aramid 0.2.0__py3-none-any.whl

aramid/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.2.0"

aramid/__main__.py

@@ -0,0 +1,3 @@
+import sys
+from aramid.cli import main
+sys.exit(main())

aramid/autolearn.py

@@ -0,0 +1,313 @@
+"""autolearn -- the learned model-selection engine (spec
+2026-07-18-aramid-autolearn-model-selection-design.md): feature bucketing,
+Beta-posterior math, the escalate-only Thompson UPLIFT decision, cascade
+trigger rules, audit sampling, the machine-global state file, and the
+ledger->state rollup. Pure computation except the two explicit state I/O
+functions; provider calls and drain wiring live in consumers.llm_review
+and commands.drain.
+
+Terminology: the learned tier-raise is an UPLIFT -- "escalation" already
+means policy.escalate_degraded's gate-exit behavior and is never used for
+arm selection.
+
+Fail-open contract (spec section 11): consumers wrap every call here in
+try/except; load_state additionally degrades any unreadable or
+foreign-version state to empty_state(). Cold start == shipped deterministic
+ladder: with no data a zero-evidence cell uses the deterministic prior mean
+1/(1+PRIOR_CLEAN) = 0.10, under the 0.15 default threshold, so the floor
+qualifies and no uplift happens -- exactly, not just in expectation (spec
+section 3.2).
+"""
+import hashlib
+import json
+import os
+import random
+from pathlib import Path
+
+from aramid import review as review_mod
+from aramid.models import EventType
+
+STATE_VERSION = 1
+# Trust-the-ladder prior (spec section 8.2): Beta(1, PRIOR_CLEAN) keeps the
+# no-data mean at 0.10 <= the 0.15 default threshold -- absence of evidence
+# reproduces the deterministic ladder exactly.
+PRIOR_CLEAN = 9
+
+
+# --- state ------------------------------------------------------------------
+
+def state_path() -> Path:
+    """Seam for tests -- monkeypatch this rather than touching the real
+    ~/.aramid (mirrors spend.spend_path / registry.registry_path)."""
+    return Path.home() / ".aramid" / "autolearn_state.json"
+
+
+def empty_state() -> dict:
+    return {"version": STATE_VERSION, "updated_at": "", "cursors": {},
+            "posteriors": {},
+            "shadow": {"decisions": 0, "would_uplift": 0},
+            "audits": {"performed": 0, "missed_criticals": 0}}
+
+
+def load_state(path: Path | None = None) -> dict:
+    """Unreadable, malformed, or foreign-version state degrades to
+    empty_state() -- cold start, never a crash (spec section 11)."""
+    p = path if path is not None else state_path()
+    try:
+        data = json.loads(p.read_text(encoding="utf-8"))
+    except Exception:
+        return empty_state()
+    if not isinstance(data, dict) or data.get("version") != STATE_VERSION:
+        return empty_state()
+    out = empty_state()
+    for key, default in list(out.items()):
+        val = data.get(key, default)
+        out[key] = val if isinstance(val, type(default)) else default
+    return out
+
+
+def save_state(state: dict, now_iso: str, path: Path | None = None) -> None:
+    """Atomic write (tmp + os.replace): a torn write can never corrupt the
+    previous state (spec section 11)."""
+    p = path if path is not None else state_path()
+    p.parent.mkdir(parents=True, exist_ok=True)
+    payload = {**state, "updated_at": now_iso}
+    tmp = p.with_name(p.name + ".tmp")
+    tmp.write_text(json.dumps(payload, indent=1), encoding="utf-8")
+    os.replace(tmp, p)
+
+
+# --- features ---------------------------------------------------------------
+
+def bucket_for(reasons) -> str:
+    """Coarse feature bucket (spec section 8.1): 'sec' iff any triage reason
+    names a security signal, else 'plain'. Deliberately 2-valued -- ~18
+    reviews/day cannot support finer cells."""
+    for r in reasons:
+        if "security-path" in r or "risky-content" in r:
+            return "sec"
+    return "plain"
+
+
+def posterior_key(arm, band: str, bucket: str) -> str:
+    return f"{arm.provider}/{arm.model}|{band}|{bucket}"
+
+
+def _counts(state: dict, key: str) -> dict:
+    rec = state.get("posteriors", {}).get(key)
+    return rec if isinstance(rec, dict) else {}
+
+
+# --- uplift decision --------------------------------------------------------
+
+def decision_rng(item_id: str, state: dict) -> random.Random:
+    """Deterministic per-(item, state-generation) RNG (spec section 8.2):
+    reproducible in tests, varies across state updates in production."""
