aegis-devops 0.3.1__tar.gz → 1.0.0__tar.gz

{aegis_devops-0.3.1/src/aegis_devops.egg-info → aegis_devops-1.0.0}/PKG-INFO

@@ -1,12 +1,13 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.3.1
+Version: 1.0.0
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
+Author: Vamshidher Reddy Jannapu Reddy
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
 Project-URL: Repository, https://github.com/moneytool/aegis-devops
 Keywords: agentops,agent-security,policy-as-code,provenance,kubernetes,terraform,guardrails,prompt-injection,context-poisoning
-Classifier: Development Status :: 3 - Alpha
+Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: System Administrators
 Classifier: Intended Audience :: Developers
@@ -45,30 +46,43 @@ become policy.
 
 ![Aegis-DevOps blocking an injected kubectl delete](docs/where-it-sits.gif)
 
-### Install in Claude Code
+## Try it in 60 seconds
+
+**1. Watch it block a pull request (nothing to install).** Open the demo's
+[example PR](https://github.com/moneytool/aegis-devops-demo/pull/1): it deletes a production
+database, and the failing check is Aegis blocking it, with the verdict posted as a comment. Fork
+the [demo repository](https://github.com/moneytool/aegis-devops-demo) to try your own change; no
+cloud account needed.
+
+**2. Check a command yourself:**
 
 ```bash
 pip install aegis-devops && aegis init .aegis
-claude plugin marketplace add moneytool/aegis-devops
-claude plugin install aegis-devops@aegis-devops
+aegis check command --pretty -- "kubectl delete namespace prod"   # BLOCK (exit 3)
+aegis check command --pretty -- "kubectl get pods -n prod"        # ALLOW (exit 0)
 ```
 
-### Install in Gemini CLI
+**3. Put it in front of your coding agent.** In the same project:
 
 ```bash
-pip install aegis-devops && aegis init .aegis
-gemini extensions install https://github.com/moneytool/aegis-devops
+claude plugin marketplace add moneytool/aegis-devops
+claude plugin install aegis-devops@aegis-devops
 ```
 
-Codex, GitHub Copilot (CLI and VS Code), Cursor and OpenCode:
-`aegis install codex|copilot|vscode|cursor|opencode`
-(see [Coding agents](docs/agents.md)). It only acts in projects with a `.aegis/` policy, and
-only blocks what that policy blocks. It also works as a CI step
-(`aegis check terraform plan.json --exit-style ci`) and as a Python library; see
-[Quick start](#quick-start). In GitHub Actions, the
-[Aegis-DevOps Plan Check](https://github.com/marketplace/actions/aegis-devops-plan-check) Action
-checks a Terraform or OpenTofu plan and comments the verdict on the pull request:
-`uses: moneytool/aegis-devops-action@v1` with `plan: plan.json`.
+Then ask Claude Code to delete the `prod` namespace: the hook blocks the command before it runs.
+Gemini CLI: `gemini extensions install https://github.com/moneytool/aegis-devops`. Codex, GitHub
+Copilot (CLI and VS Code), Cursor and OpenCode: `aegis install codex|copilot|vscode|cursor|opencode`
+(see [Coding agents](docs/agents.md)). Aegis only acts in projects with a `.aegis/` policy, and
+only blocks what that policy blocks. `aegis init` writes example rules signed with a public
+example key; replace both before relying on it ([Configuration](docs/configuration.md)). It
+works alongside RBAC and your agent's own permission settings; see
+[Why not RBAC](#why-not-rbac-or-the-agents-own-permission-settings).
+
+In CI, the [Aegis-DevOps Plan Check](https://github.com/marketplace/actions/aegis-devops-plan-check)
+Action checks a Terraform or OpenTofu plan on every pull request
+(`uses: moneytool/aegis-devops-action@v1` with `plan: plan.json`); `aegis check terraform
+plan.json --exit-style ci` does the same in any pipeline, and Aegis also works as a Python
+library ([Quick start](#quick-start)).
 
 ## What it does
 
@@ -225,6 +239,45 @@ about who wrote a rule, but it cannot recompute a hash or fetch a source. Up to
 rows were scored against all 500 rules, which counted rules the models never saw as resisted
 poison and understated their susceptibility (0.23–0.33); see [`CHANGELOG.md`](CHANGELOG.md).
 
