aegis-devops 0.1.1__tar.gz → 0.1.2__tar.gz

{aegis_devops-0.1.1/src/aegis_devops.egg-info → aegis_devops-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.1.1
+Version: 0.1.2
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -32,6 +32,9 @@ Dynamic: license-file
 
 # Aegis-DevOps — Policy Verifier for AI DevOps Agents
 
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
+[![PyPI](https://img.shields.io/pypi/v/aegis-devops)](https://pypi.org/project/aegis-devops/)
+
 **Provenance-backed, authority-aware guardrails that stop context poisoning and agentic drift
 before an AI agent's `kubectl` or `terraform` action reaches your infrastructure.**
 
@@ -162,7 +165,12 @@ oracle that never imports Aegis's own code. The full table
 | :--- | ---: | ---: | ---: |
 | **aegis** | **0.000** | **0.000** | **0.000** |
 | codex (gpt-6-astra) | 0.150 | 0.300 | 0.200 |
+| codex-gpt-6-sol | 0.150 | 0.300 | 0.200 |
+| codex-gpt-6-luna | 0.117 | 0.233 | 0.100 |
 | claude-cli (haiku) | 0.150 | 0.300 | 0.200 |
+| claude-cli-sonnet | 0.167 | 0.333 | 0.200 |
+| claude-cli-opus | 0.150 | 0.300 | 0.200 |
+| claude-cli-fable | 0.150 | 0.300 | 0.200 |
 | opa-signed | 0.250 | 0.500 | 1.000 |
 | opa | 0.500 | 1.000 | 1.000 |
 | llm-heuristic | 0.500 | 1.000 | 1.000 |
@@ -175,10 +183,15 @@ It's the headline column because **signing a policy bundle proves it wasn't alte
 not that its author was ever allowed to write the rule** — `opa-signed` scores `1.000` on it for
 exactly that reason, while Aegis's independent authority check scores `0.000`.
 
-The `codex` and `claude-cli` rows are **agent harnesses wrapped around a model**, not raw
-completions, and — unlike the other rows — are scored against a 100-constraint holdout subset
-rather than the full 500-constraint store, for context-window and cost reasons; see
-[`docs/benchmark.md`](docs/benchmark.md) before comparing them with anything else in the table.
+The `codex*` and `claude-cli*` rows are **agent harnesses wrapped around a model**, not raw
+completions — seven models across two vendors (Claude Haiku 4.5, Sonnet 5, Opus 5 and Fable
+5.1; GPT `gpt-6-astra`, `gpt-6-sol` and `gpt-6-luna`), each verified before its run to be the
+model that actually answered — and — unlike the other rows — are scored against a
+100-constraint holdout subset rather than the full 500-constraint store, for context-window and
+cost reasons; see [`docs/benchmark.md`](docs/benchmark.md) before comparing them with anything
+else in the table. Model size and vendor do not change the picture: all seven land between
+0.23 and 0.33 poison-susceptibility, and every one acts on 5 of 8 forged rules — a model can
+reason about who wrote a rule, but not recompute a hash or fetch a source.
 
 ## Why not OPA/Gatekeeper?
 

{aegis_devops-0.1.1 → aegis_devops-0.1.2}/README.md

@@ -1,5 +1,8 @@
 # Aegis-DevOps — Policy Verifier for AI DevOps Agents
 
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
+[![PyPI](https://img.shields.io/pypi/v/aegis-devops)](https://pypi.org/project/aegis-devops/)
+
 **Provenance-backed, authority-aware guardrails that stop context poisoning and agentic drift
 before an AI agent's `kubectl` or `terraform` action reaches your infrastructure.**
 
