The repository ships a fixture subscription (14 resources, a 3-day cost export, a metrics dump) so the whole pipeline runs offline.

# 1. audit the fixtures and write a report + an executable plan
PYTHONPATH=src python3 -m costwatchdog.cli audit \
  --cost-csv examples/cost-export.csv \
  --inventory examples/inventory.json \
  --metrics examples/metrics.json \
  --policy examples/policy.json \
  --today 2026-10-27 \
  --format both --out reports/report.md --plan-out reports/plan.json

# 2. read reports/report.md, then dry-run the plan (this executes nothing)
PYTHONPATH=src python3 -m costwatchdog.cli apply --plan reports/plan.json

audit is read-only everywhere: even in live mode it never changes anything.

The fixture audit finds five things it would do now, one that needs a human, and three it only reports — including a VM protected by tag, a resource group on the deny list, and a $70/month VM with no telemetry that it deliberately refuses to guess about.

Exit codes: 0 fine, 2 usage/configuration problem, 3 waste budget exceeded, 4 an action failed. --fail-on-waste turns the audit into a CI gate.

---