Separate replay value from live urgency
Some ended sessions still explain the present trust story better than a purely live queue.
Sessions Category View
Use This Page When Asking
Which runs changed trust, scope, or boundary exposure enough to deserve review right now?
Sessions in scope
43
5 active, 38 ended
High-signal runs
3
Trust or boundary changes
Shared-key sessions
4
Affect attribution confidence
Fastest drill
1 live + 1 ended
One active session and one anchor replay
Why This Page Exists
What This Page Should Make Obvious
Some ended sessions still explain the present trust story better than a purely live queue.
Sensitive-file access plus outbound traffic is more important than a newer but routine run.
User, endpoint, model, and key should stay visible beside the session story.
Fastest Drill Paths
The session that binds sensitive files, shared credentials, and outbound traffic together.
Best first click for understanding the current trust break.
The list still needs a clear path to the currently running sessions.
Operators need to compare live urgency against historical explanation.
Session-Centered Topology
Useful per session: actor chain, execution context, touched assets, outbound calls, and the posture signals that make this session normal or suspicious.
Session
alice@company.com · active session
Claude Code v1.2.0 on alice-mbp.local using claude-sonnet-4-6 with sk-ant-...A3F2.
14m live · 8 turns · $0.43
Touched capabilities
filesystem · github · web-search
Files in scope
3 files · 1 sensitive
Outbound edges
2 hosts
Current posture
active · within normal band
The primary “who ran this?” questions.
The core runtime dependencies.
What the session read or changed.
What deserves review before drilling deeper.
c6 Raw Reference
Active
5
Live now
Total (24h)
43
Recent runs
Total cost
$52.48
Session spend
Unique users
7
Distinct actors
Why Keep The Raw Ledger
Open c6 Raw List
Use the original category ledger for exact rows, counts, and timestamps.
Open c6 raw listRaw Session Ledger
User, agent, endpoint, model, key, timing, and cost.
| User | Agent | Endpoint | Model | API Key | Status |
|---|---|---|---|---|---|
| alice@company.com | Claude Code v1.2.0 | alice-mbp.local | claude-sonnet-4-6 | sk-ant-...A3F2 | active |
| unknown | Claude Code v1.2.0 | 10.0.1.44 | claude-sonnet-4-6 | sk-ant-...C001 | active |
| bob@company.com | Cursor 0.42.0 | bob-thinkpad.local | claude-opus-4-6 | sk-ant-...A3F2 | ended |