aegis-kernel 1.0.0__py3-none-any.whl

aegis_kernel/__init__.py

@@ -0,0 +1,30 @@
+"""
+Aegis Invariant Kernel for Python
+Deterministic, sub-2ms safety clearance gateway for AI Agent tool execution.
+"""
+
+from .types import AegisVerdict, AegisViolation, ToolCall, AegisConfig
+from .engine import AegisEngine
+from .decorator import aegis_guard, AegisBlockedError
+from .checkers import PythonStateChecker, PythonPiiTokenVault
+from .adapters import AegisCrewAITool, wrap_autogen_function, AegisLangChainTool, wrap_langchain_tool
+
+__all__ = [
+    "AegisVerdict",
+    "AegisViolation",
+    "ToolCall",
+    "AegisConfig",
+    "AegisEngine",
+    "aegis_guard",
+    "AegisBlockedError",
+    "AegisCrewAITool",
+    "wrap_autogen_function",
+    "AegisLangChainTool",
+    "wrap_langchain_tool",
+    "PythonStateChecker",
+    "PythonPiiTokenVault",
+]
+
+__version__ = "1.0.0"
+
+

aegis_kernel/adapters.py

@@ -0,0 +1,163 @@
+"""
+Framework adapters for popular Python AI Agent Frameworks (CrewAI, AutoGen, LangChain).
+"""
+
+import asyncio
+from typing import Any, Callable, Dict, Optional, List, Union
+from .engine import AegisEngine
+from .decorator import aegis_guard, AegisBlockedError
+from .types import ToolCall, AegisVerdict
+
+class AegisCrewAITool:
+    """
+    CrewAI Tool Wrapper: Wraps a CrewAI BaseTool or tool function
+    with deterministic Aegis invariant verification.
+    """
+    def __init__(self, tool_instance: Any, engine: Optional[AegisEngine] = None):
+        self.tool = tool_instance
+        self.engine = engine or AegisEngine()
+        self.name = getattr(tool_instance, "name", getattr(tool_instance, "__name__", "crewai_tool"))
+        self.description = getattr(tool_instance, "description", "")
+
+    def run(self, *args: Any, **kwargs: Any) -> Any:
+        params = dict(kwargs)
+        if args:
+            params["_args"] = list(args)
+
+        tool_call = ToolCall(tool=self.name, params=params)
+        verdict = self.engine.evaluate(tool_call)
+
+        if not verdict.allowed:
+            first_v = verdict.violations[0]
+            # Return structured error string for CrewAI self-healing loop
+            return f"ERROR [Aegis Policy Blocked]: {first_v.rule_id} - {first_v.message}. Suggested Fix: {first_v.suggested_fix or 'Adhere to policy bounds.'}"
+
+        if hasattr(self.tool, "_run"):
+            return self.tool._run(*args, **kwargs)
+        elif callable(self.tool):
+            return self.tool(*args, **kwargs)
+        else:
+            raise ValueError(f"Target {self.tool} is not callable")
+
+    def __call__(self, *args: Any, **kwargs: Any) -> Any:
+        return self.run(*args, **kwargs)
+
+def wrap_autogen_function(func: Callable[..., Any], engine: Optional[AegisEngine] = None) -> Callable[..., Any]:
+    """
+    Wraps an AutoGen tool function to intercept executions and return
+    self-healing structured feedback if an invariant is violated.
+    """
+    eng = engine or AegisEngine()
+    tool_name = func.__name__
+
+    def wrapped(*args: Any, **kwargs: Any) -> Any:
+        params = dict(kwargs)
+        if args:
+            params["_args"] = list(args)
+
+        tool_call = ToolCall(tool=tool_name, params=params)
+        verdict = eng.evaluate(tool_call)
+
+        if not verdict.allowed:
+            first_v = verdict.violations[0]
+            return {
+                "error": True,
+                "status": "BLOCKED",
+                "rule_id": first_v.rule_id,
+                "message": first_v.message,
+                "suggested_fix": first_v.suggested_fix,
+                "proof_hash": verdict.proof_hash
+            }
+
+        return func(*args, **kwargs)
+
+    return wrapped
+
+class AegisLangChainTool:
+    """
+    LangChain Tool Wrapper: Wraps a LangChain BaseTool, StructuredTool, or Python callable
+    with deterministic Aegis invariant verification with zero external dependencies.
+    Supports both traditional `.run()` and modern LCEL / LangGraph `.invoke()` / `.ainvoke()`.
+    """
+    def __init__(
+        self,
+        tool_instance: Any,
