aegis-devops 0.1.6__tar.gz → 0.2.0__tar.gz

{aegis_devops-0.1.6/src/aegis_devops.egg-info → aegis_devops-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.1.6
+Version: 0.2.0
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -252,16 +252,17 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.1.3 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.2.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
 What is *not* done is the part the threat model leans on hardest. See `docs/dev/PLAN.md §8`, but in
-short: sources are verified against files on disk rather than real Git/Slack/Jira connectors,
-signing uses a shared secret rather than per-principal public keys, and a `principal` is a
-signed name rather than an identity bound to a commit signature or an SSO group. Until those
-land, Aegis demonstrates that the *decision procedure* is sound; it does not yet prove the
-identities feeding it are. Resource matching is also case-sensitive on names. It is not
+short: a rule may now cite a signed commit in a policy repository, whose verified signer
+becomes its principal ([Git sources](docs/configuration.md#git-sources-signed-commits), SSH
+or GPG signatures), but file sources, the key-to-principal list and the other policy
+files still rest on a shared signing secret rather than per-principal public keys, and there
+are no Slack/Jira connectors. Until those land, Aegis demonstrates that the *decision
+procedure* is sound; it proves the identities feeding it only for Git-sourced rules. Resource matching is also case-sensitive on names. It is not
 production-ready: read `docs/dev/PLAN.md §8` for the full list of open gaps before putting it in front
 of anything you care about.
 

{aegis_devops-0.1.6 → aegis_devops-0.2.0}/README.md

@@ -220,16 +220,17 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.1.3 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.2.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
 What is *not* done is the part the threat model leans on hardest. See `docs/dev/PLAN.md §8`, but in
-short: sources are verified against files on disk rather than real Git/Slack/Jira connectors,
-signing uses a shared secret rather than per-principal public keys, and a `principal` is a
-signed name rather than an identity bound to a commit signature or an SSO group. Until those
-land, Aegis demonstrates that the *decision procedure* is sound; it does not yet prove the
-identities feeding it are. Resource matching is also case-sensitive on names. It is not
+short: a rule may now cite a signed commit in a policy repository, whose verified signer
+becomes its principal ([Git sources](docs/configuration.md#git-sources-signed-commits), SSH
+or GPG signatures), but file sources, the key-to-principal list and the other policy
+files still rest on a shared signing secret rather than per-principal public keys, and there
+are no Slack/Jira connectors. Until those land, Aegis demonstrates that the *decision
+procedure* is sound; it proves the identities feeding it only for Git-sourced rules. Resource matching is also case-sensitive on names. It is not
 production-ready: read `docs/dev/PLAN.md §8` for the full list of open gaps before putting it in front
 of anything you care about.
 

{aegis_devops-0.1.6 → aegis_devops-0.2.0}/src/aegis_core/__init__.py

@@ -4,4 +4,4 @@ infrastructure actions of AI agents.
 See the README for what this does and, importantly, what it does not yet do.
 """
 
-__version__ = "0.1.6"
+__version__ = "0.2.0"

aegis_devops-0.2.0/src/aegis_core/_examples/repos.example.yaml

@@ -0,0 +1,11 @@
+# Git sources (docs/configuration.md#git-sources-signed-commits).
+# Copy to repos.yaml to enable: a constraint may then cite
+#   source_ref: "git:<repo-id>@<full commit sha>:<path>"
+# and its principal becomes the verified signer of that commit.
+# Aegis never fetches: keep each clone up to date with your own `git fetch`,
+# and use full clones (shallow clones and grafts are refused).
+repos:
+  platform-policy:
+    path: /srv/aegis/platform-policy
+    ref: refs/remotes/origin/main   # the ref that defines "current"
+    rule_glob: rules/*.yaml         # one rule per file

aegis_devops-0.2.0/src/aegis_core/_examples/repos.example.yaml.sig

@@ -0,0 +1,2 @@
+aegis-sig-v1
+d3fdb081efd29c87dad98fd7ba59eb5522c31d6f86e8a4c672d902100c2339da

aegis_devops-0.2.0/src/aegis_core/_examples/signers.example.yaml

@@ -0,0 +1,13 @@
+# Which signing key speaks for which principal (the names authority.yaml uses).
+# Copy to signers.yaml alongside repos.yaml, then sign both with `aegis sign`.
+# Never list GitHub's web-flow key (it signs merges made in the GitHub UI):
+# it would make anyone who can press "Merge" any principal.
+signers:
+  - principal: admin
+    keys:
+      - type: ssh
+        key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleOnlyReplaceWithARealPublicKey0000 alice@example.com"
+  - principal: sre_lead
+    keys:
+      - type: ssh
+        key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAnotherExampleKeyReplaceWithARealOne000 bob@example.com"

aegis_devops-0.2.0/src/aegis_core/_examples/signers.example.yaml.sig

@@ -0,0 +1,2 @@
+aegis-sig-v1
+e7b0ef862e5c7837f13ffcfe9d53bc710b73aecac64d3d801c0e9507155435fa

