aegis-devops 0.1.2__tar.gz → 0.1.4__tar.gz

{aegis_devops-0.1.2/src/aegis_devops.egg-info → aegis_devops-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.1.2
+Version: 0.1.4
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -30,19 +30,34 @@ Provides-Extra: llm
 Requires-Dist: anthropic; extra == "llm"
 Dynamic: license-file
 
-# Aegis-DevOps — Policy Verifier for AI DevOps Agents
+# Aegis-DevOps
 
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
 [![PyPI](https://img.shields.io/pypi/v/aegis-devops)](https://pypi.org/project/aegis-devops/)
 
-**Provenance-backed, authority-aware guardrails that stop context poisoning and agentic drift
-before an AI agent's `kubectl` or `terraform` action reaches your infrastructure.**
+**Stop AI agents from running `kubectl delete`, `terraform destroy` or `DROP TABLE` because a
+ticket told them to.**
 
-**Keywords:** AI agent security · AgentOps · prompt injection · context poisoning · policy
-enforcement · policy-as-code · Kubernetes · Terraform · OPA · SRE · LLM guardrails ·
-provenance · infrastructure-as-code
+Aegis-DevOps checks every command an agent wants to run before it runs, and blocks it if your
+policy says no. A policy rule only counts if nobody has edited it since it was signed, and if
+its author was allowed to write that kind of rule. So a planted line in a Jira ticket can't
+become policy.
 
-![Aegis demo](docs/demo.gif)
+![Aegis-DevOps blocking an injected kubectl delete](docs/where-it-sits.gif)
+
+### Install in Claude Code
+
+```bash
+pip install aegis-devops && aegis init .aegis
+claude plugin marketplace add moneytool/aegis-devops
+claude plugin install aegis-devops@aegis-devops
+```
+
+Codex, GitHub Copilot (CLI and VS Code) and Cursor: `aegis install codex|copilot|vscode|cursor`
+(see [Coding agents](docs/agents.md)). It only acts in projects with a `.aegis/` policy, and
+only blocks what that policy blocks. It also works as a CI step
+(`aegis check terraform plan.json --exit-style ci`) and as a Python library; see
+[Quick start](#quick-start).
 
 ## What it does
 
@@ -81,7 +96,7 @@ BLOCK: kubernetes scale deployment/api-server
   citations: no-scale-prod-peak
   covered: True  latency_ms: 0.20
 PLAN BLOCK: 1 intent(s)
-STORE: loaded=21 quarantined=0 principals=3
+STORE: loaded=29 quarantined=0 principals=3
   warning: using example signing key
 ```
 
@@ -92,6 +107,8 @@ a key everyone has. `aegis init` prints the two commands that replace it with yo
 replace `constraints.example.yaml` with your own `constraints.yaml` (a real file wins over the
 `.example` one when both exist).
 
+![Aegis CLI demo](docs/demo.gif)
+
 ### From a clone
 
 ```bash
@@ -199,36 +216,57 @@ OPA/Gatekeeper evaluates **structured API objects** against **hand-authored rule
 derives **unstructured human constraints** (from Slack, Jira, Git) and applies
 **authority-driven validation** to the agent's intent *before* it reaches the infrastructure.
 