@@ -130,7 +133,12 @@ oracle that never imports Aegis's own code. The full table
 | :--- | ---: | ---: | ---: |
 | **aegis** | **0.000** | **0.000** | **0.000** |
 | codex (gpt-6-astra) | 0.150 | 0.300 | 0.200 |
+| codex-gpt-6-sol | 0.150 | 0.300 | 0.200 |
+| codex-gpt-6-luna | 0.117 | 0.233 | 0.100 |
 | claude-cli (haiku) | 0.150 | 0.300 | 0.200 |
+| claude-cli-sonnet | 0.167 | 0.333 | 0.200 |
+| claude-cli-opus | 0.150 | 0.300 | 0.200 |
+| claude-cli-fable | 0.150 | 0.300 | 0.200 |
 | opa-signed | 0.250 | 0.500 | 1.000 |
 | opa | 0.500 | 1.000 | 1.000 |
 | llm-heuristic | 0.500 | 1.000 | 1.000 |
@@ -143,10 +151,15 @@ It's the headline column because **signing a policy bundle proves it wasn't alte
 not that its author was ever allowed to write the rule** — `opa-signed` scores `1.000` on it for
 exactly that reason, while Aegis's independent authority check scores `0.000`.
 
-The `codex` and `claude-cli` rows are **agent harnesses wrapped around a model**, not raw
-completions, and — unlike the other rows — are scored against a 100-constraint holdout subset
-rather than the full 500-constraint store, for context-window and cost reasons; see
-[`docs/benchmark.md`](docs/benchmark.md) before comparing them with anything else in the table.
+The `codex*` and `claude-cli*` rows are **agent harnesses wrapped around a model**, not raw
+completions — seven models across two vendors (Claude Haiku 4.5, Sonnet 5, Opus 5 and Fable
+5.1; GPT `gpt-6-astra`, `gpt-6-sol` and `gpt-6-luna`), each verified before its run to be the
+model that actually answered — and — unlike the other rows — are scored against a
+100-constraint holdout subset rather than the full 500-constraint store, for context-window and
+cost reasons; see [`docs/benchmark.md`](docs/benchmark.md) before comparing them with anything
+else in the table. Model size and vendor do not change the picture: all seven land between
+0.23 and 0.33 poison-susceptibility, and every one acts on 5 of 8 forged rules — a model can
+reason about who wrote a rule, but not recompute a hash or fetch a source.
 
 ## Why not OPA/Gatekeeper?
 

{aegis_devops-0.1.1 → aegis_devops-0.1.2}/src/aegis_core/__init__.py

@@ -4,4 +4,4 @@ infrastructure actions of AI agents.
 See the README for what this does and, importantly, what it does not yet do.
 """
 
-__version__ = "0.1.1"
+__version__ = "0.1.2"

{aegis_devops-0.1.1 → aegis_devops-0.1.2}/src/aegis_core/baselines/external.py

@@ -78,6 +78,9 @@ _CODEX_BASE_ARGS = [
 
 _VERDICT_LINE_RE = re.compile(r"^\s*(ALLOW|BLOCK|ESCALATE)\b.*$", re.IGNORECASE | re.MULTILINE)
 _MODEL_BANNER_RE = re.compile(r"^model:\s*(\S+)\s*$", re.MULTILINE)
+# Claude Code's usage-limit reply, e.g. "You've hit your session limit · resets 2:10am".
+_CLAUDE_LIMIT_RE = re.compile(r"(session|usage|rate|weekly) limit|limit reached", re.I)
+_CLAUDE_RESET_RE = re.compile(r"resets?\s+(?:at\s+)?([0-9]{1,2}(?::[0-9]{2})?\s?(?:am|pm)?)", re.I)
 _TOKENS_USED_RE = re.compile(r"tokens used\s*\n\s*([\d,]+)", re.IGNORECASE)
 
 
@@ -154,10 +157,20 @@ class CodexCliClient:
             # <time>") land on stderr, not stdout -- combine both so a
             # quota error doesn't silently look like an empty response.
             combined = stdout + "\n" + stderr if stderr else stdout
+            if re.search(r"usage limit", combined, re.I):
+                when = re.search(r"try again at ([^.\n]+)", combined, re.I)
+                raise QuotaExceededError(
+                    "codex usage limit reached", when.group(1).strip() if when else None
+                )
 
             model_match = _MODEL_BANNER_RE.search(combined)
             if model_match:
                 self.resolved_model = model_match.group(1)
+                if self.model and self.resolved_model != self.model:
+                    raise ModelMismatchError(
+                        f"requested codex model {self.model!r} but the CLI ran "
+                        f"{self.resolved_model!r}"
+                    )
             tokens_match = _TOKENS_USED_RE.search(combined)
             if tokens_match:
                 self.last_tokens_used = int(tokens_match.group(1).replace(",", ""))
@@ -300,6 +313,27 @@ class OllamaClient:
 _AUTH_FAILURE_RE = re.compile(r"\b(401|authenticate|oauth)\b", re.IGNORECASE)
 
 
+class QuotaExceededError(RuntimeError):
+    """The CLI refused the call because the account hit a usage limit.
+
+    ``resets_at`` is the reset time as the CLI printed it ("10:44 PM",
+    "2:10am"), or None. Never retried and never cached, so a runner can wait
+    for the reset and resume from the recorded answers."""
+
+    def __init__(self, message: str, resets_at: str | None = None):
+        super().__init__(message)
+        self.resets_at = resets_at
+
+
+class ModelMismatchError(RuntimeError):
+    """The CLI answered with a different model than the one requested.
+
+    Agent CLIs can fall back to an account default without failing (a ChatGPT
+    account's Codex did exactly that), which would put one model's numbers under
+    another model's name. Never retried: a mismatch is a configuration problem,
+    not a transient one."""
+
+
 class ClaudeCliAuthError(RuntimeError):
     """Raised when ``claude -p`` reports ``is_error: true`` with a result
     that looks like an expired/missing OAuth session (see
@@ -421,8 +455,24 @@ class ClaudeCliClient:
         is_error = bool(envelope.get("is_error"))
         if is_error and _AUTH_FAILURE_RE.search(result_text):
             raise ClaudeCliAuthError("claude CLI is not authenticated: run 'claude login'")
+        if is_error and _CLAUDE_LIMIT_RE.search(result_text):
+            when = _CLAUDE_RESET_RE.search(result_text)
+            raise QuotaExceededError(
+                f"claude usage limit reached: {result_text[:120]}",
+                when.group(1).strip() if when else None,
+            )
 
         self.last_model_usage = envelope.get("modelUsage")
+        family = self.model.lower() if self.model else ""
+        known_family = family in ("haiku", "sonnet", "opus", "fable")
+        if known_family and isinstance(self.last_model_usage, dict):
+            used = list(self.last_model_usage)
+            # Claude Code may also call a small model for side tasks, so require the
+            # requested family to be present rather than to be the only one.
+            if used and not any(f"claude-{family}-" in m for m in used):
+                raise ModelMismatchError(
+                    f"requested claude {family!r} but the CLI reported {used}"
+                )
         self.last_tokens_used = _sum_token_usage(self.last_model_usage)
         self.last_session_id = envelope.get("session_id")
         self.last_num_turns = envelope.get("num_turns")
@@ -474,7 +524,7 @@ class RetryingClient:
         for _ in range(attempts):
             try:
                 return self.inner.complete(system, user)
-            except ClaudeCliAuthError:
+            except (ClaudeCliAuthError, ModelMismatchError, QuotaExceededError):
                 raise
             except RuntimeError as exc:
                 last_exc = exc

{aegis_devops-0.1.1 → aegis_devops-0.1.2}/src/aegis_core/baselines/llm.py

@@ -280,12 +280,29 @@ class RecordingClient:
         self.cache_path = Path(cache_path)
         self.cache_path.parent.mkdir(parents=True, exist_ok=True)
         self.model = model
+        # Resume: answers already on disk are reused, so a run interrupted by a
+        # usage limit continues where it stopped instead of re-asking (and
+        # re-paying for) every prompt. Identical prompts are asked once.
+        self._known: dict[str, str] = {}
+        if self.cache_path.exists():
+            for line in self.cache_path.read_text().splitlines():
+                if line.strip():
+                    row = json.loads(line)
+                    if (row.get("response") or "").strip():
+                        self._known[row["key"]] = row["response"]
+        self.reused = 0
 
     def complete(self, system: str, user: str) -> str:
+        key = _cache_key(system, user, self.model)
+        if key in self._known:
+            self.reused += 1
+            return self._known[key]
+        # A usage-limit error raises out of inner.complete, so it is never cached.
         response = self.inner.complete(system, user)
-        entry = _CacheEntry(key=_cache_key(system, user, self.model), response=response)
+        entry = _CacheEntry(key=key, response=response)
         with open(self.cache_path, "a") as f:
             f.write(json.dumps({"key": entry.key, "response": entry.response}) + "\n")
+        self._known[key] = response
         return response
 