+        engine: Optional[AegisEngine] = None,
+        handle_tool_error: bool = True
+    ):
+        self.tool = tool_instance
+        self.engine = engine or AegisEngine()
+        self.name = getattr(tool_instance, "name", getattr(tool_instance, "__name__", "langchain_tool"))
+        self.description = getattr(tool_instance, "description", "")
+        self.handle_tool_error = handle_tool_error
+
+    def _extract_params(self, tool_input: Any = None, *args: Any, **kwargs: Any) -> Dict[str, Any]:
+        params = dict(kwargs)
+        if tool_input is not None:
+            if isinstance(tool_input, dict):
+                params.update(tool_input)
+            elif isinstance(tool_input, str):
+                if "query" not in params and "input" not in params:
+                    params["query"] = tool_input
+                else:
+                    params["_input"] = tool_input
+            else:
+                params["_tool_input"] = tool_input
+        if args:
+            params["_args"] = list(args)
+        return params
+
+    def run(self, tool_input: Any = None, *args: Any, **kwargs: Any) -> Any:
+        params = self._extract_params(tool_input, *args, **kwargs)
+        tool_call = ToolCall(tool=self.name, params=params)
+        verdict = self.engine.evaluate(tool_call)
+
+        if not verdict.allowed:
+            first_v = verdict.violations[0]
+            if self.handle_tool_error:
+                return f"Error: [Aegis Policy Blocked] {first_v.rule_id} - {first_v.message}. Suggested Fix: {first_v.suggested_fix or 'Adhere to policy bounds.'}"
+            raise AegisBlockedError(verdict)
+
+        if hasattr(self.tool, "run") and callable(self.tool.run) and self.tool.run != self.run:
+            return self.tool.run(tool_input, *args, **kwargs) if tool_input is not None else self.tool.run(*args, **kwargs)
+        elif hasattr(self.tool, "_run") and callable(self.tool._run):
+            return self.tool._run(tool_input, *args, **kwargs) if tool_input is not None else self.tool._run(*args, **kwargs)
+        elif callable(self.tool):
+            if tool_input is not None and not kwargs and not args:
+                return self.tool(tool_input)
+            return self.tool(*args, **kwargs)
+        else:
+            raise ValueError(f"Target {self.tool} is not callable")
+
+    def invoke(self, input: Any, config: Optional[Dict[str, Any]] = None, **kwargs: Any) -> Any:
+        """LangChain Runnable Protocol compatibility."""
+        return self.run(input, **kwargs)
+
+    async def ainvoke(self, input: Any, config: Optional[Dict[str, Any]] = None, **kwargs: Any) -> Any:
+        """Async LangChain Runnable Protocol compatibility."""
+        params = self._extract_params(input, **kwargs)
+        tool_call = ToolCall(tool=self.name, params=params)
+        verdict = self.engine.evaluate(tool_call)
+
+        if not verdict.allowed:
+            first_v = verdict.violations[0]
+            if self.handle_tool_error:
+                return f"Error: [Aegis Policy Blocked] {first_v.rule_id} - {first_v.message}. Suggested Fix: {first_v.suggested_fix or 'Adhere to policy bounds.'}"
+            raise AegisBlockedError(verdict)
+
+        if hasattr(self.tool, "ainvoke") and callable(self.tool.ainvoke):
+            return await self.tool.ainvoke(input, config=config, **kwargs)
+        elif hasattr(self.tool, "_arun") and callable(self.tool._arun):
+            return await self.tool._arun(input, **kwargs)
+        elif asyncio.iscoroutinefunction(self.tool):
+            return await self.tool(input, **kwargs)
+        else:
+            return self.run(input, **kwargs)
+
+    def __call__(self, *args: Any, **kwargs: Any) -> Any:
+        return self.run(*args, **kwargs)
+
+def wrap_langchain_tool(tool: Any, engine: Optional[AegisEngine] = None, handle_tool_error: bool = True) -> AegisLangChainTool:
+    """Convenience helper to wrap any LangChain tool or callable with Aegis invariant verification."""
+    return AegisLangChainTool(tool, engine=engine, handle_tool_error=handle_tool_error)
+