+## Why not RBAC, or the agent's own permission settings?
+
+Keep both. Aegis sits alongside them; it doesn't replace either.
+
+**Agent permission settings** (Claude Code's allow/deny rules, Copilot's tool approvals and
+similar) decide which commands an agent may run without asking you. They match the command
+text. Claude Code's documentation says a Bash deny rule ["isn't a security boundary around the
+program"](https://code.claude.com/docs/en/permissions#bash-rule-limits), and recommends a
+PreToolUse hook when you need to inspect the full command before it runs. Aegis is that hook. It
+works out what the command will do, so every spelling of the same action reaches the same rule:
+
+| Command the agent writes | Aegis with the example policy |
+|---|---|
+| `kubectl delete deploy web -n prod` | BLOCK (`no-delete-in-prod-namespace`) |
+| `kubectl -n prod delete deploy web` | BLOCK, same rule |
+| `/usr/bin/kubectl …`, `sudo kubectl …`, `env kubectl …` | BLOCK, same rule |
+| `bash -c 'kubectl delete deploy web -n prod'` | BLOCK, same rule |
+| `cd /tmp && kubectl delete deploy web -n prod` | BLOCK, same rule |
+| `git -C . push --force origin main` | BLOCK (`git-block-force-push-main`) |
+| `K=kubectl; $K delete deploy web -n prod` | Refused: it can't be checked statically, so the hook denies it and asks for the command on its own |
+
+Permission settings also record *what* is allowed, not who decided it. An Aegis rule only gets a
+vote if nobody has changed it since it was signed and its author was allowed to write that kind
+of rule.
+
+**RBAC and IAM** decide what an identity may do. A coding agent usually runs with the
+developer's own kubeconfig and cloud credentials, so RBAC sees the developer and grants the
+agent the same rights. Aegis decides each action against the policy: no deletes in the `prod`
+namespace, no `kubectl --as` impersonation, no plan that deletes a database. Once agents do have
+their own identities, the same policy compiles into the platform layer, so it holds even for
+calls that never pass through the hook (an SDK script, a leaked key):
+
+- `aegis compile aws`: Service Control Policies scoped to agent identities.
+- `aegis compile kubernetes`: ValidatingAdmissionPolicies scoped to agent identities, plus
+  `aegis audit-identity kubernetes` to report the RBAC permissions that would let an agent get
+  around them (impersonation, editing admission policies, RBAC escalation).
+
+Both are previews; see [server-side enforcement](docs/server-side.md).
+
 ## Why not OPA/Gatekeeper?
 
 OPA/Gatekeeper evaluates **structured API objects** against **hand-authored rules**. Aegis
@@ -255,7 +308,11 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.3.1 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v1.0.0 is on PyPI, with the [session budget cap](docs/budget.md). **1.0 is a promise about the
+interface:** the policy file formats, the CLI commands and exit codes, the hook protocol and the
+Action's inputs and outputs stay compatible until 2.0; the server-side compilers and the
+identity audit remain previews ([CHANGELOG](CHANGELOG.md)). It is not a claim that the open gaps
+below are closed. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
@@ -278,6 +335,7 @@ of anything you care about.
 | [`docs/constraints.md`](docs/constraints.md) | Writing constraints, metadata vocabulary, authority policy, environment mapping |
 | [`docs/configuration.md`](docs/configuration.md) | Configuration/config-dir discovery, signing, source verification, the identity model (`agents.yaml`), rate limits & ledger |
 | [`docs/server-side.md`](docs/server-side.md) | Preview: compiling the policy to AWS Service Control Policies scoped to agent identities |
+| [`docs/budget.md`](docs/budget.md) | The session budget cap: per-session and per-project-per-day limits in estimated USD or tokens, across Claude Code, Codex, Gemini CLI, OpenCode and Copilot CLI |
 | [`docs/benchmark.md`](docs/benchmark.md) | Benchmark methodology, full results table, real LLM baselines, agent-harness baselines, corpus, adversarial suite |
 | [`docs/CONTRIBUTING.md`](docs/CONTRIBUTING.md) | Adding a new parser or tool |
 | [`docs/dev/PLAN.md`](docs/dev/PLAN.md) | Design plan and open gaps |
@@ -288,7 +346,7 @@ of anything you care about.
 ## Development
 
 ```bash
-venv/bin/python -m pytest -q      # 1257 passed (last full green run; CI runs this on 3.11/3.13/3.14)
+venv/bin/python -m pytest -q      # 1,791 passed (CI runs this on 3.11/3.13/3.14, Linux and macOS)
 venv/bin/python -m ruff check src tests scripts examples
 vhs docs/demo.tape                # regenerate docs/demo.gif
 ```
@@ -298,6 +356,12 @@ Reporting a bypass: see [`SECURITY.md`](SECURITY.md) — parser evasion is the l
 attack surface and the most useful thing to report. Release history is in
 [`CHANGELOG.md`](CHANGELOG.md).
 
