md b/client_reference/kosli_list_snapshots.md
index 568cb97d..123c1f15 100644
--- a/client_reference/kosli_list_snapshots.md
+++ b/client_reference/kosli_list_snapshots.md
@@ -63,12 +63,33 @@ kosli list snapshots aws-prod --output=json
 
 ```json
 [
+  {
+    "index": 5483,
+    "from": 1792045498.5715408,
+    "to": 0.0,
+    "compliant": true,
+    "duration": 94.7624032497406
+  },
+  {
+    "index": 5482,
+    "from": 1791960178.6282132,
+    "to": 1792045498.5715408,
+    "compliant": true,
+    "duration": 85319.94332766533
+  },
+  {
+    "index": 5481,
+    "from": 1791960118.442488,
+    "to": 1791960178.6282132,
+    "compliant": true,
+    "duration": 60.18572521209717
+  },
   {
     "index": 5480,
     "from": 1791880018.4897547,
-    "to": 0.0,
+    "to": 1791960118.442488,
     "compliant": true,
-    "duration": 28858.419744729996
+    "duration": 80099.95273327827
   },
   {
     "index": 5479,
@@ -146,27 +167,6 @@ kosli list snapshots aws-prod --output=json
     "to": 1791704998.5335464,
     "compliant": true,
     "duration": 56160.20444774628
-  },
-  {
-    "index": 5468,
-    "from": 1791648778.5156386,
-    "to": 1791648838.3290987,
-    "compliant": true,
-    "duration": 59.81346011161804
-  },
-  {
-    "index": 5467,
-    "from": 1791648718.5089593,
-    "to": 1791648778.5156386,
-    "compliant": true,
-    "duration": 60.00667929649353
-  },
-  {
-    "index": 5466,
-    "from": 1791648658.4163342,
-    "to": 1791648718.5089593,
-    "compliant": true,
-    "duration": 60.0926251411438
   }
 ]
 ```
diff --git a/client_reference/kosli_log_environment.md b/client_reference/kosli_log_environment.md
index 8d865980..0e5074f7 100644
--- a/client_reference/kosli_log_environment.md
+++ b/client_reference/kosli_log_environment.md
@@ -72,53 +72,11 @@ kosli log environment aws-prod --output=json
 [
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5480,
-    "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:83553f5@sha256:da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
-    "sha256": "da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
-    "description": "3 instances changed",
-    "reported_at": 1791880018.4897547,
-    "pipeline": "web-ci",
-    "deployments": [],
-    "flows": [
-      {
-        "flow_name": "web-ci",
-        "deployments": null
-      },
-      {
-        "flow_name": "production-promotion",
-        "deployments": null
-      },
-      {
-        "flow_name": "snyk-aws-prod-per-artifact",
-        "deployments": null
-      },
-      {
-        "flow_name": "snyk-aws-beta-per-artifact",
-        "deployments": null
-      }
-    ],
-    "artifact_compliance": true,
-    "snapshot_compliance": true,
-    "type": "updated-provenance",
-    "code_diff": "https://github.com/cyber-dojo/web/compare/3e6678b80d51d7ec4c89d88f46dcee93f27fd6c1...83553f52e8de8a9766a64fced8fbfb3cd32318a3",
-    "_links": {
-      "artifact": {
-        "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/web-ci/fingerprint/da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
-        "html": "https://app.kosli.com/cyber-dojo/flows/web-ci/artifacts/da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78?artifact_id=bb10f025-89b9-463a-9857-0a4a205b"
-      },
-      "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5480",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5480"
-      }
-    }
-  },
-  {
-    "environment_name": "aws-prod",
-    "snapshot_index": 5479,
+    "snapshot_index": 5483,
     "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:afeb2f3@sha256:0fe7da2f4c8a0afd88f81bb066bbdd30e02e45f4872f6a0a4538f527185d729f",
     "sha256": "0fe7da2f4c8a0afd88f81bb066bbdd30e02e45f4872f6a0a4538f527185d729f",
     "description": "1 instance changed",
-    "reported_at": 1791879958.4310446,
+    "reported_at": 1792045498.5715408,
     "pipeline": "spooler-ci",
     "deployments": [],
     "flows": [
@@ -145,18 +103,18 @@ kosli log environment aws-prod --output=json
         "html": "https://app.kosli.com/cyber-dojo/flows/spooler-ci/artifacts/0fe7da2f4c8a0afd88f81bb066bbdd30e02e45f4872f6a0a4538f527185d729f?artifact_id=bf8d791d-6bcd-4297-b745-328db4df"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5479",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5479"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5483",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5483"