 

{aegis_devops-0.1.1 → aegis_devops-0.1.2}/src/aegis_core/store.py

@@ -838,6 +838,23 @@ class ConstraintStore:
         self.constraints[constraint.id] = constraint
         return constraint
 
+    def _candidates(self, intent: InfrastructureIntent) -> list[Constraint]:
+        """Every loaded constraint that could possibly apply to ``intent``: the
+        ``(provider, action)`` and ``(provider, "*")`` buckets of the index.
+
+        Each matcher below rejects a constraint unless its provider equals the
+        intent's and its actions contain the intent's action or ``"*"``, which is
+        exactly the index key -- so these buckets are a superset of anything any
+        of them can return. All three draw from here so they cannot drift apart,
+        and a decision costs O(k) in the plausible constraints, not O(n) in the
+        store (REVIEW-4 T2.3)."""
+        candidates = self._index.get((intent.provider, intent.action), [])
+        wildcard = self._index.get((intent.provider, ANY_ACTION), [])
+        if wildcard:
+            seen = {id(c) for c in candidates}
+            candidates = candidates + [c for c in wildcard if id(c) not in seen]
+        return candidates
+
     def get_matching_constraints(
         self, intent: InfrastructureIntent, now: datetime
     ) -> list[Constraint]:
@@ -848,14 +865,9 @@ class ConstraintStore:
         constraints that could plausibly match, not O(n) in the whole
         store -- rather than every loaded constraint."""
         _require_tz_aware(now)
-        candidates = self._index.get((intent.provider, intent.action), [])
-        wildcard = self._index.get((intent.provider, ANY_ACTION), [])
-        if wildcard:
-            seen = {id(c) for c in candidates}
-            candidates = candidates + [c for c in wildcard if id(c) not in seen]
         return [
             c
-            for c in candidates
+            for c in self._candidates(intent)
             if _constraint_matches(c, intent, now, self.default_tz, self.tzdata_available)
         ]
 
@@ -867,7 +879,7 @@ class ConstraintStore:
         _require_tz_aware(now)
         return [
             c
-            for c in self.constraints.values()
+            for c in self._candidates(intent)
             if _matches_except_scope(c, intent, now, self.default_tz, self.tzdata_available)
             and env_unresolved(c.scope, intent)
         ]
@@ -884,7 +896,7 @@ class ConstraintStore:
         _require_tz_aware(now)
         return [
             c
-            for c in self.constraints.values()
+            for c in self._candidates(intent)
             if time_window_unresolved(c, intent, now, self.default_tz, self.tzdata_available)
         ]
 

{aegis_devops-0.1.1 → aegis_devops-0.1.2/src/aegis_devops.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.1.1
+Version: 0.1.2
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -32,6 +32,9 @@ Dynamic: license-file
 
 # Aegis-DevOps — Policy Verifier for AI DevOps Agents
 
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
+[![PyPI](https://img.shields.io/pypi/v/aegis-devops)](https://pypi.org/project/aegis-devops/)
+
 **Provenance-backed, authority-aware guardrails that stop context poisoning and agentic drift
 before an AI agent's `kubectl` or `terraform` action reaches your infrastructure.**
 
@@ -162,7 +165,12 @@ oracle that never imports Aegis's own code. The full table
 | :--- | ---: | ---: | ---: |
 | **aegis** | **0.000** | **0.000** | **0.000** |
 | codex (gpt-6-astra) | 0.150 | 0.300 | 0.200 |
+| codex-gpt-6-sol | 0.150 | 0.300 | 0.200 |
+| codex-gpt-6-luna | 0.117 | 0.233 | 0.100 |
 | claude-cli (haiku) | 0.150 | 0.300 | 0.200 |
+| claude-cli-sonnet | 0.167 | 0.333 | 0.200 |
+| claude-cli-opus | 0.150 | 0.300 | 0.200 |
+| claude-cli-fable | 0.150 | 0.300 | 0.200 |
 | opa-signed | 0.250 | 0.500 | 1.000 |
 | opa | 0.500 | 1.000 | 1.000 |
 | llm-heuristic | 0.500 | 1.000 | 1.000 |
@@ -175,10 +183,15 @@ It's the headline column because **signing a policy bundle proves it wasn't alte
 not that its author was ever allowed to write the rule** — `opa-signed` scores `1.000` on it for
 exactly that reason, while Aegis's independent authority check scores `0.000`.
 