{aegis_devops-0.1.6 → aegis_devops-0.2.0}/src/aegis_core/cli.py

@@ -95,6 +95,15 @@ from aegis_core.environments import (
     load_environment_map,
     resolve_current_context,
 )
+from aegis_core.gitsource import (
+    GIT_PREFIX,
+    REPOS_FILE,
+    SIGNERS_FILE,
+    DispatchingSourceFetcher,
+    GitSourceFetcher,
+    load_repos,
+    load_signers,
+)
 from aegis_core.intent import InfrastructureIntent
 from aegis_core.interceptor import AegisInterceptor, Decision
 from aegis_core.ledger import DecisionLedger, JsonlLedger, SqliteLedger, parse_window
@@ -284,6 +293,28 @@ def _add_common_options(subparser: argparse.ArgumentParser) -> None:
         "when it exists; pass '' to disable); constraints whose cited source does not back "
         "them are quarantined as forged at load time",
     )
+    subparser.add_argument(
+        "--repos",
+        default=None,
+        help="repos.yaml configuring the local clones of policy repositories that "
+        "constraints may cite as git:<repo>@<sha>:<path> (default: <dir of --constraints>/"
+        "repos.yaml when it exists); needs --signers",
+    )
+    subparser.add_argument(
+        "--signers",
+        default=None,
+        help="signers.yaml mapping SSH signing keys to principals; a git-sourced "
+        "constraint's principal is the verified signer of the commit it cites (default: "
+        "<dir of --constraints>/signers.yaml)",
+    )
+    subparser.add_argument(
+        "--max-source-age",
+        type=float,
+        default=None,
+        metavar="HOURS",
+        help="quarantine git-sourced constraints from a repository whose tracked ref has no "
+        "commit newer than this (default: only warn after 24h)",
+    )
     _add_key_options(subparser)
     subparser.add_argument(
         "--insecure",
@@ -450,6 +481,13 @@ def _build_parser() -> argparse.ArgumentParser:
         "--out", default="aegis-signing.key", help="path to write the key to"
     )
 
+    sources_parser = subparsers.add_parser(
+        "sources",
+        help="Report every constraint's source verification: which transport (git, file), "
+        "the verified principal, or why it is quarantined; exit 1 if any is",
+    )
+    _add_common_options(sources_parser)
+
     hook_parser = subparsers.add_parser(
         "hook",
         help="Run as a coding agent's pre-tool hook: read its JSON payload on stdin, answer "
@@ -591,6 +629,30 @@ def _resolve_config_paths(args: argparse.Namespace) -> None:
         )
 
 
+def _git_source_fetcher(args: argparse.Namespace, load: dict) -> GitSourceFetcher | None:
+    """A :class:`GitSourceFetcher` when a ``repos.yaml`` is given or sits
+    next to the constraints file; ``None`` otherwise. ``repos.yaml`` without
+    a ``signers.yaml`` is a data error: git sources cannot verify anyone."""
+    base = os.path.dirname(os.path.abspath(args.constraints))
+    repos = args.repos or os.path.join(base, REPOS_FILE)
+    if not os.path.exists(repos):
+        if args.repos:
+            raise FileNotFoundError(2, "No such file or directory", repos)
+        return None
+    signers = args.signers or os.path.join(base, SIGNERS_FILE)
+    if not os.path.exists(signers):
+        raise DataError(f"{repos} is configured but there is no {signers}: git sources need "
+                        "a signers file to verify commit signatures")
+    warnings: list[str] = []
+    fetcher = GitSourceFetcher(
+        load_repos(repos, warnings=warnings, **load),
+        load_signers(signers, warnings=warnings, **load),
+        max_source_age=args.max_source_age * 3600 if args.max_source_age is not None else None,
+    )
+    fetcher.warnings[:0] = warnings
+    return fetcher
+
+
 def _default_sources(args: argparse.Namespace) -> str | None:
     """``--sources`` as given; ``''`` disables; ``None`` means the
     ``sources`` directory next to the constraints file, when it exists."""
@@ -824,11 +886,12 @@ def _open_ledger(
     return ledger
 
