Fast single-file gate. Run Aegis Ring 0 (syntax) + Ring 0.5 (structural signals + cost regression) + Ring 0.7 (security anti-patterns) on a proposed file write. Returns the decision without applying the change. Pure observation — never coaches the agent. Use this when the change is contained to one file or when speed matters more than cross-file safety.

Workspace-aware gate (Ring 0 + 0.5 + 0.7 + R2). Adds cross-file checks on top of validate_change: detects when a change introduces a module import cycle, or deletes a public symbol that other files in the workspace still reference. Slower than validate_change because it walks the workspace tree; prefer this when the change touches a public API or shared module.

Post-write attestation. Reads on-disk content of path and runs absolute checks (Ring 0 syntax + Ring 0.7 security + optional Ring R2 cycle). Use from PostToolUse hooks / CI / after any write that bypasses the pre-write gate. Writes the verdict to <workspace_root>/.aegis/attestations.jsonl for audit when workspace_root is provided.