       }
     }
   },
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5478,
+    "snapshot_index": 5483,
     "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:b543342@sha256:2bb4255d1477046c8042e9973482a02e0d66b35ce31d86287a58342e990c0efa",
     "sha256": "2bb4255d1477046c8042e9973482a02e0d66b35ce31d86287a58342e990c0efa",
     "description": "1 instance changed",
-    "reported_at": 1791879898.512249,
+    "reported_at": 1792045498.5715408,
     "pipeline": "saver-ci",
     "deployments": [],
     "flows": [
@@ -175,7 +133,7 @@ kosli log environment aws-prod --output=json
     ],
     "artifact_compliance": true,
     "snapshot_compliance": true,
-    "type": "updated-provenance",
+    "type": "changed",
     "code_diff": "https://github.com/cyber-dojo/saver/compare/5799bb754b5d0fa5469650050d1e0402e9297ed9...b543342fa06b0ef415950745fddfff5a85f9d80d",
     "_links": {
       "artifact": {
@@ -183,18 +141,18 @@ kosli log environment aws-prod --output=json
         "html": "https://app.kosli.com/cyber-dojo/flows/saver-ci/artifacts/2bb4255d1477046c8042e9973482a02e0d66b35ce31d86287a58342e990c0efa?artifact_id=02ed2b7d-e77e-4543-946c-7f0eb3eb"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5478",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5478"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5483",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5483"
       }
     }
   },
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5478,
+    "snapshot_index": 5483,
     "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:68636be@sha256:2dffee94d09db0d3e291cef0fc416f007271ab578adcba8b35f359fda5f2a8a8",
     "sha256": "2dffee94d09db0d3e291cef0fc416f007271ab578adcba8b35f359fda5f2a8a8",
     "description": "1 instance changed",
-    "reported_at": 1791879898.512249,
+    "reported_at": 1792045498.5715408,
     "pipeline": "exercises-start-points-ci",
     "deployments": [],
     "flows": [
@@ -221,18 +179,18 @@ kosli log environment aws-prod --output=json
         "html": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci/artifacts/2dffee94d09db0d3e291cef0fc416f007271ab578adcba8b35f359fda5f2a8a8?artifact_id=3a46596a-b98c-4c2f-a72a-d8452f32"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5478",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5478"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5483",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5483"
       }
     }
   },
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5478,
+    "snapshot_index": 5483,
     "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:3e6678b@sha256:5f70df2163e8918675c92251f398bc1a88d0d7a9ce1eef39d1f603525de077b6",
     "sha256": "5f70df2163e8918675c92251f398bc1a88d0d7a9ce1eef39d1f603525de077b6",
     "description": "1 instance changed",
-    "reported_at": 1791879898.512249,
+    "reported_at": 1792045498.5715408,
     "pipeline": "dashboard-ci",
     "deployments": [],
     "flows": [
@@ -259,18 +217,18 @@ kosli log environment aws-prod --output=json
         "html": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci/artifacts/5f70df2163e8918675c92251f398bc1a88d0d7a9ce1eef39d1f603525de077b6?artifact_id=6923c594-deee-4b7c-83e9-3165a9ed"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5478",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5478"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5483",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5483"
       }
     }
   },
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5478,
+    "snapshot_index": 5483,
     "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:270c3c8@sha256:6726c2fe6436edca6caaeed069531e326f7bfdceeac41feed28bef90a036cc93",
     "sha256": "6726c2fe6436edca6caaeed069531e326f7bfdceeac41feed28bef90a036cc93",
     "description": "1 instance changed",
-    "reported_at": 1791879898.512249,
+    "reported_at": 1792045498.5715408,
     "pipeline": "custom-start-points-ci",
     "deployments": [],
     "flows": [
@@ -297,18 +255,18 @@ kosli log environment aws-prod --output=json
         "html": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci/artifacts/6726c2fe6436edca6caaeed069531e326f7bfdceeac41feed28bef90a036cc93?artifact_id=93be9d1e-6eff-4ff5-a077-ed2baf30"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5478",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5478"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5483",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5483"
       }
     }
   },
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5478,
+    "snapshot_index": 5483,
     "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:842bdad@sha256:807d0a7538fb9c739beab0b9f2793fe24c0a8bf079ef731ec2a2c2fe6464c463",
     "sha256": "807d0a7538fb9c739beab0b9f2793fe24c0a8bf079ef731ec2a2c2fe6464c463",
     "description": "1 instance changed",
-    "reported_at": 1791879898.512249,
+    "reported_at": 1792045498.5715408,
     "pipeline": "differ-ci",
     "deployments": [],
     "flows": [
@@ -335,18 +293,18 @@ kosli log environment aws-prod --output=json
         "html": "https://app.kosli.com/cyber-dojo/flows/differ-ci/artifacts/807d0a7538fb9c739beab0b9f2793fe24c0a8bf079ef731ec2a2c2fe6464c463?artifact_id=ec8bd3c0-ab13-4965-86f8-f877f334"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5478",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5478"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5483",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5483"
       }
     }
   },
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5478,
+    "snapshot_index": 5483,
     "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:b17fe49@sha256:896a2cd49408db95a29b752857d17c6b68df23d8a27b75e70f2e55aa0c3d367f",
     "sha256": "896a2cd49408db95a29b752857d17c6b68df23d8a27b75e70f2e55aa0c3d367f",
     "description": "1 instance changed",
-    "reported_at": 1791879898.512249,
+    "reported_at": 1792045498.5715408,
     "pipeline": "nginx-ci",
     "deployments": [],
     "flows": [
@@ -373,18 +331,18 @@ kosli log environment aws-prod --output=json
         "html": "https://app.kosli.com/cyber-dojo/flows/nginx-ci/artifacts/896a2cd49408db95a29b752857d17c6b68df23d8a27b75e70f2e55aa0c3d367f?artifact_id=7b471a07-4b64-4ba5-a309-633e3281"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5478",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5478"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5483",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5483"
       }
     }
   },
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5478,
+    "snapshot_index": 5483,
     "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:ef6768e@sha256:9b6ccf0845871128cd22f33e8ec0e0a29b1794e736b5ef783ade3c8bca11c80b",
     "sha256": "9b6ccf0845871128cd22f33e8ec0e0a29b1794e736b5ef783ade3c8bca11c80b",
     "description": "3 instances changed",
-    "reported_at": 1791879898.512249,
+    "reported_at": 1792045498.5715408,
     "pipeline": "runner-ci",
     "deployments": [],
     "flows": [
@@ -411,18 +369,18 @@ kosli log environment aws-prod --output=json
         "html": "https://app.kosli.com/cyber-dojo/flows/runner-ci/artifacts/9b6ccf0845871128cd22f33e8ec0e0a29b1794e736b5ef783ade3c8bca11c80b?artifact_id=c0267819-47af-42c9-bb43-4470c04f"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5478",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5478"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5483",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5483"
       }
     }
   },
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5478,
+    "snapshot_index": 5483,
     "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:8442c1b@sha256:b4f37af37368717581502192e3dfc9a55526c528d2f0dd927ff562c856c1a81a",
     "sha256": "b4f37af37368717581502192e3dfc9a55526c528d2f0dd927ff562c856c1a81a",
     "description": "1 instance changed",
-    "reported_at": 1791879898.512249,
+    "reported_at": 1792045498.5715408,
     "pipeline": "languages-start-points-ci",
     "deployments": [],
     "flows": [
@@ -449,18 +407,18 @@ kosli log environment aws-prod --output=json
         "html": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci/artifacts/b4f37af37368717581502192e3dfc9a55526c528d2f0dd927ff562c856c1a81a?artifact_id=87445ff6-7ec9-4337-bf43-0e9b796b"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5478",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5478"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5483",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5483"
       }
     }
   },
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5478,
+    "snapshot_index": 5483,
     "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:83553f5@sha256:da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
     "sha256": "da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
     "description": "3 instances changed",
-    "reported_at": 1791879898.512249,
+    "reported_at": 1792045498.5715408,
     "pipeline": "web-ci",
     "deployments": [],
     "flows": [
@@ -472,6 +430,10 @@ kosli log environment aws-prod --output=json
         "flow_name": "production-promotion",
         "deployments": null
       },
+      {
+        "flow_name": "snyk-aws-beta-per-artifact",
+        "deployments": null
+      },
       {
         "flow_name": "snyk-aws-prod-per-artifact",
         "deployments": null
@@ -487,18 +449,18 @@ kosli log environment aws-prod --output=json
         "html": "https://app.kosli.com/cyber-dojo/flows/web-ci/artifacts/da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78?artifact_id=bb10f025-89b9-463a-9857-0a4a205b"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5478",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5478"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5483",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5483"
       }
     }
   },
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5478,
+    "snapshot_index": 5483,
     "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:3e6678b@sha256:ee739c0183759b660a740afe28fbbdb20b4c3b434faa48dab975aa8576173efb",
     "sha256": "ee739c0183759b660a740afe28fbbdb20b4c3b434faa48dab975aa8576173efb",
     "description": "1 instance changed",
-    "reported_at": 1791879898.512249,
+    "reported_at": 1792045498.5715408,
     "pipeline": "creator-ci",
     "deployments": [],
     "flows": [
@@ -525,23 +487,23 @@ kosli log environment aws-prod --output=json
         "html": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/ee739c0183759b660a740afe28fbbdb20b4c3b434faa48dab975aa8576173efb?artifact_id=349ebdb8-fe2c-41fb-a05d-49675a91"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5478",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5478"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5483",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5483"
       }
     }
   },
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5477,
-    "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:3e6678b@sha256:b2c1ecdf766f6f687057bc95139e1c4f2cf9d086b81586f1b1e9096a279316fd",
-    "sha256": "b2c1ecdf766f6f687057bc95139e1c4f2cf9d086b81586f1b1e9096a279316fd",
-    "description": "3 instances stopped running (from 3 to 0)",
-    "reported_at": 1791806518.5142465,
-    "pipeline": "web-ci",
+    "snapshot_index": 5482,
+    "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:b543342@sha256:2bb4255d1477046c8042e9973482a02e0d66b35ce31d86287a58342e990c0efa",
+    "sha256": "2bb4255d1477046c8042e9973482a02e0d66b35ce31d86287a58342e990c0efa",
+    "description": "1 instance changed",
+    "reported_at": 1791960178.6282132,
+    "pipeline": "saver-ci",
     "deployments": [],
     "flows": [
       {
-        "flow_name": "web-ci",
+        "flow_name": "saver-ci",
         "deployments": null
       },
       {
@@ -555,26 +517,64 @@ kosli log environment aws-prod --output=json
     ],
     "artifact_compliance": true,
     "snapshot_compliance": true,
-    "type": "exited",
+    "type": "changed",
+    "code_diff": "https://github.com/cyber-dojo/saver/compare/5799bb754b5d0fa5469650050d1e0402e9297ed9...b543342fa06b0ef415950745fddfff5a85f9d80d",
+    "_links": {
+      "artifact": {
+        "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/saver-ci/fingerprint/2bb4255d1477046c8042e9973482a02e0d66b35ce31d86287a58342e990c0efa",
+        "html": "https://app.kosli.com/cyber-dojo/flows/saver-ci/artifacts/2bb4255d1477046c8042e9973482a02e0d66b35ce31d86287a58342e990c0efa?artifact_id=02ed2b7d-e77e-4543-946c-7f0eb3eb"
+      },
+      "snapshot": {
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5482",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5482"
+      }
+    }
+  },
+  {
+    "environment_name": "aws-prod",
+    "snapshot_index": 5482,
