aegis-devops 0.2.0__tar.gz → 0.2.1__tar.gz

{aegis_devops-0.2.0/src/aegis_devops.egg-info → aegis_devops-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.2.0
+Version: 0.2.1
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -33,7 +33,7 @@ Dynamic: license-file
 # Aegis-DevOps
 
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
-[![PyPI](https://img.shields.io/pypi/v/aegis-devops)](https://pypi.org/project/aegis-devops/)
+[![PyPI](https://img.shields.io/pypi/v/aegis-devops?label=pypi)](https://pypi.org/project/aegis-devops/)
 
 **Stop AI agents from running `kubectl delete`, `terraform destroy` or `DROP TABLE` because a
 ticket told them to.**
@@ -104,7 +104,7 @@ BLOCK: kubernetes scale deployment/api-server
   citations: no-scale-prod-peak
   covered: True  latency_ms: 0.20
 PLAN BLOCK: 1 intent(s)
-STORE: loaded=29 quarantined=0 principals=3
+STORE: loaded=30 quarantined=0 principals=3
   warning: using example signing key
 ```
 
@@ -252,7 +252,7 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.2.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.2.1 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/README.md

@@ -1,7 +1,7 @@
 # Aegis-DevOps
 
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
-[![PyPI](https://img.shields.io/pypi/v/aegis-devops)](https://pypi.org/project/aegis-devops/)
+[![PyPI](https://img.shields.io/pypi/v/aegis-devops?label=pypi)](https://pypi.org/project/aegis-devops/)
 
 **Stop AI agents from running `kubectl delete`, `terraform destroy` or `DROP TABLE` because a
 ticket told them to.**
@@ -72,7 +72,7 @@ BLOCK: kubernetes scale deployment/api-server
   citations: no-scale-prod-peak
   covered: True  latency_ms: 0.20
 PLAN BLOCK: 1 intent(s)
-STORE: loaded=29 quarantined=0 principals=3
+STORE: loaded=30 quarantined=0 principals=3
   warning: using example signing key
 ```
 
@@ -220,7 +220,7 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.2.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.2.1 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/src/aegis_core/__init__.py

@@ -4,4 +4,4 @@ infrastructure actions of AI agents.
 See the README for what this does and, importantly, what it does not yet do.
 """
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/src/aegis_core/_examples/constraints.example.yaml

@@ -451,3 +451,18 @@ constraints:
   rule_text: Escalate deleting Argo CD applications (with cascade this deletes the
     deployed resources) for human review.
   provenance_hash: dc24eb69ac5c8b66279284b6df19095e3f0096303f3ef18da712a53e5e339aeb
+- id: block-kubectl-impersonation
+  provider: kubernetes
+  resource_pattern: '*'
+  actions:
+  - impersonate
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: configuration
+  principal: admin
+  source_ref: git-6009
+  source_timestamp: '2026-09-28T12:00:00+00:00'
+  rule_text: 'Block kubectl impersonation (--as, --as-group, --as-uid): the request
+    would run as another identity, outside the controls on the agent''s own.'
+  provenance_hash: 3c2382c07e085d7a10be92490d9b8905085e6996c5c4ef1aaf2ba43980a41fd1

aegis_devops-0.2.1/src/aegis_core/_examples/constraints.example.yaml.sig

@@ -0,0 +1,2 @@
+aegis-sig-v1
+1b135ef7b7ff50e078b96d0944ce3f771fb541c208a55d41f93f5f0bb65c01ab

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/src/aegis_core/_examples/sources/AEGIS-MANIFEST.sig

@@ -1,6 +1,6 @@
 {
   "files": {
-    "PRINCIPALS.yaml": "e2e7025a2092240acede6a88c7f1a4f22d3cdbf5821772fba9e0f91fbfcbcc8f",
+    "PRINCIPALS.yaml": "94a36ee80347de5ff022f103f9b1288a82d008351ce958d9a5764f1edda16ed5",
     "git-4001.json": "8be2dd6c37ef643b3bc375b15d5d97889b00456285f594e21a3b4d52521e21de",
     "git-6001.json": "6592ca4568f767d71a431490ff3cacdbc699ad92be966f57aed3b0a485844dc5",
     "git-6002.json": "e6286c5fb8a0d2b3c34ca0c841ccede2a477a02f4781115caf4650f4f7c019b8",
@@ -10,6 +10,7 @@
     "git-6006.json": "3f6fbfeb34afb3bcb8075f0864047b3641f0016b8817f67288db7f64afd36b58",
     "git-6007.json": "eb84394208274b79792e285c5143dde320a2f4755d9b2922ffb55df07e7c5b9e",
     "git-6008.json": "34d29df94b55a3fa29521246fa17e0966eda93f718a6c41082e6c648569aafa5",
+    "git-6009.json": "cadad3135121749b5dc1564e44dd2f97684782f2ebdb1cefbc6e08a319d88337",
     "git-789abc.json": "48ac500e13d36240ec5c72bf90e96b433a5873d636e9e36f99a73468e7fb5757",
     "git-abc123.json": "ee3751fdcd64cf1dd374bf9f7b73cda723a4aced5053f32501ba9416de89afc7",
     "git-bcd234.json": "a0de7b32bde75735c91504aa7156e7b2ba2ef961d0f439218507e40d0bdfd89a",
@@ -36,5 +37,5 @@
     "slack-perma-1.json": "2c8945a68e413c300ef58fc6a6d3daa8e4d0029a26a454dfad983e2091a188d1"
   },
   "header": "aegis-manifest-v1",
-  "sig": "034812f78b7f502ebcbb9183bfcf88023324ffcd83e82e5d698aee252cd3b824"
+  "sig": "5c28ed037b47840ab065c77c790d7a5807ac318a05ffa43393a3e6395d5f71e1"
 }

