Reference

Quarry action reference

Every remediation Kestrel can perform. This is the model’s entire vocabulary — it selects one identifier from this list and can produce nothing else.

quarry-bundle 2026.07.3 · signed 2026-07-28T11:02:17Z · 12 actions · generated from quarry/manifests

GENERATED

This page is produced from the signed action manifests at build time. Editing it by hand fails CI. There is one source, and it is the same one the agent verifies against.

Tier	Count	Meaning	Maximum autonomy
Tier 0	3	Read-only or trivially reversible	Unattended
Tier 1	5	Reversible service-level change	Unattended
Tier 2	3	System change with a tested rollback	Unattended, explicit grant only
Tier 3	1	High blast radius or irreversible	Approval required, always

IRREVERSIBLE

quarry.disk.logrotatequarry.disk.partition.resize
These declare reversible: false and can never be promoted to unattended, at any tier or scope. Creance rejects that configuration at the data layer.

Tier 0

quarry.diagnostics.collect

v6.0.0 · windows · macos · linux

Collect a diagnostics bundle

Gathers the telemetry needed to diagnose without changing anything. Read-only by construction: the action has no write path.

Tier 0reversibleno elevation≤120s100.0% over 8,140 runs4 batedmedian 12s

Rollback: Nothing to roll back. The action writes nothing to the device.
Preconditions: None
Verification: Bundle uploaded and hash matches
Review: security-eng · sandbox 2026-07-27
sha256:cd7134be09a2f5680d3c1ea75b924f08361ad7c02e9b4d51836ea7c0bf29d146

Parameters

include_event_logbooleandefault trueInclude the incident-scoped event log slice.

quarry.dns.cache.flush

v1.2.0 · windows · macos · linux

Flush the DNS resolver cache

Clears the local resolver cache and re-registers the client. Read-adjacent and trivially reversible; the cache repopulates on demand.

Tier 0reversibleelevation · single-call≤20s99.9% over 1,522 runs1 batedmedian 2s

Rollback: None required. The cache is a cache.
Preconditions: Resolver service is running
Verification: A known-good hostname resolves
Review: security-eng · sandbox 2026-06-18
sha256:5cd8a027fe13b94620d7a5c81eb03f47921ade65c07b34d8f2ea910c65b7d349

No parameters.

quarry.smb.credential.refresh

v1.4.1 · windows · macos

Re-establish a mapped network drive

Re-mounts a mapped drive against the stored credential, refreshes the Kerberos ticket, and confirms a directory listing succeeds.

Tier 0reversibleno elevation≤30s99.8% over 2,911 runs7 batedmedian 4s

Rollback: Restores the previous mount state. No data is written.
Preconditions: A stored credential exists for the share · Device is on the corporate network or VPN
Verification: Directory listing on the mount returns without error
Review: security-eng · sandbox 2026-06-30
sha256:41ae90bc7712d55f3e08c1a4b6d9e2374f8051ca9b3d7e6021458cc7fa3b9d12

Parameters

drive_letterstringrequiredDrive letter or mount point to re-establish.
renew_kerberosbooleandefault trueRenew the Kerberos ticket before re-mounting.

Tier 1

quarry.disk.logrotate

v2.0.3 · windows · macos · linux

Truncate a runaway log directory

Identifies a log directory consuming the volume, verifies it against a hard-coded allow-list, and truncates by age. Will not follow symlinks and will not act on any path outside the list.

Tier 1not reversibleelevation · single-call≤120s99.4% over 338 runs2 batedmedian 21s

Rollback: None. Truncation is not reversible, which is why this action cannot be promoted to unattended above the tier it declares, and why the allow-list is compiled in rather than configured.
Preconditions: Free space below 8% · Target directory is on the compiled allow-list · No symlink in the resolved path
Verification: Free space above 15% · A manifest of removed files is written to the audit record
Review: security-eng · sandbox 2026-07-25
sha256:70cd91a8b2e34f076c5d81ba9e2f4038d1a67c95be04732f8ad61c0e5b93da77

Parameters

older_than_daysintegerdefault 14Only files older than this are removed. Minimum 3; the parameter is clamped, not trusted.

quarry.outlook.ost.rebuild

v2.7.0 · windows

Rebuild a corrupt Outlook OST profile cache

Closes Outlook cleanly, renames the OST rather than deleting it, and allows the client to rebuild the cache from the server on next launch.

Tier 1reversibleno elevation≤600s97.2% over 604 runs17 batedmedian 252s

Rollback: Restores the renamed OST to its original path. Nothing is deleted at any point.
Preconditions: Outlook is installed · At least 2x the OST size is free on the volume · The mailbox is server-backed, not a local PST
Verification: Outlook launches · New OST is created and reaches sync state
Review: security-eng · sandbox 2026-07-11
sha256:c73d2f8a91be045c6e17d3b820af49165d0c8ea27b41f93d5e6a0c71bb28d4f6

Parameters

profilestringNamed profile. Defaults to the logged-in user's default profile.

quarry.printspool.restart

v4.2.0 · windows

Restart the print spooler

Stops the spooler service, optionally clears the queue directory, restarts, and confirms the service reaches a running state.