+## Support
+
+If Aegis-DevOps is useful to you, a ⭐ on [GitHub](https://github.com/moneytool/aegis-devops)
+helps other people find it. Bug reports, ideas and bypasses are welcome too: open an issue, or
+see [`SECURITY.md`](SECURITY.md) for anything that gets a blocked command through.
+
 ## License
 
 Apache-2.0 — see [LICENSE](LICENSE).

{aegis_devops-0.3.1 → aegis_devops-1.0.0}/README.md

@@ -13,30 +13,43 @@ become policy.
 
 ![Aegis-DevOps blocking an injected kubectl delete](docs/where-it-sits.gif)
 
-### Install in Claude Code
+## Try it in 60 seconds
+
+**1. Watch it block a pull request (nothing to install).** Open the demo's
+[example PR](https://github.com/moneytool/aegis-devops-demo/pull/1): it deletes a production
+database, and the failing check is Aegis blocking it, with the verdict posted as a comment. Fork
+the [demo repository](https://github.com/moneytool/aegis-devops-demo) to try your own change; no
+cloud account needed.
+
+**2. Check a command yourself:**
 
 ```bash
 pip install aegis-devops && aegis init .aegis
-claude plugin marketplace add moneytool/aegis-devops
-claude plugin install aegis-devops@aegis-devops
+aegis check command --pretty -- "kubectl delete namespace prod"   # BLOCK (exit 3)
+aegis check command --pretty -- "kubectl get pods -n prod"        # ALLOW (exit 0)
 ```
 
-### Install in Gemini CLI
+**3. Put it in front of your coding agent.** In the same project:
 
 ```bash
-pip install aegis-devops && aegis init .aegis
-gemini extensions install https://github.com/moneytool/aegis-devops
+claude plugin marketplace add moneytool/aegis-devops
+claude plugin install aegis-devops@aegis-devops
 ```
 
-Codex, GitHub Copilot (CLI and VS Code), Cursor and OpenCode:
-`aegis install codex|copilot|vscode|cursor|opencode`
-(see [Coding agents](docs/agents.md)). It only acts in projects with a `.aegis/` policy, and
-only blocks what that policy blocks. It also works as a CI step
-(`aegis check terraform plan.json --exit-style ci`) and as a Python library; see
-[Quick start](#quick-start). In GitHub Actions, the
-[Aegis-DevOps Plan Check](https://github.com/marketplace/actions/aegis-devops-plan-check) Action
-checks a Terraform or OpenTofu plan and comments the verdict on the pull request:
-`uses: moneytool/aegis-devops-action@v1` with `plan: plan.json`.
+Then ask Claude Code to delete the `prod` namespace: the hook blocks the command before it runs.
+Gemini CLI: `gemini extensions install https://github.com/moneytool/aegis-devops`. Codex, GitHub
+Copilot (CLI and VS Code), Cursor and OpenCode: `aegis install codex|copilot|vscode|cursor|opencode`
+(see [Coding agents](docs/agents.md)). Aegis only acts in projects with a `.aegis/` policy, and
+only blocks what that policy blocks. `aegis init` writes example rules signed with a public
+example key; replace both before relying on it ([Configuration](docs/configuration.md)). It
+works alongside RBAC and your agent's own permission settings; see
+[Why not RBAC](#why-not-rbac-or-the-agents-own-permission-settings).
+
+In CI, the [Aegis-DevOps Plan Check](https://github.com/marketplace/actions/aegis-devops-plan-check)
+Action checks a Terraform or OpenTofu plan on every pull request
+(`uses: moneytool/aegis-devops-action@v1` with `plan: plan.json`); `aegis check terraform
+plan.json --exit-style ci` does the same in any pipeline, and Aegis also works as a Python
+library ([Quick start](#quick-start)).
 
 ## What it does
 
@@ -193,6 +206,45 @@ about who wrote a rule, but it cannot recompute a hash or fetch a source. Up to
 rows were scored against all 500 rules, which counted rules the models never saw as resisted
 poison and understated their susceptibility (0.23–0.33); see [`CHANGELOG.md`](CHANGELOG.md).
 
+## Why not RBAC, or the agent's own permission settings?
+
+Keep both. Aegis sits alongside them; it doesn't replace either.
+
+**Agent permission settings** (Claude Code's allow/deny rules, Copilot's tool approvals and
+similar) decide which commands an agent may run without asking you. They match the command
+text. Claude Code's documentation says a Bash deny rule ["isn't a security boundary around the
+program"](https://code.claude.com/docs/en/permissions#bash-rule-limits), and recommends a
+PreToolUse hook when you need to inspect the full command before it runs. Aegis is that hook. It
+works out what the command will do, so every spelling of the same action reaches the same rule:
+
+| Command the agent writes | Aegis with the example policy |
+|---|---|
+| `kubectl delete deploy web -n prod` | BLOCK (`no-delete-in-prod-namespace`) |
+| `kubectl -n prod delete deploy web` | BLOCK, same rule |
+| `/usr/bin/kubectl …`, `sudo kubectl …`, `env kubectl …` | BLOCK, same rule |
+| `bash -c 'kubectl delete deploy web -n prod'` | BLOCK, same rule |
+| `cd /tmp && kubectl delete deploy web -n prod` | BLOCK, same rule |
+| `git -C . push --force origin main` | BLOCK (`git-block-force-push-main`) |
+| `K=kubectl; $K delete deploy web -n prod` | Refused: it can't be checked statically, so the hook denies it and asks for the command on its own |
+
+Permission settings also record *what* is allowed, not who decided it. An Aegis rule only gets a
+vote if nobody has changed it since it was signed and its author was allowed to write that kind
+of rule.
+
+**RBAC and IAM** decide what an identity may do. A coding agent usually runs with the
+developer's own kubeconfig and cloud credentials, so RBAC sees the developer and grants the
+agent the same rights. Aegis decides each action against the policy: no deletes in the `prod`
+namespace, no `kubectl --as` impersonation, no plan that deletes a database. Once agents do have
+their own identities, the same policy compiles into the platform layer, so it holds even for
+calls that never pass through the hook (an SDK script, a leaked key):
+
+- `aegis compile aws`: Service Control Policies scoped to agent identities.
+- `aegis compile kubernetes`: ValidatingAdmissionPolicies scoped to agent identities, plus
+  `aegis audit-identity kubernetes` to report the RBAC permissions that would let an agent get
+  around them (impersonation, editing admission policies, RBAC escalation).
+
+Both are previews; see [server-side enforcement](docs/server-side.md).
+
 ## Why not OPA/Gatekeeper?
 
 OPA/Gatekeeper evaluates **structured API objects** against **hand-authored rules**. Aegis
@@ -223,7 +275,11 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.3.1 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v1.0.0 is on PyPI, with the [session budget cap](docs/budget.md). **1.0 is a promise about the
+interface:** the policy file formats, the CLI commands and exit codes, the hook protocol and the
+Action's inputs and outputs stay compatible until 2.0; the server-side compilers and the
+identity audit remain previews ([CHANGELOG](CHANGELOG.md)). It is not a claim that the open gaps
+below are closed. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
@@ -246,6 +302,7 @@ of anything you care about.
 | [`docs/constraints.md`](docs/constraints.md) | Writing constraints, metadata vocabulary, authority policy, environment mapping |
 | [`docs/configuration.md`](docs/configuration.md) | Configuration/config-dir discovery, signing, source verification, the identity model (`agents.yaml`), rate limits & ledger |
 | [`docs/server-side.md`](docs/server-side.md) | Preview: compiling the policy to AWS Service Control Policies scoped to agent identities |
+| [`docs/budget.md`](docs/budget.md) | The session budget cap: per-session and per-project-per-day limits in estimated USD or tokens, across Claude Code, Codex, Gemini CLI, OpenCode and Copilot CLI |
 | [`docs/benchmark.md`](docs/benchmark.md) | Benchmark methodology, full results table, real LLM baselines, agent-harness baselines, corpus, adversarial suite |
 | [`docs/CONTRIBUTING.md`](docs/CONTRIBUTING.md) | Adding a new parser or tool |
 | [`docs/dev/PLAN.md`](docs/dev/PLAN.md) | Design plan and open gaps |
@@ -256,7 +313,7 @@ of anything you care about.
 ## Development
 
 ```bash
-venv/bin/python -m pytest -q      # 1257 passed (last full green run; CI runs this on 3.11/3.13/3.14)
+venv/bin/python -m pytest -q      # 1,791 passed (CI runs this on 3.11/3.13/3.14, Linux and macOS)
 venv/bin/python -m ruff check src tests scripts examples
 vhs docs/demo.tape                # regenerate docs/demo.gif
 ```
@@ -266,6 +323,12 @@ Reporting a bypass: see [`SECURITY.md`](SECURITY.md) — parser evasion is the l
 attack surface and the most useful thing to report. Release history is in
 [`CHANGELOG.md`](CHANGELOG.md).
 
+## Support
+
+If Aegis-DevOps is useful to you, a ⭐ on [GitHub](https://github.com/moneytool/aegis-devops)
+helps other people find it. Bug reports, ideas and bypasses are welcome too: open an issue, or
+see [`SECURITY.md`](SECURITY.md) for anything that gets a blocked command through.
+
 ## License
 
 Apache-2.0 — see [LICENSE](LICENSE).

{aegis_devops-0.3.1 → aegis_devops-1.0.0}/pyproject.toml

@@ -7,6 +7,7 @@ name = "aegis-devops"
 license = "Apache-2.0"
 dynamic = ["version"]
 description = "Provenance-backed, authority-aware policy verifier for agentic DevOps actions."
+authors = [{ name = "Vamshidher Reddy Jannapu Reddy" }]
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
@@ -24,7 +25,7 @@ keywords = [
     "context-poisoning",
 ]
 classifiers = [
-    "Development Status :: 3 - Alpha",
+    "Development Status :: 4 - Beta",
     "Environment :: Console",
     "Intended Audience :: System Administrators",
     "Intended Audience :: Developers",
@@ -62,7 +63,7 @@ version = {attr = "aegis_core.__version__"}
 where = ["src"]
 
 [tool.setuptools.package-data]
-aegis_core = ["_examples/**/*", "integrations/*", "compile/actions/*"]
+aegis_core = ["_examples/**/*", "integrations/*", "compile/actions/*", "budget/*.yaml", "budget/*.json"]
 
 [tool.ruff]
 line-length = 100

{aegis_devops-0.3.1 → aegis_devops-1.0.0}/src/aegis_core/__init__.py

@@ -4,4 +4,4 @@ infrastructure actions of AI agents.
 See the README for what this does and, importantly, what it does not yet do.
 """
 
-__version__ = "0.3.1"
+__version__ = "1.0.0"

{aegis_devops-0.3.1 → aegis_devops-1.0.0}/src/aegis_core/_examples/agents.example.yaml

@@ -34,6 +34,9 @@ trusted:
   - platform: aws
     kind: source-identity
     id: alice@example.com
+    # A source identity survives role chaining, so an agent started in alice's session would
+    # carry it and be exempt. Trust one only if no agent ever runs under it, and say so:
+    no_agents: true
   - platform: github
     kind: oidc-subject
     # bound to one reusable workflow at a protected ref, so an agent job in the same

aegis_devops-1.0.0/src/aegis_core/_examples/agents.example.yaml.sig

@@ -0,0 +1,2 @@
+aegis-sig-v1
+2b55b41fc96166220d0d092f84dfee805ee18f791b5181c4b850836c7148042c

{aegis_devops-0.3.1 → aegis_devops-1.0.0}/src/aegis_core/_examples/authority.example.yaml

@@ -6,6 +6,7 @@ principals:
     - deletion
     - configuration
     - identity       # may change agents.yaml, the identity model
+    - budget         # may change budget.yaml, the budget cap
   sre_lead:
     - scaling
     - configuration

aegis_devops-1.0.0/src/aegis_core/_examples/authority.example.yaml.sig

@@ -0,0 +1,2 @@
+aegis-sig-v1
+b2ceb3e6cb27ac15787c4d6b9015065e03b804a6ac837c8fcc4f9895961bd130

aegis_devops-1.0.0/src/aegis_core/_examples/budget.example.yaml

@@ -0,0 +1,21 @@
+# The session budget cap (docs/budget.md). Copy to budget.yaml, set your own limits, and sign
+# it with `aegis sign`; its principal must hold the 'budget' class in authority.yaml. Until
+# it is named budget.yaml it does nothing. Then reinstall your agents' hooks (`aegis install
+# <agent>`) so they see every tool call, and check with: aegis budget status
+version: 1
+principal: admin                 # must hold the 'budget' class in authority.yaml
+unit: usd                        # usd (estimated from list prices) | tokens; required
+session:
+  limit: 20                      # per agent session
+  warn_at: 0.8                   # warn once at 80%
+project_day:
+  limit: 100                     # every measured session in this project, per day
+  warn_at: 0.8
+  tz: UTC                        # the day boundary
+agents: [claude, codex, gemini, opencode, copilot]   # only listed agents are measured
+on_unknown_log: allow            # allow (warn) | deny: usage Aegis cannot verify
+on_unknown_price: estimate       # estimate (warn) | deny: models with no price
+pricing: {}                      # signed overrides, USD per million tokens:
+#  claude-opus-5-5: {input: 4, output: 20, cache_read: 0.2, cache_write: 8}
+copilot:
+  premium_requests: 50           # Copilot CLI reports premium requests, not tokens

aegis_devops-1.0.0/src/aegis_core/_examples/budget.example.yaml.sig

@@ -0,0 +1,2 @@
+aegis-sig-v1
+d8ad9e56f8548c60028c05c17ce2f46ca190127cbafde00669faef484f3eaea4

aegis_devops-1.0.0/src/aegis_core/budget/__init__.py

@@ -0,0 +1,27 @@
+"""Cross-agent session budget cap (design: docs/dev/DESIGN-v1.0-budget-cap.md).
+
+* :mod:`~aegis_core.budget.policy` -- the signed ``budget.yaml``;
+* :mod:`~aegis_core.budget.pricing` -- tokens to estimated dollars;
+* :mod:`~aegis_core.budget.logs` -- reading usage from each agent's logs;
+* :mod:`~aegis_core.budget.accounting` -- session records, project/day
+  totals, revisions, locks, the inventory and rebuilds;
+* :mod:`~aegis_core.budget.evaluate` -- allow / warn / deny.
+"""
+
+from aegis_core.budget.accounting import BudgetStore, Snapshot, rebuild, refresh
+from aegis_core.budget.evaluate import ALLOW, DENY, WARN, Verdict, evaluate
+from aegis_core.budget.logs import Locator, default_logs
+from aegis_core.budget.policy import BUDGET_CLASS, BUDGET_FILE, BudgetPolicy, load_budget_policy
+from aegis_core.budget.pricing import PriceTable, load_builtin_table
+
+
+def price_table(policy: BudgetPolicy) -> PriceTable:
+    """The built-in prices with the policy's signed overrides."""
+    return PriceTable(load_builtin_table(), policy.pricing)
+
+
+__all__ = [
+    "ALLOW", "BUDGET_CLASS", "BUDGET_FILE", "DENY", "WARN", "BudgetPolicy", "BudgetStore",
+    "Locator", "PriceTable", "Snapshot", "Verdict", "default_logs", "evaluate",
+    "load_budget_policy", "load_builtin_table", "price_table", "rebuild", "refresh",
+]