 
-def _evaluate(intents: list[InfrastructureIntent], args: argparse.Namespace) -> int:
+def _load_policy(args: argparse.Namespace):
+    """Resolves the config, verifies and loads the authority map and the
+    constraint store (with file and git source verification). Returns
+    ``(store, authority_map, load, fetcher)``; shared by ``check`` and
+    ``sources``."""
     _resolve_config_paths(args)
-    now = _parse_now(args.now)
-    pretty = bool(args.pretty)
-
     if not os.path.exists(args.constraints):
         raise FileNotFoundError(2, "No such file or directory", args.constraints)
     key_warnings: list[str] = []
@@ -840,6 +903,12 @@ def _evaluate(intents: list[InfrastructureIntent], args: argparse.Namespace) ->
     )
     sources = _default_sources(args)
     fetcher = FileSourceFetcher(sources, **load) if sources else None
+    git_fetcher = _git_source_fetcher(args, load)
+    if fetcher is not None or git_fetcher is not None:
+        # always dispatch, so a git: citation is never handed to the file
+        # fetcher and is rejected as unknown-repo when git is not configured
+        # (with no fetcher at all, ConstraintStore.load rejects it itself)
+        fetcher = DispatchingSourceFetcher(fetcher, git_fetcher)
     store = _load_or_data_error(
         lambda: ConstraintStore.load(
             args.constraints, authority_map=authority_map, source_fetcher=fetcher, **load
@@ -848,6 +917,13 @@ def _evaluate(intents: list[InfrastructureIntent], args: argparse.Namespace) ->
         "constraints",
     )
     store.warnings[:0] = key_warnings
+    return store, authority_map, load, fetcher
+
+
+def _evaluate(intents: list[InfrastructureIntent], args: argparse.Namespace) -> int:
+    now = _parse_now(args.now)
+    pretty = bool(args.pretty)
+    store, authority_map, load, _fetcher = _load_policy(args)
     plan_store = None
     if args.plan_constraints:
         plan_store = _load_or_data_error(
@@ -1016,9 +1092,59 @@ def _run_init(args: argparse.Namespace) -> int:
         f"  3. Replace the *.example.yaml files in {args.dir} with your own constraints.yaml / "
         "authority.yaml / ... (aegis prefers a real file over the .example one when both exist)"
     )
+    print(
+        "  4. Optional, rules backed by signed Git commits: copy repos.example.yaml and "
+        "signers.example.yaml to repos.yaml / signers.yaml (see docs/configuration.md), then "
+        "check them with: aegis sources --pretty"
+    )
     return 0
 
 
+def _transport(source_ref: str, fetcher) -> str:
+    if source_ref.startswith(GIT_PREFIX):
+        return "git"
+    has_file = fetcher is not None and getattr(fetcher, "file_fetcher", fetcher) is not None
+    return "file" if has_file else "unchecked"
+
+
+def _run_sources(args: argparse.Namespace) -> int:
+    """``aegis sources``: one line per constraint -- loaded (with the
+    principal its source verified) or quarantined (with the reason)."""
+    store, _authority, _load, fetcher = _load_policy(args)
+    rows = []
+    for c in store.constraints.values():
+        rows.append({"id": c.id, "status": "ok", "reason": None, "principal": c.principal,
+                     "transport": _transport(c.source_ref, fetcher),
+                     "source_ref": c.source_ref})
+    # Walk the quarantine log entry by entry, in order. Entries that parsed
+    # into a Constraint were appended to quarantined_constraints in the same
+    # order; "invalid: ..." entries (bad shape, duplicate id) never parsed.
+    # Matching by id instead would drop a duplicate-id entry whose id is
+    # also a loaded rule, and confuse two quarantined entries sharing an id.
+    parsed = iter(store.quarantined_constraints)
+    for q in store.health.quarantined:
+        c = None if q["reason"].startswith("invalid: ") else next(parsed, None)
+        rows.append({"id": q["id"], "status": "quarantined", "reason": q["reason"],
+                     "principal": None,
+                     "transport": _transport(c.source_ref, fetcher) if c else None,
+                     "source_ref": c.source_ref if c else None})
+    rows.sort(key=lambda r: (r["status"] != "quarantined", r["id"]))  # stable
+    if args.pretty:
+        for r in rows:
+            label = "OK" if r["status"] == "ok" else f"QUARANTINED ({r['reason']})"
+            print(f"{label:<44} {r['id']:<40} {r['principal'] or '-':<12} "
+                  f"{r['transport'] or '-':<9} {r['source_ref'] or ''}")
+        h = store.health
+        print(f"STORE: loaded={h.loaded} quarantined={len(h.quarantined)} "
+              f"principals={h.principals}")
+        for w in h.warnings:
+            print(f"  warning: {w}")
+    else:
+        for r in rows:
+            print(json.dumps(r))
+    return 1 if store.health.quarantined else 0
+
+
 def _run_keygen(args: argparse.Namespace) -> int:
     path = config_module.generate_signing_key(args.out)
     print(f"aegis: wrote signing key to {path}")
@@ -1035,6 +1161,8 @@ def _run(argv: list[str]) -> int:
         return _run_init(args)
     if args.command == "keygen":
         return _run_keygen(args)
+    if args.command == "sources":
+        return _run_sources(args)
     if args.command == "hook":
         return hook_module.main_hook(
             args.agent,