Tier 1reversibleelevation · single-call≤60s99.0% over 1,284 runs13 batedmedian 8s

Rollback: Restores the prior service start type and state. Cleared spool files are moved to a timestamped quarantine directory rather than deleted, and restored on rollback.
Preconditions: Spooler service exists · Device health is healthy or degraded
Verification: Spooler service state is running · Optional test page returns a job id
Review: security-eng · sandbox 2026-07-19
sha256:9f2b1c7ae04d3f61b8a5d2e77c4419ba0d6e83f1c2ab94577e10dd3612c81a04

Parameters

clear_queuebooleandefault trueMove queued jobs to quarantine before restart. A single corrupt job is the usual cause.

quarry.profile.teams.reset

v1.9.0 · windows · macos

Reset the Teams client cache

Closes Teams, moves the client cache to quarantine, and relaunches so the client rebuilds. Sign-in state is preserved.

Tier 1reversibleno elevation≤180s98.2% over 488 runs9 batedmedian 64s

Rollback: Restores the quarantined cache directory.
Preconditions: Teams is installed · User session is interactive
Verification: Teams launches and reaches signed-in state
Review: security-eng · sandbox 2026-07-02
sha256:38f0c7a1be5d24906c8b13ea7d5f0284b91c6ad703e4f5182bc9d06e4a731f5c

No parameters.

quarry.service.restart

v5.0.1 · windows · macos · linux

Restart a named service

Restarts a service from the allow-listed service set and verifies it reaches a running state. The service name is validated against the list; an arbitrary name is refused.

Tier 1reversibleelevation · single-call≤90s99.3% over 3,877 runs26 batedmedian 6s

Rollback: Restores the prior service state and start type.
Preconditions: Service exists · Service is not disabled by policy
Verification: Service state is running · No dependent service left stopped
Review: security-eng · sandbox 2026-07-26
sha256:e02b7d419ca8f35607b1de2c94a0f7813d5c6ba207e94f13c8a0db756e2f4013

Parameters

serviceenumrequiredThe service to restart. The enum is the entire permitted set — there is no free-text option.Spooler | Dnscache | wuauserv | BITS | LanmanWorkstation | cups | systemd-resolved | com.apple.mDNSResponder

Tier 2

quarry.certificate.renew

v2.1.0 · windows · macos

Renew an expiring machine certificate

Requests renewal of a machine certificate from the configured enrollment endpoint and installs it alongside the existing certificate before removing the old one.

Tier 2reversibleelevation · single-call≤180s97.3% over 147 runs4 batedmedian 46s

Rollback: The prior certificate is retained until verification passes; rollback restores it as the active binding.
Preconditions: Existing certificate expires within 30 days · Enrollment endpoint reachable · Device is domain or MDM joined
Verification: New certificate present and valid · 802.1X or VPN binding still functions
Review: security-eng · sandbox 2026-07-08
sha256:b6104f8ad297e35c02b7dc419e068a3f5721cbd840e9a67f2c1b3d095ae74620

Parameters

templatestringrequiredCertificate template name as configured in your CA.

quarry.driver.rollback

v3.4.0 · windows

Roll a device driver back to the prior signed version

Identifies a recently-installed driver, snapshots the current driver store entry, and rolls back to the previously installed signed version.

Tier 2reversibleelevation · single-call≤300s93.4% over 212 runs14 batedmedian 185s

Rollback: Reinstalls the driver version that was present before the action, from the snapshot taken at step 1.
Preconditions: A prior signed driver version exists in the store · Device is on AC power · No pending reboot
Verification: Driver version matches the prior version · Device manager reports no error code · Post-action telemetry shows the class functioning
Review: security-eng · sandbox 2026-07-14
sha256:9a41c2be70d385f16b0c4ed9a273f8501cb6d4e2079f3a1c85be620d4fc17a98

Parameters

device_classenumrequiredWhich class of device. Storage rollbacks additionally require approval regardless of policy.display | network | audio | storage | input
installed_afterstringISO date. Only roll back drivers installed after this point.

quarry.vpn.adapter.reinstall

v3.1.2 · windows

Reinstall an orphaned VPN virtual adapter

Detects a virtual adapter left non-functional by an OS update, removes and reinstalls it from the vendor's installed driver store, restores the route table and reconnects.

Tier 2reversibleelevation · single-call≤300s95.9% over 419 runs17 batedmedian 158s

Rollback: Snapshots the adapter configuration and route table before acting, and restores both if the reconnect verification fails.
Preconditions: The vendor client is installed · A driver package is present in the local store · Device is not currently on the VPN
Verification: Adapter present and enabled · Tunnel establishes · Default route restored
Review: security-eng · sandbox 2026-07-22
sha256:2b8f04c17ad63e95210cbf4d7e08a3169c5d24ba0f7e1938c46b5d02a1fe7c33

Parameters

vendorenumrequiredWhich vendor's adapter to rebuild. Kestrel will not guess.cisco-anyconnect | paloalto-globalprotect | fortinet | openvpn | wireguard

Tier 3

quarry.disk.partition.resize

v0.4.0 · windows · linux

Resize a disk partition

Resizes a partition. Present in the library as a worked example of a Tier 3 action, and permanently gated behind human approval.

Tier 3not reversibleelevation · single-call≤1800s100.0% over 6 runs0 batedmedian 940s

Rollback: None. Partition geometry changes cannot be reversed in place. This is why the action is Tier 3 and why no policy can set it to unattended — Creance rejects that configuration at the data layer.
Preconditions: A verified backup exists within 24 hours · Device is on AC power · Approval from a policy_admin or security role
Verification: Partition table consistent · Filesystem mounts · Post-action integrity check passes
Review: security-eng · sandbox 2026-05-30
sha256:a10f47c2be9d3805617c4dae920fb35d81470c6ea3b95f2d0c8a17be643d92f0

Parameters

partitionstringrequiredTarget partition identifier.
size_gbintegerrequiredNew size in gigabytes.