cloudcleaner-agent 0.1.0__py3-none-any.whl

cloudcleaner/cli.py

@@ -0,0 +1,239 @@
+"""Command line entry point.
+
+    cloudcleaner scan                     what the account holds, and what it costs
+    cloudcleaner sweep                    investigate everything, approve nothing
+    cloudcleaner investigate <id>         one resource, with an approval prompt
+    cloudcleaner history                  past runs and realised savings
+    cloudcleaner doctor                   check credentials and configuration
+    cloudcleaner serve                    the HTTP API (needs the [server] extra)
+
+Every command is read-only unless you approve something, and even then
+CLOUDCLEANER_DRY_RUN defaults to true.
+"""
+
+import argparse
+import sys
+import uuid
+
+
+def _fmt(amount) -> str:
+    return f"${amount or 0:,.2f}"
+
+
+def cmd_scan(args) -> int:
+    from cloudcleaner.config import DRY_RUN, PROVIDER
+    from cloudcleaner.graph.nodes.detect import detect_node
+
+    scan = detect_node({})
+    rows = (scan.get("inventory") or []) + (scan.get("orphans") or [])
+    if not rows:
+        print("Nothing found. Either the account is empty or the credentials cannot see it.")
+        return 0
+
+    total = sum(r.estimated_monthly_cost or 0 for r in rows)
+    wasted = sum(r.estimated_monthly_cost or 0 for r in rows if r.billing_while_stopped)
+
+    print(f"provider={PROVIDER}  dry_run={DRY_RUN}\n")
+    print(f"{'RESOURCE':<26} {'TYPE':<6} {'STATE':<14} {'$/MO':>8}")
+    for r in sorted(rows, key=lambda r: -(r.estimated_monthly_cost or 0)):
+        flag = " *" if r.billing_while_stopped else ""
+        print(f"{r.resource_id:<26} {r.resource_type:<6} {(r.state or '-'):<14} "
+              f"{_fmt(r.estimated_monthly_cost):>8}{flag}")
+
+    print(f"\n{len(rows)} resources · {_fmt(total)}/mo total · {_fmt(wasted)}/mo not running "
+          f"but still billing (*)")
+    return 0
+
+
+def cmd_sweep(args) -> int:
+    """Assess every candidate. Approves nothing, so it is safe to run anywhere."""
+    from langgraph.types import Command
+
+    from cloudcleaner.config import DRY_RUN, PROVIDER
+    from cloudcleaner.graph.graph import graph
+    from cloudcleaner.graph.nodes.detect import detect_node
+
+    scan = detect_node({})
+    candidates = (scan.get("inventory") or []) + (scan.get("orphans") or [])
+    if not candidates:
+        print("Nothing to investigate.")
+        return 0
+
+    print(f"provider={PROVIDER}  dry_run={DRY_RUN}\n")
+    recoverable = 0.0
+
+    for resource in candidates:
+        config = {"configurable": {"thread_id": str(uuid.uuid4())}}
+        result = graph.invoke({**scan, "resource": resource}, config)
+        if result.get("__interrupt__"):
+            result = graph.invoke(Command(resume=""), config)
+
+        rec, plan = result.get("recommendation"), result.get("plan")
+        saving = sum(s.monthly_saving for s in plan.steps) if plan and plan.steps else 0.0
+        recoverable += saving
+
+        print(f"{resource.resource_id}  {resource.resource_type}/{resource.state}  "
+              f"{_fmt(resource.estimated_monthly_cost)}/mo")
+        if rec:
+            print(f"  -> {rec.action} ({rec.confidence:.0%}, {rec.severity}) {rec.reason}")
+        if plan and plan.blocked:
+            print(f"  -> blocked: {'; '.join(plan.blocked)}")
+        for s in (plan.steps if plan else []):
+            mark = "!" if not s.reversible else " "
+            print(f"   {mark} {s.order}. {s.action:<21} {s.resource_id:<22} "
+                  f"{_fmt(s.monthly_saving):>8}  {s.reason}")
+        print()
+
+    print(f"Recoverable: {_fmt(recoverable)}/month  ({_fmt(recoverable * 12)}/year)")
+    return 0
+
+
+def cmd_investigate(args) -> int:
+    from langgraph.types import Command
+
+    from cloudcleaner.config import DRY_RUN, PROVIDER
+    from cloudcleaner.graph.graph import graph
+    from cloudcleaner.graph.nodes.detect import detect_node
+    from cloudcleaner.graph.render import render_plan
+
+    scan = detect_node({})
+    pool = (scan.get("inventory") or []) + (scan.get("orphans") or [])
+    resource = next((r for r in pool if r.resource_id == args.resource_id), None)
+    if resource is None:
+        print(f"No resource {args.resource_id} in this account.", file=sys.stderr)
+        print("Run `cloudcleaner scan` to see what is visible.", file=sys.stderr)
+        return 1
+
+    print(f"provider={PROVIDER}  dry_run={DRY_RUN}\n")
+    config = {"configurable": {"thread_id": str(uuid.uuid4())}}
+    result = graph.invoke({**scan, "resource": resource, "force_plan": args.force_plan}, config)
+
+    while "__interrupt__" in result:
+        payload = result["__interrupt__"][0].value
+        if not sys.stdin.isatty():
+            print(render_plan(payload).rstrip() + "  [not a terminal, skipped]")
+            result = graph.invoke(Command(resume=""), config)
+            continue
+        result = graph.invoke(Command(resume=input(render_plan(payload))), config)
+
+    rec = result.get("recommendation")
+    if rec:
+        print(f"\nverdict  {rec.action} ({rec.confidence:.0%}, {rec.severity})")
+        print(f"         {rec.reason}")
+    for a in result.get("action_results") or []:
+        print(f"action   {a['action']} {a['resource_id']} -> {a['detail']}")
+    return 0
+
+
+def cmd_history(args) -> int:
+    from cloudcleaner.storage.repository import list_runs, totals
+
+    runs = list_runs(args.limit)
+    if not runs:
+        print("No runs recorded yet.")
+        return 0
+
+    t = totals()
+    print(f"{t['runs']} runs · {t['approved']} approved · {t['kept']} kept")
+    print(f"realised {_fmt(t['realised_monthly'])}/mo   "
+          f"simulated {_fmt(t['simulated_monthly'])}/mo (dry run, not saved)\n")
+
+    for r in runs:
+        outcome = (f"blocked: {r['blocked'][0]}" if r["blocked"]
+                   else f"{r['executed']}/{r['planned_steps']} steps" if r["executed"]
+                   else "no action")
+        print(f"{r['at'][:16]}  {r['resource_id']:<26} {str(r['verdict']):<10} {outcome}")
+    return 0
+
+
+def cmd_doctor(args) -> int:
+    """Check the things that actually stop this working."""
+    from cloudcleaner import config
+
+    ok = True
+    print(f"config file   {config.ENV_FILE or 'none found'}")
+    print(f"data dir      {config.DATA_DIR}")
+    print(f"provider      {config.PROVIDER}")
+    print(f"dry run       {config.DRY_RUN}")
+    print(f"model         {config.GROQ_MODEL if config.AI_ENABLED else 'disabled, rules only'}")
+    print()
+
+    def check(label, passed, hint=""):
+        nonlocal ok
+        ok = ok and passed
+        print(f"[{'ok ' if passed else 'FAIL'}] {label}" + (f"  — {hint}" if not passed else ""))
+
+    check("Groq key", bool(config.GROQ_API_KEY) or not config.AI_ENABLED,
+          "set GROQ_API_KEY, or CLOUDCLEANER_AI_ENABLED=false for rules only")
+
+    if config.PROVIDER == "fixture":
+        print("[ok ] AWS not needed — running against the built-in demo account")
+    else:
+        try:
+            from cloudcleaner.tools.aws.client import get_sts_client
+            who = get_sts_client().get_caller_identity()
+            check(f"AWS account {who['Account']}", True)
+        except Exception as e:
+            check("AWS credentials", False, str(e)[:80])
+
+    check("GitHub token", bool(config.GITHUB_TOKEN),
+          "optional — without it, code activity is skipped, not fatal")
+
+    return 0 if ok else 1
+
+
+def cmd_serve(args) -> int:
+    try:
+        import uvicorn  # noqa: F401
+    except ImportError:
+        print("The HTTP API needs the server extra:\n\n"
+              "    pip install 'cloudcleaner-agent[server]'\n", file=sys.stderr)
+        return 1
+
+    import uvicorn
+    uvicorn.run("cloudcleaner.server:app", host=args.host, port=args.port, reload=args.reload)
+    return 0
+
+
+def build_parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(
+        prog="cloudcleaner",
+        description="Find AWS resources nobody is using, prove it, and plan a safe teardown.",
+    )
+    sub = p.add_subparsers(dest="command", required=True)
+
+    sub.add_parser("scan", help="list resources and what they cost").set_defaults(fn=cmd_scan)
+    sub.add_parser("sweep", help="investigate every candidate").set_defaults(fn=cmd_sweep)
+
+    inv = sub.add_parser("investigate", help="investigate one resource")
+    inv.add_argument("resource_id")
+    inv.add_argument("--force-plan", action="store_true",
+                     help="plan a teardown even when the verdict is keep")
+    inv.set_defaults(fn=cmd_investigate)
+
+    hist = sub.add_parser("history", help="past runs and realised savings")
+    hist.add_argument("--limit", type=int, default=20)
+    hist.set_defaults(fn=cmd_history)
+
+    sub.add_parser("doctor", help="check credentials and configuration").set_defaults(fn=cmd_doctor)
+
+    serve = sub.add_parser("serve", help="run the HTTP API")
+    serve.add_argument("--host", default="0.0.0.0")
+    serve.add_argument("--port", type=int, default=8123)
+    serve.add_argument("--reload", action="store_true")
+    serve.set_defaults(fn=cmd_serve)
+
+    return p
+
+
+def main(argv=None) -> int:
+    args = build_parser().parse_args(argv)
+    try:
+        return args.fn(args)
+    except KeyboardInterrupt:
+        print("\ninterrupted", file=sys.stderr)
+        return 130
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

cloudcleaner/config.py

@@ -0,0 +1,103 @@
+"""Backend configuration.
+
+Paths are discovered rather than assumed, so the package works from a checkout,
+from any working directory, or installed into site-packages.
+"""
+
+import os
+from pathlib import Path
+
+from dotenv import load_dotenv
+
+SEARCH_DEPTH = 4
+
+
+def find_env_file() -> Path | None:
+    """Locate .env without assuming a git checkout.
+
+    Order: an explicit CLOUDCLEANER_ENV_FILE, then upwards from the working
+    directory, then upwards from this package, then ~/.cloudcleaner/.env. The
+    package walk keeps `uv run` working from inside agent/; the cwd walk is what
+    makes an installed copy usable from anywhere.
+    """
+    explicit = os.getenv("CLOUDCLEANER_ENV_FILE")
+    if explicit:
+        candidate = Path(explicit).expanduser()
+        return candidate if candidate.is_file() else None
+
+    for start in (Path.cwd(), Path(__file__).resolve().parent):
+        for directory in [start, *start.parents][:SEARCH_DEPTH]:
+            candidate = directory / ".env"
+            if candidate.is_file():
+                return candidate
+
+    home = Path.home() / ".cloudcleaner" / ".env"
+    return home if home.is_file() else None
+
+
+ENV_FILE = find_env_file()
+if ENV_FILE:
+    load_dotenv(ENV_FILE)
+
+
+def find_data_dir() -> Path:
+    """Where the database, reasoning log and restore recipes are written.
+
+    Beside the .env when there is one, so a checkout keeps using output/.
+    Otherwise ~/.cloudcleaner, so an installed copy never writes to
+    site-packages.
+    """
+    explicit = os.getenv("CLOUDCLEANER_DATA_DIR")
+    if explicit:
+        return Path(explicit).expanduser()
+    if ENV_FILE:
+        return ENV_FILE.parent / "output"
+    return Path.home() / ".cloudcleaner"
+
+
+DATA_DIR = find_data_dir()
+
+# Back-compat aliases. Prefer DATA_DIR for anything that writes.
+PROJECT_ROOT = ENV_FILE.parent if ENV_FILE else Path.cwd()
+APP_DIR = PROJECT_ROOT
+
+# Top-level constants for simple `from cloudcleaner.config import X` imports.
+AWS_REGION = os.getenv("AWS_REGION", "us-east-1")
+GROQ_API_KEY = os.getenv("GROQ_API_KEY")
+GROQ_MODEL = os.getenv("GROQ_MODEL", "openai/gpt-oss-20b")
+GITHUB_TOKEN = os.getenv("GITHUB_TOKEN")
+
+# Point boto3 at LocalStack instead of real AWS when set.
+AWS_ENDPOINT_URL = os.getenv("AWS_ENDPOINT_URL") or None
+
+# "aws" reads the live account; "fixture" runs offline against fixtures/demo.py.
+# Resolved at call time in tools/provider.py, so tests can flip it per-test.
+PROVIDER = os.getenv("CLOUDCLEANER_PROVIDER", "aws").lower()
+
+METRIC_WINDOW_DAYS = int(os.getenv("METRIC_WINDOW_DAYS", "7"))
+
+DRY_RUN = os.getenv("CLOUDCLEANER_DRY_RUN", "true").lower() not in ("false", "0", "no")
+
+# false = rules only; no resource metadata is sent to the LLM.
+AI_ENABLED = os.getenv("CLOUDCLEANER_AI_ENABLED", "true").lower() not in ("false", "0", "no")
+
+
+class Settings:
+    AWS_REGION: str = AWS_REGION
+    GROQ_API_KEY: str | None = GROQ_API_KEY
+    GROQ_MODEL: str = GROQ_MODEL
+    GITHUB_TOKEN: str | None = GITHUB_TOKEN
+
+    # Safety / Actions / Evaluation settings
+    DRY_RUN: bool = DRY_RUN
+    VERIFY_MAX_ATTEMPTS: int = int(os.getenv("CLOUDCLEANER_VERIFY_MAX_ATTEMPTS", "5"))
+    VERIFY_POLL_INTERVAL_SECONDS: float = float(
+        os.getenv("CLOUDCLEANER_VERIFY_POLL_INTERVAL", "2")
+    )
+    ROLLBACK_MAX_RETRIES: int = int(os.getenv("CLOUDCLEANER_ROLLBACK_MAX_RETRIES", "2"))
+    COST_APPROVAL_THRESHOLD_USD: float = float(
+        os.getenv("CLOUDCLEANER_COST_THRESHOLD_USD", "50")
+    )
+
+
+settings = Settings()

cloudcleaner/evidence/collector.py

@@ -0,0 +1,80 @@
+"""Reasoning trail.
+
+Every event is buffered for the current run, appended to a JSONL file for
+tailing, and flushed to SQLite when the run is recorded. The buffer is scoped
+to a run rather than the process, so one investigation never reports another's
+reasoning.
+"""
+
+import json
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+
+from cloudcleaner.config import DATA_DIR
+
+EVENT_TYPES = {"check", "finding", "skip", "decision", "action", "handoff", "error"}
+CORE_FIELDS = ("ts", "node", "event", "resource_id", "message")
+DEFAULT_LOG = DATA_DIR / "reasoning.jsonl"
+
+
+class ReasoningLog:
+    def __init__(self, path: Path | None = None):
+        self.path = path or DEFAULT_LOG
+        self.events: list[dict] = []
+
+    def start(self, truncate_file: bool = False):
+        """Begin a new run. The file is appended to unless asked to truncate."""
+        self.events = []
+        if not truncate_file:
+            return
+        try:
+            self.path.parent.mkdir(parents=True, exist_ok=True)
+            self.path.write_text("")
+        except OSError as e:
+            print(f"[reasoning] cannot open log: {e}", file=sys.stderr)
+
+    def emit(self, node: str, event: str, resource_id: str, message: str, **extra):
+        if event not in EVENT_TYPES:
+            event = "check"
+        record = {
+            "ts": datetime.now(timezone.utc).isoformat(),
+            "node": node,
+            "event": event,
+            "resource_id": resource_id,
+            "message": message,
+            **extra,
+        }
+        self.events.append(record)
+
+        try:
+            self.path.parent.mkdir(parents=True, exist_ok=True)
+            with self.path.open("a") as f:
+                f.write(json.dumps(record) + "\n")
+        except OSError as e:
+            print(f"[reasoning] write failed: {e}", file=sys.stderr)
+
+        return record
+
+    def flush(self, run_id: str, conn) -> int:
+        """Persist this run's events against the run that produced them."""
+        if not self.events:
+            return 0
+
+        conn.executemany(
+            """INSERT INTO events (run_id, at, node, event, resource_id, message, extra)
+               VALUES (?, ?, ?, ?, ?, ?, ?)""",
+            [
+                (
+                    run_id, e["ts"], e["node"], e["event"], e["resource_id"], e["message"],
+                    json.dumps({k: v for k, v in e.items() if k not in CORE_FIELDS}),
+                )
+                for e in self.events
+            ],
+        )
+        count = len(self.events)
+        self.events = []
+        return count
+
+
+log = ReasoningLog()

cloudcleaner/fixtures/demo.py

@@ -0,0 +1,97 @@
+"""Offline demo stack. Shapes match real describe_* responses so the graph cannot tell."""
+
+from cloudcleaner.schemas import CloudResource, GitHubEvidence
+
+INSTANCES = [
+    CloudResource(
+        resource_id="i-0abc123def456789", resource_type="ec2", region="us-east-1",
+        name="payments-poc", state="stopped", instance_type="t3.micro",
+        launch_time="2026-06-14T09:12:00+00:00",
+        project="payments", environment="dev", owner="hayden",
+        tags={"Name": "payments-poc", "Project": "payments",
+              "Environment": "dev", "Owner": "hayden", "Repo": "wkxcass/cloudcleaner-demo-payments"},
+    ),
+    CloudResource(
+        resource_id="i-0999prod888", resource_type="ec2", region="us-east-1",
+        name="checkout-api", state="running", instance_type="t3.medium",
+        launch_time="2026-02-01T08:00:00+00:00",
+        project="checkout", environment="prod", owner="team-payments",
+        tags={"Name": "checkout-api", "Environment": "prod", "Project": "checkout"},
+    ),
+]
+
+VOLUMES = [
+    CloudResource(
+        resource_id="vol-0a9b8c7d6", resource_type="ebs", region="us-east-1",
+        state="in-use", size_gb=16, attached_to="i-0abc123def456789",
+        delete_on_termination=False, estimated_monthly_cost=1.28,
+        billing_while_stopped=True, tags={"Name": "payments-poc-root"},
+    ),
+    CloudResource(
+        resource_id="vol-0orphan11", resource_type="ebs", region="us-east-1",
+        state="available", size_gb=100, estimated_monthly_cost=8.0,
+        billing_while_stopped=True, tags={"Name": "old-migration-scratch"},
+    ),
+    CloudResource(
+        resource_id="vol-0prod222", resource_type="ebs", region="us-east-1",
+        state="in-use", size_gb=50, attached_to="i-0999prod888",
+        delete_on_termination=True, estimated_monthly_cost=4.0,
+        billing_while_stopped=True, tags={"Name": "checkout-api-root"},
+    ),
+]
+
+ADDRESSES = [
+    CloudResource(
+        resource_id="eipalloc-0f2e3d4", resource_type="eip", region="us-east-1",
+        state="associated", public_ip="54.211.8.12", attached_to="i-0abc123def456789",
+        estimated_monthly_cost=3.65, billing_while_stopped=True,
+        tags={"Name": "payments-poc-ip", "AssociationId": "eipassoc-0c1b2a3"},
+    ),
+    CloudResource(
+        resource_id="eipalloc-0unused9", resource_type="eip", region="us-east-1",
+        state="unassociated", public_ip="3.91.44.7",
+        estimated_monthly_cost=3.65, billing_while_stopped=True, tags={},
+    ),
+]
+
+USAGE = {
+    "i-0abc123def456789": dict(avg_cpu_percent=0.4, max_cpu_percent=1.1, idle_days=41,
+                               network_in_bytes=2048.0, network_out_bytes=1024.0),
+    "i-0999prod888": dict(avg_cpu_percent=34.7, max_cpu_percent=81.2, idle_days=0,
+                          network_in_bytes=9.2e9, network_out_bytes=7.7e9),
+}
+
+# Matches the §5.2 demo narrative: "last commit 6 weeks ago, branch deleted, PR merged."