aegis_kernel/checkers.py

@@ -0,0 +1,275 @@
+import re
+from typing import Any, Dict, List, Optional
+from .types import AegisViolation, ToolCall
+
+PATTERNS = {
+    "CREDIT_CARD": re.compile(r"\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13})\b"),
+    "US_SSN": re.compile(r"\b\d{3}-\d{2}-\d{4}\b"),
+    "OPENAI_API_KEY": re.compile(r"\b(?:sk-ant-api[0-9a-zA-Z_-]{15,}|sk-(?:proj-|live-)?[a-zA-Z0-9_-]{20,})\b"),
+    "GITHUB_TOKEN": re.compile(r"\b(?:ghp|gho|ghu|ghs|ghr)_[a-zA-Z0-9]{20,}\b"),
+    "AWS_ACCESS_KEY": re.compile(r"\bAKIA[0-9A-Z]{16}\b"),
+    "STRIPE_KEY": re.compile(r"\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{20,}\b"),
+    "CREDIT_CARD_CVV": re.compile(r"\b(?:cvv|cvc|cvn|cid)\s*[:=]\s*\d{3,4}\b", re.IGNORECASE),
+    "SENSITIVE_FILE_PATH": re.compile(r"(?:/etc/(?:shadow|passwd|sudoers)|\.ssh/(?:id_rsa|authorized_keys)|\.env(?:\.[a-zA-Z0-9_-]+)?|/proc/self/environ)"),
+    "US_NPI": re.compile(r"\b[12]\d{9}\b"),
+    "US_DEA": re.compile(r"\b[A-Z]{2}\d{7}\b"),
+}
+
+def looks_like_sql(val: str) -> bool:
+    if not isinstance(val, str):
+        return False
+    s = val.lstrip()
+    while s:
+        if s.startswith("--"):
+            idx = s.find("\n")
+            s = "" if idx == -1 else s[idx + 1:].lstrip()
+        elif s.startswith("/*"):
+            idx = s.find("*/")
+            s = "" if idx == -1 else s[idx + 2:].lstrip()
+        else:
+            break
+    return bool(re.match(r"^(?:SELECT|INSERT|UPDATE|DELETE|DROP|TRUNCATE|ALTER|CREATE|EXEC|EXECUTE|WITH)\b", s, re.IGNORECASE))
+
+
+class PythonSqlChecker:
+    @staticmethod
+    def evaluate(rule_id: str, pack_id: str, params: Dict[str, Any], tool_call: ToolCall) -> List[AegisViolation]:
+        violations: List[AegisViolation] = []
+
+        strings: List[str] = []
+        def collect(obj: Any):
+            if isinstance(obj, str):
+                strings.append(obj)
+            elif isinstance(obj, list):
+                for item in obj: collect(item)
+            elif isinstance(obj, dict):
+                for val in obj.values(): collect(val)
+        collect(tool_call.params)
+
+        sql_text = ""
+        for val in strings:
+            if looks_like_sql(val):
+                sql_text = val
+                break
+
+        if not sql_text and strings:
+            for val in strings:
+                if any(kw in val.upper() for kw in ["DELETE", "DROP", "UPDATE", "TRUNCATE", "ALTER"]):
+                    sql_text = val
+                    break
+
+        if not sql_text:
+            return violations
+
+        # Strip string literals before searching for DDL statements (prevents false positives on note='DROP')
+        sql_without_strings = re.sub(r"'[^']*'", "''", sql_text)
+        upper_sql = sql_without_strings.upper()
+
+        # 1. Blocked statements (DROP, TRUNCATE, ALTER)
+        blocked_statements = params.get("block_statements", [])
+        for stmt in blocked_statements:
+            if re.search(rf"\b{stmt}\b", upper_sql):
+                violations.append(AegisViolation(
+                    rule_id=rule_id,
+                    pack_id=pack_id,
+                    severity="critical",
+                    message=f"Destructive SQL statement '{stmt}' is prohibited in production agent workflows.",
+                    suggested_fix=f"Remove prohibited {stmt} statement from query.",
+                ))
+                return violations
+
+        # 2. Required WHERE clause for DELETE/UPDATE
+        statements = params.get("statements", [])
+        require = params.get("require")
+        for stmt in statements:
+            if re.search(rf"\b{stmt}\b", upper_sql):
+                if require == "WHERE_CLAUSE":
+                    where_match = re.search(r"\bWHERE\b\s+(.*)", sql_without_strings, re.IGNORECASE | re.DOTALL)
+                    if not where_match:
+                        violations.append(AegisViolation(
+                            rule_id=rule_id,
+                            pack_id=pack_id,
+                            severity="critical",
+                            message=f"SQL {stmt} statement must include a valid targeted WHERE clause.",
+                            suggested_fix=f"Add a WHERE condition to target specific rows.",
