argus-cloud-optimizer 0.4.1__tar.gz → 0.5.0__tar.gz

{argus_cloud_optimizer-0.4.1 → argus_cloud_optimizer-0.5.0}/.env.example

@@ -68,6 +68,33 @@ REPORT_FORMAT=json,html                     # comma-separated: json, html, pdf,
 # Useful for local testing without a real webhook.
 DRY_RUN=false
 
+# -----------------------------------------------------------------------------
+# Remediation — Policy Engine + Jira Integration
+# Policies are YAML files in ARGUS_POLICIES_DIR. Argus never executes changes;
+# it creates Jira tickets for human review. See config/policies/ for examples
+# and CONTRIBUTING.md for how to write policies.
+# -----------------------------------------------------------------------------
+ARGUS_POLICIES_DIR=./config/policies        # directory containing policy YAML files
+
+# Jira credentials — required for `argus policies apply --confirm`
+# Create an API token at: https://id.atlassian.com/manage-profile/security/api-tokens
+JIRA_BASE_URL=https://your-org.atlassian.net
+JIRA_USER_EMAIL=bot@your-org.com
+JIRA_API_TOKEN=                             # Atlassian API token (not your password)
+
+# Directory containing your *.yaml policy files (one policy per file).
+# Copy from config/policies.example/ to get started, then customise.
+ARGUS_POLICY_DIR=./config/policies
+
+# Path to integrations config (project key, labels, priority map).
+# Copy config/integrations.yaml.example → config/integrations.yaml and fill in.
+# config/integrations.yaml is gitignored — never commit credentials.
+ARGUS_INTEGRATIONS_CONFIG=./config/integrations.yaml
+
+# Audit log — every `apply --confirm` appends one JSONL line mapping
+# proposal_id → jira_key → jira_url for traceability.
+ARGUS_AUDIT_LOG=./local_reports/audit.jsonl
+
 # -----------------------------------------------------------------------------
 # Logging
 # -----------------------------------------------------------------------------

{argus_cloud_optimizer-0.4.1/argus_cloud_optimizer.egg-info → argus_cloud_optimizer-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: argus-cloud-optimizer
-Version: 0.4.1
+Version: 0.5.0
 Summary: Argus — AI Cloud Detective for AWS, GCP, and Azure
 Author-email: Vamshi Siddarth Gaddam <vamshisiddarth02@gmail.com>
 License-Expression: MIT
@@ -59,6 +59,7 @@ Requires-Dist: types-python-dateutil>=2.9.0; extra == "dev"
 Requires-Dist: boto3-stubs[bedrock-runtime,ce,cloudwatch,resourceexplorer2,s3,sts]>=1.35.36; extra == "dev"
 Requires-Dist: mkdocs-material>=9.5.44; extra == "dev"
 Requires-Dist: mkdocs-minify-plugin>=0.8.0; extra == "dev"
+Requires-Dist: mike>=2.1.0; extra == "dev"
 Dynamic: license-file
 
 <p align="center">
@@ -100,15 +101,16 @@ Top findings
 
 ---
 
-## 🆕 What's new in v0.4.1
+## 🆕 What's new in v0.5.0
 
-> **Biggest release yet.** Argus jumps from scheduled reporter to a conversational FinOps companion.
+> **Remediation is now first-class.** Argus goes beyond reporting — it generates Jira tickets, suggests exact resize targets, and tracks acceptance rates.
 
-- **Interactive chat mode** — `argus chat` lets you ask natural-language questions about your cloud costs and get intelligent, context-aware answers backed by real metrics and cost data.
-- **True multi-cloud, multi-account** — GCP multi-project and Azure multi-subscription support with unified reporting across all accounts in a single run.
-- **Expanded resource coverage** — 31 GCP resource types (up from 22) and 40 Azure resource types (up from 26), all with curated metric mappings.
-- **Chat UX polish** — live spinner updates per tool call, AI-generated context summaries, turn-safe history trimming, and rich terminal formatting via `pip install argus-cloud-optimizer[chat]`.
-- **Docs overhaul** — new architecture diagram, corrected IAM permissions for all three clouds, and accurate env-var reference.
+- **Policy engine** — YAML-driven policies match AI findings and generate prioritised `ChangeProposal` objects (weight-ordered, one proposal per resource per scan). Ships with 13 real-world policies across AWS, GCP, and Azure.
+- **Jira integration** — idempotent ticket creation with ADF-structured descriptions (metrics table, runbook code block, snapshot fingerprint for diff-on-update). Dedup via deterministic label; diff-comment on re-scan.
+- **Rightsizing recommendations** — `resize` and `reduce_nodes` proposals now include a specific target tier or node count derived from observed CPU% (e.g., "Recommend db.t3.small — observed CPU ~8%").
+- **Acceptance rate monitoring** — `argus policies stats` reads the append-only audit log and prints per-policy proposal counts, Jira new/update splits, and cloud breakdown.
+- **JSONL audit log** — every `apply --confirm` appends a line to `local_reports/audit.jsonl` mapping `proposal_id → jira_key → jira_url`.
+- **1756 tests** — all pass offline, no cloud credentials needed.
 
 [Full changelog →](CHANGELOG.md)
 
@@ -129,6 +131,63 @@ The **Full report** button links to a self-contained HTML file (S3 / GCS / Azure
 
 ---
 
+## Remediation
+
+Argus stays **strictly read-only** — it never mutates a resource. Instead, the policy engine turns AI findings into prioritised Jira tickets that a human reviews and acts on.
+
+### How it works
+
+```
+argus scan → scan_report.json
+               │
+               ▼
+argus policies plan --report scan_report.json
+               │
+               ├── evaluates policies in config/policies/ (13 bundled — weight-ordered, first-match-wins)
+               ├── applies two-tier conditions: cost/priority/idle-days + metric thresholds
+               ├── computes rightsizing target (e.g. "Recommend db.t3.small — CPU ~8%")
+               └── prints proposal table with total savings estimate
+               │
+               ▼  (add --confirm to create tickets)
+argus policies apply --report scan_report.json --confirm
+               │
+               ├── creates Jira ticket per proposal (idempotent — dedup via label)
+               ├── diff-comments on re-scan if finding changed
+               ├── appends line to local_reports/audit.jsonl
+               └── prints per-ticket status
+
+argus policies stats   # acceptance rate per policy from audit log
+```
+
+### Bundled policies (13)
+
+| Policy | Cloud | Action | Cost threshold |
+|--------|-------|--------|---------------|
+| `aws-ec2-stop-idle-14d` | AWS | stop | $20/mo |
+| `aws-rds-resize-high-cost-idle` | AWS | resize | $100/mo |
+| `aws-ebs-delete-unattached-30d` | AWS | delete | $5/mo |
+| `aws-elb-delete-idle` | AWS | delete | $20/mo |
+| `aws-elasticache-delete-idle-30d` | AWS | delete | $50/mo |
+| `aws-lambda-delete-unused-30d` | AWS | delete | $0 |
+| `aws-redshift-snapshot-delete-14d` | AWS | snapshot_delete | $100/mo |
+| `gcp-compute-stop-idle-7d` | GCP | stop | $20/mo |
+| `gcp-sql-stop-idle-14d` | GCP | stop | $20/mo |
+| `gcp-gke-reduce-nodes-underutilised` | GCP | reduce_nodes | $200/mo |
+| `azure-vm-stop-idle-14d` | Azure | stop | $20/mo |
+| `azure-sql-resize-underutilised` | Azure | resize | $50/mo |
+| `azure-aks-reduce-nodes-underutilised` | Azure | reduce_nodes | $150/mo |
+
+All policies exclude `environment: prod` and `argus-exempt: "true"` tags by default. Add your own in `config/policies/` — see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+### Safety guarantees
+
+- **IAM** — read-only roles; write APIs are unavailable even with creds attached
+- **Code** — no cloud SDK write calls anywhere in the codebase
+- **CLI gate** — `apply` is a dry-run by default; `--confirm` is required to create tickets
+- **Human gate** — runbook is printed in the Jira ticket; Argus never executes it
+
+---
+
 ## Architecture
 
 ```
@@ -180,7 +239,7 @@ docker run --rm \
 
 ```bash
 pip install argus-cloud-optimizer
-argus --version   # argus 0.4.1
+argus --version   # argus 0.5.0
 argus --help
 ```
 
@@ -245,7 +304,7 @@ argus chat                                       # auto-detects cloud
 ```
 
 ```
-Argus v0.4.1 — AI Cloud Detective
+Argus v0.5.0 — AI Cloud Detective
 Cloud: AWS  |  Accounts: prod (123456789012)  |  Budget: $1.00/session
 Tip: end a line with \ to continue on the next line.
 Type your question, or /help for commands.
@@ -545,7 +604,7 @@ Before you invest time deploying Argus, know what it **can't** do yet:
 | **AI non-determinism** | By design | The AI decides what's idle — different runs may produce slightly different findings or reasoning. Set `AI_TEMPERATURE=0.0` (default) for most consistent results. |
 | **LLM cost** | Configurable | A full scan of ~200 resources costs ~$0.05–$0.50 in LLM API fees depending on provider. Use `--llm-budget` to set a hard cap (default: $2.00/scan). Large estates (1000+ resources) will hit the budget limit — increase it or use `--max-resources`. |
 | **AWS Resource Explorer setup** | Manual step | You must enable Resource Explorer with an **aggregator index** (typically in `us-east-1`). Without this, Argus cannot discover resources. This is a one-time setup but is easy to miss. |
-| **Write actions** | None | Argus is read-only. It reports findings but never deletes, stops, or modifies resources. Remediation is manual. |
+| **Write actions** | None (by design) | Argus is strictly read-only. The policy engine generates Jira tickets with runbooks — a human reviews and executes. Argus never calls the runbook itself. |
 | **Multi-cloud in one scan** | Not yet | Each `argus` invocation scans one cloud. Use the merge report feature (`core/reports/multi_cloud.py`) to combine results after separate runs. |
 | **Notifications** | Slack + Teams + webhook | No email. Slack/Teams delivery requires a webhook URL. |
 
@@ -587,6 +646,7 @@ argus/
 │   ├── agent/loop.py      # ReAct agent loop
 │   ├── agent/prompts.py   # System prompt + tool schemas
 │   ├── models/finding.py  # ResourceFinding dataclass
+│   ├── remediation/       # Policy engine — models, loader, validator, engine, audit, rightsizing
 │   └── reports/           # Report generator, multi-cloud merge, export, notifications
 ├── adapters/
 │   ├── base.py            # CloudAdapter abstract class
@@ -599,8 +659,12 @@ argus/
 │   ├── bedrock.py         # AWS Bedrock (Converse API)
 │   ├── vertexai.py        # Vertex AI / Gemini (GCP)
 │   └── azure_openai.py    # Azure OpenAI / GPT-4o (Azure)
+├── integrations/
+│   └── jira/              # Ticket lifecycle: create, dedup, diff-comment, ADF formatter, webhook
+├── config/policies/       # 13 bundled YAML policies (AWS / GCP / Azure)
+├── config/policies.example/  # 3 annotated starter templates — copy here to begin
 ├── entrypoints/
-│   ├── cli.py             # argus --cloud aws --run-now
+│   ├── cli.py             # argus scan / chat / policies validate|plan|apply|stats|docs
 │   ├── aws_lambda.py      # AWS Lambda handler
 │   ├── gcp_cloudrun.py    # GCP Cloud Run Job handler
 │   └── azure_function.py  # Azure Function timer trigger
@@ -608,7 +672,7 @@ argus/
 │   ├── aws/               # CloudFormation templates
 │   ├── gcp/               # Cloud Run + Scheduler deploy script
 │   └── azure/             # Bicep templates
-└── tests/                 # 560 tests, all pass offline
+└── tests/                 # 1756 tests, all pass offline
 ```
 
 ---

{argus_cloud_optimizer-0.4.1 → argus_cloud_optimizer-0.5.0}/README.md

@@ -37,15 +37,16 @@ Top findings
 
 ---
 
-## 🆕 What's new in v0.4.1
+## 🆕 What's new in v0.5.0
 
-> **Biggest release yet.** Argus jumps from scheduled reporter to a conversational FinOps companion.
+> **Remediation is now first-class.** Argus goes beyond reporting — it generates Jira tickets, suggests exact resize targets, and tracks acceptance rates.
 
-- **Interactive chat mode** — `argus chat` lets you ask natural-language questions about your cloud costs and get intelligent, context-aware answers backed by real metrics and cost data.
-- **True multi-cloud, multi-account** — GCP multi-project and Azure multi-subscription support with unified reporting across all accounts in a single run.
-- **Expanded resource coverage** — 31 GCP resource types (up from 22) and 40 Azure resource types (up from 26), all with curated metric mappings.
-- **Chat UX polish** — live spinner updates per tool call, AI-generated context summaries, turn-safe history trimming, and rich terminal formatting via `pip install argus-cloud-optimizer[chat]`.
-- **Docs overhaul** — new architecture diagram, corrected IAM permissions for all three clouds, and accurate env-var reference.
+- **Policy engine** — YAML-driven policies match AI findings and generate prioritised `ChangeProposal` objects (weight-ordered, one proposal per resource per scan). Ships with 13 real-world policies across AWS, GCP, and Azure.
+- **Jira integration** — idempotent ticket creation with ADF-structured descriptions (metrics table, runbook code block, snapshot fingerprint for diff-on-update). Dedup via deterministic label; diff-comment on re-scan.
+- **Rightsizing recommendations** — `resize` and `reduce_nodes` proposals now include a specific target tier or node count derived from observed CPU% (e.g., "Recommend db.t3.small — observed CPU ~8%").
+- **Acceptance rate monitoring** — `argus policies stats` reads the append-only audit log and prints per-policy proposal counts, Jira new/update splits, and cloud breakdown.
+- **JSONL audit log** — every `apply --confirm` appends a line to `local_reports/audit.jsonl` mapping `proposal_id → jira_key → jira_url`.
+- **1756 tests** — all pass offline, no cloud credentials needed.
 
 [Full changelog →](CHANGELOG.md)
 
@@ -66,6 +67,63 @@ The **Full report** button links to a self-contained HTML file (S3 / GCS / Azure
 
 ---
 
+## Remediation
+
+Argus stays **strictly read-only** — it never mutates a resource. Instead, the policy engine turns AI findings into prioritised Jira tickets that a human reviews and acts on.
+
+### How it works
+
+```
+argus scan → scan_report.json
+               │
+               ▼
+argus policies plan --report scan_report.json
+               │
+               ├── evaluates policies in config/policies/ (13 bundled — weight-ordered, first-match-wins)
+               ├── applies two-tier conditions: cost/priority/idle-days + metric thresholds
+               ├── computes rightsizing target (e.g. "Recommend db.t3.small — CPU ~8%")
+               └── prints proposal table with total savings estimate
+               │
+               ▼  (add --confirm to create tickets)
+argus policies apply --report scan_report.json --confirm
+               │
+               ├── creates Jira ticket per proposal (idempotent — dedup via label)
+               ├── diff-comments on re-scan if finding changed
+               ├── appends line to local_reports/audit.jsonl
+               └── prints per-ticket status
+
+argus policies stats   # acceptance rate per policy from audit log
+```
+
+### Bundled policies (13)
+
+| Policy | Cloud | Action | Cost threshold |
+|--------|-------|--------|---------------|
+| `aws-ec2-stop-idle-14d` | AWS | stop | $20/mo |
+| `aws-rds-resize-high-cost-idle` | AWS | resize | $100/mo |
+| `aws-ebs-delete-unattached-30d` | AWS | delete | $5/mo |
+| `aws-elb-delete-idle` | AWS | delete | $20/mo |
+| `aws-elasticache-delete-idle-30d` | AWS | delete | $50/mo |
+| `aws-lambda-delete-unused-30d` | AWS | delete | $0 |
+| `aws-redshift-snapshot-delete-14d` | AWS | snapshot_delete | $100/mo |
+| `gcp-compute-stop-idle-7d` | GCP | stop | $20/mo |
+| `gcp-sql-stop-idle-14d` | GCP | stop | $20/mo |
+| `gcp-gke-reduce-nodes-underutilised` | GCP | reduce_nodes | $200/mo |
+| `azure-vm-stop-idle-14d` | Azure | stop | $20/mo |
+| `azure-sql-resize-underutilised` | Azure | resize | $50/mo |
+| `azure-aks-reduce-nodes-underutilised` | Azure | reduce_nodes | $150/mo |
+
+All policies exclude `environment: prod` and `argus-exempt: "true"` tags by default. Add your own in `config/policies/` — see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+### Safety guarantees
+
+- **IAM** — read-only roles; write APIs are unavailable even with creds attached
+- **Code** — no cloud SDK write calls anywhere in the codebase
+- **CLI gate** — `apply` is a dry-run by default; `--confirm` is required to create tickets
+- **Human gate** — runbook is printed in the Jira ticket; Argus never executes it
+
+---
+
 ## Architecture
 
 ```
@@ -117,7 +175,7 @@ docker run --rm \
 
 ```bash
 pip install argus-cloud-optimizer
-argus --version   # argus 0.4.1
+argus --version   # argus 0.5.0
 argus --help
 ```
 
@@ -182,7 +240,7 @@ argus chat                                       # auto-detects cloud
 ```
 
 ```
-Argus v0.4.1 — AI Cloud Detective
+Argus v0.5.0 — AI Cloud Detective
 Cloud: AWS  |  Accounts: prod (123456789012)  |  Budget: $1.00/session
 Tip: end a line with \ to continue on the next line.
 Type your question, or /help for commands.
@@ -482,7 +540,7 @@ Before you invest time deploying Argus, know what it **can't** do yet:
 | **AI non-determinism** | By design | The AI decides what's idle — different runs may produce slightly different findings or reasoning. Set `AI_TEMPERATURE=0.0` (default) for most consistent results. |
 | **LLM cost** | Configurable | A full scan of ~200 resources costs ~$0.05–$0.50 in LLM API fees depending on provider. Use `--llm-budget` to set a hard cap (default: $2.00/scan). Large estates (1000+ resources) will hit the budget limit — increase it or use `--max-resources`. |
 | **AWS Resource Explorer setup** | Manual step | You must enable Resource Explorer with an **aggregator index** (typically in `us-east-1`). Without this, Argus cannot discover resources. This is a one-time setup but is easy to miss. |
-| **Write actions** | None | Argus is read-only. It reports findings but never deletes, stops, or modifies resources. Remediation is manual. |
+| **Write actions** | None (by design) | Argus is strictly read-only. The policy engine generates Jira tickets with runbooks — a human reviews and executes. Argus never calls the runbook itself. |
 | **Multi-cloud in one scan** | Not yet | Each `argus` invocation scans one cloud. Use the merge report feature (`core/reports/multi_cloud.py`) to combine results after separate runs. |
 | **Notifications** | Slack + Teams + webhook | No email. Slack/Teams delivery requires a webhook URL. |
 
@@ -524,6 +582,7 @@ argus/
 │   ├── agent/loop.py      # ReAct agent loop
 │   ├── agent/prompts.py   # System prompt + tool schemas
 │   ├── models/finding.py  # ResourceFinding dataclass
+│   ├── remediation/       # Policy engine — models, loader, validator, engine, audit, rightsizing
 │   └── reports/           # Report generator, multi-cloud merge, export, notifications
 ├── adapters/
 │   ├── base.py            # CloudAdapter abstract class
@@ -536,8 +595,12 @@ argus/
 │   ├── bedrock.py         # AWS Bedrock (Converse API)
 │   ├── vertexai.py        # Vertex AI / Gemini (GCP)
 │   └── azure_openai.py    # Azure OpenAI / GPT-4o (Azure)
+├── integrations/
+│   └── jira/              # Ticket lifecycle: create, dedup, diff-comment, ADF formatter, webhook
+├── config/policies/       # 13 bundled YAML policies (AWS / GCP / Azure)
+├── config/policies.example/  # 3 annotated starter templates — copy here to begin
 ├── entrypoints/
-│   ├── cli.py             # argus --cloud aws --run-now
+│   ├── cli.py             # argus scan / chat / policies validate|plan|apply|stats|docs
 │   ├── aws_lambda.py      # AWS Lambda handler
 │   ├── gcp_cloudrun.py    # GCP Cloud Run Job handler
 │   └── azure_function.py  # Azure Function timer trigger
@@ -545,7 +608,7 @@ argus/
 │   ├── aws/               # CloudFormation templates
 │   ├── gcp/               # Cloud Run + Scheduler deploy script
 │   └── azure/             # Bicep templates
-└── tests/                 # 560 tests, all pass offline
+└── tests/                 # 1756 tests, all pass offline
 ```
 
 ---

{argus_cloud_optimizer-0.4.1 → argus_cloud_optimizer-0.5.0}/adapters/aws/cloudwatch.py

@@ -11,11 +11,18 @@ from botocore.exceptions import ClientError
 from adapters.aws.config import BOTO_TIMEOUT_CONFIG
 from adapters.aws.retry import retry_on_transient
 from adapters.base import MetricSummary
+from core.registry import get_registry
 
 logger = structlog.get_logger(__name__)
 
-# (MetricName, Namespace, Stat, CloudWatch Dimension Key)
-# Stat is "Average" for utilisation metrics, "Sum" for throughput/count metrics.
+
+def _metrics_for(resource_type: str) -> list[tuple[str, str, str, str]] | None:
+    spec = get_registry().get(resource_type)
+    if spec and spec.metrics:
+        return [(m.name, m.namespace, m.stat, m.dimension_key) for m in spec.metrics]
+    return None
+
+
 _METRICS: dict[str, list[tuple[str, str, str, str]]] = {
     "AWS::EC2::Instance": [
         ("CPUUtilization", "AWS/EC2", "Average", "InstanceId"),
@@ -282,7 +289,7 @@ def get_metrics(
     gives the AI the current instance size so it can recommend a specific
     smaller tier rather than a generic "consider downsizing".
     """
-    metric_defs = _METRICS.get(resource_type)
+    metric_defs = _metrics_for(resource_type)
     if not metric_defs:
         metric_defs = _discover_metrics(session, resource_id, resource_type)
     if not metric_defs:

{argus_cloud_optimizer-0.4.1 → argus_cloud_optimizer-0.5.0}/adapters/azure/monitor.py

@@ -10,9 +10,18 @@ from azure.monitor.query import MetricAggregationType, MetricsQueryClient
 
 from adapters.azure.retry import retry_on_transient
 from adapters.base import MetricSummary
+from core.registry import get_registry
 
 logger = structlog.get_logger(__name__)
 
+
+def _metrics_for(resource_type: str) -> list[tuple[str, str]] | None:
+    spec = get_registry().get(resource_type.lower())
+    if spec and spec.metrics:
+        return [(m.name, m.stat) for m in spec.metrics]
+    return None
+
+
 # (MetricName, AggregationType)
 _METRICS: dict[str, list[tuple[str, str]]] = {
     # Virtual Machines
@@ -271,7 +280,7 @@ def get_metrics(
     Fetch Azure Monitor metrics for a resource.
     Falls back to querying available metric definitions for unknown resource types.
     """
-    metric_defs = _METRICS.get(resource_type.lower())
+    metric_defs = _metrics_for(resource_type)
     if not metric_defs:
         metric_defs = _discover_metrics(resource_id, resource_type, credential)
     if not metric_defs:

{argus_cloud_optimizer-0.4.1 → argus_cloud_optimizer-0.5.0}/adapters/base.py

@@ -52,7 +52,11 @@ class CloudAdapter(ABC):
     """
     Abstract cloud adapter. One implementation per cloud provider.
     The agent loop only ever calls these four methods — never raw SDK clients.
-    All implementations must be read-only (no mutations to cloud resources).
+
+    READ-ONLY CONTRACT: All implementations must be strictly read-only.
+    No method may create, modify, delete, or mutate any cloud resource.
+    This contract is enforced by tests that scan adapter subclasses for
+    mutating method names. Violations fail CI.
     """
 
     @abstractmethod

{argus_cloud_optimizer-0.4.1 → argus_cloud_optimizer-0.5.0}/adapters/gcp/cloud_monitoring.py

@@ -10,9 +10,18 @@ from google.protobuf.timestamp_pb2 import Timestamp
 
 from adapters.base import MetricSummary
 from adapters.gcp.retry import retry_on_transient
+from core.registry import get_registry
 
 logger = structlog.get_logger(__name__)
 
+
+def _metrics_for(resource_type: str) -> list[tuple[str, str]] | None:
+    spec = get_registry().get(resource_type)
+    if spec and spec.metrics:
+        return [(m.name, m.stat) for m in spec.metrics]
+    return None
+
+
 # (MetricType, Stat, label_key_for_resource_filter)
 # Stat: "mean" for utilisation, "sum" for throughput/count.
 # label_key: the monitored-resource label used to filter to this specific resource.
@@ -254,7 +263,7 @@ def get_metrics(
     Fetch Cloud Monitoring metrics for a GCP resource.
     Falls back to listing available metrics for unknown resource types.
     """
-    metric_defs = _METRICS.get(resource_type)
+    metric_defs = _metrics_for(resource_type)
     if not metric_defs:
         metric_defs = _discover_metrics(project_id, resource_id, resource_type)
     if not metric_defs:

{argus_cloud_optimizer-0.4.1 → argus_cloud_optimizer-0.5.0/argus_cloud_optimizer.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: argus-cloud-optimizer
-Version: 0.4.1
+Version: 0.5.0
 Summary: Argus — AI Cloud Detective for AWS, GCP, and Azure
 Author-email: Vamshi Siddarth Gaddam <vamshisiddarth02@gmail.com>
 License-Expression: MIT
@@ -59,6 +59,7 @@ Requires-Dist: types-python-dateutil>=2.9.0; extra == "dev"
 Requires-Dist: boto3-stubs[bedrock-runtime,ce,cloudwatch,resourceexplorer2,s3,sts]>=1.35.36; extra == "dev"
 Requires-Dist: mkdocs-material>=9.5.44; extra == "dev"
 Requires-Dist: mkdocs-minify-plugin>=0.8.0; extra == "dev"
+Requires-Dist: mike>=2.1.0; extra == "dev"
 Dynamic: license-file
 
 <p align="center">
@@ -100,15 +101,16 @@ Top findings
 
 ---
 
-## 🆕 What's new in v0.4.1
+## 🆕 What's new in v0.5.0
 
-> **Biggest release yet.** Argus jumps from scheduled reporter to a conversational FinOps companion.
+> **Remediation is now first-class.** Argus goes beyond reporting — it generates Jira tickets, suggests exact resize targets, and tracks acceptance rates.
 
-- **Interactive chat mode** — `argus chat` lets you ask natural-language questions about your cloud costs and get intelligent, context-aware answers backed by real metrics and cost data.
-- **True multi-cloud, multi-account** — GCP multi-project and Azure multi-subscription support with unified reporting across all accounts in a single run.
-- **Expanded resource coverage** — 31 GCP resource types (up from 22) and 40 Azure resource types (up from 26), all with curated metric mappings.
-- **Chat UX polish** — live spinner updates per tool call, AI-generated context summaries, turn-safe history trimming, and rich terminal formatting via `pip install argus-cloud-optimizer[chat]`.
-- **Docs overhaul** — new architecture diagram, corrected IAM permissions for all three clouds, and accurate env-var reference.
+- **Policy engine** — YAML-driven policies match AI findings and generate prioritised `ChangeProposal` objects (weight-ordered, one proposal per resource per scan). Ships with 13 real-world policies across AWS, GCP, and Azure.
+- **Jira integration** — idempotent ticket creation with ADF-structured descriptions (metrics table, runbook code block, snapshot fingerprint for diff-on-update). Dedup via deterministic label; diff-comment on re-scan.
+- **Rightsizing recommendations** — `resize` and `reduce_nodes` proposals now include a specific target tier or node count derived from observed CPU% (e.g., "Recommend db.t3.small — observed CPU ~8%").
+- **Acceptance rate monitoring** — `argus policies stats` reads the append-only audit log and prints per-policy proposal counts, Jira new/update splits, and cloud breakdown.
+- **JSONL audit log** — every `apply --confirm` appends a line to `local_reports/audit.jsonl` mapping `proposal_id → jira_key → jira_url`.
+- **1756 tests** — all pass offline, no cloud credentials needed.
 
 [Full changelog →](CHANGELOG.md)
 
@@ -129,6 +131,63 @@ The **Full report** button links to a self-contained HTML file (S3 / GCS / Azure
 
 ---
 
+## Remediation
+
+Argus stays **strictly read-only** — it never mutates a resource. Instead, the policy engine turns AI findings into prioritised Jira tickets that a human reviews and acts on.
+
+### How it works
+
+```
+argus scan → scan_report.json
+               │
+               ▼
+argus policies plan --report scan_report.json
+               │
+               ├── evaluates policies in config/policies/ (13 bundled — weight-ordered, first-match-wins)
+               ├── applies two-tier conditions: cost/priority/idle-days + metric thresholds
+               ├── computes rightsizing target (e.g. "Recommend db.t3.small — CPU ~8%")
+               └── prints proposal table with total savings estimate
+               │
+               ▼  (add --confirm to create tickets)
+argus policies apply --report scan_report.json --confirm
+               │
+               ├── creates Jira ticket per proposal (idempotent — dedup via label)
+               ├── diff-comments on re-scan if finding changed
+               ├── appends line to local_reports/audit.jsonl
+               └── prints per-ticket status
+
+argus policies stats   # acceptance rate per policy from audit log
+```
+
+### Bundled policies (13)
+
+| Policy | Cloud | Action | Cost threshold |
+|--------|-------|--------|---------------|
+| `aws-ec2-stop-idle-14d` | AWS | stop | $20/mo |
+| `aws-rds-resize-high-cost-idle` | AWS | resize | $100/mo |
+| `aws-ebs-delete-unattached-30d` | AWS | delete | $5/mo |
+| `aws-elb-delete-idle` | AWS | delete | $20/mo |
+| `aws-elasticache-delete-idle-30d` | AWS | delete | $50/mo |
+| `aws-lambda-delete-unused-30d` | AWS | delete | $0 |
+| `aws-redshift-snapshot-delete-14d` | AWS | snapshot_delete | $100/mo |
+| `gcp-compute-stop-idle-7d` | GCP | stop | $20/mo |
+| `gcp-sql-stop-idle-14d` | GCP | stop | $20/mo |
+| `gcp-gke-reduce-nodes-underutilised` | GCP | reduce_nodes | $200/mo |
+| `azure-vm-stop-idle-14d` | Azure | stop | $20/mo |
+| `azure-sql-resize-underutilised` | Azure | resize | $50/mo |
+| `azure-aks-reduce-nodes-underutilised` | Azure | reduce_nodes | $150/mo |
+
+All policies exclude `environment: prod` and `argus-exempt: "true"` tags by default. Add your own in `config/policies/` — see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+### Safety guarantees
+
+- **IAM** — read-only roles; write APIs are unavailable even with creds attached
+- **Code** — no cloud SDK write calls anywhere in the codebase
+- **CLI gate** — `apply` is a dry-run by default; `--confirm` is required to create tickets
+- **Human gate** — runbook is printed in the Jira ticket; Argus never executes it
+
+---
+
 ## Architecture
 
 ```
@@ -180,7 +239,7 @@ docker run --rm \
 
 ```bash
 pip install argus-cloud-optimizer
-argus --version   # argus 0.4.1
+argus --version   # argus 0.5.0
 argus --help
 ```
 
@@ -245,7 +304,7 @@ argus chat                                       # auto-detects cloud
 ```
 
 ```
-Argus v0.4.1 — AI Cloud Detective
+Argus v0.5.0 — AI Cloud Detective
 Cloud: AWS  |  Accounts: prod (123456789012)  |  Budget: $1.00/session
 Tip: end a line with \ to continue on the next line.
 Type your question, or /help for commands.
@@ -545,7 +604,7 @@ Before you invest time deploying Argus, know what it **can't** do yet:
 | **AI non-determinism** | By design | The AI decides what's idle — different runs may produce slightly different findings or reasoning. Set `AI_TEMPERATURE=0.0` (default) for most consistent results. |
 | **LLM cost** | Configurable | A full scan of ~200 resources costs ~$0.05–$0.50 in LLM API fees depending on provider. Use `--llm-budget` to set a hard cap (default: $2.00/scan). Large estates (1000+ resources) will hit the budget limit — increase it or use `--max-resources`. |
 | **AWS Resource Explorer setup** | Manual step | You must enable Resource Explorer with an **aggregator index** (typically in `us-east-1`). Without this, Argus cannot discover resources. This is a one-time setup but is easy to miss. |
-| **Write actions** | None | Argus is read-only. It reports findings but never deletes, stops, or modifies resources. Remediation is manual. |
+| **Write actions** | None (by design) | Argus is strictly read-only. The policy engine generates Jira tickets with runbooks — a human reviews and executes. Argus never calls the runbook itself. |
 | **Multi-cloud in one scan** | Not yet | Each `argus` invocation scans one cloud. Use the merge report feature (`core/reports/multi_cloud.py`) to combine results after separate runs. |
 | **Notifications** | Slack + Teams + webhook | No email. Slack/Teams delivery requires a webhook URL. |
 
@@ -587,6 +646,7 @@ argus/
 │   ├── agent/loop.py      # ReAct agent loop
 │   ├── agent/prompts.py   # System prompt + tool schemas
 │   ├── models/finding.py  # ResourceFinding dataclass
+│   ├── remediation/       # Policy engine — models, loader, validator, engine, audit, rightsizing
 │   └── reports/           # Report generator, multi-cloud merge, export, notifications
 ├── adapters/
 │   ├── base.py            # CloudAdapter abstract class
@@ -599,8 +659,12 @@ argus/
 │   ├── bedrock.py         # AWS Bedrock (Converse API)
 │   ├── vertexai.py        # Vertex AI / Gemini (GCP)
 │   └── azure_openai.py    # Azure OpenAI / GPT-4o (Azure)
+├── integrations/
+│   └── jira/              # Ticket lifecycle: create, dedup, diff-comment, ADF formatter, webhook
+├── config/policies/       # 13 bundled YAML policies (AWS / GCP / Azure)
+├── config/policies.example/  # 3 annotated starter templates — copy here to begin
 ├── entrypoints/
-│   ├── cli.py             # argus --cloud aws --run-now
+│   ├── cli.py             # argus scan / chat / policies validate|plan|apply|stats|docs
 │   ├── aws_lambda.py      # AWS Lambda handler
 │   ├── gcp_cloudrun.py    # GCP Cloud Run Job handler
 │   └── azure_function.py  # Azure Function timer trigger
@@ -608,7 +672,7 @@ argus/
 │   ├── aws/               # CloudFormation templates
 │   ├── gcp/               # Cloud Run + Scheduler deploy script
 │   └── azure/             # Bicep templates
-└── tests/                 # 560 tests, all pass offline
+└── tests/                 # 1756 tests, all pass offline
 ```
 
 ---