+    seed = hashlib.sha256(
+        f"{item_id}|{state.get('updated_at', '')}".encode()).hexdigest()
+    # S311 justification: non-cryptographic is the REQUIREMENT here, not a
+    # compromise. This RNG picks which arm to explore; it is seeded from a
+    # sha256 of (item_id, updated_at) precisely so the choice is reproducible
+    # in tests and re-derivable from state. A cryptographic generator would
+    # destroy the determinism the spec asks for, and nothing here is a secret.
+    return random.Random(int(seed, 16))  # noqa: S311
+
+
+def uplift_pick(arms, score: int, bucket: str, state: dict,
+                threshold: float, rng: random.Random):
+    """Escalate-only Thompson decision (spec section 8.2). Walk arms from
+    the deterministic floor upward; for each, sample its miss-probability
+    q ~ Beta(1+misses, PRIOR_CLEAN+clean) -- except a cell with ZERO
+    evidence (misses + clean == 0), which uses the deterministic prior mean
+    1/(1+PRIOR_CLEAN) instead of sampling, so empty posteriors reproduce
+    today's ladder exactly rather than in expectation (spec section 3.2).
+    Serve the lowest arm with q <= threshold. The top arm always qualifies
+    (it is the measuring ceiling). Returns (arm, floor_q) where floor_q is
+    the q for the floor arm -- the number that explains the decision -- or
+    None when there are no arms."""
+    tgt = review_mod.target_arm(arms, score)
+    if tgt is None:
+        return None
+    band = tgt.tier
+    ladder_up = [a for a in arms if a.min_score >= tgt.min_score]
+    floor_q = None
+    for a in ladder_up[:-1]:
+        c = _counts(state, posterior_key(a, band, bucket))
+        n_evidence = int(c.get("misses", 0)) + int(c.get("clean", 0))
+        if n_evidence == 0:
+            # Zero-evidence cell: deterministic prior mean (spec section 3.2
+            # -- cold start must reproduce the ladder EXACTLY, not just in
+            # expectation; Thompson sampling begins once audit evidence
+            # exists).
+            q = 1.0 / (1.0 + PRIOR_CLEAN)
+        else:
+            q = rng.betavariate(1 + int(c.get("misses", 0)),
+                                PRIOR_CLEAN + int(c.get("clean", 0)))
+        if floor_q is None:
+            floor_q = q
+        if q <= threshold:
+            return a, floor_q
+    return ladder_up[-1], (floor_q if floor_q is not None else 0.0)
+
+
+def next_arm_above(arms, served_arm):
+    """The next-higher tier for a cascade re-review, or None at the top."""
+    for a in arms:
+        if a.min_score > served_arm.min_score:
+            return a
+    return None
+
+
+# --- audit sampling ---------------------------------------------------------
+
+def audit_arm(arms, available: set[str]):
+    """The audit reviewer (spec section 10): the highest-min_score available
+    arm, or None when nothing is available."""
+    avail = [a for a in arms if a.provider in available]
+    return avail[-1] if avail else None
+
+
+def should_audit(item_id: str, served_arm, arms, audit_every: int) -> bool:
+    """Deterministic 1-in-N sampling (spec section 10): hash the item id --
+    no RNG state, reproducible in tests. Only items served BELOW the top
+    arm are auditable (self-audit measures nothing)."""
+    if audit_every <= 0 or not arms:
+        return False
+    if served_arm.min_score >= arms[-1].min_score:
+        return False
+    digest = int(hashlib.sha256(item_id.encode()).hexdigest(), 16)
+    return digest % audit_every == 0
+
+
+def _fid(cand: dict) -> str | None:
+    try:
+        return review_mod.llm_fingerprint(
+            f"llm/{cand['owasp']}", cand["file"], cand["line_content"])
+    except (KeyError, TypeError):
+        return None
+
+
+def audit_diff(served_verified: list, audit_verified: list) -> tuple[int, int]:
+    """(new_findings, missed_criticals): audit candidates whose fingerprint
+    the served review did not produce (spec section 10). Malformed
+    candidates are skipped, never counted."""