+## How it compares
+
+Other tools stop destructive commands in coding agents, and cover more agents and more kinds of
+command than Aegis does today. The difference is where the rules come from: Aegis treats every
+rule as a claim that has to be checked (was it changed since it was signed, does its cited
+source back it, was its author allowed to write that kind of rule), because in an agent's
+context a rule can arrive from a ticket or a chat message as easily as from you.
+
+| | Aegis-DevOps | [nah](https://github.com/manuelschipper/nah) | [claude-code-safety-net](https://github.com/kenryu42/claude-code-safety-net) | [destructive_command_guard](https://github.com/Dicklesworthstone/destructive_command_guard) |
+|---|---|---|---|---|
+| Guards | Infra commands and plans: kubectl, terraform/tofu, aws/az/gcloud, helm, argocd, flux, git/gh, SQL, pulumi | Git, filesystem, infra CLIs (Terraform, OpenTofu, Pulumi, kubectl, Docker), secrets, publishing | Destructive git and filesystem commands, secret access; cloud CLIs via optional rulebooks | Git, filesystem, databases, Kubernetes, IaC, clouds, Docker and more (50+ packs) |
+| Agents | Claude Code, Codex, Copilot CLI, VS Code, Cursor | Claude Code, Codex, Cursor, Copilot and 10+ more | Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and 8+ more | Claude Code, Codex, Copilot, Cursor, Gemini CLI and 9+ more |
+| Rules | Signed rules, each citing a source and an author; checked against an authority map (who may assert what) | Built-in deterministic guards; custom guards can only make it stricter | Built-in AST-based protections, configurable presets, community rulebooks | Built-in regex/AST packs, TOML config, custom YAML packs |
+| Rule provenance and authority | Yes: a tampered, forged or unauthorised rule gets no vote | — | — | — |
+| Terraform/Pulumi plan checks | Yes (plan JSON) | Whole-stack destroy commands | Commands via rulebooks | Destroy commands |
+| CI / non-agent use | `aegis check ... --exit-style ci`, Python library | `nah test` | Node.js library mode | `dcg scan` (SARIF) |
+
+"—" means the project's README does not describe it. Checked against each project's README on
+2026-09-27; corrections welcome.
+
 ## Project status / roadmap
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.1.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.1.3 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
-What is *not* done is the part the threat model leans on hardest. See `PLAN.md §8`, but in
+What is *not* done is the part the threat model leans on hardest. See `docs/dev/PLAN.md §8`, but in
 short: sources are verified against files on disk rather than real Git/Slack/Jira connectors,
 signing uses a shared secret rather than per-principal public keys, and a `principal` is a
 signed name rather than an identity bound to a commit signature or an SSO group. Until those
 land, Aegis demonstrates that the *decision procedure* is sound; it does not yet prove the
 identities feeding it are. Resource matching is also case-sensitive on names. It is not
-production-ready: read `PLAN.md §8` for the full list of open gaps before putting it in front
+production-ready: read `docs/dev/PLAN.md §8` for the full list of open gaps before putting it in front
 of anything you care about.
 
 ## Documentation
 
 | Page | Covers |
 | :--- | :--- |
+| [`docs/agents.md`](docs/agents.md) | Claude Code, Codex, Copilot, VS Code and Cursor: install, what gets blocked |
 | [`docs/cli.md`](docs/cli.md) | Exit codes, store health, the Claude Code hook, argv forms, compound commands, dry runs, library usage |
 | [`docs/constraints.md`](docs/constraints.md) | Writing constraints, metadata vocabulary, authority policy, environment mapping |
 | [`docs/configuration.md`](docs/configuration.md) | Configuration/config-dir discovery, signing, source verification, rate limits & ledger |
 | [`docs/benchmark.md`](docs/benchmark.md) | Benchmark methodology, full results table, real LLM baselines, agent-harness baselines, corpus, adversarial suite |
 | [`docs/CONTRIBUTING.md`](docs/CONTRIBUTING.md) | Adding a new parser or tool |
-| [`PLAN.md`](PLAN.md) | Design plan and open gaps |
+| [`docs/dev/PLAN.md`](docs/dev/PLAN.md) | Design plan and open gaps |
 | [`SECURITY.md`](SECURITY.md) | Reporting a bypass |
 | [`CHANGELOG.md`](CHANGELOG.md) | Release history |
-| [`REVIEW-4.md`](REVIEW-4.md) | Corpus/oracle rewrite (independent oracle, intent-level holdout) |
+| [`docs/dev/REVIEW-4.md`](docs/dev/REVIEW-4.md) | Corpus/oracle rewrite (independent oracle, intent-level holdout) |
 
 ## Development
 

{aegis_devops-0.1.2 → aegis_devops-0.1.4}/README.md

@@ -1,16 +1,31 @@
-# Aegis-DevOps — Policy Verifier for AI DevOps Agents
+# Aegis-DevOps
 
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
 [![PyPI](https://img.shields.io/pypi/v/aegis-devops)](https://pypi.org/project/aegis-devops/)
 
-**Provenance-backed, authority-aware guardrails that stop context poisoning and agentic drift
-before an AI agent's `kubectl` or `terraform` action reaches your infrastructure.**
+**Stop AI agents from running `kubectl delete`, `terraform destroy` or `DROP TABLE` because a
+ticket told them to.**
 
-**Keywords:** AI agent security · AgentOps · prompt injection · context poisoning · policy
-enforcement · policy-as-code · Kubernetes · Terraform · OPA · SRE · LLM guardrails ·
-provenance · infrastructure-as-code
+Aegis-DevOps checks every command an agent wants to run before it runs, and blocks it if your
+policy says no. A policy rule only counts if nobody has edited it since it was signed, and if
+its author was allowed to write that kind of rule. So a planted line in a Jira ticket can't
+become policy.
 