-The `codex` and `claude-cli` rows are **agent harnesses wrapped around a model**, not raw
-completions, and — unlike the other rows — are scored against a 100-constraint holdout subset
-rather than the full 500-constraint store, for context-window and cost reasons; see
-[`docs/benchmark.md`](docs/benchmark.md) before comparing them with anything else in the table.
+The `codex*` and `claude-cli*` rows are **agent harnesses wrapped around a model**, not raw
+completions — seven models across two vendors (Claude Haiku 4.5, Sonnet 5, Opus 5 and Fable
+5.1; GPT `gpt-6-astra`, `gpt-6-sol` and `gpt-6-luna`), each verified before its run to be the
+model that actually answered — and — unlike the other rows — are scored against a
+100-constraint holdout subset rather than the full 500-constraint store, for context-window and
+cost reasons; see [`docs/benchmark.md`](docs/benchmark.md) before comparing them with anything
+else in the table. Model size and vendor do not change the picture: all seven land between
+0.23 and 0.33 poison-susceptibility, and every one acts on 5 of 8 forged rules — a model can
+reason about who wrote a rule, but not recompute a hash or fetch a source.
 
 ## Why not OPA/Gatekeeper?
 

{aegis_devops-0.1.1 → aegis_devops-0.1.2}/tests/test_baselines.py

@@ -831,3 +831,162 @@ def test_cache_key_includes_model_name_and_avoids_collisions(tmp_path):
     replay_untagged = ReplayClient(cache_path)
     with pytest.raises(KeyError):
         replay_untagged.complete("same system prompt", "same user turn")
+
+
+# --- ModelMismatchError: a CLI must not silently answer with another model ----------
+
+def test_codex_banner_naming_another_model_raises_mismatch(monkeypatch, tmp_path):
+    import subprocess as sp
+
+    from aegis_core.baselines import external
+
+    def fake_run(cmd, **kwargs):
+        return sp.CompletedProcess(cmd, 0, stdout=b"model: gpt-6-astra\ncodex\nALLOW\n", stderr=b"")
+
+    monkeypatch.setattr(external.shutil, "which", lambda _: "/usr/bin/codex")
+    monkeypatch.setattr(external.subprocess, "run", fake_run)
+    client = external.CodexCliClient(model="gpt-6-sol")
+    with pytest.raises(external.ModelMismatchError, match="gpt-6-sol"):
+        client.complete("sys", "user")
+
+
+def test_claude_cli_model_usage_without_requested_family_raises_mismatch(monkeypatch):
+    import json as _json
+    import subprocess as sp
+
+    from aegis_core.baselines import external
+
+    envelope = {"result": "ALLOW", "is_error": False,
+                "modelUsage": {"claude-haiku-4-5-20251001": {"inputTokens": 1}}}
+
+    def fake_run(cmd, **kwargs):
+        return sp.CompletedProcess(cmd, 0, stdout=_json.dumps(envelope).encode(), stderr=b"")
+
+    monkeypatch.setattr(external.shutil, "which", lambda _: "/usr/bin/claude")
+    monkeypatch.setattr(external.subprocess, "run", fake_run)
+    with pytest.raises(external.ModelMismatchError, match="opus"):
+        external.ClaudeCliClient(model="opus").complete("sys", "user")
+
+
+def test_claude_cli_side_model_alongside_requested_family_is_accepted(monkeypatch):
+    import json as _json
+    import subprocess as sp
+
+    from aegis_core.baselines import external
+
+    envelope = {"result": "BLOCK", "is_error": False,
+                "modelUsage": {"claude-opus-5": {"inputTokens": 1},
+                               "claude-haiku-4-5-20251001": {"inputTokens": 1}}}
+
+    def fake_run(cmd, **kwargs):
+        return sp.CompletedProcess(cmd, 0, stdout=_json.dumps(envelope).encode(), stderr=b"")
+
+    monkeypatch.setattr(external.shutil, "which", lambda _: "/usr/bin/claude")
+    monkeypatch.setattr(external.subprocess, "run", fake_run)
+    assert external.ClaudeCliClient(model="opus").complete("sys", "user") == "BLOCK"