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/src/aegis_core/_examples/sources/PRINCIPALS.yaml

@@ -37,3 +37,4 @@ principals:
   git-6006: admin
   git-6007: admin
   git-6008: admin
+  git-6009: admin

aegis_devops-0.2.1/src/aegis_core/_examples/sources/git-6009.json

@@ -0,0 +1,15 @@
+{
+  "provider": "kubernetes",
+  "resource_pattern": "*",
+  "actions": [
+    "impersonate"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "configuration",
+  "principal": "admin",
+  "source_ref": "git-6009",
+  "source_timestamp": "2026-09-28T12:00:00+00:00",
+  "rule_text": "Block kubectl impersonation (--as, --as-group, --as-uid): the request would run as another identity, outside the controls on the agent's own."
+}

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/src/aegis_core/interceptor.py

@@ -120,6 +120,16 @@ class AegisInterceptor:
         self.fail_closed = fail_closed
         self.on_untrusted_match = on_untrusted_match
 
+    def _untrusted_reason(self, c: Constraint) -> str | None:
+        """``"tampered"`` / ``"unauthorized"`` if this constraint may not
+        vote, else ``None`` (re-checked per decision; see REVIEW-4 L4
+        below)."""
+        if not c.verify_integrity():
+            return "tampered"
+        if not self.store.is_authorized(c.principal, c.constraint_class):
+            return "unauthorized"
+        return None
+
     def intercept(self, intent: InfrastructureIntent, now: datetime | None = None) -> Decision:
         """Evaluates an intent and returns a Decision.
 
@@ -167,12 +177,22 @@ class AegisInterceptor:
         notes: list[str] = []
         fail_closed = False
         verified = []
-        for c in env_unresolved:
-            fail_closed = True
-            notes.append(f"env-unresolved: {c.id}")
-        for c in time_window_unresolved:
+        # An unresolved condition only fails closed on behalf of a constraint
+        # that could vote: a tampered or unauthorized one is discarded here
+        # exactly as it is when it matches outright (below), so it cannot
+        # force ESCALATE just because the intent's environment or time zone
+        # could not be resolved.
+        for c, label in [*((c, "env-unresolved") for c in env_unresolved),
+                         *((c, "time-window-unresolved") for c in time_window_unresolved)]:
+            reason = self._untrusted_reason(c)
+            if reason is not None:
+                discarded.append({"id": c.id, "reason": reason})
+                if c.effect in _ENFORCING_EFFECTS and self.on_untrusted_match == "escalate":
+                    fail_closed = True
+                    notes.append(f"fail-closed: {c.id} ({reason})")
+                continue
             fail_closed = True
-            notes.append(f"time-window-unresolved: {c.id}")
+            notes.append(f"{label}: {c.id}")
         if unknown_target:
             fail_closed = True
             notes.append("unknown-target")
@@ -193,11 +213,7 @@ class AegisInterceptor:
             # rule, not per loaded rule -- see get_matching_constraints'
             # index), so we pay it on every decision instead of trusting a
             # verification result that may be stale by the time it matters.
-            reason = None
-            if not c.verify_integrity():
-                reason = "tampered"
-            elif not self.store.is_authorized(c.principal, c.constraint_class):
-                reason = "unauthorized"
+            reason = self._untrusted_reason(c)
             if reason is not None:
                 discarded.append({"id": c.id, "reason": reason})
                 if c.effect in _ENFORCING_EFFECTS and self.on_untrusted_match == "escalate":