-![Aegis demo](docs/demo.gif)
+![Aegis-DevOps blocking an injected kubectl delete](docs/where-it-sits.gif)
+
+### Install in Claude Code
+
+```bash
+pip install aegis-devops && aegis init .aegis
+claude plugin marketplace add moneytool/aegis-devops
+claude plugin install aegis-devops@aegis-devops
+```
+
+Codex, GitHub Copilot (CLI and VS Code) and Cursor: `aegis install codex|copilot|vscode|cursor`
+(see [Coding agents](docs/agents.md)). It only acts in projects with a `.aegis/` policy, and
+only blocks what that policy blocks. It also works as a CI step
+(`aegis check terraform plan.json --exit-style ci`) and as a Python library; see
+[Quick start](#quick-start).
 
 ## What it does
 
@@ -49,7 +64,7 @@ BLOCK: kubernetes scale deployment/api-server
   citations: no-scale-prod-peak
   covered: True  latency_ms: 0.20
 PLAN BLOCK: 1 intent(s)
-STORE: loaded=21 quarantined=0 principals=3
+STORE: loaded=29 quarantined=0 principals=3
   warning: using example signing key
 ```
 
@@ -60,6 +75,8 @@ a key everyone has. `aegis init` prints the two commands that replace it with yo
 replace `constraints.example.yaml` with your own `constraints.yaml` (a real file wins over the
 `.example` one when both exist).
 
+![Aegis CLI demo](docs/demo.gif)
+
 ### From a clone
 
 ```bash
@@ -167,36 +184,57 @@ OPA/Gatekeeper evaluates **structured API objects** against **hand-authored rule
 derives **unstructured human constraints** (from Slack, Jira, Git) and applies
 **authority-driven validation** to the agent's intent *before* it reaches the infrastructure.
 
+## How it compares
+
+Other tools stop destructive commands in coding agents, and cover more agents and more kinds of
+command than Aegis does today. The difference is where the rules come from: Aegis treats every
+rule as a claim that has to be checked (was it changed since it was signed, does its cited
+source back it, was its author allowed to write that kind of rule), because in an agent's
+context a rule can arrive from a ticket or a chat message as easily as from you.
+
+| | Aegis-DevOps | [nah](https://github.com/manuelschipper/nah) | [claude-code-safety-net](https://github.com/kenryu42/claude-code-safety-net) | [destructive_command_guard](https://github.com/Dicklesworthstone/destructive_command_guard) |
+|---|---|---|---|---|
+| Guards | Infra commands and plans: kubectl, terraform/tofu, aws/az/gcloud, helm, argocd, flux, git/gh, SQL, pulumi | Git, filesystem, infra CLIs (Terraform, OpenTofu, Pulumi, kubectl, Docker), secrets, publishing | Destructive git and filesystem commands, secret access; cloud CLIs via optional rulebooks | Git, filesystem, databases, Kubernetes, IaC, clouds, Docker and more (50+ packs) |
+| Agents | Claude Code, Codex, Copilot CLI, VS Code, Cursor | Claude Code, Codex, Cursor, Copilot and 10+ more | Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and 8+ more | Claude Code, Codex, Copilot, Cursor, Gemini CLI and 9+ more |
+| Rules | Signed rules, each citing a source and an author; checked against an authority map (who may assert what) | Built-in deterministic guards; custom guards can only make it stricter | Built-in AST-based protections, configurable presets, community rulebooks | Built-in regex/AST packs, TOML config, custom YAML packs |
+| Rule provenance and authority | Yes: a tampered, forged or unauthorised rule gets no vote | — | — | — |
+| Terraform/Pulumi plan checks | Yes (plan JSON) | Whole-stack destroy commands | Commands via rulebooks | Destroy commands |
+| CI / non-agent use | `aegis check ... --exit-style ci`, Python library | `nah test` | Node.js library mode | `dcg scan` (SARIF) |
+
+"—" means the project's README does not describe it. Checked against each project's README on
+2026-09-27; corrections welcome.
+
 ## Project status / roadmap
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.1.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.1.3 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
-What is *not* done is the part the threat model leans on hardest. See `PLAN.md §8`, but in
+What is *not* done is the part the threat model leans on hardest. See `docs/dev/PLAN.md §8`, but in
 short: sources are verified against files on disk rather than real Git/Slack/Jira connectors,
 signing uses a shared secret rather than per-principal public keys, and a `principal` is a
 signed name rather than an identity bound to a commit signature or an SSO group. Until those
 land, Aegis demonstrates that the *decision procedure* is sound; it does not yet prove the
 identities feeding it are. Resource matching is also case-sensitive on names. It is not
-production-ready: read `PLAN.md §8` for the full list of open gaps before putting it in front
+production-ready: read `docs/dev/PLAN.md §8` for the full list of open gaps before putting it in front
 of anything you care about.
 