+                        ))
+                    else:
+                        where_clause = where_match.group(1).strip()
+                        # Comprehensive tautology check (1=1, 2>1, true, 1, id>0, id<>-1, IS NOT NULL)
+                        is_tautology = bool(
+                            re.search(r"^\s*(?:1\s*=\s*1|2\s*>\s*1|(\d+)\s*=\s*\1|(\d+)\s*>\s*(\d+)|true|1|'a'\s*=\s*'a')\s*(?:;)?$", where_clause, re.IGNORECASE)
+                            or re.search(r"\bIS\s+NOT\s+NULL\b", where_clause, re.IGNORECASE)
+                            or re.search(r"\b[a-zA-Z_]\w*\s*>\s*0\b", where_clause, re.IGNORECASE)
+                            or re.search(r"\b[a-zA-Z_]\w*\s*(?:<>|!=)\s*-\d+\b", where_clause, re.IGNORECASE)
+                            or re.search(r"\bIN\s*\(\s*SELECT\b", where_clause, re.IGNORECASE)
+                            or re.search(r"\bOR\s+(?:1\s*=\s*1|true|1|\d+\s*>\s*\d+|'[^']+'\s*=\s*'[^']+')", where_clause, re.IGNORECASE)
+                        )
+                        if is_tautology:
+                            violations.append(AegisViolation(
+                                rule_id=rule_id,
+                                pack_id=pack_id,
+                                severity="critical",
+                                message=f"SQL {stmt} contains constant tautology WHERE clause bypassing safety filters.",
+                                suggested_fix="Replace tautology with authentic column filters.",
+                            ))
+
+        return violations
+
+class PythonPiiChecker:
+    @staticmethod
+    def evaluate(rule_id: str, pack_id: str, params: Dict[str, Any], tool_call: ToolCall) -> List[AegisViolation]:
+        violations: List[AegisViolation] = []
+        target_patterns = params.get("patterns", [])
+
+        # Collect all string values recursively
+        strings: List[str] = []
+        def collect(obj: Any):
+            if isinstance(obj, str):
+                strings.append(obj)
+            elif isinstance(obj, list):
+                for item in obj: collect(item)
+            elif isinstance(obj, dict):
+                for val in obj.values(): collect(val)
+        collect(tool_call.params)
+
+        for pat_name in target_patterns:
+            regex = PATTERNS.get(pat_name) or re.compile(pat_name, re.IGNORECASE)
+            for text in strings:
+                if regex.search(text):
+                    violations.append(AegisViolation(
+                        rule_id=rule_id,
+                        pack_id=pack_id,
+                        severity="critical",
+                        message=f"Sensitive pattern '{pat_name}' detected in tool arguments.",
+                        suggested_fix=f"Redact or parameterize sensitive tokens before invoking tool '{tool_call.tool}'.",
+                    ))
+                    break
+
+        return violations
+
+class PythonNumericChecker:
+    @staticmethod
+    def evaluate(rule_id: str, pack_id: str, params: Dict[str, Any], tool_call: ToolCall) -> List[AegisViolation]:
+        violations: List[AegisViolation] = []
+        field_name = params.get("field", "amount")
+        max_val = params.get("max")
+        min_val = params.get("min", 0 if any(k in field_name.lower() for k in ["amount", "price", "cost", "payment", "payout", "transfer"]) else None)
+
+        def parse_number(val: Any) -> Optional[float]:
+            if isinstance(val, (int, float)):
+                return float(val)
+            if isinstance(val, str):
+                cleaned = re.sub(r"[$€£¥₹,]", "", val).strip()
+                try:
+                    return float(cleaned)
+                except ValueError:
+                    return None
+            return None
+
+        val = None
+        # Check direct field
+        if field_name in tool_call.params:
+            val = parse_number(tool_call.params[field_name])
+        
+        # Check semantic aliases (total, value, sum, price, payout, cost)
+        if val is None:
+            aliases = ["amount", "total", "value", "sum", "price", "cost", "payout", "payment", "transfer"]
+            for alias in aliases:
+                for k, v in tool_call.params.items():
+                    if k.lower() == alias:
+                        parsed = parse_number(v)
+                        if parsed is not None:
+                            val = parsed
+                            break
+                if val is not None:
+                    break
+
+        if val is None and "_args" in tool_call.params and isinstance(tool_call.params["_args"], list):
+            for arg in tool_call.params["_args"]:
+                parsed = parse_number(arg)
+                if parsed is not None:
+                    val = parsed
+                    break
+
+        if val is not None:
+            if max_val is not None and val > max_val:
+                violations.append(AegisViolation(
+                    rule_id=rule_id,
+                    pack_id=pack_id,
+                    severity="critical",
+                    message=f"Field '{field_name}' with value {val} exceeds maximum allowed boundary of {max_val}.",
+                    suggested_fix=f"Constrain {field_name} <= {max_val}.",
+                ))
+            if min_val is not None and val < min_val:
+                violations.append(AegisViolation(
+                    rule_id=rule_id,
+                    pack_id=pack_id,
+                    severity="critical",
+                    message=f"Field '{field_name}' with value {val} is below minimum allowed boundary of {min_val}.",
+                    suggested_fix=f"Ensure {field_name} >= {min_val}.",
+                ))
+
+        return violations
+
+class PythonStateChecker:
+    @staticmethod
+    def evaluate(rule_id: str, pack_id: str, params: Dict[str, Any], tool_call: ToolCall, state: Optional[Dict[str, Any]] = None) -> List[AegisViolation]:
+        violations: List[AegisViolation] = []
+        current_state = state or {}
+
+        # 1. Multi-tenant isolation check
+        tenant_field = params.get("tenant_field")
+        if tenant_field:
+            expected_tenant = current_state.get(tenant_field)
+            call_tenant = tool_call.params.get(tenant_field)
+            if expected_tenant is not None and call_tenant is not None and str(expected_tenant) != str(call_tenant):
+                violations.append(AegisViolation(
+                    rule_id=rule_id,
+                    pack_id=pack_id,
+                    severity="critical",
+                    message=f"Cross-tenant parameter mismatch: request tenant '{call_tenant}' != session tenant '{expected_tenant}'.",
+                    suggested_fix="Align request tenant with authenticated session context.",
+                ))
+
+        # 2. Target field state assertion (e.g. order_status != 'cancelled')
+        target_field = params.get("target_field")
+        assertion = params.get("assertion")
+        if target_field and assertion:
+            target_val = tool_call.params.get(target_field)
+            if target_val:
+                order_status = current_state.get("order_status")
+                if order_status == "cancelled" and "cancelled" in assertion:
+                    violations.append(AegisViolation(
+                        rule_id=rule_id,
+                        pack_id=pack_id,
+                        severity="critical",
+                        message=f"Operation on '{target_field}={target_val}' prohibited when state is '{order_status}'.",
+                        suggested_fix="Check entity status before requesting mutation.",
+                    ))
+
+        return violations
+
+class PythonPiiTokenVault:
+    def __init__(self, salt: Optional[str] = None):
+        import secrets
+        self.salt = salt or secrets.token_hex(16)
+        self.vault: Dict[str, str] = {}
+        self.reverse_vault: Dict[str, str] = {}
+
+    def tokenize(self, value: str, token_type: str = "PII") -> str:
+        if value in self.vault:
+            return self.vault[value]
+
+        import hashlib
+        digest = hashlib.sha256(f"{self.salt}:{value}".encode()).hexdigest()[:16]
+        token = f"<AEGIS_{token_type}_{digest}>"
+        self.vault[value] = token
+        self.reverse_vault[token] = value
+        return token
+
+    def detokenize(self, text: str) -> str:
+        result = text
+        for token, original in self.reverse_vault.items():
+            result = result.replace(token, original)
+        return result
+