+    "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:3e6678b@sha256:5f70df2163e8918675c92251f398bc1a88d0d7a9ce1eef39d1f603525de077b6",
+    "sha256": "5f70df2163e8918675c92251f398bc1a88d0d7a9ce1eef39d1f603525de077b6",
+    "description": "1 instance changed",
+    "reported_at": 1791960178.6282132,
+    "pipeline": "dashboard-ci",
+    "deployments": [],
+    "flows": [
+      {
+        "flow_name": "dashboard-ci",
+        "deployments": null
+      },
+      {
+        "flow_name": "production-promotion",
+        "deployments": null
+      },
+      {
+        "flow_name": "snyk-aws-prod-per-artifact",
+        "deployments": null
+      }
+    ],
+    "artifact_compliance": true,
+    "snapshot_compliance": true,
+    "type": "changed",
     "code_diff": "https://github.com/cyber-dojo/web/compare/239086385550e2c369fd3aa1f656b56f362db8f7...3e6678b80d51d7ec4c89d88f46dcee93f27fd6c1",
     "_links": {
       "artifact": {
-        "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/web-ci/fingerprint/b2c1ecdf766f6f687057bc95139e1c4f2cf9d086b81586f1b1e9096a279316fd",
-        "html": "https://app.kosli.com/cyber-dojo/flows/web-ci/artifacts/b2c1ecdf766f6f687057bc95139e1c4f2cf9d086b81586f1b1e9096a279316fd?artifact_id=b989576f-1600-41bb-87cd-91d54378"
+        "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/dashboard-ci/fingerprint/5f70df2163e8918675c92251f398bc1a88d0d7a9ce1eef39d1f603525de077b6",
+        "html": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci/artifacts/5f70df2163e8918675c92251f398bc1a88d0d7a9ce1eef39d1f603525de077b6?artifact_id=6923c594-deee-4b7c-83e9-3165a9ed"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5477",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5477"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5482",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5482"
       }
     }
   },
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5476,
+    "snapshot_index": 5482,
     "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:83553f5@sha256:da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
     "sha256": "da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78",
-    "description": "3 instances started running (from 0 to 3)",
-    "reported_at": 1791806458.6975975,
+    "description": "3 instances changed",
+    "reported_at": 1791960178.6282132,
     "pipeline": "web-ci",
     "deployments": [],
     "flows": [
@@ -585,11 +585,19 @@ kosli log environment aws-prod --output=json
       {
         "flow_name": "production-promotion",
         "deployments": null
+      },
+      {
+        "flow_name": "snyk-aws-prod-per-artifact",
+        "deployments": null
+      },
+      {
+        "flow_name": "snyk-aws-beta-per-artifact",
+        "deployments": null
       }
     ],
     "artifact_compliance": true,
     "snapshot_compliance": true,
-    "type": "started-compliant",
+    "type": "changed",
     "code_diff": "https://github.com/cyber-dojo/web/compare/3e6678b80d51d7ec4c89d88f46dcee93f27fd6c1...83553f52e8de8a9766a64fced8fbfb3cd32318a3",
     "_links": {
       "artifact": {
@@ -597,23 +605,23 @@ kosli log environment aws-prod --output=json
         "html": "https://app.kosli.com/cyber-dojo/flows/web-ci/artifacts/da7984414ab096232877f301d3d7cea1daf3cdd3fdb72157f530fe186cba3d78?artifact_id=bb10f025-89b9-463a-9857-0a4a205b"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5476",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5476"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5482",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5482"
       }
     }
   },
   {
     "environment_name": "aws-prod",
-    "snapshot_index": 5475,
-    "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:5799bb7@sha256:f7da4f8c48fa84c3b03a4dcb158c05004cfea877269a6488f86eab84e9e44195",
-    "sha256": "f7da4f8c48fa84c3b03a4dcb158c05004cfea877269a6488f86eab84e9e44195",
-    "description": "1 instance stopped running (from 1 to 0)",
-    "reported_at": 1791801958.431194,
-    "pipeline": "saver-ci",
+    "snapshot_index": 5482,
+    "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:3e6678b@sha256:ee739c0183759b660a740afe28fbbdb20b4c3b434faa48dab975aa8576173efb",
+    "sha256": "ee739c0183759b660a740afe28fbbdb20b4c3b434faa48dab975aa8576173efb",
