autoops-sre 0.1.3__tar.gz

autoops_sre-0.1.3/.gitignore

@@ -0,0 +1,38 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+
+# uv / venv
+.venv/
+.python-version
+
+# Tooling caches
+.ruff_cache/
+.mypy_cache/
+.pytest_cache/
+.coverage
+.coverage.*
+htmlcov/
+coverage.xml
+
+# Artifacts, evidence, traces and SBOM are committed as a backup
+# (large >3MB dumps go through Git LFS, see .gitattributes).
+# Only transient root-level logs stay ignored; logs inside the dirs are kept.
+/*.log
+
+# Editor / OS
+.vscode/
+.idea/
+.DS_Store
+
+# Secrets (never commit credentials)
+.env
+.env.*
+!.env.example
+
+# Claude Code personal project settings
+.claude/settings.local.json

autoops_sre-0.1.3/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Evangelos Pappas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

autoops_sre-0.1.3/PKG-INFO

@@ -0,0 +1,199 @@
+Metadata-Version: 2.4
+Name: autoops-sre
+Version: 0.1.3
+Summary: An agentic ops harness for AIOps — SRE, cloud, Kubernetes, observability, and security automation.
+Project-URL: Repository, https://github.com/epappas/autoops
+Author-email: Evangelos Pappas <epappas@evalonlabs.com>
+License: MIT
+License-File: LICENSE
+Keywords: agent,aiops,harness,kubernetes,observability,sre
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.12
+Requires-Dist: anthropic>=0.121.0
+Requires-Dist: cedarpy<5,>=4.8.7
+Requires-Dist: cryptography>=50
+Requires-Dist: mcp>=2.1.1
+Requires-Dist: openai>=2.53.0
+Requires-Dist: opentelemetry-api>=1.43.0
+Requires-Dist: opentelemetry-sdk>=1.44.0
+Requires-Dist: pydantic>=2.7
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: starlette>=1.6.0
+Requires-Dist: typer>=0.27.1
+Requires-Dist: uvicorn>=0.52.4
+Requires-Dist: websockets>=17.1
+Description-Content-Type: text/markdown
+
+# autoOps
+
+An autonomous SRE agent. Point it at a Kubernetes namespace and it models the estate,
+names the service that is broken, shows the evidence it used, and re-reads the cluster to
+check its own answer — or hands a human a briefing saying why it could not.
+
+**Prime objective:** an agent that operates real estates unaided through one core runtime
+loop. The measure of done is **transfer** — the loop working on an estate it was not built
+for (ADR-0038 D6) — never a benchmark score.
+
+> **What works today.** The nine-stage loop is built and has run against real clusters
+> read-only. Perception is deterministic and comes first: 35 senses read the cluster's own
+> declared state and nominate what looks broken, while metrics, traces and logs supply the
+> evidence that either confirms a candidate or refuses it. A sense never votes on its own
+> nomination. Diagnosis then reaches a confident answer or escalates, and says which.
+>
+> **What it deliberately will not do.** It does not act. Stage 8 emits an incident note or
+> a remediation proposal, never a change. The one typed mutation verb that exists,
+> `k8s_scale_workload`, has an executor that raises unconditionally and is reachable from no
+> live path — the boundary is code, not policy. It stays locked until the reasoning is
+> trustworthy enough to earn it.
+
+## Install
+
+```bash
+uv tool install autoops-sre                      # or: pip install autoops-sre
+docker pull ghcr.io/epappas/autoops:latest       # entrypoint is `autoops`
+```
+
+The distribution is **`autoops-sre`**; the command it installs is **`autoops`**. The bare name
+`autoops` on PyPI belongs to an unrelated project — do not install it.
+
+```bash
+autoops version && autoops --help
+```
+
+Three paths — a Python tool, a container image, or a source checkout — with the exact commands,
+what the image does and does not contain, and how to verify its provenance:
+**[`docs/operations/install.md`](docs/operations/install.md)**.
+
+## The Loop
+
+```
+recall -> understand -> [detect -> map topology -> map services -> localize] -> rca -> mitigate -> remember
+```
+
+The bracket is the investigation. `rca` matches over everything inside it plus what was
+recalled; `remember` closes the loop so the next run starts from a model rather than from
+nothing. Perception is deterministic and precedes action — the estate model generates the
+agent's moves, not the other way round (ADR-0038, ADR-0039).
+
+## Try It Without A Cluster
+
+A real model drives the real agent stack over committed recordings — no cluster, and no
+credentials beyond an LLM key. The run is graded against the fixture's known answer, so you
+see both what it concluded and whether it was right.
+
+```bash
+uv sync
+export OPENROUTER_API_KEY=...            # or put both in .env (never committed)
+export OPENROUTER_MODEL=anthropic/claude-opus-4.8
+
+uv run autoops offline --fixtures tests/fixtures/observability --results-dir ./out
+```
+
+It writes the trajectory, `results.tsv` and — only if it was wrong — a miss record, all under
+`./out`. Four problems are available: `--problem localization` (default), `detection`, `rca`,
+`cascade-localization`.
+
+## Running It Against A Cluster
+
+Read **[`docs/operations/operator-runbook.md`](docs/operations/operator-runbook.md)** — the
+operator's document: prerequisites, exit codes and what to do about each, the exact shape of
+a confident answer and of an escalation, troubleshooting, and the safety rails.
+
+The short version, on a loopback (kind/k3s) cluster:
+
+```bash
+uv run autoops diagnose --namespace <ns> --results-dir ./out
+```
+
+It runs a three-vote panel and decides fail-closed: **exit 0** is a confident answer,
+**exit 3** is an escalation briefing for a human, **exit 4** means every sense came back
+without a read and no answer above it can be trusted.
+
+Once an estate is written into a config file — `./autoops.yaml`, or `--config <path>`, or
+`$AUTOOPS_CONFIG` — a routine diagnosis is `autoops diagnose --namespace <ns>` and nothing
+else. Every flag overrides the config, the config overrides the environment, and with no
+config file every command resolves exactly as it did before (ADR-0206).
+
+`autoops watch` is the continuous mode — scheduled panels with a cadence floor, a rolling
+token budget, and escalations delivered to a directory or a webhook.
+
+Any cluster that is not loopback is refused before a single read until it is named in an
+allowlist the owner has signed out of band. That refusal is the authorization boundary and
+it lives in the loader, not in the model.
+
+## The Command Surface
+
+Seven verbs, plus `version` (ADR-0206, ADR-0208):
+
+| Verb | What it is for |
+|---|---|
+| `init` | Onboard an estate and check the setup: `init verify` (the crossing kill-switch), `init validate`, `init print-config`, `init selftest` |
+| `diagnose` | Diagnose a live namespace read-only — the product path |
+| `watch` | Continuous mode: scheduled panels, cadence floor, budget, delivered escalations |
+| `offline` | One committed fixture problem, no cluster, recorded telemetry only |
+| `export` | `export evidence` bundles a finished run for a ticket; `export misses` turns recorded misses into replayable scenarios |
+| `serve` | Serve over the network: `serve http` (REST + websockets + MCP), `serve mcp-stdio` (MCP for a local agent) |
+| `eval` | Evaluation and campaign instrumentation — `declare-campaign`, `campaign-report`, `miss-replay`, `axis-gap` |
+| `version` | Print the version |
+
+Every pre-ADR-0206 command name still dispatches, hidden and with a deprecation notice
+naming its replacement, because committed evidence manifests and estate crossing scripts
+record those invocations verbatim.
+
+## Safety
+
+autoOps is built to run against real infrastructure, so the constraints come first:
+
+- **The model is never the authorization boundary.** Every tool call passes a
+  deny-by-default policy gate before execution, and gets a structured reason it can replan
+  on rather than a bare refusal.
+- **Read-only by construction on the shipped path.** The Cedar read-only profile plus a
+  destructive re-check; a diagnosis cannot mutate.
+- **Approvals are short-lived, target-scoped and re-checked** before every target contact —
+  deleting an allowlist entry aborts a run already in flight.
+- **Secrets never enter the model context or the logs.**
+
+## Documentation
+
+**[`docs/`](docs/index.md)** is the map — every document, what it answers, and who it is for.
+The four an operator needs:
+
+| Task | Document |
+|---|---|
+| Install it | [`operations/install.md`](docs/operations/install.md) |
+| Point it at a cluster | [`operations/onboarding-a-cluster.md`](docs/operations/onboarding-a-cluster.md) |
+| Run a diagnosis and read the answer | [`operations/operator-runbook.md`](docs/operations/operator-runbook.md) |
+| Run it unattended, or over the network | [`operations/continuous.md`](docs/operations/continuous.md) · [`operations/api.md`](docs/operations/api.md) |
+
+## Design
+
+- Decisions: [`docs/architecture/adr/`](docs/architecture/adr/) — ADR-0038 and ADR-0039
+  define the loop; ADR-0113 records why a sense is a node in the estate graph rather than a
+  vote for a culprit.
+- Architecture: [`system-architecture.md`](docs/architecture/system-architecture.md)
+  (structure) · [`incident-loop.md`](docs/architecture/incident-loop.md) (behaviour) ·
+  [`data-plane.md`](docs/architecture/data-plane.md)
+- Estates: [`deploy/estates/`](deploy/estates/) — eighteen deployable fault estates, each
+  with its own contract and offline validators.
+- Research: [`docs/research/`](docs/research/) · beliefs that constrain the design live in
+  [`_meta/beliefs.md`](docs/research/_meta/beliefs.md).
+
+## Contributing
+
+```bash
+make help        # every target
+make check       # the merge gate: lint, imports, types, dead code, tests + coverage, security, estates
+```
+
+See [`CLAUDE.md`](CLAUDE.md) (= `AGENTS.md`) and [`CONTRIBUTING.md`](CONTRIBUTING.md). The
+hard rule: no detection, localization, RCA or mitigation capability is "done" without an
+end-to-end run that closes the telemetry loop — re-reading real cluster state to verify the
+outcome, not the agent's self-report.
+
+## License
+
+MIT — see [`LICENSE`](LICENSE).

autoops_sre-0.1.3/README.md

@@ -0,0 +1,169 @@
+# autoOps
+
+An autonomous SRE agent. Point it at a Kubernetes namespace and it models the estate,
+names the service that is broken, shows the evidence it used, and re-reads the cluster to
+check its own answer — or hands a human a briefing saying why it could not.
+
+**Prime objective:** an agent that operates real estates unaided through one core runtime
+loop. The measure of done is **transfer** — the loop working on an estate it was not built
+for (ADR-0038 D6) — never a benchmark score.
+
+> **What works today.** The nine-stage loop is built and has run against real clusters
+> read-only. Perception is deterministic and comes first: 35 senses read the cluster's own
+> declared state and nominate what looks broken, while metrics, traces and logs supply the
+> evidence that either confirms a candidate or refuses it. A sense never votes on its own
+> nomination. Diagnosis then reaches a confident answer or escalates, and says which.
+>
+> **What it deliberately will not do.** It does not act. Stage 8 emits an incident note or
+> a remediation proposal, never a change. The one typed mutation verb that exists,
+> `k8s_scale_workload`, has an executor that raises unconditionally and is reachable from no
+> live path — the boundary is code, not policy. It stays locked until the reasoning is
+> trustworthy enough to earn it.
+
+## Install
+
+```bash
+uv tool install autoops-sre                      # or: pip install autoops-sre
+docker pull ghcr.io/epappas/autoops:latest       # entrypoint is `autoops`
+```
+
+The distribution is **`autoops-sre`**; the command it installs is **`autoops`**. The bare name
+`autoops` on PyPI belongs to an unrelated project — do not install it.
+
+```bash
+autoops version && autoops --help
+```
+
+Three paths — a Python tool, a container image, or a source checkout — with the exact commands,
+what the image does and does not contain, and how to verify its provenance:
+**[`docs/operations/install.md`](docs/operations/install.md)**.
+
+## The Loop
+
+```
+recall -> understand -> [detect -> map topology -> map services -> localize] -> rca -> mitigate -> remember
+```
+
+The bracket is the investigation. `rca` matches over everything inside it plus what was
+recalled; `remember` closes the loop so the next run starts from a model rather than from
+nothing. Perception is deterministic and precedes action — the estate model generates the
+agent's moves, not the other way round (ADR-0038, ADR-0039).
+
+## Try It Without A Cluster
+
+A real model drives the real agent stack over committed recordings — no cluster, and no
+credentials beyond an LLM key. The run is graded against the fixture's known answer, so you
+see both what it concluded and whether it was right.
+
+```bash
+uv sync
+export OPENROUTER_API_KEY=...            # or put both in .env (never committed)
+export OPENROUTER_MODEL=anthropic/claude-opus-4.8
+
+uv run autoops offline --fixtures tests/fixtures/observability --results-dir ./out
+```
+
+It writes the trajectory, `results.tsv` and — only if it was wrong — a miss record, all under
+`./out`. Four problems are available: `--problem localization` (default), `detection`, `rca`,
+`cascade-localization`.
+
+## Running It Against A Cluster
+
+Read **[`docs/operations/operator-runbook.md`](docs/operations/operator-runbook.md)** — the
+operator's document: prerequisites, exit codes and what to do about each, the exact shape of
+a confident answer and of an escalation, troubleshooting, and the safety rails.
+
+The short version, on a loopback (kind/k3s) cluster:
+
+```bash
+uv run autoops diagnose --namespace <ns> --results-dir ./out
+```
+
+It runs a three-vote panel and decides fail-closed: **exit 0** is a confident answer,
+**exit 3** is an escalation briefing for a human, **exit 4** means every sense came back
+without a read and no answer above it can be trusted.
+
+Once an estate is written into a config file — `./autoops.yaml`, or `--config <path>`, or
+`$AUTOOPS_CONFIG` — a routine diagnosis is `autoops diagnose --namespace <ns>` and nothing
+else. Every flag overrides the config, the config overrides the environment, and with no
+config file every command resolves exactly as it did before (ADR-0206).
+
+`autoops watch` is the continuous mode — scheduled panels with a cadence floor, a rolling
+token budget, and escalations delivered to a directory or a webhook.
+
+Any cluster that is not loopback is refused before a single read until it is named in an
+allowlist the owner has signed out of band. That refusal is the authorization boundary and
+it lives in the loader, not in the model.
+
+## The Command Surface
+
+Seven verbs, plus `version` (ADR-0206, ADR-0208):
+
+| Verb | What it is for |
+|---|---|
+| `init` | Onboard an estate and check the setup: `init verify` (the crossing kill-switch), `init validate`, `init print-config`, `init selftest` |
+| `diagnose` | Diagnose a live namespace read-only — the product path |
+| `watch` | Continuous mode: scheduled panels, cadence floor, budget, delivered escalations |
+| `offline` | One committed fixture problem, no cluster, recorded telemetry only |
+| `export` | `export evidence` bundles a finished run for a ticket; `export misses` turns recorded misses into replayable scenarios |
+| `serve` | Serve over the network: `serve http` (REST + websockets + MCP), `serve mcp-stdio` (MCP for a local agent) |
+| `eval` | Evaluation and campaign instrumentation — `declare-campaign`, `campaign-report`, `miss-replay`, `axis-gap` |
+| `version` | Print the version |
+
+Every pre-ADR-0206 command name still dispatches, hidden and with a deprecation notice
+naming its replacement, because committed evidence manifests and estate crossing scripts
+record those invocations verbatim.
+
+## Safety
+
+autoOps is built to run against real infrastructure, so the constraints come first:
+
+- **The model is never the authorization boundary.** Every tool call passes a
+  deny-by-default policy gate before execution, and gets a structured reason it can replan
+  on rather than a bare refusal.
+- **Read-only by construction on the shipped path.** The Cedar read-only profile plus a
+  destructive re-check; a diagnosis cannot mutate.
+- **Approvals are short-lived, target-scoped and re-checked** before every target contact —
+  deleting an allowlist entry aborts a run already in flight.
+- **Secrets never enter the model context or the logs.**
+
+## Documentation
+
+**[`docs/`](docs/index.md)** is the map — every document, what it answers, and who it is for.
+The four an operator needs:
+
+| Task | Document |
+|---|---|
+| Install it | [`operations/install.md`](docs/operations/install.md) |
+| Point it at a cluster | [`operations/onboarding-a-cluster.md`](docs/operations/onboarding-a-cluster.md) |
+| Run a diagnosis and read the answer | [`operations/operator-runbook.md`](docs/operations/operator-runbook.md) |
+| Run it unattended, or over the network | [`operations/continuous.md`](docs/operations/continuous.md) · [`operations/api.md`](docs/operations/api.md) |
+
+## Design
+
+- Decisions: [`docs/architecture/adr/`](docs/architecture/adr/) — ADR-0038 and ADR-0039
+  define the loop; ADR-0113 records why a sense is a node in the estate graph rather than a
+  vote for a culprit.
+- Architecture: [`system-architecture.md`](docs/architecture/system-architecture.md)
+  (structure) · [`incident-loop.md`](docs/architecture/incident-loop.md) (behaviour) ·
+  [`data-plane.md`](docs/architecture/data-plane.md)
+- Estates: [`deploy/estates/`](deploy/estates/) — eighteen deployable fault estates, each
+  with its own contract and offline validators.
+- Research: [`docs/research/`](docs/research/) · beliefs that constrain the design live in
+  [`_meta/beliefs.md`](docs/research/_meta/beliefs.md).
+
+## Contributing
+
+```bash
+make help        # every target
+make check       # the merge gate: lint, imports, types, dead code, tests + coverage, security, estates
+```
+
+See [`CLAUDE.md`](CLAUDE.md) (= `AGENTS.md`) and [`CONTRIBUTING.md`](CONTRIBUTING.md). The
+hard rule: no detection, localization, RCA or mitigation capability is "done" without an
+end-to-end run that closes the telemetry loop — re-reading real cluster state to verify the
+outcome, not the agent's self-report.
+
+## License
+
+MIT — see [`LICENSE`](LICENSE).

autoops_sre-0.1.3/pyproject.toml

@@ -0,0 +1,221 @@
+[build-system]
+# hatch-vcs (ADR-0205 D3): the version IS the git tag, never a hand-edited constant. A released
+# artifact reporting 0.0.0 is a falsehood the release workflow would publish under a real tag.
+# ⚑ hatchling is BOUNDED, and the upper bound is load-bearing. `[build-system].requires` is the one
+# input to a release that `uv.lock` does not lock, so an unpinned backend means the published
+# artefact can change with zero commits to this repository -- which is exactly what happened.
+# hatchling 1.32.0 (2026-08-11) began emitting `Metadata-Version: 2.5`, and the SHA-pinned
+# `pypa/gh-action-pypi-publish` bundles a twine that rejects it, so `v0.1.2` built, version-checked
+# and cut a GitHub Release, then died on upload with:
+#
+#   InvalidDistribution: Invalid distribution metadata: '2.5' is not a valid metadata version
+#
+# MEASURED by building this project against each: 1.32.0 -> 2.5, 1.31.0 -> 2.4, 1.27.0 -> 2.4.
+# Lift the cap when the publish action ships a twine that accepts 2.5 -- its newest release
+# (v1.14.2, 2026-07-29) PREDATES hatchling 1.32.0, so bumping the action today fixes nothing.
+# The cap is the honest fix; disabling the action's `verify_metadata` would be passing by declining.
+requires = ["hatchling>=1.27,<1.32", "hatch-vcs>=0.5"]
+build-backend = "hatchling.build"
+
+[project]
+name = "autoops-sre"
+dynamic = ["version"]
+description = "An agentic ops harness for AIOps — SRE, cloud, Kubernetes, observability, and security automation."
+readme = "README.md"
+requires-python = ">=3.12"
+license = { text = "MIT" }
+authors = [{ name = "Evangelos Pappas", email = "epappas@evalonlabs.com" }]
+keywords = ["aiops", "sre", "agent", "kubernetes", "observability", "harness"]
+classifiers = [
+  "Development Status :: 2 - Pre-Alpha",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3.12",
+  "Topic :: System :: Systems Administration",
+]
+dependencies = [
+  "typer>=0.27.1",
+  "pydantic>=2.7",
+  "pyyaml>=6.0",
+  "opentelemetry-api>=1.43.0",
+  "opentelemetry-sdk>=1.44.0",
+  "anthropic>=0.121.0",
+  "openai>=2.53.0",
+  "cedarpy>=4.8.7,<5",
+  # ADR-0042: the SPKI telemetry pin (sandbox/pinned_http.py) parses the negotiated DER leaf and
+  # extracts its SubjectPublicKeyInfo -- X.509 parsing the stdlib does not provide. Promoted from
+  # the dev group (#109); a real, disclosed runtime cost, not "free".
+  # >=50 pins out CVE-2026-69247 (fixed in 50.0.0); the SPKI pin (ADR-0042) needs this at runtime.
+  "cryptography>=50",
+  # ADR-0208, `autoops serve`. ONE new dependency SUBTREE, declared as the four names this code
+  # actually imports: `mcp` already depends on starlette and uvicorn, so naming them costs nothing
+  # in the resolved graph and buys honesty -- `serve/api.py` imports starlette, `serve/commands.py`
+  # imports uvicorn, and a module that imports a package it does not declare is one upstream drop
+  # away from breaking.
+  # `mcp` is the protocol's REFERENCE implementation. Hand-rolling the MCP wire protocol for an
+  # agent-facing boundary is the higher risk, not the lower one: session ids, protocol-version
+  # negotiation and the Streamable-HTTP handshake are exactly where a hand-rolled server silently
+  # stops interoperating. Measured before adding: `pip-audit --strict` and `osv-scanner` are both
+  # green on the resulting lock, and the tree overlaps what autoOps already ships (pydantic,
+  # opentelemetry-api, cryptography, anyio, httpx).
+  # `websockets` is NOT optional and that was MEASURED, not assumed: without it,
+  # `uvicorn.config.Config(ws="auto").load()` resolves `ws_protocol_class = None` and the shipped
+  # `autoops serve http` refuses every websocket upgrade -- the stage stream would not exist. With
+  # it, the same call resolves `WebSocketsSansIOProtocol`.
+  "mcp>=2.1.1",
+  "starlette>=1.6.0",
+  "uvicorn>=0.52.4",
+  "websockets>=17.1",
+]
+
+[project.scripts]
+autoops = "autoops.cli:main"
+autoctl = "autoops.autoctl:main"
+
+[project.urls]
+Repository = "https://github.com/epappas/autoops"
+
+[dependency-groups]
+dev = [
+  # ⚑ DECLARED, not inherited. `httpx` reached the tests transitively through `openai` 2.x and the
+  # 3.x bump dropped it, breaking collection in `test_openrouter_client.py`, `test_serve_api.py` and
+  # `test_serve_mcp.py` with `ModuleNotFoundError`. Every one of the nine dependency PRs was green
+  # on its own; the UNION was red. This is exactly the hazard the main dependency block's own
+  # comment names -- "a module that imports a package it does not declare is one upstream drop away
+  # from breaking" -- so the fix is to declare it rather than re-pin `openai`.
+  "httpx>=0.28",
+  "ruff>=0.16.2",
+  "mypy>=2.3.0",
+  "pytest>=9.1.1",
+  "pytest-cov>=5.0",
+  "bandit>=1.7",
+  "pip-audit>=2.7",
+  # ADR-0099: the import-layering gate (`.importlinter`, run by `make lint-imports`). Unlike
+  # semgrep below, this one BELONGS in the group: `lint-imports` resolves its root package
+  # through `sys.path`, so an isolated `uvx` environment would analyse whatever `autoops` it
+  # could find rather than this working tree. Membership makes it resolve the editable install.
+  # Measured before adding, against the precedent below: it pulls `click` and `grimp` into the
+  # graph -- `click` being the exact package semgrep held at a vulnerable pin -- and resolves
+  # click 8.4.2, not the 8.1.8 that carries PYSEC-2026-2132. `make security` is green with it.
+  # Pinned exactly because this tool is a GATE: layer parsing, `exhaustive` and
+  # `exclude_type_checking_imports` are version-dependent, so a silent minor bump would change
+  # what the contract means, not just how it runs.
+  "import-linter==2.14",
+  "pre-commit>=4.6.1",
+  "cyclonedx-bom>=7.3.1",
+  "types-pyyaml>=6.0.12.20260724",
+  # semgrep is NOT a project dependency -- it is a TOOL, and it is pinned and run in isolation by
+  # the Makefile (`uvx semgrep==...`), exactly as osv-scanner is (`go run ...@v2.3.8`). It was a dev
+  # dependency until #126: it pins `click~=8.1.8`, and click 8.1.8 carries PYSEC-2026-2132, so a
+  # non-shipping scanner was holding a CVE inside the project's own dependency graph and failing the
+  # gate it exists to serve. Even semgrep's latest release (1.169.0) still carries that pin, so no
+  # bump fixes it -- the tool simply does not belong in the graph.
+  # cryptography moved to [project].dependencies for ADR-0042 (the SPKI pin needs it at
+  # runtime); tests/test_token_minter.py and the pinned-transport tests keep using it from there.
+]
+
+[tool.hatch.version]
+# ADR-0205 D3. The version comes from the nearest `v*` tag; `autoops.__version__` reads it back out
+# of the installed distribution's metadata at runtime.
+source = "vcs"
+# BOTH the describe glob AND the regex are constrained to `v*`, and BOTH are load-bearing. This
+# tree carries 15 non-release tags -- `gate-combined-8dc7c554`, `archive/estate-gate-6ee92ef`,
+# `rescue/worktree-prune-2026-08-25/...` -- and setuptools-scm's DEFAULT_DESCRIBE glob is
+# `*[0-9]*`, which matches them.
+#
+# ⚑ MEASURED end to end on 2026-08-31, in a scratch repository holding `v0.1.0` and then
+# `gate-combined-8dc7c554` one commit later, exactly the shape a merge would produce here:
+#
+#   git describe --tags --long --match '*[0-9]*'  ->  gate-combined-8dc7c554-0-g528b1e0
+#   git describe --tags --long --match 'v[0-9]*'  ->  v0.1.0-1-g528b1e0
+#   uv build, WITH these two lines     ->  autoops-0.1.1.dev1+g528b1e09-py3-none-any.whl
+#   uv build, with the defaults        ->  ValueError: Error getting the version from source
+#                                          `vcs`: Can't parse version from tag
+#                                          'gate-combined-8dc7c554'
+#
+# So the default configuration REFUSES rather than lying, which is the better of the two failures
+# -- but it refuses at release time, on a tag push, with the release half-made. `tag-pattern`
+# alone cannot prevent it: `git describe` has already chosen the wrong tag by the time the regex
+# sees the result, and a tag the regex rejects is an error, not a fallback.
+#
+# A LATENT trap today, not an active one: `git tag --merged HEAD` is empty, so none of the 15 is
+# reachable from this branch yet. It is closed now because the merge that makes one reachable will
+# not announce itself.
+tag-pattern = '^v(?P<version>[0-9]+\.[0-9]+\.[0-9]+.*)$'
+raw-options = { git_describe_command = [
+  "git", "describe", "--dirty", "--tags", "--long", "--match", "v[0-9]*", "--abbrev=8",
+] }
+# Used ONLY where there is neither VCS metadata nor sdist PKG-INFO -- the container build, whose
+# context excludes `.git` (`.dockerignore`). Declared here so the fallback has exactly one home
+# rather than being duplicated into the Dockerfile. `.github/workflows/release.yml` ASSERTS the
+# built wheel carries the pushed tag, so this string can never silently reach PyPI.
+fallback-version = "0.1.0.dev0"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/autoops"]
+
+[tool.hatch.build.targets.sdist]
+# ⚑ DENY BY DEFAULT, exactly as `.dockerignore` does for the image (ADR-0205 D2), and for the same
+# reason. The wheel target above bounds the wheel; nothing bounded the sdist, and hatchling's
+# default sdist is the whole project directory. Measured before this section existed:
+#
+#   autoops_sre-*.tar.gz   120,019,386 bytes   vs the wheel's 1,590,905
+#   evidence/ 1,934 entries · artifacts/ 1,677 · docs/ 1,321 · deploy/ 562 · tests/ 416 · src/ 222
+#   393 files inside it carrying the production control-plane IP
+#
+# `uv build` builds the sdist and then builds the WHEEL FROM IT, so an over-narrow list here fails
+# the build loudly rather than shipping something short. These are the same five paths the image
+# ships, which keeps one answer to "what leaves this repository" instead of two.
+include = ["/src", "/README.md", "/LICENSE", "/uv.lock"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py312"
+# `operators/` is out-of-tree live-crossing code (NOT shipped in the wheel), held to the same lint
+# bar as `src`/`tests` — see operators/__init__.py for why it lives outside `src/`.
+src = ["src", "tests", "operators"]
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "N", "UP", "B", "S", "C4", "C90", "SIM", "RUF"]
+# S101 (assert) is expected in tests; S603/S607 reviewed case-by-case when subprocess lands.
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = ["S101"]
+
+[tool.ruff.lint.mccabe]
+max-complexity = 10
+
+[tool.mypy]
+python_version = "3.12"
+strict = true
+warn_unreachable = true
+warn_redundant_casts = true
+plugins = ["pydantic.mypy"]
+# `operators/` (the out-of-`src/` live-crossing transport) is type-checked strictly alongside `src`.
+files = ["src", "operators"]
+
+[[tool.mypy.overrides]]
+# aiopslab is the cluster-only benchmark dependency, imported lazily by eval/runner.py and not
+# installed in CI (it needs a live Kubernetes cluster). Don't fail strict mode on its absence.
+module = ["aiopslab.*"]
+ignore_missing_imports = true
+
+[[tool.mypy.overrides]]
+# cedarpy ships py.typed + inline annotations, so this is belt-and-braces in case a future
+# release drops them. The Cedar PDP (policy/cedar_guard.py) is the only importer.
+module = ["cedarpy.*"]
+ignore_missing_imports = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+# Repo root on the path so tests can import the out-of-`src/` `operators` package. Coverage stays
+# scoped to `autoops` (below), so operator code is exercised but never counts toward the 90% gate.
+pythonpath = ["."]
+addopts = "--cov=autoops --cov-report=term-missing --cov-fail-under=90 -q"
+
+[tool.coverage.run]
+source = ["autoops"]
+branch = true
+
+[tool.bandit]
+exclude_dirs = ["tests"]