 ## Documentation
 
 | Page | Covers |
 | :--- | :--- |
+| [`docs/agents.md`](docs/agents.md) | Claude Code, Codex, Copilot, VS Code and Cursor: install, what gets blocked |
 | [`docs/cli.md`](docs/cli.md) | Exit codes, store health, the Claude Code hook, argv forms, compound commands, dry runs, library usage |
 | [`docs/constraints.md`](docs/constraints.md) | Writing constraints, metadata vocabulary, authority policy, environment mapping |
 | [`docs/configuration.md`](docs/configuration.md) | Configuration/config-dir discovery, signing, source verification, rate limits & ledger |
 | [`docs/benchmark.md`](docs/benchmark.md) | Benchmark methodology, full results table, real LLM baselines, agent-harness baselines, corpus, adversarial suite |
 | [`docs/CONTRIBUTING.md`](docs/CONTRIBUTING.md) | Adding a new parser or tool |
-| [`PLAN.md`](PLAN.md) | Design plan and open gaps |
+| [`docs/dev/PLAN.md`](docs/dev/PLAN.md) | Design plan and open gaps |
 | [`SECURITY.md`](SECURITY.md) | Reporting a bypass |
 | [`CHANGELOG.md`](CHANGELOG.md) | Release history |
-| [`REVIEW-4.md`](REVIEW-4.md) | Corpus/oracle rewrite (independent oracle, intent-level holdout) |
+| [`docs/dev/REVIEW-4.md`](docs/dev/REVIEW-4.md) | Corpus/oracle rewrite (independent oracle, intent-level holdout) |
 
 ## Development
 

{aegis_devops-0.1.2 → aegis_devops-0.1.4}/src/aegis_core/__init__.py

@@ -4,4 +4,4 @@ infrastructure actions of AI agents.
 See the README for what this does and, importantly, what it does not yet do.
 """
 
-__version__ = "0.1.2"
+__version__ = "0.1.4"

{aegis_devops-0.1.2 → aegis_devops-0.1.4}/src/aegis_core/_examples/constraints.example.yaml

@@ -336,3 +336,118 @@ constraints:
   rule_text: Block deleting Helm releases in any production environment (resolved
     from the kube context), whatever the namespace; use the decommission runbook instead.
   provenance_hash: 747653b3b34300a18e4773a0784706fcb0147fb10507e88ce93f2fb5cdcd4df8
+- id: block-terraform-destroy
+  provider: terraform
+  resource_pattern: workspace/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6001
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: 'Block ''terraform destroy'' and ''tofu destroy'' (and apply -destroy):
+    tearing down a whole configuration needs a reviewed plan, not an agent''s command.'
+  provenance_hash: 48bd0974d281efa45af89240c0ffc997a4ee7323d07471bb97a4a047081c4178
+- id: block-pulumi-destroy
+  provider: pulumi
+  resource_pattern: stack/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6002
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: 'Block ''pulumi destroy'' and ''pulumi stack rm'': removing a whole stack
+    needs a human.'
+  provenance_hash: 41428597dfe6a997f0797c3c700db953399d515447b2857552cbf4635d3e1782
+- id: block-namespace-delete
+  provider: kubernetes
+  resource_pattern: namespace/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6003
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: 'Block deleting Kubernetes namespaces: it deletes everything inside them.'
+  provenance_hash: 44ee6f6790b2e4996f1fa03bc8d79782e876d1aae27dca7630b81a88206de572
+- id: block-s3-bucket-delete
+  provider: aws
+  resource_pattern: s3/bucket/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6004
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: Block deleting S3 buckets (aws s3 rb, s3api delete-bucket).
+  provenance_hash: 27e8b1723128c747f4780969cf2b44f639235bc1e83e4188686618cb23d42125
+- id: block-rds-delete
+  provider: aws
+  resource_pattern: rds/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6005
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: Block deleting RDS databases, clusters and snapshots.
+  provenance_hash: e44c7617a771c4f53260e751bf23b1bf6c1df648e1b0aa6a6629a2a344b60b0d
+- id: block-gcp-project-delete
+  provider: gcp
+  resource_pattern: project/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6006
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: Block deleting GCP projects.
+  provenance_hash: 7e6fe5ce1001c1c8849af9bbbc66ce4c9f4c2303772f77dcbf9fef0d58f2b4a0
+- id: block-azure-resource-group-delete
+  provider: azure
+  resource_pattern: resource/group/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6007
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: 'Block deleting Azure resource groups: it deletes every resource in them.'
+  provenance_hash: 733126d10190f8cdcde09cbbcd6a6aef719b97e9dc8bd070cf3b84aa381029b9
+- id: escalate-argocd-app-delete
+  provider: argocd
+  resource_pattern: app/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: ESCALATE
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6008
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: Escalate deleting Argo CD applications (with cascade this deletes the
+    deployed resources) for human review.
+  provenance_hash: dc24eb69ac5c8b66279284b6df19095e3f0096303f3ef18da712a53e5e339aeb

