Call before editing files: returns the rules for files (default: the git diff), ranked by fitness within the token budget, and records this session's scan and rule exposure. Mandatory rules (gates, invariants) take at most two slots (the excess is in omitted_mandatory) and are served from the reviewed base, so branch-local edits to them do not bind and are listed in unreviewed_rules. Use aegis_list_rules to browse without recording and aegis_report_outcome after verifying. Fails closed if a rule file cannot be loaded.

Call after verifying a change with tests or aegis check, naming rules from aegis_scan; use aegis_capture_insight for user corrections. With a passing aegis check --record --tests row for the current tree, the rules this session's scans exposed that match the diff are credited, counting once CI passes on the landing commit; without one, it writes at most one unwitnessed claim per session and tree, which earns no credit. Capped at 200 report rows per session and rate-limited to 5 calls per 60 seconds.

Builds a prompt for drafting a rule from description, with up to three active workspace rules (500 chars each) as examples; it writes nothing to disk. Save the result to .aegis/rules/<type_dir>/<id>.md as instruction says. Check aegis_list_rules for an existing rule first.

Lists every rule with metadata and ledger fitness (_error if unloadable, _expired: true if retired), the stale_rules edited since the last aegis sync, and non-rule files under .aegis/rules/ (ignored). Records no scan or exposure: call aegis_scan before editing files.

Appends a user correction or preference to ~/.aegis/insights/ for rule curation; use aegis_report_outcome to report whether rules helped. Secrets are redacted, quote is cut to 300 characters and paths default to the dirty git paths. Agent captures stay at level: 'suggestion': invisible to aegis_scan, never counted by aegis rule insight review, never upgraded. Capped at 50 captures per session and rate-limited to 5 calls per 60 seconds.