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/src/aegis_core/parser.py

@@ -177,11 +177,46 @@ _RESOURCE_ALIASES = {
     "jobs": "job",
     "cronjobs": "cronjob",
     "hpa": "horizontalpodautoscaler",
+    "horizontalpodautoscalers": "horizontalpodautoscaler",
+    "sc": "storageclass",
+    "storageclasses": "storageclass",
+    "ingressclasses": "ingressclass",
+    "pv": "persistentvolume",
+    "persistentvolumes": "persistentvolume",
+    "netpol": "networkpolicy",
+    "networkpolicies": "networkpolicy",
+    "pdb": "poddisruptionbudget",
+    "poddisruptionbudgets": "poddisruptionbudget",
+    "roles": "role",
+    "rolebindings": "rolebinding",
+    "clusterroles": "clusterrole",
+    "clusterrolebindings": "clusterrolebinding",
+    "crd": "customresourcedefinition",
+    "crds": "customresourcedefinition",
+    "customresourcedefinitions": "customresourcedefinition",
+    "validatingwebhookconfigurations": "validatingwebhookconfiguration",
+    "mutatingwebhookconfigurations": "mutatingwebhookconfiguration",
+    "priorityclasses": "priorityclass",
+    "pc": "priorityclass",
+    "limitranges": "limitrange",
+    "limits": "limitrange",
+    "resourcequotas": "resourcequota",
+    "quota": "resourcequota",
+    "certificatesigningrequests": "certificatesigningrequest",
+    "csr": "certificatesigningrequest",
+    "ep": "endpoints",  # the kind is "Endpoints"; its singular name is "endpoints"
+    "leases": "lease",
+    "events": "event",
+    "ev": "event",
 }
 
 # kubectl flags that are booleans (no value token follows) when given
 # without "=value".
-_KNOWN_BOOL_FLAGS = {"force", "cascade", "all", "wait", "now", "ignore-not-found"}
+_KNOWN_BOOL_FLAGS = {
+    "force", "cascade", "all", "wait", "now", "ignore-not-found",
+    # kubectl drain
+    "ignore-daemonsets", "delete-emptydir-data", "delete-local-data", "disable-eviction",
+}
 
 # Global boolean flags that are consumed but not recorded anywhere.
 _DISCARD_BOOL_FLAGS = {
@@ -199,9 +234,6 @@ _DISCARD_VALUE_FLAGS = {
     "s",
     "server",
     "v",
-    "as",
-    "as-uid",
-    "as-group",
     "request-timeout",
     "token",
     "user",
@@ -217,6 +249,9 @@ _DISCARD_VALUE_FLAGS = {
     "log-flush-frequency",
 }
 
+# kubectl impersonation flags, recorded in params["impersonate"].
+_IMPERSONATION_FLAGS = {"as", "as-uid", "as-group"}
+
 # Flags that point at a manifest (file or kustomize directory).
 _MANIFEST_FLAGS = {"f", "filename", "k", "kustomize"}
 
@@ -227,15 +262,24 @@ _KUBECTL_IDENTITY_FLAGS = {"n", "namespace", "context", "cluster"}
 _SELECTOR_FLAGS = {"l": "selector", "selector": "selector", "field-selector": "field_selector"}
 
 # Every global option kubectl accepts in front of the verb, split by arity.
-_KUBECTL_GLOBAL_VALUE_FLAGS = _KUBECTL_IDENTITY_FLAGS | _DISCARD_VALUE_FLAGS
+_KUBECTL_GLOBAL_VALUE_FLAGS = _KUBECTL_IDENTITY_FLAGS | _DISCARD_VALUE_FLAGS | _IMPERSONATION_FLAGS
 _KUBECTL_GLOBAL_BOOL_FLAGS = {"A", "all-namespaces"} | _DISCARD_BOOL_FLAGS
 
 # Short flags that may be glued to their value: -nprod, -lapp=web, -fx.yaml.
 _KUBECTL_GLUED_SHORT_FLAGS = {"n", "l", "f", "o", "k", "s", "v"}
 
-# Verbs whose "resource" is just the literal first positional token (a pod
-# name, a path, ...), not a kind/name pair to be normalised.
-_LITERAL_RESOURCE_VERBS = {"exec", "logs", "port-forward", "cp"}
+# Verbs whose "resource" is just the literal first positional token (a
+# path), not a kind/name pair to be normalised.
+_LITERAL_RESOURCE_VERBS = {"cp"}
+
+# Verbs whose target is a pod by default: a bare name is a pod
+# ("exec api-0" -> pod/api-0), and "deploy/web" / "svc/web" normalise like
+# any other kind/name token.
+_POD_TARGET_VERBS = {"exec", "logs", "port-forward", "attach"}
+
+# Verbs that act on nodes: a bare name is a node ("drain node1" ->
+# node/node1), not a kind to list.
+_NODE_TARGET_VERBS = {"cordon", "uncordon", "drain"}
 