aegis_devops-0.1.4/src/aegis_core/_examples/constraints.example.yaml.sig

@@ -0,0 +1,2 @@
+aegis-sig-v1
+245908109e5e1ecf20ba80c41aa725c57dfbd5b2f185da1bc6708b3cbd3ce42d

{aegis_devops-0.1.2 → aegis_devops-0.1.4}/src/aegis_core/_examples/sources/AEGIS-MANIFEST.sig

@@ -1,7 +1,15 @@
 {
   "files": {
-    "PRINCIPALS.yaml": "bdc9ca4ae562397b203242031e960dc4a45eae1bf1ba6d8951f7e17d819a7cfb",
+    "PRINCIPALS.yaml": "e2e7025a2092240acede6a88c7f1a4f22d3cdbf5821772fba9e0f91fbfcbcc8f",
     "git-4001.json": "8be2dd6c37ef643b3bc375b15d5d97889b00456285f594e21a3b4d52521e21de",
+    "git-6001.json": "6592ca4568f767d71a431490ff3cacdbc699ad92be966f57aed3b0a485844dc5",
+    "git-6002.json": "e6286c5fb8a0d2b3c34ca0c841ccede2a477a02f4781115caf4650f4f7c019b8",
+    "git-6003.json": "b077ac2d1119f9a90453e762f2186f3f37837d348822016c01a6f145f528b197",
+    "git-6004.json": "57d2dc91b3014c3cad329266f7ba57472b2d5053635827afc7ddeda02cd73ee3",
+    "git-6005.json": "3fe8ba5cc4cd123fe78f5f4e60f81f8ab38dc0da395d4dbf82634f1359f01803",
+    "git-6006.json": "3f6fbfeb34afb3bcb8075f0864047b3641f0016b8817f67288db7f64afd36b58",
+    "git-6007.json": "eb84394208274b79792e285c5143dde320a2f4755d9b2922ffb55df07e7c5b9e",
+    "git-6008.json": "34d29df94b55a3fa29521246fa17e0966eda93f718a6c41082e6c648569aafa5",
     "git-789abc.json": "48ac500e13d36240ec5c72bf90e96b433a5873d636e9e36f99a73468e7fb5757",
     "git-abc123.json": "ee3751fdcd64cf1dd374bf9f7b73cda723a4aced5053f32501ba9416de89afc7",
     "git-bcd234.json": "a0de7b32bde75735c91504aa7156e7b2ba2ef961d0f439218507e40d0bdfd89a",
@@ -28,5 +36,5 @@
     "slack-perma-1.json": "2c8945a68e413c300ef58fc6a6d3daa8e4d0029a26a454dfad983e2091a188d1"
   },
   "header": "aegis-manifest-v1",
-  "sig": "16b0f5f348626c74d6b40cfe21fe92d3e37703668fa51e9428fdc026cc297bc0"
+  "sig": "034812f78b7f502ebcbb9183bfcf88023324ffcd83e82e5d698aee252cd3b824"
 }

{aegis_devops-0.1.2 → aegis_devops-0.1.4}/src/aegis_core/_examples/sources/PRINCIPALS.yaml

@@ -29,3 +29,11 @@ principals:
   plan-1004: admin
   plan-5005: admin
   slack-perma-1: admin
+  git-6001: admin
+  git-6002: admin
+  git-6003: admin
+  git-6004: admin
+  git-6005: admin
+  git-6006: admin
+  git-6007: admin
+  git-6008: admin

aegis_devops-0.1.4/src/aegis_core/_examples/sources/git-6001.json

@@ -0,0 +1,15 @@
+{
+  "provider": "terraform",
+  "resource_pattern": "workspace/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6001",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block 'terraform destroy' and 'tofu destroy' (and apply -destroy): tearing down a whole configuration needs a reviewed plan, not an agent's command."
+}

aegis_devops-0.1.4/src/aegis_core/_examples/sources/git-6002.json

@@ -0,0 +1,15 @@
+{
+  "provider": "pulumi",
+  "resource_pattern": "stack/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6002",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block 'pulumi destroy' and 'pulumi stack rm': removing a whole stack needs a human."
+}

aegis_devops-0.1.4/src/aegis_core/_examples/sources/git-6003.json

@@ -0,0 +1,15 @@
+{
+  "provider": "kubernetes",
+  "resource_pattern": "namespace/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6003",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block deleting Kubernetes namespaces: it deletes everything inside them."
+}

aegis_devops-0.1.4/src/aegis_core/_examples/sources/git-6004.json

@@ -0,0 +1,15 @@
+{
+  "provider": "aws",
+  "resource_pattern": "s3/bucket/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6004",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block deleting S3 buckets (aws s3 rb, s3api delete-bucket)."
+}

aegis_devops-0.1.4/src/aegis_core/_examples/sources/git-6005.json

@@ -0,0 +1,15 @@
+{
+  "provider": "aws",
+  "resource_pattern": "rds/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6005",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block deleting RDS databases, clusters and snapshots."
+}

aegis_devops-0.1.4/src/aegis_core/_examples/sources/git-6006.json

@@ -0,0 +1,15 @@
+{
+  "provider": "gcp",
+  "resource_pattern": "project/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6006",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block deleting GCP projects."
+}

aegis_devops-0.1.4/src/aegis_core/_examples/sources/git-6007.json

@@ -0,0 +1,15 @@
+{
+  "provider": "azure",
+  "resource_pattern": "resource/group/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6007",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block deleting Azure resource groups: it deletes every resource in them."
+}

aegis_devops-0.1.4/src/aegis_core/_examples/sources/git-6008.json

@@ -0,0 +1,15 @@
+{
+  "provider": "argocd",
+  "resource_pattern": "app/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "ESCALATE",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6008",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Escalate deleting Argo CD applications (with cascade this deletes the deployed resources) for human review."
+}

{aegis_devops-0.1.2 → aegis_devops-0.1.4}/src/aegis_core/baselines/__init__.py

@@ -1,5 +1,5 @@
 """Baseline verifiers compared against Aegis in the Week 7-8 benchmark
-(PLAN.md §4).
+(docs/dev/PLAN.md §4).
 
 Every verifier here implements the same tiny protocol (see ``base.py``) so
 ``scripts/benchmark.py`` can run Aegis and the baselines through one loop

{aegis_devops-0.1.2 → aegis_devops-0.1.4}/src/aegis_core/baselines/llm.py

@@ -1,4 +1,4 @@
-"""Baseline B — LLM Self-Check (PLAN.md §4).
+"""Baseline B — LLM Self-Check (docs/dev/PLAN.md §4).
 
 The model is handed the *same* 500 constraints Aegis loads into its store
 (constraint parity) as a YAML blob in the system prompt, and the intent as

{aegis_devops-0.1.2 → aegis_devops-0.1.4}/src/aegis_core/baselines/metrics.py

@@ -1,4 +1,4 @@
-"""Benchmark metrics (PLAN.md §4): confusion matrix, over-block rate,
+"""Benchmark metrics (docs/dev/PLAN.md §4): confusion matrix, over-block rate,
 coverage, poison susceptibility (per attack kind) and latency percentiles.
 
 The harness consumes ``Decision`` objects duck-typed: only ``verdict``,

{aegis_devops-0.1.2 → aegis_devops-0.1.4}/src/aegis_core/baselines/opa.py

@@ -1,10 +1,10 @@
-"""Baseline C — OPA/Rego (PLAN.md §4).
+"""Baseline C — OPA/Rego (docs/dev/PLAN.md §4).
 
 Like the LLM baseline, this one loads *every* constraint — tampered,
 unauthorized, and forged included — because OPA/Gatekeeper has no concept
 of provenance or authority. It evaluates structured input against
 hand-authored (here, generated) rules, which is exactly the "why not
-OPA/Gatekeeper" distinction PLAN.md §3 draws.
+OPA/Gatekeeper" distinction docs/dev/PLAN.md §3 draws.
 
 Known limitation: constraint ``time_window`` is NOT evaluated by the
 generated Rego (OPA has ``time.now_ns`` but wiring day-of-week + local-tz