proxy-aiops 0.9.3__tar.gz → 0.9.4__tar.gz

{proxy_aiops-0.9.3 → proxy_aiops-0.9.4}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "proxy-aiops",
   "displayName": "Proxy AIops",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "description": "Governed Traefik + Caddy + HAProxy ops: routes, upstreams, certs, 5xx RCA. 28 tools.",
   "author": {
     "name": "Wei Zhou",

{proxy_aiops-0.9.3 → proxy_aiops-0.9.4}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "proxy-aiops==0.9.3",
+        "proxy-aiops==0.9.4",
         "proxy-aiops-mcp"
       ]
     }

{proxy_aiops-0.9.3 → proxy_aiops-0.9.4}/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v0.9.4 — 2026-09-17
+
+### Fixed
+- `agent-guardrails.md` promised, in the table headed "what the tool enforces — do not
+  waste prompt budget on these", that all four RCAs "rank findings worst-first" with
+  "priority in the payload". `backend_health_rca` sorts its findings on an internal score
+  removed before return, and `route_conflict_analysis` is in the proxy's own evaluation
+  order — route priority, which is not returned, and which is match order rather than
+  severity. `error_rate_rca` and `cert_expiry_sweep` are genuinely checkable (`errorRatePct`
+  with a `critical`/`warning` `severity`, and `daysToExpiry`), and the row now says only
+  that. The copyable system prompt gained a line about not reading priority off position.
+
 ## v0.9.3 — 2026-09-15
 
 ### Fixed

{proxy_aiops-0.9.3 → proxy_aiops-0.9.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: proxy-aiops
-Version: 0.9.3
+Version: 0.9.4
 Summary: Governed AI-ops for Traefik + Caddy + HAProxy reverse proxies / load balancers: routes, services, upstream health, TLS cert expiry sweep, 5xx error-rate RCA, route conflict analysis, and governed writes (caddy config, haproxy server state/weight) with a built-in governance harness (audit, budget, undo, risk tiers)
 Author-email: Wei Zhou <zhouwei008@gmail.com>
 License-Expression: MIT

{proxy_aiops-0.9.3 → proxy_aiops-0.9.4}/RELEASE_NOTES.md

@@ -1,5 +1,8 @@
 # Release notes — proxy-aiops 0.5.0
 
+> Historical — this file covers the 0.5.0 release only and is not updated.
+> For every release since, see [CHANGELOG.md](CHANGELOG.md) and the GitHub releases.
+
 Previous release: 0.4.0.
 
 ## BREAKING — the authorization layer is removed

{proxy_aiops-0.9.3 → proxy_aiops-0.9.4}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "proxy-aiops==0.9.3",
+        "proxy-aiops==0.9.4",
         "proxy-aiops-mcp"
       ]
     }

{proxy_aiops-0.9.3 → proxy_aiops-0.9.4}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/proxy-aiops",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "description": "Governed Traefik + Caddy + HAProxy ops: routes, upstreams, certs, 5xx RCA. 28 tools.",
   "private": true,
   "license": "MIT",

{proxy_aiops-0.9.3 → proxy_aiops-0.9.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "proxy-aiops"
-version = "0.9.3"
+version = "0.9.4"
 description = "Governed AI-ops for Traefik + Caddy + HAProxy reverse proxies / load balancers: routes, services, upstream health, TLS cert expiry sweep, 5xx error-rate RCA, route conflict analysis, and governed writes (caddy config, haproxy server state/weight) with a built-in governance harness (audit, budget, undo, risk tiers)"
 readme = "README.md"
 license = "MIT"

{proxy_aiops-0.9.3 → proxy_aiops-0.9.4}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/AIops-tools/Proxy-AIops",
     "source": "github"
   },
-  "version": "0.9.3",
+  "version": "0.9.4",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "proxy-aiops",
-      "version": "0.9.3",
+      "version": "0.9.4",
       "transport": {
         "type": "stdio"
       }