 
 def _coerce(value: str) -> Any:
@@ -470,6 +514,18 @@ def _parse_flags(
                     i += 1
                     val = _value_at(tokens, i, tok)
                 manifest_value = val
+            elif key in _IMPERSONATION_FLAGS:
+                # kubectl --as / --as-group / --as-uid: the request runs as
+                # someone else. Recorded (never silently dropped), so a
+                # policy or a server-side check can see it.
+                if val is None:
+                    i += 1
+                    val = _value_at(tokens, i, tok)
+                imp = params.setdefault("impersonate", {})
+                if key == "as-group":
+                    imp.setdefault("groups", []).append(val)
+                else:
+                    imp["user" if key == "as" else "uid"] = val
             elif key in _DISCARD_VALUE_FLAGS:
                 if val is None:
                     i += 1
@@ -514,7 +570,33 @@ def _make_intents(
 def from_kubectl_multi(argv: list[str]) -> list[InfrastructureIntent]:
     """Parses a kubectl invocation into one InfrastructureIntent per target
     resource (kubectl commands may name more than one, e.g.
-    ``kubectl delete pod/a pod/b``)."""
+    ``kubectl delete pod/a pod/b``).
+
+    With ``--as`` / ``--as-group`` / ``--as-uid`` the request runs as
+    someone else, which moves it out of an agent identity's scope on the
+    server side. So besides the action itself, each impersonated identity
+    becomes its own ``impersonate`` intent (``user/<name>``,
+    ``group/<name>``, ``uid/<id>``) that a policy can block or escalate."""
+    intents = _from_kubectl_multi(argv)
+    seen: set[str] = set()
+    extra: list[InfrastructureIntent] = []
+    for intent in intents:
+        imp = intent.params.get("impersonate") or {}
+        targets = ([f"user/{imp['user']}"] if "user" in imp else []) + [
+            f"group/{g}" for g in imp.get("groups", [])
+        ] + ([f"uid/{imp['uid']}"] if "uid" in imp else [])
+        for target in targets:
+            if target in seen:
+                continue
+            seen.add(target)
+            extra.append(InfrastructureIntent(
+                resource=target, action="impersonate", provider="kubernetes",
+                params={"impersonate": imp}, metadata=dict(intent.metadata),
+            ))
+    return intents + extra
+
+
+def _from_kubectl_multi(argv: list[str]) -> list[InfrastructureIntent]:
     if len(argv) < 2 or not (argv[0] == "kubectl" or argv[0].endswith("/kubectl")):
         raise ValueError(f"not a recognizable kubectl invocation: {argv!r}")
 
@@ -526,19 +608,34 @@ def from_kubectl_multi(argv: list[str]) -> list[InfrastructureIntent]:
         tool="kubectl",
     )
     verb = rest[0]
+    after_verb = rest[1:]
+
+    # A subcommand ("rollout restart", "set image") is the token right after
+    # the verb, so it is taken from the post-verb tokens *before* the leading
+    # global options are merged back in -- otherwise "kubectl -n prod rollout
+    # restart x" would read "-n" as the subcommand.
+    # kubectl also accepts global options *between* the verb and its
+    # subcommand ("kubectl rollout --as admin restart x"), so those are
+    # consumed the same way as leading ones and kept for the flag walker.
+    subverb = None
+    if verb in ("rollout", "set"):
+        if not after_verb:
+            raise ValueError(f"kubectl {verb} requires a subcommand: {argv!r}")
+        between, sub_rest = _split_leading_globals(
+            after_verb,
+            value_flags=_KUBECTL_GLOBAL_VALUE_FLAGS,
+            bool_flags=_KUBECTL_GLOBAL_BOOL_FLAGS,
+            tool="kubectl",
+        )
+        subverb, after_verb = sub_rest[0], between + sub_rest[1:]
+        if verb == "set":
+            if subverb != "image":
+                raise ValueError(f"unsupported 'kubectl set' invocation: {argv!r}")
+            subverb = None
+
     # Global options are parsed by the same flag walker as post-verb flags,
     # so "-n prod delete x" and "delete x -n prod" produce identical intents.
-    tokens = leading + rest[1:]
-
-    subverb = None
-    if verb == "rollout":
-        if not tokens:
-            raise ValueError(f"kubectl rollout requires a subcommand: {argv!r}")
-        subverb, *tokens = tokens
-    elif verb == "set":
-        if not tokens or tokens[0] != "image":
-            raise ValueError(f"unsupported 'kubectl set' invocation: {argv!r}")
-        tokens = tokens[1:]
+    tokens = leading + after_verb
 
     metadata, params, positional, manifest_value, command = _parse_flags(tokens)
     if command is not None:
@@ -560,6 +657,22 @@ def from_kubectl_multi(argv: list[str]) -> list[InfrastructureIntent]:
             raise ValueError(f"could not find a target resource in: {argv!r}")
         return _make_intents([positional[0]], verb, params, metadata)
 
+    if verb in _POD_TARGET_VERBS:
+        if not positional:
+            raise ValueError(f"could not find a target resource in: {argv!r}")
+        kind, name = _split_resource_token(positional[0])
+        target = f"{kind}/{name}" if name is not None else f"pod/{positional[0]}"
+        return _make_intents([target], verb, params, metadata)
+
+    if verb in _NODE_TARGET_VERBS:
+        if not positional:
+            raise ValueError(f"could not find a target resource in: {argv!r}")
+        targets = []
+        for token in positional:
+            kind, name = _split_resource_token(token)
+            targets.append(f"{kind}/{name}" if name is not None else f"node/{token}")
+        return _make_intents(targets, verb, params, metadata)
+
     if verb in ("label", "annotate"):
         resource_tokens = [t for t in positional if "=" not in t]
         kv_tokens = [t for t in positional if "=" in t]