+    served = {f for f in (_fid(c) for c in served_verified) if f}
+    new_findings = 0
+    missed_criticals = 0
+    for c in audit_verified:
+        fid = _fid(c)
+        if fid is None or fid in served:
+            continue
+        new_findings += 1
+        if c.get("severity") == "critical":
+            missed_criticals += 1
+    return new_findings, missed_criticals
+
+
+# --- cascade ----------------------------------------------------------------
+
+def cascade_trigger(served_arm, arms, verified: list, rejected: int,
+                    truncated: bool, halluc_min: int) -> str | None:
+    """Deterministic danger signs after the served review (spec section 9).
+    Returns 'critical' | 'hallucination' | 'truncated' or None. Never fires
+    for a top-tier review."""
+    if not arms or served_arm.min_score >= arms[-1].min_score:
+        return None
+    if any(c.get("severity") == "critical" for c in verified):
+        return "critical"
+    if rejected >= halluc_min:
+        return "hallucination"
+    if truncated:
+        return "truncated"
+    return None
+
+
+# --- reward rollup ----------------------------------------------------------
+
+def rollup(state: dict, events: list, repo_key: str) -> dict:
+    """Fold ledger events past this repo's cursor into posterior counts
+    (spec section 8.3). Pure: returns a NEW state dict; the caller saves.
+    The cursor is an event COUNT (the ledger is append-only and
+    seq-ordered), so replaying the same list twice is a no-op; a shorter
+    list than the cursor (rebuilt/compacted ledger) SKIPS the fold (a
+    correct rebuild is cross-repo -- run `aramid autolearn --rebuild`).
+
+    Primary reward: audit outcomes -> misses/clean on the SERVED arm's
+    (band, bucket) cell. Secondary counters (halluc/malformed/refuted/
+    survived/overridden) are recorded for reporting but NOT read by
+    uplift_pick (spec section 8.3)."""
+    out = json.loads(json.dumps(state))     # deep copy; state is JSON-shaped
+    cursor = int(out.get("cursors", {}).get(repo_key, 0))
+    if cursor > len(events):
+        # Shrunk/compacted ledger: a correct rebuild is CROSS-REPO (posteriors
+        # aggregate across every registered repo, keyed by arm-cell), so a
+        # single per-repo rollup cannot re-fold without double-counting the
+        # surviving events onto posteriors that already include them. Skip the
+        # fold (leave the cursor as-is); correct counts after a compaction
+        # require a global `aramid autolearn --rebuild`. (Was: cursor=0 then
+        # re-fold -> posterior double-count.)
+        return out
+
+    # Join maps from the FULL stream (a finding's detect event may precede
+    # the cursor): llm finding -> its drain run_id -> the served-arm cell.
+    run_key: dict[str, str] = {}
+    fid_run: dict[str, str] = {}
+    for e in events:
+        if e.type is EventType.CONSUMER_RUN_FINISHED:
+            sel = e.payload.get("selection")
+            if isinstance(sel, dict):
+                served = sel.get("served") or {}
+                band, bucket = sel.get("target_tier"), sel.get("bucket")
+                if served.get("provider") and band and bucket:
+                    run_key[e.run_id] = (f"{served['provider']}/"
+                                         f"{served.get('model', '')}"
+                                         f"|{band}|{bucket}")
+        elif (e.type is EventType.FINDING_DETECTED
+              and e.payload.get("source") == "llm" and e.finding_id):
+            fid_run[e.finding_id] = e.run_id
+
+    posts = out.setdefault("posteriors", {})
+
+    def bump(key: str | None, field: str, n: int = 1) -> None:
+        if not key or n <= 0:
+            return
+        rec = posts.setdefault(key, {"misses": 0, "clean": 0, "halluc": 0,
+                                     "malformed": 0, "refuted": 0,
+                                     "survived": 0, "overridden": 0})