+GITHUB = {
+    "wkxcass/cloudcleaner-demo-payments": dict(
+        latest_commit_at="2026-07-20T10:00:00+00:00",
+        pr_number=42, pr_status="merged", branch="feature/payments-poc",
+        branch_exists=False, last_workflow_run_at="2026-07-20T10:30:00+00:00",
+        scheduled_workflow_exists=False,
+    ),
+}
+
+
+def list_ec2_instances():
+    return [i.model_copy(deep=True) for i in INSTANCES]
+
+
+def list_volumes(only_unattached: bool = False):
+    vols = [v.model_copy(deep=True) for v in VOLUMES]
+    return [v for v in vols if v.attached_to is None] if only_unattached else vols
+
+
+def list_elastic_ips():
+    return [a.model_copy(deep=True) for a in ADDRESSES]
+
+
+def get_ec2_usage_evidence(instance_id: str, days: int = 7):
+    from cloudcleaner.schemas import AWSEvidence
+    return AWSEvidence(metric_window_days=days, **USAGE.get(instance_id, {}))
+
+
+def get_github_evidence(repo: str | None = None):
+    from cloudcleaner.schemas import GitHubEvidence
+    if not repo:
+        return GitHubEvidence()
+    return GitHubEvidence(repo=repo, **GITHUB.get(repo, {}))

cloudcleaner/graph/graph.py

@@ -0,0 +1,101 @@
+from langgraph.checkpoint.memory import MemorySaver
+from langgraph.checkpoint.sqlite import SqliteSaver
+from langgraph.graph import END, START, StateGraph
+
+from cloudcleaner.graph.nodes.approval import approval_node
+from cloudcleaner.graph.nodes.assess import assess_node
+from cloudcleaner.graph.nodes.detect import detect_node
+from cloudcleaner.graph.nodes.execute import execute_node
+from cloudcleaner.graph.nodes.investigate import investigate_node
+from cloudcleaner.graph.nodes.plan import plan_node
+from cloudcleaner.graph.nodes.policy_check import policy_check_node
+from cloudcleaner.graph.nodes.record import record_node
+from cloudcleaner.graph.nodes.rollback import rollback_node
+from cloudcleaner.graph.nodes.verify import verify_node
+from cloudcleaner.graph.routing import (
+    route_after_assess,
+    route_after_detect,
+    route_after_plan,
+    route_after_approval,
+    route_after_policy_check,
+    route_after_verify,
+)
+from cloudcleaner.graph.state import CloudCleanerState
+
+
+def _default_checkpointer():
+    """Persist paused runs so an approval survives an agent restart.
+
+    Falls back to memory if the file cannot be opened - a demo on a read-only
+    filesystem should still work, it just forgets interrupted runs.
+    """
+    import sqlite3
+
+    from langgraph.checkpoint.serde.jsonplus import JsonPlusSerializer
+
+    from cloudcleaner.storage.db import DB_PATH
+
+    # Declare our own models rather than deserialising whatever the checkpoint
+    # file happens to contain.
+    from cloudcleaner import schemas
+
+    allowed = [
+        getattr(schemas, n) for n in dir(schemas)
+        if isinstance(getattr(schemas, n), type) and getattr(schemas, n).__module__
+        == "cloudcleaner.schemas"
+    ]
+    serde = JsonPlusSerializer(allowed_msgpack_modules=allowed)
+
+    try:
+        DB_PATH.parent.mkdir(parents=True, exist_ok=True)
+        conn = sqlite3.connect(DB_PATH, check_same_thread=False)
+        return SqliteSaver(conn, serde=serde)
+    except sqlite3.Error:
+        return MemorySaver(serde=serde)
+
+
+def build_graph(checkpointer=None):
+    builder = StateGraph(CloudCleanerState)
+
+    builder.add_node("detect", detect_node)
+    builder.add_node("investigate", investigate_node)
+    builder.add_node("assess", assess_node)
+    builder.add_node("policy_check", policy_check_node)
+    builder.add_node("plan", plan_node)
+    builder.add_node("approval", approval_node)
+    builder.add_node("execute", execute_node)
+    builder.add_node("verify", verify_node)
+    builder.add_node("rollback", rollback_node)
+    builder.add_node("record", record_node)
+
+    builder.add_edge(START, "detect")
+    builder.add_conditional_edges(
+        "detect", route_after_detect, {"investigate": "investigate", "end": END}
+    )
+    builder.add_edge("investigate", "assess")
+    builder.add_conditional_edges(
+        "assess", route_after_assess,
+        {"plan": "plan", "policy_check": "policy_check", "record": "record"}
+    )
+    builder.add_conditional_edges(
+        "plan", route_after_plan, {"policy_check": "policy_check", "record": "record"}
+    )
+    builder.add_conditional_edges(
+        "policy_check", route_after_policy_check,
+        {"approval": "approval", "execute": "execute", "record": "record"},
+    )
+    builder.add_conditional_edges(
+        "approval", route_after_approval,
+        {"approval": "approval", "execute": "execute", "record": "record"},
+    )
+    builder.add_edge("execute", "verify")
+    builder.add_conditional_edges(
+        "verify", route_after_verify, {"complete": "record", "rollback": "rollback"}
+    )
+    builder.add_edge("rollback", "record")
+    builder.add_edge("record", END)
+
+    return builder.compile(checkpointer=checkpointer or _default_checkpointer())
+
+
+graph = build_graph()