{aegis_devops-0.2.0 → aegis_devops-0.2.1/src/aegis_devops.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.2.0
+Version: 0.2.1
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -33,7 +33,7 @@ Dynamic: license-file
 # Aegis-DevOps
 
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
-[![PyPI](https://img.shields.io/pypi/v/aegis-devops)](https://pypi.org/project/aegis-devops/)
+[![PyPI](https://img.shields.io/pypi/v/aegis-devops?label=pypi)](https://pypi.org/project/aegis-devops/)
 
 **Stop AI agents from running `kubectl delete`, `terraform destroy` or `DROP TABLE` because a
 ticket told them to.**
@@ -104,7 +104,7 @@ BLOCK: kubernetes scale deployment/api-server
   citations: no-scale-prod-peak
   covered: True  latency_ms: 0.20
 PLAN BLOCK: 1 intent(s)
-STORE: loaded=29 quarantined=0 principals=3
+STORE: loaded=30 quarantined=0 principals=3
   warning: using example signing key
 ```
 
@@ -252,7 +252,7 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.2.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.2.1 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/src/aegis_devops.egg-info/SOURCES.txt

@@ -45,6 +45,7 @@ src/aegis_core/_examples/sources/git-6005.json
 src/aegis_core/_examples/sources/git-6006.json
 src/aegis_core/_examples/sources/git-6007.json
 src/aegis_core/_examples/sources/git-6008.json
+src/aegis_core/_examples/sources/git-6009.json
 src/aegis_core/_examples/sources/git-789abc.json
 src/aegis_core/_examples/sources/git-abc123.json
 src/aegis_core/_examples/sources/git-bcd234.json

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/tests/test_cli.py

@@ -460,7 +460,7 @@ def test_example_constraints_load_with_zero_quarantined():
 
     store = ConstraintStore.load(CONSTRAINTS, authority_map=load_authority_map(AUTHORITY))
     assert store.quarantined == []
-    assert len(store.constraints) == 29
+    assert len(store.constraints) == 30
 
 
 def test_tofu_plan_is_gated_by_the_same_terraform_rule(capsys, tmp_path):
@@ -680,7 +680,7 @@ def test_sources_flag_quarantines_forged_constraints_with_no_vote_by_default(cap
     )
     assert {"id": "no-scale-prod-peak", "reason": "forged"} in plan["quarantined_at_load"]
     assert {"id": "no-scale-prod-peak", "reason": "forged"} in plan["store_health"]["quarantined"]
-    assert lines[0]["store_health"]["loaded"] == 28
+    assert lines[0]["store_health"]["loaded"] == 29
 
 
 def test_sources_flag_forged_constraint_escalates_under_on_untrusted_match_escalate(
@@ -708,7 +708,7 @@ def test_sources_flag_forged_constraint_escalates_under_on_untrusted_match_escal
     assert "fail-closed: no-scale-prod-peak (forged)" in lines[0]["decision"]["notes"]
     assert {"id": "no-scale-prod-peak", "reason": "forged"} in plan["quarantined_at_load"]
     assert {"id": "no-scale-prod-peak", "reason": "forged"} in plan["store_health"]["quarantined"]
-    assert lines[0]["store_health"]["loaded"] == 28
+    assert lines[0]["store_health"]["loaded"] == 29
 
 
 def test_ledger_flag_records_allowed_actions(capsys, tmp_path):
@@ -874,7 +874,7 @@ def test_store_health_is_on_every_per_intent_line_and_the_plan_summary(capsys, m
     )
     assert code == 0
     health = lines[0]["store_health"]
-    assert health["loaded"] == 29
+    assert health["loaded"] == 30
     assert health["quarantined"] == []
     assert health["principals"] == 3
     assert len(health["constraints_sha256"]) == 64
@@ -890,7 +890,7 @@ def test_pretty_output_ends_with_store_line(capsys):
     )
     out = capsys.readouterr().out
     assert code == 0
-    assert out.strip().splitlines()[-1] == "STORE: loaded=29 quarantined=0 principals=3"
+    assert out.strip().splitlines()[-1] == "STORE: loaded=30 quarantined=0 principals=3"
 
 
 def test_single_bit_flip_allows_by_default_but_reports_quarantine(capsys, tmp_path):
@@ -919,7 +919,7 @@ def test_single_bit_flip_allows_by_default_but_reports_quarantine(capsys, tmp_pa
     assert decision["notes"] == []
     health = lines[0]["store_health"]
     assert health["quarantined"] == [{"id": "no-delete-nodes", "reason": "tampered"}]
-    assert health["loaded"] == 28
+    assert health["loaded"] == 29
     assert "aegis: WARNING Quarantined constraint no-delete-nodes" in err
 
 
@@ -939,7 +939,7 @@ def test_single_bit_flip_escalates_under_on_untrusted_match_escalate(capsys, tmp