+        rec[field] = int(rec.get(field, 0)) + n
+
+    for e in events[cursor:]:
+        if e.type is EventType.CONSUMER_RUN_FINISHED:
+            sel = e.payload.get("selection")
+            if not isinstance(sel, dict):
+                continue
+            key = run_key.get(e.run_id)
+            audit = sel.get("audit")
+            if isinstance(audit, dict) and audit.get("performed"):
+                out["audits"]["performed"] += 1
+                missed = int(audit.get("missed_criticals", 0))
+                out["audits"]["missed_criticals"] += missed
+                if missed:
+                    bump(key, "misses", missed)
+                else:
+                    bump(key, "clean")
+            bump(key, "halluc", int(sel.get("hallucination_rejected", 0)))
+            if sel.get("malformed"):
+                bump(key, "malformed")
+            for r in sel.get("refutes") or []:
+                if not isinstance(r, dict):
+                    continue
+                if r.get("outcome") == "refuted":
+                    bump(key, "refuted")
+                elif r.get("outcome") == "survived":
+                    bump(key, "survived")
+            up = sel.get("uplift")
+            if isinstance(up, dict) and up.get("mode") == "shadow":
+                out["shadow"]["decisions"] += 1
+                if up.get("pick") and up.get("pick") != sel.get("target_tier"):
+                    out["shadow"]["would_uplift"] += 1
+        elif e.type is EventType.FINDING_OVERRIDDEN and e.finding_id in fid_run:
+            bump(run_key.get(fid_run[e.finding_id]), "overridden")
+
+    out.setdefault("cursors", {})[repo_key] = len(events)
+    return out

aramid/cli.py

@@ -0,0 +1,264 @@
+"""cli -- top-level argparse dispatch tree. Each subcommand maps 1:1 to a
+`aramid.commands.<name>.cmd_<name>` function; this module's only job is
+argv parsing and translating parsed args into that function's positional/
+keyword arguments, then returning its int exit code unchanged.
+
+Any argparse parse failure -- unknown subcommand, missing required
+argument, bad flag -- normally raises `SystemExit(2)`; that is intercepted
+here and remapped to exit code 3 (design doc section 3's "engine or config
+error" tier), so `python -m aramid bogus-command` and a genuinely crashed
+engine report the same code, never a bare argparse 2. `-h`/`--help`
+(`SystemExit(0)`) and `--version` are the only paths that exit 0 without
+dispatching to a subcommand.
+"""
+import argparse
+import sys
+from pathlib import Path
+
+from aramid import __version__
+from aramid.commands.autolearn_cmd import cmd_autolearn
+from aramid.commands.arm import cmd_arm
+from aramid.commands.check import cmd_check
+from aramid.commands.doctor import cmd_doctor
+from aramid.commands.drain import cmd_drain
+from aramid.commands.init import cmd_init
+from aramid.commands.ledger_cmd import (
+    cmd_ledger_filter,
+    cmd_ledger_list,
+    cmd_ledger_mark_not_a_secret,
+    cmd_ledger_mark_rotated,
+    cmd_ledger_mark_unreachable,
+    cmd_ledger_show,
+)
+from aramid.commands.mutation_score import cmd_mutation_score
+from aramid.commands.override import cmd_override
+from aramid.commands.pack_cmd import cmd_pack_add, cmd_pack_compile, cmd_pack_list
+from aramid.commands.rebaseline import cmd_rebaseline
+from aramid.commands.schedule import cmd_schedule
+from aramid.commands.status import cmd_status
+from aramid.commands.triage_cmd import cmd_triage
+from aramid.commands.uninstall import cmd_uninstall
+from aramid.commands.update_rules import cmd_update_rules
+from aramid.models import Gate
+
+
+def build_parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(prog="aramid")
+    p.add_argument("--version", action="store_true")
+    sub = p.add_subparsers(dest="command")
+
+    p_init = sub.add_parser("init", help="onboard a repo (write config, install hooks, baseline)")
+    p_init.add_argument("path", nargs="?", default=".")
+    p_init.add_argument("--discover", action="store_true")
+
+    p_check = sub.add_parser("check", help="run the gate pipeline")
+    p_check.add_argument("--gate", choices=["pre-commit", "pre-push"], default="pre-commit")
+    mode = p_check.add_mutually_exclusive_group()
+    mode.add_argument("--staged", action="store_true")
+    mode.add_argument("--range", action="store_true")
+    mode.add_argument("--all", action="store_true")
+    p_check.add_argument("--strict", action="store_true", help="CI mode: treat 2/3 as failure")
+    p_check.add_argument("--json", action="store_true")
+    p_check.add_argument("--accept-degraded", action="store_true")
+    p_check.add_argument("--reason", default=None)
+
+    p_doctor = sub.add_parser("doctor", help="probe/repair the toolchain")
+    p_doctor.add_argument("--fix", action="store_true")
+
+    sub.add_parser("status", help="report ledger/config state")
+
+    p_ms = sub.add_parser("mutation-score",
+                          help="advisory per-function mutation-score + regression report")
+    p_ms.add_argument("--json", action="store_true")
+
+    p_triage = sub.add_parser("triage", help="score a commit (or range) and enqueue if risky")
+    p_triage.add_argument("rev", nargs="?", default="HEAD")
+    p_triage.add_argument("--budget", type=float, default=None,
+                          help="wall-clock watchdog in seconds; on expiry triage "
+                               "self-kills with exit 3 (used by the post-commit shim)")
+
+    p_drain = sub.add_parser("drain", help="sweep registered repos, pop queued items, consume")
+    drain_scope = p_drain.add_mutually_exclusive_group()
+    drain_scope.add_argument("--all", action="store_true", help="drain every registered repo")
+    drain_scope.add_argument("--repo", default=None, help="drain a single repo (default: .)")
+    p_drain.add_argument("--dry-run", action="store_true")
+    p_drain.add_argument("--max-items", type=int, default=None)
+
+    p_ledger = sub.add_parser("ledger", help="query the findings ledger")
+    ledger_sub = p_ledger.add_subparsers(dest="ledger_command")
+    ledger_sub.add_parser("list")
+    p_show = ledger_sub.add_parser("show")
+    p_show.add_argument("id")
+    p_filter = ledger_sub.add_parser("filter")
+    p_filter.add_argument("--tool")
+    p_filter.add_argument("--rule")
+    p_filter.add_argument("--status")
+    p_filter.add_argument("--severity")
+    p_rotated = ledger_sub.add_parser("mark-rotated")
+    p_rotated.add_argument("id")
+    p_rotated.add_argument("--reason", required=True)
+    p_nas = ledger_sub.add_parser("mark-not-a-secret")
+    p_nas.add_argument("id")
+    p_nas.add_argument("--reason", required=True)
+    p_unreachable = ledger_sub.add_parser("mark-unreachable")
+    p_unreachable.add_argument("id")
+    p_unreachable.add_argument("--reason", required=True)
+
+    p_override = sub.add_parser("override", help="suppress a WARN finding (ledger-logged)")
+    p_override.add_argument("id")
+    p_override.add_argument("--reason", required=True)
+
+    p_pack = sub.add_parser("pack", help="manage the regression attack pack")
+    pack_sub = p_pack.add_subparsers(dest="pack_command")
+    pack_sub.add_parser("list")
+    p_pack_add = pack_sub.add_parser("add")
+    p_pack_add.add_argument("id")
+    pack_sub.add_parser("compile")
+
+    p_autolearn = sub.add_parser("autolearn",
+                                 help="learned model-selection report (--rebuild: replay registry ledgers)")
+    p_autolearn.add_argument("--rebuild", action="store_true")
+
+    p_arm = sub.add_parser("arm", help="end a WARN-only bake (semgrep default, --llm for the LLM reviewer, --autolearn for learned uplift, --tdd for code-without-test findings, --mutation for surviving-mutant findings, --mutation-score for score-regression transitions, --red-proof for never-red test findings)")
+    arm_which = p_arm.add_mutually_exclusive_group()
+    arm_which.add_argument("--llm", action="store_true")
+    arm_which.add_argument("--autolearn", action="store_true")
+    arm_which.add_argument("--tdd", action="store_true")
+    arm_which.add_argument("--mutation", action="store_true")
+    arm_which.add_argument("--mutation-score", action="store_true")
+    arm_which.add_argument("--red-proof", action="store_true")
+    sub.add_parser("update-rules", help="refresh the vendored semgrep ruleset")
+
+    p_uninstall = sub.add_parser("uninstall", help="reverse init")
+    p_uninstall.add_argument("path", nargs="?", default=".")
+
+    p_schedule = sub.add_parser("schedule", help="register/remove/query the Windows Task Scheduler drain job")
+    p_schedule.add_argument("action", choices=["install", "remove", "status"])
+
+    p_hooks = sub.add_parser("hooks",
+                             help="manage the machine-wide git hook template (seeds NEW clones/inits; "
+                                  "the shims no-op in repos without an aramid.toml)")
+    p_hooks.add_argument("action", choices=["install", "remove", "status"])
+
+    p_rebaseline = sub.add_parser("rebaseline",
+                                  help="re-snapshot current findings as the ratchet baseline (after a fingerprint-affecting upgrade)")
+    p_rebaseline.add_argument("path", nargs="?", default=".")
+    p_rebaseline.add_argument("--yes", action="store_true",
+                              help="required: confirms discarding current ratchet grandfathering")
+
+    return p
+
+
+def _check_mode(args: argparse.Namespace) -> str:
+    if args.all:
+        return "all"
+    if args.range:
+        return "range"
+    if args.staged:
+        return "staged"
+    return "staged" if args.gate == "pre-commit" else "range"
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser()
+    try:
+        args = parser.parse_args(argv)
+    except SystemExit as exc:
+        code = exc.code if isinstance(exc.code, int) else 1
+        return 0 if code == 0 else 3
+
+    if args.version:
+        print(f"aramid {__version__}")
+        return 0
+
+    if args.command is None:
+        print("aramid: no command", file=sys.stderr)
+        return 3
+
+    root = Path.cwd()
+
+    if args.command == "init":
+        return cmd_init(Path(args.path), discover=args.discover)
+
+    if args.command == "check":
+        gate = Gate(args.gate)
+        accept_degraded = (args.reason or "no reason given") if args.accept_degraded else None
+        return cmd_check(root, gate, _check_mode(args), strict=args.strict,
+                          as_json=args.json, accept_degraded=accept_degraded)
+
+    if args.command == "doctor":
+        return cmd_doctor(root, fix=args.fix)
+
+    if args.command == "status":
+        return cmd_status(root)
+
+    if args.command == "mutation-score":
+        return cmd_mutation_score(root, as_json=args.json)
+
+    if args.command == "triage":
+        return cmd_triage(root, args.rev, budget=args.budget)
+
+    if args.command == "drain":
+        targets = [] if args.all else ([args.repo] if args.repo else [str(root)])
+        return cmd_drain(targets, dry_run=args.dry_run, max_items=args.max_items)
+
+    if args.command == "ledger":
+        if args.ledger_command == "list":
+            return cmd_ledger_list(root)
+        if args.ledger_command == "show":
+            return cmd_ledger_show(root, args.id)
+        if args.ledger_command == "filter":
+            return cmd_ledger_filter(root, tool=args.tool, rule=args.rule,
+                                      status=args.status, severity=args.severity)
+        if args.ledger_command == "mark-rotated":
+            return cmd_ledger_mark_rotated(root, args.id, args.reason)
+        if args.ledger_command == "mark-not-a-secret":
+            return cmd_ledger_mark_not_a_secret(root, args.id, args.reason)
+        if args.ledger_command == "mark-unreachable":
+            return cmd_ledger_mark_unreachable(root, args.id, args.reason)
+        print("aramid: ledger: a subcommand is required "
+              "(list|show|filter|mark-rotated|mark-not-a-secret|mark-unreachable)",
+              file=sys.stderr)
+        return 3
+
+    if args.command == "override":
+        return cmd_override(root, args.id, args.reason)
+
+    if args.command == "pack":
+        if args.pack_command == "list":
+            return cmd_pack_list(root)
+        if args.pack_command == "add":
+            return cmd_pack_add(root, args.id)
+        if args.pack_command == "compile":
+            return cmd_pack_compile(root)
+        print("aramid: pack: a subcommand is required (list|add|compile)",
+              file=sys.stderr)
+        return 3
+
+    if args.command == "autolearn":
+        return cmd_autolearn(root, rebuild=args.rebuild)
+
+    if args.command == "arm":
+        return cmd_arm(root, llm=args.llm, autolearn=args.autolearn,
+                       tdd=args.tdd, mutation=args.mutation,
+                       mutation_score=args.mutation_score,
+                       red_proof=args.red_proof)
+
+    if args.command == "update-rules":
+        return cmd_update_rules(root)
+
+    if args.command == "uninstall":
+        return cmd_uninstall(Path(args.path))
+
+    if args.command == "schedule":
+        return cmd_schedule(root, args.action)
+
+    if args.command == "hooks":
+        from aramid.commands.hooks_template import cmd_hooks
+        return cmd_hooks(args.action)
+
+    if args.command == "rebaseline":
+        return cmd_rebaseline(Path(args.path), yes=args.yes)
+
+    print(f"aramid: unknown command: {args.command}", file=sys.stderr)
+    return 3