Aegis Production Ops

Invariant

Preserve this chain:

intent -> deterministic analyzer -> local model review -> deterministic policy -> signed execution plan -> constrained executor -> audit log

The local model is a reviewer only. It must not approve execution, generate argv, or run commands.

Agent Rules

• Never run direct mutation: sudo, apt-get install, apt-get upgrade, npm install, pip install, docker pull, podman pull, go get, cargo install, lifecycle scripts, or curl | bash.
• Use Aegis planning commands first, such as aegis apt install <pkg> --plan or aegis apt upgrade --plan.
• Run aegis review <plan.json> only for advisory risk classification.
• Run aegis policy <plan.json> for the deterministic decision.
• Use aegisctl sign only when the policy result is not deny and required approvals/snapshots are satisfied.
• Use aegisctl apply --execution-plan <file> --public-key-hex <key> to submit to aegisd; do not bypass the daemon on production hosts.
• Treat provenance gaps, unsigned repositories, mutable container tags, direct artifact paths, critical vulnerabilities, package removals, downgrades, kernel changes, and suspicious scripts as blockers unless policy explicitly allows a signed approval path.