bind9-aiops 0.2.0__py3-none-any.whl

bind9_aiops/__init__.py

@@ -0,0 +1,8 @@
+"""BIND 9 AIops: governed read-only DNS operations."""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("bind9-aiops")
+except PackageNotFoundError:
+    __version__ = "0.0.0+unknown"

bind9_aiops/cli/__init__.py

@@ -0,0 +1,9 @@
+"""CLI package for bind9-aiops.
+
+Re-exports ``app`` so the pyproject entry point
+``bind9-aiops = "bind9_aiops.cli:app"`` works unchanged.
+"""
+
+from bind9_aiops.cli._root import app
+
+__all__ = ["app"]

bind9_aiops/cli/_common.py

@@ -0,0 +1,118 @@
+"""Shared helpers for bind9-aiops CLI sub-modules."""
+
+from __future__ import annotations
+
+import functools
+from collections.abc import Callable
+from typing import Annotated, Any
+
+import typer
+from rich.console import Console
+from rich.markup import escape
+
+console = Console()
+
+# ─── Shared Option types ───────────────────────────────────────────────────
+
+TargetOption = Annotated[str | None, typer.Option("--target", "-t", help="Target name from config")]
+DryRunOption = Annotated[
+    bool, typer.Option("--dry-run", help="Print the API call without executing")
+]
+
+
+def _cli_error_types() -> tuple[type[BaseException], ...]:
+    """Exceptions translated to a one-line teaching error instead of a traceback.
+
+    ``BudgetExceeded`` (and the retained ``PolicyDenied`` type) are raised by
+    ``@governed_tool`` OUTSIDE the tool body, so ``tool_errors`` never sees them
+    and they never arrive as an ``{"error": ...}`` dict. Their message is the
+    teaching text (e.g. which budget was hit) — without them here such a refusal
+    reaches the CLI as a traceback instead.
+    """
+    from bind9_aiops.connection import BindCommandError
+    from bind9_aiops.governance import BudgetExceeded, PolicyDenied
+
+    return (BindCommandError, PolicyDenied, BudgetExceeded, KeyError, OSError, ValueError)
+
+
+def cli_errors(fn: Callable) -> Callable:
+    """Translate known exceptions into one red line + exit code 1."""
+
+    @functools.wraps(fn)
+    def wrapper(*args: Any, **kwargs: Any) -> Any:
+        try:
+            return fn(*args, **kwargs)
+        except (typer.Exit, typer.Abort):
+            raise
+        except _cli_error_types() as e:
+            message = str(e)
+            if isinstance(e, KeyError):
+                message = f"Missing required key or environment variable: {message}"
+            # Upstream text can contain "[/bold]"; unescaped, rich raises on it and the
+            # real error is replaced by a MarkupError traceback.
+            console.print(f"[red]Error: {escape(message)}[/]")
+            raise typer.Exit(1) from e
+
+    return wrapper
+
+
+#: Exit status for a write whose outcome could not be determined — kept distinct
+#: from 0 (confirmed) and 1 (failed) so a script can tell all three apart.
+EXIT_UNDETERMINED = 2
+
+
+def governed(result: Any) -> dict:
+    """Return a governed tool's result, or print its error and exit 1.
+
+    The ``bind9_aiops.mcp_server.tools`` twins never raise: ``@tool_errors`` flattens every
+    failure — an unreachable service, a refused login, a bad argument — into
+    ``{"error": ...}``. A CLI command that drops that on the floor prints an empty
+    table and exits 0 as if the service had nothing to report. Route every governed
+    call through here.
+    """
+    # ``outcomeUnknown`` is judged BEFORE ``error``, matching the harness: a
+    # write whose response was lost carries BOTH keys, and it is audited
+    # `unknown` precisely because it may have taken effect. Reporting that as a
+    # plain failure would tell a script the change did not happen and invite the
+    # double-apply the payload's own note warns about.
+    if isinstance(result, dict) and result.get("outcomeUnknown"):
+        console.print(f"[yellow]Outcome undetermined: {escape(str(result.get('note') or ''))}[/]")
+        raise typer.Exit(EXIT_UNDETERMINED)
+    if isinstance(result, dict) and result.get("error"):
+        console.print(f"[red]Error: {escape(str(result['error']))}[/]")
+        raise typer.Exit(1)
+    return result if isinstance(result, dict) else {}
+
+
+def dry_run_print(*, operation: str, api_call: str, parameters: dict | None = None) -> None:
+    """Print a dry-run preview of the API call that would be made."""
+    console.print("\n[bold magenta][DRY-RUN] No changes will be made.[/]")
+    console.print(f"[magenta]  Operation: {operation}[/]")
+    console.print(f"[magenta]  API Call:  {api_call}[/]")
+    for k, v in (parameters or {}).items():
+        console.print(f"[magenta]  Param:     {k} = {v}[/]")
+    console.print("[magenta]  Run without --dry-run to execute.[/]\n")
+
+
+def double_confirm(action: str, resource: str) -> None:
+    """Require two confirmations for a destructive operation."""
+    console.print(f"[bold yellow]⚠️  About to: {action} '{resource}'[/]")
+    typer.confirm(f"Confirm 1/2: {action} '{resource}'?", abort=True)
+    typer.confirm(
+        f"Confirm 2/2: really {action} '{resource}'? This may be irreversible.",
+        abort=True,
+    )
+
+
+def print_truncation_note(result: dict, noun: str) -> None:
+    """Print a visible warning when a listing envelope was capped.
+
+    The JSON already carries ``truncated``, but a human scrolling a long dump
+    will not spot it — and neither will a model summarising the terminal. Say
+    it in words, on the last line, where it cannot be missed.
+    """
+    if isinstance(result, dict) and result.get("truncated"):
+        console.print(
+            f"[yellow]… showing {result.get('returned')} of more {noun} — "
+            f"truncated, re-run with a higher --limit[/]"
+        )