     assert "fail-closed: no-delete-nodes (tampered)" in decision["notes"]
     health = lines[0]["store_health"]
     assert health["quarantined"] == [{"id": "no-delete-nodes", "reason": "tampered"}]
-    assert health["loaded"] == 28
+    assert health["loaded"] == 29
     assert "aegis: WARNING Quarantined constraint no-delete-nodes" in err
 
 
@@ -952,7 +952,7 @@ def test_single_bit_flip_pretty_lists_quarantined_ids_but_allows_by_default(caps
     )
     out = capsys.readouterr().out
     assert code == 0
-    assert "STORE: loaded=28 quarantined=1 principals=3" in out
+    assert "STORE: loaded=29 quarantined=1 principals=3" in out
     assert "  quarantined: no-delete-nodes (tampered)" in out
     assert "note: fail-closed:" not in out
 
@@ -968,7 +968,7 @@ def test_single_bit_flip_pretty_lists_quarantined_ids_and_escalates_under_escala
     )
     out = capsys.readouterr().out
     assert code == 2
-    assert "STORE: loaded=28 quarantined=1 principals=3" in out
+    assert "STORE: loaded=29 quarantined=1 principals=3" in out
     assert "  quarantined: no-delete-nodes (tampered)" in out
     assert "note: fail-closed: no-delete-nodes (tampered)" in out
 

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/tests/test_default_rules.py

@@ -124,3 +124,36 @@ def test_forged_sources_differ_from_sources_in_one_file_only():
         or (real / n).read_bytes() != (forged / n).read_bytes()
     )
     assert differing == ["jira-1001.json"]
+
+
+@pytest.mark.parametrize("command, target", [
+    ("kubectl --as admin get pods", "user/admin"),
+    ("kubectl get pods --as-group=system:masters", "group/system:masters"),
+    ("kubectl delete pod/x --as-uid=0", "uid/0"),
+])
+def test_kubectl_impersonation_is_blocked(command, target, capsys):
+    code, verdicts = _verdicts(command, capsys)
+    assert ("BLOCK", ["block-kubectl-impersonation"]) in verdicts
+    assert code == 3
+    assert ("impersonate", target) in [
+        (i.action, i.resource) for i in intents_from_command(command)]
+
+
+def test_kubectl_without_impersonation_is_unaffected(capsys):
+    code, verdicts = _verdicts("kubectl get pods", capsys)
+    assert code == 0
+    assert all(v == "ALLOW" for v, _ in verdicts)
+
+
+@pytest.mark.parametrize("command", [
+    "kubectl --as admin rollout restart deploy/web",
+    "kubectl --as=admin rollout restart deploy/web",
+    "kubectl --as=admin set image deploy/web app=x:2",
+    "kubectl rollout --as admin restart deploy/web",
+    "kubectl rollout --as=admin restart deploy/web",
+    "kubectl set --as=admin image deploy/web app=x:2",
+])
+def test_impersonation_before_a_subcommand_verb_is_blocked(command, capsys):
+    code, verdicts = _verdicts(command, capsys)
+    assert ("BLOCK", ["block-kubectl-impersonation"]) in verdicts
+    assert code == 3

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/tests/test_interceptor.py

@@ -779,3 +779,62 @@ def test_resource_pattern_matches_module_stripped_terraform_alias():
     bare = InfrastructureIntent(resource="module.app.aws_db_instance.main", action="delete",
                                 provider="terraform")
     assert interceptor.intercept(bare, now=NOW).verdict == "ALLOW"
+
+
+# --- v0.2.1: unresolved conditions only fail closed for rules that may vote -----
+# (council review of the v0.3 design, gpt-6-astra P0-2: an unauthorized or
+# tampered rule could force ESCALATE through the env-/time-window-unresolved
+# paths, which ran before any integrity or authority check.)
+
+
+def _env_rule(**overrides):
+    fields = dict(id="prod-only", actions={"delete"}, resource_pattern="*",
+                  scope={"env": "prod"}, constraint_class="deletion", principal="admin")
+    fields.update(overrides)
+    return make_constraint(**fields)
+
+
+_UNRESOLVED_ENV_INTENT = InfrastructureIntent(
+    resource="pod/x", action="delete", provider="kubernetes", metadata={"namespace": "prod"})
+
+
+def test_unauthorized_rule_cannot_force_escalate_through_env_unresolved():
+    rule = _env_rule(principal="developer")  # developer may not assert deletion
+    decision = AegisInterceptor(_store_with(rule)).intercept(_UNRESOLVED_ENV_INTENT, now=NOW)
+    assert decision.verdict == "ALLOW"
+    assert decision.notes == []
+    assert decision.discarded == [{"id": "prod-only", "reason": "unauthorized"}]
+
+
+def test_tampered_rule_cannot_force_escalate_through_env_unresolved():