+    "description": "1 instance changed",
+    "reported_at": 1791960178.6282132,
+    "pipeline": "creator-ci",
     "deployments": [],
     "flows": [
       {
-        "flow_name": "saver-ci",
+        "flow_name": "creator-ci",
         "deployments": null
       },
       {
@@ -623,24 +631,20 @@ kosli log environment aws-prod --output=json
       {
         "flow_name": "snyk-aws-prod-per-artifact",
         "deployments": null
-      },
-      {
-        "flow_name": "snyk-aws-beta-per-artifact",
-        "deployments": null
       }
     ],
     "artifact_compliance": true,
     "snapshot_compliance": true,
-    "type": "exited",
-    "code_diff": "https://github.com/cyber-dojo/saver/compare/c638c1e0bb5f782b0356f2b33d55300b37acd2d1...5799bb754b5d0fa5469650050d1e0402e9297ed9",
+    "type": "changed",
+    "code_diff": "https://github.com/cyber-dojo/web/compare/3b4ef042cde981a0668dec70ed3137041a51cbe6...3e6678b80d51d7ec4c89d88f46dcee93f27fd6c1",
     "_links": {
       "artifact": {
-        "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/saver-ci/fingerprint/f7da4f8c48fa84c3b03a4dcb158c05004cfea877269a6488f86eab84e9e44195",
-        "html": "https://app.kosli.com/cyber-dojo/flows/saver-ci/artifacts/f7da4f8c48fa84c3b03a4dcb158c05004cfea877269a6488f86eab84e9e44195?artifact_id=314775a2-8c5b-480d-9a17-0c82c86f"
+        "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/creator-ci/fingerprint/ee739c0183759b660a740afe28fbbdb20b4c3b434faa48dab975aa8576173efb",
+        "html": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/ee739c0183759b660a740afe28fbbdb20b4c3b434faa48dab975aa8576173efb?artifact_id=349ebdb8-fe2c-41fb-a05d-49675a91"
       },
       "snapshot": {
-        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5475",
-        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5475"
+        "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5482",
+        "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5482"
       }
     }
   }
diff --git a/client_reference/kosli_report_artifact.md b/client_reference/kosli_report_artifact.md
index 92a51214..59658976 100644
--- a/client_reference/kosli_report_artifact.md
+++ b/client_reference/kosli_report_artifact.md
@@ -50,6 +50,9 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
+This command always requires access to a git repository to read `--git-commit` and the commits since the previous artifact.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory.
+
 ## Flags
 | Flag | Type | Description |
 | :--- | :--- | :--- |
@@ -60,13 +63,13 @@ To drop the file from the fingerprint safely, move its entries to `--exclude` an
 | `-x`, `--exclude` | strings | [optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir. |
 | `-F`, `--fingerprint` | string | [conditional] The SHA256 fingerprint of the artifact. Only required if you don't specify '`--artifact-type`'. |
 | `-f`, `--flow` | string | The Kosli flow name. |
-| `-g`, `--git-commit` | string | [defaulted] The git commit from which the artifact was created. (defaulted in some CIs: [docs](/integrations/ci_cd), otherwise defaults to HEAD ). |
+| `-g`, `--git-commit` | string | [defaulted] The git commit from which the artifact was created. (defaulted in some CIs: [docs](/integrations/ci_cd), otherwise required ). The commit is read from the git repository at `--repo-root`. |
 | `-h`, `--help` | bool | help for artifact |
 | `-n`, `--name` | string | [optional] Artifact display name, if different from file, image or directory name. |
 | `--registry-password` | string | [conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--registry-provider` | string | [deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used) |
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. (default ".") |
 
 
 ## Flags inherited from parent commands
diff --git a/client_reference/overview.md b/client_reference/overview.md
index 54bb086e..2ac66259 100644
--- a/client_reference/overview.md
+++ b/client_reference/overview.md
@@ -4,7 +4,7 @@ description: "Reference documentation for the Kosli CLI."
 ---
 
 <Info>
-  This reference was generated from Kosli CLI **v2.47.2**.
+  This reference was generated from Kosli CLI **v2.48.0**.
 </Info>
 
 The Kosli CLI allows you to interact with Kosli from your terminal and CI/CD pipelines.