bind9_aiops/cli/_root.py

@@ -0,0 +1,249 @@
+"""BIND 9 AIops CLI; each server operation calls its governed MCP twin."""
+
+from __future__ import annotations
+
+import json
+import sys
+from typing import Annotated
+
+import typer
+import yaml
+
+from bind9_aiops.cli._common import cli_errors, console, double_confirm, governed
+from bind9_aiops.cli.undo import undo_app
+from bind9_aiops.governance.paths import ops_home
+
+app = typer.Typer(name="bind9-aiops", no_args_is_help=True, help="Audited BIND 9 DNS diagnosis.")
+app.add_typer(undo_app, name="undo")
+Target = Annotated[str | None, typer.Option("--target", "-t", help="Configured BIND 9 target")]
+
+
+def _print(result: dict) -> None:
+    console.print_json(json.dumps(governed(result)))
+
+
+@app.command("fetch-limits")
+@cli_errors
+def fetch_limits(target: Target = None) -> None:
+    """Show recursive fetch limit hits."""
+    from bind9_aiops.mcp_server.tools.dns import bind_fetch_limits
+    _print(bind_fetch_limits(target=target))
+
+
+@app.command("security-roots")
+@cli_errors
+def security_roots(target: Target = None) -> None:
+    """Show DNSSEC trust anchors through rndc, without a dump file."""
+    from bind9_aiops.mcp_server.tools.dns import bind_security_roots
+    _print(bind_security_roots(target=target))
+
+
+@app.command("tcp-timeouts")
+@cli_errors
+def tcp_timeouts(target: Target = None) -> None:
+    """Show current DNS TCP timeouts."""
+    from bind9_aiops.mcp_server.tools.dns import bind_tcp_timeouts
+    _print(bind_tcp_timeouts(target=target))
+
+
+@app.command("signing-status")
+@cli_errors
+def signing_status(zone: str, target: Target = None) -> None:
+    """Show DNSSEC signing state for a zone."""
+    from bind9_aiops.mcp_server.tools.dns import bind_signing_status
+    _print(bind_signing_status(zone=zone, target=target))
+
+
+@app.command("dnssec-zone")
+@cli_errors
+def dnssec_zone(zone: str, target: Target = None) -> None:
+    """Show DNSSEC signing status for a zone."""
+    from bind9_aiops.mcp_server.tools.dns import bind_dnssec_zone_status
+    _print(bind_dnssec_zone_status(zone=zone, target=target))
+
+
+@app.command("managed-keys")
+@cli_errors
+def managed_keys(target: Target = None) -> None:
+    """Show managed DNSSEC trust-key status."""
+    from bind9_aiops.mcp_server.tools.dns import bind_managed_keys_status
+    _print(bind_managed_keys_status(target=target))
+
+
+@app.command("serve-stale")
+@cli_errors
+def serve_stale(target: Target = None) -> None:
+    """Show serve-stale mode."""
+    from bind9_aiops.mcp_server.tools.dns import bind_serve_stale_status
+    _print(bind_serve_stale_status(target=target))
+
+
+@app.command("show-zone")
+@cli_errors
+def show_zone(zone: str, target: Target = None) -> None:
+    """Show running zone configuration when enabled."""
+    from bind9_aiops.mcp_server.tools.dns import bind_show_zone
+    _print(bind_show_zone(zone=zone, target=target))
+
+
+@app.command("query-server")
+@cli_errors
+def query_server(name: str, server: str, rrtype: str = "A", target: Target = None) -> None:
+    """Query a specified DNS server."""
+    from bind9_aiops.mcp_server.tools.dns import bind_query_server
+    _print(bind_query_server(name=name, server=server, rrtype=rrtype, target=target))
+
+
+@app.command("reload-zone")
+@cli_errors
+def reload_zone(zone: str, dry_run: bool = False, target: Target = None) -> None:
+    """Check config, then queue a zone reload."""
+    from bind9_aiops.mcp_server.tools.dns import bind_reload_zone
+    if not dry_run:
+        double_confirm("reload zone", zone)
+    _print(bind_reload_zone(zone=zone, dry_run=dry_run, target=target))
+
+
+@app.command("refresh-zone")
+@cli_errors
+def refresh_zone(zone: str, dry_run: bool = False, target: Target = None) -> None:
+    """Request a secondary zone refresh."""
+    from bind9_aiops.mcp_server.tools.dns import bind_refresh_zone
+    if not dry_run:
+        double_confirm("refresh zone", zone)
+    _print(bind_refresh_zone(zone=zone, dry_run=dry_run, target=target))
+
+
+@app.command("flush-name")
+@cli_errors
+def flush_name(name: str, dry_run: bool = False, target: Target = None) -> None:
+    """Flush one name from the DNS cache."""
+    from bind9_aiops.mcp_server.tools.dns import bind_flush_name
+    if not dry_run:
+        double_confirm("flush cached name", name)
+    _print(bind_flush_name(name=name, dry_run=dry_run, target=target))
+
+
+@app.command("retransfer-zone")
+@cli_errors
+def retransfer_zone(zone: str, dry_run: bool = False, target: Target = None) -> None:
+    """Request a fresh transfer of one secondary zone."""
+    from bind9_aiops.mcp_server.tools.dns import bind_retransfer_zone
+    if not dry_run:
+        double_confirm("retransfer secondary zone", zone)
+    _print(bind_retransfer_zone(zone=zone, dry_run=dry_run, target=target))
+
+
+@app.command("notify-zone")
+@cli_errors
+def notify_zone(zone: str, dry_run: bool = False, target: Target = None) -> None:
+    """Resend NOTIFY for one zone."""
+    from bind9_aiops.mcp_server.tools.dns import bind_notify_zone
+    if not dry_run:
+        double_confirm("resend zone NOTIFY", zone)
+    _print(bind_notify_zone(zone=zone, dry_run=dry_run, target=target))
+
+
+@app.command("init")
+@cli_errors
+def init() -> None:
+    """Configure a local BIND 9 service target."""
+    name = typer.prompt("Target name", default="local")
+    server = typer.prompt("DNS server address", default="127.0.0.1")
+    from bind9_aiops.config import TargetConfig
+
+    chosen = TargetConfig(name=name, server=server)
+    path = ops_home() / "config.yaml"
+    path.parent.mkdir(parents=True, exist_ok=True)
+    if path.exists():
+        raise ValueError(f"Config already exists at {path}; edit it to add a target.")
+    path.write_text(yaml.safe_dump({"targets": [{"name": chosen.name, "server": chosen.server}]}))
+    path.chmod(0o600)
+    console.print(f"Configured {name} at {path}")
+
+
+@app.command("status")
+@cli_errors
+def status(target: Target = None) -> None:
+    """Show named status."""
+    from bind9_aiops.mcp_server.tools.dns import bind_status
+
+    _print(bind_status(target=target))
+
+
+@app.command("config-check")
+@cli_errors
+def config_check(target: Target = None) -> None:
+    """Validate config and zone files."""
+    from bind9_aiops.mcp_server.tools.dns import bind_config_check
+
+    _print(bind_config_check(target=target))
+
+
+@app.command("zone-status")
+@cli_errors
+def zone_status(zone: str, target: Target = None) -> None:
+    """Show live zone status."""
+    from bind9_aiops.mcp_server.tools.dns import bind_zone_status
+
+    _print(bind_zone_status(zone=zone, target=target))
+
+
+@app.command("dnssec")
+@cli_errors
+def dnssec(target: Target = None) -> None:
+    """Show DNSSEC validation status."""
+    from bind9_aiops.mcp_server.tools.dns import bind_dnssec_validation
+
+    _print(bind_dnssec_validation(target=target))
+
+
+@app.command("query")
+@cli_errors
+def query(name: str, rrtype: str = "A", target: Target = None) -> None:
+    """Query a DNS record."""
+    from bind9_aiops.mcp_server.tools.dns import bind_query
+
+    _print(bind_query(name=name, rrtype=rrtype, target=target))
+
+
+@app.command("compare-soa")
+@cli_errors
+def compare_soa(zone: str, secondary: str, target: Target = None) -> None:
+    """Compare primary and secondary SOA serials."""
+    from bind9_aiops.mcp_server.tools.dns import bind_compare_soa
+
+    _print(bind_compare_soa(zone=zone, secondary=secondary, target=target))
+
+
+@app.command("diagnose")
+@cli_errors
+def diagnose(zone: str, target: Target = None) -> None:
+    """Diagnose a BIND 9 zone."""
+    from bind9_aiops.mcp_server.tools.dns import bind_diagnose_zone
+
+    _print(bind_diagnose_zone(zone=zone, target=target))
+
+
+@app.command("doctor")
+@cli_errors
+def doctor(target: Target = None) -> None:
+    """Test access to rndc status."""
+    from bind9_aiops.mcp_server.tools.dns import bind_status
+
+    _print(bind_status(target=target))
+
+
+@app.command("mcp")
+@cli_errors
+def mcp_cmd() -> None:
+    """Start stdio MCP server."""
+    if sys.version_info < (3, 11):
+        raise typer.Exit(2)
+    from bind9_aiops.mcp_server.server import main
+
+    main()
+
+
+if __name__ == "__main__":
+    app()

bind9_aiops/cli/undo.py

@@ -0,0 +1,66 @@
+"""``bind9-aiops undo`` — list recorded undo tokens and apply them.
+
+Real execution is delegated to the ``@governed_tool``-wrapped functions in
+``bind9_aiops.mcp_server.tools.undo`` so an applied undo is audited on the SAME governance
+path as any other write (the inverse tool it dispatches is itself governed).
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Annotated
+
+import typer
+
+from bind9_aiops.cli._common import (
+    DryRunOption,
+    TargetOption,
+    cli_errors,
+    console,
+    double_confirm,
+    dry_run_print,
+    governed,
+    print_truncation_note,
+)
+
+undo_app = typer.Typer(
+    name="undo",
+    help="List recorded undo tokens and apply their inverse operations.",
+    no_args_is_help=True,
+)
+
+UndoIdArg = Annotated[str, typer.Argument(help="Undo id from 'undo list'")]
+
+
+@undo_app.command("list")
+@cli_errors
+def undo_list_cmd(
+    limit: Annotated[int, typer.Option("--limit", help="Max tokens to show")] = 50,
+    target: TargetOption = None,
+) -> None:
+    """List recorded, not-yet-applied undo tokens."""
+    from bind9_aiops.mcp_server.tools import undo as gov
+
+    result = governed(gov.undo_list(limit=limit, target=target))
+    console.print_json(json.dumps(result))
+    print_truncation_note(result, "undo tokens")
+
+
+@undo_app.command("apply")
+@cli_errors
+def undo_apply_cmd(
+    undo_id: UndoIdArg, target: TargetOption = None, dry_run: DryRunOption = False
+) -> None:
+    """Apply a recorded undo (dispatches its inverse tool; dry-run + confirm)."""
+    from bind9_aiops.mcp_server.tools import undo as gov
+
+    if dry_run:
+        preview = governed(gov.undo_apply(undo_id=undo_id, dry_run=True, target=target))
+        dry_run_print(
+            operation="undo_apply",
+            api_call=f"inverse: {preview.get('wouldApply', {}).get('tool', '?')}",
+            parameters=preview.get("wouldApply", {}).get("params", {}),
+        )
+        return
+    double_confirm("apply undo", undo_id)
+    console.print_json(json.dumps(governed(gov.undo_apply(undo_id=undo_id, target=target))))

bind9_aiops/config.py

@@ -0,0 +1,58 @@
+"""Local BIND 9 target configuration."""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from pathlib import Path
+
+import yaml
+
+from bind9_aiops.governance.paths import ops_home
+
+
+@dataclass(frozen=True)
+class TargetConfig:
+    name: str
+    server: str = "127.0.0.1"
+    dns_port: int = 53
+    rndc_config: str | None = None
+    named_config: str | None = None
+    timeout: float = 10.0
+    rndc_bin: str = "rndc"
+    checkconf_bin: str = "named-checkconf"
+    dig_bin: str = "dig"
+
+    def __post_init__(self) -> None:
+        if not self.name or not self.server or self.server.startswith("-"):
+            raise ValueError("name and server are required; server cannot start with '-'.")
+        if not 1 <= self.dns_port <= 65535 or self.timeout <= 0:
+            raise ValueError("dns_port must be 1–65535 and timeout must be positive.")
+        for binary in (self.rndc_bin, self.checkconf_bin, self.dig_bin):
+            if not binary or binary.startswith("-"):
+                raise ValueError("Command binaries must be configured by the operator.")
+
+
+@dataclass(frozen=True)
+class AppConfig:
+    targets: tuple[TargetConfig, ...] = ()
+
+    def get_target(self, name: str | None = None) -> TargetConfig:
+        if name is None:
+            if not self.targets:
+                raise ValueError("No BIND 9 target configured. Run 'bind9-aiops init'.")
+            return self.targets[0]
+        for target in self.targets:
+            if target.name == name:
+                return target
+        raise KeyError(f"Unknown BIND 9 target '{name}'.")
+
+
+def load_config(path: Path | None = None) -> AppConfig:
+    path = path or Path(os.environ.get("BIND9_AIOPS_CONFIG", ops_home() / "config.yaml"))
+    if not path.is_file():
+        raise FileNotFoundError(f"No BIND 9 config at {path}. Run 'bind9-aiops init'.")
+    raw = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
+    if not isinstance(raw, dict) or not isinstance(raw.get("targets"), list):
+        raise ValueError("BIND 9 config must have a targets list.")
+    return AppConfig(tuple(TargetConfig(**entry) for entry in raw["targets"]))

bind9_aiops/connection.py

@@ -0,0 +1,119 @@
+"""Bounded execution of official BIND 9 administrative commands; no shell."""
+
+from __future__ import annotations
+
+import re
+import subprocess
+from typing import Any
+
+from bind9_aiops.config import AppConfig, TargetConfig, load_config
+
+_DOMAIN = re.compile(r"^(?:[A-Za-z0-9_*-]{1,63}\.)*[A-Za-z0-9_*-]{1,63}\.?$")
+_RRTYPES = {"A", "AAAA", "CNAME", "DNSKEY", "DS", "MX", "NS", "RRSIG", "SOA", "TXT"}
+_OUTPUT_MAX = 12000
+
+
+class BindCommandError(Exception):
+    pass
+
+
+class BindWriteUncertainError(BindCommandError):
+    """The rndc write may have reached named before the response was lost."""
+
+
+def domain(value: str) -> str:
+    if not _DOMAIN.fullmatch(value) or value.startswith("-") or ".." in value:
+        raise ValueError("Invalid DNS name; use a domain or host name without command options.")
+    return value
+
+
+class BindConnection:
+    def __init__(self, target: TargetConfig, runner: Any = subprocess.run) -> None:
+        self.target = target
+        self._run = runner
+
+    def _command(self, argv: list[str], *, write: bool = False) -> dict:
+        try:
+            result = self._run(
+                argv, capture_output=True, text=True, timeout=self.target.timeout, check=False
+            )
+        except FileNotFoundError as exc:
+            raise BindCommandError(
+                f"Missing BIND command '{argv[0]}'; install bind9 utilities or configure its path."
+            ) from exc
+        except subprocess.TimeoutExpired as exc:
+            error_type = BindWriteUncertainError if write else BindCommandError
+            raise error_type(
+                f"BIND command '{argv[0]}' timed out after {self.target.timeout:g}s."
+            ) from exc
+        if result.returncode != 0:
+            detail = (result.stderr or result.stdout or "unknown error")[:800]
+            raise BindCommandError(
+                f"BIND command '{argv[0]}' failed (exit {result.returncode}): {detail}"
+            )
+        output = result.stdout or ""
+        return {
+            "output": output[:_OUTPUT_MAX] + ("…" if len(output) > _OUTPUT_MAX else ""),
+            "truncated": len(output) > _OUTPUT_MAX,
+        }
+
+    def rndc(self, *arguments: str) -> dict:
+        argv = [self.target.rndc_bin]
+        if self.target.rndc_config:
+            argv.extend(["-c", self.target.rndc_config])
+        argv.extend(arguments)
+        return self._command(argv)
+
+    def rndc_write(self, *arguments: str) -> dict:
+        argv = [self.target.rndc_bin]
+        if self.target.rndc_config:
+            argv.extend(["-c", self.target.rndc_config])
+        argv.extend(arguments)
+        return self._command(argv, write=True)
+
+    def check_config(self) -> dict:
+        argv = [self.target.checkconf_bin, "-z"]
+        if self.target.named_config:
+            argv.append(self.target.named_config)
+        return self._command(argv)
+
+    def query(self, name: str, rrtype: str = "SOA", server: str | None = None) -> dict:
+        name = domain(name)
+        rrtype = rrtype.upper()
+        if rrtype not in _RRTYPES:
+            raise ValueError(f"Unsupported RR type '{rrtype}'.")
+        server = server or self.target.server
+        if not server or server.startswith("-") or any(c.isspace() for c in server):
+            raise ValueError("Invalid DNS server address.")
+        argv = [
+            self.target.dig_bin,
+            f"@{server}",
+            "-p",
+            str(self.target.dns_port),
+            name,
+            rrtype,
+            "+tries=1",
+            "+time=2",
+            "+noall",
+            "+comments",
+            "+answer",
+        ]
+        result = self._command(argv)
+        match = re.search(r"\bstatus:\s*([A-Z]+)", result["output"])
+        result.update(
+            {
+                "name": name,
+                "rrtype": rrtype,
+                "server": server,
+                "rcode": match.group(1) if match else None,
+            }
+        )
+        return result
+
+
+class ConnectionManager:
+    def __init__(self, config: AppConfig | None = None) -> None:
+        self.config = config or load_config()
+
+    def connect(self, target: str | None = None) -> BindConnection:
+        return BindConnection(self.config.get_target(target))

bind9_aiops/governance/__init__.py

@@ -0,0 +1,50 @@
+"""Governance harness for bind9-aiops — audit, policy, budget, undo, sanitize.
+
+A self-contained, vendored governance layer. bind9-aiops has NO dependency on
+any external skill family — this package is its own copy of the harness:
+
+  - ``@governed_tool`` — mandatory decorator on every MCP tool: policy pre-check,
+    token/runaway budget guard, graduated-autonomy risk-tier gate, audit logging,
+    and undo-token recording.
+  - unified SQLite audit log under ``~/.bind9-aiops/`` (override with
+    ``BIND9_AIOPS_HOME``).
+  - ``sanitize`` — output hygiene (encoding-level defense) for API-returned text.
+
+State lives under ``ops_home()`` (default ``~/.bind9-aiops``).
+"""
+
+from bind9_aiops.governance.audit import AuditEngine, get_engine
+from bind9_aiops.governance.budget import BudgetExceeded, BudgetTracker, get_budget
+from bind9_aiops.governance.decorators import PolicyDenied, governed_tool
+from bind9_aiops.governance.outcome import (
+    UNKNOWN_FIELD,
+    capture_prior_state,
+    is_unknown,
+    mark_unknown,
+)
+from bind9_aiops.governance.patterns import Pattern, PatternMatch, get_pattern_engine
+from bind9_aiops.governance.policy import get_policy_engine
+from bind9_aiops.governance.sanitize import opt_str, sanitize
+from bind9_aiops.governance.undo import UndoStore, get_undo_store
+
+__all__ = [
+    "governed_tool",
+    "sanitize",
+    "opt_str",
+    "capture_prior_state",
+    "mark_unknown",
+    "is_unknown",
+    "UNKNOWN_FIELD",
+    "PolicyDenied",
+    "get_engine",
+    "AuditEngine",
+    "get_policy_engine",
+    "get_budget",
+    "BudgetTracker",
+    "BudgetExceeded",
+    "get_undo_store",
+    "UndoStore",
+    "Pattern",
+    "PatternMatch",
+    "get_pattern_engine",
+]