+    rule = _env_rule()
+    rule.effect = "ESCALATE"  # mutated after its hash was computed
+    decision = AegisInterceptor(_store_with(rule)).intercept(_UNRESOLVED_ENV_INTENT, now=NOW)
+    assert decision.verdict == "ALLOW"
+    assert decision.discarded == [{"id": "prod-only", "reason": "tampered"}]
+
+
+def test_unauthorized_env_rule_escalates_only_under_escalate_mode():
+    rule = _env_rule(principal="developer")
+    decision = AegisInterceptor(_store_with(rule), on_untrusted_match="escalate").intercept(
+        _UNRESOLVED_ENV_INTENT, now=NOW)
+    assert decision.verdict == "ESCALATE"
+    assert decision.notes == ["fail-closed: prod-only (unauthorized)"]
+
+
+def test_authorized_env_rule_still_escalates_when_env_is_unresolved():
+    decision = AegisInterceptor(_store_with(_env_rule())).intercept(
+        _UNRESOLVED_ENV_INTENT, now=NOW)
+    assert (decision.verdict, decision.notes) == ("ESCALATE", ["env-unresolved: prod-only"])
+
+
+def test_unauthorized_rule_cannot_force_escalate_through_time_window_unresolved():
+    rule = make_constraint(
+        id="peak-hours", actions={"scale"}, principal="developer", constraint_class="scaling",
+        time_window={"days": ["Mon"], "start": "09:00", "end": "17:00", "tz": "America/New_York"},
+    )
+    store = _store_with(rule)
+    store.tzdata_available = False
+    decision = AegisInterceptor(store).intercept(SCALE_INTENT, now=NOW)
+    assert decision.verdict == "ALLOW"
+    assert decision.discarded == [{"id": "peak-hours", "reason": "unauthorized"}]

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/tests/test_parser.py

@@ -254,14 +254,14 @@ def test_from_kubectl_rollout_status():
 def test_from_kubectl_exec_with_command():
     intent = from_kubectl(["kubectl", "exec", "mypod", "--", "ls", "-la"])
     assert intent.action == "exec"
-    assert intent.resource == "mypod"
+    assert intent.resource == "pod/mypod"  # a bare name is a pod
     assert intent.params["command"] == ["ls", "-la"]
 
 
 def test_from_kubectl_logs_resource():
     intent = from_kubectl(["kubectl", "logs", "mypod"])
     assert intent.action == "logs"
-    assert intent.resource == "mypod"
+    assert intent.resource == "pod/mypod"
 
 
 def test_from_kubectl_set_image():
@@ -2487,3 +2487,99 @@ def test_helm_set_replica_count_zero_expressible_as_a_scope_rule():
         ["helm", "upgrade", "api", "./chart", "--set", "replicaCount=3"]
     )
     assert not scope_matches(scope, not_zero.metadata, not_zero.params)
+
+
+# --- v0.2.1: kubectl normal forms (council review of the v0.3 design) --------
+
+
+@pytest.mark.parametrize("argv, expected", [
+    ("kubectl drain node1", [("drain", "node/node1")]),
+    ("kubectl drain node/node1 --ignore-daemonsets", [("drain", "node/node1")]),
+    ("kubectl cordon node1 node2", [("cordon", "node/node1"), ("cordon", "node/node2")]),
+    ("kubectl uncordon node1", [("uncordon", "node/node1")]),
+    ("kubectl exec api-0 -- sh", [("exec", "pod/api-0")]),
+    ("kubectl exec deploy/web -- sh", [("exec", "deployment/web")]),
+    ("kubectl attach api-0", [("attach", "pod/api-0")]),
+    ("kubectl port-forward svc/web 8080:80", [("port-forward", "service/web")]),
+    ("kubectl port-forward api-0 8080:80", [("port-forward", "pod/api-0")]),
+    ("kubectl logs api-0", [("logs", "pod/api-0")]),
+    ("kubectl delete storageclasses fast", [("delete", "storageclass/fast")]),
+    ("kubectl delete sc fast", [("delete", "storageclass/fast")]),
+    ("kubectl delete ingressclasses nginx", [("delete", "ingressclass/nginx")]),
+    ("kubectl delete clusterrolebindings admin", [("delete", "clusterrolebinding/admin")]),
+    ("kubectl delete validatingwebhookconfigurations aegis",
+     [("delete", "validatingwebhookconfiguration/aegis")]),
+    ("kubectl delete ep web", [("delete", "endpoints/web")]),
+])
+def test_kubectl_normal_forms(argv, expected):
+    from aegis_core.parser import from_argv
+
+    assert [(i.action, i.resource) for i in from_argv(argv.split())] == expected
+
+
+def test_kubectl_impersonation_is_recorded_not_dropped():
+    from aegis_core.parser import from_argv
+
+    intents = from_argv("kubectl delete node w1 --as=admin --as-group=system:masters "
+                        "--as-group=ops --as-uid=42".split())
+    assert intents[0].params["impersonate"] == {