{proxy_aiops-0.9.3 → proxy_aiops-0.9.4}/skills/proxy-aiops/references/agent-guardrails.md

@@ -31,7 +31,7 @@ What the tool *does* guarantee is that you can always see what happened:
 |---|---|
 | "Don't invent a value when a field is missing" | Traefik, Caddy and HAProxy express the same concepts differently, so a field one platform has and another does not comes back as `null`, never as `""`. A Caddy route's `raw` rule string is `null` — Caddy matches on a match list and has no such string — rather than a misleading empty rule. |
 | "Tell me if the output was cut off" | `search_config`, `traffic_stats` and `error_counters` return `{"matches"/"services": [...], "returned": N, "limit": L, "truncated": true/false}` — one convention across the repo. Truncation is measured (the config walk deliberately overshoots by one) and not guessed from the count reaching the cap. |
-| "Preserve the ordering / tell me what's most urgent" | `backend_health_rca`, `error_rate_rca`, `route_conflict_analysis` and `cert_expiry_sweep` rank findings worst-first with the measured number attached. Priority is in the payload, not implied by list position. |
+| "Make it show the number it judged on" | `error_rate_rca` returns `errorRatePct`, `vsBaselineX` against the fleet baseline and a `severity` of `critical`/`warning` on every flagged service; `cert_expiry_sweep` returns `daysToExpiry` and a `bucket` per certificate, and orders by `daysToExpiry`. Both orderings are therefore checkable from the payload itself. |
 | "Confirm before anything destructive" | `delete_config_path` and `load_config` require a `--dry-run`-able preview plus double confirmation at the CLI. Config writes capture the prior value so the undo token can restore it. |
 | "Log what you did" | Every governed call is audited to `~/.proxy-aiops/audit.db` regardless of what the model says it did — and the CLI writes the same row the MCP path does, so there is no unaudited entry point. |
 | "Don't get stuck retrying" | The runaway guard trips a circuit breaker if the same call is hammered in a tight loop — a stuck agent is stopped rather than left to burn calls and time. |
@@ -39,6 +39,15 @@ What the tool *does* guarantee is that you can always see what happened:
 ## What still needs a prompt
 
 These are model-behaviour problems the harness cannot fix from the outside.
+
+⚠️ **Two of the four orderings cannot be checked, for different reasons.**
+`backend_health_rca` sorts its `findings` worst-first on an internal score that is removed
+before the payload is returned, and its findings carry neither a `rank` nor a `severity`.
+`route_conflict_analysis` is ordered by the proxy's own **evaluation order** (route priority,
+which is not returned) — that is match order, not severity: a shadowed route appearing first
+says nothing about how bad the shadowing is. `error_rate_rca` and `cert_expiry_sweep` are
+different: they sort on `errorRatePct` and `daysToExpiry`, both of which are in the payload.
+
 Copy this into your agent's system prompt:
 
 ```text
@@ -57,6 +66,10 @@ READING RESULTS
 - Read the whole result before concluding. If a result contains a "truncated"
   field that is true, say so and narrow the query instead of treating the
   partial result as complete.
+- `backend_health_rca` findings and `route_conflict_analysis` results are not ordered by
+  severity — the latter is in the proxy's match order. Weigh `backend_health_rca` findings on
+  their own `serversTotal`/`up`/`down`/`maint` counts. `route_conflict_analysis` results carry
+  no number at all — read `shadowedBy`, `reason` or `chain` and say which one you acted on.
 - A null field means this platform does not express that concept, or did not
   report it. Report it as "not available" — never infer it.
 - An "unsupported" field is a capability statement about the platform, not an

{proxy_aiops-0.9.3 → proxy_aiops-0.9.4}/uv.lock

@@ -529,7 +529,7 @@ wheels = [
 
 [[package]]
 name = "proxy-aiops"
-version = "0.9.3"
+version = "0.9.4"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },