argus-cloud-optimizer 0.4.0__tar.gz → 0.5.0__tar.gz

{argus_cloud_optimizer-0.4.0 → argus_cloud_optimizer-0.5.0}/.env.example

@@ -68,6 +68,33 @@ REPORT_FORMAT=json,html                     # comma-separated: json, html, pdf,
 # Useful for local testing without a real webhook.
 DRY_RUN=false
 
+# -----------------------------------------------------------------------------
+# Remediation — Policy Engine + Jira Integration
+# Policies are YAML files in ARGUS_POLICIES_DIR. Argus never executes changes;
+# it creates Jira tickets for human review. See config/policies/ for examples
+# and CONTRIBUTING.md for how to write policies.
+# -----------------------------------------------------------------------------
+ARGUS_POLICIES_DIR=./config/policies        # directory containing policy YAML files
+
+# Jira credentials — required for `argus policies apply --confirm`
+# Create an API token at: https://id.atlassian.com/manage-profile/security/api-tokens
+JIRA_BASE_URL=https://your-org.atlassian.net
+JIRA_USER_EMAIL=bot@your-org.com
+JIRA_API_TOKEN=                             # Atlassian API token (not your password)
+
+# Directory containing your *.yaml policy files (one policy per file).
+# Copy from config/policies.example/ to get started, then customise.
+ARGUS_POLICY_DIR=./config/policies
+
+# Path to integrations config (project key, labels, priority map).
+# Copy config/integrations.yaml.example → config/integrations.yaml and fill in.
+# config/integrations.yaml is gitignored — never commit credentials.
+ARGUS_INTEGRATIONS_CONFIG=./config/integrations.yaml
+
+# Audit log — every `apply --confirm` appends one JSONL line mapping
+# proposal_id → jira_key → jira_url for traceability.
+ARGUS_AUDIT_LOG=./local_reports/audit.jsonl
+
 # -----------------------------------------------------------------------------
 # Logging
 # -----------------------------------------------------------------------------

{argus_cloud_optimizer-0.4.0/argus_cloud_optimizer.egg-info → argus_cloud_optimizer-0.5.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: argus-cloud-optimizer
-Version: 0.4.0
-Summary: AI-powered multi-cloud cost optimization agent
+Version: 0.5.0
+Summary: Argus — AI Cloud Detective for AWS, GCP, and Azure
 Author-email: Vamshi Siddarth Gaddam <vamshisiddarth02@gmail.com>
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/vamshisiddarth/argus
@@ -59,15 +59,16 @@ Requires-Dist: types-python-dateutil>=2.9.0; extra == "dev"
 Requires-Dist: boto3-stubs[bedrock-runtime,ce,cloudwatch,resourceexplorer2,s3,sts]>=1.35.36; extra == "dev"
 Requires-Dist: mkdocs-material>=9.5.44; extra == "dev"
 Requires-Dist: mkdocs-minify-plugin>=0.8.0; extra == "dev"
+Requires-Dist: mike>=2.1.0; extra == "dev"
 Dynamic: license-file
 
 <p align="center">
-  <img src="docs/assets/images/logo-full.svg" alt="Argus" height="72">
+  <img src="docs/assets/images/logo.svg" alt="Argus" height="72">
 </p>
 
-<p align="center"><strong>AI-powered cloud cost optimization agent for AWS, GCP, and Azure.</strong></p>
+<p align="center"><strong>Argus — AI Cloud Detective for AWS, GCP, and Azure.</strong></p>
 
-Argus finds idle and wasted cloud resources — stopped EC2 instances, unattached EBS volumes, orphaned Elastic IPs, underutilized RDS databases — and delivers a prioritized, AI-reasoned report to Slack every week.
+Argus is an open-source AI Cloud Detective — it hunts idle and wasted cloud resources across AWS, GCP, and Azure (stopped EC2 instances, unattached EBS volumes, orphaned Elastic IPs, underutilized RDS databases) and delivers a prioritized, AI-reasoned report to Slack every week. No rules. No thresholds. Just reasoning.
 
 [![CI](https://github.com/vamshisiddarth/argus/actions/workflows/ci.yml/badge.svg)](https://github.com/vamshisiddarth/argus/actions/workflows/ci.yml)
 [![Publish](https://github.com/vamshisiddarth/argus/actions/workflows/publish.yml/badge.svg)](https://github.com/vamshisiddarth/argus/actions/workflows/publish.yml)
@@ -100,6 +101,21 @@ Top findings
 
 ---
 
+## 🆕 What's new in v0.5.0
+
+> **Remediation is now first-class.** Argus goes beyond reporting — it generates Jira tickets, suggests exact resize targets, and tracks acceptance rates.
+
+- **Policy engine** — YAML-driven policies match AI findings and generate prioritised `ChangeProposal` objects (weight-ordered, one proposal per resource per scan). Ships with 13 real-world policies across AWS, GCP, and Azure.
+- **Jira integration** — idempotent ticket creation with ADF-structured descriptions (metrics table, runbook code block, snapshot fingerprint for diff-on-update). Dedup via deterministic label; diff-comment on re-scan.
+- **Rightsizing recommendations** — `resize` and `reduce_nodes` proposals now include a specific target tier or node count derived from observed CPU% (e.g., "Recommend db.t3.small — observed CPU ~8%").
+- **Acceptance rate monitoring** — `argus policies stats` reads the append-only audit log and prints per-policy proposal counts, Jira new/update splits, and cloud breakdown.
+- **JSONL audit log** — every `apply --confirm` appends a line to `local_reports/audit.jsonl` mapping `proposal_id → jira_key → jira_url`.
+- **1756 tests** — all pass offline, no cloud credentials needed.
+
+[Full changelog →](CHANGELOG.md)
+
+---
+
 ## What it does
 
 Every week (or on demand), Argus:
@@ -115,6 +131,63 @@ The **Full report** button links to a self-contained HTML file (S3 / GCS / Azure
 
 ---
 
+## Remediation
+
+Argus stays **strictly read-only** — it never mutates a resource. Instead, the policy engine turns AI findings into prioritised Jira tickets that a human reviews and acts on.
+
+### How it works
+
+```
+argus scan → scan_report.json
+               │
+               ▼
+argus policies plan --report scan_report.json
+               │
+               ├── evaluates policies in config/policies/ (13 bundled — weight-ordered, first-match-wins)
+               ├── applies two-tier conditions: cost/priority/idle-days + metric thresholds
+               ├── computes rightsizing target (e.g. "Recommend db.t3.small — CPU ~8%")
+               └── prints proposal table with total savings estimate
+               │
+               ▼  (add --confirm to create tickets)
+argus policies apply --report scan_report.json --confirm
+               │
+               ├── creates Jira ticket per proposal (idempotent — dedup via label)
+               ├── diff-comments on re-scan if finding changed
+               ├── appends line to local_reports/audit.jsonl
+               └── prints per-ticket status
+
+argus policies stats   # acceptance rate per policy from audit log
+```
+
+### Bundled policies (13)
+
+| Policy | Cloud | Action | Cost threshold |
+|--------|-------|--------|---------------|
+| `aws-ec2-stop-idle-14d` | AWS | stop | $20/mo |
+| `aws-rds-resize-high-cost-idle` | AWS | resize | $100/mo |
+| `aws-ebs-delete-unattached-30d` | AWS | delete | $5/mo |
+| `aws-elb-delete-idle` | AWS | delete | $20/mo |
+| `aws-elasticache-delete-idle-30d` | AWS | delete | $50/mo |
+| `aws-lambda-delete-unused-30d` | AWS | delete | $0 |
+| `aws-redshift-snapshot-delete-14d` | AWS | snapshot_delete | $100/mo |
+| `gcp-compute-stop-idle-7d` | GCP | stop | $20/mo |
+| `gcp-sql-stop-idle-14d` | GCP | stop | $20/mo |
+| `gcp-gke-reduce-nodes-underutilised` | GCP | reduce_nodes | $200/mo |
+| `azure-vm-stop-idle-14d` | Azure | stop | $20/mo |
+| `azure-sql-resize-underutilised` | Azure | resize | $50/mo |
+| `azure-aks-reduce-nodes-underutilised` | Azure | reduce_nodes | $150/mo |
+
+All policies exclude `environment: prod` and `argus-exempt: "true"` tags by default. Add your own in `config/policies/` — see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+### Safety guarantees
+
+- **IAM** — read-only roles; write APIs are unavailable even with creds attached
+- **Code** — no cloud SDK write calls anywhere in the codebase
+- **CLI gate** — `apply` is a dry-run by default; `--confirm` is required to create tickets
+- **Human gate** — runbook is printed in the Jira ticket; Argus never executes it
+
+---
+
 ## Architecture
 
 ```
@@ -166,13 +239,13 @@ docker run --rm \
 
 ```bash
 pip install argus-cloud-optimizer
-argus --version   # argus 0.3.0
+argus --version   # argus 0.5.0
 argus --help
 ```
 
 One package — all three clouds included. No extras needed. `--cloud` auto-detects from your environment (GCP_PROJECT_ID / AZURE_SUBSCRIPTION_IDS / AWS credentials), or specify explicitly.
 
-> **Verified 2026-06-21:** `pip install argus-cloud-optimizer && argus --version` works on a clean Python 3.11/3.12/3.13 venv with no project files.
+> **Verified 2026-06-24:** `pip install argus-cloud-optimizer && argus --version` works on a clean Python 3.11/3.12/3.13 venv with no project files.
 
 **AWS:**
 
@@ -231,7 +304,7 @@ argus chat                                       # auto-detects cloud
 ```
 
 ```
-Argus v0.3.0 — Interactive Cloud Cost Assistant
+Argus v0.5.0 — AI Cloud Detective
 Cloud: AWS  |  Accounts: prod (123456789012)  |  Budget: $1.00/session
 Tip: end a line with \ to continue on the next line.
 Type your question, or /help for commands.
@@ -531,7 +604,7 @@ Before you invest time deploying Argus, know what it **can't** do yet:
 | **AI non-determinism** | By design | The AI decides what's idle — different runs may produce slightly different findings or reasoning. Set `AI_TEMPERATURE=0.0` (default) for most consistent results. |
 | **LLM cost** | Configurable | A full scan of ~200 resources costs ~$0.05–$0.50 in LLM API fees depending on provider. Use `--llm-budget` to set a hard cap (default: $2.00/scan). Large estates (1000+ resources) will hit the budget limit — increase it or use `--max-resources`. |
 | **AWS Resource Explorer setup** | Manual step | You must enable Resource Explorer with an **aggregator index** (typically in `us-east-1`). Without this, Argus cannot discover resources. This is a one-time setup but is easy to miss. |
-| **Write actions** | None | Argus is read-only. It reports findings but never deletes, stops, or modifies resources. Remediation is manual. |
+| **Write actions** | None (by design) | Argus is strictly read-only. The policy engine generates Jira tickets with runbooks — a human reviews and executes. Argus never calls the runbook itself. |
 | **Multi-cloud in one scan** | Not yet | Each `argus` invocation scans one cloud. Use the merge report feature (`core/reports/multi_cloud.py`) to combine results after separate runs. |
 | **Notifications** | Slack + Teams + webhook | No email. Slack/Teams delivery requires a webhook URL. |
 
@@ -573,6 +646,7 @@ argus/
 │   ├── agent/loop.py      # ReAct agent loop
 │   ├── agent/prompts.py   # System prompt + tool schemas
 │   ├── models/finding.py  # ResourceFinding dataclass
+│   ├── remediation/       # Policy engine — models, loader, validator, engine, audit, rightsizing
 │   └── reports/           # Report generator, multi-cloud merge, export, notifications
 ├── adapters/
 │   ├── base.py            # CloudAdapter abstract class
@@ -585,8 +659,12 @@ argus/
 │   ├── bedrock.py         # AWS Bedrock (Converse API)
 │   ├── vertexai.py        # Vertex AI / Gemini (GCP)
 │   └── azure_openai.py    # Azure OpenAI / GPT-4o (Azure)
+├── integrations/
+│   └── jira/              # Ticket lifecycle: create, dedup, diff-comment, ADF formatter, webhook
+├── config/policies/       # 13 bundled YAML policies (AWS / GCP / Azure)
+├── config/policies.example/  # 3 annotated starter templates — copy here to begin
 ├── entrypoints/
-│   ├── cli.py             # argus --cloud aws --run-now
+│   ├── cli.py             # argus scan / chat / policies validate|plan|apply|stats|docs
 │   ├── aws_lambda.py      # AWS Lambda handler
 │   ├── gcp_cloudrun.py    # GCP Cloud Run Job handler
 │   └── azure_function.py  # Azure Function timer trigger
@@ -594,7 +672,7 @@ argus/
 │   ├── aws/               # CloudFormation templates
 │   ├── gcp/               # Cloud Run + Scheduler deploy script
 │   └── azure/             # Bicep templates
-└── tests/                 # 560 tests, all pass offline
+└── tests/                 # 1756 tests, all pass offline
 ```
 
 ---

{argus_cloud_optimizer-0.4.0 → argus_cloud_optimizer-0.5.0}/README.md

@@ -1,10 +1,10 @@
 <p align="center">
-  <img src="docs/assets/images/logo-full.svg" alt="Argus" height="72">
+  <img src="docs/assets/images/logo.svg" alt="Argus" height="72">
 </p>
 
-<p align="center"><strong>AI-powered cloud cost optimization agent for AWS, GCP, and Azure.</strong></p>
+<p align="center"><strong>Argus — AI Cloud Detective for AWS, GCP, and Azure.</strong></p>
 
-Argus finds idle and wasted cloud resources — stopped EC2 instances, unattached EBS volumes, orphaned Elastic IPs, underutilized RDS databases — and delivers a prioritized, AI-reasoned report to Slack every week.
+Argus is an open-source AI Cloud Detective — it hunts idle and wasted cloud resources across AWS, GCP, and Azure (stopped EC2 instances, unattached EBS volumes, orphaned Elastic IPs, underutilized RDS databases) and delivers a prioritized, AI-reasoned report to Slack every week. No rules. No thresholds. Just reasoning.
 
 [![CI](https://github.com/vamshisiddarth/argus/actions/workflows/ci.yml/badge.svg)](https://github.com/vamshisiddarth/argus/actions/workflows/ci.yml)
 [![Publish](https://github.com/vamshisiddarth/argus/actions/workflows/publish.yml/badge.svg)](https://github.com/vamshisiddarth/argus/actions/workflows/publish.yml)
@@ -37,6 +37,21 @@ Top findings
 
 ---
 
+## 🆕 What's new in v0.5.0
+
+> **Remediation is now first-class.** Argus goes beyond reporting — it generates Jira tickets, suggests exact resize targets, and tracks acceptance rates.
+
+- **Policy engine** — YAML-driven policies match AI findings and generate prioritised `ChangeProposal` objects (weight-ordered, one proposal per resource per scan). Ships with 13 real-world policies across AWS, GCP, and Azure.
+- **Jira integration** — idempotent ticket creation with ADF-structured descriptions (metrics table, runbook code block, snapshot fingerprint for diff-on-update). Dedup via deterministic label; diff-comment on re-scan.
+- **Rightsizing recommendations** — `resize` and `reduce_nodes` proposals now include a specific target tier or node count derived from observed CPU% (e.g., "Recommend db.t3.small — observed CPU ~8%").
+- **Acceptance rate monitoring** — `argus policies stats` reads the append-only audit log and prints per-policy proposal counts, Jira new/update splits, and cloud breakdown.
+- **JSONL audit log** — every `apply --confirm` appends a line to `local_reports/audit.jsonl` mapping `proposal_id → jira_key → jira_url`.
+- **1756 tests** — all pass offline, no cloud credentials needed.
+
+[Full changelog →](CHANGELOG.md)
+
+---
+
 ## What it does
 
 Every week (or on demand), Argus:
@@ -52,6 +67,63 @@ The **Full report** button links to a self-contained HTML file (S3 / GCS / Azure
 
 ---
 
+## Remediation
+
+Argus stays **strictly read-only** — it never mutates a resource. Instead, the policy engine turns AI findings into prioritised Jira tickets that a human reviews and acts on.
+
+### How it works
+
+```
+argus scan → scan_report.json
+               │
+               ▼
+argus policies plan --report scan_report.json
+               │
+               ├── evaluates policies in config/policies/ (13 bundled — weight-ordered, first-match-wins)
+               ├── applies two-tier conditions: cost/priority/idle-days + metric thresholds
+               ├── computes rightsizing target (e.g. "Recommend db.t3.small — CPU ~8%")
+               └── prints proposal table with total savings estimate
+               │
+               ▼  (add --confirm to create tickets)
+argus policies apply --report scan_report.json --confirm
+               │
+               ├── creates Jira ticket per proposal (idempotent — dedup via label)
+               ├── diff-comments on re-scan if finding changed
+               ├── appends line to local_reports/audit.jsonl
+               └── prints per-ticket status
+
+argus policies stats   # acceptance rate per policy from audit log
+```
+
+### Bundled policies (13)
+
+| Policy | Cloud | Action | Cost threshold |
+|--------|-------|--------|---------------|
+| `aws-ec2-stop-idle-14d` | AWS | stop | $20/mo |
+| `aws-rds-resize-high-cost-idle` | AWS | resize | $100/mo |
+| `aws-ebs-delete-unattached-30d` | AWS | delete | $5/mo |
+| `aws-elb-delete-idle` | AWS | delete | $20/mo |
+| `aws-elasticache-delete-idle-30d` | AWS | delete | $50/mo |
+| `aws-lambda-delete-unused-30d` | AWS | delete | $0 |
+| `aws-redshift-snapshot-delete-14d` | AWS | snapshot_delete | $100/mo |
+| `gcp-compute-stop-idle-7d` | GCP | stop | $20/mo |
+| `gcp-sql-stop-idle-14d` | GCP | stop | $20/mo |
+| `gcp-gke-reduce-nodes-underutilised` | GCP | reduce_nodes | $200/mo |
+| `azure-vm-stop-idle-14d` | Azure | stop | $20/mo |
+| `azure-sql-resize-underutilised` | Azure | resize | $50/mo |
+| `azure-aks-reduce-nodes-underutilised` | Azure | reduce_nodes | $150/mo |
+
+All policies exclude `environment: prod` and `argus-exempt: "true"` tags by default. Add your own in `config/policies/` — see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+### Safety guarantees
+
+- **IAM** — read-only roles; write APIs are unavailable even with creds attached
+- **Code** — no cloud SDK write calls anywhere in the codebase
+- **CLI gate** — `apply` is a dry-run by default; `--confirm` is required to create tickets
+- **Human gate** — runbook is printed in the Jira ticket; Argus never executes it
+
+---
+
 ## Architecture
 
 ```
@@ -103,13 +175,13 @@ docker run --rm \
 
 ```bash
 pip install argus-cloud-optimizer
-argus --version   # argus 0.3.0
+argus --version   # argus 0.5.0
 argus --help
 ```
 
 One package — all three clouds included. No extras needed. `--cloud` auto-detects from your environment (GCP_PROJECT_ID / AZURE_SUBSCRIPTION_IDS / AWS credentials), or specify explicitly.
 
-> **Verified 2026-06-21:** `pip install argus-cloud-optimizer && argus --version` works on a clean Python 3.11/3.12/3.13 venv with no project files.
+> **Verified 2026-06-24:** `pip install argus-cloud-optimizer && argus --version` works on a clean Python 3.11/3.12/3.13 venv with no project files.
 
 **AWS:**
 
@@ -168,7 +240,7 @@ argus chat                                       # auto-detects cloud
 ```
 
 ```
-Argus v0.3.0 — Interactive Cloud Cost Assistant
+Argus v0.5.0 — AI Cloud Detective
 Cloud: AWS  |  Accounts: prod (123456789012)  |  Budget: $1.00/session
 Tip: end a line with \ to continue on the next line.
 Type your question, or /help for commands.
@@ -468,7 +540,7 @@ Before you invest time deploying Argus, know what it **can't** do yet:
 | **AI non-determinism** | By design | The AI decides what's idle — different runs may produce slightly different findings or reasoning. Set `AI_TEMPERATURE=0.0` (default) for most consistent results. |
 | **LLM cost** | Configurable | A full scan of ~200 resources costs ~$0.05–$0.50 in LLM API fees depending on provider. Use `--llm-budget` to set a hard cap (default: $2.00/scan). Large estates (1000+ resources) will hit the budget limit — increase it or use `--max-resources`. |
 | **AWS Resource Explorer setup** | Manual step | You must enable Resource Explorer with an **aggregator index** (typically in `us-east-1`). Without this, Argus cannot discover resources. This is a one-time setup but is easy to miss. |
-| **Write actions** | None | Argus is read-only. It reports findings but never deletes, stops, or modifies resources. Remediation is manual. |
+| **Write actions** | None (by design) | Argus is strictly read-only. The policy engine generates Jira tickets with runbooks — a human reviews and executes. Argus never calls the runbook itself. |
 | **Multi-cloud in one scan** | Not yet | Each `argus` invocation scans one cloud. Use the merge report feature (`core/reports/multi_cloud.py`) to combine results after separate runs. |
 | **Notifications** | Slack + Teams + webhook | No email. Slack/Teams delivery requires a webhook URL. |
 
@@ -510,6 +582,7 @@ argus/
 │   ├── agent/loop.py      # ReAct agent loop
 │   ├── agent/prompts.py   # System prompt + tool schemas
 │   ├── models/finding.py  # ResourceFinding dataclass
+│   ├── remediation/       # Policy engine — models, loader, validator, engine, audit, rightsizing
 │   └── reports/           # Report generator, multi-cloud merge, export, notifications
 ├── adapters/
 │   ├── base.py            # CloudAdapter abstract class
@@ -522,8 +595,12 @@ argus/
 │   ├── bedrock.py         # AWS Bedrock (Converse API)
 │   ├── vertexai.py        # Vertex AI / Gemini (GCP)
 │   └── azure_openai.py    # Azure OpenAI / GPT-4o (Azure)
+├── integrations/
+│   └── jira/              # Ticket lifecycle: create, dedup, diff-comment, ADF formatter, webhook
+├── config/policies/       # 13 bundled YAML policies (AWS / GCP / Azure)
+├── config/policies.example/  # 3 annotated starter templates — copy here to begin
 ├── entrypoints/
-│   ├── cli.py             # argus --cloud aws --run-now
+│   ├── cli.py             # argus scan / chat / policies validate|plan|apply|stats|docs
 │   ├── aws_lambda.py      # AWS Lambda handler
 │   ├── gcp_cloudrun.py    # GCP Cloud Run Job handler
 │   └── azure_function.py  # Azure Function timer trigger
@@ -531,7 +608,7 @@ argus/
 │   ├── aws/               # CloudFormation templates
 │   ├── gcp/               # Cloud Run + Scheduler deploy script
 │   └── azure/             # Bicep templates
-└── tests/                 # 560 tests, all pass offline
+└── tests/                 # 1756 tests, all pass offline
 ```
 
 ---

{argus_cloud_optimizer-0.4.0 → argus_cloud_optimizer-0.5.0}/adapters/aws/adapter.py

@@ -82,4 +82,6 @@ class AWSAdapter(CloudAdapter):
     ) -> "AWSAdapter":
         """Convenience constructor — resolves auth and returns a ready adapter."""
         session = auth.get_session(account=account, region=region)
-        return cls(session=session, aggregator_region=region)
+        # Pass aggregator_region=None so __init__ honours RESOURCE_EXPLORER_REGION
+        # env var before falling back to the default "us-east-1".
+        return cls(session=session, aggregator_region=None)

{argus_cloud_optimizer-0.4.0 → argus_cloud_optimizer-0.5.0}/adapters/aws/cloudwatch.py

@@ -11,11 +11,18 @@ from botocore.exceptions import ClientError
 from adapters.aws.config import BOTO_TIMEOUT_CONFIG
 from adapters.aws.retry import retry_on_transient
 from adapters.base import MetricSummary
+from core.registry import get_registry
 
 logger = structlog.get_logger(__name__)
 
-# (MetricName, Namespace, Stat, CloudWatch Dimension Key)
-# Stat is "Average" for utilisation metrics, "Sum" for throughput/count metrics.
+
+def _metrics_for(resource_type: str) -> list[tuple[str, str, str, str]] | None:
+    spec = get_registry().get(resource_type)
+    if spec and spec.metrics:
+        return [(m.name, m.namespace, m.stat, m.dimension_key) for m in spec.metrics]
+    return None
+
+
 _METRICS: dict[str, list[tuple[str, str, str, str]]] = {
     "AWS::EC2::Instance": [
         ("CPUUtilization", "AWS/EC2", "Average", "InstanceId"),
@@ -282,7 +289,7 @@ def get_metrics(
     gives the AI the current instance size so it can recommend a specific
     smaller tier rather than a generic "consider downsizing".
     """
-    metric_defs = _METRICS.get(resource_type)
+    metric_defs = _metrics_for(resource_type)
     if not metric_defs:
         metric_defs = _discover_metrics(session, resource_id, resource_type)
     if not metric_defs:

{argus_cloud_optimizer-0.4.0 → argus_cloud_optimizer-0.5.0}/adapters/azure/monitor.py

@@ -10,9 +10,18 @@ from azure.monitor.query import MetricAggregationType, MetricsQueryClient
 
 from adapters.azure.retry import retry_on_transient
 from adapters.base import MetricSummary
+from core.registry import get_registry
 
 logger = structlog.get_logger(__name__)
 