+        "user": "admin", "groups": ["system:masters", "ops"], "uid": "42"}
+    # each impersonated identity is also its own intent, so policy can block it
+    assert [(i.action, i.resource) for i in intents] == [
+        ("delete", "node/w1"),
+        ("impersonate", "user/admin"),
+        ("impersonate", "group/system:masters"),
+        ("impersonate", "group/ops"),
+        ("impersonate", "uid/42"),
+    ]
+    leading = from_argv("kubectl --as admin delete node w1".split())
+    assert [(i.action, i.resource) for i in leading] == [
+        ("delete", "node/w1"), ("impersonate", "user/admin")]
+
+
+@pytest.mark.parametrize("leading, trailing", [
+    ("kubectl -n prod rollout restart deploy/web", "kubectl rollout restart deploy/web -n prod"),
+    ("kubectl --as admin rollout restart deploy/web",
+     "kubectl rollout restart deploy/web --as admin"),
+    ("kubectl --as=admin rollout undo deploy/web", "kubectl rollout undo deploy/web --as=admin"),
+    ("kubectl -n prod set image deploy/web app=x:2",
+     "kubectl set image deploy/web app=x:2 -n prod"),
+    ("kubectl --as=admin set image deploy/web app=x:2",
+     "kubectl set image deploy/web app=x:2 --as=admin"),
+    # re-review of #13: globals between the verb and its subcommand
+    ("kubectl rollout --as admin restart deploy/web",
+     "kubectl rollout restart deploy/web --as admin"),
+    ("kubectl rollout --as=admin restart deploy/web",
+     "kubectl rollout restart deploy/web --as=admin"),
+    ("kubectl rollout -n prod --as-group=ops restart deploy/web",
+     "kubectl rollout restart deploy/web -n prod --as-group=ops"),
+    ("kubectl set --as=admin image deploy/web app=x:2",
+     "kubectl set image deploy/web app=x:2 --as=admin"),
+    ("kubectl -n prod set --as admin image deploy/web app=x:2",
+     "kubectl set image deploy/web app=x:2 -n prod --as admin"),
+])
+def test_leading_globals_before_a_subcommand_verb(leading, trailing):
+    """Review of #13: for rollout/set the subcommand was taken from the
+    merged token list, so a leading global ("-n", "--as") became the
+    subcommand and the impersonation / namespace was lost."""
+    from aegis_core.parser import from_argv
+
+    def shape(argv):
+        return [(i.action, i.resource, i.metadata, i.params.get("impersonate"))
+                for i in from_argv(argv.split())]
+
+    assert shape(leading) == shape(trailing)
+    assert not any(a.startswith("rollout--") for a, *_ in shape(leading))
+
+
+@pytest.mark.parametrize("argv", [
+    "kubectl rollout --bogus restart deploy/web",  # unknown option before the subcommand
+    "kubectl rollout --as",                        # option without its value
+    "kubectl rollout --as admin",                  # no subcommand after the options
+    "kubectl set --as admin rollout deploy/web",   # not "set image"
+])
+def test_unparseable_options_before_a_subcommand_fail_closed(argv):
+    from aegis_core.parser import from_argv
+
+    with pytest.raises(ValueError):
+        from_argv(argv.split())

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/tests/test_parsers_sql.py

@@ -500,7 +500,7 @@ def _load_example_store():
 def test_example_store_loads_with_zero_quarantined():
     store = _load_example_store()
     assert store.quarantined == []
-    assert len(store.constraints) == 29
+    assert len(store.constraints) == 30
 
 
 def test_unbounded_delete_is_blocked_end_to_end():

{aegis_devops-0.2.0 → aegis_devops-0.2.1}/tests/test_store.py

@@ -299,7 +299,7 @@ def test_store_health_of_example_store_is_clean():
         "data/constraints.example.yaml", authority_map=load_authority_map(AUTHORITY_PATH)
     )
     health = store.health
-    assert health.loaded == 29
+    assert health.loaded == 30
     assert health.quarantined == []
     assert health.principals == 3
     assert len(health.constraints_sha256) == 64
@@ -479,7 +479,7 @@ def test_shipped_example_store_loads_signed_with_sources_and_no_warnings():
         source_fetcher=FileSourceFetcher("data/sources", key=key),
         key=key,
     )
-    assert store.health.loaded == 29
+    assert store.health.loaded == 30
     assert store.health.quarantined == []
     assert store.health.warnings == []
 

aegis_devops-0.2.0/src/aegis_core/_examples/constraints.example.yaml.sig

@@ -1,2 +0,0 @@
-aegis-sig-v1
-245908109e5e1ecf20ba80c41aa725c57dfbd5b2f185da1bc6708b3cbd3ce42d