aegis_kernel/decorator.py

@@ -0,0 +1,63 @@
+import asyncio
+import functools
+from typing import Any, Callable, Optional, List, Dict
+from .engine import AegisEngine
+from .types import ToolCall, AegisVerdict
+
+class AegisBlockedError(Exception):
+    def __init__(self, verdict: AegisVerdict):
+        self.verdict = verdict
+        rule_info = verdict.violations[0].rule_id if verdict.violations else "INVARIANT-POLICY"
+        msg_info = verdict.violations[0].message if verdict.violations else "Security policy constraint violated"
+        msg = f"Aegis Invariant Violation: Tool execution blocked. Rule: {rule_info} - {msg_info}"
+        super().__init__(msg)
+
+def aegis_guard(
+    tool_name: Optional[str] = None,
+    mode: str = "enforce",
+    rules: Optional[List[Dict[str, Any]]] = None,
+    engine: Optional[AegisEngine] = None
+):
+    """
+    Decorator to wrap Python agent tool functions (sync or async coroutines)
+    with sub-2ms deterministic Aegis invariant verification.
+    """
+    active_engine = engine if engine is not None else AegisEngine(mode=mode, rules=rules)
+
+    def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+        actual_name = tool_name or func.__name__
+
+        if asyncio.iscoroutinefunction(func):
+            @functools.wraps(func)
+            async def async_wrapper(*args: Any, **kwargs: Any) -> Any:
+                params = dict(kwargs)
+                if args:
+                    params["_args"] = list(args)
+
+                tool_call = ToolCall(tool=actual_name, params=params)
+                verdict = active_engine.evaluate(tool_call)
+
+                if not verdict.allowed:
+                    raise AegisBlockedError(verdict)
+
+                return await func(*args, **kwargs)
+
+            return async_wrapper
+        else:
+            @functools.wraps(func)
+            def sync_wrapper(*args: Any, **kwargs: Any) -> Any:
+                params = dict(kwargs)
+                if args:
+                    params["_args"] = list(args)
+
+                tool_call = ToolCall(tool=actual_name, params=params)
+                verdict = active_engine.evaluate(tool_call)
+
+                if not verdict.allowed:
+                    raise AegisBlockedError(verdict)
+
+                return func(*args, **kwargs)
+
+            return sync_wrapper
+
+    return decorator

aegis_kernel/engine.py

@@ -0,0 +1,117 @@
+import time
+import hashlib
+import json
+from typing import Any, Dict, List, Optional, Union
+from .types import AegisVerdict, AegisViolation, ToolCall, AegisConfig
+from .checkers import PythonSqlChecker, PythonPiiChecker, PythonNumericChecker, PythonStateChecker, PythonPiiTokenVault
+
+BUILTIN_RULES = [
+    # SQL Guard
+    {
+        "id": "SQL-001",
+        "pack_id": "sql-guard",
+        "type": "sql",
+        "params": {"statements": ["DELETE", "UPDATE"], "require": "WHERE_CLAUSE"}
+    },
+    {
+        "id": "SQL-002",
+        "pack_id": "sql-guard",
+        "type": "sql",
+        "params": {"block_statements": ["DROP", "TRUNCATE", "ALTER"]}
+    },
+    # Finance Guard
+    {
+        "id": "FIN-001",
+        "pack_id": "finance-guard",
+        "type": "numeric",
+        "params": {"field": "amount", "max": 10000}
+    },
+    # Data Guard
+    {
+        "id": "DATA-001",
+        "pack_id": "data-guard",
+        "type": "pii",
+        "params": {"patterns": ["CREDIT_CARD", "US_SSN", "CREDIT_CARD_CVV"]}
+    },
+    {
+        "id": "DATA-002",
+        "pack_id": "data-guard",
+        "type": "pii",
+        "params": {"patterns": ["OPENAI_API_KEY", "GITHUB_TOKEN", "AWS_ACCESS_KEY", "STRIPE_KEY"]}
+    },
+    # SOC 2 & HIPAA
+    {
+        "id": "SOC2-001",
+        "pack_id": "soc2-guard",
+        "type": "pii",
+        "params": {"patterns": ["SENSITIVE_FILE_PATH"]}
+    },
+    {
+        "id": "HIPAA-001",
+        "pack_id": "hipaa-guard",
+        "type": "pii",
+        "params": {"patterns": ["US_NPI", "US_DEA"]}
+    }
+]
+
+class AegisEngine:
+    def __init__(
+        self,
+        config: Optional[Union[AegisConfig, str]] = None,
+        rules: Optional[List[Dict[str, Any]]] = None,
+        mode: str = "enforce",
+        fail_policy: str = "fail-closed",
+        packs: Optional[List[str]] = None,
+    ):
+        if isinstance(config, AegisConfig):
+            self.mode = config.mode
+            self.fail_policy = config.fail_policy
+            self.rules = config.rules or rules or BUILTIN_RULES
+        elif isinstance(config, str):
+            self.mode = config
+            self.fail_policy = fail_policy
+            self.rules = rules or BUILTIN_RULES
+        else:
+            self.mode = mode
+            self.fail_policy = fail_policy
+            self.rules = rules or BUILTIN_RULES
+        self.policy_hash = hashlib.sha256(json.dumps(self.rules, sort_keys=True).encode()).hexdigest()
+
+    def evaluate(self, tool_call: ToolCall, state: Optional[Dict[str, Any]] = None) -> AegisVerdict:
+        start_time = time.perf_counter()
+        violations: List[AegisViolation] = []
+
+        for rule in self.rules:
+            rule_type = rule.get("type")
+            rule_id = rule.get("id", "UNKNOWN")
+            pack_id = rule.get("pack_id", "custom")
+            params = rule.get("params", {})
+
+            if rule_type == "sql" or rule_type == "sql_ast":
+                violations.extend(PythonSqlChecker.evaluate(rule_id, pack_id, params, tool_call))
+            elif rule_type == "pii" or rule_type == "regex":
+                violations.extend(PythonPiiChecker.evaluate(rule_id, pack_id, params, tool_call))
+            elif rule_type == "numeric":
+                violations.extend(PythonNumericChecker.evaluate(rule_id, pack_id, params, tool_call))
+            elif rule_type == "state" or rule_type == "state_invariant":
+                violations.extend(PythonStateChecker.evaluate(rule_id, pack_id, params, tool_call, state))
+
+        latency_ms = (time.perf_counter() - start_time) * 1000.0
+
+        # Cryptographic proof hash
+        proof_payload = f"{tool_call.tool}:{json.dumps(tool_call.params, sort_keys=True)}:{self.policy_hash}"
+        proof_hash = hashlib.sha256(proof_payload.encode()).hexdigest()
+
+        is_allowed = len(violations) == 0 or self.mode == "shadow"
+        verdict_str = "ALLOWED" if is_allowed else "BLOCKED"
+        suggested_fix = violations[0].suggested_fix if violations else None
+
+        return AegisVerdict(
+            allowed=is_allowed,
+            verdict=verdict_str,
+            violations=violations,
+            latency_ms=round(latency_ms, 3),
+            proof_hash=proof_hash,
+            policy_commitment_hash=self.policy_hash,
+            suggested_fix=suggested_fix,
+        )

aegis_kernel/types.py

@@ -0,0 +1,36 @@
+from dataclasses import dataclass, field
+from typing import Any, Dict, List, Optional, Literal
+
+@dataclass
+class AegisViolation:
+    rule_id: str
+    pack_id: str
+    severity: Literal["critical", "warning", "info"]
+    message: str
+    suggested_fix: Optional[str] = None
+    context: Dict[str, Any] = field(default_factory=dict)
+
+@dataclass
+class AegisVerdict:
+    allowed: bool
+    verdict: Literal["ALLOWED", "BLOCKED"]
+    violations: List[AegisViolation] = field(default_factory=list)
+    latency_ms: float = 0.0
+    proof_hash: str = ""
+    policy_commitment_hash: str = ""
+    suggested_fix: Optional[str] = None
+
+    @property
+    def valid(self) -> bool:
+        return self.allowed
+
+@dataclass
+class AegisConfig:
+    mode: Literal["enforce", "monitor", "simulate"] = "enforce"
+    fail_policy: Literal["fail-closed", "fail-open"] = "fail-closed"
+    rules: Optional[List[Dict[str, Any]]] = None
+
+@dataclass
+class ToolCall:
+    tool: str
+    params: Dict[str, Any]