+
+def _metrics_for(resource_type: str) -> list[tuple[str, str]] | None:
+    spec = get_registry().get(resource_type.lower())
+    if spec and spec.metrics:
+        return [(m.name, m.stat) for m in spec.metrics]
+    return None
+
+
 # (MetricName, AggregationType)
 _METRICS: dict[str, list[tuple[str, str]]] = {
     # Virtual Machines
@@ -271,7 +280,7 @@ def get_metrics(
     Fetch Azure Monitor metrics for a resource.
     Falls back to querying available metric definitions for unknown resource types.
     """
-    metric_defs = _METRICS.get(resource_type.lower())
+    metric_defs = _metrics_for(resource_type)
     if not metric_defs:
         metric_defs = _discover_metrics(resource_id, resource_type, credential)
     if not metric_defs:

{argus_cloud_optimizer-0.4.0 → argus_cloud_optimizer-0.5.0}/adapters/base.py

@@ -52,7 +52,11 @@ class CloudAdapter(ABC):
     """
     Abstract cloud adapter. One implementation per cloud provider.
     The agent loop only ever calls these four methods — never raw SDK clients.
-    All implementations must be read-only (no mutations to cloud resources).
+
+    READ-ONLY CONTRACT: All implementations must be strictly read-only.
+    No method may create, modify, delete, or mutate any cloud resource.
+    This contract is enforced by tests that scan adapter subclasses for
+    mutating method names. Violations fail CI.
     """
 
     @abstractmethod

{argus_cloud_optimizer-0.4.0 → argus_cloud_optimizer-0.5.0}/adapters/gcp/adapter.py

@@ -33,12 +33,16 @@ class GCPAdapter(CloudAdapter):
             )
         self._project_id: str = resolved
         self._bq_billing_table = bq_billing_table or os.environ.get("BILLING_BQ_TABLE")
+        # Populated after list_resources() — asset types skipped due to disabled APIs
+        self.skipped_asset_types: list[str] = []
 
     def list_resources(self, ignore_regions: list[str] | None = None) -> list[Resource]:
-        return asset_inventory.list_resources(
+        resources, skipped = asset_inventory.list_resources(
             project_id=self._project_id,
             ignore_regions=ignore_regions,
         )
+        self.skipped_asset_types = skipped
+        return resources
 
     def get_metrics(
         self,

{argus_cloud_optimizer-0.4.0 → argus_cloud_optimizer-0.5.0}/adapters/gcp/asset_inventory.py

@@ -3,7 +3,12 @@ from __future__ import annotations
 from typing import Any
 
 import structlog
-from google.api_core.exceptions import GoogleAPICallError, PermissionDenied
+from google.api_core.exceptions import (
+    GoogleAPICallError,
+    InvalidArgument,
+    NotFound,
+    PermissionDenied,
+)
 from google.cloud import asset_v1
 
 from adapters.base import Resource
@@ -32,7 +37,7 @@ SCANNED_ASSET_TYPES: list[str] = [
     "compute.googleapis.com/VpnTunnel",
     "vpcaccess.googleapis.com/Connector",  # Serverless VPC
     # --- Databases ---
-    "sql.googleapis.com/Instance",  # Cloud SQL
+    "sqladmin.googleapis.com/Instance",  # Cloud SQL
     "spanner.googleapis.com/Instance",
     "bigtable.googleapis.com/Instance",
     "alloydb.googleapis.com/Cluster",  # AlloyDB (managed Postgres)
@@ -55,42 +60,76 @@ SCANNED_ASSET_TYPES: list[str] = [
 def list_resources(
     project_id: str,
     ignore_regions: list[str] | None = None,
-) -> list[Resource]:
+) -> tuple[list[Resource], list[str]]:
     """
-    Return all billable GCP resources in a project using Cloud Asset Inventory.
-    Uses a single paginated API call — no per-resource-type enumeration needed.
+    Return (resources, skipped_asset_types) for a GCP project.
+
+    Uses a single paginated Cloud Asset Inventory call. If any asset type's API
+    is not enabled in the project, INVALID_ARGUMENT is returned for that type.
+    We strip it and retry so a project without Bigtable/Spanner/etc. enabled
+    doesn't block the whole scan. Callers receive the list of skipped types so
+    they can surface a warning in the Slack digest.
     """
     client = asset_v1.AssetServiceClient()
     parent = f"projects/{project_id}"
     ignore_set = set(ignore_regions or [])
     resources: list[Resource] = []
-
-    request = asset_v1.ListAssetsRequest(
-        parent=parent,
-        asset_types=SCANNED_ASSET_TYPES,
-        content_type=asset_v1.ContentType.RESOURCE,
-    )
-
-    try:
-        for asset in retry_on_transient(
-            client.list_assets, request=request, timeout=60
-        ):
-            parsed = _parse_asset(asset, ignore_set)
-            if parsed:
-                resources.append(parsed)
-    except PermissionDenied as exc:
-        raise PermissionError(
-            f"Argus service account is missing cloudasset.assets.listAssets "
-            f"permission on project {project_id}."
-        ) from exc
-    except GoogleAPICallError as exc:
-        raise RuntimeError(f"Cloud Asset Inventory API error: {exc}") from exc
+    asset_types = list(SCANNED_ASSET_TYPES)  # mutable — bad types get stripped
+    skipped_types: list[str] = []
+
+    while True:
+        request = asset_v1.ListAssetsRequest(
+            parent=parent,
+            asset_types=asset_types,
+            content_type=asset_v1.ContentType.RESOURCE,
+        )
+        try:
+            for asset in retry_on_transient(
+                client.list_assets, request=request, timeout=60
+            ):
+                parsed = _parse_asset(asset, ignore_set)
+                if parsed:
+                    resources.append(parsed)
+            break  # success — exit retry loop
+        except InvalidArgument as exc:
+            # An asset type whose API is not enabled in this project causes
+            # INVALID_ARGUMENT. Strip it and retry with the remaining types.
+            bad_type = _extract_bad_asset_type(str(exc), asset_types)
+            if bad_type:
+                logger.warning(
+                    "asset_type_api_not_enabled_skipping",
+                    asset_type=bad_type,
+                    project_id=project_id,
+                )
+                skipped_types.append(bad_type)
+                asset_types.remove(bad_type)
+                resources = []  # reset — avoid duplicates from partial page
+            else:
+                raise RuntimeError(
+                    f"Cloud Asset Inventory INVALID_ARGUMENT (unknown type): {exc}"
+                ) from exc
+        except (PermissionDenied, NotFound) as exc:
+            raise PermissionError(
+                f"Project '{project_id}' not found or Argus lacks permission. "
+                f"Check the project ID and ensure cloudasset.assets.listAssets "
+                f"is granted to your credentials."
+            ) from exc
+        except GoogleAPICallError as exc:
+            raise RuntimeError(f"Cloud Asset Inventory API error: {exc}") from exc
 
     logger.info(
         "asset_inventory_complete",
         extra={"project_id": project_id, "total": len(resources)},
     )
-    return resources
+    return resources, skipped_types
+
+
+def _extract_bad_asset_type(error_msg: str, asset_types: list[str]) -> str | None:
+    """Return the first asset type string found in an INVALID_ARGUMENT error."""
+    for asset_type in asset_types:
+        if asset_type in error_msg:
+            return asset_type
+    return None
 
 
 def _parse_asset(asset: Any, ignore_set: set[str]) -> Resource | None:

{argus_cloud_optimizer-0.4.0 → argus_cloud_optimizer-0.5.0}/adapters/gcp/cloud_logging.py

@@ -52,7 +52,6 @@ def get_last_activity(
                 filter_=log_filter,
                 order_by=gcp_logging.DESCENDING,
                 page_size=1,
-                timeout=60,
             )
         )
     except GoogleAPICallError as exc:
@@ -76,7 +75,7 @@ def _service_from_resource_type(resource_type: str) -> str | None:
     mapping: dict[str, str] = {
         "compute.googleapis.com/Instance": "compute.googleapis.com",
         "compute.googleapis.com/Disk": "compute.googleapis.com",
-        "sql.googleapis.com/Instance": "cloudsql.googleapis.com",
+        "sqladmin.googleapis.com/Instance": "cloudsql.googleapis.com",
         "container.googleapis.com/Cluster": "container.googleapis.com",
         "storage.googleapis.com/Bucket": "storage.googleapis.com",
         "bigquery.googleapis.com/Dataset": "bigquery.googleapis.com",