+
+
+def test_retrying_client_does_not_retry_a_model_mismatch():
+    from aegis_core.baselines import external
+
+    calls = []
+
+    class Mismatching:
+        def complete(self, system, user):
+            calls.append(1)
+            raise external.ModelMismatchError("wrong model")
+
+    with pytest.raises(external.ModelMismatchError):
+        external.RetryingClient(Mismatching()).complete("s", "u")
+    assert len(calls) == 1
+
+
+# --- resume + usage limits: what a long benchmark run depends on ---------------------
+
+def test_recording_client_resumes_from_its_own_cache(tmp_path):
+    from aegis_core.baselines.llm import RecordingClient
+
+    calls = []
+
+    class Model:
+        def complete(self, system, user):
+            calls.append(user)
+            return f"ALLOW {user}"
+
+    cache = tmp_path / "c.jsonl"
+    first = RecordingClient(Model(), cache, model="m")
+    first.complete("s", "a")
+    first.complete("s", "b")
+    # a new run over the same cache must not re-ask a or b
+    second = RecordingClient(Model(), cache, model="m")
+    assert second.complete("s", "a") == "ALLOW a"
+    second.complete("s", "c")
+    assert calls == ["a", "b", "c"] and second.reused == 1
+
+
+def test_recording_client_asks_an_identical_prompt_once(tmp_path):
+    from aegis_core.baselines.llm import RecordingClient
+
+    calls = []
+
+    class Model:
+        def complete(self, system, user):
+            calls.append(user)
+            return "BLOCK"
+
+    rc = RecordingClient(Model(), tmp_path / "c.jsonl")
+    rc.complete("s", "same")
+    rc.complete("s", "same")
+    assert calls == ["same"]
+
+
+def test_quota_error_is_neither_retried_nor_cached(tmp_path):
+    from aegis_core.baselines.external import QuotaExceededError, RetryingClient
+    from aegis_core.baselines.llm import RecordingClient
+
+    calls = []
+
+    class Limited:
+        def complete(self, system, user):
+            calls.append(1)
+            raise QuotaExceededError("limit", "10:44 PM")
+
+    cache = tmp_path / "c.jsonl"
+    with pytest.raises(QuotaExceededError) as exc:
+        RecordingClient(RetryingClient(Limited()), cache).complete("s", "u")
+    assert exc.value.resets_at == "10:44 PM"
+    assert len(calls) == 1
+    assert not cache.exists() or cache.read_text() == ""
+
+
+def test_codex_usage_limit_raises_quota_with_reset_time(monkeypatch):
+    import subprocess as sp
+
+    from aegis_core.baselines import external
+
+    def fake_run(cmd, **kwargs):
+        err = b"ERROR: You've hit your usage limit. try again at 10:44 PM."
+        return sp.CompletedProcess(cmd, 1, stdout=b"", stderr=err)
+
+    monkeypatch.setattr(external.shutil, "which", lambda _: "/usr/bin/codex")
+    monkeypatch.setattr(external.subprocess, "run", fake_run)
+    with pytest.raises(external.QuotaExceededError) as exc:
+        external.CodexCliClient(model="gpt-6-luna").complete("s", "u")
+    assert exc.value.resets_at == "10:44 PM"
+
+
+def test_claude_session_limit_raises_quota_with_reset_time(monkeypatch):
+    import json as _json
+    import subprocess as sp
+
+    from aegis_core.baselines import external
+
+    env = {"is_error": True, "modelUsage": {},
+           "result": "You've hit your session limit · resets 2:10am"}
+    out = _json.dumps(env).encode()
+    monkeypatch.setattr(external.shutil, "which", lambda _: "/usr/bin/claude")
+    monkeypatch.setattr(external.subprocess, "run",
+                        lambda cmd, **k: sp.CompletedProcess(cmd, 0, stdout=out, stderr=b""))
+    with pytest.raises(external.QuotaExceededError) as exc:
+        external.ClaudeCliClient(model="fable").complete("s", "u")
+    assert exc.value.resets_at == "2:10am"

{aegis_devops-0.1.1 → aegis_devops-0.1.2}/tests/test_docs_consistency.py

@@ -123,3 +123,18 @@ def test_docs_do_not_describe_escalate_as_the_default(doc):
 
 def test_changelog_has_an_entry_for_the_package_version():
     assert f"## [{__version__}]" in (ROOT / "CHANGELOG.md").read_text()
+
+
+def test_latency_svg_is_regenerated_from_current_results(tmp_path):
+    """docs/latency.svg used to be hand-drawn; it is generated now and must match."""
+    committed = (ROOT / "docs" / "latency.svg").read_text()
+    for d in ("results", "docs", "scripts"):
+        (tmp_path / d).mkdir()
+    latency = (ROOT / "results" / "latency.json").read_text()
+    (tmp_path / "results" / "latency.json").write_text(latency)
+    script = tmp_path / "scripts" / "make_latency_svg.py"
+    script.write_text((ROOT / "scripts" / "make_latency_svg.py").read_text())
+    subprocess.run([sys.executable, str(script)], check=True, capture_output=True)
+    assert (tmp_path / "docs" / "latency.svg").read_text() == committed, (
+        "docs/latency.svg is stale: run venv/bin/python scripts/make_latency_svg.py"
+    )

{aegis_devops-0.1.1 → aegis_devops-0.1.2}/tests/test_store.py

@@ -997,28 +997,31 @@ def test_get_matching_constraints_finds_direct_dict_assignments_and_overwrites()
     assert store.get_matching_constraints(intent, now) == []
 
 
-def test_matching_10k_constraints_against_500_intents_is_fast(tmp_path):
+def test_matching_10k_constraints_examines_only_the_indexed_bucket(tmp_path, monkeypatch):
     """REVIEW-4 T2.3: matching should be O(k) in the constraints that could
-    plausibly apply, not O(n) in the whole store -- generous bound, the
-    point is the scaling, not a tight latency number."""
-    import time as _time
+    plausibly apply, not O(n) in the whole store.
+
+    This used to assert a wall-clock bound (500 intents in < 0.5 s). That was
+    flaky on shared CI runners -- it failed once at 0.513 s on a change that
+    touched no code -- and it only tested the scaling indirectly. Counting how
+    many constraints the matcher actually examines tests it directly and is
+    deterministic. Real latency is measured by scripts/latency_sweep.py."""
     from datetime import UTC, datetime
 
     import yaml
 
+    from aegis_core import store as store_module
     from aegis_core.intent import InfrastructureIntent
 
     providers = ["kubernetes", "terraform", "helm", "aws", "gcp"]
     actions = [f"action-{j}" for j in range(20)]
     entries = []
     for i in range(10_000):
-        provider = providers[i % len(providers)]
-        action = actions[i % len(actions)]
         c = make_constraint(
             id=f"c-{i}",
-            provider=provider,
+            provider=providers[i % len(providers)],
             resource_pattern=f"kind{i % 50}/*",
-            actions={action},
+            actions={actions[i % len(actions)]},
             time_window=None,
         )
         entries.append(_constraint_entry(c))
@@ -1028,20 +1031,34 @@ def test_matching_10k_constraints_against_500_intents_is_fast(tmp_path):
     assert store.quarantined == []
     assert len(store.constraints) == 10_000
 
+    examined = 0
+    real_match = store_module._constraint_matches
+
+    def counting_match(*args, **kwargs):
+        nonlocal examined
+        examined += 1
+        return real_match(*args, **kwargs)
+
+    monkeypatch.setattr(store_module, "_constraint_matches", counting_match)
+
     now = datetime(2026, 1, 5, 12, 0, tzinfo=UTC)
-    intents = [
-        InfrastructureIntent(
-            resource=f"kind{i % 50}/x", action=actions[i % len(actions)],
+    matched = 0
+    for i in range(500):
+        intent = InfrastructureIntent(
+            resource=f"kind{i % 50}/x",
+            action=actions[i % len(actions)],
             provider=providers[i % len(providers)],
         )
-        for i in range(500)
-    ]
-    start = _time.perf_counter()
-    for intent in intents:
-        store.get_matching_constraints(intent, now)
-    elapsed = _time.perf_counter() - start
-    assert elapsed < 0.5, f"500 intents against 10k constraints took {elapsed:.3f}s"
+        bucket = len(store._index.get((intent.provider, intent.action), []))
+        before = examined
+        matched += len(store.get_matching_constraints(intent, now))
+        # exactly the (provider, action) bucket is scanned, nothing else
+        assert examined - before == bucket
+        assert bucket < len(store.constraints) / 10
 
+    assert matched > 0, "the fixture must actually produce matches"
+    # 500 intents over 10k constraints: a full scan would examine 5,000,000
+    assert examined < 500 * len(store.constraints) / 10
 
 def _constraint_entry(c: Constraint) -> dict:
     from aegis_core.store import _constraint_to_dict
@@ -1070,3 +1087,65 @@ def test_load_cached_returns_the_same_object_until_the_file_changes(tmp_path):
     third = CS.load_cached(path, insecure=True)
     assert third is not first
     assert "ok2" in third.constraints
+
+
+def test_full_intercept_scans_only_the_indexed_bucket(tmp_path, monkeypatch):
+    """A decision, not just matching, must be O(k) in the plausible constraints.
+
+    get_matching_constraints used the index, but get_env_unresolved and
+    get_time_window_unresolved -- which the interceptor calls on every intent --
+    scanned the whole store, so intercept() stayed O(n) even though matching was
+    O(k). All three now draw from ConstraintStore._candidates. This counts every
+    per-constraint predicate a full intercept() evaluates and requires it to stay
+    within a small multiple of the bucket, never the store."""
+    from datetime import UTC, datetime
+
+    import yaml
+
+    from aegis_core import store as store_module
+    from aegis_core.intent import InfrastructureIntent
+    from aegis_core.interceptor import AegisInterceptor
+
+    providers = ["kubernetes", "terraform", "helm", "aws", "gcp"]
+    actions = [f"action-{j}" for j in range(20)]
+    entries = [
+        _constraint_entry(make_constraint(
+            id=f"c-{i}",
+            provider=providers[i % len(providers)],
+            resource_pattern=f"kind{i % 50}/*",
+            actions={actions[i % len(actions)]},
+            time_window=None,
+        ))
+        for i in range(10_000)
+    ]
+    path = tmp_path / "constraints.yaml"
+    path.write_text(yaml.safe_dump({"constraints": entries}, sort_keys=False))
+    store = ConstraintStore.load(path, authority_map=AUTHORITY, insecure=True)
+    interceptor = AegisInterceptor(store)
+
+    calls = 0
+
+    def counted(fn):
+        def wrapper(*args, **kwargs):
+            nonlocal calls
+            calls += 1
+            return fn(*args, **kwargs)
+        return wrapper
+
+    for name in ("_constraint_matches", "_matches_except_scope", "time_window_unresolved"):
+        monkeypatch.setattr(store_module, name, counted(getattr(store_module, name)))
+
+    now = datetime(2026, 1, 5, 12, 0, tzinfo=UTC)
+    for i in range(200):
+        intent = InfrastructureIntent(
+            resource=f"kind{i % 50}/x",
+            action=actions[i % len(actions)],
+            provider=providers[i % len(providers)],
+        )
+        bucket = len(store._candidates(intent))
+        before = calls
+        interceptor.intercept(intent, now=now)
+        # matching (2 predicate calls per candidate), env and time-window checks
+        # (1 each): a bounded multiple of the bucket, never of the store
+        assert calls - before <= 4 * bucket, (calls - before, bucket)
+        assert bucket < len(store.constraints) / 10