aegis_kernel-1.0.0.dist-info/METADATA

@@ -0,0 +1,69 @@
+Metadata-Version: 2.4
+Name: aegis-kernel
+Version: 1.0.0
+Summary: Aegis Invariant Kernel: Deterministic Tool-Call Safety Clearance Gateway for AI Agents
+Author-email: Sneh Gabani <sneh@aegis-kernel.dev>
+License-Expression: MIT
+Project-URL: Homepage, https://aegis-kernel.dev
+Project-URL: Repository, https://github.com/Snehgabani/aegis-kernel
+Keywords: ai-safety,agentic-ai,langchain,crewai,autogen,mcp,security,invariants
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# Aegis Invariant Kernel for Python
+
+> **Deterministic Tool-Call Safety Gateway for Autonomous AI Agents**  
+> *Sub-0.1ms Latency • Zero External Dependencies • Zero Network Egress*
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![Python](https://img.shields.io/badge/Python-3.9%2B-blue.svg)](https://pypi.org/project/aegis-kernel/)
+[![Tests](https://img.shields.io/badge/tests-11%2F11%20passing-brightgreen.svg)](#)
+
+---
+
+## 🚀 Installation
+
+```bash
+pip install aegis-kernel
+```
+
+---
+
+## ⚡ Quickstart
+
+### Protect Database Tools
+```python
+from aegis_kernel import aegis_guard
+
+@aegis_guard(tool_name="database_exec")
+def execute_sql(query: str):
+    # Automatically blocks destructive SQL (DELETE without WHERE, DROP TABLE, etc.)
+    return db.execute(query)
+```
+
+### Protect Financial & Payout Operations
+```python
+from aegis_kernel import aegis_guard
+
+@aegis_guard(tool_name="payout_tool")
+def transfer_funds(amount: float, recipient_id: str):
+    # Automatically blocks transactions exceeding numeric risk limits
+    return payment_gateway.transfer(amount, recipient_id)
+```
+
+### CrewAI & AutoGen Integration
+```python
+from aegis_kernel import AegisCrewAITool
+
+safe_tool = AegisCrewAITool(my_existing_tool)
+```
+
+---
+
+## 📄 License
+
+Distributed under the [MIT License](https://opensource.org/licenses/MIT). Copyright (c) 2026 Sneh Gabani.

aegis_kernel-1.0.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+aegis_kernel/__init__.py,sha256=zRN-_PRODWy3dyMY-0dU93l1tdEkc_2GM1_LbJ87ARc,779
+aegis_kernel/adapters.py,sha256=nmdkeNjZBcSsrfB7JmfK_7AWVGXHSiKuCiJ1xv2MJVI,7113
+aegis_kernel/checkers.py,sha256=4fSFWWBDQLrwusF_nz-LqP7AEJPeZxmMdGBhyaZDdWQ,12542
+aegis_kernel/decorator.py,sha256=oGi2UCeQUKeAsb7pBI9rrvT6RoZS8XkM9HxA554XWew,2279
+aegis_kernel/engine.py,sha256=i9J7JdgjixnvxKwtvHOhpMV6l6nHjr1qmkQumjpf5f4,4263
+aegis_kernel/types.py,sha256=wndUGJPdK0nzQvZUjftOUZPYprsnFVjlPKF5XPYPO1Q,975
+aegis_kernel-1.0.0.dist-info/licenses/LICENSE,sha256=xQ647HwFJ1R_qJcAGazYfzfZShHLlxqvBaTFXp3SQds,1068
+aegis_kernel-1.0.0.dist-info/METADATA,sha256=Wv1x5gBkZLdp_jYiy9FWKdFlaQ4eSRJXBjVSNtzAZsg,2038
+aegis_kernel-1.0.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+aegis_kernel-1.0.0.dist-info/top_level.txt,sha256=2venPfy9skeieBu3sTkwnbaZITjcmM0LMQdzU8rx0C0,13
+aegis_kernel-1.0.0.dist-info/RECORD,,

aegis_kernel-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

aegis_kernel-1.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sneh Gabani
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

aegis_kernel-1.0.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+aegis_kernel